last executing test programs: 1.328902472s ago: executing program 0 (id=255): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) write$sndseq(r0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000240)={0x80, 0x1f4, 0x12, 0x0, 0x0, 0x4000002}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000900000005"], 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r1}, 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x10, &(0x7f0000000080)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}, @jmp={0x5, 0x1, 0x1, 0x7, 0x4, 0xffffffffffffffe0}, @generic={0xfc, 0x5, 0x6, 0x0, 0x10}, @tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @jmp={0x5, 0x1, 0x0, 0x5, 0x0, 0x4, 0xfffffffffffffff0}, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8}, @call={0x85, 0x0, 0x0, 0xb2}, @generic={0xf, 0x8, 0x6, 0x2a61, 0xfffffffc}], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x8) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='devpts\x00', 0x0, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$tmpfs(0x0, &(0x7f0000000400)='./file0/../file0\x00', &(0x7f00000001c0), 0x0, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/diskstats\x00', 0x0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000002a00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f00000003c0)='kfree\x00', r5}, 0x10) sigaltstack(&(0x7f0000000040)={0x0, 0x80000001, 0xffffffffffffff76}, 0x0) sigaltstack(0x0, &(0x7f0000000100)={0x0}) r6 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendfile(r6, r4, 0x0, 0x3fffff) getegid() getsockopt$inet_mreqsrc(r1, 0x0, 0x62, 0x0, &(0x7f0000000040)) 1.270993455s ago: executing program 0 (id=257): socket$key(0xf, 0x3, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) mkdir(&(0x7f0000000580)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) pipe2$9p(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000300)=ANY=[], 0x15) bpf$MAP_CREATE(0x0, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000950000020000000022a9884bba974e05b7ac41755cfac0710ce5cfb258fd0817233af8a0d1f98bfdeba0a534fc614987296fad639f99d3596250"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000280)='kmem_cache_free\x00', r4}, 0x10) r5 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fcntl$setsig(r5, 0xa, 0x13) fcntl$setlease(r5, 0x400, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000280)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x0) fcntl$setlease(r5, 0x400, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x3d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x62000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100000, 0x1, 0x0, 0x6, 0x1, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000040)=0x7) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000900000005"], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYRES32=r2, @ANYRES32=r7, @ANYRESOCT=r7], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x51, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r8}, 0x10) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x0) 1.053143808s ago: executing program 0 (id=260): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000006"], 0x48) pipe(0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x30, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) add_key(&(0x7f0000000040)='ceph\x00', 0x0, &(0x7f00000000c0)="010001000000000000001000015b097ead85847817353d2dbad05dd5", 0x1c, 0xfffffffffffffffd) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r3}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r5, 0x1, 0x0, 0xfffffffd, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0xa00, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000000)=ANY=[@ANYRES64=r0, @ANYRES16=r0], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffff95, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r6}, 0x10) request_key(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000140)='\\\\@[*#)\x00', 0xfffffffffffffffe) 999.485302ms ago: executing program 4 (id=262): mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x4, 0x8, 0xb, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd']) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, 0x0) 966.599083ms ago: executing program 1 (id=263): ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x2}, {0x0, 0x1}}}, 0x24}}, 0x4014) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=@newtfilter={0x38, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {}, {0x2, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x2}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@getchain={0x24, 0x65, 0xfcd66a900070b049, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x55}, 0x0) 921.643326ms ago: executing program 1 (id=264): ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x4, 0x27, 0xfb, 0x8, 0x8, @local, @local, 0x10, 0x40, 0x7, 0x4}}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', r0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./file0\x00') 857.46324ms ago: executing program 0 (id=265): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x3f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x5}, 0x8002, 0x0, 0xfff, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xdd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r5, 0x0) syz_emit_ethernet(0x5a, &(0x7f00000002c0)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "005d88", 0x24, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x9, 0xc2, 0x0, 0x0, 0x10, {[@mss={0x1e, 0x4, 0x2101}, @exp_fastopen={0xfe, 0xa, 0xf989, "ff2e2b5de799"}]}}}}}}}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x3c) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r7, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0xff, r7}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000002305e20000000000030000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r8, 0x0, 0xfffffffffffffffd}, 0x18) r9 = socket$inet(0x2, 0x3, 0x9) setsockopt$inet_mreqsrc(r9, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x4) sendmsg$nl_route(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20088814}, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route_sched(r10, &(0x7f0000000280)={0x0, 0x7400, &(0x7f00000001c0)={&(0x7f0000000200)=@delchain={0x24, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r12}}, 0x24}}, 0x0) 851.18481ms ago: executing program 1 (id=267): r0 = socket$inet(0x2, 0x3, 0x1) getsockopt$MRT(r0, 0x0, 0xcf, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYBLOB="0400000008"], 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$MRT6(r3, 0x29, 0xcf, 0x0, 0x0) preadv(r1, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/124, 0xe}], 0x3e8, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) socket$phonet_pipe(0x23, 0x5, 0x2) socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x280, 0x108, 0x25, 0x148, 0x0, 0x60, 0x228, 0x2a8, 0x2a8, 0x228, 0x2a8, 0x3, 0x0, {[{{@ip={@dev={0xac, 0x14, 0x14, 0x21}, @rand_addr=0x64010101, 0xff, 0xff000000, 'batadv0\x00', 'caif0\x00', {}, {}, 0x62, 0x0, 0x81f1586ddde8655f}, 0x0, 0x98, 0xc8, 0x0, {0x200003ae, 0x7f00}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0x5, 0x5}, {0xffffffffffffffff, 0x1, 0x4}, 0x1, 0xffffff01}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_virt_wifi\x00', {}, {0x152102e86cf61c3}}, 0x0, 0xd8, 0x120, 0x0, {}, [@common=@addrtype={{0x30}, {0x1a0, 0xe00}}, @common=@unspec=@statistic={{0x38}, {0x8}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xa, 'syz0\x00'}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x2e0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x3d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x62000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x0, 0x6, 0x3, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r4 = socket(0x10, 0x3, 0x0) sendto$inet6(r4, &(0x7f0000000000)="7800000018002507b9409b14ffff00000204be04020506050e0204094300080004000000040011000d0068d0bf46d32345653600648d0a0012000200000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f25232500000", 0x78, 0x0, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002d0001fffffff3000000000001"], 0x114}], 0x1}, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x50, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x24, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'syz_tun\x00'}]}]}]}], {0x14}}, 0x78}}, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000005c0)={&(0x7f0000000480)="efc989e3cc2bc2fe17ef98f6883de590661568745347bce572d1d597b8a65b7904b29db7bcfba4b2ac7d9b309e075cb3350628a43ab89d057029b6129ed828d9e4769e90779422112da6d2d7112c843e962dabb3c344712bd408dceababb6efb7161897b6eb613b17dcb309a6b0c114b10f147097cf19bc746ddfdfdbb7233766cd94e511b7afe64fc44c4d72f6fe7df0d5eeda13e133372ede0341e4516ac1554a4f3ff52ee269fecbf66d51409016c66543f17df9798141e445e412eaecc71de92761503f277ba6b8d147c56a77a799c833ee7563684dbbecbf444cc6866a9c2f5299d7c27212bb6ccdd7c2760cac15d3cba1b45b56d", &(0x7f0000000940)=""/180, &(0x7f0000000a00)="b9223d4a9682e95d2cf8fb5e45f63e1716bf0e644d337099c0135011374d17e866c9522a3a241817c12364034f791b02962cba5faf72c3546ec13fd513459c50e110a511936b11b16217f47383cacf4bb11f8968b19e0d6c9f3032ba7df0c11b1d79b9f1f45ce937d7d0a25d5511a93870c6b8385cbf3cd21fa45d932b41cb79dcc581cf0d29ef98cb42cab267c19c88190bffaf9b5312bc69d51040eb73eed650b473f0644463a787e1b9702853996ac4dd", &(0x7f0000000ac0)="5a853e6488a63edabef1a05177c4854bd85139fc8dcf345dae7ee228a1fc69ea1126e353b3257683f16f7de50c03bbc3e43a21295e6d36c07d6e13ae6a908ffca1e89f437aaa2efdd00db86c82501106851f83eb249982cd74fa02f7da902e4fa95975095adfb5caaf9fc09723d22bb0458af4277835c94cbf6ae989720b225c766065cd9d934dd9c85d31c30a35f76dcc2b68e799ca58362bed1f06fa8f610f3525c2ecc6df8aba4edddf40a90e52f1956b392f9e4722527378ff01ade0cf5a69b031f3bd437433ecc95094eaca6bd6147c3777d151db2f5be0d3d68ffa88f7b264a735d1b3f4697a5f74b1f2ef754d2ccaa6df7b", 0x9, r5, 0x4}, 0x38) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000180)={@loopback={0xfec0ffff00006600}, 0x8000000, 0x0, 0x1, 0x1}, 0x29) 838.283611ms ago: executing program 3 (id=268): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000027b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xbe69ae51be7b2c52, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x1800) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) setsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x4, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r4, 0x114, 0x7, &(0x7f0000000400)={@in={0x2, 0x4e20, @empty}, {&(0x7f0000000340)=""/140, 0x8c}, &(0x7f0000000280), 0x40}, 0xa0) sendto$inet6(r3, &(0x7f00000005c0)="f5", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0xfffffffc, @rand_addr=' \x01\x00'}, 0x1c) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008f00850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_emit_ethernet(0x4a, &(0x7f00000007c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\f\n5', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000002240)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0xc2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x41}]}}}}}}}, 0x0) 691.465999ms ago: executing program 3 (id=271): r0 = socket$inet(0x2, 0x3, 0x1) getsockopt$MRT(r0, 0x0, 0xcf, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYBLOB="0400000008"], 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$MRT6(r3, 0x29, 0xcf, 0x0, 0x0) preadv(r1, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/124, 0xe}], 0x3e8, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) socket$phonet_pipe(0x23, 0x5, 0x2) socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x280, 0x108, 0x25, 0x148, 0x0, 0x60, 0x228, 0x2a8, 0x2a8, 0x228, 0x2a8, 0x3, 0x0, {[{{@ip={@dev={0xac, 0x14, 0x14, 0x21}, @rand_addr=0x64010101, 0xff, 0xff000000, 'batadv0\x00', 'caif0\x00', {}, {}, 0x62, 0x0, 0x81f1586ddde8655f}, 0x0, 0x98, 0xc8, 0x0, {0x200003ae, 0x7f00}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0x5, 0x5}, {0xffffffffffffffff, 0x1, 0x4}, 0x1, 0xffffff01}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_virt_wifi\x00', {}, {0x152102e86cf61c3}}, 0x0, 0xd8, 0x120, 0x0, {}, [@common=@addrtype={{0x30}, {0x1a0, 0xe00}}, @common=@unspec=@statistic={{0x38}, {0x8}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xa, 'syz0\x00'}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x2e0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x3d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x62000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x0, 0x6, 0x3, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r4 = socket(0x10, 0x3, 0x0) sendto$inet6(r4, &(0x7f0000000000)="7800000018002507b9409b14ffff00000204be04020506050e0204094300080004000000040011000d0068d0bf46d32345653600648d0a0012000200000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f25232500000", 0x78, 0x0, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002d0001fffffff3000000000001"], 0x114}], 0x1}, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x50, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x24, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'syz_tun\x00'}]}]}]}], {0x14}}, 0x78}}, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000005c0)={&(0x7f0000000480)="efc989e3cc2bc2fe17ef98f6883de590661568745347bce572d1d597b8a65b7904b29db7bcfba4b2ac7d9b309e075cb3350628a43ab89d057029b6129ed828d9e4769e90779422112da6d2d7112c843e962dabb3c344712bd408dceababb6efb7161897b6eb613b17dcb309a6b0c114b10f147097cf19bc746ddfdfdbb7233766cd94e511b7afe64fc44c4d72f6fe7df0d5eeda13e133372ede0341e4516ac1554a4f3ff52ee269fecbf66d51409016c66543f17df9798141e445e412eaecc71de92761503f277ba6b8d147c56a77a799c833ee7563684dbbecbf444cc6866a9c2f5299d7c27212bb6ccdd7c2760cac15d3cba1b45b56d", &(0x7f0000000940)=""/180, &(0x7f0000000a00)="b9223d4a9682e95d2cf8fb5e45f63e1716bf0e644d337099c0135011374d17e866c9522a3a241817c12364034f791b02962cba5faf72c3546ec13fd513459c50e110a511936b11b16217f47383cacf4bb11f8968b19e0d6c9f3032ba7df0c11b1d79b9f1f45ce937d7d0a25d5511a93870c6b8385cbf3cd21fa45d932b41cb79dcc581cf0d29ef98cb42cab267c19c88190bffaf9b5312bc69d51040eb73eed650b473f0644463a787e1b9702853996ac4dd", &(0x7f0000000ac0)="5a853e6488a63edabef1a05177c4854bd85139fc8dcf345dae7ee228a1fc69ea1126e353b3257683f16f7de50c03bbc3e43a21295e6d36c07d6e13ae6a908ffca1e89f437aaa2efdd00db86c82501106851f83eb249982cd74fa02f7da902e4fa95975095adfb5caaf9fc09723d22bb0458af4277835c94cbf6ae989720b225c766065cd9d934dd9c85d31c30a35f76dcc2b68e799ca58362bed1f06fa8f610f3525c2ecc6df8aba4edddf40a90e52f1956b392f9e4722527378ff01ade0cf5a69b031f3bd437433ecc95094eaca6bd6147c3777d151db2f5be0d3d68ffa88f7b264a735d1b3f4697a5f74b1f2ef754d2ccaa6df7b", 0x9, r5, 0x4}, 0x38) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000180)={@loopback={0xfec0ffff00006600}, 0x8000000, 0x0, 0x1, 0x1}, 0x29) 605.459635ms ago: executing program 4 (id=272): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r1, 0x400, 0x0) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000001200)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000011c0)={&(0x7f0000001540)={0x82c, 0x0, 0x2, 0x70bd26, 0x25dfdbfe, {}, [{{0x8}, {0xc0, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}, {0x8}}}]}}, {{0x8}, {0x104, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x1f4, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x10001}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffff01}}}]}}, {{0x8}, {0xc8, 0x2, 0x0, 0x1, [{0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x160, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3ff}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x80, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0x138, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x10001}}, {0x8}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}]}}]}, 0x82c}, 0x1, 0x0, 0x0, 0x1}, 0x8bf312f19c79d3cb) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x5, 0x4, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r3 = socket$inet6(0x10, 0x3, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x8, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffb}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000380)='neigh_update\x00', r5}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000000740)="900000001c001f4d154a813393278bff0a80a578020000000104740014000100ac1414bb0542d6401051a2d72e5a15c50866c6d55d08f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee", 0x90, 0x3000c080, 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r7 = socket$inet6(0xa, 0x806, 0x0) bind$inet6(r7, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1c) close_range(r6, 0xffffffffffffffff, 0x0) 603.844975ms ago: executing program 2 (id=273): mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0x8, 0x70, 0x80000}, 0x20) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) writev(r0, &(0x7f00000025c0)=[{&(0x7f0000000240)='4', 0x1}], 0x1) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000d80)=ANY=[@ANYBLOB="020cff020a00000027bd7000ffdbdf25010016004e240000070018000fff2d006244ee4e149c6dd1dc1bdb875253f52f8622be26d0e7f317a8b48e3e4d350fff5115728e3c17924d581e48084d00000014068a49f5382dae906e0c6559c57718d7e783ec04ccf1863af6858397d91a49310c115cc818bc3cb1531da4197eca4e0b627e3fde602b1ff4dded5cf716c4d06cb3a8b30342a6541736fd709b7fa9280d8ad46b140e90dcb9ee283fbe708e4fa0fefee99fda1ae4919f946e8c37b278d73c69e1aa19f05fe63bf6e3c1ac9b6cc0d718d5dd0dc8333aecd7672849f33c5d4e9f2af70b661428eb1d611988754c1d1cb28e04200b19ea69c99585f4ae726886192dd1da38996f33a1468d5dd8eb22645b00be1c49844aaacd2b74e2f7d8bf25afbf9290714c051f7b1354"], 0x50}}, 0x10) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000040), 0x4) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x82) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000040)="273eebfecb7c0e923301b61c42cb", 0xe}, {&(0x7f0000000140)="10eba9fdb4cbab48929e1af15100", 0xe}], 0x2) perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x2, 0x10, 0x0, 0x0, 0x0, 0x91f, 0x4156, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4, @perf_bp={0x0, 0xd}, 0x12640, 0x0, 0xfffffffe, 0x6, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = socket$inet_sctp(0x2, 0x4, 0x84) listen(r6, 0xda90) accept4(r6, 0x0, 0x0, 0x0) syz_mount_image$iso9660(&(0x7f0000000d40), &(0x7f0000000280)='./file0\x00', 0x1004400, &(0x7f0000000b80)=ANY=[], 0x1, 0x5c1, &(0x7f0000000440)="$eJzs3EFv29YdAPDH1G4UFwsGFFvSNMDYtIfsUFeSFwdGd4hGUzZbSRRIunBOQ7HYXTC7BdYNWHNaLt0KbNhp56HXfYJ9kn2JoZ/BAyXZkeTYztJ6doHfD4jfE/kn3/8xxHs2occAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIQoWW82W1HoZYOt7fhkyXqR90/Zf3i+f80UMxanfoYohKj+FxqNcHO86ebrz2J/VP+4E26MP90IjbpohCev/fiH77++cKU+cDGKwikJfSeuzX787Mo4n6MNn3/x5Dcf7+3t/Pa8E7mkNtJBVuZZv7ORxlmZx2urq833Nrtl3M16afmwrNJ+nBRpp8qL+G7yIISwthKnyw/zrcHGeqeXxneTn8attbX777abzdX4g+Vh2inKfPDeB8tlspn1etlgYxRT767vgfv1jfhhVsVV2ujH8e7jvZ2Vs5Ksg1ovEtQ+K6jdbLdbrXa7tXpv7d79ZrMxuVuPNiw054T5QxbO/6bl0nk1TA0ch2Pcq9/REA4v7SD520WnAAAAAJyzaPSMPRo9l785qnWzXtqciTmIrp10MAAAAPA9MPoT/sbkAUAIN0N0/O9/AAAA4Pvtz6eusQtRFMrh1ehwqcpw+51ov1PXOvuvjDe9Mn/Gqnsruj45yahYXZh8StLb0RvjoDcOo7+ZFLuzeSyG+TyioliMnr50AnXUQvhLuDWOufVoXD6axE1WJC51s166nOS991uh07l+pUq3q99/+vgPIRTFwStfDfrXo7D7eG9n+Vef7T0a5fK0PsvT/ck3IY59IWI2l6vh2cUIvzta9zi58g9me7w4ehBT9/qrQX9p3G5zuv+TxYhXXvw/IHwZ3hzHvLk0Lpdm+9+o22wtP6f301m0htvvXJ009oI9n8vi9jjm9t236+Ltu5M9i1NZtM/Koj19/V/qWpyQxfS1WDkri5VvmQXARdmdn4WOzf/H5t3jo9x4Tf8po9zu6b9l1JPzXCv/+ff4gGez+6/DWa18Gd4ax7x1a+HZjDQ3ojfPGtGbLzivH/2GMpfFP8Odf/w9hK1w5zD4pDm2bvevM7NqtP91fcDXx9o9XGle9toHByFcm0y/Xzx59/H+x5/sfLLzabu9str8WbN5rx0WR92YFOYeAJ4jLb6Jlqo/RUWRDX/ZWltrdarNNC7y5MO4yNY30jgbVGmRbHYGG2k8LPIqT/JeXfkoW0/LuNwaDvOiirt5EQ/zMtsevfklDn8cvfqlTPudQZUl5bCXdso0TvJB1UmqeD0rk3i49YteVm6mxejgcpgmWTdLOlWWD+Iy3yqSdDmOyzSdCszW00GVdbO6OoiHRdbvFA/jj/LeVj+N19MyKbJhlY9PeNhWNujmRX902uWLvtgAcEl8HiZvsDt6ld3/XAmNM2Iuuo8AwKz5WfrqiZEnvAMAAAAAAAAAAAAAAAA4d9PL9X4+eaXPt14R+H+uNGa3PHjtecE/uRSpHlVCCAuXII1LWIlCCJcgjdPvsfOqHL7n6aSYxcn+l22ivrhnB/+gjrmoEQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATvbfAAAA//9S7I0P") r7 = syz_open_procfs(0x0, &(0x7f0000000380)='attr/exec\x00') bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bind$pptp(r7, &(0x7f00000000c0)={0x18, 0x2, {0x2, @multicast1}}, 0x81) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0xd, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_io_uring_setup(0x2e3b, &(0x7f00000002c0)={0x0, 0x482b, 0x2000, 0x1}, 0x0, 0x0) mkdir(&(0x7f0000000240)='./file0\x00', 0x80) r8 = mq_open(&(0x7f0000000a00)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!T\xeeux\x00\xbf@\xf4\x1c\xbce\xca\x97\xd5pkv\x88L\xe8$\xef\xfeI\xdaW1\xfcg\xa1\xdb$,0y$\xcd{zl.\xae\x805\xa8\xd6\x85\x15\xd2\x0e~\xcc\x90\x97\xe8h\v\x1a9X\a\xca{\x11#\x95m{U\xe5-\xabRw\xcafy\xe6\aNhX4Ll[\x14\x150x0, 0x20, &(0x7f00000002c0)=[@in={0x2, 0x4e22, @local}, @in={0x2, 0x4e22, @rand_addr=0x64010101}]}, &(0x7f0000000280)=0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000040)={r9}, &(0x7f00000000c0)=0x8) 545.157338ms ago: executing program 1 (id=274): r0 = socket$netlink(0x10, 0x3, 0xf) (async) r1 = socket$netlink(0x10, 0x3, 0xf) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x69, 0x7ffc0005}]}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_user\x00', 0x0, 0x0) (async) unshare(0x2c020400) (async) r3 = socket$inet(0x2, 0x2, 0x1) bind$inet(r3, &(0x7f0000000680)={0x2, 0x4e1e, @private=0xa010101}, 0x10) (async) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000700000000000000000000850000002300000095"], &(0x7f00000001c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) mq_notify(0xffffffffffffffff, 0x0) (async) bind$netlink(r1, &(0x7f0000000a40)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xe, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="18000000000000000000000000000000711093000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff96, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0500000004000000ff0f000007", @ANYRES64=r3], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYRESOCT=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="240000001e0001000000000000000000020000000100000000000000080001"], 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @void, @value}, 0x94) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback, r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r10}, 0x10) (async) r11 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r11, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff000000000100000458000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) (async) ioctl$EXT4_IOC_SWAP_BOOT(r10, 0x6611) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000680)={&(0x7f0000000100)='kmem_cache_free\x00', r7}, 0x18) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f00000003c0)=0x6, 0xdc) (async) r12 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4800000010001fff0000faffffffffffffff0000", @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x48}}, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000800)={{r2}, &(0x7f0000000580), &(0x7f00000007c0)='%pI4 \x00'}, 0x20) 524.844929ms ago: executing program 4 (id=275): r0 = socket(0xa, 0x3, 0x3a) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x21, &(0x7f00000000c0)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffe}}, @ldst={0x3, 0x0, 0x1, 0x8, 0xf, 0x18, 0x10}, @exit, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7}, @exit, @btf_id={0x18, 0x8, 0x3, 0x0, 0x1}, @tail_call, @cb_func={0x18, 0x3, 0x4, 0x0, 0x1}], &(0x7f0000000000)='syzkaller\x00', 0x7ff, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x4, 0x3, 0x22, 0x5}, 0x10, 0x0, 0x0, 0xa, &(0x7f0000000240)=[0xffffffffffffffff], &(0x7f0000000280)=[{0x4, 0x5, 0xf, 0x4}, {0x2, 0x1, 0x4, 0x6}, {0x0, 0x3, 0x4, 0x9}, {0x0, 0x4, 0x5, 0xc}, {0x5, 0x5, 0x8, 0x4}, {0x0, 0x4, 0xc, 0xb}, {0x4, 0x3, 0x5, 0xa}, {0x0, 0x4, 0xb, 0x8}, {0x0, 0x4, 0xf, 0x7}, {0x3, 0x2, 0xd, 0x4}], 0x10, 0x1, @void, @value}, 0x94) vmsplice(r1, &(0x7f00000016c0)=[{&(0x7f0000000400)="3db55b25405c7a4cc3151adf0f794dc449bda380d9b92f4d96932ba265986b73fa96109085e10198e6d94996ecd7f61837b629e3b44b0f854ec64d1c17f2d377a667ae7b884a691f83b5a43c688e63553ddcbe1119e700b3824cae39cd2ce349c9af6e2fb4c82e9ebc6bc3dfb48f80b42625b60198b1e5f383bd88555c441583b8baa2d851965cd558ad93a8c848f31d683cb8da80406c793445a7a17b9bc1475720030cba58fcb4efc170dde96b00173c360a5284663315871fb456abc1717d47f0d1f4eb3f6dfa28d652fdc3c121617f9bace48582", 0xd6}, {&(0x7f0000000500)="cad205f9fec52c9304a36a79086abfa0d420e567cef855257da7836dbb8f87f3fc6db8c675a20c97e5db3c3d013e46e66cee363c46aa7c9d71dcd82aceb4a57627d9faf7daf2485b065e87cbfe31b7fab65469318b7acf47713d69d6795b2b1ef62b68353278cbfe85a2e337ff037f530315a99bc7b38079fd2d4cb712e7816f9c6d7a43f46d6fb4", 0x88}, {&(0x7f00000005c0)="fd9969ad437fcab80ea7a74ed884b1042654095999057d4a6bada40081c49b03a4f161b6ab3aeb18e137ecb9502da43b94eb9500bdfd634ae917f1f1d02550", 0x3f}, {&(0x7f0000000600)="d44662b027e19cfab2a37941d67008f9662d04a45351cdbcf1196d3b2330ab8b3e3dd193e9fc1fef33620d81ed3d006af1bfa55f7335c8ea8a20e7238242fb2409e759eb01eebf8c6d45de8a92e415dfe38cfb0d55fd3d92cc32d47f857e61b4c344369599dcd6020c574efc99a38ba7046a5a", 0x73}, {&(0x7f0000000680)="613c294aa6dbaa75cb41ffe2a52d74b392d06c42eeafa9ca3b8939542aa7751b1b2f40066730d799ce9525962554ad5e64a59e50e4c766", 0x37}, {&(0x7f00000006c0)="5bb227986552d38a9ef035d5226da8315eab97897c7df390b8b62c5881ebf92ce7ff406e2230517a1aa1e5e81436e527edef32e29c6a2262c6dbb7aba7504eb376af7df956020bb4ae9321ffa92d85fe0a19b56239ccd94d6d2fcd8f3769c91b27569311e9f40d80437b53e8718b3936972398c88307e04e71183f243cbce1907ec2fa59e946413572eb1caf5a3ed45c3f496c39073b7dbc07f25d9ffd0282689e3e2d008d7d8980d4c465e1974c3d1194d24e6bea3e683ea90969dfd10ae595c94a63eaeb459e4880534720f085e3f8a12c40ad2efaf8839ea9e552bf30f736f887ad78336db157fdff46911a23d3a649da284b8cdcea138566840fb344545e1d1993920d74d306b23536c003a3d69b26411f15cea2997e073c6112ad4c3c5dd6d4d271847358e5d914bd8be04dea2ae4e1b594d753bbcb4a62132252ebaf41520be55e4bd29c9a2dc560598ede4f5133cab292a2f2cabe3428904e4b603f6d7f79b523dc7dc046bc2230e0cf340332c96ad65dcaf89bb5ce1cff04ec97e0429031291612efb5844ef3dcda27e1ad43472afce572cb7d2eeec319c1ebef2a6a5cfd46d084f0536fadd818ad81197557af01ee54e229783c244e063c52a046a43f9977a1bdb8fb5a5717448d0f7c9523d29ade4ce70b35d1aa8ed5355ef0efd4b8478cb3e2f6e582a386cd6795bb54011e5173af66f2fa1e9ddc8ad9762f02b73244e87d49ca6fb7465ae6098d15f918a253ae2d6fe377e05d0132d0638e4bda058172564c30dfc3c8ad170c87798e3b407c0247241644c428c7c366561cd6247e0e892bb0f383fcd2b193eabb2180d5d8786093bcaf783beb128cc72eebbeaa045a6318e4767c68ae6afdb2bcf3929e19170331a1cf0d79fde87ab2cbc861ea3109d8f88e1b72b656b305143ad2becd31c214c58135517b60069f842a759524f2c42353e87d7f2cc10fc2c2ee71ed3483125f809c5d3dc09e7b674f174a349dae4212d849f0aabcb7773777c88bd7ddc7d861fba99e066d72973b8049f10d14e6ccf4c8922940a7bcc73d3074324c2e1d248093ef60b3ed740026ca6a1724f23f4c52002df073cfe302be2126b341978980b0d3bcb20818c0b039b71372aac262063e9a730d2cf734a52122554787ec07462ea05145b37e6dae00d73c7fb087c3edf535b5d66e41c36f59de8929c21ffea75a16079a07086356c1462f107f9def6b0b6d0890b62a7122d3906b0587e5ec237031bb7ef483a5107cabfff8506973ec8887a5f9b5e78eba735bffb5f245cce79eb04b4ae7bd1869d557ffea1411d917215f981ecf7f41c15f2d637ac7c8eea556c645b23bb454525e0d232edf6dae39363bfd5da4f9e2cf5b36841a7dfd0784a0dcd1e4a578d8b77c240ea8cd670ff0ee74ea5e2355614e726262f735543ee3b2669310582e6bd588291f9e9da92c63f4048442cf61c58daea7e3e06fd3f32ea1342aa52c981ee93f10c26c57803000226e8cb80c6030043d4934a9967c5d415326a5a8ded68509db7f12451b3f3493f9109636c757043a1695929180ced8379d5c28b0f50b1e4e49cf0d8ce0f463e625a3e077514d6249604e5c282822f19e997a517f70132ba3f2371eb6df8d665e79bd629a41bd31bc1d03248e3490e57533ac9de9bddeae5121ca77d5d9715456124ea4cf47b96eac5491787fc0ec8939abde0e1059bb91cd888e192125cb2351be3b3dc11bea1e52051b01b6ccf884b16ad70b0bd7a1e25d8127fee505af07e07d2ff8449bfb2cddccb7f6cc76ff2a23b670a93cda845b00d39cd7f71b271862369ae4133d1a3e2e98779b0dd320bc8be49162c1036edd2cddc5f2187d1d160607ea24d461e4105560079c994a1f5891fbcb0c92257ef76b85873b41bd7d495109e64fe6509b9ec33a4fb25f743864b527e9714a243c582a0480adb684c01b2a37ca4c9b7fd80ddc6f6f824e236a7514bae155e99011fd9c0173c106eb8b292f380c877d76a4b94dc5477ea6a3e7d394fecb021518ae6b31935982d415f87edbabe9830c2b814d0830aaf439f5d819ae6c1ae9abd7ab0f30f283a1f81daf5894a6b46ec53acadd645ef393a10712ee938379b93145c0fa9afd0514521f3fe40c3810d0c1f2655c56b980ddf12bd196a691c979df01b4650235cba20add4f174b834e8e79bb1b45bb2e36179fbf09cd6f287c4d1fc7926c9d3bbca57b7a8159f2c6e1ef07bbe63d396361df6f1685a2b6e3d8cfc94d399c8c7a6fb06a0059104705e62930e887cd69cde77e7095fc60fbb89df6a814bb7126ed59ee4f09a09c58b9ab2b41abe9c906d2e8611d8977efbc5f626f79349ec24ded31dcdace536b9782469a624ac0163be6351d588349cc7c56deb46654fcae95cdd88c99e5d77acda59502ca6d1de881c726eb03a3ee2f1b37d399781749cf96d73d37d42e59bf3e524d913bf83af56f7f4eacc91b0f4df10ef733dfd9666ecf9b7daa732e6d706851e513faee767d179e229349e305b518b9d6f98e9fa1b77d203056b7627f27a9f53598c1987060b993ae4b62f76788c329925ee7344ce9ce4947583c6ae35b8bab653e690ae6e471b83d727274ff33c4cad2ecc7a89e43be606147e51e1e651fe6db1c6ac579176843703b26692a7dc6b7ae2204b44387a006a5de9a98ae5e97959cb033c253e9099d8967c170c52b80ea1c6c2faf8816a6cbc401de3a9f7ef6a68336d05e44f4235489cb26fa27e566628ed9c0e0422b9bc22276dad5cc9bd662a6c40402f2bfe8e5803700d1498ca1b616df2606c548ed0275dc6fc4be1867e5846f195025263f065a8c5b3fa36d7920a837224df6d7f6e340559855453f86fe9674aa8392b3331719234d5a02026f3353fb2ca959a8107121f6a94161e060013ce2250feda9e728146a4b907b2e94c3dfe06f6ca8a0523d35a668124ffb2e77985799b212b147c1dde85f4e5977de04649783290481e277cd8f92b1590c6cd49a93de2c05f4fd3f3e5272b6b4c4f6e85fbb1d1e2b7b4c33e67b1975817600154528dd1ff9feb5d71e449ea4651e8713e3bc78c62ef025c64304e143cab8f161da232815edc17908ab331764dc5662ce754d830afbd06e9204f3cb800a6eeb4d8cbec147aeacf88341920cd635c75373594ed9c07319ad42d3d041a06ea2464ce2588b0fcfcb1ad6639266e7b37a78c955fda3b713721371e2355bafaa3befbfba0a82e26332bd2c0198d8e122c19564b3fdc9a63228810ba3b20924d4cfa705351d684991db70375c259a97717d17349bb5fa6fdf83802560e998a44fba81e2551ad9aa62181fa1e9fec27860410a25aa7730ff20e24dc46c5017cdbfc2c8c4175f86faa71c1f040a1673976771c542ce29327fe482152d95f5b5f2de5eba2c8121548d7ee40ffa7f487280fd44a093742d5c2a08c848fc2f5aaf81fff0c9ed514cc65eaaa0a96338b578e1768e82c34ea1ccc659ac22da4f905136c9fc3c3eebdf13fd216314dece2b5df6fed125996f907304ce4eb39e61db2bbb35cd5df0248d102caa7db636a9954007cbee8d62b9110713257696ded742cc0665a921fc00255ce7ab36c79c3c092f8294119e7e987bebc40dfff4e0a3dc6da47cf8243b29b8ffbb661a0d0143a48453b17686bee55c242d917fdde513cce958b0d8629ba3b4061f951e8adab1bb283c11c9da29197867d08159fc60f7815407b7e63fa19a55fac3b354f966e7b9aa19cf2ff51cbf4408e0a3b88e41fbb457d478c8730225f4391f29ccaa2998e18530217322990cf18efd2ed12144a1e85bc27c2bbb38ea0edf6fdb508925e58fa909f8def42e84d576cbdf8c1776f2ca67d1ede2631d572dcdd1bb56eb602dc24706fac0e59cf908fe3e796e97fa5ae8a0de6dffe76bc24cb06c028326d1e2007f90d9bce141ac9c533f1ccf43fa3b8bd90abfbd506786e226f5d49f7e4112efa6a95cc7789749833058b81ac8cc8f088a39f07f5e2b3d59c2997106823673b0b2a36ccf6c7e89027872d4145de0d18545f3f5f7c36816706bf4f8ab55417779b39cd328a1b799476c1991a9906d0f0c6ad378018995339b5acb023f85fdf8cf6276c94d4bf39e63fc2ceb35609d19f1de7fe877342b3a278d9abb13efeb66954cc8518ffc0eb81f6318a3a9f10a133185d5eaa25577b3e69bf0154d730b436360bb04865166af1a0e00512815f575fc5c69cbc0a20c8d0acf1de8ff90228c6562ce43b325314689adb253d0848156e2b42664b4ec66bd4e967c2388681743cd689d230d925b981f77b8344b80552c92817f81a3a9328d73fafee0c5327cafb36c509942819f0852a880a1f779ced2632670a6990663775d8152bccdf997f7ecff890a1619cebbb05e91e824a5e4119e6be870cac0900c9a2e22f08b4a0776128c11e2835a7d7a1e83916a8f8a2d8344801846f425a2ddf62f184f5945cd763f8efee4177f22101f6068caf71f29d96674df6eee8874ab9e1f6347f836a3419e448ff66e3619875e551f1999f802b74feefda1b42ba0c3be3ef9372e84a2c63c6e979ec5cb6ff01ab71d4912ad6a8c976b17a24428ecbbaaddc1544a8ffdaf20152c98c1dd615196eb72d577408cd7e33ada97b6b54b267fa9d67efefa1c62dc13d599864ef9584c4bc54d44cc09ff9f8fe5c9df457d69788e5309be7066e5d69b7a5e76d12e07033fda8af73c254716855932fc5fd8ccd62363d68d57a790196a20308b35ff6c759bfac053c8537f97cb6d88f181db1b6b1d61150ef688e5912f45a4510b6c2d5fd94bf2338585924f1c4cce32eae15fa0135830e9d19c1d2aeedce0bf8b6f260d4ee8321825d5d501787f7e4342bd7cd3b8d16f4d2d92d98c0ae1afdb6d12762311f377a5d9082987913a87b9d64d89f3524ecb6eda707c6aecc126436cc4e830d7d0a2c89b94ae300fe698275bff0a4ae5b95dce10a63aef0d3564ed37c750b8d7c9f7b4e8a9ee8da0fea3ccec1789de30a685c562a62123ac8c6a93c56d6a89984d7f6f090d4ee8b1fe78effe01e0f43c6112c14f0f6d5f5a936c1b45f5977778df7b1eb4e663413f673b00825f38d72128d91b1ac88ba9e5c90c582ea662798877345a0ead89453fcfd51df2f34d03f1be82286b0c20e835ee7a1b4d19fa922452ac9664221a6711b0e84e8498e0275eb91125b03539ff9fb68e50d2f2340820b54faab7a300439a9476e62302cca75f0ab52baf1cc2d58a83959711fe6dda64a0f614313e3144757bab6f6c79aca546017ec1ac4f1ab59874bde236506b0d85bdde559c5eb4fc8333b64be549bb1748262ae89511d33d2ff4fe18496b1e6ab3b0b07df7ea0daece7c24ed61e2656f1b1ec12d582a48321d966cd9e67476dffe49407ec719f60f204d419534892ca983d07b0412d049bc7f50c3435eee1c97118573c02bdca7d977fdd79407019f7539cd2a0b1b6407786dd7281862d3f5234af79f19a7f1acc6847c80c2a354260c5007762e76718a9d1bd95523174a3f99c83f034f326aabb0cdfecec098b79289e52d101dfc49f9b6e16f26b97c8c9c2001e9b14d4af74cbf58d2b2ee299ec9586bf742a75147bd6a64cb20ace6907868a1205e7d7f2fb48e42137516732c698b3b79afec9c17d0608919cdb6dc99d986f1383504473f9f370267a6a7c395f17f66b6a6aff2b989a3d964f342ba0b5709ff7b3e4fbe6a134cbcae3740d5c53fd73c22fdde10d177178f7e5891ffd806776392c39b3681b1da6ca44f43277068c82dc9b81bef4484e3d14690ad5a1cb9037a26981698c10059a31777", 0x1000}], 0x6, 0x2) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd0, &(0x7f0000000080)=0x8, 0x4) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xa2, 0x7}}, './file0\x00'}) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_VERSION_NUM(r2, 0x2284, &(0x7f0000000080)) 453.052674ms ago: executing program 2 (id=276): r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 32) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) (rerun: 32) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000600)='sys_enter\x00', r2}, 0x10) (async) mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000180)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r4}, 0x10) (async) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}}, 0x10) (async) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r6, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=@base={0xf, 0x4, 0x4, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @void, @value, @void, @value}, 0x50) (async) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000003, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r7, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r6}, 0x20) (async, rerun: 64) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x10202, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x9) (async, rerun: 64) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2000000011000100"/20, @ANYRES32=r8], 0x20}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) recvmsg(r6, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 64) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000200)='lp\x00', 0x3) (async, rerun: 64) write(r5, &(0x7f0000000280)="d3cc144c48e6ee54d9f1d0d7567060ae409c95013726c776ffbcd6f37dc2717a8644866d73bb01434ea36acc528589f0984c8b58191d544435b91d352c8d549ccb09fa5ec1afd735f7d7ec68ef0713f63643b27a4d7ca410957efb53722181d7210fb5ad6c604dcf202a41f6f7fecc2be3306e1dc7bdb68f8e3c51e86f510fbb7f4b8ee6109dc9029ea0831c462a137e991f91fc011b1c50274865a50f50e7b1940b2ae9e164e268cec9bf789c532266e36b2591", 0xb4) (async, rerun: 32) ioctl$FS_IOC_SETFSLABEL(r3, 0x41009432, &(0x7f0000000f00)="485804e8506b312cb706c3689bad7b85289224400a1d4121d9442a50c9b919b5b42650b86f1c1f7118b0ba4397a394cef69e5e7a862391b2161d21f38a8cad8cd679a2c2736080c7ab2ada5aab6280a0d0c5f5a2ad5eb215b967a0bc40b0f7d646ef5a5e25d477716c419dce438231236fe2980c866bb7a3245be5f127ee7d8c3d1180a1e202917634186bb09455f759a29a5c039ef37904786b0849caf913b5bd518d88e1120c4ac1f42f4bdffaaca967e3d12481881ab688719d4c4e669e369738c83a18e28c074feb3310a51c51228605420e86a9469e0fd7ab98d26c787443bd11836c9b9af6e809e8fd97f43c235465818a1c08384727c0e1d0b19181a3") (rerun: 32) 449.819354ms ago: executing program 4 (id=277): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r3) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x3e, 0x1, 0x0, 0x0, 0x0, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x2, 0x800000000003}, 0x1320, 0xffffffff, 0x3, 0x5, 0x4, 0x1088f109, 0xfffb, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) sendmsg$NL80211_CMD_GET_WIPHY(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="01032cbd7000000000000100000008000300", @ANYRES32=0x0, @ANYBLOB="58cb97d57b"], 0x1c}}, 0x40) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xf}, {}, {0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) 444.038034ms ago: executing program 3 (id=278): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x1, 0x0, 0x7ffc1ffb}]}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000002000000000000000018090000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000008850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @cgroup_sock_addr, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x23, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='sys_enter\x00', r0}, 0x10) r1 = syz_io_uring_setup(0x247a, &(0x7f0000000080)={0x0, 0x3, 0x10100, 0x3}, &(0x7f0000000540), &(0x7f00000001c0)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000002c0)={0x10000004}) getgroups(0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000500)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = socket$inet6(0xa, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000000)={@remote, r6}, 0x14) setsockopt$inet6_mreq(r5, 0x29, 0x1c, &(0x7f00000001c0)={@remote}, 0x14) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x3d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x62000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100020, 0x0, 0x0, 0x6, 0x3, 0x0, 0xa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r7 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r8 = fcntl$dupfd(r7, 0x0, r7) write$sndseq(r8, &(0x7f0000000180)=[{0xff, 0x0, 0x0, 0x0, @tick=0x4, {}, {}, @result={0x1, 0x2}}, {0x0, 0x0, 0xff, 0x3, @tick=0xf27, {0x1}, {}, @addr={0x2a, 0x5}}], 0x38) readv(r8, &(0x7f0000000000)=[{&(0x7f0000001140)=""/136, 0x88}], 0x1) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r3, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r4, 0x0, 0x9}, 0x18) getcwd(&(0x7f0000000140)=""/235, 0xeb) 401.707787ms ago: executing program 2 (id=279): setxattr$trusted_overlay_origin(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200), &(0x7f0000000280), 0x2, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="020000000400000045000000020000000010"], 0x48) syz_io_uring_complete(0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_GET(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001940)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16, @ANYBLOB="01dfffffff9a26000000210000000c00018008000100", @ANYRES32=r2], 0x20}, 0x1, 0x0, 0x0, 0x4000c00}, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000329bd7000ffdbdf251400000008000f00030000000800020009000000050019000120000008000400030000000800150000000100"], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x8840) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRESDEC=r0, @ANYRES64=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r4}, 0x10) mq_open(0x0, 0x42, 0x0, 0x0) 333.48477ms ago: executing program 2 (id=280): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = syz_io_uring_setup(0x24f7, &(0x7f0000000780)={0x0, 0x64fb, 0x1, 0x1}, &(0x7f0000000100)=0x0, &(0x7f0000000800)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_SENDMSG={0x9, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000440)={&(0x7f0000000340)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x0, {0x2, 0x0, @multicast1}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000480)="10ab119b497ad23a1c1142ce24b27ffa12477294d5f95fbf8890c08a1c7a02944cf58f9e6725ddafac32a98ed3ec927d19a01a193c99058915996d97a79d6e364c97cd620d3e639b4374dae2de1c616415fbc228c3f6bbaacf237291ea1c763bc9f9405da6d699a83194b49c8848fe72407cbcd06881dbc687e9a9967c4031632fbbb883db18c6b0c40a546715fa886040c2", 0x5d}], 0x100000000000000f}, 0x0, 0x80840, 0x1}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'dvmrp1\x00', 0x1}) ioctl$TUNSETIFF(r5, 0x400454da, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f00000000c0)="580000001400192340834b80040d8c560a0677bc45ff810500000fff000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010000081000418e00000004fcff", 0x58}], 0x1) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000003680), r6) sendmsg$NFC_CMD_FW_DOWNLOAD(r6, &(0x7f0000003800)={0x0, 0x0, &(0x7f00000037c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010029bd7000fcdbdf251500000008000100", @ANYRES32=0x0, @ANYBLOB="a6bdc0821a01f68f7f33764d81db106fc33c5fc32983595828a4da07d46f52c3a1ab572ada65915ea7bff031dd6c5075ecc0a8dd566d94a903777344baef92ade6ab4f54b370f94cb44af945625d9dc32726a292809ea2ea6b6cd31ba907335b0af47d6c9e3f6cd1c0d00b5525ff9f16bee53dd81914bca616d39723b698f64c1c5b267e72283ef89ab41d9e3eac4e5c9e60cb3c59bd4cfe301d329a370898d7a213b2dd8da50c89584e3f5243c33330b5191d0ae6a0d5b0c42d92a1697b7ca87e66bd19026c0954d187e0c72b3884b9fccb6c5393174a6e72add802988725f61ccb0c863115"], 0x1c}, 0x1, 0x0, 0x0, 0xc084}, 0x40) io_uring_enter(r2, 0x11d30, 0x0, 0x0, 0x0, 0x0) 332.885781ms ago: executing program 2 (id=281): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000027b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xbe69ae51be7b2c52, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x1800) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) setsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x4, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r4, 0x114, 0x7, &(0x7f0000000400)={@in={0x2, 0x4e20, @empty}, {&(0x7f0000000340)=""/140, 0x8c}, &(0x7f0000000280), 0x40}, 0xa0) sendto$inet6(r3, &(0x7f00000005c0)="f5", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0xfffffffc, @rand_addr=' \x01\x00'}, 0x1c) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008f00850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_emit_ethernet(0x4a, &(0x7f00000007c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\f\n5', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000002240)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0xc2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x41}]}}}}}}}, 0x0) 332.33133ms ago: executing program 4 (id=282): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000070000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x1, 0x4, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{r3}, &(0x7f0000000000), &(0x7f0000000300)='%+9llu \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000002680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000740)='scsi_dispatch_cmd_start\x00', r4}, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x7800007, 0x12, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a80)={{r2}, &(0x7f0000000a00), &(0x7f0000000a40)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r2}, &(0x7f0000000880), &(0x7f00000008c0)=r0}, 0x20) 331.512621ms ago: executing program 1 (id=283): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000098000000060a010400000000000000000100000008000b400000000070000480340001800b00010065787468647200003f000280080001400000000c080003400000000008000440000000220500020007000000380001800c0001006269747769736500280002800400078008000140000000140800024000000012080003400000000308000640000000010900010073797a3000000000140000001100010000000000000000000000000a03da"], 0x10c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f00000001c0)={0x200000000000001}, 0x8) sendto$inet6(r2, 0x0, 0x5c4, 0x24048844, &(0x7f0000000340)={0xa, 0x4e26, 0x5815, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1a) r3 = memfd_create(&(0x7f0000000800)='uid<', 0x4) fstatfs(r3, &(0x7f00000003c0)=""/146) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000080850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000380)='cachefiles_coherency\x00', r4, 0x0, 0x4}, 0x18) ioprio_set$pid(0x1, 0x0, 0x4007) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000180)={'geneve0\x00', @remote}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'ip6_vti0\x00', 0x0, 0x29, 0x1, 0x0, 0x3, 0x5, @private1, @ipv4={'\x00', '\xff\xff', @remote}, 0x20, 0x8000, 0x6, 0x40}}) setsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000080)={@private2={0xfc, 0x2, '\x00', 0x1}, r5}, 0x14) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ASSERT(r6, 0x0, 0xcf, &(0x7f0000000000), 0x4) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r1) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01000000040200f2c8dc1b"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) 310.301432ms ago: executing program 4 (id=284): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000200)='./file2\x00', 0x1000410, &(0x7f0000000000)={[{@barrier_val={'barrier', 0x3d, 0x7}}, {@i_version}]}, 0x4, 0x504, &(0x7f0000019940)="$eJzs3c9vG1kdAPDvOHGTZt1NF/YACNiyLBRU6vzobrRaDnQvILRaCbFCQuLQDYk3imLXUZwsTcghPXJHohIn+BO4cUDqiQM3bnDjUg5IBSJQg8Rh0IyniZvEdWiTeGt/PtJ45r1x/H3PznvP8xznBTC0rkTETkRciIgPI2KyyE+KLW62t+x+j3a3F/Z2txeSSNMP/pHk57O86PiZzEvFY45HxPe/E/Hj5Gjc1ubWyny9Xlsr0lPrjdWp1ubW9eVSkTM7NzM3/faNt2ZPra6vNX7z8NvL7/3gd7/9woM/7nz9p1mxKj+7lJ/rrMdpale9HJWOvNGIeO8sgvXJaPH7w4sna22fiojX8/Y/GSP5qwkADLI0nYx0sjMNAAy67Pq/EkmpWswFVKJUqlbbc3ivxkSp3mytX5tsbtxejHwO63KUSx8t12vTxVzh5SgnWXomPz5Izx5K34iIVyLi52MX83R1oVlf7OcbHwAYYi8dGv//PdYe/wGAATfe7wIAAOfO+A8Aw8f4DwDD5/8Y/307EAAGhOt/ABg+xn8AGD49x/+751MOAOBcfO/997Mt3Sv+//Xix5sb36x8fH2x1lqpNjYWqgvNtdXqUrO5VK9VF9K01+PVm83VmTf3k63NrVuN5sbt9VvLjfml2q1a+YzrAwD09spr9/+cRMTOOxfzLTrWcjBWw2ArPZE6ZqEeYGCN9LsAQN/4Pg8MrxNc45sGgAHX68q/658I3bP4K7yorn7W/D8Mq1K/CwD0zbPN/3/r1MsBnD/z/zC80jSx5j8ADBlz/MCzfP7/wyg+/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAhVcm3pFTN1wLfyW5L1WrEpYi4HOXko+V6bToiXo6IP42Vx7L0TL8LDQA8p9LfkmL9r6uTb1QOn72Q/Gcs30fET375wS/uzK+vr81k+f/cz1+/V+TPXuhHBQCATjePZrXH6WLfcSH/aHd74fF2nkV8+G57cdEs7l6xtc+Mxmi+H49yREz8KynSbdn7lZFTiL9zNyI+c1D/Ox0RKvkcSHvl08Pxs9iXziD+wfOfRJqm6UH80hPxS3nZsn05fy4+fQplgWFz/912P5m1u4u721kTK9pfKa7k++Pb/3jeQz2/x/3f3pH+r7Tf/40ciZ/kbf7KfvrpJXn45u+/eyQznWyfuxvxudHj4if78ZMu/e8bJ6zjXz7/xde7nUt/FXE1jo/f1si72an1xupUa3Pr+nJjfqm2VLs9Ozs3Mzf99o23ZqfyOer27R+Oi/H3d6693C1+Vv+JLvHHe9T/Kyes/6//++GPvvSU+F/78vGv/6tPiZ+NiV89Yfz5iZvHLd+9H3+xS/17vf7XThj/wV+3Fk94VwDgHLQ2t1bm6/XaWo+D7L1mr/s4eDEPYifinIN+YzziE1F3B90O+t0zAWftoNH3uyQAAAAAAAAAAAAAAEA3rc2tlbE4268T9buOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADK7/BQAA//+TAtDE") perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x3e, 0x1, 0x0, 0x0, 0x0, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x2, 0x800000000003}, 0x1320, 0xffffffff, 0x3, 0x5, 0x4, 0x1088f109, 0xfffb, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) bind$packet(r3, &(0x7f0000000280)={0x11, 0x7, r4, 0x1, 0xdf, 0x6, @local}, 0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x70bd2a, 0x8000000, {0x0, 0x0, 0x0, r4, {0x1f, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x20008040}, 0x4000000) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000700)={0xd8, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {}, [@HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}]}, @HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x2c010}, 0x4080) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c7766646e6f3d6b4293c97bcd236660c46c3b62d6f35f72e2f3961b8ce9665d4b0c", @ANYRESHEX=r2, @ANYBLOB=',cache=fscache,\x00']) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000f58e6eeb58792841d8d403f7eda814f8f7c1ec596504e3c55e42eb9c5317bef39e01500afa1e287b22f81fb5ba1cc04b73d5c5a653f28b55584a986ce5e98857a865cdbe76b01e0bc6b1fcd11bd1c2bc041b11e573d00f13a6b86b9c282cf167c3c49c76d654554b286efd8c7e7cb3ad17c9af6931d956bc3d1835df78874205467241570ba0e2b173e2e486d4696ed3aa201158fd62557106ece9225275f2392c2e8d96e9cb51fe3380c7bece6988418ee81058affb23b1b152c177a78b1c1a2021a305824928efc4dcb18b7a36126e730aa0df4a88a3a290b9834d922a405d47cbf1"], 0x50) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000006d00000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r8 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r8, 0x0, 0x8, &(0x7f00000000c0)={0x0, @initdev, @broadcast}, &(0x7f0000000100)=0xc) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={0xffffffffffffffff, r9, 0x25, 0x0, @val=@netfilter={0x2, 0x0, 0x3}}, 0x20) setsockopt$SO_TIMESTAMPING(r8, 0x1, 0x41, &(0x7f0000000080)=0x654a, 0x4) bind$inet(r8, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x61) connect$inet(r8, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r8, &(0x7f0000007fc0), 0x800001d, 0x0) r10 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0xd814, 0x8, 0x80000000, 0xfffffffc}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r11, r12, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0xfffffffffffffffd, 0x0}) io_uring_enter(r10, 0x47ba, 0x0, 0x0, 0x0, 0x0) 302.131833ms ago: executing program 2 (id=285): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014fa0000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180200000020702500000000002020207b1af8ff00000000bfa100000000000007010000dbffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000340)='kfree\x00', r2, 0x0, 0xfffffffffffffffd}, 0x18) r3 = syz_io_uring_setup(0x3bda, &(0x7f0000000b40)={0x0, 0xcfb6, 0x8, 0x5, 0xfffffff7}, &(0x7f0000000800)=0x0, &(0x7f0000000440)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f00000002c0)=0x9, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000180)=@IORING_OP_STATX={0x15, 0xa, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000001740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x20, 0x6008}) io_uring_enter(r3, 0x1c3e, 0x1aa5, 0x0, 0x0, 0x1a) symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f00000017c0)='./file0\x00') r6 = syz_io_uring_setup(0x109, &(0x7f0000000140)={0x0, 0x114df, 0x0, 0x1, 0x89}, &(0x7f00000003c0)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x29c780}) io_uring_enter(r6, 0x3516, 0xaddf, 0x63, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 280.667264ms ago: executing program 0 (id=286): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffd, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x34, r3, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}]}]}, 0x34}}, 0x0) 234.207347ms ago: executing program 1 (id=287): mknod$loop(&(0x7f0000000080)='./bus\x00', 0x2, 0x1) mount(&(0x7f00000002c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x44) syz_mount_image$vfat(&(0x7f00000003c0), &(0x7f0000000180)='./bus/file0\x00', 0x2041c3, &(0x7f0000000840)=ANY=[@ANYRES32, @ANYRES16, @ANYRESDEC, @ANYRES16, @ANYRES8, @ANYRES32, @ANYBLOB="7f89788aa6aeed4380045dfd981401487441e95942697f07d43f26c6939fd0c05d1c0191c8c886c8eec946698d86462be47c85def89e902882cfb71d2443ad37af11b83006d68399a270b1fa8b7288fc31a93d8b4314e5"], 0x1, 0x1207, &(0x7f0000002dc0)="$eJzs3E+LG2UcB/Bf49Zut+4fa622B33Qi6ehuwdPgiyyBdmAUrtCKwhTd6IhYxIyYSEiVk9efR3i0ZsgvoG99DV424vHHsQRk61t2rS6h27E/Xwu8yPP75t5HkIGJsyTg7e++7zTqrJWPozGqVPR6EekuylSNOKeV7Ynxxs3tzebza1rKV3dvL7+Zkpp5dWfP/ryh9d+GZ778MeVn87E/trHB79t/Lp/cf/SwR/XP2tXqV2lbm+Y8nSr1xvmt8oi7barTpbS+2WRV0Vqd6tiMDXeKnv9/ijl3d3lpf6gqKqUd0epU4zSsJeGg1HKP83b3ZRlWVpeCh7r9D+37Hx/t67riLo+Hc9GXdf12ViKc/FcLMdKfB0Rz8f5eCEuxItxMV6Kl+PSuOs4pg8AAAAAAAAAAAAAAAAAAAAnx5P2/6/Gmv3/AAAAAAAAAAAAAAAAAAAAcAw+uHFze7PZ3LqW0mJE+e3ezt7O5DgZ32xFO8oo4kqsxu8x3v0/MamvvtvcupLG1uKb8vZh/vbezjPT+fXx3wkc5hfGY/fy65N8ms6fiaUH8xuxGhdmn39jZn4x3nj9gXwWq3Hnk+hFGbvjc9/Pf7We0jvvNR/KXx73AQAAwP9Blv428/49yx43Pskf4feBh+6vF+LywnzXTkQ1+qKTl2UxmC4WH3lF8e+LxlN650b8RxZ4Qouzh1+aI8b/uszNf/KPFHfOP7FnzhcmjsX9D33eMwEAAAAAAAAAAOAonvKThgsx48myt+ezVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA/2YFjAQAAAABh/tZpdGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBUAAP//i0XIUQ==") r0 = open(&(0x7f0000000040)='./bus\x00', 0x44842, 0x0) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)='$', 0x3fec00}], 0x2, 0x1400, 0x0, 0x3) (fail_nth: 1) 233.397686ms ago: executing program 0 (id=288): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x20000000000000f4, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000021b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x65, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000180)='kfree\x00', r1}, 0x18) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0xfff, 0x4, 0x105, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffda}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3, @void, @value}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r8}, 0x10) mlock2(&(0x7f0000af1000/0x3000)=nil, 0x3000, 0x1) getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)=@newqdisc={0x58, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x2, 0x8, 0x7fffffff, 0x0, 0x3, 0xb5a3, 0x9, 0x2217, 0x9}}}}]}, 0x58}}, 0x4000800) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r9}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) 180.996039ms ago: executing program 3 (id=289): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) r2 = dup(r1) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="708661e1483d66452c7266646e6f3d87d3183ed3d223cd07cd61617bb712b7b9a30af136cc63e02983d4ce06e4539111c47375e5b8853290a39bcace448347810c8c0577ab1ecdf558f8d9f7467c61279f107ae9d392386f34809a520818ffee794ce347939c716c1614b6e739b004a9", @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB=',\x00']) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'pim6reg1\x00', 0x2}) socket$inet6(0xa, 0x80002, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @broadcast}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYRES32=r3], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r5}, 0x10) rename(&(0x7f0000000200)='./file0\x00', &(0x7f0000000f00)='./file0\x00') r6 = inotify_init() inotify_add_watch(r6, 0x0, 0x4) bpf$ENABLE_STATS(0x20, 0x0, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80880) write$P9_RLERRORu(r7, &(0x7f0000000140)={0x13, 0x7, 0x2, {{0x6, 'msdos\x00'}, 0x3}}, 0x13) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0xffffff6a) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x4030582b, &(0x7f0000000300)={0x1100, 0x0, 0x0, 0x2a40}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r9) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)={0x1c, r10, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000054) 35.350018ms ago: executing program 3 (id=290): ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x2}, {0x0, 0x1}}}, 0x24}}, 0x4014) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=@newtfilter={0x38, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {}, {0x2, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x2}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route_sched(r3, 0x0, 0x0) 0s ago: executing program 3 (id=291): r0 = socket$nl_audit(0x10, 0x3, 0x9) keyctl$update(0x2, 0x0, 0x0, 0x4c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000008000000060000000010"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2000000000000dd020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r4, 0xffffffffffffffff}, 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x10, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r6, 0x0, 0x8000000000002}, 0x18) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lgetxattr(0x0, &(0x7f0000000280)=ANY=[], 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x12, &(0x7f0000000340)={&(0x7f00000000c0)=ANY=[@ANYRESDEC=r3], 0x34}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000400000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sys_enter\x00', r7}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) flock(r8, 0x2) sendmsg$AUDIT_USER_AVC(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="500000005304"], 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x40000) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 18.354350][ T29] kauditd_printk_skb: 64 callbacks suppressed [ 18.354369][ T29] audit: type=1400 audit(1740252451.266:76): avc: denied { transition } for pid=3178 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 18.358656][ T29] audit: type=1400 audit(1740252451.266:77): avc: denied { noatsecure } for pid=3178 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 18.361650][ T29] audit: type=1400 audit(1740252451.276:78): avc: denied { write } for pid=3178 comm="sh" path="pipe:[1010]" dev="pipefs" ino=1010 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 18.364908][ T29] audit: type=1400 audit(1740252451.276:79): avc: denied { rlimitinh } for pid=3178 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 18.367751][ T29] audit: type=1400 audit(1740252451.276:80): avc: denied { siginh } for pid=3178 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.247709][ T29] audit: type=1400 audit(1740252455.166:81): avc: denied { read } for pid=2983 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.0.206' (ED25519) to the list of known hosts. [ 26.381945][ T29] audit: type=1400 audit(1740252459.296:82): avc: denied { mounton } for pid=3288 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.383025][ T3288] cgroup: Unknown subsys name 'net' [ 26.404692][ T29] audit: type=1400 audit(1740252459.296:83): avc: denied { mount } for pid=3288 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.432085][ T29] audit: type=1400 audit(1740252459.326:84): avc: denied { unmount } for pid=3288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.585873][ T3288] cgroup: Unknown subsys name 'cpuset' [ 26.592050][ T3288] cgroup: Unknown subsys name 'rlimit' [ 26.703381][ T29] audit: type=1400 audit(1740252459.616:85): avc: denied { setattr } for pid=3288 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.726901][ T29] audit: type=1400 audit(1740252459.616:86): avc: denied { create } for pid=3288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.747514][ T29] audit: type=1400 audit(1740252459.616:87): avc: denied { write } for pid=3288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.767893][ T29] audit: type=1400 audit(1740252459.616:88): avc: denied { read } for pid=3288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.788248][ T29] audit: type=1400 audit(1740252459.626:89): avc: denied { mounton } for pid=3288 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.795099][ T3291] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.813038][ T29] audit: type=1400 audit(1740252459.626:90): avc: denied { mount } for pid=3288 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.844818][ T29] audit: type=1400 audit(1740252459.746:91): avc: denied { relabelto } for pid=3291 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.902254][ T3288] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.913046][ T3298] chnl_net:caif_netlink_parms(): no params data found [ 28.921711][ T3305] chnl_net:caif_netlink_parms(): no params data found [ 28.930392][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 28.961877][ T3299] chnl_net:caif_netlink_parms(): no params data found [ 29.041535][ T3303] chnl_net:caif_netlink_parms(): no params data found [ 29.102855][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.110003][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.117227][ T3307] bridge_slave_0: entered allmulticast mode [ 29.123559][ T3307] bridge_slave_0: entered promiscuous mode [ 29.139370][ T3298] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.146543][ T3298] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.153761][ T3298] bridge_slave_0: entered allmulticast mode [ 29.160122][ T3298] bridge_slave_0: entered promiscuous mode [ 29.166417][ T3305] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.173537][ T3305] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.180676][ T3305] bridge_slave_0: entered allmulticast mode [ 29.186974][ T3305] bridge_slave_0: entered promiscuous mode [ 29.193402][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.200610][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.207836][ T3307] bridge_slave_1: entered allmulticast mode [ 29.214265][ T3307] bridge_slave_1: entered promiscuous mode [ 29.222607][ T3299] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.229786][ T3299] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.237078][ T3299] bridge_slave_0: entered allmulticast mode [ 29.243505][ T3299] bridge_slave_0: entered promiscuous mode [ 29.249972][ T3298] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.257143][ T3298] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.264368][ T3298] bridge_slave_1: entered allmulticast mode [ 29.270864][ T3298] bridge_slave_1: entered promiscuous mode [ 29.277156][ T3305] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.284237][ T3305] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.291392][ T3305] bridge_slave_1: entered allmulticast mode [ 29.297975][ T3305] bridge_slave_1: entered promiscuous mode [ 29.310912][ T3299] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.318010][ T3299] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.325262][ T3299] bridge_slave_1: entered allmulticast mode [ 29.331671][ T3299] bridge_slave_1: entered promiscuous mode [ 29.372486][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.386640][ T3303] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.393741][ T3303] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.400926][ T3303] bridge_slave_0: entered allmulticast mode [ 29.407531][ T3303] bridge_slave_0: entered promiscuous mode [ 29.420241][ T3298] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.430671][ T3305] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.440797][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.451195][ T3305] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.460599][ T3303] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.467702][ T3303] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.474987][ T3303] bridge_slave_1: entered allmulticast mode [ 29.481505][ T3303] bridge_slave_1: entered promiscuous mode [ 29.488661][ T3299] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.498949][ T3299] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.508973][ T3298] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.564298][ T3298] team0: Port device team_slave_0 added [ 29.570631][ T3307] team0: Port device team_slave_0 added [ 29.577003][ T3305] team0: Port device team_slave_0 added [ 29.583815][ T3303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.593697][ T3299] team0: Port device team_slave_0 added [ 29.600240][ T3298] team0: Port device team_slave_1 added [ 29.606646][ T3305] team0: Port device team_slave_1 added [ 29.612819][ T3307] team0: Port device team_slave_1 added [ 29.624384][ T3303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.634059][ T3299] team0: Port device team_slave_1 added [ 29.671489][ T3298] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.678508][ T3298] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.704514][ T3298] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.715538][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.722486][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.748565][ T3305] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.759694][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.766702][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.792699][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.803964][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.810969][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.836896][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.857392][ T3298] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.864363][ T3298] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.890325][ T3298] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.901423][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.908453][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.934459][ T3305] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.954747][ T3303] team0: Port device team_slave_0 added [ 29.960862][ T3299] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.967861][ T3299] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.993783][ T3299] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.005130][ T3299] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.012171][ T3299] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.038321][ T3299] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.062538][ T3303] team0: Port device team_slave_1 added [ 30.086311][ T3298] hsr_slave_0: entered promiscuous mode [ 30.092295][ T3298] hsr_slave_1: entered promiscuous mode [ 30.109187][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.116223][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.142271][ T3303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.169580][ T3299] hsr_slave_0: entered promiscuous mode [ 30.175743][ T3299] hsr_slave_1: entered promiscuous mode [ 30.181542][ T3299] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 30.189136][ T3299] Cannot create hsr debugfs directory [ 30.195171][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.202169][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.228156][ T3303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.243332][ T3305] hsr_slave_0: entered promiscuous mode [ 30.249395][ T3305] hsr_slave_1: entered promiscuous mode [ 30.255331][ T3305] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 30.262890][ T3305] Cannot create hsr debugfs directory [ 30.275110][ T3307] hsr_slave_0: entered promiscuous mode [ 30.281100][ T3307] hsr_slave_1: entered promiscuous mode [ 30.286983][ T3307] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 30.294539][ T3307] Cannot create hsr debugfs directory [ 30.360073][ T3303] hsr_slave_0: entered promiscuous mode [ 30.366252][ T3303] hsr_slave_1: entered promiscuous mode [ 30.372095][ T3303] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 30.379748][ T3303] Cannot create hsr debugfs directory [ 30.540405][ T3307] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.551260][ T3307] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.562844][ T3307] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.573865][ T3307] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.588483][ T3299] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 30.597241][ T3299] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 30.616138][ T3299] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 30.624906][ T3299] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 30.642004][ T3305] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 30.651035][ T3305] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 30.662048][ T3305] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 30.670768][ T3305] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 30.721122][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.728604][ T3298] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.743196][ T3298] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.755778][ T3298] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.771596][ T3298] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.787508][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.802435][ T3303] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.814626][ T3303] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.830110][ T3303] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.839951][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.847120][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.857504][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.864677][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.882181][ T3303] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.902976][ T3305] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.920797][ T3299] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.936195][ T3305] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.945929][ T2115] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.953167][ T2115] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.965831][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.972902][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.003380][ T3299] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.023210][ T2115] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.030399][ T2115] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.057181][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.064348][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.079403][ T3298] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.116548][ T3298] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.130192][ T3299] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.140703][ T3299] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.161454][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.175187][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.182278][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.191779][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.198912][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.210424][ T3303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.241122][ T3303] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.253034][ T3305] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.273649][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.280881][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.297544][ T3298] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.323030][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.330140][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.341551][ T3299] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.373309][ T3307] veth0_vlan: entered promiscuous mode [ 31.398306][ T3307] veth1_vlan: entered promiscuous mode [ 31.423644][ T3307] veth0_macvtap: entered promiscuous mode [ 31.447343][ T3298] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.466520][ T3307] veth1_macvtap: entered promiscuous mode [ 31.502223][ T3305] veth0_vlan: entered promiscuous mode [ 31.516284][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.534298][ T3305] veth1_vlan: entered promiscuous mode [ 31.543264][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.562366][ T3303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.577122][ T3307] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.585928][ T3307] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.594710][ T3307] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.603663][ T3307] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.641536][ T3305] veth0_macvtap: entered promiscuous mode [ 31.649882][ T3305] veth1_macvtap: entered promiscuous mode [ 31.666051][ T29] kauditd_printk_skb: 18 callbacks suppressed [ 31.666068][ T29] audit: type=1400 audit(1740252464.576:110): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/root/syzkaller.AIFunO/syz-tmp" dev="sda1" ino=1944 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 31.668556][ T3305] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 31.672220][ T29] audit: type=1400 audit(1740252464.576:111): avc: denied { mount } for pid=3307 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 31.696502][ T3305] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 31.697718][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.707033][ T29] audit: type=1400 audit(1740252464.576:112): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/root/syzkaller.AIFunO/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 31.732290][ T3299] veth0_vlan: entered promiscuous mode [ 31.738967][ T29] audit: type=1400 audit(1740252464.576:113): avc: denied { mount } for pid=3307 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 31.773039][ T3303] veth0_vlan: entered promiscuous mode [ 31.804278][ T29] audit: type=1400 audit(1740252464.586:114): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/root/syzkaller.AIFunO/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 31.830778][ T3305] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 31.830970][ T29] audit: type=1400 audit(1740252464.586:115): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/root/syzkaller.AIFunO/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=2940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 31.841290][ T3305] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 31.868627][ T29] audit: type=1400 audit(1740252464.586:116): avc: denied { unmount } for pid=3307 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 31.885296][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.907492][ T3303] veth1_vlan: entered promiscuous mode [ 31.916857][ T3299] veth1_vlan: entered promiscuous mode [ 31.935161][ T3303] veth0_macvtap: entered promiscuous mode [ 31.941555][ T29] audit: type=1400 audit(1740252464.726:117): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=502 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 31.944396][ T3298] veth0_vlan: entered promiscuous mode [ 31.964543][ T29] audit: type=1400 audit(1740252464.726:118): avc: denied { mount } for pid=3307 comm="syz-executor" name="/" dev="gadgetfs" ino=2957 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 31.980477][ T3298] veth1_vlan: entered promiscuous mode [ 31.999320][ T3303] veth1_macvtap: entered promiscuous mode [ 32.007986][ T3307] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.014687][ T3305] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.031473][ T3305] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.040327][ T3305] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.049084][ T3305] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.064027][ T3303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.074606][ T3303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.084581][ T3303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.095020][ T3303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.105568][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.120730][ T3303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.131257][ T3303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.141104][ T29] audit: type=1400 audit(1740252465.036:119): avc: denied { read write } for pid=3307 comm="syz-executor" name="loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 32.165468][ T3303] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.176022][ T3303] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.189553][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.212918][ T3303] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.221698][ T3303] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.230449][ T3303] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.239184][ T3303] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.261719][ T3439] mmap: syz.2.3 (3439) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 32.284456][ T3298] veth0_macvtap: entered promiscuous mode [ 32.318260][ T3299] veth0_macvtap: entered promiscuous mode [ 32.325780][ T3299] veth1_macvtap: entered promiscuous mode [ 32.332449][ T3298] veth1_macvtap: entered promiscuous mode [ 32.370765][ T3299] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.381256][ T3299] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.391155][ T3299] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.401673][ T3299] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.411552][ T3299] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.422037][ T3299] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.432696][ T3299] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.468261][ T3298] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.478841][ T3298] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.488682][ T3298] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.499187][ T3298] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.509074][ T3298] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.519573][ T3298] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.529412][ T3298] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.539925][ T3298] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.555366][ T3444] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 32.571504][ T3298] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.585161][ T3298] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.595717][ T3298] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.605557][ T3298] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.616015][ T3298] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.625908][ T3298] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.636371][ T3298] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.647274][ T3298] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.655636][ T3299] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.666121][ T3299] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.676048][ T3299] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.686586][ T3299] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.696461][ T3299] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.706969][ T3299] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.716919][ T3299] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.727415][ T3299] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.738307][ T3299] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.767708][ T3438] Set syz1 is full, maxelem 65536 reached [ 32.776523][ T3444] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4'. [ 32.788104][ T3298] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.797070][ T3298] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.805912][ T3298] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.814632][ T3298] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.846405][ T3299] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.855279][ T3299] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.864111][ T3299] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.864614][ T3438] syz.2.3 (3438) used greatest stack depth: 10872 bytes left [ 32.872944][ T3299] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.929201][ T3450] loop0: detected capacity change from 0 to 512 [ 32.973201][ T3450] EXT4-fs: Ignoring removed i_version option [ 33.090003][ T3468] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7'. [ 33.102078][ T3467] smc: net device bond0 applied user defined pnetid SYZ0 [ 33.113897][ T3450] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.130066][ T3467] raw_sendmsg: syz.3.10 forgot to set AF_INET. Fix it! [ 33.138183][ T3450] ext4 filesystem being mounted at /0/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.159034][ T3450] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1'. [ 33.169674][ T3450] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 33.170015][ T3462] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 33.177330][ T3450] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 33.183593][ T3462] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 33.183698][ T3462] vhci_hcd vhci_hcd.0: Device attached [ 33.209336][ T3450] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 33.216984][ T3450] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 33.236515][ T3473] 9pnet_fd: Insufficient options for proto=fd [ 33.236749][ T3475] loop2: detected capacity change from 0 to 512 [ 33.250473][ T3471] vhci_hcd: connection closed [ 33.250924][ T3475] EXT4-fs: Ignoring removed i_version option [ 33.261929][ T379] vhci_hcd: stop threads [ 33.266386][ T379] vhci_hcd: release socket [ 33.270867][ T379] vhci_hcd: disconnect device [ 33.299160][ C0] hrtimer: interrupt took 38365 ns [ 33.306432][ T3475] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.325957][ T3475] ext4 filesystem being mounted at /2/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.368515][ T3475] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11'. [ 33.384860][ T3475] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 33.392575][ T3475] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 33.408306][ T3475] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 33.415847][ T3475] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 33.433838][ T3482] 9pnet_fd: Insufficient options for proto=fd [ 33.634163][ T3487] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13'. [ 33.731307][ T3477] loop3: detected capacity change from 0 to 8192 [ 33.767382][ T3477] syz.3.12: attempt to access beyond end of device [ 33.767382][ T3477] loop3: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 33.782403][ T3477] FAT-fs (loop3): error, invalid access to FAT (entry 0x0000e1b1) [ 33.799695][ T3477] FAT-fs (loop3): Filesystem has been set read-only [ 33.811646][ T3477] FAT-fs (loop3): error, invalid access to FAT (entry 0x0000e1b1) [ 33.811745][ T3491] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14'. [ 33.832860][ T3477] FAT-fs (loop3): error, invalid access to FAT (entry 0x0000e1b1) [ 34.113460][ T3509] netlink: 68 bytes leftover after parsing attributes in process `syz.4.21'. [ 34.124305][ T3504] syz.3.18 (3504) used greatest stack depth: 10808 bytes left [ 34.150311][ T3511] netlink: 14 bytes leftover after parsing attributes in process `syz.4.22'. [ 34.163774][ T3511] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 34.179551][ T3511] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 34.190687][ T3511] bond0 (unregistering): Released all slaves [ 34.218859][ T3514] netlink: 244 bytes leftover after parsing attributes in process `syz.4.22'. [ 34.239945][ T3515] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 34.246499][ T3515] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 34.254223][ T3515] vhci_hcd vhci_hcd.0: Device attached [ 34.284860][ T3516] vhci_hcd: connection closed [ 34.285728][ T2115] vhci_hcd: stop threads [ 34.294741][ T2115] vhci_hcd: release socket [ 34.299308][ T2115] vhci_hcd: disconnect device [ 34.761567][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.811863][ T3523] SELinux: security policydb version 17 (MLS) not backwards compatible [ 34.826466][ T3523] SELinux: failed to load policy [ 34.835595][ T3524] netlink: 'syz.1.26': attribute type 29 has an invalid length. [ 34.843276][ T3524] netlink: 4 bytes leftover after parsing attributes in process `syz.1.26'. [ 34.867728][ T3522] netlink: 'syz.1.26': attribute type 29 has an invalid length. [ 35.076600][ T3307] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.111697][ T3534] Zero length message leads to an empty skb [ 35.120790][ T3526] loop3: detected capacity change from 0 to 512 [ 35.139598][ T3526] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 35.152753][ T3526] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 35.181481][ T3526] EXT4-fs (loop3): 1 truncate cleaned up [ 35.192936][ T3526] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.208262][ T3538] x_tables: duplicate underflow at hook 2 [ 35.231508][ T3541] syz.4.28 uses obsolete (PF_INET,SOCK_PACKET) [ 35.703918][ T3561] loop2: detected capacity change from 0 to 164 [ 35.712985][ T3561] iso9660: Unknown parameter 'ÿÿÿÿ' [ 35.723456][ T3374] hid-generic 0000:0003:0000.0001: unknown main item tag 0x0 [ 35.730942][ T3374] hid-generic 0000:0003:0000.0001: unknown main item tag 0x0 [ 35.748366][ T3561] loop2: detected capacity change from 0 to 512 [ 35.752125][ T3374] hid-generic 0000:0003:0000.0001: hidraw0: HID v0.00 Device [syz0] on syz1 [ 35.755074][ T3561] EXT4-fs: inline encryption not supported [ 35.810241][ T3561] EXT4-fs warning (device loop2): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 35.821987][ T3561] EXT4-fs warning (device loop2): dx_probe:881: Enable large directory feature to access it [ 35.832272][ T3561] EXT4-fs warning (device loop2): dx_probe:966: inode #2: comm syz.2.39: Corrupt directory, running e2fsck is recommended [ 35.909746][ T3305] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.975573][ T3561] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -117 [ 36.015022][ T3561] EXT4-fs error (device loop2): ext4_xattr_ibody_find:2240: inode #15: comm syz.2.39: corrupted in-inode xattr: invalid ea_ino [ 36.050328][ T3561] EXT4-fs error (device loop2): ext4_orphan_get:1394: comm syz.2.39: couldn't read orphan inode 15 (err -117) [ 36.071306][ T3561] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 36.108955][ T3577] loop4: detected capacity change from 0 to 1024 [ 36.117182][ T3561] EXT4-fs warning (device loop2): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 36.128848][ T3561] EXT4-fs warning (device loop2): dx_probe:881: Enable large directory feature to access it [ 36.138964][ T3561] EXT4-fs warning (device loop2): dx_probe:966: inode #2: comm syz.2.39: Corrupt directory, running e2fsck is recommended [ 36.171910][ T3577] EXT4-fs: dax option not supported [ 36.177604][ T3561] EXT4-fs warning (device loop2): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 36.189193][ T3561] EXT4-fs warning (device loop2): dx_probe:881: Enable large directory feature to access it [ 36.199326][ T3561] EXT4-fs warning (device loop2): dx_probe:966: inode #2: comm syz.2.39: Corrupt directory, running e2fsck is recommended [ 36.219985][ T3579] EXT4-fs warning (device loop2): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 36.231698][ T3579] EXT4-fs warning (device loop2): dx_probe:881: Enable large directory feature to access it [ 36.241864][ T3579] EXT4-fs warning (device loop2): dx_probe:966: inode #2: comm syz.2.39: Corrupt directory, running e2fsck is recommended [ 36.269017][ T3581] Cannot find map_set index 0 as target [ 36.276178][ T3584] EXT4-fs warning (device loop2): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 36.307270][ T3307] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.343057][ T3528] Process accounting resumed [ 36.416401][ T3593] loop4: detected capacity change from 0 to 128 [ 36.436352][ T3593] IPv4: Oversized IP packet from 127.202.26.0 [ 36.520621][ T3605] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 36.527257][ T3605] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 36.535039][ T3605] vhci_hcd vhci_hcd.0: Device attached [ 36.543593][ T3604] 0ªX¹¦À: renamed from caif0 [ 36.559550][ T3606] vhci_hcd: connection closed [ 36.559669][ T112] vhci_hcd: stop threads [ 36.568860][ T112] vhci_hcd: release socket [ 36.573281][ T112] vhci_hcd: disconnect device [ 36.586575][ T3604] 0ªX¹¦À: entered allmulticast mode [ 36.591834][ T3604] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 36.618621][ T3604] loop1: detected capacity change from 0 to 164 [ 36.629962][ T3604] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 36.656196][ T3604] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 36.686135][ T3615] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 36.692739][ T3615] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 36.700460][ T3615] vhci_hcd vhci_hcd.0: Device attached [ 36.715594][ T29] kauditd_printk_skb: 248 callbacks suppressed [ 36.715610][ T29] audit: type=1400 audit(1740252469.636:368): avc: denied { unmount } for pid=3298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:iso9660_t tclass=filesystem permissive=1 [ 36.717741][ T3616] vhci_hcd: connection closed [ 36.751916][ T11] vhci_hcd: stop threads [ 36.761206][ T11] vhci_hcd: release socket [ 36.765728][ T11] vhci_hcd: disconnect device [ 36.819032][ T29] audit: type=1400 audit(1740252469.736:369): avc: denied { mounton } for pid=3623 comm="syz.0.61" path="/3/bus" dev="tmpfs" ino=35 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 36.842618][ T29] audit: type=1400 audit(1740252469.766:370): avc: denied { unmount } for pid=3303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 36.873395][ T29] audit: type=1400 audit(1740252469.786:371): avc: denied { create } for pid=3627 comm="syz.2.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 36.896105][ T29] audit: type=1400 audit(1740252469.786:372): avc: denied { create } for pid=3627 comm="syz.2.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 36.915535][ T29] audit: type=1400 audit(1740252469.786:373): avc: denied { getopt } for pid=3627 comm="syz.2.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 36.938342][ T3630] FAULT_INJECTION: forcing a failure. [ 36.938342][ T3630] name failslab, interval 1, probability 0, space 0, times 1 [ 36.951471][ T3630] CPU: 1 UID: 0 PID: 3630 Comm: syz.0.63 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 [ 36.951513][ T3630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 36.951569][ T3630] Call Trace: [ 36.951574][ T3630] [ 36.951583][ T3630] dump_stack_lvl+0xf2/0x150 [ 36.951618][ T3630] dump_stack+0x15/0x1a [ 36.951644][ T3630] should_fail_ex+0x24a/0x260 [ 36.951737][ T3630] ? tcf_proto_create+0x45/0x1a0 [ 36.951813][ T3630] should_failslab+0x8f/0xb0 [ 36.951842][ T3630] __kmalloc_cache_noprof+0x4e/0x320 [ 36.951866][ T3630] tcf_proto_create+0x45/0x1a0 [ 36.951990][ T3630] tc_new_tfilter+0x974/0x1110 [ 36.952035][ T3630] ? __pfx_tc_new_tfilter+0x10/0x10 [ 36.952073][ T3630] rtnetlink_rcv_msg+0x651/0x710 [ 36.952170][ T3630] ? ref_tracker_free+0x3a5/0x410 [ 36.952206][ T3630] netlink_rcv_skb+0x12c/0x230 [ 36.952295][ T3630] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 36.952331][ T3630] rtnetlink_rcv+0x1c/0x30 [ 36.952357][ T3630] netlink_unicast+0x599/0x670 [ 36.952386][ T3630] netlink_sendmsg+0x5cc/0x6e0 [ 36.952433][ T3630] ? __pfx_netlink_sendmsg+0x10/0x10 [ 36.952465][ T3630] __sock_sendmsg+0x140/0x180 [ 36.952496][ T3630] ____sys_sendmsg+0x326/0x4b0 [ 36.952524][ T3630] __sys_sendmsg+0x19d/0x230 [ 36.952581][ T3630] __x64_sys_sendmsg+0x46/0x50 [ 36.952609][ T3630] x64_sys_call+0x2734/0x2dc0 [ 36.952640][ T3630] do_syscall_64+0xc9/0x1c0 [ 36.952670][ T3630] ? clear_bhb_loop+0x55/0xb0 [ 36.952748][ T3630] ? clear_bhb_loop+0x55/0xb0 [ 36.952778][ T3630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 36.952807][ T3630] RIP: 0033:0x7fc95128d169 [ 36.952824][ T3630] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 36.952842][ T3630] RSP: 002b:00007fc94f8f7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 36.952862][ T3630] RAX: ffffffffffffffda RBX: 00007fc9514a5fa0 RCX: 00007fc95128d169 [ 36.952885][ T3630] RDX: 0000000000040080 RSI: 0000400000006040 RDI: 0000000000000004 [ 36.952899][ T3630] RBP: 00007fc94f8f7090 R08: 0000000000000000 R09: 0000000000000000 [ 36.952911][ T3630] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 36.952924][ T3630] R13: 0000000000000000 R14: 00007fc9514a5fa0 R15: 00007ffe5f27a718 [ 36.952940][ T3630] [ 37.187524][ T3631] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 37.194088][ T3631] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 37.196241][ T29] audit: type=1400 audit(1740252470.116:374): avc: denied { setopt } for pid=3627 comm="syz.2.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.201791][ T3631] vhci_hcd vhci_hcd.0: Device attached [ 37.228512][ T29] audit: type=1400 audit(1740252470.146:375): avc: denied { connect } for pid=3627 comm="syz.2.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 37.271403][ T3636] loop2: detected capacity change from 0 to 1024 [ 37.281359][ T3636] ======================================================= [ 37.281359][ T3636] WARNING: The mand mount option has been deprecated and [ 37.281359][ T3636] and is ignored by this kernel. Remove the mand [ 37.281359][ T3636] option from the mount to silence this warning. [ 37.281359][ T3636] ======================================================= [ 37.293917][ T3632] vhci_hcd: connection closed [ 37.325292][ T112] vhci_hcd: stop threads [ 37.334336][ T112] vhci_hcd: release socket [ 37.338861][ T112] vhci_hcd: disconnect device [ 37.362030][ T3636] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.374870][ T3636] ext4 filesystem being mounted at /17/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.405967][ T29] audit: type=1400 audit(1740252470.326:376): avc: denied { read write } for pid=3635 comm="syz.2.65" name="file1" dev="loop2" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 37.428674][ T29] audit: type=1400 audit(1740252470.326:377): avc: denied { open } for pid=3635 comm="syz.2.65" path="/17/file1/file1" dev="loop2" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 37.461034][ T3636] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 37.476139][ T3636] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 63 with max blocks 65 with error 28 [ 37.488671][ T3636] EXT4-fs (loop2): This should not happen!! Data will be lost [ 37.488671][ T3636] [ 37.498449][ T3636] EXT4-fs (loop2): Total free blocks count 0 [ 37.504459][ T3636] EXT4-fs (loop2): Free/Dirty block details [ 37.505331][ T3645] netlink: 'syz.4.68': attribute type 32 has an invalid length. [ 37.510580][ T3636] EXT4-fs (loop2): free_blocks=4293918720 [ 37.523948][ T3636] EXT4-fs (loop2): dirty_blocks=80 [ 37.529344][ T3636] EXT4-fs (loop2): Block reservation details [ 37.535635][ T3636] EXT4-fs (loop2): i_reserved_data_blocks=5 [ 38.309921][ T3645] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 38.318680][ T3645] bridge1: entered promiscuous mode [ 38.406695][ T3636] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.454467][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x4 [ 38.462238][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x2 [ 38.473445][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.481198][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.489157][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.496901][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.504641][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.512477][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.520159][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.527824][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.535489][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.543201][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.550971][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.558768][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.566473][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.574121][ T8] hid-generic 0000:3000000:0000.0002: unknown main item tag 0x0 [ 38.609707][ T3636] syz.2.65 (3636) used greatest stack depth: 9880 bytes left [ 38.746262][ T8] hid-generic 0000:3000000:0000.0002: hidraw0: HID v0.00 Device [sy] on syz0 [ 38.852590][ T3674] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 39.017240][ T3680] loop4: detected capacity change from 0 to 1024 [ 39.035217][ T3680] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 39.061678][ T3680] EXT4-fs error (device loop4): ext4_map_blocks:705: inode #3: block 1: comm syz.4.81: lblock 1 mapped to illegal pblock 1 (length 1) [ 39.098230][ T3680] EXT4-fs error (device loop4): ext4_acquire_dquot:6927: comm syz.4.81: Failed to acquire dquot type 0 [ 39.120156][ T3680] EXT4-fs error (device loop4): ext4_free_blocks:6589: comm syz.4.81: Freeing blocks not in datazone - block = 0, count = 4096 [ 39.158311][ T3680] EXT4-fs error (device loop4): ext4_read_inode_bitmap:139: comm syz.4.81: Invalid inode bitmap blk 0 in block_group 0 [ 39.181218][ T112] EXT4-fs error (device loop4): ext4_map_blocks:671: inode #3: block 1: comm kworker/u8:4: lblock 1 mapped to illegal pblock 1 (length 1) [ 39.205236][ T3680] EXT4-fs error (device loop4) in ext4_free_inode:361: Corrupt filesystem [ 39.217902][ T3698] SELinux: syz.0.84 (3698) wrote to /sys/fs/selinux/user! This will not be supported in the future; please update your userspace. [ 39.224171][ T112] EXT4-fs error (device loop4): ext4_release_dquot:6950: comm kworker/u8:4: Failed to release dquot type 0 [ 39.244487][ T3680] EXT4-fs (loop4): 1 orphan inode deleted [ 39.256069][ T3680] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.305588][ T3708] netlink: 'syz.2.88': attribute type 3 has an invalid length. [ 39.376628][ T3714] __nla_validate_parse: 9 callbacks suppressed [ 39.376647][ T3714] netlink: 68 bytes leftover after parsing attributes in process `syz.0.90'. [ 39.420709][ T3299] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.477448][ T3720] capability: warning: `syz.4.92' uses deprecated v2 capabilities in a way that may be insecure [ 39.492299][ T3722] 9pnet_fd: Insufficient options for proto=fd [ 39.614767][ T3727] loop1: detected capacity change from 0 to 128 [ 39.650090][ T3727] netlink: 28 bytes leftover after parsing attributes in process `syz.1.97'. [ 39.660801][ T3733] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 39.792348][ T3738] netlink: 28 bytes leftover after parsing attributes in process `syz.4.98'. [ 40.400461][ T3748] netlink: 28 bytes leftover after parsing attributes in process `syz.3.99'. [ 40.618621][ T3754] nlmon0: Master is either lo or non-ether device [ 40.670670][ T3756] netlink: 'syz.4.103': attribute type 27 has an invalid length. [ 40.689169][ T3754] loop0: detected capacity change from 0 to 1024 [ 40.717562][ T3754] EXT4-fs: Ignoring removed nobh option [ 40.723285][ T3754] EXT4-fs: Ignoring removed bh option [ 40.738327][ T3754] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.817318][ T3756] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.824659][ T3756] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.835952][ T3764] netlink: 'syz.2.104': attribute type 13 has an invalid length. [ 40.866983][ T3756] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 40.877025][ T3756] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 40.905366][ T3756] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.914345][ T3756] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.923292][ T3756] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.932271][ T3756] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.966611][ T3756] bridge1: left promiscuous mode [ 41.039061][ T3764] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.042897][ T3771] loop1: detected capacity change from 0 to 1024 [ 41.046321][ T3764] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.053136][ T3771] EXT4-fs: Ignoring removed bh option [ 41.087311][ T3771] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 41.113574][ T3771] FAULT_INJECTION: forcing a failure. [ 41.113574][ T3771] name failslab, interval 1, probability 0, space 0, times 0 [ 41.126591][ T3771] CPU: 0 UID: 0 PID: 3771 Comm: syz.1.105 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 [ 41.126631][ T3771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 41.126646][ T3771] Call Trace: [ 41.126653][ T3771] [ 41.126661][ T3771] dump_stack_lvl+0xf2/0x150 [ 41.126688][ T3771] dump_stack+0x15/0x1a [ 41.126734][ T3771] should_fail_ex+0x24a/0x260 [ 41.126772][ T3771] should_failslab+0x8f/0xb0 [ 41.126873][ T3771] kmem_cache_alloc_noprof+0x52/0x320 [ 41.126897][ T3771] ? __es_insert_extent+0x563/0xed0 [ 41.126934][ T3771] __es_insert_extent+0x563/0xed0 [ 41.127000][ T3771] ext4_es_insert_extent+0x45a/0x1c60 [ 41.127091][ T3771] ext4_map_blocks+0x8b9/0xd20 [ 41.127219][ T3771] _ext4_get_block+0x104/0x370 [ 41.127251][ T3771] ? folio_mark_accessed+0x272/0x3d0 [ 41.127277][ T3771] ext4_get_block_unwritten+0x2c/0xb0 [ 41.127309][ T3771] ext4_block_write_begin+0x34f/0x9c0 [ 41.127391][ T3771] ? __pfx_ext4_get_block_unwritten+0x10/0x10 [ 41.127426][ T3771] ? ext4_inode_journal_mode+0xdf/0x1d0 [ 41.127447][ T3771] ext4_write_begin+0x426/0xc30 [ 41.127479][ T3771] ext4_da_write_begin+0x1b6/0x540 [ 41.127550][ T3771] generic_perform_write+0x1a8/0x4a0 [ 41.127621][ T3771] ? __mark_inode_dirty+0x45e/0x7e0 [ 41.127699][ T3771] ext4_buffered_write_iter+0x1ed/0x3c0 [ 41.127768][ T3771] ext4_file_write_iter+0x383/0xf20 [ 41.127807][ T3771] ? kstrtouint_from_user+0xb0/0xe0 [ 41.127839][ T3771] ? avc_policy_seqno+0x15/0x20 [ 41.127899][ T3771] ? selinux_file_permission+0x22a/0x360 [ 41.127932][ T3771] vfs_write+0x77b/0x920 [ 41.127963][ T3771] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 41.128022][ T3771] ksys_write+0xe8/0x1b0 [ 41.128056][ T3771] __x64_sys_write+0x42/0x50 [ 41.128085][ T3771] x64_sys_call+0x287e/0x2dc0 [ 41.128117][ T3771] do_syscall_64+0xc9/0x1c0 [ 41.128174][ T3771] ? clear_bhb_loop+0x55/0xb0 [ 41.128244][ T3771] ? clear_bhb_loop+0x55/0xb0 [ 41.128279][ T3771] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 41.128312][ T3771] RIP: 0033:0x7f8ce7c5d169 [ 41.128331][ T3771] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 41.128384][ T3771] RSP: 002b:00007f8ce62c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 41.128407][ T3771] RAX: ffffffffffffffda RBX: 00007f8ce7e75fa0 RCX: 00007f8ce7c5d169 [ 41.128422][ T3771] RDX: 0000000000000401 RSI: 0000400000001080 RDI: 0000000000000004 [ 41.128436][ T3771] RBP: 00007f8ce62c7090 R08: 0000000000000000 R09: 0000000000000000 [ 41.128449][ T3771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 41.128463][ T3771] R13: 0000000000000000 R14: 00007f8ce7e75fa0 R15: 00007fffd235c0f8 [ 41.128485][ T3771] [ 41.417744][ T3764] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.426879][ T3764] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.435857][ T3764] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.444867][ T3764] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.455236][ T3298] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.490659][ T3766] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.505452][ T3766] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 41.534824][ T3775] netlink: 16 bytes leftover after parsing attributes in process `syz.3.106'. [ 41.547243][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.568705][ T3785] loop0: detected capacity change from 0 to 128 [ 41.582087][ T3785] IPv4: Oversized IP packet from 127.202.26.0 [ 41.629800][ T3789] netlink: 16 bytes leftover after parsing attributes in process `syz.1.107'. [ 41.641024][ T3791] loop0: detected capacity change from 0 to 128 [ 41.680228][ T3795] netlink: 96 bytes leftover after parsing attributes in process `syz.3.112'. [ 41.780391][ T29] kauditd_printk_skb: 148 callbacks suppressed [ 41.780408][ T29] audit: type=1400 audit(1740252474.696:521): avc: denied { write } for pid=3804 comm="syz.3.115" path="socket:[4756]" dev="sockfs" ino=4756 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 41.842695][ T3808] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=4095 sclass=netlink_audit_socket pid=3808 comm=syz.3.116 [ 41.855443][ T3808] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=3808 comm=syz.3.116 [ 41.863243][ T29] audit: type=1400 audit(1740252474.696:522): avc: denied { nlmsg_read } for pid=3804 comm="syz.3.115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 41.890425][ T3809] netlink: 28 bytes leftover after parsing attributes in process `syz.1.114'. [ 41.909182][ T3793] loop4: detected capacity change from 0 to 512 [ 41.909624][ T29] audit: type=1400 audit(1740252474.826:523): avc: denied { create } for pid=3807 comm="syz.3.116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 41.983380][ T3808] netlink: 52 bytes leftover after parsing attributes in process `syz.3.116'. [ 41.993661][ T3808] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 42.001402][ T3808] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 42.010016][ T29] audit: type=1400 audit(1740252474.856:524): avc: denied { setopt } for pid=3807 comm="syz.3.116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 42.029328][ T29] audit: type=1400 audit(1740252474.856:525): avc: denied { ioctl } for pid=3807 comm="syz.3.116" path="socket:[5796]" dev="sockfs" ino=5796 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 42.052429][ T3814] GUP no longer grows the stack in syz.4.117 (3814): 400000004000-400000009000 (400000002000) [ 42.064025][ T3814] CPU: 1 UID: 0 PID: 3814 Comm: syz.4.117 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 [ 42.064058][ T3814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 42.064111][ T3814] Call Trace: [ 42.064137][ T3814] [ 42.064146][ T3814] dump_stack_lvl+0xf2/0x150 [ 42.064179][ T3814] dump_stack+0x15/0x1a [ 42.064200][ T3814] __get_user_pages+0x1de5/0x2350 [ 42.064241][ T3814] ? __rcu_read_unlock+0x4e/0x70 [ 42.064288][ T3814] get_user_pages_remote+0x1df/0x790 [ 42.064382][ T3814] __access_remote_vm+0x15b/0x580 [ 42.064485][ T3814] access_remote_vm+0x34/0x50 [ 42.064521][ T3814] proc_pid_cmdline_read+0x3e5/0x6b0 [ 42.064556][ T3814] vfs_readv+0x3e2/0x660 [ 42.064589][ T3814] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 42.064631][ T3814] __x64_sys_preadv+0xf4/0x1c0 [ 42.064669][ T3814] x64_sys_call+0x2680/0x2dc0 [ 42.064701][ T3814] do_syscall_64+0xc9/0x1c0 [ 42.064737][ T3814] ? clear_bhb_loop+0x55/0xb0 [ 42.064772][ T3814] ? clear_bhb_loop+0x55/0xb0 [ 42.064878][ T3814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.064911][ T3814] RIP: 0033:0x7f0e1a7fd169 [ 42.064998][ T3814] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 42.065021][ T3814] RSP: 002b:00007f0e18e67038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 42.065043][ T3814] RAX: ffffffffffffffda RBX: 00007f0e1aa15fa0 RCX: 00007f0e1a7fd169 [ 42.065058][ T3814] RDX: 0000000000000001 RSI: 0000400000000040 RDI: 0000000000000005 [ 42.065070][ T3814] RBP: 00007f0e1a87e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 42.065151][ T3814] R10: 0000000000000300 R11: 0000000000000246 R12: 0000000000000000 [ 42.065166][ T3814] R13: 0000000000000000 R14: 00007f0e1aa15fa0 R15: 00007ffd8efd79f8 [ 42.065191][ T3814] [ 42.246691][ T3808] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 42.254185][ T3808] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 42.266840][ T29] audit: type=1400 audit(1740252475.186:526): avc: denied { accept } for pid=3813 comm="syz.4.117" lport=39828 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 42.280401][ T3814] netlink: 'syz.4.117': attribute type 13 has an invalid length. [ 42.291882][ T29] audit: type=1400 audit(1740252475.186:527): avc: denied { create } for pid=3813 comm="syz.4.117" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 42.335827][ T3814] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 42.390525][ T3821] netlink: 96 bytes leftover after parsing attributes in process `syz.2.118'. [ 42.421785][ T3823] loop4: detected capacity change from 0 to 512 [ 42.433684][ T29] audit: type=1400 audit(1740252475.346:528): avc: denied { ioctl } for pid=3824 comm="syz.2.121" path="socket:[5810]" dev="sockfs" ino=5810 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 42.472188][ T29] audit: type=1400 audit(1740252475.346:529): avc: denied { setopt } for pid=3824 comm="syz.2.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 42.492831][ T3823] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.508107][ T29] audit: type=1400 audit(1740252475.426:530): avc: denied { setattr } for pid=3822 comm="syz.4.120" name="file0" dev="loop4" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 42.573558][ T3299] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.639475][ T3844] loop1: detected capacity change from 0 to 512 [ 42.651065][ T3844] EXT4-fs: Ignoring removed i_version option [ 42.657201][ T3846] loop3: detected capacity change from 0 to 128 [ 42.679204][ T3846] IPv4: Oversized IP packet from 127.202.26.0 [ 42.686488][ T3849] FAULT_INJECTION: forcing a failure. [ 42.686488][ T3849] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 42.699755][ T3849] CPU: 1 UID: 0 PID: 3849 Comm: syz.4.126 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 [ 42.699786][ T3849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 42.699868][ T3849] Call Trace: [ 42.699875][ T3849] [ 42.699884][ T3849] dump_stack_lvl+0xf2/0x150 [ 42.699919][ T3849] dump_stack+0x15/0x1a [ 42.699945][ T3849] should_fail_ex+0x24a/0x260 [ 42.699977][ T3849] should_fail+0xb/0x10 [ 42.700002][ T3849] should_fail_usercopy+0x1a/0x20 [ 42.700070][ T3849] _copy_from_iter+0xd5/0xd00 [ 42.700120][ T3849] ? kmalloc_reserve+0x16e/0x190 [ 42.700139][ T3849] ? __build_skb_around+0x196/0x1f0 [ 42.700159][ T3849] ? __alloc_skb+0x21f/0x310 [ 42.700253][ T3849] ? __virt_addr_valid+0x1ed/0x250 [ 42.700278][ T3849] ? __check_object_size+0x364/0x520 [ 42.700335][ T3849] netlink_sendmsg+0x460/0x6e0 [ 42.700374][ T3849] ? __pfx_netlink_sendmsg+0x10/0x10 [ 42.700412][ T3849] __sock_sendmsg+0x140/0x180 [ 42.700520][ T3849] sock_write_iter+0x15e/0x1a0 [ 42.700552][ T3849] do_iter_readv_writev+0x403/0x4b0 [ 42.700592][ T3849] vfs_writev+0x2d9/0x880 [ 42.700614][ T3849] ? get_pid_task+0x8e/0xc0 [ 42.700713][ T3849] ? proc_fail_nth_write+0x12a/0x150 [ 42.700753][ T3849] do_writev+0xf4/0x220 [ 42.700827][ T3849] __x64_sys_writev+0x45/0x50 [ 42.700854][ T3849] x64_sys_call+0x1fab/0x2dc0 [ 42.700879][ T3849] do_syscall_64+0xc9/0x1c0 [ 42.700915][ T3849] ? clear_bhb_loop+0x55/0xb0 [ 42.700982][ T3849] ? clear_bhb_loop+0x55/0xb0 [ 42.701015][ T3849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.701128][ T3849] RIP: 0033:0x7f0e1a7fd169 [ 42.701209][ T3849] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 42.701228][ T3849] RSP: 002b:00007f0e18e67038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 42.701249][ T3849] RAX: ffffffffffffffda RBX: 00007f0e1aa15fa0 RCX: 00007f0e1a7fd169 [ 42.701263][ T3849] RDX: 0000000000000001 RSI: 0000400000000140 RDI: 0000000000000005 [ 42.701277][ T3849] RBP: 00007f0e18e67090 R08: 0000000000000000 R09: 0000000000000000 [ 42.701291][ T3849] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 42.701305][ T3849] R13: 0000000000000000 R14: 00007f0e1aa15fa0 R15: 00007ffd8efd79f8 [ 42.701401][ T3849] [ 42.955673][ T3844] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.983175][ T3844] ext4 filesystem being mounted at /22/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 43.024426][ T3844] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 43.031933][ T3844] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 43.044242][ T3844] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 43.051849][ T3844] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 43.081601][ T3868] 9pnet_fd: Insufficient options for proto=fd [ 43.199368][ T3874] hub 6-0:1.0: USB hub found [ 43.204367][ T3874] hub 6-0:1.0: 8 ports detected [ 43.398316][ T3298] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.513525][ T3890] netlink: 'syz.1.144': attribute type 13 has an invalid length. [ 43.522725][ T3893] random: crng reseeded on system resumption [ 43.609936][ T3890] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 43.742426][ T3902] loop4: detected capacity change from 0 to 8192 [ 43.814247][ T3914] FAULT_INJECTION: forcing a failure. [ 43.814247][ T3914] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 43.827499][ T3914] CPU: 1 UID: 0 PID: 3914 Comm: syz.4.154 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 [ 43.827527][ T3914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 43.827542][ T3914] Call Trace: [ 43.827549][ T3914] [ 43.827558][ T3914] dump_stack_lvl+0xf2/0x150 [ 43.827592][ T3914] dump_stack+0x15/0x1a [ 43.827619][ T3914] should_fail_ex+0x24a/0x260 [ 43.827648][ T3914] should_fail+0xb/0x10 [ 43.827676][ T3914] should_fail_usercopy+0x1a/0x20 [ 43.827753][ T3914] _copy_from_user+0x1c/0xa0 [ 43.827791][ T3914] copy_msghdr_from_user+0x54/0x2a0 [ 43.827822][ T3914] ? __fget_files+0x17c/0x1c0 [ 43.827864][ T3914] __sys_sendmsg+0x13e/0x230 [ 43.827928][ T3914] __x64_sys_sendmsg+0x46/0x50 [ 43.827957][ T3914] x64_sys_call+0x2734/0x2dc0 [ 43.827990][ T3914] do_syscall_64+0xc9/0x1c0 [ 43.828025][ T3914] ? clear_bhb_loop+0x55/0xb0 [ 43.828051][ T3914] ? clear_bhb_loop+0x55/0xb0 [ 43.828117][ T3914] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 43.828175][ T3914] RIP: 0033:0x7f0e1a7fd169 [ 43.828191][ T3914] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 43.828207][ T3914] RSP: 002b:00007f0e18e67038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 43.828225][ T3914] RAX: ffffffffffffffda RBX: 00007f0e1aa15fa0 RCX: 00007f0e1a7fd169 [ 43.828237][ T3914] RDX: 0000000000000000 RSI: 0000400000001f80 RDI: 0000000000000003 [ 43.828251][ T3914] RBP: 00007f0e18e67090 R08: 0000000000000000 R09: 0000000000000000 [ 43.828265][ T3914] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 43.828355][ T3914] R13: 0000000000000000 R14: 00007f0e1aa15fa0 R15: 00007ffd8efd79f8 [ 43.828372][ T3914] [ 44.040033][ T3921] netlink: 'syz.2.158': attribute type 1 has an invalid length. [ 44.064298][ T3926] loop3: detected capacity change from 0 to 512 [ 44.073192][ T3921] 8021q: adding VLAN 0 to HW filter on device bond1 [ 44.094014][ T3926] EXT4-fs error (device loop3): ext4_xattr_ibody_find:2240: inode #15: comm syz.3.159: corrupted in-inode xattr: invalid ea_ino [ 44.117964][ T3921] veth3: entered promiscuous mode [ 44.127896][ T3921] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 44.135253][ T3926] EXT4-fs error (device loop3): ext4_orphan_get:1394: comm syz.3.159: couldn't read orphan inode 15 (err -117) [ 44.149612][ T3926] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 44.188440][ T3305] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.220167][ T3941] loop4: detected capacity change from 0 to 128 [ 44.236011][ T3941] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 44.249350][ T3941] ext4 filesystem being mounted at /43/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 44.281940][ T3946] loop3: detected capacity change from 0 to 1024 [ 44.297999][ T3946] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.310281][ T3946] ext4 filesystem being mounted at /31/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.323542][ T3946] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 44.339170][ T3946] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 21 with max blocks 44 with error 28 [ 44.351553][ T3946] EXT4-fs (loop3): This should not happen!! Data will be lost [ 44.351553][ T3946] [ 44.361251][ T3946] EXT4-fs (loop3): Total free blocks count 0 [ 44.367310][ T3946] EXT4-fs (loop3): Free/Dirty block details [ 44.373330][ T3946] EXT4-fs (loop3): free_blocks=4293918720 [ 44.379114][ T3946] EXT4-fs (loop3): dirty_blocks=80 [ 44.384327][ T3946] EXT4-fs (loop3): Block reservation details [ 44.390418][ T3946] EXT4-fs (loop3): i_reserved_data_blocks=5 [ 44.405476][ T3946] syz.3.167 (3946) used greatest stack depth: 9592 bytes left [ 44.413533][ T288] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 131075 with max blocks 1 with error 28 [ 44.460882][ T3951] SELinux: syz.0.169 (3951) wrote to /sys/fs/selinux/user! This will not be supported in the future; please update your userspace. [ 44.547877][ T3956] binfmt_misc: register: failed to install interpreter file ./file2 [ 44.579483][ T3958] loop0: detected capacity change from 0 to 2048 [ 44.596084][ T3958] netlink: 'syz.0.171': attribute type 1 has an invalid length. [ 44.610334][ T3958] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=48424 sclass=netlink_route_socket pid=3958 comm=syz.0.171 [ 44.707832][ T3961] __nla_validate_parse: 6 callbacks suppressed [ 44.707892][ T3961] netlink: 20 bytes leftover after parsing attributes in process `syz.0.172'. [ 44.791310][ T3965] FAULT_INJECTION: forcing a failure. [ 44.791310][ T3965] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 44.804430][ T3965] CPU: 1 UID: 0 PID: 3965 Comm: syz.0.173 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 [ 44.804459][ T3965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 44.804474][ T3965] Call Trace: [ 44.804482][ T3965] [ 44.804512][ T3965] dump_stack_lvl+0xf2/0x150 [ 44.804548][ T3965] dump_stack+0x15/0x1a [ 44.804651][ T3965] should_fail_ex+0x24a/0x260 [ 44.804729][ T3965] should_fail+0xb/0x10 [ 44.804773][ T3965] should_fail_usercopy+0x1a/0x20 [ 44.804879][ T3965] _copy_from_user+0x1c/0xa0 [ 44.804908][ T3965] bpf_obj_get_info_by_fd+0x2cd/0x1ca0 [ 44.804998][ T3965] ? kstrtoull+0x110/0x140 [ 44.805027][ T3965] ? kstrtouint+0x77/0xc0 [ 44.805066][ T3965] __sys_bpf+0x613/0x7a0 [ 44.805176][ T3965] __x64_sys_bpf+0x43/0x50 [ 44.805204][ T3965] x64_sys_call+0x2914/0x2dc0 [ 44.805234][ T3965] do_syscall_64+0xc9/0x1c0 [ 44.805268][ T3965] ? clear_bhb_loop+0x55/0xb0 [ 44.805372][ T3965] ? clear_bhb_loop+0x55/0xb0 [ 44.805401][ T3965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.805433][ T3965] RIP: 0033:0x7fc95128d169 [ 44.805450][ T3965] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 44.805472][ T3965] RSP: 002b:00007fc94f8f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 44.805492][ T3965] RAX: ffffffffffffffda RBX: 00007fc9514a5fa0 RCX: 00007fc95128d169 [ 44.805506][ T3965] RDX: 0000000000000010 RSI: 0000400000000300 RDI: 000000000000000f [ 44.805519][ T3965] RBP: 00007fc94f8f7090 R08: 0000000000000000 R09: 0000000000000000 [ 44.805588][ T3965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 44.805603][ T3965] R13: 0000000000000000 R14: 00007fc9514a5fa0 R15: 00007ffe5f27a718 [ 44.805626][ T3965] [ 45.060578][ T3977] netlink: 268 bytes leftover after parsing attributes in process `syz.2.178'. [ 45.069874][ T3977] unsupported nla_type 65024 [ 45.155455][ T3981] loop0: detected capacity change from 0 to 2048 [ 45.196428][ T3981] loop0: p1 < > p4 [ 45.201827][ T3981] loop0: p4 size 8388608 extends beyond EOD, truncated [ 45.285584][ T3985] loop0: detected capacity change from 0 to 128 [ 45.304843][ T3985] IPv4: Oversized IP packet from 127.202.26.0 [ 45.396863][ T3995] netlink: 96 bytes leftover after parsing attributes in process `syz.2.186'. [ 45.471885][ T4005] netlink: 'syz.2.190': attribute type 27 has an invalid length. [ 45.485520][ T4005] veth3: left promiscuous mode [ 45.509449][ T4005] 8021q: adding VLAN 0 to HW filter on device bond0 [ 45.517321][ T4005] 8021q: adding VLAN 0 to HW filter on device team0 [ 45.527078][ T4005] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 45.568226][ T4008] capability: warning: `syz.0.191' uses 32-bit capabilities (legacy support in use) [ 45.657606][ T4022] loop0: detected capacity change from 0 to 128 [ 45.680429][ T4022] IPv4: Oversized IP packet from 127.202.26.0 [ 45.775495][ T4042] netlink: 96 bytes leftover after parsing attributes in process `syz.0.197'. [ 45.812169][ T4046] netlink: 68 bytes leftover after parsing attributes in process `syz.0.199'. [ 45.825130][ T4048] netlink: 'syz.2.198': attribute type 3 has an invalid length. [ 45.837815][ T4048] netlink: 8 bytes leftover after parsing attributes in process `syz.2.198'. [ 45.881830][ T4059] netlink: 28 bytes leftover after parsing attributes in process `syz.2.201'. [ 45.939883][ T4063] netlink: 96 bytes leftover after parsing attributes in process `syz.0.203'. [ 45.978321][ T4067] loop0: detected capacity change from 0 to 128 [ 45.990995][ T4067] IPv4: Oversized IP packet from 127.202.26.0 [ 46.135980][ T4073] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 46.292619][ T4082] netlink: 96 bytes leftover after parsing attributes in process `syz.0.211'. [ 46.325868][ T4084] loop3: detected capacity change from 0 to 1024 [ 46.366271][ T4084] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a840c018, mo2=0002] [ 46.379984][ T4084] System zones: 0-1, 3-12 [ 46.390755][ T4084] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 46.406564][ T4088] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 46.412490][ T4088] syzkaller1: linktype set to 512 [ 46.428849][ T4084] 9pnet_fd: Insufficient options for proto=fd [ 46.446649][ T3305] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.476944][ T4090] loop3: detected capacity change from 0 to 128 [ 46.524499][ T4090] netlink: 100 bytes leftover after parsing attributes in process `syz.3.214'. [ 46.534190][ T4092] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 46.613746][ T4090] syz.3.214: attempt to access beyond end of device [ 46.613746][ T4090] loop3: rw=2049, sector=145, nr_sectors = 896 limit=128 [ 46.644980][ T4097] loop0: detected capacity change from 0 to 512 [ 46.655342][ T4097] EXT4-fs: Ignoring removed i_version option [ 46.697130][ T4097] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.730912][ T4097] ext4 filesystem being mounted at /48/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 46.784822][ T4106] sch_tbf: peakrate 8 is lower than or equals to rate 3221225473 ! [ 46.807423][ T29] kauditd_printk_skb: 300 callbacks suppressed [ 46.807441][ T29] audit: type=1326 audit(1740252479.726:829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2999d0d169 code=0x7ffc0000 [ 46.846178][ T4109] 9pnet_fd: Insufficient options for proto=fd [ 46.914966][ T29] audit: type=1326 audit(1740252479.726:830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=64 compat=0 ip=0x7f2999d0d169 code=0x7ffc0000 [ 46.938204][ T29] audit: type=1326 audit(1740252479.726:831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2999d0d169 code=0x7ffc0000 [ 46.961569][ T29] audit: type=1326 audit(1740252479.726:832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2999d0d169 code=0x7ffc0000 [ 46.984829][ T29] audit: type=1326 audit(1740252479.726:833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2999d0d169 code=0x7ffc0000 [ 47.008245][ T29] audit: type=1326 audit(1740252479.726:834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2999d0d169 code=0x7ffc0000 [ 47.031916][ T29] audit: type=1326 audit(1740252479.726:835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2999d0d169 code=0x7ffc0000 [ 47.055431][ T29] audit: type=1326 audit(1740252479.726:836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f2999d0d169 code=0x7ffc0000 [ 47.078667][ T29] audit: type=1326 audit(1740252479.726:837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2999d0d169 code=0x7ffc0000 [ 47.102068][ T29] audit: type=1326 audit(1740252479.726:838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4105 comm="syz.3.220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2999d0d169 code=0x7ffc0000 [ 47.218485][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.237255][ T3299] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 47.273529][ T4114] bridge_slave_1: left allmulticast mode [ 47.279474][ T4114] bridge_slave_1: left promiscuous mode [ 47.285524][ T4114] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.294626][ T4114] bridge_slave_0: left allmulticast mode [ 47.300343][ T4114] bridge_slave_0: left promiscuous mode [ 47.306026][ T4114] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.392051][ T4120] IPv6: addrconf: prefix option has invalid lifetime [ 47.444667][ T4128] loop4: detected capacity change from 0 to 512 [ 47.458927][ T4128] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 47.480884][ T4133] xt_hashlimit: max too large, truncated to 1048576 [ 48.005829][ T4154] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 48.023837][ T4152] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 48.030482][ T4152] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 48.038286][ T4152] vhci_hcd vhci_hcd.0: Device attached [ 48.107705][ T4163] FAULT_INJECTION: forcing a failure. [ 48.107705][ T4163] name failslab, interval 1, probability 0, space 0, times 0 [ 48.120484][ T4163] CPU: 1 UID: 0 PID: 4163 Comm: syz.0.236 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 [ 48.120514][ T4163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 48.120584][ T4163] Call Trace: [ 48.120591][ T4163] [ 48.120598][ T4163] dump_stack_lvl+0xf2/0x150 [ 48.120631][ T4163] dump_stack+0x15/0x1a [ 48.120657][ T4163] should_fail_ex+0x24a/0x260 [ 48.120693][ T4163] should_failslab+0x8f/0xb0 [ 48.120751][ T4163] kmem_cache_alloc_noprof+0x52/0x320 [ 48.120809][ T4163] ? alloc_empty_file+0xd0/0x200 [ 48.120832][ T4163] ? _raw_spin_unlock+0x26/0x50 [ 48.120857][ T4163] alloc_empty_file+0xd0/0x200 [ 48.120882][ T4163] alloc_file_pseudo+0xc9/0x160 [ 48.120910][ T4163] anon_inode_getfile+0xa3/0x120 [ 48.120935][ T4163] do_eventfd+0x10a/0x1b0 [ 48.120965][ T4163] __x64_sys_eventfd+0x20/0x30 [ 48.120996][ T4163] x64_sys_call+0x2626/0x2dc0 [ 48.121028][ T4163] do_syscall_64+0xc9/0x1c0 [ 48.121064][ T4163] ? clear_bhb_loop+0x55/0xb0 [ 48.121096][ T4163] ? clear_bhb_loop+0x55/0xb0 [ 48.121188][ T4163] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 48.121299][ T4163] RIP: 0033:0x7fc95128d169 [ 48.121316][ T4163] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 48.121336][ T4163] RSP: 002b:00007fc94f8f7038 EFLAGS: 00000246 ORIG_RAX: 000000000000011c [ 48.121357][ T4163] RAX: ffffffffffffffda RBX: 00007fc9514a5fa0 RCX: 00007fc95128d169 [ 48.121390][ T4163] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 48.121497][ T4163] RBP: 00007fc94f8f7090 R08: 0000000000000000 R09: 0000000000000000 [ 48.121508][ T4163] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 48.121519][ T4163] R13: 0000000000000000 R14: 00007fc9514a5fa0 R15: 00007ffe5f27a718 [ 48.121536][ T4163] [ 48.310828][ T4155] vhci_hcd: connection closed [ 48.311416][ T112] vhci_hcd: stop threads [ 48.320676][ T112] vhci_hcd: release socket [ 48.325155][ T112] vhci_hcd: disconnect device [ 48.365032][ T9] usb 8-1: enqueue for inactive port 0 [ 48.372510][ T4167] netlink: 'syz.4.239': attribute type 29 has an invalid length. [ 48.383632][ T4169] Cannot find del_set index 4 as target [ 48.403966][ T4167] netlink: 'syz.4.239': attribute type 29 has an invalid length. [ 48.520740][ T4178] loop0: detected capacity change from 0 to 256 [ 48.544262][ T4178] FAT-fs (loop0): codepage cp866 not found [ 48.575944][ T9] usb 8-1: enqueue for inactive port 0 [ 48.598492][ T4178] loop0: detected capacity change from 0 to 2048 [ 48.729373][ T4176] syz.1.244 (4176) used greatest stack depth: 9416 bytes left [ 48.820773][ T4184] loop1: detected capacity change from 0 to 128 [ 48.904295][ T4186] loop3: detected capacity change from 0 to 512 [ 48.915222][ T4186] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 48.928720][ T4186] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=800ec018, mo2=0002] [ 48.941228][ T4186] EXT4-fs error (device loop3): ext4_xattr_ibody_find:2240: inode #15: comm syz.3.247: corrupted in-inode xattr: bad e_name length [ 48.966059][ T4186] EXT4-fs error (device loop3): ext4_orphan_get:1394: comm syz.3.247: couldn't read orphan inode 15 (err -117) [ 48.985395][ T4186] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.041511][ T3305] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.077299][ T4197] loop3: detected capacity change from 0 to 512 [ 49.097739][ T4197] EXT4-fs: Ignoring removed i_version option [ 49.127459][ T4197] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.140415][ T4197] ext4 filesystem being mounted at /47/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 49.222046][ T4197] 9pnet_fd: Insufficient options for proto=fd [ 49.528316][ T4208] Set syz1 is full, maxelem 65536 reached [ 49.659869][ T4233] tipc: Started in network mode [ 49.664850][ T4233] tipc: Node identity ac14140f, cluster identity 4711 [ 49.687667][ T4233] tipc: New replicast peer: 255.255.255.255 [ 49.693850][ T4233] tipc: Enabled bearer , priority 10 [ 49.708048][ T9] usb usb8-port1: attempt power cycle [ 49.835849][ T3305] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.872872][ T4255] __nla_validate_parse: 8 callbacks suppressed [ 49.872887][ T4255] netlink: 4 bytes leftover after parsing attributes in process `syz.0.265'. [ 49.926781][ T4259] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 49.946211][ T4260] netlink: 4 bytes leftover after parsing attributes in process `syz.0.265'. [ 49.955173][ T4262] wireguard: wg2: Could not create IPv6 socket [ 49.961373][ T4262] wg2: entered promiscuous mode [ 49.966408][ T4262] wg2: entered allmulticast mode [ 49.971703][ T4236] 9pnet_fd: Insufficient options for proto=fd [ 49.994817][ T4263] netlink: 16 bytes leftover after parsing attributes in process `syz.1.267'. [ 50.026687][ T4262] xt_CT: No such helper "pptp" [ 50.035783][ T2964] IPVS: starting estimator thread 0... [ 50.082802][ T4273] netlink: 16 bytes leftover after parsing attributes in process `syz.3.271'. [ 50.117652][ T4271] netlink: 96 bytes leftover after parsing attributes in process `syz.4.272'. [ 50.127377][ T4268] IPVS: using max 2304 ests per chain, 115200 per kthread [ 50.198469][ T4282] sd 0:0:1:0: device reset [ 50.353165][ T4307] netlink: 36 bytes leftover after parsing attributes in process `syz.1.283'. [ 50.382097][ T4307] netlink: 36 bytes leftover after parsing attributes in process `syz.1.283'. [ 50.397461][ T4309] loop4: detected capacity change from 0 to 512 [ 50.404126][ T4309] EXT4-fs: Ignoring removed i_version option [ 50.480361][ T4309] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 50.496973][ T4321] pim6reg1: entered promiscuous mode [ 50.502353][ T4321] pim6reg1: entered allmulticast mode [ 50.528436][ T4313] loop1: detected capacity change from 0 to 8192 [ 50.542211][ T4309] ext4 filesystem being mounted at /57/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 50.557493][ T4321] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 50.610779][ T4309] netlink: 4 bytes leftover after parsing attributes in process `syz.4.284'. [ 50.663987][ T4309] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 50.675021][ C0] ================================================================== [ 50.683234][ C0] BUG: KCSAN: data-race in wq_worker_tick / wq_worker_tick [ 50.690452][ C0] [ 50.692781][ C0] read-write to 0xffff8881000730b8 of 8 bytes by interrupt on cpu 1: [ 50.700876][ C0] wq_worker_tick+0x63/0x240 [ 50.705501][ C0] sched_tick+0xd7/0x140 [ 50.709781][ C0] update_process_times+0x161/0x190 [ 50.715034][ C0] tick_nohz_handler+0x250/0x2d0 [ 50.720000][ C0] __hrtimer_run_queues+0x20d/0x5e0 [ 50.725221][ C0] hrtimer_interrupt+0x235/0x4a0 [ 50.730176][ C0] __sysvec_apic_timer_interrupt+0x5c/0x1d0 [ 50.736092][ C0] sysvec_apic_timer_interrupt+0x6e/0x80 [ 50.741733][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 50.747726][ C0] kcsan_setup_watchpoint+0x404/0x410 [ 50.753114][ C0] in_aton+0x1f/0x2a0 [ 50.757107][ C0] nsim_dev_trap_report_work+0x335/0x620 [ 50.762744][ C0] process_scheduled_works+0x4db/0xa20 [ 50.768214][ C0] worker_thread+0x51d/0x6f0 [ 50.772808][ C0] kthread+0x4ae/0x520 [ 50.776905][ C0] ret_from_fork+0x4b/0x60 [ 50.781330][ C0] ret_from_fork_asm+0x1a/0x30 [ 50.786102][ C0] [ 50.788422][ C0] read-write to 0xffff8881000730b8 of 8 bytes by interrupt on cpu 0: [ 50.796486][ C0] wq_worker_tick+0x63/0x240 [ 50.801085][ C0] sched_tick+0xd7/0x140 [ 50.805337][ C0] update_process_times+0x161/0x190 [ 50.810552][ C0] tick_nohz_handler+0x250/0x2d0 [ 50.815498][ C0] __hrtimer_run_queues+0x20d/0x5e0 [ 50.820700][ C0] hrtimer_interrupt+0x235/0x4a0 [ 50.825664][ C0] __sysvec_apic_timer_interrupt+0x5c/0x1d0 [ 50.831575][ C0] sysvec_apic_timer_interrupt+0x6e/0x80 [ 50.837217][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 50.843214][ C0] __tsan_unaligned_write4+0x2c/0x180 [ 50.848593][ C0] __build_skb_around+0xdf/0x1f0 [ 50.853623][ C0] __alloc_skb+0x1e9/0x310 [ 50.858041][ C0] nsim_dev_trap_report_work+0x189/0x620 [ 50.863680][ C0] process_scheduled_works+0x4db/0xa20 [ 50.869157][ C0] worker_thread+0x51d/0x6f0 [ 50.873771][ C0] kthread+0x4ae/0x520 [ 50.877850][ C0] ret_from_fork+0x4b/0x60 [ 50.882271][ C0] ret_from_fork_asm+0x1a/0x30 [ 50.887134][ C0] [ 50.889464][ C0] value changed: 0x00000000000ad570 -> 0x00000000000afc80 [ 50.896568][ C0] [ 50.898889][ C0] Reported by Kernel Concurrency Sanitizer on: [ 50.905037][ C0] CPU: 0 UID: 0 PID: 112 Comm: kworker/u8:4 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 [ 50.915801][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 50.925865][ C0] Workqueue: events_unbound nsim_dev_trap_report_work [ 50.932728][ C0] ================================================================== [ 50.941491][ T2964] tipc: Node number set to 2886997007 [ 50.950001][ T4327] 9pnet_fd: Insufficient options for proto=fd [ 50.972089][ T4309] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 51.065340][ T4333] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.072653][ T4333] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.107740][ T4319] netlink: 24 bytes leftover after parsing attributes in process `syz.0.288'. [ 51.153083][ T3299] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.173791][ T4333] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.183159][ T4333] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.192256][ T4333] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.201308][ T4333] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.220950][ T4319] netlink: 4 bytes leftover after parsing attributes in process `syz.0.288'. [ 51.835204][ T9] usb usb8-port1: unable to enumerate USB device