last executing test programs:

737.997713ms ago: executing program 2 (id=2349):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000180)=0x7, 0x4)

736.000967ms ago: executing program 1 (id=2351):
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001600), 0x1}, 0x38)
r1 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0xc0}, &(0x7f00000002c0)=<r2=>0x0, &(0x7f0000000640)=<r3=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2f, 0x8, 0x0, 0x4}]}, 0x10)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x7b, 0x0, 0x0, 0x0, &(0x7f0000011000/0x4000)=nil, 0x4000, 0xc})
io_uring_enter(r1, 0x47bc, 0x20, 0x0, 0x0, 0x0)

681.023729ms ago: executing program 0 (id=2352):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0xd, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0xf}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x20000002}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xa6}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x34, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48)

680.785433ms ago: executing program 0 (id=2353):
r0 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0)
mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2000001, 0x13, r0, 0x1e67e000)
mremap(&(0x7f0000241000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000977000/0x1000)=nil)

616.779161ms ago: executing program 1 (id=2354):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0x4}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xd}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x5c}}, 0x0)

616.498671ms ago: executing program 2 (id=2355):
syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x11, &(0x7f0000000200)={[{@i_version}, {@debug}, {@delalloc}, {@oldalloc}, {@min_batch_time={'min_batch_time', 0x3d, 0x80000001}}, {@data_err_abort}]}, 0x1, 0x631, &(0x7f0000001940)="$eJzs3c1vVFUbAPDn3k6/3/edQt6ouJBGYyBRWlrAEGMC3bgiBD92riotBBkooTVaJLFNcGNi3LgwceVC/C+UxK0Lty7cuDIkxBgWYlDG3Jk7ZTrt9Hs6pf39kmnvndM557lNn54zZ86ZCWDPGsy+pBEHIuJaElGsKytEXjhY/bn7f9w8n92SKJff+j2Jmx8nc/V1Jfn3/vzB/xQj+SmN2N+xtN3p2RuXx0ulyev5+fDMlWvD07M3jly6Mn5x8uLk1dFXRk+eOH7i5MjRTV1fHtPf2Zczt977oPjp2Xe++ephMvLtL2eTOB2P8tiy62p8bPemWs5+Z4NRrnqwqCCNOLnJuneKP4u1v5OK7uwPIim0MyLWI42IUxHRGRFPRzE64nGyFuOTN9oaHNBS5SQqfdRgGdh7kmhadKkn/yexVE9LYwK2Q20cUHtuv9zz4KXSVg5JgG1yb6w6V1fN/c6IqOV/oTo3GD2VuYG++0n9PE9lXm1zM3NVWRs//nD2VnaLJvNwQGvMzddmuRv7/6SSmwNRfQ7Qdz9dlP9j+SggzV8neLOx4jVOng82nMt/2D5z8xHxTN7/d8Wa8z/Nc7eW/+9usH35DwAAAAAAAFvnzlhEvLzc+r90Yf1P1zLrf/oj4vQWtL/663/p3fwg2YLmgDr3xiJeW3b978Ia34GO/Oy/lfUAncmFS6XJoxHxv4g4HJ3d2flIQ731K4SPfLb/y2bt16//y25Z+7W1gHlNdwsNa4kmxmfGN3vdQMS9+YhnK+t/D+b3LF7/k/X/yTL9f5bf19bYxv4Xb59rVrZ6/gOtUv464tCy/f/j4Xay8vtzDFfGA8O1UcFSz330+XfN2pf/0D5Z/9+3cv53J/Xv1zO9vvq7IuLYbKHcrHyj4/+u5O2OWv2ZD8dnZq6PRHQlZ5beP7q+mGG3quVDLV+y/D/8wsrzfwvj/7o87I2IuTW2+dSj/l+blen/oX2y/J9Yuf8vLu7/138wenvg+2btn1tT/3+80qcfzu8x/wf1lr4fx1oTtC3hAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMATLo2I/0SSDi0cp+nQUER/RPw/+tLS1PTMSxem3r86kZVVPv8/rX3Sb7F6ntQ+/3+g7ny04fxYROyLiC86eivnQ+enShPtvngAAAAAAAAAAAAAAAAAAADYIfore/7L3Y37/zO/dbQ7OqDlCvl3+Q57T2HDjyx3b2kgwLbbeP4DT7L5deV/Z0tjAbZf8/x/8LBc0XD368+3PCZgexj/w961wfz3cgHsAvp/2KvWOKfX0+o4gHbQ/wMAAAAAwK6y7+Cdn5OImHu1t3LLdOVlvW2NDGi1tN0BAG1jDS/sXYWpdkcAtIsN/UCycPRX42b/iuar/5PWBAQAAAAAAAAAAAAALHHoQPP9//YGwO628v5/a/thN1th//9yye/tAmAXaf7RH/p+2O08xwdW6+3t/wcAAAAAAAAAAACAHaDnxuXxUmny+vTsk3dwameEsb6DufHN1VPu3glXsfjgUWtq7oyInXGBW3CQJVupNFkuR6z+w7W34GhjzO39twQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADz2bwAAAP///UcgJw==")

614.701778ms ago: executing program 0 (id=2356):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00'})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3)
sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x4, 0x4, 0x4, 0x10000, 0x808, 0xffffffffffffffff, 0x20000000, '\x00', 0x0, 0xffffffffffffffff, 0x3000000, 0xffffffff}, 0x50)
capset(&(0x7f0000000080)={0x20071026}, 0x0)
openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000000), 0x6bc440, 0x0)

614.390672ms ago: executing program 1 (id=2357):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0x74, 0x2c, 0xd27, 0x70bd25, 0x7ffd, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {}, {0xffff, 0x8}}, [@filter_kind_options=@f_route={{0xa}, {0x44, 0x2, [@TCA_ROUTE4_POLICE={0x40, 0x5, [@TCA_POLICE_TBF={0x3c, 0x1, {0x8, 0x20000000, 0x80000001, 0x1, 0x450b, {0x2, 0x0, 0xf00b, 0x1, 0x1, 0xfffffffd}, {0x8, 0x0, 0x2, 0x14, 0x4, 0x3}, 0xfffff448, 0x80000000, 0x4}}]}]}}]}, 0x74}, 0x1, 0x0, 0x0, 0x1}, 0x800)

560.980999ms ago: executing program 2 (id=2358):
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8)
connect$inet6(r0, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c)
sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="82", 0x1}, {&(0x7f0000000180)="ef", 0x1}], 0x2}}], 0x1, 0x4400c800)
sendto$inet6(r0, &(0x7f0000000300), 0x16, 0x3b12, 0x0, 0xfffffffffffffdfd)

560.718859ms ago: executing program 0 (id=2359):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x58, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x5f}]}]}, 0x58}}, 0x2)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x5c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x7}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000002}, 0x90)

560.398631ms ago: executing program 2 (id=2360):
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f50009058202"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)

504.06121ms ago: executing program 0 (id=2361):
syz_80211_inject_frame(0x0, 0x0, 0xb5)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0)

503.234406ms ago: executing program 1 (id=2362):
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@updpolicy={0xb8, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x8}, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x4000000)

503.006481ms ago: executing program 1 (id=2363):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="10000000040000000800000002"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000300), &(0x7f0000000000)=""/10, 0x2}, 0x20)

436.841826ms ago: executing program 1 (id=2364):
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x2133, 0x18, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0xb1, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x101, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xc, 0x1}}}}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000040)={0x20, 0xa, 0x5, {0x5, 0xf, "00f400"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
setresuid(0xee01, 0xee01, 0x0)

5.056828ms ago: executing program 2 (id=2365):
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x6, 0x9, 0x8}]}, 0x10)
syz_emit_ethernet(0x83, &(0x7f0000000140)={@link_local, @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, "01a600", 0x4d, 0x11, 0x0, @local, @mcast2, {[], {0x4e23, 0x4e20, 0x4d, 0x0, @opaque="335ab83451d0ffeda8de6bc0acde5a9a741d355d20f0781c117bb1513c00906205be6510b6cee3a99c91f1391c7885ddfe93a5642dc92f75f65785ad334baab4ba1ecf551f"}}}}}}, 0x0)

4.887552ms ago: executing program 2 (id=2366):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000400000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sys_enter\x00', r0}, 0x10)
move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x2)

0s ago: executing program 0 (id=2367):
syz_mount_image$udf(&(0x7f00000019c0), &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1016400, &(0x7f0000000680)=ANY=[], 0x1, 0xc5e, &(0x7f0000001a00)="$eJzs3U9sHNd9B/DfGy7FpdxWTOwqThoHm7ZIZcZy9S+mYhXuqqbZFpBlIRRzC8CVSKkLUyRBUq1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRhD0wBYBAhQIGMzsW3FFkYksUiIlfT629J2deW/mvZn1DC3ozQsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIOL3Xjt/4mTaZkPfPjQGAHgoLo5/6cSp7Z7/AMBj6/JO//8PAAAAAAAAAAAAAAAcFCmKeDpSzF9cT5PV5476hXb/zVsTo2PbVxtMVc2+qnz5q37y1OkzX3hp5Gw3L7Rnf079vfapeGP88vnGq3M35hemFxenpxoTs+2rc1PT97yH3dbfarg6AY0bb96cunZtsXHqxdN3bL419OHAU0eHzo08f/y5btmJ0bGx8c0i9d7ytftuSMdOIzwORRHHI8UL3/phakVEEbs/F/WHe+23Gqw6MVx1YmJ0rOrITLs1u1RuvNQ9EUVEo6dSs3uOtr8WUet/qH3YWTNiuWx+2eDhsnvj862F1pWZ6cal1sJSe6k9N3spdVpb9qcRRZxNESsRsTZw9+76o4hapPjGkfV0Jb/1ozoPn68GBu/cjuIB9vEelO1s9EesFI/ANTvABqKI1yPFj987Flfzfaa613wu4vUyvxPxTpmvRKTyi3Em4oNtvkc8mmpRxF+W1//cepqq7gfd+8qFLzf+cPbaXE/Z7n3lIz4f7rpT7NPzYXBLPhwH/N5UjyJa1R1/Pd3/DzsAAAAAAAAAAAAAAAAA7LXBKOKTkeK1//jjalxxVOPSj5wb+f2hX+4dM/7sL9hPWfbFiFgu7m1M7qE8MPBSupTSPo8lfpLVo4g/zeP/vrbfjQEAAAAAAAAAAAAAAAAAAHiiFfGDSPHy+8fSSvTOKd6evd643Loy05kVtjv3b3fO9I2NjY1G6mQz52TO5ZwrOVdzruWMItcf6OyomT9P5lzOuZJzNedazujL9XM2c07mXM65knM151rOqOX6OZs5J3Mu51zJuZpzLWcckLl7AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeJ0UU8dNI8fU/WU+RIqIZMRmdXB3Y79YBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKWBVMS3I0XjD5q319UiIlX/dhwrfzsTzUNlfjyaI2W+Es3zOVtV1ppf24f2szv9qYjvR4qB+ru3L3i+/v2dT7e/BvHOVyMG8/Knap3s624c+nDgqaNHzo2MfebZnZbTdg0YvtCevXmrMTE6Njbes7qWj/7xnnVD+bjF3nSdiFh86+03WzMz0wv3s3CoWii/AvdV/ZFbSLV96OnAE3N6D95C1A5EM/an73eo79cNigeqfP5/ECl++/3/7D7wO8//evxS59PtJ3z85M82fxp4eeuO7vH5X9taLz//y2f6ds//p3vWvZx/GumvRdSXbsz3H42oL7719vH2jdb16evTs2dOnPjiyMgXT5/oPxRRv9aeme5Z2pPTBQAAAAAAAAAAAAAAAPDwpCJ+N1K0vr+eGhFxqxqvNXRu5Pnjz/VFXzXe6o5x22+MXz7feHXuxvzC9OLi9FRjYrZ9dW5q+l4PV6+Ge02Mjj2QzvxCgw+4/YP1V+fm31poX/+jpW23H66fv7K4dLV1dfvNMRhFRLN3zXDV4InRsarRM+3WbFX10raD6T+6/lTEf0WKq2ca6bN5XR7/v3WEfzX+v3vY5a072sPx/585vDn+72M9RctjplTETyLFb/3Vs/HZqp2H465zlsv9XaQYPvvpXC4OleW6bei8V6AzMrAs+7+R4p9+emfZ7njIpzfLnvxIJ/cRUF7/I5Hi23/xzfj1vO7O9z9sf/0Pb93RHl3/4W4b8tGf6Sl6+I73FexJ95945fU/Hileefrd+I1qzf//3Pd/dN+9caxTePP9HA/o/R+/2rNuKB/3N/eq8wAAAAAAAAAAAI+w/lTE30eK747V0kt53b38/b+prTt6QH//6xM966Z2O1/RPS7s+qQCAAAAwAHRn4r4QaS4vvTu7THUd47/7hn/+Tub4z9H05at1Z/z/Ur13oC9/PO/XkP5uJO77zYAAAAAAAAAAAAAAAAAAAAcKCkV8VKeT32yGs8/teN86quR4rUfvZDLpaNlue488EPV7/WLc7PHz8/MzNVjqXVlZroxPt+6Ol3WfSZSrP/tp3PdoppfvTvffGeO98252Bcixdg/dMt25mLvzk3+zGbZk2XZj0WK//7HO8vmqanz3NFV2VNl2b+JFF/5l96yfbfLHt0se7os+81I8b2vNLplD5f77b4f9RObZV+8Olc8gKsCAAAAAAAAAAAAAAAAAADAk6Y/FfHnkeJ/bqzcHsuf5//v7/lYeeerPfP9b3Grmud/qJr/f6fl+5n/v3qvwPJORwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgMdTiiLejhTzF9fT6kD5uaN+oV3ErYnRse2rDaaqZl9VvvxVP3nq9JkvvDRytpsX2rM3d66/1z4Zb4xfPt94de7G/ML04uL0VGNitn11bmr6nvew2/pbDVcnoHHjzZs/unZtsXHqxdN3bL419OHAU0eHzo08f/y5btmJ0bGx8Z4ytf77Pvpd0g7rD0URfx0pXvjWD9N3ByKK2P25qD/ca7/VYNWJ4aoTE6NjVUdm2q3ZpXLjpe6JKCIaPZWa3XP0EK7FrjQjlsvmlw0eLrs3Pt9aaF2ZmW5cai0stZfac7OXUqe1ZX8aUcTZFLESEWsDd++uP4p4M1J848h6+teBiL7uefj8xfEvnTi1czuKB9jHe1C2s9EfsVLsfM0O7WP7HhUDUcQ/R4ofv3cs/m0gohadX/G5iNfL/E7EO9G53qn8YpyJ+GCb7xGPploU8X/l9T+3nt4bKO8H3fvKhS+n5Yi5nrLd+8oj/3x4mA7486QeRXyvuuOvp3/33zUAAAAAAAAAAAAAAADAAVLEr0WKl98/ltaid0xxe/Z643LrykxnWF937F93zPTGxsZGI3WymXMy53LOlZyrOddyRpHr52yWWd/YmMyfl3Ou5FzNuZYz+nL9nM2ckzmXc67kXM25ljNquX7OZs7JnMs5V3Ku5lzLGQdk7B4AAAAAAAAAAAAAAAAAAPB4Kap/Uny9qCYDruaXnoxOrpoP9LH3swAAAP//ta7yzA==")
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
r2 = fcntl$getown(r1, 0x9)
prlimit64(r2, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r3 = getpid()
sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff)
r6 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
r7 = openat$cgroup_int(r6, &(0x7f0000000100)='cpuset.cpus\x00', 0x2, 0x0)
write$cgroup_subtree(r7, &(0x7f0000000240)=ANY=[], 0x31)
pread64(0xffffffffffffffff, 0x0, 0x0, 0x0)
r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x1800, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000004c0)="e0"})
syz_emit_vhci(0x0, 0xd)

kernel console output (not intermixed with test programs):

ce batadv_slave_1 (retrying later): interface not active
[   65.783281][ T5855] hsr_slave_0: entered promiscuous mode
[   65.787978][ T5855] hsr_slave_1: entered promiscuous mode
[   65.790902][ T5855] debugfs: 'hsr0' already exists in 'hsr'
[   65.793363][ T5855] Cannot create hsr debugfs directory
[   65.795950][ T5851] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   65.805836][ T5851] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   65.814534][ T5851] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   65.821750][ T5851] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   65.973130][ T5847] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   65.989028][ T5847] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   66.003242][ T5847] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   66.014193][ T5847] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   66.122853][ T5855] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   66.130329][ T5855] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   66.144060][ T5855] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   66.153839][ T5851] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.162983][ T5855] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   66.181694][ T5851] 8021q: adding VLAN 0 to HW filter on device team0
[   66.205354][ T1090] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.208675][ T1090] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.216025][ T1090] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.219182][ T1090] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.290140][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.326120][ T5847] 8021q: adding VLAN 0 to HW filter on device team0
[   66.336354][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.339559][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.351171][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.353919][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.401024][ T5853] Bluetooth: hci0: command tx timeout
[   66.401032][ T5238] Bluetooth: hci1: command tx timeout
[   66.439134][ T5855] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.489711][ T5855] 8021q: adding VLAN 0 to HW filter on device team0
[   66.509596][   T53] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.512709][   T53] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.527954][   T53] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.531104][   T53] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.559515][ T5853] Bluetooth: hci2: command tx timeout
[   66.613328][ T5851] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.628392][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.698119][ T5851] veth0_vlan: entered promiscuous mode
[   66.710877][ T5847] veth0_vlan: entered promiscuous mode
[   66.721247][ T5851] veth1_vlan: entered promiscuous mode
[   66.725700][ T5847] veth1_vlan: entered promiscuous mode
[   66.774410][ T5847] veth0_macvtap: entered promiscuous mode
[   66.790591][ T5847] veth1_macvtap: entered promiscuous mode
[   66.804746][ T5851] veth0_macvtap: entered promiscuous mode
[   66.812770][ T5851] veth1_macvtap: entered promiscuous mode
[   66.837661][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.845497][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.851125][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.860968][ T5855] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.868026][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.888559][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.894086][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.900401][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.904162][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.922740][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.928648][   T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.943867][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.948342][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.045221][ T5855] veth0_vlan: entered promiscuous mode
[   67.060791][ T3566] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.066224][ T5855] veth1_vlan: entered promiscuous mode
[   67.068952][ T3566] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.100744][ T1088] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.104099][ T1088] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.152175][   T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.155701][   T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.179542][ T1089] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.182952][ T1089] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.191269][ T5855] veth0_macvtap: entered promiscuous mode
[   67.212319][ T5855] veth1_macvtap: entered promiscuous mode
[   67.240875][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.251913][ T5847] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   67.259799][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.281794][ T5696] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.302850][ T5696] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.327284][ T5696] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.330863][ T5696] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.441875][ T3566] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.445243][ T3566] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.508550][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.511917][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.636971][ T5923] loop2: detected capacity change from 0 to 1024
[   67.755332][ T5921] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   67.818402][ T5924] loop0: detected capacity change from 0 to 8
[   67.855360][ T5924] SQUASHFS error: Unable to read inode 0x127
[   68.477535][ T5853] Bluetooth: hci0: command tx timeout
[   68.478137][ T3566] hfsplus: b-tree write err: -5, ino 4
[   68.511760][ T5915] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[   68.637235][ T5853] Bluetooth: hci2: command tx timeout
[   69.037039][ T5931] loop2: detected capacity change from 0 to 32768
[   69.042464][ T5931] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.8 (5931)
[   69.061448][ T5931] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[   69.065419][ T5931] BTRFS info (device loop2): using sha256 (sha256-lib) checksum algorithm
[   69.151761][ T5915] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0
[   69.155813][ T5915] usb 2-1: config 0 interface 0 has no altsetting 0
[   69.178023][ T5915] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[   69.180908][ T5915] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[   69.189630][ T5915] usb 2-1: Product: syz
[   69.191029][ T5915] usb 2-1: Manufacturer: syz
[   69.196731][ T5915] usb 2-1: SerialNumber: syz
[   69.213283][ T5931] BTRFS info (device loop2): enabling ssd optimizations
[   69.215648][ T5931] BTRFS info (device loop2): enabling free space tree
[   69.224821][ T5915] usb 2-1: config 0 descriptor??
[   69.242454][ T5915] usb 2-1: selecting invalid altsetting 0
[   69.264024][ T5851] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[   69.607040][ T5903] usb 2-1: USB disconnect, device number 2
[   69.757584][ T5853] Bluetooth: hci1: command tx timeout
[   69.849660][ T5968] loop2: detected capacity change from 0 to 1024
[   69.945586][ T5972] Bluetooth: MGMT ver 1.23
[   70.364731][ T5989] loop0: detected capacity change from 0 to 4096
[   70.402780][ T5990] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[   70.438783][ T5982] loop2: detected capacity change from 0 to 32768
[   70.508248][ T5982] XFS (loop2): Mounting V5 Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a
[   70.552494][ T5998] dummy0: entered promiscuous mode
[   70.554837][ T5998] dummy0: entered allmulticast mode
[   70.557415][ T5853] Bluetooth: hci0: command tx timeout
[   70.602034][ T5982] XFS (loop2): Ending clean mount
[   70.694654][ T5851] XFS (loop2): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a
[   70.716810][ T5853] Bluetooth: hci2: command tx timeout
[   71.053615][ T6025] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   71.201920][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   71.204734][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   71.341663][ T6032] ubi31: attaching mtd0
[   71.354517][ T6032] ubi31: scanning is finished
[   71.357145][ T6032] ubi31: empty MTD device detected
[   71.575040][ T6032] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB)
[   71.578528][ T6032] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[   71.581691][ T6032] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1
[   71.584725][ T6032] ubi31: VID header offset: 64 (aligned 64), data offset: 128
[   71.588640][ T6032] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[   71.591651][ T6032] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23
[   71.595176][ T6032] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 820903378
[   71.601976][ T6032] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[   71.606707][ T6034] ubi31: background thread "ubi_bgt31d" started, PID 6034
[   71.696579][ T5915] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[   71.846591][ T5915] usb 1-1: Using ep0 maxpacket: 8
[   71.849018][ T5853] Bluetooth: hci1: command tx timeout
[   71.853626][ T5915] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[   71.859952][ T5915] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
[   71.863683][ T5915] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[   71.871749][ T5915] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[   71.875760][ T5915] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   71.880758][ T5915] usb 1-1: Product: syz
[   71.883243][ T5915] usb 1-1: Manufacturer: syz
[   71.885339][ T5915] usb 1-1: SerialNumber: syz
[   72.648146][ T5853] Bluetooth: hci0: command tx timeout
[   72.807129][ T5853] Bluetooth: hci2: command tx timeout
[   73.902961][ T6068] loop2: detected capacity change from 0 to 256
[   73.908190][ T6068] =======================================================
[   73.908190][ T6068] WARNING: The mand mount option has been deprecated and
[   73.908190][ T6068]          and is ignored by this kernel. Remove the mand
[   73.908190][ T6068]          option from the mount to silence this warning.
[   73.908190][ T6068] =======================================================
[   73.949457][ T6068] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fe7f, chksum : 0x19066d23, utbl_chksum : 0xe619d30d)
[   74.224719][ T5915] usb 1-1: 0:2 : does not exist
[   74.268314][ T5915] usb 1-1: USB disconnect, device number 2
[   74.335569][ T5850] udevd[5850]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[   74.512584][  T791] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[   74.692678][  T791] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[   74.697442][  T791] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[   74.700807][  T791] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[   74.705411][  T791] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[   74.710991][  T791] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   74.735651][  T791] usb 2-1: config 0 descriptor??
[   75.356231][  T791] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[   75.475171][  T791] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0
[   76.586526][ T5314] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[   76.738223][ T5314] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[   76.742726][ T5314] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
[   76.748563][ T5314] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[   76.752569][ T5314] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[   76.756087][ T5314] usb 1-1: SerialNumber: syz
[   76.976137][ T5314] usb 1-1: 0:2 : does not exist
[   76.979099][ T5314] usb 1-1: usbmixer: too many channels (61) in unit 5
[   76.987618][ T5314] usb 1-1: USB disconnect, device number 3
[   77.000247][ T5850] udevd[5850]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[   77.350141][ T5915] usb 2-1: USB disconnect, device number 3
[   78.837601][ T6150] loop0: detected capacity change from 0 to 4096
[   78.896037][ T6150] ntfs3(loop0): Mark volume as dirty due to NTFS errors
[   78.916995][ T6150] ntfs3(loop0): Failed to load $Extend (-22).
[   78.919752][ T6150] ntfs3(loop0): Failed to initialize $Extend.
[   78.950318][ T6150] ntfs3(loop0): ino=21, The size of extended attributes must not exceed 64KiB
[   79.126305][ T6148] loop2: detected capacity change from 0 to 32768
[   79.225423][ T6148] ocfs2: Mounting device (7,2) on (node local, slot 0) with writeback data mode.
[   79.324706][ T5851] ocfs2: Unmounting device (7,2) on (node local)
[   79.864755][ T6176] loop1: detected capacity change from 0 to 2048
[   79.871070][ T6176] EXT4-fs: Ignoring removed mblk_io_submit option
[   79.908414][ T6176] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   79.964359][   T40] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm kworker/u10:2: bg 0: block 234: padding at end of block bitmap is not set
[   79.970039][   T40] EXT4-fs (loop1): Remounting filesystem read-only
[   79.975621][ T5855] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   79.976525][ T5314] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[   80.097554][ T6174] loop2: detected capacity change from 0 to 32768
[   80.109515][   T33] audit: type=1804 audit(1756996916.142:2): pid=6181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.97" name="/newroot/23/file1" dev="fuse" ino=1 res=1 errno=0
[   80.124858][ T6174] XFS (loop2): Mounting V5 Filesystem 9f1cad42-11bd-4e12-8f0b-f07876b81d9a
[   80.137070][   T33] audit: type=1800 audit(1756996916.152:3): pid=6181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.97" name="/" dev="fuse" ino=1 res=0 errno=0
[   80.146142][ T5314] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[   80.151159][   T33] audit: type=1800 audit(1756996916.152:4): pid=6181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.97" name="/" dev="fuse" ino=1 res=0 errno=0
[   80.154885][ T5314] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[   80.177780][ T5314] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00
[   80.189708][ T5314] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   80.208569][ T6174] XFS (loop2): Ending clean mount
[   80.208585][ T6192] loop1: detected capacity change from 0 to 512
[   80.214021][ T5314] usb 1-1: config 0 descriptor??
[   80.234316][ T6192] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem
[   80.243480][ T6192] EXT4-fs (loop1): bad geometry: first data block is 0 with a 1k block and cluster size
[   80.290052][ T5851] XFS (loop2): Unmounting Filesystem 9f1cad42-11bd-4e12-8f0b-f07876b81d9a
[   80.664584][ T5314] kovaplus 0003:1E7D:2D50.0002: unknown main item tag 0x0
[   81.064143][ T5314] kovaplus 0003:1E7D:2D50.0002: unknown main item tag 0x0
[   81.066893][  T791] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[   81.069930][ T5314] kovaplus 0003:1E7D:2D50.0002: unknown main item tag 0x0
[   81.072676][ T5314] kovaplus 0003:1E7D:2D50.0002: unknown main item tag 0x0
[   81.075316][ T5314] kovaplus 0003:1E7D:2D50.0002: unknown main item tag 0x0
[   81.087863][ T5314] kovaplus 0003:1E7D:2D50.0002: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.0-1/input0
[   81.234864][ T6207] loop1: detected capacity change from 0 to 1024
[   81.245094][ T6207] EXT4-fs: Ignoring removed nobh option
[   81.249770][ T6207] EXT4-fs: inline encryption not supported
[   81.259447][  T791] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[   81.262645][  T791] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[   81.268145][  T791] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3
[   81.271642][  T791] usb 3-1: config 1 has no interface number 1
[   81.274167][  T791] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[   81.289365][  T791] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[   81.293236][  T791] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   81.298109][ T6207] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   81.303948][  T791] usb 3-1: Product: syz
[   81.305796][  T791] usb 3-1: Manufacturer: syz
[   81.308043][  T791] usb 3-1: SerialNumber: syz
[   81.331923][ T6207] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4183: comm syz.1.104: Allocating blocks 385-513 which overlap fs metadata
[   81.343713][ T6207] EXT4-fs (loop1): pa ffff888107502488: logic 16, phys. 129, len 24
[   81.347233][ T6207] EXT4-fs error (device loop1): ext4_mb_release_inode_pa:5434: group 0, free 0, pa_free 8
[   81.354459][ T6207] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 28
[   81.360549][ T6207] EXT4-fs (loop1): This should not happen!! Data will be lost
[   81.360549][ T6207] 
[   81.364833][ T6207] EXT4-fs (loop1): Total free blocks count 0
[   81.367539][ T6207] EXT4-fs (loop1): Free/Dirty block details
[   81.370387][ T6207] EXT4-fs (loop1): free_blocks=128
[   81.372643][ T6207] EXT4-fs (loop1): dirty_blocks=0
[   81.374769][ T6207] EXT4-fs (loop1): Block reservation details
[   81.377603][ T6207] EXT4-fs (loop1): i_reserved_data_blocks=0
[   81.482984][ T6211] mmap: syz.1.105 (6211) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[   81.563486][  T791] usb 3-1: USB disconnect, device number 2
[   81.589312][ T5850] udevd[5850]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[   81.624956][ T5314] kovaplus 0003:1E7D:2D50.0002: couldn't init struct kovaplus_device
[   81.630210][ T5314] kovaplus 0003:1E7D:2D50.0002: couldn't install mouse
[   81.634943][ T5314] kovaplus 0003:1E7D:2D50.0002: probe with driver kovaplus failed with error -71
[   81.643099][ T5314] usb 1-1: USB disconnect, device number 4
[   82.292130][ T6224] loop0: detected capacity change from 0 to 256
[   82.553414][ T6220] loop2: detected capacity change from 0 to 40427
[   82.584105][ T6220] F2FS-fs (loop2): invalid crc value
[   82.718974][ T6220] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[   82.747590][ T6220] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5
[   82.804938][ T5851] syz-executor: attempt to access beyond end of device
[   82.804938][ T5851] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[   82.829759][ T5851] CPU: 0 UID: 0 PID: 5851 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
[   82.829771][ T5851] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   82.829783][ T5851] Call Trace:
[   82.829787][ T5851]  <TASK>
[   82.829791][ T5851]  dump_stack_lvl+0x189/0x250
[   82.829804][ T5851]  ? __pfx_dump_stack_lvl+0x10/0x10
[   82.829811][ T5851]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[   82.829821][ T5851]  ? __pfx_queue_work_on+0x10/0x10
[   82.829828][ T5851]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   82.829837][ T5851]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   82.829850][ T5851]  f2fs_handle_critical_error+0x37c/0x540
[   82.829863][ T5851]  f2fs_write_end_io+0x886/0xb60
[   82.829876][ T5851]  __submit_merged_bio+0x27a/0x6a0
[   82.829887][ T5851]  __submit_merged_write_cond+0x255/0x530
[   82.829899][ T5851]  f2fs_write_data_pages+0x261d/0x3000
[   82.829921][ T5851]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[   82.829956][ T5851]  ? __lock_acquire+0xab9/0xd20
[   82.829970][ T5851]  ? do_raw_spin_lock+0x121/0x290
[   82.829982][ T5851]  ? do_raw_spin_unlock+0x4d/0x240
[   82.829990][ T5851]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[   82.830000][ T5851]  do_writepages+0x32e/0x550
[   82.830013][ T5851]  ? do_raw_spin_unlock+0x4d/0x240
[   82.830023][ T5851]  filemap_fdatawrite+0x199/0x240
[   82.830032][ T5851]  ? __pfx_filemap_fdatawrite+0x10/0x10
[   82.830057][ T5851]  ? do_raw_spin_unlock+0x4d/0x240
[   82.830067][ T5851]  f2fs_sync_dirty_inodes+0x31f/0x830
[   82.830079][ T5851]  f2fs_write_checkpoint+0x95a/0x1df0
[   82.830095][ T5851]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[   82.830119][ T5851]  ? kill_f2fs_super+0x298/0x6c0
[   82.830127][ T5851]  kill_f2fs_super+0x2c3/0x6c0
[   82.830136][ T5851]  ? __pfx_kill_f2fs_super+0x10/0x10
[   82.830142][ T5851]  ? radix_tree_delete_item+0x2b6/0x400
[   82.830175][ T5851]  ? shrinker_free+0x2ce/0x3e0
[   82.830183][ T5851]  deactivate_locked_super+0xbc/0x130
[   82.830193][ T5851]  cleanup_mnt+0x425/0x4c0
[   82.830201][ T5851]  ? lockdep_hardirqs_on+0x9c/0x150
[   82.830211][ T5851]  task_work_run+0x1d4/0x260
[   82.830221][ T5851]  ? __pfx_task_work_run+0x10/0x10
[   82.830229][ T5851]  ? __x64_sys_umount+0x122/0x160
[   82.830262][ T5851]  ? exit_to_user_mode_loop+0x40/0x110
[   82.830275][ T5851]  exit_to_user_mode_loop+0xec/0x110
[   82.830285][ T5851]  do_syscall_64+0x2bd/0x3b0
[   82.830290][ T5851]  ? lockdep_hardirqs_on+0x9c/0x150
[   82.830300][ T5851]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   82.830307][ T5851]  ? exc_page_fault+0x9f/0xf0
[   82.830317][ T5851]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   82.830323][ T5851] RIP: 0033:0x7f219b18ff17
[   82.830331][ T5851] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[   82.830337][ T5851] RSP: 002b:00007ffc3e94dfc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[   82.830345][ T5851] RAX: 0000000000000000 RBX: 00007f219b211c05 RCX: 00007f219b18ff17
[   82.830349][ T5851] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc3e94e080
[   82.830353][ T5851] RBP: 00007ffc3e94e080 R08: 0000000000000000 R09: 0000000000000000
[   82.830357][ T5851] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc3e94f110
[   82.830361][ T5851] R13: 00007f219b211c05 R14: 00000000000142d6 R15: 00007ffc3e94f150
[   82.830372][ T5851]  </TASK>
[   82.830412][ T5851] F2FS-fs (loop2): Stopped filesystem due to reason: 3
[   83.086495][ T5314] usb 1-1: new high-speed USB device number 5 using dummy_hcd
[   83.276853][ T5314] usb 1-1: Using ep0 maxpacket: 8
[   83.283291][ T5314] usb 1-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4
[   83.288035][ T5314] usb 1-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3
[   83.294675][ T5314] usb 1-1: Product: syz
[   83.297028][ T5314] usb 1-1: Manufacturer: syz
[   83.657344][ T5314] usb 1-1: SerialNumber: syz
[   83.660495][ T5314] usb 1-1: config 0 descriptor??
[   83.663934][ T5314] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd
[   83.871485][ T5314] gspca_zc3xx: reg_w_i err -71
[   83.879624][ T5314] gspca_zc3xx 1-1:0.0: probe with driver gspca_zc3xx failed with error -71
[   83.896723][ T5314] usb 1-1: USB disconnect, device number 5
[   84.081832][ T6281] Falling back ldisc for ptm0.
[   84.089820][ T6283] loop1: detected capacity change from 0 to 8
[   84.105923][ T6283] SQUASHFS error: zstd decompression error: 10
[   84.116542][ T6283] SQUASHFS error: zstd decompression failed, data probably corrupt
[   84.119696][ T6283] SQUASHFS error: Failed to read block 0x62b: -5
[   84.124404][ T6283] SQUASHFS error: Unable to read metadata cache entry [629]
[   84.128903][ T6283] SQUASHFS error: Unable to read directory block [629:ff26]
[   84.217750][ T6287] netlink: 32 bytes leftover after parsing attributes in process `syz.1.138'.
[   84.222000][ T6287] openvswitch: netlink: Missing key (keys=40, expected=10000000)
[   84.336957][ T6291] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off.
[   84.341975][ T6291] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
[   84.536333][ T6294] loop1: detected capacity change from 0 to 512
[   84.539577][ T6294] EXT4-fs: Ignoring removed oldalloc option
[   84.551747][ T6294] EXT4-fs (loop1): 1 truncate cleaned up
[   84.554857][ T6294] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   84.576075][ T6294] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #13: comm syz.1.140: invalid indirect mapped block 234881024 (level 0)
[   84.583774][ T6294] EXT4-fs (loop1): Remounting filesystem read-only
[   84.605370][ T5855] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   84.661473][ T6302] loop1: detected capacity change from 0 to 512
[   84.674898][ T6302] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[   84.686332][ T6302] EXT4-fs (loop1): blocks per group (95) and clusters per group (32768) inconsistent
[   85.316516][ T5314] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[   85.366577][ T5896] usb 2-1: new high-speed USB device number 4 using dummy_hcd
[   85.486554][ T5314] usb 3-1: Using ep0 maxpacket: 32
[   85.495535][ T5314] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0
[   85.499766][ T5314] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0
[   85.509910][ T5314] usb 3-1: config 0 interface 0 has no altsetting 0
[   85.516381][ T5314] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e
[   85.526469][ T5314] usb 3-1: New USB device strings: Mfr=229, Product=1, SerialNumber=3
[   85.526527][ T5896] usb 2-1: Using ep0 maxpacket: 32
[   85.529915][ T5314] usb 3-1: Product: syz
[   85.538428][ T5314] usb 3-1: Manufacturer: syz
[   85.538532][ T5896] usb 2-1: config 0 has an invalid interface number: 54 but max is 0
[   85.540891][ T5314] usb 3-1: SerialNumber: syz
[   85.543505][ T5896] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[   85.543520][ T5896] usb 2-1: config 0 has no interface number 0
[   85.543540][ T5896] usb 2-1: too many endpoints for config 0 interface 54 altsetting 205: 134, using maximum allowed: 30
[   85.543558][ T5896] usb 2-1: config 0 interface 54 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 134
[   85.543568][ T5896] usb 2-1: config 0 interface 54 has no altsetting 0
[   85.570380][ T5314] usb 3-1: config 0 descriptor??
[   85.573630][ T5896] usb 2-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11
[   85.579916][ T5896] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   85.583054][ T5896] usb 2-1: Product: syz
[   85.594365][ T5896] usb 2-1: Manufacturer: syz
[   85.596265][ T5896] usb 2-1: SerialNumber: syz
[   85.605944][ T5896] usb 2-1: config 0 descriptor??
[   85.612010][ T5896] usb 2-1: Quirk or no altset; falling back to MIDI 1.0
[   85.619382][ T5896] usb 2-1: MIDIStreaming interface descriptor not found
[   85.840689][  T791] usb 2-1: USB disconnect, device number 4
[   85.847316][   T47] usb 1-1: new high-speed USB device number 6 using dummy_hcd
[   85.927290][ T5853] Bluetooth: hci0: command tx timeout
[   85.981384][ T5314] gs_usb 3-1:0.0: Configuring for 1 interfaces
[   86.010008][   T47] usb 1-1: New USB device found, idVendor=0c45, idProduct=60a8, bcdDevice=b5.55
[   86.013901][   T47] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   86.017313][   T47] usb 1-1: Product: syz
[   86.019050][   T47] usb 1-1: Manufacturer: syz
[   86.020944][   T47] usb 1-1: SerialNumber: syz
[   86.025534][   T47] usb 1-1: config 0 descriptor??
[   86.032887][   T47] gspca_main: sonixb-2.14.0 probing 0c45:60a8
[   86.385690][ T5314] gs_usb 3-1:0.0: Couldn't get extended bit timing const for channel 0 (-EPROTO)
[   86.399843][ T5314] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -71
[   86.419833][ T5314] usb 3-1: USB disconnect, device number 3
[   86.420175][ T6325] loop1: detected capacity change from 0 to 2048
[   86.449288][ T5915] usb 1-1: USB disconnect, device number 6
[   86.459270][ T5952] Dev loop1: RDB in block 2 has bad checksum
[   86.469701][ T6325] Dev loop1: RDB in block 2 has bad checksum
[   86.561857][   T10] cfg80211: failed to load regulatory.db
[   86.745185][ T6331] netlink: 4 bytes leftover after parsing attributes in process `syz.1.154'.
[   86.751391][ T6331] netlink: 4 bytes leftover after parsing attributes in process `syz.1.154'.
[   86.754406][ T6331] Zero length message leads to an empty skb
[   86.880281][ T6337] netlink: 4 bytes leftover after parsing attributes in process `syz.1.157'.
[   86.981920][ T6342] loop2: detected capacity change from 0 to 512
[   86.988338][ T6342] EXT4-fs error (device loop2): ext4_get_journal_inode:5800: comm syz.2.159: inode #16777216: comm syz.2.159: iget: illegal inode #
[   86.995324][ T6342] EXT4-fs (loop2): Remounting filesystem read-only
[   86.999559][ T6342] EXT4-fs (loop2): no journal found
[   87.005117][ T6342] EXT4-fs (loop2): can't get journal size
[   87.010308][ T6343] loop1: detected capacity change from 0 to 256
[   87.014715][ T6343] exfat: Deprecated parameter 'utf8'
[   87.017486][ T6342] EXT4-fs (loop2): warning: mounting fs with errors, running e2fsck is recommended
[   87.030215][ T6342] EXT4-fs (loop2): failed to initialize system zone (-22)
[   87.033344][ T6342] EXT4-fs (loop2): mount failed
[   87.042362][ T6343] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x36dfe6b4, utbl_chksum : 0xe619d30d)
[   87.335609][ T6363] bond0: Unable to set down delay as MII monitoring is disabled
[   87.441828][ T6369] loop1: detected capacity change from 0 to 4096
[   87.492468][ T6369] ntfs3(loop1): ino=21, "file1" fiemap is not supported for compressed file (cp -r)
[   87.586610][   T47] usb 3-1: new high-speed USB device number 4 using dummy_hcd
[   87.743861][   T47] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[   87.749965][   T47] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[   87.754163][   T47] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00
[   87.759625][   T47] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   87.765916][   T47] usb 3-1: config 0 descriptor??
[   87.786631][ T5896] usb 1-1: new full-speed USB device number 7 using dummy_hcd
[   87.949296][ T5896] usb 1-1: unable to get BOS descriptor or descriptor too short
[   87.953860][ T5896] usb 1-1: not running at top speed; connect to a high speed hub
[   87.963104][ T5896] usb 1-1: config 1 has an invalid interface number: 130 but max is 0
[   87.967357][ T5896] usb 1-1: config 1 has no interface number 0
[   87.970846][ T5896] usb 1-1: config 1 interface 130 altsetting 3 endpoint 0x1 has invalid maxpacket 512, setting to 64
[   87.974694][ T5896] usb 1-1: config 1 interface 130 has no altsetting 0
[   87.989883][ T5896] usb 1-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice=84.ac
[   87.993845][ T5896] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   87.998207][ T5896] usb 1-1: Product: syz
[   88.000214][ T5896] usb 1-1: Manufacturer: syz
[   88.002801][ T5896] usb 1-1: SerialNumber: syz
[   88.013666][ T6371] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22
[   88.232312][ T5896] dvb-usb: found a 'Gigabyte U7000' in cold state, will try to load a firmware
[   88.282160][ T5896] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw'
[   88.292315][ T5896] dib0700: firmware download failed at 7 with -71
[   88.352774][ T5896] usb 1-1: USB disconnect, device number 7
[   88.810388][   T47] uclogic 0003:256C:006D.0003: failed retrieving string descriptor #100: -71
[   88.813216][   T47] uclogic 0003:256C:006D.0003: failed retrieving pen parameters: -71
[   88.816208][   T47] uclogic 0003:256C:006D.0003: failed probing pen v1 parameters: -71
[   88.822297][   T47] uclogic 0003:256C:006D.0003: failed probing parameters: -71
[   88.824746][   T47] uclogic 0003:256C:006D.0003: probe with driver uclogic failed with error -71
[   88.830336][   T47] usb 3-1: USB disconnect, device number 4
[   89.089672][ T5896] usb 2-1: new high-speed USB device number 5 using dummy_hcd
[   89.265632][ T5896] usb 2-1: unable to get BOS descriptor or descriptor too short
[   89.274395][ T5896] usb 2-1: config 249 has an invalid interface number: 177 but max is 0
[   89.282136][ T5896] usb 2-1: config 249 has no interface number 0
[   89.285024][ T5896] usb 2-1: config 249 interface 177 altsetting 0 has a duplicate endpoint with address 0xE, skipping
[   89.293021][ T5896] usb 2-1: config 249 interface 177 altsetting 0 has an endpoint descriptor with address 0x53, changing to 0x3
[   89.299220][ T5896] usb 2-1: config 249 interface 177 altsetting 0 endpoint 0x3 has invalid maxpacket 65199, setting to 1024
[   89.304507][ T5896] usb 2-1: config 249 interface 177 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024
[   89.311208][ T5896] usb 2-1: config 249 interface 177 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3
[   89.324563][ T5896] usb 2-1: New USB device found, idVendor=057c, idProduct=3800, bcdDevice=5a.9d
[   89.331142][ T5896] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   89.334483][ T5896] usb 2-1: Product: syz
[   89.335998][ T5896] usb 2-1: Manufacturer: syz
[   89.342238][ T5896] usb 2-1: SerialNumber: syz
[   89.375596][ T6390] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[   89.624011][ T5896] usb 2-1: USB disconnect, device number 5
[   89.939462][ T6414] loop0: detected capacity change from 0 to 32768
[   89.954726][ T6414] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[   89.991087][ T6414] XFS (loop0): Ending clean mount
[   89.998394][ T6412] loop2: detected capacity change from 0 to 40427
[   90.000784][ T6414] XFS (loop0): Quotacheck needed: Please wait.
[   90.015986][ T6412] F2FS-fs (loop2): invalid crc value
[   90.035384][ T6414] XFS (loop0): Quotacheck: Done.
[   90.065809][ T6412] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[   90.075981][ T6412] F2FS-fs (loop2): Start checkpoint disabled!
[   90.078302][ T5847] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[   90.084080][ T6412] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6
[   90.157256][ T1088] kworker/u10:3: attempt to access beyond end of device
[   90.157256][ T1088] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[   90.185491][ T1088] CPU: 1 UID: 0 PID: 1088 Comm: kworker/u10:3 Not tainted syzkaller #0 PREEMPT(full) 
[   90.185504][ T1088] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   90.185510][ T1088] Workqueue: writeback wb_workfn (flush-7:2)
[   90.185524][ T1088] Call Trace:
[   90.185528][ T1088]  <TASK>
[   90.185531][ T1088]  dump_stack_lvl+0x189/0x250
[   90.185542][ T1088]  ? __pfx_dump_stack_lvl+0x10/0x10
[   90.185550][ T1088]  ? __pfx_queue_work_on+0x10/0x10
[   90.185557][ T1088]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   90.185567][ T1088]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   90.185580][ T1088]  f2fs_handle_critical_error+0x37c/0x540
[   90.185595][ T1088]  f2fs_write_end_io+0x886/0xb60
[   90.185608][ T1088]  __submit_merged_bio+0x27a/0x6a0
[   90.185619][ T1088]  __submit_merged_write_cond+0x255/0x530
[   90.185631][ T1088]  f2fs_write_data_pages+0x261d/0x3000
[   90.185654][ T1088]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[   90.185669][ T1088]  ? __pfx_f2fs_available_free_memory+0x10/0x10
[   90.185689][ T1088]  ? __pfx_f2fs_balance_fs_bg+0x10/0x10
[   90.185709][ T1088]  ? trace_f2fs_writepages+0x7f/0x200
[   90.185719][ T1088]  ? f2fs_write_node_pages+0x478/0x6e0
[   90.185729][ T1088]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[   90.185743][ T1088]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[   90.185753][ T1088]  do_writepages+0x32e/0x550
[   90.185765][ T1088]  ? reacquire_held_locks+0x127/0x1d0
[   90.185771][ T1088]  ? writeback_sb_inodes+0x384/0x1010
[   90.185783][ T1088]  __writeback_single_inode+0x145/0xff0
[   90.185791][ T1088]  ? do_raw_spin_unlock+0x4d/0x240
[   90.185801][ T1088]  writeback_sb_inodes+0x6c7/0x1010
[   90.185819][ T1088]  ? __pfx_writeback_sb_inodes+0x10/0x10
[   90.185843][ T1088]  ? rcu_is_watching+0x15/0xb0
[   90.185854][ T1088]  wb_writeback+0x43b/0xaf0
[   90.185865][ T1088]  ? queue_io+0x3d1/0x590
[   90.185875][ T1088]  ? __pfx_wb_writeback+0x10/0x10
[   90.185886][ T1088]  ? _raw_spin_unlock_irq+0x23/0x50
[   90.185897][ T1088]  wb_workfn+0x409/0xef0
[   90.185909][ T1088]  ? __pfx_wb_workfn+0x10/0x10
[   90.185918][ T1088]  ? __lock_acquire+0xab9/0xd20
[   90.185931][ T1088]  ? process_scheduled_works+0x9ef/0x17b0
[   90.185940][ T1088]  ? _raw_spin_unlock_irq+0x23/0x50
[   90.185948][ T1088]  ? process_scheduled_works+0x9ef/0x17b0
[   90.185954][ T1088]  ? process_scheduled_works+0x9ef/0x17b0
[   90.185961][ T1088]  process_scheduled_works+0xae1/0x17b0
[   90.185978][ T1088]  ? __pfx_process_scheduled_works+0x10/0x10
[   90.185991][ T1088]  worker_thread+0x8a0/0xda0
[   90.186002][ T1088]  ? __kthread_parkme+0x7b/0x200
[   90.186014][ T1088]  kthread+0x711/0x8a0
[   90.186023][ T1088]  ? __pfx_worker_thread+0x10/0x10
[   90.186029][ T1088]  ? __pfx_kthread+0x10/0x10
[   90.186038][ T1088]  ? _raw_spin_unlock_irq+0x23/0x50
[   90.186046][ T1088]  ? lockdep_hardirqs_on+0x9c/0x150
[   90.186055][ T1088]  ? __pfx_kthread+0x10/0x10
[   90.186064][ T1088]  ret_from_fork+0x3fc/0x770
[   90.186072][ T1088]  ? __pfx_ret_from_fork+0x10/0x10
[   90.186081][ T1088]  ? __switch_to_asm+0x39/0x70
[   90.186089][ T1088]  ? __switch_to_asm+0x33/0x70
[   90.186096][ T1088]  ? __pfx_kthread+0x10/0x10
[   90.186105][ T1088]  ret_from_fork_asm+0x1a/0x30
[   90.186119][ T1088]  </TASK>
[   90.186123][ T1088] F2FS-fs (loop2): Stopped filesystem due to reason: 3
[   90.200717][ T6426] openvswitch: netlink: Missing key (keys=40, expected=2000)
[   90.429419][ T6433] (unnamed net_device) (uninitialized): down delay (2) is not a multiple of miimon (100), value rounded to 0 ms
[   90.434252][ T6433] (unnamed net_device) (uninitialized): peer notification delay (8) is not a multiple of miimon (100), value rounded to 0 ms
[   90.491839][ T6433] 8021q: adding VLAN 0 to HW filter on device bond1
[   90.819686][   T10] usb 3-1: new high-speed USB device number 5 using dummy_hcd
[   91.076370][   T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[   91.095441][   T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3
[   91.137322][   T10] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[   91.142450][   T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[   91.152779][   T10] usb 3-1: SerialNumber: syz
[   91.417661][   T10] usb 3-1: 0:2 : does not exist
[   91.434118][   T10] usb 3-1: 5:0: failed to get current value for ch 1 (-22)
[   91.826601][   T10] usb 3-1: 5:0: failed to get current value for ch 0 (-22)
[   91.862285][   T10] usb 3-1: 5:0: cannot get min/max values for control 2 (id 5)
[   91.938679][   T47] IPVS: starting estimator thread 0...
[   91.939744][   T10] usb 3-1: USB disconnect, device number 5
[   92.045691][ T6460] IPVS: using max 81 ests per chain, 194400 per kthread
[   92.082178][ T5850] udevd[5850]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[   92.496897][   T33] audit: type=1326 audit(1756996928.532:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.1.206" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faac138ebe9 code=0x0
[   93.439925][ T6474] loop1: detected capacity change from 0 to 1024
[   93.441890][ T6476] warning: `syz.0.212' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   93.530992][ T1088] hfsplus: b-tree write err: -5, ino 4
[   93.538538][ T6478] netlink: 16 bytes leftover after parsing attributes in process `syz.0.213'.
[   93.574712][ T6480] capability: warning: `syz.2.215' uses deprecated v2 capabilities in a way that may be insecure
[   93.598557][ T6480] 9pnet_fd: p9_fd_create_tcp (6480): problem binding to privport
[   93.696093][ T6486] Illegal XDP return value 32768 on prog  (id 22) dev N/A, expect packet loss!
[   93.913232][ T6500] kernel profiling enabled (shift: 63)
[   93.918332][ T6500] profiling shift: 63 too large
[   94.037475][ T6509] netlink: 'syz.0.227': attribute type 5 has an invalid length.
[   94.129548][ T6517] loop2: detected capacity change from 0 to 512
[   94.158431][ T6517] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   94.163008][ T6517] ext4 filesystem being mounted at /80/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[   94.172091][   T33] audit: type=1800 audit(1756996930.202:6): pid=6517 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.232" name="file1" dev="loop2" ino=15 res=0 errno=0
[   94.188571][   T33] audit: type=1800 audit(1756996930.212:7): pid=6517 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.232" name="file2" dev="loop2" ino=16 res=0 errno=0
[   94.202344][ T5851] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   94.206283][   T33] audit: type=1800 audit(1756996930.212:8): pid=6517 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.232" name="file1" dev="loop2" ino=15 res=0 errno=0
[   94.466546][ T6120] usb 3-1: new full-speed USB device number 6 using dummy_hcd
[   94.629784][ T6120] usb 3-1: config 201 has an invalid interface number: 249 but max is 0
[   94.633285][ T6120] usb 3-1: config 201 has an invalid descriptor of length 0, skipping remainder of the config
[   94.637874][ T6120] usb 3-1: config 201 has no interface number 0
[   94.640555][ T6120] usb 3-1: config 201 interface 249 altsetting 4 has an endpoint descriptor with address 0xF1, changing to 0x81
[   94.645426][ T6120] usb 3-1: config 201 interface 249 altsetting 4 endpoint 0x3 has an invalid bInterval 0, changing to 10
[   94.650561][ T6120] usb 3-1: config 201 interface 249 altsetting 4 endpoint 0x3 has invalid maxpacket 255, setting to 64
[   94.655094][ T6120] usb 3-1: config 201 interface 249 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[   94.661760][ T6120] usb 3-1: config 201 interface 249 has no altsetting 0
[   94.666565][ T6120] usb 3-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=fa.df
[   94.669533][ T6120] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   94.672054][ T6120] usb 3-1: Product: syz
[   94.673416][ T6120] usb 3-1: Manufacturer: syz
[   94.675094][ T6120] usb 3-1: SerialNumber: syz
[   94.679576][ T6524] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[   94.905708][ T6120] ath6kl: Failed to submit usb control message: -71
[   94.909022][ T6120] ath6kl: unable to send the bmi data to the device: -71
[   94.911855][ T6120] ath6kl: Unable to send get target info: -71
[   94.920405][ T6120] ath6kl: Failed to init ath6kl core: -71
[   94.924718][ T6120] ath6kl_usb 3-1:201.249: probe with driver ath6kl_usb failed with error -71
[   94.956869][ T6120] usb 3-1: USB disconnect, device number 6
[   94.976668][ T5850] udevd[5850]: setting owner of /dev/bus/usb/003/006 to uid=0, gid=0 failed: No such file or directory
[   95.066209][ T6534] netlink: 8 bytes leftover after parsing attributes in process `syz.1.237'.
[   95.256611][   T10] usb 1-1: new high-speed USB device number 8 using dummy_hcd
[   95.409263][   T10] usb 1-1: config 27 interface 0 altsetting 0 has an endpoint descriptor with address 0x98, changing to 0x88
[   95.414128][   T10] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7
[   95.438264][   T10] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 255, changing to 11
[   95.447232][   T10] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 59391, setting to 1024
[   95.466328][   T10] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d
[   95.470629][   T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   95.481078][ T6529] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[   95.489315][   T10] usb 1-1: Quirk or no altset; falling back to MIDI 1.0
[   95.560211][ T6558] binder: BINDER_SET_CONTEXT_MGR already set
[   95.563714][ T6558] binder: 6557:6558 ioctl 4018620d 200000000100 returned -16
[   95.574523][ T6558] binder: BINDER_SET_CONTEXT_MGR already set
[   95.579872][ T6558] binder: 6557:6558 ioctl 4018620d 200000004a80 returned -16
[   95.668965][ T6564] loop2: detected capacity change from 0 to 1024
[   95.672615][ T6564] EXT4-fs: inline encryption not supported
[   95.675296][ T6564] EXT4-fs: Ignoring removed bh option
[   95.700154][ T6564] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   95.702323][   T10] usb 1-1: USB disconnect, device number 8
[   95.778593][ T6564] EXT4-fs error (device loop2): mb_free_blocks:2017: group 0, inode 15: block 241:freeing already freed block (bit 15); block bitmap corrupt.
[   95.787286][ T6564] EXT4-fs (loop2): Remounting filesystem read-only
[   95.805554][ T6563] loop1: detected capacity change from 0 to 32768
[   95.812940][ T6563] (syz.1.250,6563,1):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #66: rec_len is smaller than minimal - offset=88, inode=69, rec_len=8, name_len=8
[   95.819312][ T6563] (syz.1.250,6563,1):ocfs2_init_global_system_inodes:465 ERROR: status = -22
[   95.822511][ T6563] (syz.1.250,6563,1):ocfs2_init_global_system_inodes:467 ERROR: Unable to load system inode 2, possibly corrupt fs?
[   95.822525][ T6563] (syz.1.250,6563,1):ocfs2_init_global_system_inodes:476 ERROR: status = -22
[   95.830027][ T6563] (syz.1.250,6563,1):ocfs2_initialize_super:2198 ERROR: status = -22
[   95.833170][ T6563] (syz.1.250,6563,1):ocfs2_fill_super:1177 ERROR: status = -22
[   95.861333][ T5851] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   95.941251][ T6573] loop2: detected capacity change from 0 to 512
[   95.959733][ T6573] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
[   95.979476][ T6573] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2848: Unable to expand inode 15. Delete some EAs or run e2fsck.
[   95.999671][ T6573] EXT4-fs (loop2): 1 truncate cleaned up
[   96.003425][ T6573] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   96.033654][ T6576] loop1: detected capacity change from 0 to 256
[   96.150636][ T6576] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xb5f96684, utbl_chksum : 0xe619d30d)
[   96.855455][ T5851] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   97.159402][ T6594] loop1: detected capacity change from 0 to 32768
[   97.163323][ T6594] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.263 (6594)
[   97.179483][ T6594] BTRFS info (device loop1 state S): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6
[   97.184585][ T6594] BTRFS info (device loop1 state S): using blake2b (blake2b-256-generic) checksum algorithm
[   97.189149][  T791] usb 3-1: new high-speed USB device number 7 using dummy_hcd
[   97.213848][ T6594] BTRFS info (device loop1 state CS): enabling ssd optimizations
[   97.217274][ T6594] BTRFS info (device loop1 state CS): using spread ssd allocation scheme
[   97.220687][ T6594] BTRFS info (device loop1 state CS): turning off barriers
[   97.223661][ T6594] BTRFS info (device loop1 state CS): disabling log replay at mount time
[   97.231791][ T6594] BTRFS info (device loop1 state CS): enabling free space tree
[   97.236377][ T6594] BTRFS info (device loop1 state CS): ignoring bad roots
[   97.240582][ T6594] BTRFS info (device loop1 state CS): ignoring data csums
[   97.243693][ T6594] BTRFS info (device loop1 state CS): ignoring meta csums
[   97.251799][ T6594] BTRFS info (device loop1 state CS): ignoring unknown super block flags
[   97.255285][ T6594] BTRFS info (device loop1 state CS): force zlib compression, level 3
[   97.312259][ T5855] BTRFS info (device loop1 state CS): last unmount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6
[   97.338066][  T791] usb 3-1: Using ep0 maxpacket: 32
[   97.342483][  T791] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024
[   97.369703][  T791] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79
[   97.373419][  T791] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2
[   97.386732][  T791] usb 3-1: Product: syz
[   97.388472][  T791] usb 3-1: Manufacturer: syz
[   97.391519][  T791] usb 3-1: SerialNumber: syz
[   97.400744][  T791] usb 3-1: config 0 descriptor??
[   97.403514][ T6600] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[   97.411762][  T791] hub 3-1:0.0: bad descriptor, ignoring hub
[   97.415666][  T791] hub 3-1:0.0: probe with driver hub failed with error -5
[   97.569874][ T6638] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[   97.599917][ T6638] overlayfs: failed lookup in lower (/, name='file1', err=-66): unsupported object type
[   97.746748][  T791] usb 3-1: USB disconnect, device number 7
[   98.222842][ T6648] loop0: detected capacity change from 0 to 131072
[   98.228839][ T6648] F2FS-fs (loop0): invalid crc value
[   98.264043][ T6648] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[   98.268248][ T6648] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4
[   98.464538][ T6654] loop2: detected capacity change from 0 to 8192
[   98.474869][ T6654] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[   98.671538][ T6656] loop1: detected capacity change from 0 to 4096
[   99.200250][ T6666] loop2: detected capacity change from 0 to 164
[   99.206938][ T6666] iso9660: Unknown parameter 'ma'
[   99.371941][   T12] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[   99.685240][ T6675] loop0: detected capacity change from 0 to 8192
[   99.695235][   T10] usb 2-1: new full-speed USB device number 6 using dummy_hcd
[   99.860003][   T10] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08
[   99.869685][   T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   99.877474][ T6684] tipc: Started in network mode
[   99.880034][ T6684] tipc: Node identity 4, cluster identity 4711
[   99.882712][ T6684] tipc: Node number set to 4
[   99.893367][   T10] usb 2-1: config 0 descriptor??
[   99.986706][ T6688] netlink: 40 bytes leftover after parsing attributes in process `syz.2.292'.
[  100.106238][   T10] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor
[  100.135613][   T10] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 3
[  100.146528][   T10] [drm] Initialized udl on minor 3
[  100.217331][ T6698] loop2: detected capacity change from 0 to 512
[  100.250421][ T6698] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  100.264308][ T6698] ext4 filesystem being mounted at /98/file2 supports timestamps until 2038-01-19 (0x7fffffff)
[  100.307653][ T6703] loop0: detected capacity change from 0 to 512
[  100.321841][   T10] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed
[  100.336911][   T10] udl 2-1:0.0: [drm] Cannot find any crtc or sizes
[  100.348124][ T6703] EXT4-fs error (device loop0): ext4_orphan_get:1392: inode #15: comm syz.0.298: casefold flag without casefold feature
[  100.367692][ T5851] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  100.375380][ T6703] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.298: couldn't read orphan inode 15 (err -117)
[  100.399472][ T6703] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  100.480766][ T5847] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  100.531503][ T5314] usb 2-1: USB disconnect, device number 6
[  100.536923][   T10] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9
[  100.543653][   T10] udl 2-1:0.0: [drm] Cannot find any crtc or sizes
[  100.653489][ T6716] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  101.279629][ T6733] loop0: detected capacity change from 0 to 32768
[  101.291933][ T6733] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.310 (6733)
[  101.342929][ T6733] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  101.351128][ T6733] BTRFS info (device loop0): using sha256 (sha256-lib) checksum algorithm
[  101.400387][ T6743] binder: 6742:6743 ioctl c0306201 200000001a80 returned -14
[  101.402081][ T6733] BTRFS info (device loop0): enabling ssd optimizations
[  101.408276][ T6733] BTRFS info (device loop0): enabling free space tree
[  101.518748][ T5847] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  101.782712][ T6783] loop1: detected capacity change from 0 to 8
[  101.809638][ T6785] netlink: 8 bytes leftover after parsing attributes in process `syz.0.326'.
[  101.868687][ T6781] loop2: detected capacity change from 0 to 8192
[  101.906845][ T6781] FAT-fs (loop2): bogus sectors per cluster 0
[  101.909625][ T6781] FAT-fs (loop2): Can't find a valid FAT filesystem
[  102.140678][ T6797] loop2: detected capacity change from 0 to 256
[  102.276711][ T6798] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[  102.411395][ T6798] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
[  103.606731][   T47] usb 3-1: new full-speed USB device number 8 using dummy_hcd
[  103.756595][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  103.805762][   T47] usb 3-1: New USB device found, idVendor=13d8, idProduct=0011, bcdDevice=d0.62
[  103.815733][   T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  103.821188][   T47] usb 3-1: Product: syz
[  103.823032][   T47] usb 3-1: Manufacturer: syz
[  103.824968][   T47] usb 3-1: SerialNumber: syz
[  103.864527][   T47] usb 3-1: config 0 descriptor??
[  103.890756][ T6828] netlink: 8 bytes leftover after parsing attributes in process `syz.0.344'.
[  103.894558][ T6828] netlink: 'syz.0.344': attribute type 30 has an invalid length.
[  103.919524][   T47] comedi comedi5: This driver needs USB 2.0 to operate. Aborting...
[  103.926931][ T5875] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  103.936558][   T47] usbduxfast 3-1:0.0: driver 'usbduxfast' failed to auto-configure device.
[  103.945973][ T5875] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  103.959947][ T5875] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  103.963662][ T5875] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  104.090428][   T47] usb 3-1: USB disconnect, device number 8
[  104.143884][ T6840] loop0: detected capacity change from 0 to 128
[  104.171088][ T6840] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  104.178201][ T6843] loop1: detected capacity change from 0 to 512
[  104.184359][ T6840] ext4 filesystem being mounted at /109/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff)
[  104.198226][ T6843] EXT4-fs (loop1): Test dummy encryption mode enabled
[  104.215095][ T6843] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode
[  104.244240][ T6843] EXT4-fs (loop1): 1 truncate cleaned up
[  104.248383][ T6843] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  104.290835][ T5847] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  104.409535][ T6843] fscrypt: AES-256-XTS using implementation "xts(ecb(aes-fixed-time))"
[  104.485710][ T6856] fscrypt: AES-256-CBC-CTS using implementation "cts(cbc(ecb(aes-fixed-time)))"
[  104.542754][ T5855] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  104.640859][ T6865] loop1: detected capacity change from 0 to 4096
[  104.672214][ T6865] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  104.733797][ T5855] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  104.994389][ T6891] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  105.790701][ T6916] loop0: detected capacity change from 0 to 1024
[  105.820888][ T6916] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  105.832242][ T6916] EXT4-fs error (device loop0): ext4_get_first_dir_block:3552: inode #11: comm syz.0.374: directory missing '..'
[  105.869532][ T5847] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  106.449023][ T6936] netlink: 20 bytes leftover after parsing attributes in process `syz.1.381'.
[  106.452668][ T6936] netlink: 20 bytes leftover after parsing attributes in process `syz.1.381'.
[  106.790707][ T6926] syz.2.376 (6926): drop_caches: 2
[  107.030415][ T6950] loop2: detected capacity change from 0 to 164
[  107.047360][ T6950] ISOFS: unable to read i-node block
[  107.049862][ T6950] ISOFS: root inode is unusable. Disabling Rock Ridge and switching to Joliet.
[  107.192520][ T6961] loop1: detected capacity change from 0 to 128
[  107.202614][ T6960] netlink: 56 bytes leftover after parsing attributes in process `syz.2.394'.
[  107.205775][ T6960] netlink: 8 bytes leftover after parsing attributes in process `syz.2.394'.
[  107.224828][ T6961] Invalid source name
[  107.227689][ T6961] UBIFS error (pid: 6961): cannot open "/dev/loop1", error -22
[  107.316127][ T6965] syz.2.396 uses obsolete (PF_INET,SOCK_PACKET)
[  107.441722][ T6971] loop0: detected capacity change from 0 to 256
[  108.107911][ T6990] netlink: 8 bytes leftover after parsing attributes in process `syz.2.407'.
[  108.232636][ T6993] loop1: detected capacity change from 0 to 4096
[  108.245070][ T6993] NILFS (loop1): mounting unchecked fs
[  108.249701][ T6993] NILFS (loop1): recovery required for readonly filesystem
[  108.254299][ T6993] NILFS (loop1): write access will be enabled during recovery
[  108.265114][ T6993] NILFS (loop1): invalid segment: Checksum error in segment payload
[  108.270104][ T6993] NILFS (loop1): trying rollback from an earlier position
[  108.294308][ T6993] NILFS (loop1): norecovery option specified, skipping roll-forward recovery
[  108.313346][ T6993] NILFS (loop1): couldn't remount because the filesystem is in an incomplete recovery state
[  108.489552][ T6995] Bluetooth: received HCILL_WAKE_UP_ACK in state 2
[  108.501054][  T152] Bluetooth: hci3: Frame reassembly failed (-84)
[  109.276635][ T5314] usb 2-1: new high-speed USB device number 7 using dummy_hcd
[  109.429732][ T5314] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  109.433765][ T5314] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  109.439818][ T5314] usb 2-1: New USB device found, idVendor=056a, idProduct=0336, bcdDevice= 0.00
[  109.443627][ T5314] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  109.451541][ T5314] usb 2-1: config 0 descriptor??
[  109.870119][ T5314] wacom 0003:056A:0336.0004: hidraw0: USB HID v0.00 Device [HID 056a:0336] on usb-dummy_hcd.1-1/input0
[  109.906592][ T5896] usb 1-1: new high-speed USB device number 9 using dummy_hcd
[  110.056531][ T5896] usb 1-1: Using ep0 maxpacket: 8
[  110.060563][ T5896] usb 1-1: config 0 has an invalid interface number: 55 but max is 0
[  110.064263][ T5896] usb 1-1: config 0 has no interface number 0
[  110.068842][ T5896] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[  110.073284][ T5896] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B
[  110.073841][ T5314] usb 2-1: USB disconnect, device number 7
[  110.078846][ T5896] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[  110.086756][ T5896] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[  110.098795][ T5896] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a
[  110.103354][ T5896] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  110.114196][ T5896] usb 1-1: config 0 descriptor??
[  110.125604][ T5896] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0
[  110.333012][ T5896] usb 1-1: USB disconnect, device number 9
[  110.342018][ T5896] ldusb 1-1:0.55: LD USB Device #0 now disconnected
[  110.556671][ T5853] Bluetooth: hci3: Opcode 0x1003 failed: -110
[  110.556711][ T5238] Bluetooth: hci3: command 0x1003 tx timeout
[  111.720546][ T7045] loop1: detected capacity change from 0 to 4096
[  111.723384][ T7045] ntfs3(loop1): Different NTFS sector size (1024) and media sector size (512).
[  111.748203][ T7045] ntfs3(loop1): Mark volume as dirty due to NTFS errors
[  112.053430][ T7063] loop2: detected capacity change from 0 to 4096
[  112.075859][ T7063] ntfs3(loop2): Mark volume as dirty due to NTFS errors
[  112.078558][ T7063] ntfs3(loop2): Failed to initialize $Extend/$ObjId.
[  112.091410][ T7063] ntfs3(loop2): ino=1e, "file1" attr_set_size
[  112.184215][ T7069] input: syz1 as /devices/virtual/input/input7
[  112.806595][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  112.864516][ T7088] loop1: detected capacity change from 0 to 16
[  112.867278][ T7088] erofs: Unknown parameter 'cache_stratey'
[  113.006536][ T5314] usb 3-1: new high-speed USB device number 9 using dummy_hcd
[  113.082271][ T7088] loop1: detected capacity change from 0 to 32768
[  113.093690][ T7088] bcachefs (/dev/loop1): error validating superblock: Invalid superblock section journal_seq_blacklist: entry 0 start >= end (9 >= 7)
[  113.093690][ T7088] journal_seq_blacklist (size 40):
[  113.093690][ T7088] 9-7 24-64
[  113.093690][ T7088] 
[  113.103244][ T7088] bcachefs: bch2_fs_get_tree() error: invalid_sb_journal_seq_blacklist
[  113.167964][ T5314] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08
[  113.174616][ T5314] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  113.185833][ T5314] usb 3-1: config 0 descriptor??
[  113.284345][ T7092] loop1: detected capacity change from 0 to 512
[  113.289928][ T7092] EXT4-fs: Ignoring removed mblk_io_submit option
[  113.293790][ T7092] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock
[  113.304486][ T7092] EXT4-fs (loop1): revision level too high, forcing read-only mode
[  113.312222][ T7092] EXT4-fs (loop1): orphan cleanup on readonly fs
[  113.321579][ T7092] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:483: comm syz.1.452: Invalid block bitmap block 0 in block_group 0
[  113.333120][ T7092] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:483: comm syz.1.452: Invalid block bitmap block 0 in block_group 0
[  113.343026][ T7092] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:483: comm syz.1.452: Invalid block bitmap block 0 in block_group 0
[  113.361158][ T7092] Quota error (device loop1): write_blk: dquota write failed
[  113.365004][ T7092] Quota error (device loop1): qtree_write_dquot: Error -28 occurred while creating quota
[  113.376540][ T7092] EXT4-fs error (device loop1): ext4_acquire_dquot:6937: comm syz.1.452: Failed to acquire dquot type 1
[  113.384787][ T7092] EXT4-fs (loop1): 1 orphan inode deleted
[  113.400537][ T1089] Quota error (device loop1): do_check_range: Getting block 0 out of range 1-5
[  113.404374][ T1089] EXT4-fs error (device loop1): ext4_release_dquot:6973: comm kworker/u10:4: Failed to release dquot type 1
[  113.416340][ T7092] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
[  113.422341][ T7084] netlink: 12 bytes leftover after parsing attributes in process `syz.2.448'.
[  113.450276][ T5314] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor
[  113.458830][ T5855] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  113.658461][ T5314] [drm:udl_init] *ERROR* Selecting channel failed
[  113.676615][   T10] usb 1-1: new high-speed USB device number 10 using dummy_hcd
[  113.681229][ T5314] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 3
[  113.684355][ T5314] [drm] Initialized udl on minor 3
[  113.692290][ T5314] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9
[  113.696013][ T5314] udl 3-1:0.0: [drm] Cannot find any crtc or sizes
[  113.701715][ T5314] usb 3-1: USB disconnect, device number 9
[  113.705675][ T6120] udl 3-1:0.0: [drm] Cannot find any crtc or sizes
[  113.791212][ T7100] loop1: detected capacity change from 0 to 2048
[  113.795852][ T7100] EXT4-fs: Ignoring removed orlov option
[  113.822234][ T7100] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  113.846264][   T10] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00
[  113.852916][   T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  113.857407][   T10] usb 1-1: Product: syz
[  113.859722][   T10] usb 1-1: Manufacturer: syz
[  113.861979][   T10] usb 1-1: SerialNumber: syz
[  113.893977][ T5855] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  114.330034][ T7117] loop2: detected capacity change from 0 to 1024
[  114.339791][ T7117] EXT4-fs: Ignoring removed bh option
[  114.343506][ T7117] EXT4-fs (loop2): stripe (5) is not aligned with cluster size (16), stripe is disabled
[  114.353708][ T5314] usb 2-1: new full-speed USB device number 8 using dummy_hcd
[  114.362087][ T7117] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  114.394047][ T7117] EXT4-fs error (device loop2): ext4_check_all_de:659: inode #12: block 7: comm syz.2.462: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0
[  114.406193][ T7117] EXT4-fs (loop2): Remounting filesystem read-only
[  114.450450][ T5851] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  114.506488][ T5314] usb 2-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  114.511543][ T5314] usb 2-1: config 1 interface 0 has no altsetting 0
[  114.519014][   T10] rtl8150 1-1:1.0: eth1: rtl8150 is detected
[  114.526800][ T5314] usb 2-1: New USB device found, idVendor=05ac, idProduct=0225, bcdDevice= 0.40
[  114.530447][ T5314] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  114.534042][ T5314] usb 2-1: Product: syz
[  114.535781][ T5314] usb 2-1: Manufacturer: syz
[  114.537614][ T5314] usb 2-1: SerialNumber: syz
[  114.695612][   T10] usb 1-1: USB disconnect, device number 10
[  114.758339][ T5314] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input8
[  114.776024][ T5281] bcm5974 2-1:1.0: could not read from device
[  114.783950][ T5281] bcm5974 2-1:1.0: could not read from device
[  114.794632][ T5314] usb 2-1: USB disconnect, device number 8
[  114.800452][ T5281] bcm5974 2-1:1.0: could not read from device
[  114.809460][ T5281] bcm5974 2-1:1.0: could not read from device
[  115.990956][ T7144] loop1: detected capacity change from 0 to 32768
[  116.021442][ T7144] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  116.074843][ T7144] XFS (loop1): Ending clean mount
[  116.085701][ T7144] XFS (loop1): Quotacheck needed: Please wait.
[  116.167259][ T7144] XFS (loop1): Quotacheck: Done.
[  116.420020][ T5855] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  116.587694][ T7160] pim6reg1: entered promiscuous mode
[  116.590233][ T7160] pim6reg1: entered allmulticast mode
[  118.019773][ T7184] netlink: 20 bytes leftover after parsing attributes in process `syz.2.481'.
[  118.282406][ T7181] loop1: detected capacity change from 0 to 32768
[  118.353652][ T7181] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  118.384697][ T7181] XFS (loop1): Ending clean mount
[  118.389636][ T7181] XFS (loop1): Quotacheck needed: Please wait.
[  118.419093][ T7181] XFS (loop1): Quotacheck: Done.
[  118.421093][  T791] usb 1-1: new high-speed USB device number 11 using dummy_hcd
[  118.563951][  T791] usb 1-1: Using ep0 maxpacket: 16
[  118.604656][  T791] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  118.697909][  T791] usb 1-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a
[  118.713713][  T791] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  118.731043][  T791] usb 1-1: Product: syz
[  118.740784][  T791] usb 1-1: Manufacturer: syz
[  118.756599][  T791] usb 1-1: SerialNumber: syz
[  118.786996][ T5855] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  118.792640][  T791] usb 1-1: config 0 descriptor??
[  118.805540][  T791] pegasus_notetaker 1-1:0.0: Invalid number of endpoints
[  118.816056][  T791] pegasus_notetaker 1-1:0.0: probe with driver pegasus_notetaker failed with error -22
[  118.981123][ T7206] loop1: detected capacity change from 0 to 2048
[  118.986274][ T7206] EXT4-fs: Ignoring removed nobh option
[  118.998514][   T47] usb 1-1: USB disconnect, device number 11
[  119.017532][ T7206] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  119.035703][   T33] audit: type=1800 audit(908.400:9): pid=7206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.487" name="file0" dev="loop1" ino=13 res=0 errno=0
[  119.069807][ T5855] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  119.555129][ T7234] sch_tbf: burst 19872 is lower than device lo mtu (65550) !
[  119.675924][ T7240] loop1: detected capacity change from 0 to 1024
[  119.680935][ T7240] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled
[  119.684000][ T7240] EXT4-fs (loop1): Test dummy encryption mode enabled
[  119.686083][ T7240] EXT4-fs (loop1): filesystem too large to mount safely on this system
[  119.699445][ T7236] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0)
[  119.759469][ T7242] loop2: detected capacity change from 0 to 128
[  119.818764][ T7244] overlayfs: failed to clone upperpath
[  119.872931][ T7246] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[  120.174792][ T7260] netlink: 24 bytes leftover after parsing attributes in process `syz.2.512'.
[  120.834307][ T7280] netlink: 'syz.1.522': attribute type 10 has an invalid length.
[  120.857544][ T7238] loop0: detected capacity change from 0 to 262144
[  120.862215][ T7238] BTRFS: device fsid 7e32c2af-f87a-45a1-bcba-64dea7c56a53 devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.501 (7238)
[  120.869840][ T7238] BTRFS info (device loop0): first mount of filesystem 7e32c2af-f87a-45a1-bcba-64dea7c56a53
[  120.873964][ T7238] BTRFS info (device loop0): using xxhash64 (xxhash64-generic) checksum algorithm
[  120.933234][ T1092] BTRFS warning (device loop0): checksum verify failed on logical 22036480 mirror 1 wanted 0x23e101be1e001a29 found 0x09049c5cc74d15fb level 0
[  120.945888][ T7238] BTRFS info (device loop0): read error corrected: ino 0 off 22036480 (dev /dev/loop0 sector 43040)
[  120.950600][ T7238] BTRFS info (device loop0): read error corrected: ino 0 off 22040576 (dev /dev/loop0 sector 43048)
[  120.955329][ T7238] BTRFS info (device loop0): read error corrected: ino 0 off 22044672 (dev /dev/loop0 sector 43056)
[  120.960220][ T7238] BTRFS info (device loop0): read error corrected: ino 0 off 22048768 (dev /dev/loop0 sector 43064)
[  120.975694][ T7238] BTRFS info (device loop0): enabling ssd optimizations
[  120.978546][ T7238] BTRFS info (device loop0): enabling free space tree
[  121.336094][ T7238] BTRFS info (device loop0): balance: start -d -m -s
[  121.346943][ T7238] BTRFS info (device loop0): relocating block group 30408704 flags metadata|dup
[  121.381828][ T7238] BTRFS info (device loop0): found 3 extents, stage: move data extents
[  121.405710][ T7238] BTRFS info (device loop0): relocating block group 22020096 flags system|dup
[  121.427894][ T7238] BTRFS info (device loop0): found 1 extents, stage: move data extents
[  121.446224][ T7238] BTRFS info (device loop0): relocating block group 13631488 flags data
[  121.495908][ T7238] BTRFS info (device loop0): found 2 extents, stage: move data extents
[  121.519397][ T7238] BTRFS info (device loop0): found 2 extents, stage: update data pointers
[  121.539970][ T7238] BTRFS info (device loop0): balance: ended with status: 0
[  121.653134][ T5847] BTRFS info (device loop0): last unmount of filesystem 7e32c2af-f87a-45a1-bcba-64dea7c56a53
[  122.097848][ T7321] netlink: 116 bytes leftover after parsing attributes in process `syz.1.532'.
[  122.140976][ T7323] netlink: 'syz.1.533': attribute type 9 has an invalid length.
[  122.144369][ T7323] netlink: 4 bytes leftover after parsing attributes in process `syz.1.533'.
[  122.387550][ T7334] fuse: Bad value for 'fd'
[  122.618630][ T7348] loop0: detected capacity change from 0 to 256
[  122.657219][ T7348] FAT-fs (loop0): Directory bread(block 64) failed
[  122.661371][ T7348] FAT-fs (loop0): Directory bread(block 65) failed
[  122.664228][ T7348] FAT-fs (loop0): Directory bread(block 66) failed
[  122.666871][ T7348] FAT-fs (loop0): Directory bread(block 67) failed
[  122.671614][ T7348] FAT-fs (loop0): Directory bread(block 68) failed
[  122.674426][ T7348] FAT-fs (loop0): Directory bread(block 69) failed
[  122.677146][ T7348] FAT-fs (loop0): Directory bread(block 70) failed
[  122.682866][ T7348] FAT-fs (loop0): Directory bread(block 71) failed
[  122.693372][ T7348] FAT-fs (loop0): Directory bread(block 72) failed
[  122.696129][ T7348] FAT-fs (loop0): Directory bread(block 73) failed
[  123.442884][ T7390] loop0: detected capacity change from 0 to 32768
[  123.465382][ T7390] OCFS2: ERROR (device loop0): int ocfs2_validate_inode_block(struct super_block *, struct buffer_head *): Invalid dinode #76: signature = INODE0
[  123.472400][ T7390] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[  123.478363][ T7390] OCFS2: File system is now read-only.
[  123.480573][ T7390] (syz.0.564,7390,1):ocfs2_read_locked_inode:597 ERROR: status = -30
[  123.484963][ T7390] (syz.0.564,7390,1):_ocfs2_get_system_file_inode:144 ERROR: status = -30
[  123.488027][ T7390] (syz.0.564,7390,1):ocfs2_init_local_system_inodes:496 ERROR: status=-30, sysfile=11, slot=0
[  123.492907][ T7390] (syz.0.564,7390,1):ocfs2_init_local_system_inodes:505 ERROR: status = -30
[  123.496247][ T7390] (syz.0.564,7390,1):ocfs2_mount_volume:1758 ERROR: status = -30
[  123.500986][ T7390] (syz.0.564,7390,1):ocfs2_fill_super:1177 ERROR: status = -30
[  125.115279][ T7434] netlink: 8 bytes leftover after parsing attributes in process `syz.1.586'.
[  125.528176][ T7452] sctp: [Deprecated]: syz.0.589 (pid 7452) Use of int in max_burst socket option deprecated.
[  125.528176][ T7452] Use struct sctp_assoc_value instead
[  125.767607][ T7457] vxcan1: tx address claim with dlc 0
[  126.148420][ T7473] netlink: 'syz.2.604': attribute type 6 has an invalid length.
[  126.580488][ T7483] loop0: detected capacity change from 0 to 1024
[  126.701646][ T7483] hfsplus: bad catalog entry type
[  126.748502][ T1088] hfsplus: b-tree write err: -5, ino 4
[  126.956664][   T33] audit: type=1326 audit(916.780:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7495 comm="syz.2.614" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f219b18ebe9 code=0x0
[  127.060528][   T47] usb 1-1: new high-speed USB device number 12 using dummy_hcd
[  127.202585][   T47] usb 1-1: Using ep0 maxpacket: 32
[  127.211626][   T47] usb 1-1: unable to get BOS descriptor or descriptor too short
[  127.217072][   T47] usb 1-1: config 0 has an invalid interface number: 223 but max is 0
[  127.220883][   T47] usb 1-1: config 0 has no interface number 0
[  127.226678][   T47] usb 1-1: config 0 interface 223 altsetting 2 endpoint 0xF has invalid maxpacket 1023, setting to 64
[  127.232454][   T47] usb 1-1: config 0 interface 223 altsetting 2 endpoint 0x4 has invalid maxpacket 1024, setting to 64
[  127.236919][   T47] usb 1-1: config 0 interface 223 has no altsetting 0
[  127.243136][   T47] usb 1-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=86.21
[  127.247540][   T47] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  127.252513][   T47] usb 1-1: Product: syz
[  127.254399][   T47] usb 1-1: Manufacturer: syz
[  127.256501][   T47] usb 1-1: SerialNumber: syz
[  127.265684][   T47] usb 1-1: config 0 descriptor??
[  127.277294][   T47] usb 1-1: Quirk or no altset; falling back to MIDI 1.0
[  127.358045][ T5958] udevd[5958]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.223/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  127.486150][   T47] usb 1-1: USB disconnect, device number 12
[  129.039446][ T6101] usb 1-1: new high-speed USB device number 13 using dummy_hcd
[  129.184166][ T6101] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  129.187762][ T6101] usb 1-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00
[  129.191609][ T6101] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  129.197083][ T6101] usb 1-1: config 0 descriptor??
[  129.603776][ T6101] itetech 0003:258A:6A88.0005: unbalanced collection at end of report description
[  129.607268][ T6101] itetech 0003:258A:6A88.0005: probe with driver itetech failed with error -22
[  129.801845][ T6101] usb 1-1: USB disconnect, device number 13
[  129.834991][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  130.802603][ T7574] loop0: detected capacity change from 0 to 32768
[  130.816035][ T7574] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.647 (7574)
[  130.886722][ T7595] IPVS: length: 24 != 600
[  131.262325][ T7574] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  131.277195][ T7574] BTRFS info (device loop0): using sha256 (sha256-lib) checksum algorithm
[  131.363476][ T7574] BTRFS info (device loop0): enabling ssd optimizations
[  131.366575][ T7574] BTRFS info (device loop0): enabling free space tree
[  131.423560][ T5847] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  131.657130][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[  131.659778][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[  131.767657][ T7614] loop0: detected capacity change from 0 to 32768
[  132.302149][ T7638] netlink: 'syz.2.666': attribute type 4 has an invalid length.
[  132.384831][ T7648] bridge0: port 3(team0) entered blocking state
[  132.387633][ T7648] bridge0: port 3(team0) entered disabled state
[  132.391089][ T7648] team0: entered allmulticast mode
[  132.395437][ T7648] team_slave_0: entered allmulticast mode
[  132.397911][ T7648] team_slave_1: entered allmulticast mode
[  132.406548][ T7648] team0: entered promiscuous mode
[  132.408906][ T7648] team_slave_0: entered promiscuous mode
[  132.415272][ T7648] team_slave_1: entered promiscuous mode
[  132.418822][ T7648] bridge0: port 3(team0) entered blocking state
[  132.422932][ T7648] bridge0: port 3(team0) entered forwarding state
[  134.242210][ T7680] netlink: 'syz.0.682': attribute type 9 has an invalid length.
[  135.273820][ T7724] Invalid ELF header magic: != ELF
[  135.749233][ T7770] netlink: 'syz.2.725': attribute type 3 has an invalid length.
[  135.752990][ T7770] netlink: 'syz.2.725': attribute type 3 has an invalid length.
[  135.758845][ T7770] netlink: 'syz.2.725': attribute type 3 has an invalid length.
[  135.762189][ T7770] netlink: 'syz.2.725': attribute type 3 has an invalid length.
[  135.770362][ T7770] netlink: 'syz.2.725': attribute type 3 has an invalid length.
[  135.773730][ T7770] netlink: 'syz.2.725': attribute type 3 has an invalid length.
[  135.781526][ T7770] netlink: 'syz.2.725': attribute type 3 has an invalid length.
[  135.785192][ T7770] netlink: 'syz.2.725': attribute type 3 has an invalid length.
[  135.810714][ T7774] netlink: zone id is out of range
[  135.818128][ T7774] netlink: zone id is out of range
[  135.830584][ T7774] netlink: zone id is out of range
[  135.837792][ T7774] netlink: zone id is out of range
[  135.840011][ T7774] netlink: zone id is out of range
[  135.850248][ T7774] netlink: zone id is out of range
[  135.852450][ T7774] netlink: zone id is out of range
[  135.857509][ T7774] netlink: zone id is out of range
[  135.865704][ T7776] netlink: del zone limit has 4 unknown bytes
[  135.873971][ T7774] netlink: zone id is out of range
[  137.226300][ T7821] fuse: Bad value for 'fd'
[  138.523589][ T5915] usb 1-1: new high-speed USB device number 14 using dummy_hcd
[  138.683309][ T7875] validate_nla: 46 callbacks suppressed
[  138.683322][ T7875] netlink: 'syz.2.771': attribute type 2 has an invalid length.
[  138.689226][ T5915] usb 1-1: Using ep0 maxpacket: 16
[  138.696420][ T5915] usb 1-1: unable to get BOS descriptor or descriptor too short
[  138.701625][ T5915] usb 1-1: config 0 has an invalid interface number: 51 but max is 0
[  138.707485][ T5915] usb 1-1: config 0 has no interface number 0
[  138.710580][ T5915] usb 1-1: config 0 interface 51 has no altsetting 0
[  138.714878][ T7877] netlink: 48 bytes leftover after parsing attributes in process `syz.1.772'.
[  138.717589][ T5915] usb 1-1: New USB device found, idVendor=eb1a, idProduct=2710, bcdDevice=83.9c
[  138.722923][ T5915] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  138.731412][ T5915] usb 1-1: Product: syz
[  138.733383][ T5915] usb 1-1: Manufacturer: syz
[  138.738124][ T5915] usb 1-1: SerialNumber: syz
[  138.746390][ T5915] usb 1-1: config 0 descriptor??
[  138.951720][ T5915] em28xx 1-1:0.51: audio device (eb1a:2710): interface 51, class 1
[  138.963471][ T5915] usb 1-1: USB disconnect, device number 14
[  139.249897][ T7912] netlink: 4 bytes leftover after parsing attributes in process `syz.1.789'.
[  140.014749][ T7947] nfs4: Unexpected value for 'acl'
[  141.289313][ T7991] bridge0: port 2(bridge_slave_1) entered disabled state
[  141.552642][ T8009] netlink: 'syz.0.837': attribute type 298 has an invalid length.
[  142.650252][ T8032] loop0: detected capacity change from 0 to 4096
[  142.658583][ T8032] EXT4-fs (loop0): Test dummy encryption mode enabled
[  142.677501][ T8032] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  142.695865][ T8032] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.846: bg 0: block 232: padding at end of block bitmap is not set
[  142.731435][ T5847] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  142.821165][ T8042] netlink: 8 bytes leftover after parsing attributes in process `syz.2.850'.
[  143.192732][ T8063] loop0: detected capacity change from 0 to 4096
[  143.221716][ T8066] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  144.138673][ T8090] loop0: detected capacity change from 0 to 32768
[  144.175139][ T8090] XFS (loop0): Mounting V5 Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a
[  144.196587][ T8112] fuse: Bad value for 'fd'
[  144.214179][ T8090] XFS (loop0): Ending clean mount
[  144.264216][   T33] audit: type=1800 audit(936.005:11): pid=8090 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.868" name="file1" dev="loop0" ino=6150 res=0 errno=0
[  144.334820][ T5847] XFS (loop0): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a
[  144.463956][   T33] audit: type=1326 audit(936.204:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8108 comm="syz.1.876" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  144.487803][   T33] audit: type=1326 audit(936.204:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8108 comm="syz.1.876" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  144.575424][   T33] audit: type=1326 audit(936.204:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8108 comm="syz.1.876" exe="/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  144.652114][   T33] audit: type=1326 audit(936.204:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8108 comm="syz.1.876" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  144.709897][   T33] audit: type=1326 audit(936.204:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8108 comm="syz.1.876" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  144.718743][   T33] audit: type=1326 audit(936.204:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8108 comm="syz.1.876" exe="/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  144.727784][   T33] audit: type=1326 audit(936.215:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8108 comm="syz.1.876" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  144.736189][   T33] audit: type=1326 audit(936.215:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8108 comm="syz.1.876" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  144.744556][   T33] audit: type=1326 audit(936.215:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8108 comm="syz.1.876" exe="/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  144.833381][ T8124] pim6reg1: entered promiscuous mode
[  144.838735][ T8124] pim6reg1: entered allmulticast mode
[  146.352092][ T8167] lo: MTU too low for tipc bearer
[  146.353909][ T8167] tipc: Enabling of bearer <eth:lo> rejected, failed to enable media
[  146.388686][ T8169] loop0: detected capacity change from 0 to 16
[  146.413026][ T8169] erofs (device loop0): mounted with root inode @ nid 36.
[  148.161939][ T8240] loop0: detected capacity change from 0 to 512
[  148.170417][ T8240] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem
[  148.200211][ T8240] EXT4-fs error (device loop0): ext4_orphan_get:1392: inode #15: comm syz.0.933: iget: bad extended attribute block 851968
[  148.219922][ T8240] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.933: couldn't read orphan inode 15 (err -117)
[  148.225077][ T8240] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  148.261046][ T5847] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  148.325944][ T8252] loop0: detected capacity change from 0 to 16
[  148.352900][ T8252] erofs (device loop0): mounted with root inode @ nid 36.
[  148.487168][ T8262] 9pnet_fd: Insufficient options for proto=fd
[  149.254877][ T8277] netlink: 60 bytes leftover after parsing attributes in process `syz.2.950'.
[  149.260189][ T8277] netlink: 60 bytes leftover after parsing attributes in process `syz.2.950'.
[  149.264259][ T8277] netlink: 60 bytes leftover after parsing attributes in process `syz.2.950'.
[  149.548814][ T8302] delete_channel: no stack
[  149.825852][ T8325] sch_fq: defrate 4294967295 ignored.
[  149.892959][ T8327] netlink: 52 bytes leftover after parsing attributes in process `syz.2.974'.
[  149.921546][ T8327] netlink: 4 bytes leftover after parsing attributes in process `syz.2.974'.
[  149.973284][ T8327] team_slave_0 (unregistering): left promiscuous mode
[  149.975926][ T8327] team_slave_0 (unregistering): left allmulticast mode
[  149.982447][ T8327] team0: Port device team_slave_0 removed
[  150.130559][ T8331] (unnamed net_device) (uninitialized): option ad_user_port_key: invalid value (1136)
[  150.139339][ T8331] (unnamed net_device) (uninitialized): option ad_user_port_key: allowed values 0 - 1023
[  151.171544][ T8384] netlink: 24 bytes leftover after parsing attributes in process `syz.1.994'.
[  151.473128][ T8410] netlink: 'syz.0.1005': attribute type 9 has an invalid length.
[  151.489081][ T8410] netlink: 'syz.0.1005': attribute type 9 has an invalid length.
[  152.918271][ T8478] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1037'.
[  153.471829][ T8511] loop0: detected capacity change from 0 to 128
[  153.783560][ T8528] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1060'.
[  154.470969][ T8549] loop0: detected capacity change from 0 to 4096
[  154.477032][ T8549] ntfs3: Bad value for 'umask'
[  155.503998][ T8564] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1076'.
[  155.645460][ T8569] netlink: 'syz.1.1078': attribute type 5 has an invalid length.
[  155.778657][ T8581] loop0: detected capacity change from 0 to 512
[  155.787595][ T8581] EXT4-fs (loop0): revision level too high, forcing read-only mode
[  155.795125][ T8581] EXT4-fs (loop0): orphan cleanup on readonly fs
[  155.798459][ T8581] __quota_error: 5 callbacks suppressed
[  155.798469][ T8581] Quota error (device loop0): v2_read_file_info: Block with free entry 4294967071 out of range (1, 6).
[  155.806391][ T8581] EXT4-fs warning (device loop0): ext4_enable_quotas:7172: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix.
[  155.813895][ T8581] EXT4-fs (loop0): Cannot turn on quotas: error -117
[  155.824338][ T8581] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.1083: bg 0: block 40: padding at end of block bitmap is not set
[  155.833742][ T8581] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6657: Corrupt filesystem
[  155.839436][ T8581] EXT4-fs (loop0): 1 truncate cleaned up
[  155.843512][ T8581] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
[  155.855525][ T8581] EXT4-fs error (device loop0): ext4_get_link:106: inode #16: comm syz.0.1083: bad symlink.
[  155.879135][ T5847] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  156.142952][ T8589] loop0: detected capacity change from 0 to 32768
[  156.147673][ T8589] bcachefs (/dev/loop0): error validating superblock: Invalid superblock section clean: entry type btree_keys overruns end of section
[  156.147673][ T8589] clean (size 2912):
[  156.147673][ T8589] flags:          0
[  156.147673][ T8589] journal_seq:    8
[  156.147673][ T8589] prio_ptrs: 
[  156.147673][ T8589] usage: type=key_version v=0
[  156.147673][ T8589] usage: type=reserved v=0
[  156.147673][ T8589] usage: type=reserved v=0
[  156.147673][ T8589] usage: type=reserved v=0
[  156.147673][ T8589] usage: type=reserved v=0
[  156.147673][ T8589] data_usage: btree: 1/1 [0]=2816
[  156.147673][ T8589] data_usage: journal: 1/1 [0]=0
[  156.147673][ T8589] data_usage: user: 1/1 [0]=32
[  156.147673][ T8589] dev_usage: dev=0  
[  156.147673][ T8589]   free: buckets=83 sectors=0 fragmented=0
[  156.147673][ T8589]   sb: buckets=25 sectors=6152 fragmented=248
[  156.147673][ T8589]   journal: buckets=8 sectors=2048 fragmented=0
[  156.147673][ T8589]   btree: buckets=11 sectors=2816 fragmented=0
[  156.147673][ T8589]   user: buckets=1 sectors=32 fragmented=224
[  156.147673][ T8589]   cached: buckets=0 sectors=0 fragmented=0
[  156.147673][ T8589]   parity: buckets=0 sectors=0 fragmented=0
[  156.147673][ T8589]   stripe: buckets=0 sectors=0 fragmented=0
[  156.147673][ T8589]   need_gc_gens: buckets=0 sectors=0 fragmented=0
[  156.147673][ T8589]   need_discard: buckets=0 sectors=0 fragmented=0
[  156.147673][ T8589] clock: read=0
[  156.147673][ T8589] clock: write=1288
[  156.147673][ T8589] btree_root: btree=extents level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 249e7ae2af8ee3
[  156.147822][ T8589] bcachefs: bch2_fs_get_tree() error: invalid_sb_clean
[  157.077012][ T8634] process 'syz.1.1109' launched './file0' with NULL argv: empty string added
[  157.616072][ T8649] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1115'.
[  158.006843][ T8670] syz_tun: entered allmulticast mode
[  158.162094][ T8669] syz_tun: left allmulticast mode
[  159.957114][ T8717] net_ratelimit: 39 callbacks suppressed
[  159.957129][ T8717] openvswitch: netlink: VXLAN extension 2 out of range max 1
[  160.025431][ T8720] netlink: 300 bytes leftover after parsing attributes in process `syz.2.1146'.
[  160.387559][ T8744] loop0: detected capacity change from 0 to 164
[  160.481311][ T8749] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1159'.
[  162.040714][ T8799] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1182'.
[  163.015127][ T8816] netlink: 172 bytes leftover after parsing attributes in process `syz.0.1190'.
[  163.101287][ T8822] netlink: 'syz.1.1192': attribute type 1 has an invalid length.
[  163.103963][ T8822] netlink: 'syz.1.1192': attribute type 2 has an invalid length.
[  163.112602][ T8822] netlink: 'syz.1.1192': attribute type 1 has an invalid length.
[  163.116013][ T8822] netlink: 1156 bytes leftover after parsing attributes in process `syz.1.1192'.
[  163.340950][ T8838] loop0: detected capacity change from 0 to 128
[  163.821241][ T8841] loop0: detected capacity change from 0 to 32768
[  163.824381][ T8841] BTRFS warning: excessive commit interval 491628334, use with care
[  163.827845][ T8841] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.1200 (8841)
[  163.839909][ T8841] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  163.846547][ T8841] BTRFS info (device loop0): using crc32c (crc32c-lib) checksum algorithm
[  163.911335][ T8841] BTRFS info (device loop0): setting nodatasum
[  163.917379][ T8841] BTRFS info (device loop0): enabling ssd optimizations
[  163.923623][ T8841] BTRFS info (device loop0): enabling free space tree
[  163.932285][ T8841] BTRFS info (device loop0): max_inline set to 0
[  164.103130][ T5847] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  164.616058][ T8885] loop0: detected capacity change from 0 to 4096
[  165.144000][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  165.333866][ T8898] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null.
[  165.339184][ T8898] overlayfs: failed to clone lowerpath
[  165.972938][   T33] audit: type=1326 audit(958.807:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8909 comm="syz.1.1223" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7fc00000
[  166.033555][   T33] audit: type=1326 audit(958.880:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8909 comm="syz.1.1223" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7fc00000
[  166.073487][   T33] audit: type=1326 audit(958.880:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8909 comm="syz.1.1223" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7fc00000
[  166.099496][   T33] audit: type=1326 audit(958.880:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8909 comm="syz.1.1223" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7fc00000
[  166.119186][   T33] audit: type=1326 audit(958.880:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8909 comm="syz.1.1223" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7fc00000
[  166.566557][ T8921] loop0: detected capacity change from 0 to 40427
[  166.586173][ T8921] F2FS-fs (loop0): Wrong segment_count / block_count (31 > 0)
[  166.593029][ T8921] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
[  166.613182][ T8921] F2FS-fs (loop0): invalid crc value
[  166.660249][   T33] audit: type=1326 audit(959.531:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8909 comm="syz.1.1223" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7fc00000
[  166.719859][ T8921] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[  166.730439][ T8921] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
[  166.733638][ T8921] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
[  166.979687][ T8936] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1234'.
[  167.388879][ T8939] netlink: 'syz.2.1235': attribute type 3 has an invalid length.
[  168.093318][ T8943] loop0: detected capacity change from 0 to 32768
[  168.139719][ T8943] syz.0.1232: attempt to access beyond end of device
[  168.139719][ T8943] loop0: rw=1, sector=4680032, nr_sectors = 8 limit=32768
[  168.146926][ T8943] metapage_write_end_io: I/O error
[  168.150172][ T8943] ERROR: (device loop0): release_metapage: metapage_write_one() failed
[  168.150172][ T8943] 
[  168.158795][ T8943] ERROR: (device loop0): remounting filesystem as read-only
[  168.162138][ T8943] ERROR: (device loop0): diWrite: ixpxd invalid
[  168.162138][ T8943] 
[  168.166365][ T8943] ERROR: (device loop0): txCommit: 
[  168.166365][ T8943] 
[  168.178112][ T8943] blkno = 8ed2c, nblocks = 1
[  168.180968][ T8943] ERROR: (device loop0): dbUpdatePMap: blocks are outside the map
[  168.180968][ T8943] 
[  168.188832][ T8943] UFO tlock:0xffffc90001f92090
[  168.244756][ T8943] ERROR: (device loop0): dtSearch: DT_GETPAGE: dtree page corrupt
[  168.244756][ T8943] 
[  168.249319][ T8943] jfs_lookup: dtSearch returned -5
[  168.275978][  T115] blkno = 8ed2c, nblocks = 4
[  168.283990][  T115] ERROR: (device loop0): dbUpdatePMap: blocks are outside the map
[  168.283990][  T115] 
[  168.290038][ T5847] syz-executor: attempt to access beyond end of device
[  168.290038][ T5847] loop0: rw=1, sector=4680032, nr_sectors = 8 limit=32768
[  168.299646][ T5847] metapage_write_end_io: I/O error
[  168.302218][ T5847] JFS: metapage_get_blocks failed
[  168.304398][ T5847] JFS: metapage_get_blocks failed
[  168.306237][ T5847] JFS: metapage_get_blocks failed
[  168.309175][ T5847] JFS: metapage_get_blocks failed
[  168.434200][ T8978] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1252'.
[  168.657714][ T8990] bridge1: entered promiscuous mode
[  168.667175][ T8990] bridge1: entered allmulticast mode
[  168.672714][ T8990] team0: Port device bridge1 added
[  168.815957][ T9002] netlink: 'syz.1.1263': attribute type 29 has an invalid length.
[  168.819220][ T9002] netlink: 'syz.1.1263': attribute type 29 has an invalid length.
[  168.822571][ T9002] netlink: 500 bytes leftover after parsing attributes in process `syz.1.1263'.
[  168.882503][ T9006] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  168.887772][ T9006] batadv_slave_0: entered promiscuous mode
[  168.916508][ T9006] batadv_slave_0: entered allmulticast mode
[  168.921292][ T9006] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check.
[  169.725747][   T47] usb 1-1: new high-speed USB device number 15 using dummy_hcd
[  169.889980][   T47] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  169.899523][   T47] usb 1-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00
[  169.903908][   T47] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  169.924848][   T47] usb 1-1: config 0 descriptor??
[  170.334288][   T47] prodikeys 0003:041E:2801.0006: unknown main item tag 0x2
[  170.357882][   T47] prodikeys 0003:041E:2801.0006: hidraw0: USB HID v0.00 Device [HID 041e:2801] on usb-dummy_hcd.0-1/input0
[  170.411858][ T9054] sit1: entered promiscuous mode
[  170.413756][ T9054] sit1: entered allmulticast mode
[  170.532215][ T5314] usb 1-1: USB disconnect, device number 15
[  171.117310][ T9101] loop0: detected capacity change from 0 to 2048
[  171.122392][ T9101] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024)
[  171.141213][ T8493] udevd[8493]: incorrect nilfs2 checksum on /dev/loop0
[  171.159204][ T8493] udevd[8493]: incorrect nilfs2 checksum on /dev/loop0
[  171.167033][ T9106] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  171.418132][ T9120] trusted_key: encrypted_key: keylen parameter is missing
[  171.781718][ T9136] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[  171.786725][ T9136] overlayfs: "xino" feature enabled using 2 upper inode bits.
[  172.061469][ T9139] sock: sock_set_timeout: `syz.2.1325' (pid 9139) tries to set negative timeout
[  174.057532][ T9222] netlink: 'syz.2.1364': attribute type 3 has an invalid length.
[  174.068100][ T6101] usb 1-1: new high-speed USB device number 16 using dummy_hcd
[  174.212052][ T6101] usb 1-1: Using ep0 maxpacket: 8
[  174.216229][ T6101] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[  174.220713][ T6101] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint descriptor of length 2, skipping
[  174.226003][ T6101] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1
[  174.233877][ T6101] usb 1-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1
[  174.237745][ T6101] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  174.241770][ T6101] usb 1-1: Product: syz
[  174.243549][ T6101] usb 1-1: Manufacturer: syz
[  174.245544][ T6101] usb 1-1: SerialNumber: syz
[  174.255260][ T6101] usb 1-1: config 0 descriptor??
[  174.267538][ T6101] imon_raw 1-1:0.0: IR endpoint missing
[  174.457905][ T6101] usb 1-1: USB disconnect, device number 16
[  175.060547][ T9278] 9pnet_virtio: no channels available for device syz
[  175.752807][ T9304] 9pnet_virtio: no channels available for device syz
[  176.066805][ T9326] 9pnet_fd: p9_fd_create_tcp (9326): problem connecting socket to 127.0.0.1
[  176.565969][ T9344] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1421'.
[  176.570472][ T9344] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1421'.
[  176.867789][ T9358] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1429'.
[  177.311014][ T9376] 9pnet_fd: Insufficient options for proto=fd
[  177.787271][ T9383] capability: warning: `syz.1.1438' uses 32-bit capabilities (legacy support in use)
[  177.835013][ T9385] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1439'.
[  177.938691][ T9389] loop0: detected capacity change from 0 to 8
[  177.943637][ T9389] SQUASHFS error: Failed to read block 0x62: -5
[  177.947884][ T9389] squashfs image failed sanity check
[  179.758195][ T9377] usb 1-1: new high-speed USB device number 17 using dummy_hcd
[  179.906575][ T9377] usb 1-1: Using ep0 maxpacket: 8
[  179.909934][ T9377] usb 1-1: config 0 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  179.915555][ T9377] usb 1-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  179.920345][ T9377] usb 1-1: config 0 interface 0 has no altsetting 0
[  179.929223][ T9377] usb 1-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice= 0.00
[  179.937695][ T9377] usb 1-1: New USB device strings: Mfr=32, Product=0, SerialNumber=0
[  179.940729][ T9377] usb 1-1: Manufacturer: syz
[  179.952505][ T9377] usb 1-1: config 0 descriptor??
[  179.972211][ T9377] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input9
[  180.158187][ T5281] bcm5974 1-1:0.0: could not read from device
[  180.173567][ T5281] bcm5974 1-1:0.0: could not read from device
[  180.176933][ T9377] usb 1-1: USB disconnect, device number 17
[  180.587285][ T9466] netlink: 'syz.2.1478': attribute type 10 has an invalid length.
[  180.590715][ T9466] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1478'.
[  180.596596][ T9466] vcan0: entered promiscuous mode
[  180.599249][ T9466] A link change request failed with some changes committed already. Interface vcan0 may have been left with an inconsistent configuration, please check.
[  180.995555][ T9481] netlink: 'syz.1.1485': attribute type 21 has an invalid length.
[  181.724321][ T9498] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1492'.
[  182.338420][ T9501] loop0: detected capacity change from 0 to 32768
[  182.416281][ T9501] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  182.479205][ T9501] XFS (loop0): Ending clean mount
[  182.517495][ T5847] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  182.519146][ T9531] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1502'.
[  182.529298][ T9527] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1502'.
[  182.844511][ T9550] loop0: detected capacity change from 0 to 2048
[  182.866003][ T9550] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  182.875593][ T9553] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1512'.
[  182.888212][   T33] audit: type=1800 audit(1489.490:32): pid=9550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1511" name="file1" dev="loop0" ino=1367 res=0 errno=0
[  182.962926][   T33] audit: type=1800 audit(1489.552:33): pid=9557 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1511" name="file1" dev="loop0" ino=1367 res=0 errno=0
[  183.640677][ T9567] o2cb: This node has not been configured.
[  183.643226][ T9567] o2cb: Cluster check failed. Fix errors before retrying.
[  183.646554][ T9567] (syz.1.1518,9567,1):user_dlm_register:674 ERROR: status = -22
[  183.649858][ T9567] (syz.1.1518,9567,1):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "bus"
[  184.170428][ T5896] usb 1-1: new high-speed USB device number 18 using dummy_hcd
[  184.596238][ T5896] usb 1-1: Using ep0 maxpacket: 16
[  184.608008][ T5896] usb 1-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6
[  184.621477][ T5896] usb 1-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3
[  184.627854][ T5896] usb 1-1: Product: syz
[  184.629619][ T5896] usb 1-1: Manufacturer: syz
[  184.633765][ T5896] usb 1-1: SerialNumber: syz
[  184.640295][ T5896] usb 1-1: config 0 descriptor??
[  184.885683][    T9] usb 1-1: USB disconnect, device number 18
[  185.687581][ T9671] sctp: [Deprecated]: syz.2.1543 (pid 9671) Use of int in maxseg socket option.
[  185.687581][ T9671] Use struct sctp_assoc_value instead
[  185.968152][ T9677] loop0: detected capacity change from 0 to 32768
[  185.971891][ T9677] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.1547 (9677)
[  186.001914][ T9677] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  186.013939][ T9677] BTRFS info (device loop0): using crc32c (crc32c-lib) checksum algorithm
[  186.019287][ T9685] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1551'.
[  186.180433][ T9677] BTRFS info (device loop0): rebuilding free space tree
[  186.433837][ T9677] BTRFS info (device loop0): checking UUID tree
[  186.455834][ T9677] BTRFS info (device loop0): enabling ssd optimizations
[  186.480837][ T9677] BTRFS info (device loop0): turning on async discard
[  186.489727][ T9677] BTRFS info (device loop0): enabling free space tree
[  186.497819][ T9677] BTRFS info (device loop0): force clearing of disk cache
[  186.504584][ T9677] BTRFS info (device loop0): force zstd compression, level 3
[  186.711439][   T33] audit: type=1800 audit(1493.453:34): pid=9677 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1547" name="file2" dev="loop0" ino=261 res=0 errno=0
[  187.045925][ T5847] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  187.363345][ T9659] Bluetooth: hci1: command 0x0406 tx timeout
[  187.366116][ T9659] Bluetooth: hci0: command 0x0406 tx timeout
[  187.421507][   T33] audit: type=1326 audit(1494.215:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9734 comm="syz.2.1564" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f219b18ebe9 code=0x0
[  187.484560][ T9739] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1566'.
[  187.496935][ T9731] loop0: detected capacity change from 0 to 32768
[  187.501023][ T9731] XFS: ikeep mount option is deprecated.
[  187.532326][ T9731] XFS (loop0): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  187.560226][ T9731] XFS (loop0): Ending clean mount
[  187.567825][ T9731] XFS (loop0): Quotacheck needed: Please wait.
[  187.599010][ T9731] XFS (loop0): Quotacheck: Done.
[  187.624217][ T5847] XFS (loop0): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  187.925717][ T9771] loop0: detected capacity change from 0 to 8
[  188.082690][   T33] audit: type=1800 audit(1494.882:36): pid=9773 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1577" name="file1" dev="loop0" ino=5 res=0 errno=0
[  188.104822][ T5238] Bluetooth: hci0: unexpected event for opcode 0x0407
[  188.254227][ T9773] SQUASHFS error: Failed to read block 0x2fc: -5
[  188.263703][ T9773] SQUASHFS error: Unable to read metadata cache entry [2fa]
[  188.277007][ T9773] SQUASHFS error: read_indexes: reading block [2fa:0]
[  188.294267][ T9773] SQUASHFS error: Failed to read block 0xfc: -5
[  188.309564][ T9773] SQUASHFS error: Unable to read metadata cache entry [2fa]
[  188.318516][ T9773] SQUASHFS error: read_indexes: reading block [2fa:0]
[  188.334369][ T9773] SQUASHFS error: Unable to read metadata cache entry [2fa]
[  188.344422][ T9773] SQUASHFS error: read_indexes: reading block [2fa:0]
[  188.357647][ T9773] SQUASHFS error: Unable to read metadata cache entry [2fa]
[  188.368376][ T9773] SQUASHFS error: read_indexes: reading block [2fa:0]
[  188.377776][ T9773] SQUASHFS error: Unable to read metadata cache entry [2fa]
[  188.393526][ T9773] SQUASHFS error: read_indexes: reading block [2fa:0]
[  188.829642][ T9773] syz.0.1577 (9773) used greatest stack depth: 19464 bytes left
[  189.177594][ T9779] netlink: 'syz.1.1579': attribute type 5 has an invalid length.
[  190.283176][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[  190.285896][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[  191.561294][    T9] usb 1-1: new high-speed USB device number 19 using dummy_hcd
[  191.682904][ T9825] netlink: 'syz.2.1599': attribute type 3 has an invalid length.
[  191.687845][ T9825] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1599'.
[  191.752200][    T9] usb 1-1: config 0 has an invalid interface number: 197 but max is 0
[  191.757299][    T9] usb 1-1: config 0 has no interface number 0
[  191.760130][    T9] usb 1-1: config 0 interface 197 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 8
[  191.764847][    T9] usb 1-1: config 0 interface 197 altsetting 0 endpoint 0xC has invalid maxpacket 1023, setting to 64
[  191.769796][    T9] usb 1-1: config 0 interface 197 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 1024
[  191.781334][    T9] usb 1-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=bb.42
[  191.785093][    T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  191.788570][    T9] usb 1-1: Product: syz
[  191.798645][    T9] usb 1-1: Manufacturer: syz
[  191.800836][    T9] usb 1-1: SerialNumber: syz
[  191.837078][    T9] usb 1-1: config 0 descriptor??
[  191.902073][ T9808] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  191.961734][ T9808] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  192.208944][ T9808] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  192.212354][ T9808] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  192.220383][    T9] qmi_wwan 1-1:0.197: probe with driver qmi_wwan failed with error -22
[  192.450134][ T9377] usb 1-1: USB disconnect, device number 19
[  193.657488][ T9863] netlink: 'syz.0.1615': attribute type 11 has an invalid length.
[  193.883910][ T9869] loop0: detected capacity change from 0 to 2048
[  193.898288][ T9869] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  195.068677][   T47] usb 1-1: new high-speed USB device number 20 using dummy_hcd
[  195.118794][ T9893] bridge0: port 2(bridge_slave_1) entered disabled state
[  195.211857][   T47] usb 1-1: Using ep0 maxpacket: 16
[  195.217608][   T47] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06
[  195.221225][   T47] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  195.224026][   T47] usb 1-1: Product: syz
[  195.225535][   T47] usb 1-1: Manufacturer: syz
[  195.227198][   T47] usb 1-1: SerialNumber: syz
[  195.236230][   T47] r8152-cfgselector 1-1: Unknown version 0x0000
[  195.238443][   T47] r8152-cfgselector 1-1: config 0 descriptor??
[  195.647089][ T5915] r8152-cfgselector 1-1: USB disconnect, device number 20
[  196.254718][ T9935] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1649'.
[  196.309901][ T9935] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1649'.
[  196.515779][ T9953] overlayfs: failed to clone upperpath
[  196.569180][ T9943] loop0: detected capacity change from 0 to 32768
[  196.609030][ T9963] IPv6: Can't replace route, no match found
[  196.628526][ T8493] Dev loop0 SGI disklabel: csum bad, label corrupted
[  196.637515][ T9943] Dev loop0 SGI disklabel: csum bad, label corrupted
[  197.658769][ T9989] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1674'.
[  197.914562][T10011] 9pnet_fd: p9_fd_create_unix (10011): problem connecting socket: qY3aK: -111
[  197.960101][T10017] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1687'.
[  198.245377][T10026] random: crng reseeded on system resumption
[  199.381749][T10058] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1701'.
[  199.385520][T10058] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1701'.
[  199.424824][T10060] loop0: detected capacity change from 0 to 4096
[  199.431517][T10060] ntfs3(loop0): Different NTFS sector size (4096) and media sector size (512).
[  199.457525][T10060] ntfs3(loop0): ino=19, mi_enum_attr
[  199.459824][T10060] ntfs3(loop0): Mark volume as dirty due to NTFS errors
[  200.577601][T10109] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1727'.
[  200.668821][T10117] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1731'.
[  201.269115][T10124] Bluetooth: received HCILL_WAKE_UP_IND in state 2
[  201.274099][  T152] Bluetooth: hci3: Frame reassembly failed (-84)
[  203.227004][ T5849] Bluetooth: hci3: command 0x1003 tx timeout
[  203.255427][ T5238] Bluetooth: hci3: Opcode 0x1003 failed: -110
[  203.344995][T10143] loop0: detected capacity change from 0 to 512
[  203.348163][   T33] audit: type=1326 audit(1510.834:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10144 comm="syz.2.1740" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f219b18ebe9 code=0x0
[  203.419942][T10143] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[  204.304989][T10207] geneve2: entered promiscuous mode
[  204.306793][T10207] geneve2: entered allmulticast mode
[  204.852826][T10219] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1778'.
[  205.203202][T10255] netdevsim netdevsim2 netdevsim0: entered promiscuous mode
[  205.215778][T10255] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  205.275154][ T5915] usb 1-1: new high-speed USB device number 21 using dummy_hcd
[  205.431974][ T5915] usb 1-1: Using ep0 maxpacket: 16
[  205.436324][ T5915] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  205.489411][ T5915] usb 1-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e
[  205.504749][ T5915] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  205.513877][ T5915] usb 1-1: Product: syz
[  205.525207][ T5915] usb 1-1: Manufacturer: syz
[  205.530807][ T5915] usb 1-1: SerialNumber: syz
[  205.597429][ T5915] usb 1-1: config 0 descriptor??
[  205.713327][ T5915] hub 1-1:0.0: bad descriptor, ignoring hub
[  205.731592][ T5915] hub 1-1:0.0: probe with driver hub failed with error -5
[  205.749060][ T5915] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input11
[  206.034774][   T47] usb 1-1: USB disconnect, device number 21
[  206.669098][T10290] af_packet: tpacket_rcv: packet too big, clamped from 32 to 4294967272. macoff=96
[  206.724043][T10296] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1814'.
[  206.740196][T10294] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1815'.
[  206.774537][T10298] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1816'.
[  207.110961][T10306] loop0: detected capacity change from 0 to 32768
[  207.142753][T10306] XFS (loop0): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  207.174000][T10306] XFS (loop0): Ending clean mount
[  207.192334][   T33] audit: type=1804 audit(1514.856:38): pid=10306 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1819" name="/newroot/464/file0/file1" dev="loop0" ino=6150 res=1 errno=0
[  207.217058][ T5847] XFS (loop0): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  207.344566][T10330] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1828'.
[  208.979127][T10398] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1855'.
[  209.029590][T10400] netlink: 'syz.1.1856': attribute type 10 has an invalid length.
[  209.033585][T10400] bond0: (slave wlan1): Opening slave failed
[  209.452701][T10424] netlink: 'syz.1.1868': attribute type 22 has an invalid length.
[  209.456216][T10424] (unnamed net_device) (uninitialized): option ad_select: invalid value (6)
[  210.530983][T10475] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1891'.
[  212.415044][ T5238] Bluetooth: hci0: command 0x0406 tx timeout
[  217.310179][T10695] netlink: 'syz.0.1986': attribute type 10 has an invalid length.
[  217.315359][T10695] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1986'.
[  217.602116][T10713] overlayfs: failed to clone upperpath
[  217.605805][T10713] overlayfs: failed to clone lowerpath
[  219.182191][   T33] audit: type=1800 audit(1527.379:39): pid=10758 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2014" name="bus" dev="tmpfs" ino=2836 res=0 errno=0
[  219.652949][T10784] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2026'.
[  219.659865][T10784] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2026'.
[  220.373123][T10820] netlink: 'syz.1.2042': attribute type 1 has an invalid length.
[  220.530095][T10836] overlayfs: missing 'lowerdir'
[  221.438925][T10880] netlink: 'syz.1.2071': attribute type 9 has an invalid length.
[  221.441946][T10880] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2071'.
[  221.457500][T10880] netlink: 'syz.1.2071': attribute type 9 has an invalid length.
[  221.459972][T10880] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2071'.
[  221.463526][ T5696] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  221.475086][ T5696] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  221.489260][ T5696] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  221.494595][ T5696] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  223.044001][   T33] audit: type=1326 audit(1531.426:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10957 comm="syz.1.2103" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  223.070971][   T33] audit: type=1326 audit(1531.426:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10957 comm="syz.1.2103" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  223.095130][   T33] audit: type=1326 audit(1531.437:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10957 comm="syz.1.2103" exe="/syz-executor" sig=0 arch=c000003e syscall=318 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  223.113707][   T33] audit: type=1326 audit(1531.437:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10957 comm="syz.1.2103" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  223.135272][   T33] audit: type=1326 audit(1531.437:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10957 comm="syz.1.2103" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x7ffc0000
[  224.128804][  T791] IPVS: starting estimator thread 0...
[  224.193331][T10979] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2112'.
[  224.225759][T10973] IPVS: using max 43 ests per chain, 103200 per kthread
[  224.292666][T10985] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2115'.
[  224.296397][T10985] netlink: 'syz.1.2115': attribute type 2 has an invalid length.
[  224.320511][T10985] netlink: 'syz.1.2115': attribute type 1 has an invalid length.
[  224.325899][T10985] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2115'.
[  224.412997][T10993] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2120'.
[  224.450212][T10998] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2122'.
[  224.570823][T11012] netlink: 'syz.1.2128': attribute type 1 has an invalid length.
[  224.588822][T11012] 8021q: adding VLAN 0 to HW filter on device bond1
[  224.611727][T11012] bond1: (slave veth3): Enslaving as an active interface with a down link
[  225.968848][T11078] overlayfs: failed to clone lowerpath
[  226.534021][T11098] netlink: 1347 bytes leftover after parsing attributes in process `syz.1.2168'.
[  226.702457][   T33] audit: type=1804 audit(1535.244:45): pid=11104 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.2171" name="file0" dev="tmpfs" ino=3061 res=1 errno=0
[  227.986905][T11176] macvtap0: refused to change device tx_queue_len
[  228.338754][T11193] netlink: 'syz.1.2212': attribute type 1 has an invalid length.
[  229.222038][   T33] audit: type=1326 audit(1537.880:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11228 comm="syz.1.2225" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7faac138ebe9 code=0x0
[  229.260121][T11231] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2226'.
[  229.965936][T11259] dummy0: mtu less than device minimum
[  230.005065][T11261] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2240'.
[  230.292496][T11275] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2247'.
[  230.327631][T11277] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2248'.
[  230.504113][T11287] netlink: 'syz.1.2253': attribute type 10 has an invalid length.
[  231.144950][T11318] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.2268'.
[  231.191358][T11320] overlayfs: failed to clone upperpath
[  231.747277][T11334] veth0_to_team: entered promiscuous mode
[  231.749743][T11334] veth0_to_team: entered allmulticast mode
[  234.723877][T11434] netlink: 212388 bytes leftover after parsing attributes in process `syz.1.2317'.
[  234.732814][T11434] openvswitch: netlink: Message has 5 unknown bytes.
[  235.557990][T11461] syz_tun: entered promiscuous mode
[  235.563207][T11461] syz_tun: left promiscuous mode
[  235.847704][T11477] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2336'.
[  235.946704][T11485] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2339'.
[  236.116305][ T5849] Bluetooth: hci2: command tx timeout
[  236.381091][T11532] netlink: 'syz.0.2361': attribute type 10 has an invalid length.
[  236.385954][T11532] bond0: (slave wlan1): Opening slave failed
[  236.389438][T11530] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  236.969067][T11547] netlink: 372 bytes leftover after parsing attributes in process `syz.2.2368'.
[  236.973665][T11547] ==================================================================
[  236.976897][T11547] BUG: KASAN: slab-use-after-free in xfrm_alloc_spi+0x570/0xf30
[  236.979894][T11547] Read of size 4 at addr ffff8880336f9744 by task syz.2.2368/11547
[  236.982821][T11547] 
[  236.984066][T11547] CPU: 0 UID: 0 PID: 11547 Comm: syz.2.2368 Not tainted syzkaller #0 PREEMPT(full) 
[  236.984083][T11547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  236.984091][T11547] Call Trace:
[  236.984097][T11547]  <TASK>
[  236.984103][T11547]  dump_stack_lvl+0x189/0x250
[  236.984121][T11547]  ? __kasan_check_byte+0x12/0x40
[  236.984140][T11547]  ? __pfx_dump_stack_lvl+0x10/0x10
[  236.984154][T11547]  ? lock_release+0x4b/0x3e0
[  236.984174][T11547]  ? __virt_addr_valid+0x4a5/0x5c0
[  236.984189][T11547]  print_report+0xca/0x240
[  236.984199][T11547]  ? xfrm_alloc_spi+0x570/0xf30
[  236.984212][T11547]  kasan_report+0x118/0x150
[  236.984229][T11547]  ? xfrm_alloc_spi+0x570/0xf30
[  236.984243][T11547]  xfrm_alloc_spi+0x570/0xf30
[  236.984254][T11547]  ? xfrm_alloc_spi+0x2a0/0xf30
[  236.984270][T11547]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  236.984282][T11547]  ? xfrm_find_acq+0x87/0xa0
[  236.984296][T11547]  xfrm_alloc_userspi+0x70b/0xc90
[  236.984315][T11547]  ? apparmor_capable+0x137/0x1b0
[  236.984328][T11547]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  236.984343][T11547]  ? __nla_parse+0x40/0x60
[  236.984362][T11547]  xfrm_user_rcv_msg+0x7a3/0xab0
[  236.984378][T11547]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  236.984402][T11547]  ? __pfx___mutex_trylock_common+0x10/0x10
[  236.984415][T11547]  ? rcu_is_watching+0x15/0xb0
[  236.984427][T11547]  ? trace_contention_end+0x39/0x120
[  236.984438][T11547]  ? __mutex_lock+0x335/0x1350
[  236.984451][T11547]  netlink_rcv_skb+0x208/0x470
[  236.984500][T11547]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  236.984516][T11547]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  236.984538][T11547]  ? netlink_deliver_tap+0x2e/0x1b0
[  236.984556][T11547]  ? netlink_deliver_tap+0x2e/0x1b0
[  236.984573][T11547]  xfrm_netlink_rcv+0x79/0x90
[  236.984589][T11547]  netlink_unicast+0x82f/0x9e0
[  236.984608][T11547]  ? __pfx_netlink_unicast+0x10/0x10
[  236.984623][T11547]  ? netlink_sendmsg+0x642/0xb30
[  236.984633][T11547]  ? skb_put+0x11b/0x210
[  236.984646][T11547]  netlink_sendmsg+0x805/0xb30
[  236.984658][T11547]  ? __pfx_netlink_sendmsg+0x10/0x10
[  236.984670][T11547]  ? aa_sock_msg_perm+0xf1/0x1d0
[  236.984681][T11547]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  236.984693][T11547]  ? __pfx_netlink_sendmsg+0x10/0x10
[  236.984704][T11547]  __sock_sendmsg+0x21c/0x270
[  236.984720][T11547]  ____sys_sendmsg+0x505/0x830
[  236.984734][T11547]  ? __pfx_____sys_sendmsg+0x10/0x10
[  236.985098][T11547]  ? import_iovec+0x74/0xa0
[  236.985113][T11547]  ___sys_sendmsg+0x21f/0x2a0
[  236.985126][T11547]  ? __pfx____sys_sendmsg+0x10/0x10
[  236.985149][T11547]  ? __fget_files+0x2a/0x420
[  236.985160][T11547]  ? __fget_files+0x3a0/0x420
[  236.985173][T11547]  __x64_sys_sendmsg+0x19b/0x260
[  236.985185][T11547]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  236.985199][T11547]  ? rcu_is_watching+0x15/0xb0
[  236.985211][T11547]  ? do_syscall_64+0xbe/0x3b0
[  236.985223][T11547]  do_syscall_64+0xfa/0x3b0
[  236.985231][T11547]  ? lockdep_hardirqs_on+0x9c/0x150
[  236.985246][T11547]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  236.985258][T11547]  ? exc_page_fault+0x9f/0xf0
[  236.985274][T11547]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  236.985284][T11547] RIP: 0033:0x7f219b18ebe9
[  236.985295][T11547] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  236.985305][T11547] RSP: 002b:00007f219bfff038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  236.985318][T11547] RAX: ffffffffffffffda RBX: 00007f219b3c5fa0 RCX: 00007f219b18ebe9
[  236.985327][T11547] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003
[  236.985335][T11547] RBP: 00007f219b211e19 R08: 0000000000000000 R09: 0000000000000000
[  236.985342][T11547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  236.985350][T11547] R13: 00007f219b3c6038 R14: 00007f219b3c5fa0 R15: 00007ffc3e94ed38
[  236.985364][T11547]  </TASK>
[  236.985368][T11547] 
[  237.127982][T11547] Allocated by task 7953:
[  237.129770][T11547]  kasan_save_track+0x3e/0x80
[  237.131670][T11547]  __kasan_slab_alloc+0x6c/0x80
[  237.133665][T11547]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  237.135891][T11547]  xfrm_state_alloc+0x24/0x2f0
[  237.137791][T11547]  __find_acq_core+0x8a7/0x1c00
[  237.139748][T11547]  xfrm_find_acq+0x78/0xa0
[  237.141638][T11547]  xfrm_alloc_userspi+0x6b3/0xc90
[  237.143778][T11547]  xfrm_user_rcv_msg+0x7a3/0xab0
[  237.145750][T11547]  netlink_rcv_skb+0x208/0x470
[  237.147768][T11547]  xfrm_netlink_rcv+0x79/0x90
[  237.149795][T11547]  netlink_unicast+0x82f/0x9e0
[  237.151764][T11547]  netlink_sendmsg+0x805/0xb30
[  237.153729][T11547]  __sock_sendmsg+0x21c/0x270
[  237.155696][T11547]  ____sys_sendmsg+0x505/0x830
[  237.157657][T11547]  ___sys_sendmsg+0x21f/0x2a0
[  237.159565][T11547]  __x64_sys_sendmsg+0x19b/0x260
[  237.161593][T11547]  do_syscall_64+0xfa/0x3b0
[  237.163502][T11547]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  237.165701][T11547] 
[  237.166541][T11547] Freed by task 10:
[  237.167819][T11547]  kasan_save_track+0x3e/0x80
[  237.169644][T11547]  kasan_save_free_info+0x46/0x50
[  237.171396][T11547]  __kasan_slab_free+0x5b/0x80
[  237.173217][T11547]  kmem_cache_free+0x18f/0x400
[  237.175133][T11547]  xfrm_state_gc_task+0x52d/0x6b0
[  237.177211][T11547]  process_scheduled_works+0xae1/0x17b0
[  237.179491][T11547]  worker_thread+0x8a0/0xda0
[  237.181499][T11547]  kthread+0x711/0x8a0
[  237.183216][T11547]  ret_from_fork+0x3fc/0x770
[  237.185105][T11547]  ret_from_fork_asm+0x1a/0x30
[  237.187074][T11547] 
[  237.188076][T11547] The buggy address belongs to the object at ffff8880336f9680
[  237.188076][T11547]  which belongs to the cache xfrm_state of size 928
[  237.193234][T11547] The buggy address is located 196 bytes inside of
[  237.193234][T11547]  freed 928-byte region [ffff8880336f9680, ffff8880336f9a20)
[  237.198082][T11547] 
[  237.198974][T11547] The buggy address belongs to the physical page:
[  237.201404][T11547] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880336f9f80 pfn:0x336f8
[  237.205203][T11547] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  237.208565][T11547] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  237.211565][T11547] page_type: f5(slab)
[  237.212976][T11547] raw: 00fff00000000040 ffff8881055223c0 dead000000000122 0000000000000000
[  237.215976][T11547] raw: ffff8880336f9f80 00000000800e0008 00000000f5000000 0000000000000000
[  237.219089][T11547] head: 00fff00000000040 ffff8881055223c0 dead000000000122 0000000000000000
[  237.222222][T11547] head: ffff8880336f9f80 00000000800e0008 00000000f5000000 0000000000000000
[  237.225438][T11547] head: 00fff00000000002 ffffea0000cdbe01 00000000ffffffff 00000000ffffffff
[  237.228223][T11547] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  237.231215][T11547] page dumped because: kasan: bad access detected
[  237.233387][T11547] page_owner tracks the page as allocated
[  237.235282][T11547] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6720, tgid 6719 (syz.0.305), ts 100703021082, free_ts 100661418776
[  237.242324][T11547]  post_alloc_hook+0x240/0x2a0
[  237.244292][T11547]  get_page_from_freelist+0x21e4/0x22c0
[  237.246574][T11547]  __alloc_frozen_pages_noprof+0x181/0x370
[  237.248909][T11547]  alloc_pages_mpol+0x232/0x4a0
[  237.250825][T11547]  allocate_slab+0x8a/0x370
[  237.252490][T11547]  ___slab_alloc+0xbeb/0x1410
[  237.254360][T11547]  kmem_cache_alloc_noprof+0x283/0x3c0
[  237.256596][T11547]  xfrm_state_alloc+0x24/0x2f0
[  237.258548][T11547]  xfrm_add_sa+0x17d1/0x4070
[  237.260191][T11547]  xfrm_user_rcv_msg+0x7a3/0xab0
[  237.262000][T11547]  netlink_rcv_skb+0x208/0x470
[  237.263820][T11547]  xfrm_netlink_rcv+0x79/0x90
[  237.265513][T11547]  netlink_unicast+0x82f/0x9e0
[  237.267460][T11547]  netlink_sendmsg+0x805/0xb30
[  237.269490][T11547]  __sock_sendmsg+0x21c/0x270
[  237.271206][T11547]  ____sys_sendmsg+0x505/0x830
[  237.273067][T11547] page last free pid 6715 tgid 6715 stack trace:
[  237.275282][T11547]  __free_frozen_pages+0xbc4/0xd30
[  237.277409][T11547]  stack_depot_save_flags+0x436/0x860
[  237.279383][T11547]  kasan_save_track+0x4f/0x80
[  237.280936][T11547]  __kasan_kmalloc+0x93/0xb0
[  237.282483][T11547]  __kmalloc_cache_noprof+0x230/0x3d0
[  237.284355][T11547]  kobject_uevent_env+0x27c/0x8c0
[  237.286120][T11547]  __kobject_del+0xd2/0x300
[  237.287795][T11547]  kobject_put+0x243/0x480
[  237.289624][T11547]  device_del+0x529/0x8e0
[  237.291358][T11547]  device_unregister+0x20/0xc0
[  237.293355][T11547]  iommufd_fops_release+0x174/0x370
[  237.295513][T11547]  __fput+0x44c/0xa70
[  237.297129][T11547]  task_work_run+0x1d4/0x260
[  237.298704][T11547]  exit_to_user_mode_loop+0xec/0x110
[  237.300859][T11547]  do_syscall_64+0x2bd/0x3b0
[  237.302754][T11547]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  237.304867][T11547] 
[  237.305689][T11547] Memory state around the buggy address:
[  237.307538][T11547]  ffff8880336f9600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  237.310354][T11547]  ffff8880336f9680: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  237.313067][T11547] >ffff8880336f9700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  237.316131][T11547]                                            ^
[  237.318269][T11547]  ffff8880336f9780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  237.321389][T11547]  ffff8880336f9800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  237.324625][T11547] ==================================================================
[  237.329036][T11547] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  237.331913][T11547] CPU: 0 UID: 0 PID: 11547 Comm: syz.2.2368 Not tainted syzkaller #0 PREEMPT(full) 
[  237.335213][T11547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  237.338912][T11547] Call Trace:
[  237.340243][T11547]  <TASK>
[  237.341445][T11547]  dump_stack_lvl+0x99/0x250
[  237.343048][T11547]  ? __asan_memcpy+0x40/0x70
[  237.344700][T11547]  ? __pfx_dump_stack_lvl+0x10/0x10
[  237.346759][T11547]  ? __pfx__printk+0x10/0x10
[  237.348489][T11547]  vpanic+0x281/0x750
[  237.350199][T11547]  ? __pfx_vpanic+0x10/0x10
[  237.351865][T11547]  ? irqentry_exit+0x74/0x90
[  237.353389][T11547]  panic+0xb9/0xc0
[  237.354782][T11547]  ? __pfx_panic+0x10/0x10
[  237.356258][T11547]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  237.358365][T11547]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  237.360613][T11547]  ? xfrm_alloc_spi+0x570/0xf30
[  237.362235][T11547]  check_panic_on_warn+0x89/0xb0
[  237.363918][T11547]  ? xfrm_alloc_spi+0x570/0xf30
[  237.365549][T11547]  end_report+0x78/0x160
[  237.366963][T11547]  kasan_report+0x129/0x150
[  237.368580][T11547]  ? xfrm_alloc_spi+0x570/0xf30
[  237.370222][T11547]  xfrm_alloc_spi+0x570/0xf30
[  237.371784][T11547]  ? xfrm_alloc_spi+0x2a0/0xf30
[  237.373418][T11547]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  237.375145][T11547]  ? xfrm_find_acq+0x87/0xa0
[  237.376693][T11547]  xfrm_alloc_userspi+0x70b/0xc90
[  237.378370][T11547]  ? apparmor_capable+0x137/0x1b0
[  237.380053][T11547]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  237.381806][T11547]  ? __nla_parse+0x40/0x60
[  237.383329][T11547]  xfrm_user_rcv_msg+0x7a3/0xab0
[  237.385010][T11547]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  237.386877][T11547]  ? __pfx___mutex_trylock_common+0x10/0x10
[  237.388939][T11547]  ? rcu_is_watching+0x15/0xb0
[  237.390579][T11547]  ? trace_contention_end+0x39/0x120
[  237.392570][T11547]  ? __mutex_lock+0x335/0x1350
[  237.394292][T11547]  netlink_rcv_skb+0x208/0x470
[  237.396089][T11547]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  237.398264][T11547]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  237.400109][T11547]  ? netlink_deliver_tap+0x2e/0x1b0
[  237.402016][T11547]  ? netlink_deliver_tap+0x2e/0x1b0
[  237.404076][T11547]  xfrm_netlink_rcv+0x79/0x90
[  237.405656][T11547]  netlink_unicast+0x82f/0x9e0
[  237.407220][T11547]  ? __pfx_netlink_unicast+0x10/0x10
[  237.409317][T11547]  ? netlink_sendmsg+0x642/0xb30
[  237.411378][T11547]  ? skb_put+0x11b/0x210
[  237.413245][T11547]  netlink_sendmsg+0x805/0xb30
[  237.415341][T11547]  ? __pfx_netlink_sendmsg+0x10/0x10
[  237.417653][T11547]  ? aa_sock_msg_perm+0xf1/0x1d0
[  237.419782][T11547]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  237.422060][T11547]  ? __pfx_netlink_sendmsg+0x10/0x10
[  237.424308][T11547]  __sock_sendmsg+0x21c/0x270
[  237.426301][T11547]  ____sys_sendmsg+0x505/0x830
[  237.428344][T11547]  ? __pfx_____sys_sendmsg+0x10/0x10
[  237.430568][T11547]  ? import_iovec+0x74/0xa0
[  237.432446][T11547]  ___sys_sendmsg+0x21f/0x2a0
[  237.434523][T11547]  ? __pfx____sys_sendmsg+0x10/0x10
[  237.436798][T11547]  ? __fget_files+0x2a/0x420
[  237.438819][T11547]  ? __fget_files+0x3a0/0x420
[  237.440847][T11547]  __x64_sys_sendmsg+0x19b/0x260
[  237.442892][T11547]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  237.445175][T11547]  ? rcu_is_watching+0x15/0xb0
[  237.447263][T11547]  ? do_syscall_64+0xbe/0x3b0
[  237.449313][T11547]  do_syscall_64+0xfa/0x3b0
[  237.451299][T11547]  ? lockdep_hardirqs_on+0x9c/0x150
[  237.453576][T11547]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  237.456050][T11547]  ? exc_page_fault+0x9f/0xf0
[  237.458008][T11547]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  237.460487][T11547] RIP: 0033:0x7f219b18ebe9
[  237.462376][T11547] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  237.470116][T11547] RSP: 002b:00007f219bfff038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  237.473451][T11547] RAX: ffffffffffffffda RBX: 00007f219b3c5fa0 RCX: 00007f219b18ebe9
[  237.476806][T11547] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003
[  237.480148][T11547] RBP: 00007f219b211e19 R08: 0000000000000000 R09: 0000000000000000
[  237.483520][T11547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  237.486893][T11547] R13: 00007f219b3c6038 R14: 00007f219b3c5fa0 R15: 00007ffc3e94ed38
[  237.490136][T11547]  </TASK>
[  237.492391][T11547] Kernel Offset: disabled
[  237.494275][T11547] Rebooting in 86400 seconds..

VM DIAGNOSIS:
14:44:33  Registers:
info registers vcpu 0

CPU#0
RAX=ffffffff8b767c48 RBX=ffffc9000608eb52 RCX=ffff888107b70000 RDX=ffffc90020fe9000
RSI=000000000000de2f RDI=0000000000000000 RBP=ffffc9000608e830 RSP=ffffc9000608e458
R8 =ffffc9000608e117 R9 =0000000000000000 R10=ffffc9000608e100 R11=fffff52000c11c23
R12=000000000000005f R13=000000000000000d R14=dffffc0000000000 R15=00000000fffffffe
RIP=ffffffff81bfae56 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f219bfff6c0 ffffffff 00c00000
GS =0000 ffff8880b8618000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000000000000000 CR3=000000002552c000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=00007f8e6a55b5a0 00007f8e6a55b580
XMM02=00007f8e6a55b6e0 00007f8e6a55b560 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00007f8e6a55b5a0 XMM05=0000000000000000 00007f8e6a55b6e0
XMM06=00007f8e6a55b6e0 00007f8e6a55b560 XMM07=00007f8e6a55b5a0 00007f8e6a55b580
XMM08=ec640719cb5ce6ae 725739cb9cc9ce66 XMM09=0000000000000000 00007f8e69812fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ce53a17cecdf5000 RBX=ffffffff819683c8 RCX=ce53a17cecdf5000 RDX=0000000000000001
RSI=ffffffff8d9b8241 RDI=ffffffff8be33880 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f9b R9 =1ffff11026cc65f3 R10=dffffc0000000000 R11=ffffed1026cc65f4
R12=ffffffff8fa39030 R13=0000000000000001 R14=0000000000000001 R15=1ffff110200d5000
RIP=ffffffff8b79c3f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c18000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b3261aff4 CR3=0000000027416000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=6161616161616161 6161616161616161
XMM06=6161616161616161 6161616161616161 XMM07=6161616161616161 6161616161616161
XMM08=6161616161616161 6161616161616161 XMM09=0000000000000000 00007faac1412fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
