last executing test programs: 1.906109445s ago: executing program 3 (id=349): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000007000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x45, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs\x00') r3 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r3, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r3, 0x4) close_range(r2, r3, 0x0) 1.833952026s ago: executing program 3 (id=351): syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000200)='./file0\x00', 0x800, &(0x7f0000000340)=ANY=[@ANYRES32=0x0, @ANYRESOCT, @ANYRES64, @ANYRES16], 0x1, 0x36e, &(0x7f0000000c00)="$eJzs3c9rI2UYwPEnaZpMumyTgygK0ge96GVoq2c1yC6IAZfuRtwVhNntREPGpMyESERsPXkVb/4DgsseFzwsqP9AL97WixdP9iIIuog4Mr/SJJ00aTZL0/b7gTZP8r7PzPvmF88byJuD9776uFn3zLrVkayhkhEReSRSlqwkMtFFXlLsycuX/nz4/PWbt96uVKtXtlSvVm68sqmqq2s/fPJZMe72oCD75Q8OxPht/+n9Zw/+u/FRw9OGp612Ry293f61Y912bN1ueE1T9ZpjW56tjZZnu1F7O2qvO+2dnZ5are3LKzuu7XlqtXratHvaaWvH7an1odVoqWmaenklbbjnmDFDTu3u1pZVmfGEd2bMw7z94/v+Mc2uW7GWRMzikZba3Sc6LgAAsJBG6v9vkhqhLNl+QZmJ1wL5MB5eBgT1fxKH9X+wWDis/++98FPn0rv3V+P6/0E+rf5/9Zcof6j+D84+9/r/u5HrRyuiM2/3JJ0fq/7HYlgbfkX+frhijwX1f/Bq6K/ov3j/3noYUP8DAAAAAAAAAAAAAAAAAAAAAHAWPPL9ku/7peQy+Tv8CkF8Pbl23BeNceaMe/wL8Y4C/ecDzqXrN2+JEX5xL7cq4nzZrXVr0WXcnnRcl5L8Gz4fYtGGE3thowbK8qOz260txwlL4f+KiIojtmxIScpD+WF89a3qlQ2NRPnh+Xe7tUxuJcivSyPM35SSPJWev5man5eXXhzIN6UkP9+RtjiyHb+PJfmfb6i++U51JL8Y9kvz+pN9SAAAAAAAmDtT1YiXz+Xh9W+0fjdN1bT2YC0vg+vzo58P9NfX66nr81zpudzpzh0AAAAAgIvCy3/atBzHdr3e2KAok/oU4qONNOVkwpGDIDdFn6HgYRgsH9dnaWCG0x45H/+CxrTDcL2eTD3mJPirIKl3ZrKF61CTkX6vThkk85+is3HSh8D1siefu+16a8F4dKbpDATJx0bj+si1WY88Lkh2zp3U+Zmvv/17tlNk4l17B5teu29MmGkYZEZu2ZvwpP3D9yeOZzn93eL7WX5kBgAAAMCCSIr+opfc8sbpDggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAtortukjQlOe44AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAovg/AAD//5h69bA=") r0 = creat(&(0x7f0000000100)='./bus\x00', 0x2) r1 = open(&(0x7f0000000780)='./bus\x00', 0x14507e, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x2, 0x7fe2, 0x3, 0x12}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) fallocate(r0, 0x0, 0x0, 0x1000f4) io_setup(0x7d, &(0x7f0000000600)=0x0) io_submit(r4, 0x2, &(0x7f0000001d00)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000)="96", 0xfffffe10, 0x0, 0x0, 0x0, r1}, &(0x7f0000000740)={0x0, 0x0, 0x41, 0x3, 0x0, r0, 0x0, 0x0, 0xffffffffffffffff}]) 1.598170921s ago: executing program 3 (id=357): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x80) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0x3}, {0x7}, {0x2, 0x1}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x4, 0x2, 0x40, 0x3276}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40098}, 0x4044) 1.528815612s ago: executing program 2 (id=359): r0 = perf_event_open(&(0x7f0000000c40)={0x2, 0x80, 0x25, 0x1, 0x0, 0x0, 0x0, 0x100, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_config_ext={0x7fff, 0x401}, 0x100b28, 0x6, 0x0, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x20280, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) perf_event_open$cgroup(&(0x7f0000000380)={0x2, 0x80, 0x2, 0x1, 0x3, 0x10, 0x0, 0x7f, 0x201, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, @perf_config_ext={0x1000, 0x4}, 0x14006, 0xe, 0x3, 0x9, 0x0, 0x2c, 0x1, 0x0, 0x3, 0x0, 0x3}, r1, 0xc, r0, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="190000000400000004000000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001201", 0x2e}], 0x1}, 0x48000) 1.519638472s ago: executing program 4 (id=360): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff018004000800395032303030"], 0x15) r2 = dup(r1) write$P9_RLERRORu(r2, &(0x7f0000000540)=ANY=[@ANYBLOB="8b"], 0x53) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) write$binfmt_elf64(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c4600073f034b0b00000000000003003e00ffffffe935"], 0x7c8) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) stat(&(0x7f0000001c40)='./file0\x00', 0x0) 1.463032963s ago: executing program 3 (id=362): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = mq_open(&(0x7f0000000080)='$@\x00', 0x40, 0xb4, 0x0) fcntl$setlease(r2, 0x400, 0x0) mq_open(&(0x7f0000000140)='$@\x00', 0x1, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xf, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00', r3}, 0x10) 1.426327914s ago: executing program 4 (id=364): syz_mount_image$ext4(&(0x7f0000000380)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x3000046, &(0x7f0000000e00)={[{@jqfmt_vfsold}, {@nojournal_checksum}, {@nodelalloc}, {@dioread_lock}, {@data_err_ignore}, {@resgid}, {@jqfmt_vfsold}, {@journal_dev={'journal_dev', 0x3d, 0x800}}, {@nobh}, {@inlinecrypt}, {@grpquota}, {@dioread_nolock}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000060000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = creat(&(0x7f0000000000)='./file1\x00', 0x14c) fallocate(r2, 0x0, 0xbf5, 0x2000402) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./file1\x00', &(0x7f0000000300), &(0x7f0000000040)=ANY=[], 0xfe37, 0x0) 1.277935027s ago: executing program 4 (id=365): socket(0x2b, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x3, 0x0, &(0x7f0000000000)="5cdd30", 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd5f, 0x0, 0x0}, 0x4c) r0 = syz_io_uring_setup(0xd38, &(0x7f0000000300)={0x0, 0x7732, 0x80, 0x1, 0x350}, &(0x7f00000000c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_TIMEOUT={0xb, 0x36, 0x0, 0x0, 0x4, 0x0, 0x1, 0x20}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) 1.204876808s ago: executing program 2 (id=366): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x11, 0xb, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000070000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = syz_io_uring_setup(0xa4d, &(0x7f0000000480)={0x0, 0x0, 0x80, 0x1, 0x24f}, &(0x7f00000000c0)=0x0, &(0x7f0000000340)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2c, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x42, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, {0x2}}) io_uring_enter(r1, 0x47bc, 0x2000, 0x0, 0x0, 0x0) 1.192657148s ago: executing program 4 (id=367): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000900)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0xfffffd9d) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x10000000}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x2) sendfile(r0, r1, 0x0, 0x8000002b) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="50000000270001000000000006000000ac1e01", @ANYRES32=0x0, @ANYRES32=0x0], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x0) 991.949952ms ago: executing program 2 (id=370): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) setsockopt(r0, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000005400)={0x0, @in6={{0xa, 0x4e23, 0x46, @mcast1, 0x40}}}, 0x84) 955.040412ms ago: executing program 2 (id=371): r0 = socket(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xfff3, 0xffe0}, {}, {0x5, 0x8}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x0, 0xffff}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8848}, 0x4000010) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) 845.098155ms ago: executing program 2 (id=373): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000007c0), r3) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000800)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)={0x24, r4, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x44801}, 0x40) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000006c0)={0x24, r4, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x8040}, 0x40) 752.021226ms ago: executing program 2 (id=375): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000300)="a0", 0x1, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0x21) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000800)="3504000030000511d25a80648c63940d0324fc60040035400c0002000200002037153e373f04018006041000450055d64a12f76710989a119052acaa1100da3e813fa6ba1eb693d93f699e37af0d43f908fa7d995a8feb85d6a4e1b691276cd9561767309099f86f8e9e71fa51bde29f19b06fb9b3ba96da0e93d5a4024c1747fff68092705b44bb48dd2db4f3127aab13b4af0554957da6c0e03db227b65d459fa5c1232d7b62f12b65354b7e7fd32998da02ae0dc28942ec82d97191d0b68697", 0xc1}], 0x1}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000800)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x11, r2, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, 0x0, &(0x7f00000000c0)) 724.526357ms ago: executing program 0 (id=376): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40000100, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x800, 0xfffffffc, 0x7, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x20000000000002b8, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x8000, 0x0, 0x0, 0x41000}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000940)="2e00000010008188e6b62aa73772cc9f1ba1f8482e0000005e140602000000000e000a001000000002800000128c", 0x2e}], 0x1}, 0x0) 639.570788ms ago: executing program 0 (id=377): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$ext4(0x0, &(0x7f0000000140)='./file0\x00', 0x2000000, 0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x1, 0xc, 0x9}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2000000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0xc7) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180), &(0x7f0000000280), 0x84, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r1}, 0x10) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000500)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000a40)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) 581.760969ms ago: executing program 3 (id=378): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x10) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f00000001c0), 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='devpts\x00', 0x5, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$tmpfs(0x0, &(0x7f0000000400)='./file0/../file0\x00', &(0x7f00000003c0), 0x200044, 0x0) umount2(&(0x7f00000002c0)='./file0/../file0\x00', 0x0) 566.7577ms ago: executing program 0 (id=379): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1, 0x12}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) unshare(0x2c020400) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x18, 0x1b, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000005000000000000000200000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000ff0300007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001080000850000008200000018110000", @ANYRES32=r2, @ANYBLOB="00000000000000008500000075000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r3}, 0x10) preadv(r4, 0x0, 0x0, 0xc002a0, 0x1) 494.646241ms ago: executing program 0 (id=380): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='rxrpc_recvmsg\x00', r2}, 0x18) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='rxrpc_recvmsg\x00', r3}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000380)=r1}, 0x20) r4 = socket$kcm(0x21, 0x2, 0x2) recvmsg$kcm(r4, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) 476.022421ms ago: executing program 1 (id=381): r0 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001940)=@newtaction={0x14, 0x30, 0x10b}, 0x14}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000016"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffedd, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 456.154612ms ago: executing program 0 (id=382): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'macvlan1\x00', 0x0}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r3}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r4, 0x0, 0xa55c}, 0x18) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ipvlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000001000030500000000fddbdf0000000000", @ANYRES32=0x0, @ANYBLOB="02880100373004002000128008000100687372001400028008000100", @ANYRES32=r1, @ANYBLOB="08000200", @ANYRES32=r5], 0x40}}, 0x4008054) 428.360612ms ago: executing program 3 (id=383): bpf$PROG_LOAD(0x5, 0x0, 0x0) open$dir(&(0x7f0000000080)='./bus\x00', 0x224801, 0x80) socket$nl_netfilter(0x10, 0x3, 0xc) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x4000, &(0x7f0000000c00)={[{@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@nombcache}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x4}}, {@mblk_io_submit}, {@resuid}, {@norecovery}]}, 0x8, 0x445, &(0x7f0000001dc0)="$eJzs28tvG0UYAPBv105KX8RU5dEHECiIikfSpKX0wAEQSBxAQoJDOYYkrUrdBjVBolUFBaFyRJW4I45I/AWc4IKAExJX4IwqVSiXFk5Ga+82jmunSbDrEP9+0tYzu+POfJ4de3YnG8DAGs3+SSJ2RMRvETHSyC4vMNp4ubF4cfrvxYvTSdRqb/6V1MtdX7w4XRQt3re9yJQj0k+T2Nem3vnzF05PVauz5/L8+MKZ98bnz1945tSZqZOzJ2fPTh47duTwxHNHJ5/tSpxZXNf3fji3f8+rb195ffr4lXd++iYp4m+Jo0tG2+4tN14er9W6XF1/7WxKJ+U+NoQ1KeWn5FB9/I9EKZY6byRe+aSvjQN6qlar1e7rfPhSDdjEkuh3C4D+KH7os+vfYrtDU48N4dqLjQugLO4b+dY4Uo40LzPUcn3bTaMRcfzSP19mW7Teh9jao0oBgIH2XTb/ebrd/C+N5vtCd+drKJWIuCcidkXE0YjYHRH3RtTL3h8RD6yx/tZFklvnn+nVdQW2Stn87/l8bWv5/K+Y/UWllOd21uMfSk6cqs4eyj+TgzG0JctPrFDH9y//+nmnY83zv2zL6i/mgnk7rpa3LH/PzNTC1H+Judm1jyP2ltvFn9xcCUgiYk9EvLDOOk49+fX+Tsc6xD+8qv+4C+tMta8inmj0/6Voib+QrLw+OX5XVGcPjRdnxa1+/uXyG53qv33/91bW/9vanv9F/H9Ukub12vm113H59886XlOu9/wfTt5atu+DqYWFcxMRw8lr9Xylef9kS7nJpfJZ/AcPtB//u2Lpk9gXEdlJ/GBEPBQRD+dtfyQiHo2IAyvE/+NLj727/vh7K4t/ZsX+j5b+X0oMR+ue9onS6R++XVZpZS3xZ/1/pJ46mO9Zzfffatq1vrMZAAAA/n/SiNgRSTp2M52mY2ONv+HfHdvS6tz8wlMn5t4/O9N4RqASQ2lxp2uk6X7oRH5ZX+QnW/KH8/vGX5S21vNj03PVmX4HDwNue4fxn/mz1O/WAT3neS0YXMY/DC7jHwaX8Q+Dq8349+gZDIh2v/8f9aEdwJ3XMv5XXPYzMYDNxfU/DC7jHwaX8Q8DaX5r3P4h+c2RSCNiAzRjsyQi3RDNkOhRot/fTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN3xbwAAAP//ynflmQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./bus\x00', 0x1c5042, 0x12) write(r1, &(0x7f00000009c0)="3bf58d7d45d32cfe1da7c797b82f", 0xe) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7fffeffd) 344.789754ms ago: executing program 0 (id=384): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x3}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000e00000850000001b000000b700000000fa000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00', r2}, 0x18) syz_usb_disconnect(0xffffffffffffffff) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000180)=0x4000000) pwritev(r0, 0x0, 0x0, 0x73a, 0x1) 312.854285ms ago: executing program 4 (id=385): r0 = getpgrp(0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="070000000400000008020000d9"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r3}, 0x18) r4 = getpgrp(0x0) r5 = syz_pidfd_open(r4, 0x0) fsetxattr$trusted_overlay_nlink(r5, &(0x7f00000018c0), 0x0, 0x0, 0x3) fsetxattr$trusted_overlay_nlink(r1, &(0x7f00000018c0), 0x0, 0x0, 0x3) 181.720227ms ago: executing program 1 (id=386): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x402) r1 = socket$unix(0x1, 0x5, 0x0) connect$unix(r1, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18080000000000000000000000000002850000000f000000850000002a00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) accept(r0, 0x0, 0x0) 181.240137ms ago: executing program 4 (id=387): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) unshare(0x28040680) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = accept4(r0, 0x0, 0x0, 0x0) sendto(r2, &(0x7f0000000000)="00c881d7", 0x4, 0x0, 0x0, 0x0) recvfrom(r1, &(0x7f00000001c0)=""/62, 0x3e, 0x10120, 0x0, 0x0) 151.857968ms ago: executing program 1 (id=388): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=ANY=[@ANYRES64, @ANYRES32=0x0, @ANYBLOB="00000000000000005000128009000100766c616e0000000040000280060001000000000004000480280003800c00010040000000060000000c000100ff04000000000000d8fd010006"], 0x8c}, 0x1, 0xba01, 0x0, 0x4004001}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x2, 0x0, &(0x7f0000000100)="e0b9", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$inet6(0xa, 0x3, 0x3c) setsockopt$inet6_IPV6_RTHDR(r1, 0x29, 0x39, &(0x7f0000001640)=ANY=[@ANYBLOB="0002020100000008ff"], 0x18) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0xfffffffe, @local, 0x4}, 0x1c) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000100)="88", 0xfdef}], 0x1) 127.239088ms ago: executing program 1 (id=389): r0 = socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r3}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x439, 0x70bd2a, 0x25dbdbfd, {0x0, 0x0, 0xe403, 0x0, 0x3, 0x610c0}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @private=0xa010100}, @IFLA_IPTUN_6RD_RELAY_PREFIXLEN={0x6, 0xe, 0x4d3}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8080}, 0x4008040) 22.05127ms ago: executing program 1 (id=390): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0xb76e}, 0x100002, 0x0, 0xfffffffc, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x800, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200a}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r3}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0xf8, 0x30, 0xffff, 0xfffffffe, 0x0, {}, [{0xe4, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x2, 0x5, 0x0, 0x3, 0x1000, {0x0, 0x2, 0x0, 0x0, 0x5}, {0x2, 0x0, 0xff, 0x0, 0x2}}}]]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0xfffffff7}}]}, {0x4}, {0xc}, {0xc}}}, @m_bpf={0x2c, 0x3, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xf8}}, 0x0) 0s ago: executing program 1 (id=391): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1, 0x12}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) unshare(0x2c020400) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x18, 0x1b, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000005000000000000000200000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000ff0300007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001080000850000008200000018110000", @ANYRES32=r2, @ANYBLOB="00000000000000008500000075000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r3}, 0x10) preadv(r4, 0x0, 0x0, 0xc002a0, 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.98' (ED25519) to the list of known hosts. [ 33.631399][ T29] audit: type=1400 audit(1758234758.852:62): avc: denied { mounton } for pid=3295 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.632620][ T3295] cgroup: Unknown subsys name 'net' [ 33.654672][ T29] audit: type=1400 audit(1758234758.852:63): avc: denied { mount } for pid=3295 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.682133][ T29] audit: type=1400 audit(1758234758.892:64): avc: denied { unmount } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.855897][ T3295] cgroup: Unknown subsys name 'cpuset' [ 33.862298][ T3295] cgroup: Unknown subsys name 'rlimit' [ 33.983580][ T29] audit: type=1400 audit(1758234759.202:65): avc: denied { setattr } for pid=3295 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.007699][ T29] audit: type=1400 audit(1758234759.202:66): avc: denied { create } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.028334][ T29] audit: type=1400 audit(1758234759.202:67): avc: denied { write } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.048757][ T29] audit: type=1400 audit(1758234759.212:68): avc: denied { read } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.057769][ T3297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 34.069051][ T29] audit: type=1400 audit(1758234759.212:69): avc: denied { mounton } for pid=3295 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 34.102456][ T29] audit: type=1400 audit(1758234759.212:70): avc: denied { mount } for pid=3295 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 34.125782][ T29] audit: type=1400 audit(1758234759.312:71): avc: denied { relabelto } for pid=3297 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.161186][ T3295] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 35.307860][ T3304] chnl_net:caif_netlink_parms(): no params data found [ 35.377663][ T3304] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.384791][ T3304] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.392087][ T3304] bridge_slave_0: entered allmulticast mode [ 35.398748][ T3304] bridge_slave_0: entered promiscuous mode [ 35.405666][ T3304] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.412739][ T3304] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.419948][ T3304] bridge_slave_1: entered allmulticast mode [ 35.426562][ T3304] bridge_slave_1: entered promiscuous mode [ 35.478026][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 35.497028][ T3304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.509298][ T3304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.540638][ T3305] chnl_net:caif_netlink_parms(): no params data found [ 35.564046][ T3311] chnl_net:caif_netlink_parms(): no params data found [ 35.578693][ T3310] chnl_net:caif_netlink_parms(): no params data found [ 35.587952][ T3304] team0: Port device team_slave_0 added [ 35.617954][ T3304] team0: Port device team_slave_1 added [ 35.678171][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.685197][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 35.711375][ T3304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.734668][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.741798][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.749013][ T3307] bridge_slave_0: entered allmulticast mode [ 35.755561][ T3307] bridge_slave_0: entered promiscuous mode [ 35.762107][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.769160][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 35.795305][ T3304] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.817711][ T3310] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.824813][ T3310] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.832210][ T3310] bridge_slave_0: entered allmulticast mode [ 35.838702][ T3310] bridge_slave_0: entered promiscuous mode [ 35.845563][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.852657][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.860256][ T3307] bridge_slave_1: entered allmulticast mode [ 35.866755][ T3307] bridge_slave_1: entered promiscuous mode [ 35.880779][ T3311] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.887948][ T3311] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.895296][ T3311] bridge_slave_0: entered allmulticast mode [ 35.901683][ T3311] bridge_slave_0: entered promiscuous mode [ 35.908390][ T3305] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.915600][ T3305] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.922802][ T3305] bridge_slave_0: entered allmulticast mode [ 35.929395][ T3305] bridge_slave_0: entered promiscuous mode [ 35.935920][ T3310] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.942992][ T3310] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.950215][ T3310] bridge_slave_1: entered allmulticast mode [ 35.956801][ T3310] bridge_slave_1: entered promiscuous mode [ 35.968856][ T3311] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.976069][ T3311] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.983308][ T3311] bridge_slave_1: entered allmulticast mode [ 35.989784][ T3311] bridge_slave_1: entered promiscuous mode [ 36.000939][ T3305] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.008068][ T3305] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.015480][ T3305] bridge_slave_1: entered allmulticast mode [ 36.021840][ T3305] bridge_slave_1: entered promiscuous mode [ 36.039846][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.064466][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.074780][ T3310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.090042][ T3311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.114365][ T3310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.129480][ T3311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.140688][ T3304] hsr_slave_0: entered promiscuous mode [ 36.146737][ T3304] hsr_slave_1: entered promiscuous mode [ 36.153883][ T3305] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.174429][ T3307] team0: Port device team_slave_0 added [ 36.192552][ T3305] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.202510][ T3310] team0: Port device team_slave_0 added [ 36.209293][ T3310] team0: Port device team_slave_1 added [ 36.215553][ T3307] team0: Port device team_slave_1 added [ 36.222064][ T3311] team0: Port device team_slave_0 added [ 36.228720][ T3311] team0: Port device team_slave_1 added [ 36.270845][ T3305] team0: Port device team_slave_0 added [ 36.276989][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.283961][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.309976][ T3310] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.336269][ T3305] team0: Port device team_slave_1 added [ 36.350249][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.357319][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.383265][ T3310] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.398792][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.406037][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.431981][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.443135][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.450184][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.476107][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.487071][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.494018][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.519938][ T3311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.544460][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.551474][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.577404][ T3305] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.590692][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.597723][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.623679][ T3305] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.634788][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.641789][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.667934][ T3311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.715763][ T3310] hsr_slave_0: entered promiscuous mode [ 36.721810][ T3310] hsr_slave_1: entered promiscuous mode [ 36.727786][ T3310] debugfs: 'hsr0' already exists in 'hsr' [ 36.733520][ T3310] Cannot create hsr debugfs directory [ 36.749015][ T3311] hsr_slave_0: entered promiscuous mode [ 36.755185][ T3311] hsr_slave_1: entered promiscuous mode [ 36.761059][ T3311] debugfs: 'hsr0' already exists in 'hsr' [ 36.766855][ T3311] Cannot create hsr debugfs directory [ 36.801166][ T3307] hsr_slave_0: entered promiscuous mode [ 36.807393][ T3307] hsr_slave_1: entered promiscuous mode [ 36.813336][ T3307] debugfs: 'hsr0' already exists in 'hsr' [ 36.819230][ T3307] Cannot create hsr debugfs directory [ 36.827765][ T3305] hsr_slave_0: entered promiscuous mode [ 36.833940][ T3305] hsr_slave_1: entered promiscuous mode [ 36.840169][ T3305] debugfs: 'hsr0' already exists in 'hsr' [ 36.845948][ T3305] Cannot create hsr debugfs directory [ 36.989711][ T3304] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 37.000835][ T3304] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 37.022737][ T3304] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 37.041310][ T3304] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 37.085899][ T3310] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 37.097517][ T3310] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 37.113608][ T3310] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 37.123472][ T3310] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 37.146941][ T3307] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 37.156433][ T3307] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 37.167183][ T3307] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 37.177191][ T3307] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 37.217154][ T3311] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 37.228705][ T3311] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 37.239976][ T3311] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 37.249979][ T3311] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 37.275724][ T3304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.312560][ T3305] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.326409][ T3305] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 37.336152][ T3305] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 37.354266][ T3305] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 37.367387][ T3310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.377696][ T3304] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.396568][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.403683][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.418072][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.443657][ T3310] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.451803][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.458924][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.478557][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.494939][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.502070][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.515799][ T3311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.524815][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.531983][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.541785][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.548882][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.568773][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.576614][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.594764][ T3310] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 37.605314][ T3310] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 37.637965][ T3311] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.654429][ T3305] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.663227][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.670333][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.683945][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.691055][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.721973][ T3305] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.750002][ T3310] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 37.788008][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.795232][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.804536][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.811733][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.831967][ T3304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 37.858237][ T3311] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 37.883215][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 37.978585][ T3304] veth0_vlan: entered promiscuous mode [ 37.998240][ T3304] veth1_vlan: entered promiscuous mode [ 38.029467][ T3305] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.040513][ T3311] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.068478][ T3304] veth0_macvtap: entered promiscuous mode [ 38.088862][ T3310] veth0_vlan: entered promiscuous mode [ 38.096043][ T3304] veth1_macvtap: entered promiscuous mode [ 38.117393][ T3310] veth1_vlan: entered promiscuous mode [ 38.124483][ T3307] veth0_vlan: entered promiscuous mode [ 38.139901][ T3310] veth0_macvtap: entered promiscuous mode [ 38.149634][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.167872][ T3307] veth1_vlan: entered promiscuous mode [ 38.176667][ T3310] veth1_macvtap: entered promiscuous mode [ 38.193654][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.202334][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.216827][ T2309] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.229181][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.236545][ T2309] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.265808][ T31] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.281291][ T3305] veth0_vlan: entered promiscuous mode [ 38.297264][ T31] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.322032][ T3307] veth0_macvtap: entered promiscuous mode [ 38.333793][ T31] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.345677][ T3305] veth1_vlan: entered promiscuous mode [ 38.376649][ T3307] veth1_macvtap: entered promiscuous mode [ 38.383366][ T37] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.392725][ T37] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.406517][ T3310] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 38.413350][ T3311] veth0_vlan: entered promiscuous mode [ 38.428845][ T3305] veth0_macvtap: entered promiscuous mode [ 38.435803][ T37] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.455561][ T3311] veth1_vlan: entered promiscuous mode [ 38.471461][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.479719][ T3305] veth1_macvtap: entered promiscuous mode [ 38.497782][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.510571][ T3311] veth0_macvtap: entered promiscuous mode [ 38.538079][ T3311] veth1_macvtap: entered promiscuous mode [ 38.546214][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.556627][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.565113][ T51] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.576648][ T3478] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 38.581522][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.605938][ T51] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.617644][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.639838][ T29] kauditd_printk_skb: 33 callbacks suppressed [ 38.639854][ T29] audit: type=1400 audit(1758234763.862:105): avc: denied { bind } for pid=3477 comm="syz.1.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 38.668387][ T51] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.688239][ T29] audit: type=1400 audit(1758234763.912:106): avc: denied { map_create } for pid=3479 comm="syz.3.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 38.713137][ T51] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.737481][ T3480] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6'. [ 38.746243][ T3480] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6'. [ 38.767483][ T51] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.787614][ T37] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.797664][ T29] audit: type=1400 audit(1758234763.982:107): avc: denied { map_read map_write } for pid=3483 comm="syz.1.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 38.819990][ T37] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.847313][ T37] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.874635][ T37] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.895231][ T29] audit: type=1400 audit(1758234764.122:108): avc: denied { open } for pid=3487 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 38.914204][ T3485] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6'. [ 38.923116][ T3485] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6'. [ 38.939883][ T29] audit: type=1400 audit(1758234764.122:109): avc: denied { kernel } for pid=3487 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 38.974243][ T37] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.003804][ T37] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.013030][ T29] audit: type=1400 audit(1758234764.182:110): avc: denied { write } for pid=3487 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 39.032119][ T29] audit: type=1400 audit(1758234764.202:111): avc: denied { execute } for pid=3491 comm="syz.2.3" path="/0/cpu.stat" dev="tmpfs" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 39.037917][ T3495] loop1: detected capacity change from 0 to 512 [ 39.054558][ T29] audit: type=1326 audit(1758234764.212:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3493 comm="syz.1.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe13c47eba9 code=0x7ffc0000 [ 39.084059][ T29] audit: type=1326 audit(1758234764.212:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3493 comm="syz.1.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe13c47eba9 code=0x7ffc0000 [ 39.096124][ T37] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.107241][ T29] audit: type=1326 audit(1758234764.212:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3493 comm="syz.1.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe13c47eba9 code=0x7ffc0000 [ 39.118007][ T3495] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 39.152143][ T3495] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 39.162352][ T3499] openvswitch: netlink: Message has 6 unknown bytes. [ 39.220612][ T3505] loop2: detected capacity change from 0 to 128 [ 39.263664][ T3495] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2848: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 39.279210][ T3495] EXT4-fs (loop1): 1 truncate cleaned up [ 39.285836][ T3495] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.306491][ T3505] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 39.314467][ T3505] FAT-fs (loop2): Filesystem has been set read-only [ 39.354392][ T3505] syz.2.12: attempt to access beyond end of device [ 39.354392][ T3505] loop2: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 39.370530][ T3505] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 39.378477][ T3505] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 39.400559][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.409263][ T3525] syz.2.12: attempt to access beyond end of device [ 39.409263][ T3525] loop2: rw=0, sector=2065, nr_sectors = 1 limit=128 [ 39.422791][ T3525] Buffer I/O error on dev loop2, logical block 2065, async page read [ 39.435105][ T3525] syz.2.12: attempt to access beyond end of device [ 39.435105][ T3525] loop2: rw=0, sector=2066, nr_sectors = 1 limit=128 [ 39.448385][ T3525] Buffer I/O error on dev loop2, logical block 2066, async page read [ 39.457951][ T3531] Zero length message leads to an empty skb [ 39.474413][ T3525] syz.2.12: attempt to access beyond end of device [ 39.474413][ T3525] loop2: rw=0, sector=2067, nr_sectors = 1 limit=128 [ 39.487599][ T3525] Buffer I/O error on dev loop2, logical block 2067, async page read [ 39.499250][ T3525] syz.2.12: attempt to access beyond end of device [ 39.499250][ T3525] loop2: rw=0, sector=2068, nr_sectors = 1 limit=128 [ 39.512469][ T3525] Buffer I/O error on dev loop2, logical block 2068, async page read [ 39.522415][ T3525] syz.2.12: attempt to access beyond end of device [ 39.522415][ T3525] loop2: rw=0, sector=2069, nr_sectors = 1 limit=128 [ 39.535669][ T3525] Buffer I/O error on dev loop2, logical block 2069, async page read [ 39.545339][ T3525] syz.2.12: attempt to access beyond end of device [ 39.545339][ T3525] loop2: rw=0, sector=2070, nr_sectors = 1 limit=128 [ 39.558466][ T3525] Buffer I/O error on dev loop2, logical block 2070, async page read [ 39.568510][ T3525] syz.2.12: attempt to access beyond end of device [ 39.568510][ T3525] loop2: rw=0, sector=2071, nr_sectors = 1 limit=128 [ 39.581676][ T3525] Buffer I/O error on dev loop2, logical block 2071, async page read [ 39.595983][ T3525] syz.2.12: attempt to access beyond end of device [ 39.595983][ T3525] loop2: rw=0, sector=2072, nr_sectors = 1 limit=128 [ 39.609171][ T3525] Buffer I/O error on dev loop2, logical block 2072, async page read [ 39.617613][ T3525] syz.2.12: attempt to access beyond end of device [ 39.617613][ T3525] loop2: rw=0, sector=2065, nr_sectors = 1 limit=128 [ 39.630699][ T3525] Buffer I/O error on dev loop2, logical block 2065, async page read [ 39.639263][ T3525] Buffer I/O error on dev loop2, logical block 2066, async page read [ 39.724612][ T3553] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19'. [ 39.738684][ T3553] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.752242][ T3553] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 40.195022][ T3633] loop0: detected capacity change from 0 to 512 [ 40.226115][ T3633] ======================================================= [ 40.226115][ T3633] WARNING: The mand mount option has been deprecated and [ 40.226115][ T3633] and is ignored by this kernel. Remove the mand [ 40.226115][ T3633] option from the mount to silence this warning. [ 40.226115][ T3633] ======================================================= [ 40.295206][ T3633] EXT4-fs (loop0): orphan cleanup on readonly fs [ 40.322292][ T3633] EXT4-fs error (device loop0): ext4_orphan_get:1418: comm syz.0.22: bad orphan inode 13 [ 40.349508][ T3633] ext4_test_bit(bit=12, block=18) = 1 [ 40.355039][ T3633] is_bad_inode(inode)=0 [ 40.359218][ T3633] NEXT_ORPHAN(inode)=2130706432 [ 40.364161][ T3633] max_ino=32 [ 40.367458][ T3633] i_nlink=1 [ 40.383932][ T3633] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 40.407858][ T3633] EXT4-fs (loop0): warning: mounting fs with errors, running e2fsck is recommended [ 40.428593][ T3633] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.22: bg 0: block 248: padding at end of block bitmap is not set [ 40.459196][ T3655] netlink: 'syz.2.25': attribute type 10 has an invalid length. [ 40.471806][ T3655] team0: Port device dummy0 added [ 40.472862][ T3633] EXT4-fs error (device loop0): ext4_acquire_dquot:6937: comm syz.0.22: Failed to acquire dquot type 1 [ 40.490325][ T3633] EXT4-fs warning (device loop0): ext4_enable_quotas:7172: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 40.507177][ T3655] netlink: 'syz.2.25': attribute type 10 has an invalid length. [ 40.516087][ T3655] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 40.529073][ T3655] team0: Failed to send options change via netlink (err -105) [ 40.550238][ T3633] syz.0.22 (3633) used greatest stack depth: 9248 bytes left [ 40.561046][ T3655] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 40.575561][ T3655] team0: Port device dummy0 removed [ 40.588055][ T3305] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.592945][ T3655] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 40.694599][ T3670] SELinux: Context system_u:object_r:fsadm_exec_t:s0 is not valid (left unmapped). [ 40.762670][ T3674] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.891823][ T3685] loop0: detected capacity change from 0 to 8192 [ 40.937657][ T3685] loop0: p1 p2 < > p3 p4 < p5 > [ 40.942649][ T3685] loop0: partition table partially beyond EOD, truncated [ 40.955701][ T3685] loop0: p1 size 100663296 extends beyond EOD, truncated [ 40.971363][ T3674] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.985658][ T3685] loop0: p2 start 591104 is beyond EOD, truncated [ 40.992126][ T3685] loop0: p3 start 33572980 is beyond EOD, truncated [ 41.009606][ T3685] loop0: p5 size 100663296 extends beyond EOD, truncated [ 41.084758][ T3693] netlink: 96 bytes leftover after parsing attributes in process `syz.2.37'. [ 41.115043][ T3696] syz_tun: entered allmulticast mode [ 41.122507][ T3697] loop3: detected capacity change from 0 to 128 [ 41.138738][ T3674] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.166803][ T3695] syz_tun: left allmulticast mode [ 41.193261][ T3674] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.234196][ T3699] netlink: 'syz.2.39': attribute type 1 has an invalid length. [ 41.242030][ T3699] netlink: 198116 bytes leftover after parsing attributes in process `syz.2.39'. [ 41.262490][ T3506] udevd[3506]: inotify_add_watch(7, /dev/loop0p5, 10) failed: No such file or directory [ 41.267326][ T3298] udevd[3298]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 41.278925][ T3291] udevd[3291]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 41.313887][ T57] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.326249][ T57] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.365227][ T57] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.372612][ T3706] loop0: detected capacity change from 0 to 2048 [ 41.387072][ T57] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.405680][ T3291] loop0: p4 < > [ 41.410300][ T3708] ref_ctr increment failed for inode: 0x41 offset: 0xb ref_ctr_offset: 0x82 of mm: 0xffff88810c1f2e00 [ 41.422473][ T3706] loop0: p4 < > [ 41.430782][ T3707] uprobe: syz.2.43:3707 failed to unregister, leaking uprobe [ 41.479044][ T3291] udevd[3291]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 41.851349][ T3746] loop0: detected capacity change from 0 to 2048 [ 41.906414][ T3291] loop0: p1 < > p4 [ 41.911181][ T3291] loop0: p4 size 8388608 extends beyond EOD, truncated [ 41.922427][ T3746] loop0: p1 < > p4 [ 41.932483][ T3746] loop0: p4 size 8388608 extends beyond EOD, truncated [ 41.975570][ T3756] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 37748736, id = 0 [ 42.067867][ T3508] udevd[3508]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 42.078544][ T3291] udevd[3291]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 42.122340][ T3508] udevd[3508]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 42.133977][ T3291] udevd[3291]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 42.251673][ T3773] loop4: detected capacity change from 0 to 2048 [ 42.273680][ T3776] loop1: detected capacity change from 0 to 1024 [ 42.317931][ T3776] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.378831][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.389890][ T3787] Driver unsupported XDP return value 0 on prog (id 64) dev N/A, expect packet loss! [ 42.488253][ T3797] loop2: detected capacity change from 0 to 7 [ 42.504472][ T3799] netlink: 96 bytes leftover after parsing attributes in process `syz.4.80'. [ 42.602171][ T3806] capability: warning: `syz.4.82' uses deprecated v2 capabilities in a way that may be insecure [ 42.881931][ T3815] bridge_slave_0: left allmulticast mode [ 42.887906][ T3815] bridge_slave_0: left promiscuous mode [ 42.893644][ T3815] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.912401][ T3820] netlink: 'syz.4.85': attribute type 10 has an invalid length. [ 42.920378][ T3820] netlink: 40 bytes leftover after parsing attributes in process `syz.4.85'. [ 43.000699][ T3815] bridge_slave_1: left allmulticast mode [ 43.006656][ T3815] bridge_slave_1: left promiscuous mode [ 43.012354][ T3815] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.096376][ T3815] bond0: (slave bond_slave_0): Releasing backup interface [ 43.190072][ T3815] bond0: (slave bond_slave_1): Releasing backup interface [ 43.241612][ T3815] team0: Port device team_slave_0 removed [ 43.250995][ T3815] team0: Port device team_slave_1 removed [ 43.261343][ T3815] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 43.268892][ T3815] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 43.359254][ T3815] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 43.366711][ T3815] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 43.420073][ T3820] batman_adv: batadv0: Adding interface: veth1_vlan [ 43.426800][ T3820] batman_adv: batadv0: The MTU of interface veth1_vlan is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 43.473366][ T3820] batman_adv: batadv0: Interface activated: veth1_vlan [ 43.496741][ T3833] -1: renamed from syzkaller0 [ 43.506635][ T3838] netlink: 96 bytes leftover after parsing attributes in process `syz.0.91'. [ 43.602434][ T3846] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 43.695255][ C0] hrtimer: interrupt took 49723 ns [ 43.756400][ T3851] netlink: 8 bytes leftover after parsing attributes in process `syz.1.98'. [ 43.820086][ T29] kauditd_printk_skb: 206 callbacks suppressed [ 43.820101][ T29] audit: type=1400 audit(1758234769.042:319): avc: denied { connect } for pid=3856 comm="syz.3.100" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 43.924097][ T29] audit: type=1400 audit(1758234769.142:320): avc: denied { firmware_load } for pid=3850 comm="syz.1.98" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 44.058835][ T29] audit: type=1400 audit(1758234769.282:321): avc: denied { read write } for pid=3872 comm="syz.4.106" name="ppp" dev="devtmpfs" ino=140 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 44.082067][ T29] audit: type=1400 audit(1758234769.282:322): avc: denied { open } for pid=3872 comm="syz.4.106" path="/dev/ppp" dev="devtmpfs" ino=140 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 44.114058][ T3877] netlink: 64985 bytes leftover after parsing attributes in process `syz.2.108'. [ 44.137712][ T3877] loop2: detected capacity change from 0 to 128 [ 44.157230][ T29] audit: type=1400 audit(1758234769.332:323): avc: denied { ioctl } for pid=3872 comm="syz.4.106" path="/dev/ppp" dev="devtmpfs" ino=140 ioctlcmd=0x7451 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 44.254800][ T29] audit: type=1400 audit(1758234769.472:324): avc: denied { connect } for pid=3880 comm="syz.3.110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 44.274382][ T29] audit: type=1400 audit(1758234769.472:325): avc: denied { write } for pid=3880 comm="syz.3.110" path="socket:[6207]" dev="sockfs" ino=6207 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 44.354253][ T3885] syzkaller0: entered promiscuous mode [ 44.359896][ T3885] syzkaller0: entered allmulticast mode [ 44.407482][ T29] audit: type=1400 audit(1758234769.622:326): avc: denied { bind } for pid=3886 comm="syz.3.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 44.426750][ T29] audit: type=1400 audit(1758234769.622:327): avc: denied { node_bind } for pid=3886 comm="syz.3.113" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 44.517401][ T29] audit: type=1400 audit(1758234769.672:328): avc: denied { write } for pid=3890 comm="syz.3.115" name="ip_vs" dev="proc" ino=4026532448 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 44.528399][ T3895] mmap: syz.0.117 (3895) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 44.643658][ T3904] wireguard0: entered promiscuous mode [ 44.649450][ T3904] wireguard0: entered allmulticast mode [ 44.724485][ T3919] netlink: 'syz.0.127': attribute type 1 has an invalid length. [ 44.845229][ T3924] loop1: detected capacity change from 0 to 2048 [ 44.859752][ T3924] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.879786][ T3934] EXT4-fs error (device loop1): __ext4_new_inode:1073: comm syz.1.130: reserved inode found cleared - inode=1 [ 44.913706][ T3935] loop3: detected capacity change from 0 to 1024 [ 44.927816][ T3924] EXT4-fs error (device loop1) in ext4_free_inode:361: Corrupt filesystem [ 44.954410][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.964000][ T3935] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 44.977943][ T3935] EXT4-fs error (device loop3): ext4_orphan_get:1392: inode #11: comm syz.3.133: iget: bogus i_mode (1) [ 44.989727][ T3935] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.133: couldn't read orphan inode 11 (err -117) [ 45.002746][ T3935] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.216361][ T3304] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.538725][ T3953] loop0: detected capacity change from 0 to 1024 [ 45.545628][ T3953] EXT4-fs: Ignoring removed bh option [ 45.551863][ T3953] EXT4-fs (loop0): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 45.570557][ T3953] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 45.710433][ T3961] all: renamed from bridge_slave_0 (while UP) [ 45.791255][ T3966] loop4: detected capacity change from 0 to 512 [ 45.807358][ T3966] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 45.837326][ T3968] loop2: detected capacity change from 0 to 764 [ 45.847566][ T3966] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #16: comm syz.4.142: invalid indirect mapped block 4294967295 (level 0) [ 45.862449][ T3966] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #16: comm syz.4.142: invalid indirect mapped block 4294967295 (level 1) [ 45.881444][ T3966] EXT4-fs (loop4): 1 orphan inode deleted [ 45.887290][ T3966] EXT4-fs (loop4): 1 truncate cleaned up [ 45.894261][ T3966] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 45.924296][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.976221][ T3971] loop2: detected capacity change from 0 to 1024 [ 46.033927][ T3971] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 46.043881][ T3979] netlink: 20 bytes leftover after parsing attributes in process `syz.4.147'. [ 46.076683][ T51] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 46.086916][ T51] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 46.095908][ T51] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 46.104475][ T51] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 46.138308][ T3307] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.161545][ T3979] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 46.171660][ T3979] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.190656][ T3982] syz.2.148 uses obsolete (PF_INET,SOCK_PACKET) [ 46.226741][ T3979] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 46.236612][ T3979] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.336990][ T3979] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 46.346848][ T3979] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.536917][ T3979] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 46.546794][ T3979] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.600050][ T3305] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.655557][ T3606] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 46.663814][ T3606] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.700095][ T3606] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 46.708464][ T3606] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.841529][ T3606] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 46.849830][ T3606] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.961792][ T4011] loop4: detected capacity change from 0 to 512 [ 46.974635][ T4012] loop0: detected capacity change from 0 to 1024 [ 46.987081][ T3606] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 46.995445][ T3606] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 47.102173][ T4011] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.112420][ T4012] EXT4-fs: Ignoring removed bh option [ 47.120288][ T4012] EXT4-fs: inline encryption not supported [ 47.216319][ T4011] ext4 filesystem being mounted at /35/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 47.254017][ T4012] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 47.274351][ T4012] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 47.320884][ T4012] EXT4-fs error (device loop0): ext4_map_blocks:778: inode #3: block 2: comm syz.0.158: lblock 2 mapped to illegal pblock 2 (length 1) [ 47.363956][ T4012] EXT4-fs error (device loop0): ext4_map_blocks:778: inode #3: block 48: comm syz.0.158: lblock 0 mapped to illegal pblock 48 (length 1) [ 47.419343][ T4012] EXT4-fs error (device loop0): ext4_acquire_dquot:6937: comm syz.0.158: Failed to acquire dquot type 0 [ 47.573542][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.584077][ T4012] EXT4-fs error (device loop0) in ext4_reserve_inode_write:6334: Corrupt filesystem [ 47.594070][ T4012] EXT4-fs error (device loop0): ext4_evict_inode:254: inode #11: comm syz.0.158: mark_inode_dirty error [ 47.615352][ T4012] EXT4-fs warning (device loop0): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 47.635127][ T4012] EXT4-fs (loop0): 1 orphan inode deleted [ 47.641356][ T4012] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.685748][ T57] EXT4-fs error (device loop0): ext4_map_blocks:778: inode #3: block 1: comm kworker/u8:4: lblock 1 mapped to illegal pblock 1 (length 1) [ 47.728134][ T4022] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.735393][ T4022] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.743576][ T57] EXT4-fs error (device loop0): ext4_release_dquot:6973: comm kworker/u8:4: Failed to release dquot type 0 [ 48.054168][ T4022] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 48.064748][ T4022] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 48.090444][ T3305] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.105709][ T3305] EXT4-fs error (device loop0): __ext4_get_inode_loc:4861: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 48.150355][ T3305] EXT4-fs error (device loop0) in ext4_reserve_inode_write:6334: Corrupt filesystem [ 48.159925][ T57] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.179041][ T57] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.189275][ T3305] EXT4-fs error (device loop0): ext4_quota_off:7221: inode #3: comm syz-executor: mark_inode_dirty error [ 48.217463][ T57] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.243269][ T57] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.437191][ T4037] loop2: detected capacity change from 0 to 1024 [ 48.557600][ T4037] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 48.580171][ T4046] syz_tun: entered allmulticast mode [ 48.632409][ T4048] loop8: detected capacity change from 0 to 16384 [ 48.642265][ T4037] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.168: bg 0: block 494: padding at end of block bitmap is not set [ 48.658847][ T4044] syz_tun: left allmulticast mode [ 48.713234][ T4037] EXT4-fs (loop2): Remounting filesystem read-only [ 48.725874][ T4037] EXT4-fs (loop2): error restoring inline_data for inode -- potential data loss! (inode 15, error -30) [ 48.845911][ T4052] loop8: detected capacity change from 16384 to 16383 [ 48.898123][ T4059] pim6reg1: entered promiscuous mode [ 48.903478][ T4059] pim6reg1: entered allmulticast mode [ 48.959986][ T3307] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.960855][ T29] kauditd_printk_skb: 299 callbacks suppressed [ 48.960872][ T29] audit: type=1400 audit(1758234774.182:625): avc: denied { create } for pid=4062 comm="syz.0.178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 49.084151][ T4069] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4069 comm=syz.3.181 [ 49.139659][ T4071] loop2: detected capacity change from 0 to 1024 [ 49.151774][ T4069] netlink: 'syz.3.181': attribute type 1 has an invalid length. [ 49.176407][ T4071] EXT4-fs: Ignoring removed orlov option [ 49.189237][ T4074] wireguard0: entered promiscuous mode [ 49.194778][ T4074] wireguard0: entered allmulticast mode [ 49.229991][ T4069] bond1: (slave bridge1): making interface the new active one [ 49.257321][ T4069] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 49.268002][ T4071] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.430773][ T29] audit: type=1400 audit(1758234774.652:626): avc: denied { create } for pid=4081 comm="syz.1.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 49.453752][ T4082] @: renamed from vlan0 (while UP) [ 49.498696][ T4087] netlink: 'syz.3.187': attribute type 1 has an invalid length. [ 49.507867][ T29] audit: type=1400 audit(1758234774.672:627): avc: denied { setopt } for pid=4081 comm="syz.1.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 49.527467][ T29] audit: type=1400 audit(1758234774.672:628): avc: denied { ioctl } for pid=4081 comm="syz.1.186" path="socket:[6045]" dev="sockfs" ino=6045 ioctlcmd=0x8923 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 49.535811][ T4087] 8021q: adding VLAN 0 to HW filter on device bond2 [ 49.552019][ T29] audit: type=1326 audit(1758234774.722:629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4089 comm="syz.1.189" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe13c47eba9 code=0x7ffc0000 [ 49.575472][ T4087] netlink: 4 bytes leftover after parsing attributes in process `syz.3.187'. [ 49.582082][ T29] audit: type=1326 audit(1758234774.722:630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4089 comm="syz.1.189" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe13c47eba9 code=0x7ffc0000 [ 49.614103][ T29] audit: type=1326 audit(1758234774.722:631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4089 comm="syz.1.189" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe13c47eba9 code=0x7ffc0000 [ 49.637464][ T29] audit: type=1326 audit(1758234774.722:632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4089 comm="syz.1.189" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe13c47eba9 code=0x7ffc0000 [ 49.660957][ T29] audit: type=1326 audit(1758234774.722:633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4089 comm="syz.1.189" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe13c47eba9 code=0x7ffc0000 [ 49.684270][ T29] audit: type=1326 audit(1758234774.722:634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4089 comm="syz.1.189" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe13c47eba9 code=0x7ffc0000 [ 49.710411][ T4087] bond2 (unregistering): Released all slaves [ 49.807955][ T4103] netlink: 24 bytes leftover after parsing attributes in process `syz.1.194'. [ 49.870956][ T4107] loop3: detected capacity change from 0 to 512 [ 49.881088][ T4107] EXT4-fs (loop3): external journal device major/minor numbers have changed [ 49.917576][ T3307] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.944105][ T4107] EXT4-fs (loop3): failed to open journal device unknown-block(0,4) -6 [ 50.013511][ T4119] loop1: detected capacity change from 0 to 2048 [ 50.057826][ T4119] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 50.529291][ T4169] loop4: detected capacity change from 0 to 512 [ 50.547052][ T4158] usb usb1: usbfs: interface 0 claimed by hub while 'syz.3.213' sets config #0 [ 50.558262][ T4169] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 50.587018][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.590760][ T4165] loop0: detected capacity change from 0 to 8192 [ 50.606914][ T4169] ext4 filesystem being mounted at /48/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 50.645586][ T4173] pim6reg1: entered promiscuous mode [ 50.650989][ T4173] pim6reg1: entered allmulticast mode [ 50.680373][ T4169] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 41 vs 39667 free clusters [ 50.805292][ T4169] EXT4-fs (loop4): Remounting filesystem read-only [ 50.839661][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.914898][ T4186] geneve2: entered promiscuous mode [ 50.920327][ T4186] geneve2: entered allmulticast mode [ 51.036512][ T4192] loop2: detected capacity change from 0 to 1024 [ 51.043563][ T4192] EXT4-fs: Ignoring removed nomblk_io_submit option [ 51.116537][ T4192] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 51.164302][ T4192] System zones: 0-1, 3-36 [ 51.169789][ T4192] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 51.254722][ T3307] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.325159][ T4208] process 'syz.2.233' launched '/dev/fd/6' with NULL argv: empty string added [ 51.511833][ T4216] netlink: 'syz.0.236': attribute type 1 has an invalid length. [ 51.532884][ T4216] bond1: entered promiscuous mode [ 51.541601][ T4216] 8021q: adding VLAN 0 to HW filter on device bond1 [ 51.561005][ T4216] netlink: 3 bytes leftover after parsing attributes in process `syz.0.236'. [ 51.586636][ T4216] batadv1: entered promiscuous mode [ 51.591903][ T4216] batadv1: entered allmulticast mode [ 51.627874][ T4218] netlink: 3 bytes leftover after parsing attributes in process `syz.0.236'. [ 51.664241][ T4216] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 51.673123][ T4216] bond1: (slave batadv1): making interface the new active one [ 51.681595][ T4216] bond1: (slave batadv1): Enslaving as an active interface with an up link [ 51.713251][ T4218] batadv2: entered promiscuous mode [ 51.718612][ T4218] batadv2: entered allmulticast mode [ 51.763970][ T4218] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 51.796307][ T4218] bond1: (slave batadv2): Enslaving as an active interface with an up link [ 51.824697][ T4226] netlink: 20 bytes leftover after parsing attributes in process `syz.2.239'. [ 51.885539][ T4230] tipc: Started in network mode [ 51.890596][ T4230] tipc: Node identity ac14140f, cluster identity 4711 [ 51.900512][ T4230] tipc: New replicast peer: 255.255.255.255 [ 51.906795][ T4230] tipc: Enabled bearer , priority 10 [ 51.914623][ T4228] syz.3.242 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 52.324895][ T4256] loop3: detected capacity change from 0 to 1024 [ 52.377751][ T4256] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.421997][ T4256] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:4183: comm syz.3.253: Allocating blocks 449-513 which overlap fs metadata [ 52.509144][ T4255] EXT4-fs (loop3): pa ffff88810071a230: logic 48, phys. 177, len 21 [ 52.517251][ T4255] EXT4-fs error (device loop3): ext4_mb_release_inode_pa:5434: group 0, free 0, pa_free 4 [ 52.758734][ T3304] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.888337][ T4266] netlink: 96 bytes leftover after parsing attributes in process `syz.1.256'. [ 53.035265][ T3386] tipc: Node number set to 2886997007 [ 53.063279][ T4268] netlink: 96 bytes leftover after parsing attributes in process `syz.1.257'. [ 53.143933][ T4278] SELinux: security_context_str_to_sid (ض) failed with errno=-22 [ 53.184698][ T3386] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 53.224106][ T3386] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 53.441593][ T4274] Set syz1 is full, maxelem 65536 reached [ 53.515326][ T4294] hub 1-0:1.0: USB hub found [ 53.535460][ T4294] hub 1-0:1.0: 8 ports detected [ 53.743912][ T4319] loop1: detected capacity change from 0 to 512 [ 53.774493][ T4319] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 53.804209][ T4319] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8042c118, mo2=0002] [ 53.824084][ T4319] EXT4-fs error (device loop1): ext4_iget_extra_inode:5104: inode #15: comm syz.1.278: corrupted in-inode xattr: e_value size too large [ 53.845320][ T4319] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.278: couldn't read orphan inode 15 (err -117) [ 53.867410][ T4319] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 53.922795][ T4319] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 53.943501][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.960366][ T4330] bridge_slave_0: left allmulticast mode [ 53.966326][ T4330] bridge_slave_0: left promiscuous mode [ 53.972026][ T4330] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.982263][ T4330] bridge_slave_1: left allmulticast mode [ 53.988025][ T4330] bridge_slave_1: left promiscuous mode [ 53.993788][ T4330] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.010617][ T4330] bond0: (slave bond_slave_0): Releasing backup interface [ 54.020464][ T4330] bond0: (slave bond_slave_1): Releasing backup interface [ 54.033474][ T4330] team0: Port device team_slave_0 removed [ 54.044832][ T4330] team0: Port device team_slave_1 removed [ 54.051872][ T4330] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 54.059430][ T4330] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 54.068450][ T4330] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 54.076046][ T4330] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 54.096772][ T4330] bond1: (slave bridge1): Releasing active interface [ 54.108016][ T4334] wg2: entered promiscuous mode [ 54.112936][ T4334] wg2: entered allmulticast mode [ 54.134061][ T4335] pim6reg1: entered promiscuous mode [ 54.139507][ T4335] pim6reg1: entered allmulticast mode [ 54.192540][ T29] kauditd_printk_skb: 77 callbacks suppressed [ 54.192556][ T29] audit: type=1400 audit(1758234779.412:710): avc: denied { listen } for pid=4340 comm="syz.1.286" lport=49673 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 54.242545][ T29] audit: type=1326 audit(1758234779.452:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4342 comm="syz.3.287" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3700baeba9 code=0x7ffc0000 [ 54.265874][ T29] audit: type=1326 audit(1758234779.452:712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4342 comm="syz.3.287" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3700baeba9 code=0x7ffc0000 [ 54.289293][ T29] audit: type=1326 audit(1758234779.452:713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4342 comm="syz.3.287" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3700baeba9 code=0x7ffc0000 [ 54.312715][ T29] audit: type=1326 audit(1758234779.452:714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4342 comm="syz.3.287" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3700baeba9 code=0x7ffc0000 [ 54.336018][ T29] audit: type=1326 audit(1758234779.452:715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4342 comm="syz.3.287" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3700baeba9 code=0x7ffc0000 [ 54.359393][ T29] audit: type=1326 audit(1758234779.452:716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4342 comm="syz.3.287" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3700baeba9 code=0x7ffc0000 [ 54.382772][ T29] audit: type=1326 audit(1758234779.462:717): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4342 comm="syz.3.287" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3700baeba9 code=0x7ffc0000 [ 54.406027][ T29] audit: type=1326 audit(1758234779.462:718): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4342 comm="syz.3.287" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3700baeba9 code=0x7ffc0000 [ 54.429282][ T29] audit: type=1326 audit(1758234779.462:719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4342 comm="syz.3.287" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3700baeba9 code=0x7ffc0000 [ 54.604056][ T4371] loop1: detected capacity change from 0 to 512 [ 54.613524][ T4369] loop4: detected capacity change from 0 to 2048 [ 54.636352][ T4371] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 54.667755][ T4369] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 54.808290][ T4385] netlink: 'syz.2.302': attribute type 30 has an invalid length. [ 54.847097][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 54.886522][ T4388] loop4: detected capacity change from 0 to 2048 [ 54.911868][ T4388] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 54.932874][ T4388] ext4 filesystem being mounted at /72/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 54.983651][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.029660][ T4395] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=4395 comm=syz.4.305 [ 55.042206][ T4395] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=4395 comm=syz.4.305 [ 55.129917][ T4402] vlan2: entered allmulticast mode [ 55.135574][ T4402] dummy0: entered allmulticast mode [ 55.197055][ T4410] loop4: detected capacity change from 0 to 512 [ 55.232362][ T4410] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 55.268496][ T4420] netlink: 8 bytes leftover after parsing attributes in process `syz.2.315'. [ 55.272834][ T4410] ext4 filesystem being mounted at /76/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 55.424381][ T4426] bridge_slave_0: left allmulticast mode [ 55.430232][ T4426] bridge_slave_0: left promiscuous mode [ 55.435944][ T4426] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.448422][ T4426] bridge_slave_1: left allmulticast mode [ 55.454131][ T4426] bridge_slave_1: left promiscuous mode [ 55.459947][ T4426] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.475188][ T4426] bond0: (slave bond_slave_0): Releasing backup interface [ 55.496224][ C1] vcan0: j1939_tp_rxtimer: 0xffff88811a9f2400: rx timeout, send abort [ 55.504493][ C1] vcan0: j1939_tp_rxtimer: 0xffff88811a9caa00: rx timeout, send abort [ 55.512788][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88811a9f2400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 55.527144][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88811a9caa00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 55.550417][ T4426] bond0: (slave bond_slave_1): Releasing backup interface [ 55.573574][ T4426] team0: Port device team_slave_0 removed [ 55.601515][ T4426] team0: Port device team_slave_1 removed [ 55.615062][ T4426] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 55.622518][ T4426] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 55.633655][ T4426] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 55.641127][ T4426] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 55.673756][ T4426] bond1: (slave batadv1): Releasing active interface [ 55.680549][ T4426] bond1: (slave batadv1): the permanent HWaddr of slave - 56:74:28:16:3d:77 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 55.701531][ T4426] bond1: (slave batadv2): making interface the new active one [ 55.715320][ T4426] bond1: (slave batadv2): Releasing active interface [ 55.894193][ T4451] loop1: detected capacity change from 0 to 512 [ 55.935625][ T4451] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 55.962840][ T4451] EXT4-fs (loop1): orphan cleanup on readonly fs [ 56.003914][ T4451] EXT4-fs error (device loop1): ext4_acquire_dquot:6937: comm syz.1.329: Failed to acquire dquot type 1 [ 56.061819][ T4451] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.329: bg 0: block 40: padding at end of block bitmap is not set [ 56.090316][ T4451] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 56.099351][ T4451] EXT4-fs (loop1): 1 truncate cleaned up [ 56.114225][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.115545][ T4451] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 56.185719][ T4451] EXT4-fs error (device loop1): ext4_xattr_block_get:593: inode #16: comm syz.1.329: corrupted xattr block 31: invalid header [ 56.221273][ T4451] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=16 [ 56.279093][ T4451] EXT4-fs error (device loop1): ext4_xattr_block_get:593: inode #16: comm syz.1.329: corrupted xattr block 31: invalid header [ 56.315223][ T4476] 9pnet: p9_errstr2errno: server reported unknown error ‌@يخ0x0000000000000007 [ 56.336984][ T4451] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop1 ino=16 [ 56.367620][ T4488] netlink: 48 bytes leftover after parsing attributes in process `syz.2.337'. [ 56.381393][ T4451] EXT4-fs error (device loop1): ext4_get_link:106: inode #16: comm syz.1.329: bad symlink. [ 56.407886][ T4486] loop4: detected capacity change from 0 to 4096 [ 56.429883][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.439195][ T4486] EXT4-fs: Ignoring removed nomblk_io_submit option [ 56.464425][ T4486] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.523642][ T4501] SELinux: Context ـ is not valid (left unmapped). [ 56.596986][ T4507] loop1: detected capacity change from 0 to 512 [ 56.640148][ T4507] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 56.676264][ T4515] netlink: 4 bytes leftover after parsing attributes in process `syz.2.344'. [ 56.697704][ T4507] EXT4-fs (loop1): 1 truncate cleaned up [ 56.713128][ T4515] netlink: 12 bytes leftover after parsing attributes in process `syz.2.344'. [ 56.715768][ T4507] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.847450][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.923825][ T4530] loop3: detected capacity change from 0 to 128 [ 56.951422][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.011763][ T4530] bio_check_eod: 28961 callbacks suppressed [ 57.011778][ T4530] syz.3.351: attempt to access beyond end of device [ 57.011778][ T4530] loop3: rw=0, sector=121, nr_sectors = 920 limit=128 [ 57.042163][ T4536] loop4: detected capacity change from 0 to 512 [ 57.056918][ T4538] loop2: detected capacity change from 0 to 1024 [ 57.070121][ T4538] EXT4-fs (loop2): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 57.087192][ T4538] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 57.087463][ T4536] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 57.114620][ T4536] ext4 filesystem being mounted at /80/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 57.151757][ T4547] loop0: detected capacity change from 0 to 128 [ 57.155926][ T4545] netlink: 'syz.3.357': attribute type 1 has an invalid length. [ 57.169271][ T3307] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.184276][ T4536] netlink: 96 bytes leftover after parsing attributes in process `syz.4.352'. [ 57.223933][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.258614][ T4551] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 57.287917][ T4551] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 57.331467][ T4562] loop4: detected capacity change from 0 to 1024 [ 57.340653][ T4562] EXT4-fs: Ignoring removed nobh option [ 57.346397][ T4562] EXT4-fs: inline encryption not supported [ 57.358298][ T4562] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 57.392855][ T4562] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4183: comm syz.4.364: Allocating blocks 497-513 which overlap fs metadata [ 57.414005][ T4562] EXT4-fs (loop4): pa ffff888107282690: logic 16, phys. 129, len 24 [ 57.422142][ T4562] EXT4-fs error (device loop4): ext4_mb_release_inode_pa:5434: group 0, free 0, pa_free 1 [ 57.465427][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.723733][ T4579] netlink: 60 bytes leftover after parsing attributes in process `syz.4.367'. [ 57.733045][ T4579] unsupported nlmsg_type 40 [ 57.768427][ T4581] netlink: 'syz.0.369': attribute type 10 has an invalid length. [ 57.790492][ T4581] team0: Port device dummy0 added [ 57.817145][ T4581] netlink: 'syz.0.369': attribute type 10 has an invalid length. [ 57.830493][ T4581] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 57.849004][ T4581] team0: Failed to send options change via netlink (err -105) [ 57.859948][ T4581] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 57.876706][ T4581] team0: Port device dummy0 removed [ 57.899148][ T4587] loop1: detected capacity change from 0 to 1024 [ 57.911147][ T4587] EXT4-fs: Ignoring removed orlov option [ 57.932167][ T4587] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 57.939526][ T4581] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 58.033469][ T4600] netlink: 'syz.0.376': attribute type 10 has an invalid length. [ 58.054013][ T4600] team0: Device hsr_slave_0 failed to register rx_handler [ 58.178580][ T4605] loop3: detected capacity change from 0 to 512 [ 58.208694][ T4605] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 58.250038][ T4605] ext4 filesystem being mounted at /71/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 58.269175][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.301586][ T4613] macvlan1: entered promiscuous mode [ 58.308128][ T4613] ipvlan0: entered promiscuous mode [ 58.314117][ T4613] ipvlan0: left promiscuous mode [ 58.319695][ T4613] macvlan1: left promiscuous mode [ 58.338609][ T3304] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.350488][ T4615] netlink: 'syz.1.381': attribute type 10 has an invalid length. [ 58.358730][ T4615] netlink: 40 bytes leftover after parsing attributes in process `syz.1.381'. [ 58.381122][ T4617] loop3: detected capacity change from 0 to 512 [ 58.389860][ T4617] EXT4-fs: Ignoring removed mblk_io_submit option [ 58.412260][ T4617] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 58.422526][ T4615] dummy0: entered promiscuous mode [ 58.438137][ T4615] bridge0: port 3(dummy0) entered blocking state [ 58.450029][ T4615] bridge0: port 3(dummy0) entered disabled state [ 58.459570][ T4615] dummy0: entered allmulticast mode [ 58.471249][ T4617] EXT4-fs (loop3): 1 truncate cleaned up [ 58.483378][ T4617] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 58.486059][ T4615] bridge0: port 3(dummy0) entered blocking state [ 58.502877][ T4615] bridge0: port 3(dummy0) entered forwarding state [ 58.799693][ T4617] ================================================================== [ 58.807859][ T4617] BUG: KCSAN: data-race in __xa_set_mark / filemap_write_and_wait_range [ 58.816224][ T4617] [ 58.818564][ T4617] write to 0xffff8881072469a4 of 4 bytes by task 4627 on cpu 1: [ 58.826213][ T4617] __xa_set_mark+0x172/0x1a0 [ 58.830831][ T4617] __folio_mark_dirty+0x3af/0x4d0 [ 58.835885][ T4617] mark_buffer_dirty+0x11e/0x210 [ 58.840842][ T4617] block_write_end+0x12d/0x210 [ 58.845621][ T4617] ext4_write_end+0x134/0x730 [ 58.850317][ T4617] generic_perform_write+0x312/0x490 [ 58.855651][ T4617] ext4_buffered_write_iter+0x1ee/0x3c0 [ 58.861233][ T4617] ext4_file_write_iter+0xdbf/0xf00 [ 58.866461][ T4617] iter_file_splice_write+0x666/0xa60 [ 58.871848][ T4617] direct_splice_actor+0x156/0x2a0 [ 58.877000][ T4617] splice_direct_to_actor+0x312/0x680 [ 58.882385][ T4617] do_splice_direct+0xda/0x150 [ 58.887160][ T4617] do_sendfile+0x380/0x650 [ 58.891622][ T4617] __x64_sys_sendfile64+0x105/0x150 [ 58.896841][ T4617] x64_sys_call+0x2bb0/0x2ff0 [ 58.901540][ T4617] do_syscall_64+0xd2/0x200 [ 58.906071][ T4617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.912022][ T4617] [ 58.914353][ T4617] read to 0xffff8881072469a4 of 4 bytes by task 4617 on cpu 0: [ 58.921907][ T4617] filemap_write_and_wait_range+0xfc/0x340 [ 58.927739][ T4617] ext4_file_write_iter+0xe04/0xf00 [ 58.932968][ T4617] iter_file_splice_write+0x666/0xa60 [ 58.938358][ T4617] direct_splice_actor+0x156/0x2a0 [ 58.943483][ T4617] splice_direct_to_actor+0x312/0x680 [ 58.948872][ T4617] do_splice_direct+0xda/0x150 [ 58.953661][ T4617] do_sendfile+0x380/0x650 [ 58.958106][ T4617] __x64_sys_sendfile64+0x105/0x150 [ 58.963326][ T4617] x64_sys_call+0x2bb0/0x2ff0 [ 58.968017][ T4617] do_syscall_64+0xd2/0x200 [ 58.972545][ T4617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.978451][ T4617] [ 58.980869][ T4617] value changed: 0x00000021 -> 0x0a000021 [ 58.986592][ T4617] [ 58.988919][ T4617] Reported by Kernel Concurrency Sanitizer on: [ 58.995087][ T4617] CPU: 0 UID: 0 PID: 4617 Comm: syz.3.383 Not tainted syzkaller #0 PREEMPT(voluntary) [ 59.004819][ T4617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 59.014887][ T4617] ================================================================== [ 59.293523][ T3304] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.