last executing test programs: 6.684979971s ago: executing program 1 (id=484): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0100000004000000080000000b"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) write$binfmt_aout(r2, &(0x7f00000000c0)=ANY=[@ANYRES8=0x0], 0x20) r3 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0) syz_clone(0x630c1100, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000bc0), 0x20040, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000000, 0x10010, r4, 0x10000000) perf_event_open(&(0x7f0000000180)={0x8, 0x80, 0x0, 0x4, 0x0, 0x7, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0x4}, 0x0, 0x0, 0x0, 0x2, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4507}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x9) 5.971216094s ago: executing program 1 (id=488): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0x7}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x37e2f4aba9289b81, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000180)='ns/uts\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8}}, 0x0, 0x100, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x3, 0x5}, 0x8, 0x10, &(0x7f0000000340)={0x3, 0x8, 0x8, 0x1b}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xaaf}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) 2.471013572s ago: executing program 4 (id=560): bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a03f0fff0ffffff79a4f0ff00000000b7060000ffffffff2e64050000000000750afaff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c850000003d000000b70000000000002995000000000000001da5ad3548ebb63d18c5071c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f0e5eb09d38ac46e99e7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6e0b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8ef534b93dcb34e1da2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa380700000000000000c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f29f8bb35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8cea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82e3568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000500000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac64d9c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccfd8b129258bb0a93cee1d44f8665172c06933d20f184b78b435462c52a85149451ffd564c56a7cbf11a1127c77242915e43b2bc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x200000, 0x10, &(0x7f0000000000), 0x143}, 0x48) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000680)={'gre0\x00', &(0x7f0000000700)={'ip_vti0\x00', 0x0, 0x707, 0x10, 0x8, 0x2, {{0x13, 0x4, 0x2, 0x0, 0x4c, 0x68, 0x0, 0x8, 0x29, 0x0, @loopback, @private=0xa010101, {[@end, @rr={0x7, 0x13, 0x2b, [@broadcast, @remote, @loopback, @empty]}, @noop, @timestamp_addr={0x44, 0x1c, 0xa3, 0x1, 0x5, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8001}, {@multicast2, 0x9}, {@multicast1, 0x10}]}, @noop, @ra={0x94, 0x4}]}}}}}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000780)={&(0x7f0000000800)={0xac, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {}, [@HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x7c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x800}, 0x804) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x16, 0x0, 0x4, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = socket$inet(0xa, 0x801, 0x84) connect$inet(r3, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r3, 0x8) r4 = accept4(r3, 0x0, 0x0, 0x0) sendto$inet(r4, &(0x7f00000002c0)="cc", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f00000006c0)={0x0, 0x2}, 0x8) close_range(r2, 0xffffffffffffffff, 0x200000000000000) 2.403655414s ago: executing program 3 (id=561): socket$inet6_udp(0xa, 0x2, 0x0) getpid() syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x8126}}) io_uring_enter(0xffffffffffffffff, 0x38c5, 0x2000000, 0x0, 0x0, 0x0) r0 = socket(0x8000000010, 0x2, 0x0) write(r0, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="f24d42257afbc15541eaae06d05c2d963b287bab55fe07d9595e7a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a00000000000000001812", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x3c) setsockopt$inet6_IPV6_RTHDR(r2, 0x29, 0x39, &(0x7f0000000340)=ANY=[@ANYBLOB="000202"], 0x18) socket(0x5, 0xa, 0x7) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r6 = syz_open_dev$loop(&(0x7f0000000140), 0x9, 0x40000) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd00000080190000000000000800", [0x0, 0x2000000000001]}}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x12, r6, 0x2604a000) sendto$inet(r4, &(0x7f0000000040)='\f\x00', 0xffeb, 0x0, &(0x7f0000000340), 0x10) syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$inet_udp(0x2, 0x2, 0x0) close(r9) socket$nl_route(0x10, 0x3, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000040)={0x0, 0x0, 0x1fd, {0x0, 0xa}, {0x1}, @const={0x0, {0x7, 0x8, 0x4, 0x1a00}}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4808000010001fff3a4ee9bfd5c3a3696c40af0b", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e"], 0x3}}, 0x0) write$binfmt_misc(r8, &(0x7f0000000000), 0xfffffecc) splice(r7, 0x0, r9, 0x0, 0x4ffe6, 0x0) ioctl$sock_inet_SIOCSARP(r3, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x2, 0x0, @multicast1=0xe000cc02}}) 2.08236756s ago: executing program 1 (id=570): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80001}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$vsock(0xffffffffffffff9c, 0x0, 0x402002, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000000)={'wg1\x00', 0x0}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0}, 0x18) r5 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r5, 0x5421, &(0x7f0000000100)=0x100000001) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{}, &(0x7f0000000000), &(0x7f00000005c0)=r6}, 0x20) connect$inet(r5, &(0x7f0000000480)={0x2, 0x4e20, @dev}, 0x10) r7 = getpid() process_vm_writev(r7, &(0x7f0000000800)=[{&(0x7f0000000340)=""/126, 0x7e}, {&(0x7f00000004c0)=""/93, 0x5d}, {&(0x7f0000000600)=""/207, 0xcf}, {&(0x7f0000000400)=""/28, 0x1c}, {&(0x7f0000000700)=""/84, 0x54}], 0x5, &(0x7f0000000580)=[{&(0x7f00000009c0)=""/157, 0x9d}, {0x0}, {&(0x7f0000000a80)=""/217, 0xd9}], 0x3, 0x0) close(r5) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b80)={&(0x7f0000000780)='sched_switch\x00', r9, 0x0, 0x7}, 0x18) r10 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r11, {0x6, 0x4}, {0x7}, {0xfff2}}}, 0x24}}, 0x4084) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@gettfilter={0x54, 0x2e, 0x10, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xa, 0x8}, {0x7, 0x6}, {0x0, 0x2}}}, 0x54}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$TCFLSH(r1, 0x5608, 0x0) 1.999976361s ago: executing program 1 (id=572): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000280)='kfree\x00', r0}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000580)='nmi_handler\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffffc}, 0x18) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000240)={0x19, 0x3d24, 0x1575, 0x0, 0x0, 0xfffe}) 1.978350242s ago: executing program 1 (id=573): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) shutdown(r2, 0x1) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000000)={0x0, 0xffffffff}, &(0x7f0000000080)=0x8) r3 = syz_io_uring_setup(0x10e, &(0x7f00000000c0)={0x0, 0xf07d, 0x400, 0x2, 0x105}, &(0x7f0000000400)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000004c0)=@IORING_OP_READV=@pass_iovec={0x1, 0x1, 0x4004, @fd_index=0x1, 0x8, 0x0, 0x0, 0x1d}) io_uring_enter(r3, 0x8aa, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6, 0x0, 0x7fff}, 0x18) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000005a40)=ANY=[@ANYBLOB="b400000010000904000000000000000000002200", @ANYRES32=0x0, @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200367da1650e000000280003800c00010001800000002000000c000100a1000000c84200000c0001000800000008000000340004800c00010006000000ff0300000c00010004000000080000000c00010004000000020000000c000100050000000300000008000500", @ANYRES32=r7, @ANYBLOB='\b\x00\n\x00', @ANYRESOCT], 0xb4}}, 0x0) 1.802442205s ago: executing program 1 (id=577): sched_setscheduler(0x0, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f00000003c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb2570000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0e000000040000000800"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000001c0)='sched_switch\x00', r4}, 0xe) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000500000008040000cd00000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r5], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r6}, 0x18) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='kfree\x00', r8}, 0x10) r9 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r9, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) setsockopt$inet6_mreq(r9, 0x29, 0x1b, &(0x7f0000000280)={@remote}, 0x14) close(r9) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000580)=@generic={&(0x7f0000000400)='./file0\x00', r7}, 0x18) io_setup(0x8, &(0x7f0000001e00)) unshare(0x62040200) 1.772198796s ago: executing program 2 (id=578): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x18) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x800) memfd_create(&(0x7f0000000bc0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc00xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000001c0)='sched_switch\x00', r4}, 0xe) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000500000008040000cd00000001"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r5}, 0x18) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='kfree\x00', r7}, 0x10) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r8, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) setsockopt$inet6_mreq(r8, 0x29, 0x1b, &(0x7f0000000280)={@remote}, 0x14) close(r8) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000580)=@generic={&(0x7f0000000400)='./file0\x00', r6}, 0x18) io_setup(0x8, &(0x7f0000001e00)) 1.452473412s ago: executing program 3 (id=582): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x64, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c094, 0x2, @perf_config_ext={0x9, 0x6}, 0x0, 0x0, 0x800000, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x7a, 0x0, 0x0, 0x41000, 0x44, '\x00', 0x0, @cgroup_sysctl=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='kmem_cache_free\x00', r4}, 0x18) syz_emit_ethernet(0x3e, &(0x7f0000000b40)=ANY=[@ANYRES16=r3, @ANYRES64=r3, @ANYRES32=r1, @ANYRESHEX=r5, @ANYRES8=r0], 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000880)=ANY=[@ANYBLOB="58000000100039042abd7000eaffffff000003e4", @ANYRES32=0x0, @ANYBLOB="03000000c31006003800128008000100736974002c00028006000e000010000008000300ac9414bb08000200ac14142d08000c00ee0000000800140001000100"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x4008040) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a11800150006001400000000120800030043000040", 0x30}], 0x1}, 0xc001) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0xfe33) 1.391499313s ago: executing program 2 (id=583): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6(0xa, 0x2, 0x0) socket(0x10, 0x803, 0x0) openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000004c0), 0x1, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = signalfd(0xffffffffffffffff, &(0x7f0000000140)={[0x3]}, 0x8) read$msr(r1, &(0x7f0000000bc0)=""/4096, 0x1000) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) 1.372511054s ago: executing program 0 (id=584): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x23) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) r2 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) write$selinux_attr(r2, 0x0, 0x0) 1.351347254s ago: executing program 3 (id=585): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) syz_clone(0x0, &(0x7f0000000800)="f98f88e93f876202f41eeb7515edbd560bb5ba03481cbf81f951aa51ee4ab1c73dc8953f6c6e4f83176b6ddee34456691036106134e5299501a062b70e88ea1a84ab70237ae067445808ddca7251c7f04cb486e76c09000000c11c689f9b99fbb00320c6ebde3259161736bd43b623d633e846afc4a066bbb3824d5c6a23dbcb5434d660886693e0d4ce06833e38c36a9a20e68192d54d959d13db687c0511c68570243adbfc7b39ddfd7af561c3db198d435309ff11b3fa3da81a635f8b1a184735a245ace5aa983239c691311f4c1b5848c97d0c8d114f709069d902efa58f21062cae04ae519fc932ef93fa1900f2e51c9018fa8297ad8d83a6b2339ee86df6538a903a41ffd624925ce962af1ba16a9b3690ab2406305c1c03f17a743ff447e1f2f274dd04b8777a0746a9a53e0075c1e67ba07a6bccc98e4958986d412c9810037e28b7efb738e9b081441cb0ec65f4154e3d599f6ffafcb5595d6bf722886a60d6c2e4eac04f45e43c8f5991682c1d75a834fda56367755c82e563a12789e752aec64819caf36d6e71a4d34be4e21a6b5ce7aa04f720b4d2f080ed1b9bd45a6c59734dd37171ef8599e67dda8341b99ef41c12cb5a2f920ab12dc1d68378ce620cb54da191592f905113dd330d6a5618597bf45647ada6b3f994db5e10b5b42997223c461dfdf19b0f969407c76aec07ccbc6be8912c17d5aeaaddbcd29a8e77b1b282c29265448d8f571c86d1dee3c3bca3d6b8a6bc8859a681c73d2537d0d6ae020113e26d37f47140043c2a19bb8c2a9bd98ce5edddce974ead5e0bfe55b1dc5a7794238fa312bb8a0a36aa7ceede55d6a05b948de671ca471ac202d8436ea9f38165e411fa97d3874020cf30c15de1168480bdcfd4533fc73bccb15e9a498794efde1a6b55257dfa8feecf90523de63d4fee5dfffd7f454147dd68505a41d8b35772fb328d5824357f798b86618089d24e6ce27265504d6851970a6bbf7e27ad1c095414a78bfa74efa9874240b6a0c00fd52b15b32af1325846f9319c36bc6d6fd1e331d8591814a85a8d378e26e3c937a4c68fa60c367286f74916ee9776c3667cff3a7fa8ed1b7235cd0681286fa14e6eeae083198ac6cd9c41e6a380c465a86bf41222eb938269565e2b637edb5c54a0dc155dcaef8b41f72246aad387ad32871a69938f0236371b555f89e6ec1e594eb9b6ec8d746aa5aba046b27e8a79dcd0b7b191d7ec3e860f09e4cb35e286f73adc5e19414078c6419690173cfd5c81514a4c182cecad086865c26119713e83a616041bd76a99ab7c54c4a6a07b3fdcbee959b457dcb1396a66d3b13104bc9e17c14116cae77ec7e7a5a8fc09b48678b1d357cee835b0097921f2be6e4470c6e6fcc2821830cec0d48ba2ae9d9e4bc406f5e0e8a4abde4df41a539df5aa0940e143d3b6723f95ee2b9b46d68242f59492d35899573af84809701779fa4dc464f7d52ecbd0bcca4e80a0231fdaa464f8961b91937dae6524de52f6103aa300abc569e5ae3181278a31c04b332f3b4745e6cdf3ea0c75cc471391b0bd5b85096fc5ec5ef723e71ebc08fa3923458ac2d6000b420f920ef6534385a4fd8a15a6fd5e89c942249cb47cac46dabb7938e499daa814538a8245b5f05a511d42d8d7e8673e271aaf7b990c1466bb733e73e9d3a736b916d76174cf56f842a2fb771b9b714ccfcb7f9ef7733c43aa415a2486218229bc29ea52289f96186605dd2038063580a7ab0eaf717cbad7bc3b4502334ee15152e7ff13bfbc9065dedf94daed392106f35f2de6f2bcb644759575a8027b3b14d12bdaa7bf0e79b2fdc65f559061760539a9e6c08b9053752f95a1a769cdb90b7cbac545ab74d6c2e1dabf9ab33923abcfbc84af06ab1d0fee2dcca712d18ff6413fc645298217684f7116f872ec0b757300217efbc4902a8048341feb856e006c07e43e59548a0f7b6292e7d830c1e08e5c9958dc92952a2824c1f0bd12f170acb5d6a6060adbd7aa5996d58c8576ef05de4216c33dd7370524a4ef0a5e02d1d2b71ce6b3b56174efa15f5ccd388d5e22468b410720709cabc12c7553ec5322dda7b8be25077d200edf24e01cc1fee142fd1962196a352630a30339a189508198d497bbb8d9e27c39d5ad8486da65e56d295298bf3c10540b7f5bd4b7ac237bbb4a3bde1f5d2389f5a6993147193d7c2b9c13586ea7b321ae077be5ce4234cdd422de97c904b245339ed9116e50c97b8d95eb93057f0078707e790a5fba2f0393746763fdfac571ace3d7d5e7f41462acb47f5b34551d5e3ed2b30b8c05bf630ecb3b19c70435a8a47a95f884e25b9dcb3dc3af8cd9f4ad2e5606f6df6f4c52740b0aff7dbae58b3a63c8c29c837bd71edd36fd3037cb260bd994de1b72526ada11530f5dd7cf88f460aaad5ed04b61c8f59e3ba2bbaf9b97352c2233ce43cf6db55582954aa6149a36d6d372b2751d6502436c3ad14e58db8717087af7691334cd805f1809c58644727bda2209c8789c485031c8cd409df0774997572e111ffc448bc767153553f707f6766f28f9f2463ae833525ca0cdcb4fcb2053ca42f95515ee3bf704bf1a278c27b4ec03c3dc79e2d2501484dc6e8179a00d5f4fa21b638ca9ab5095e5de580559674481c02262c15a5a1fb33e3a06228cd9502308e68e875c3e69ad071b259e28446d030bf90cf58bc7a91a7a643d4521ffc63deed75890836e23629cd588eef1ba30031a1c0ef9ba10ab9bc9d3b8060bdb932b79bd17e423607f48a01a9821d207ca26e8c66afc904ed4ed024fd029809633cdd0b868ac33f78f2dcb2bfd291c0553f4afd22b070e31152a74cf395c2793e5642321d23ba8497616a9f8b1725da48df0e76ff177e3439cf041caabe862863925da9a2fb82f03e62942303f50d416cfe58c3466878692e7d8b1e014247c4a62c34ad79afef80d3acf7caeacef2fe8e152ab85f76e7707a62d2befbe2ac6c93d3d855cb1109e8b2af60115442efd27e7c5340f45b52568e761eaf05db3d9101467fc7b6c9e9f7ab7433c33e1a053d4f38d9f3382a2e0cae61dcfb622a084f687a2d1df1beb8c55cc5b5fae031757905090b87b6d432489ee23db0d5401f850745f06ae90765cb80b700d76b790dbf2cfa88e2671964057b69da6deed4b2d5e0d8a89f791a61557530996a6c9662104798e6b9cf52c5bbfd184dbf9810420fc749f4723dd36068cecfab6ae32011ec316613c42ff0938d981423db4d245507817e05ac1804586401a6b78352a5596c0568487a28fcdf3d2bf96c5d9666b7307e413b4fae9bb0a1bdd8eed4c17eaf7effcd8e0afd9dd6a33df88275836c4f8aadf4a65e05278cd90116bb4706266586a94f28d8dc55455f9e43054d17c8d7d1cb4e1f8542a48380d5a42b655d1f1d657100783adc0a79e3687f44870ded8cfa538f642495470fa4b7f4ac2ed3ba0d9a8cae027a324b7dff2ab1b0816ef741fd3013312ae683dd23581696febd07c6b4aab1398446a2b16d78f1daecdd5a905beb8cb7d15909b62188496ec1d6dbf72ce6ed3eceb66e8416766c32c799b7e226d5a63e772be51ff8fbc561c9847b128b5ce6fb53ddcb2ef901f5326226ab821215dd5d6a44d1b9effa6c5bd11945a2e1cba495eaaecc98e273cf04fc2c583ff8ac1c2038271c6fc93e5e001f8ec1f46515d26a83e7edd5320fab3ea8227e14a8880d9ca9369869ac6ba575735bb6a8152355f58c4c03e0dada0e4dad40529909a9bd34261a49539e22d4ab8da6464652ffdc805759e8d0c83e4f441af630bc15306bcf7b395a2fa4abb7e63c0788405fb95f721081392ad7fa7305b61786697dabe0f0f24cb0c7c1301f1d02d7ed6d509c45fe6ebbe7ca5ceb1ee080f6587bfa87e8db4ec185db8b60b11bf8e98bbc7d574db6c010b183d33f89f827972391bd17c71eb447bb678f9e3d30751028aa2fd7aae65e0c333b0063d4ccc79505222352c86009030ac5b7db791e9677a2056c8004a2103035aa528f6376cd368e864c4c384b080ae6558f9c3321caa829607da8442c6247ee56544b7c2160884d819fc008f28c701953f8f62f9bc235ca823873d521f1b0c8066f5873a9dde76d5d5fa8860b5ef8517c3954f2fb2cda6c5bf5574013fb56888a8eedc1705c2f541f2527b15b3fd649b65ec33bed2ace34294e9ab3c81f05d74ed602a0ef631518aefb96bf73127f1e69863a14c329ec8d1d02bcc4b9cd5792105604356c24dbafbf38aebbcb41134f78aff116744d9003bdfcfb0013a7594b6933fab54829d67686100ccb625c1720563bc7eba8dbe1a4ce2e6b2a41510fb5aa82414ebe9f6c6215da4308c5dce1d96693270ad379df5bc9cce49c4ca6abb4684ea9a655fbf1180de0f947d5fb29f657329bfe355d993dab6d298b0701668f0ccbebdf0abb729a504613e6bb585757e74229ad35b5ebaac00"/3174, 0xc66, 0x0, &(0x7f0000000000), &(0x7f00000003c0)="5cbacbd181f2ed01cca6f4f4862323baf158a6ee6d9a9a8ed58cb6b0fde396c9be290d0c643eddbff6c945cf64eaf7418efc0f5bf04d0300ba0f48ec") bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb2570000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000001c0)='sched_switch\x00', r4}, 0xe) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000500000008040000cd00000001"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r5}, 0x18) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='kfree\x00', r7}, 0x10) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r8, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) setsockopt$inet6_mreq(r8, 0x29, 0x1b, &(0x7f0000000280)={@remote}, 0x14) close(r8) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000580)=@generic={&(0x7f0000000400)='./file0\x00', r6}, 0x18) io_setup(0x8, &(0x7f0000001e00)) 1.074820799s ago: executing program 0 (id=586): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0xf, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000800018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="2000b82646131c74c40000f585db3784e8d2c3f8b93e576fc3dcb78613f6e7ee9539e4a14ebe442e82c5ec016f235aa55a3b9d62a1f50c985d2cd25b08c08d80010d9382e959b1b4c01c5c1f5aec0424a7f18946b2414981fdbc4e901dd86689e4f20af316b98076d705d72135bc55cc5c149187d56370e4a8000093dbb84a92e16d775cac6ee0ff42848463358f1e0b42f499ec38437dc5cdcb3acf49e4f355703522a7469dab562aecede7d1d30a443430a89d17c662f56afe971ebe766df6070604afec61f959bb30302bb889388511272a6a94e4af09f45ddcb6a9f25267fdde0c91c72d298ca7bf19", @ANYRES16=r2, @ANYBLOB="318328bd700000000000190000000c00018008000100", @ANYRES32=0x0, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x4000000) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) read(r3, &(0x7f0000000040)=""/148, 0xffffff96) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) r6 = socket(0x2a, 0x2, 0x0) getsockname$packet(r6, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1, 0x2, 0x3, 0xfffffff9, 0x9, 0x101, 0x2, 0xffff}}}}]}, 0x58}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) getsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000000480)={0x0, @empty, @local}, &(0x7f00000004c0)=0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000500)=@gettclass={0x24, 0x2a, 0x800, 0x70bd2b, 0x25dfdbf9, {0x0, 0x0, 0x0, r8, {0xd, 0xffff}, {0x6, 0xc}, {0xc, 0xffe0}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x2) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket$netlink(0x10, 0x3, 0x10) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000680)='wg0\x00', 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r10, 0x8933, &(0x7f00000002c0)={'batadv0\x00', 0x0}) r12 = syz_genetlink_get_family_id$batadv(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r10, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010027bd7000fbdbdf250f00000005002f000100000005002ae800000000050029000100000008000300", @ANYRES32=r11], 0x54}, 0x1, 0x0, 0x0, 0x24004040}, 0x24008824) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="574d1e1a", @ANYRES16=r12, @ANYBLOB="040027bd7000fedbdf250e00000008002b0089060000050033000200000005003700000000000800340005000000"], 0x34}, 0x1, 0x0, 0x0, 0x24040080}, 0x20000004) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000800)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_NOOP(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000014c0)=ANY=[@ANYBLOB="e4030000", @ANYRES16=0x0, @ANYBLOB="000026bd7000fddbdf250000000008000100", @ANYRES32=r11, @ANYBLOB="b800028038000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000050003000300000008000400020000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r7, @ANYBLOB="40000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000100004006c6f616462616c616e63650008000100", @ANYRES32=r13, @ANYRESHEX=0x0, @ANYRES32=r7, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c000000000000000000000005000300030000000800040005fc000008000100", @ANYRESOCT, @ANYBLOB="6002028038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000100000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004000800000040000100240001007072696f72697479", @ANYBLOB="eaa8c25348cd3b045d5eb02601a528535e8d52139a8480c468493b72052310252c50fd6375cd498e97246eaa11719525bf316ff749facdc7dfd3c36bd9e447c256a095f9b37f8ac0b6552f6be4219cfee7872ce3f449a13b42055d4e7eaf96faa041ee482a146337fb746d71d5146b8944a44bf01c0b2e13b54eecd189679db210a6a9a65e6f97d0ff5ab8c7f92f4247bca4b320d8977bdb1c083112e008b261567940efe8ca718ef34fd801b55c037e3aea8a497a671b", @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000700000008000600", @ANYRES32=r8, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000600000008000600", @ANYRES16, @ANYRESOCT=r10, @ANYRES32=r11, @ANYRESDEC=r13, @ANYRES32=r7, @ANYBLOB="44000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000110004006163746976656261636b75700000000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004003a000000"], 0x3f8}, 0x1, 0x0, 0x0, 0x20040001}, 0x20000010) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000180)={'vxcan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_BEACONS(r9, &(0x7f0000000a40)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="2a012bbd7000fddbdf2554ffffff0c0099000100000033000000"], 0x20}, 0x1, 0x0, 0x0, 0x24000000}, 0x4000090) bind$can_raw(r5, &(0x7f0000000200)={0x1d, r14}, 0x10) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r14, {0x1}, {0xffff, 0xfff1}, {0x1}}}, 0x24}}, 0x0) 447.936012ms ago: executing program 4 (id=587): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x200, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000200)={[{@init_itable_val}, {@jqfmt_vfsold}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@user_xattr}, {@errors_remount}, {@quota}]}, 0x3, 0x42f, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./file1\x00', &(0x7f0000000300), &(0x7f0000000040)=ANY=[], 0xfe37, 0x0) unlink(&(0x7f0000000180)='./file1\x00') 397.091942ms ago: executing program 2 (id=588): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) write$selinux_attr(r0, 0x0, 0x0) 295.316894ms ago: executing program 2 (id=589): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000280)='kfree\x00', r0}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000580)='nmi_handler\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffffc}, 0x18) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000240)={0x19, 0x3d24, 0x1575, 0x0, 0x0, 0xfffe}) 271.229985ms ago: executing program 2 (id=590): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="181958000000000000000000000000008500000008001e06c924000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000700000085000000060000009500000000000000c6cafee1f09f89b31df59afd30d9ad581447afa541d428220b85ed01a4a51d40c6137e925d61762a022a5f71aaf20cf638c40c53cb5c875d97a82abf6260219a58fe5d3b311c54de30bfc686c1e5e01e10568f77972e78d0f6c7ccff7d13feb15b680b5a4eba7b33624876e72f8ef3fc8bf9260ae55d22f42d632a3ae384b1fd4729fdace895990f6f5ac8d124cec3ad34bf3b31a3aff5292bf67bc4bbe15fda9a2e"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x34, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='sys_enter\x00', r0}, 0x10) timer_gettime(0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, 0x0) sigaltstack(0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r1, &(0x7f0000000980)=ANY=[@ANYBLOB="7f454c4600000006010000000000000003003e000000000003000000000000004000000000000000980100000000000002000000000038000200000002000000000000600300000008000000000000000d00000000000000ed08000000000000f0ffffffffffffff0000000000000000080000000000000003000000cff5ffff800300000000000001000000000000000500000000000000ff"], 0x5b0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000012c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x94, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x34, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x108}, 0x1, 0x0, 0x0, 0x200c0}, 0x40) close(r1) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x5}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec8500000050000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00', r4}, 0x10) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) 268.862795ms ago: executing program 3 (id=591): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100000000001c000000000000ea04850000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) move_pages(0x0, 0x10000000, 0xffffffffffffffff, &(0x7f0000000080)=[0x0], 0x0, 0x0) 233.167086ms ago: executing program 0 (id=592): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='kmem_cache_free\x00', r0}, 0x10) move_pages(0x0, 0x10000000, 0xffffffffffffffff, &(0x7f0000000080)=[0x0], 0x0, 0x0) 214.734696ms ago: executing program 4 (id=593): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x18) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x800) memfd_create(&(0x7f0000000bc0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc00x0}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0}, 0x18) r5 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r5, 0x5421, &(0x7f0000000100)=0x100000001) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{}, &(0x7f0000000000), &(0x7f00000005c0)=r6}, 0x20) connect$inet(r5, &(0x7f0000000480)={0x2, 0x4e20, @dev}, 0x10) r7 = getpid() process_vm_writev(r7, &(0x7f0000000800)=[{&(0x7f0000000340)=""/126, 0x7e}, {&(0x7f00000004c0)=""/93, 0x5d}, {&(0x7f0000000600)=""/207, 0xcf}, {&(0x7f0000000400)=""/28, 0x1c}, {&(0x7f0000000700)=""/84, 0x54}], 0x5, &(0x7f0000000580)=[{&(0x7f00000009c0)=""/157, 0x9d}, {0x0}, {&(0x7f0000000a80)=""/217, 0xd9}], 0x3, 0x0) close(r5) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b80)={&(0x7f0000000780)='sched_switch\x00', r9, 0x0, 0x7}, 0x18) r10 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r11, {0x6, 0x4}, {0x7}, {0xfff2}}}, 0x24}}, 0x4084) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@gettfilter={0x54, 0x2e, 0x10, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xa, 0x8}, {0x7, 0x6}, {0x0, 0x2}}}, 0x54}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$TCFLSH(r1, 0x5608, 0x0) 159.656777ms ago: executing program 3 (id=595): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x64, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c094, 0x2, @perf_config_ext={0x9, 0x6}, 0x0, 0x0, 0x800000, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x7a, 0x0, 0x0, 0x41000, 0x44, '\x00', 0x0, @cgroup_sysctl=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='kmem_cache_free\x00', r4}, 0x18) syz_emit_ethernet(0x3e, &(0x7f0000000b40)=ANY=[@ANYRES16=r3, @ANYRES64=r3, @ANYRES32=r1, @ANYRESHEX=r5, @ANYRES8=r0], 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000880)=ANY=[@ANYBLOB="58000000100039042abd7000eaffffff000003e4", @ANYRES32=0x0, @ANYBLOB="03000000c31006003800128008000100736974002c00028006000e000010000008000300ac9414bb08000200ac14142d08000c00ee0000000800140001000100"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x4008040) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a11800150006001400000000120800030043000040", 0x30}], 0x1}, 0xc001) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0xfe33) 147.093507ms ago: executing program 0 (id=596): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1801000001ffffeb00000000eb658e0d850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000940)=ANY=[@ANYBLOB="1809000004000000000000000000000018120000", @ANYRES32=r1], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r1}, &(0x7f0000000540), &(0x7f0000000580)=r2}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r1, &(0x7f0000000780)}, 0x20) 51.326259ms ago: executing program 0 (id=597): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000200)={{r0}, &(0x7f0000000140), &(0x7f0000000040)='%pI4 \x00'}, 0x2a) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) r2 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) write$selinux_attr(r2, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) 48.565099ms ago: executing program 4 (id=598): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = signalfd(r0, &(0x7f0000000040)={[0xa]}, 0x8) syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r3 = epoll_create(0x10001) mount$9p_fd(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0100000004000000e27f00000100000000000000", @ANYRES32, @ANYBLOB="f1c0b9d9247e181777ff07f68257fb9b28574d4ebd53dc3c3e0e588cc8d2f5a78ea0ab5eb6cf1303fc32cc5d5e5264f4714fb98f00"/66, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r4, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000180)}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000feffff81000000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000feffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000040)='kmem_cache_free\x00', r6}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) getrlimit(0x5, &(0x7f0000000240)) write$UHID_INPUT(r2, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000400)={@remote, r8}, 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x18, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000", @ANYRES32=r7, @ANYBLOB="ee0999b3485869dbce0fa8c7f5a550a6d04ccb0f1e7e5e37dcb283c4548591a9082693deb2ffed42ed01caa465b73a198307aa8282cb66f9a2616c5ae8f6251d685ad41680a059e2377049e91c923d7ff5576ba4efec", @ANYRESOCT=r8, @ANYBLOB="7c2fdd858af745a3d820742d4572dd223205157712ba941f7212c6a2914b07408227fef558cc8eba4f22611223caf212c816701fcdd59d5c5955067e9c9fd580567d11810dea6b18bc50639cc65f827919221d3d71beff0fb0f801c57ca8281bc83ea2ccae03f978d054784d42d05843198ffece81c8baf231d901ed87a216077f39eb2fde982cb34221333d9b3975ff016df82cb659b322dffd28fa5fb0eb568e726dfb7135756b6b6e136f5e89f949c7a2e13efd3b96fd4c0dff495f7b9188733a534116cfac5c81a0032b7c54f5be9fe64b60534ea231a23f0f1a1dc779a0"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', r8}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000380)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, 0x94) r9 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b702000014000080b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r11}, 0x10) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x100000000000600d, 0x0) r12 = creat(&(0x7f00000000c0)='./file0\x00', 0xc9028ba210c11f8b) ioctl$BLKTRACESETUP(r12, 0xc0481273, &(0x7f0000000000)={'\x00', 0x8, 0x2, 0x803fd, 0x1, 0x800}) connect$llc(r9, &(0x7f0000000340)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random="48bd00"}, 0x10) open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x190) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r13, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_flash={0x33, 0xea5, './file0\x00'}}) 0s ago: executing program 0 (id=599): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000021"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000001850000001b000000b70000000000070095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kfree\x00', r1}, 0x18) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, &(0x7f000000b000)={0x77359400}, &(0x7f0000048000), 0xfffffffc) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x420000, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000740)) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000fc850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kyber_latency\x00', r1, 0x0, 0x800400}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) inotify_rm_watch(0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x25, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x1}, 0x0, 0x10000, 0x0, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e0000000000000004000000ff", @ANYRESOCT=r4, @ANYRES32=r3], 0x48) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) fsetxattr(r5, &(0x7f0000000000)=@known='security.selinux\x00', &(0x7f0000000080)='@\x00', 0x3c8, 0x0) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000802, 0x0, &(0x7f0000000800)={0xfffffffffffffff8, 0x0, 0x4, 0x1, 0x1, 0x9, 0x1, 0x5, 0x7}) shmget$private(0x0, 0x4000, 0x4, &(0x7f0000ffc000/0x4000)=nil) r6 = shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) shmat(r6, &(0x7f0000ff9000/0x1000)=nil, 0x4000) shmdt(0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES16, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x25, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x11, 0xc, &(0x7f0000000880)=ANY=[@ANYRESDEC=r3], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x49, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r7}, 0x18) syz_mount_image$ext4(&(0x7f00000007c0)='ext4\x00', &(0x7f00000006c0)='./file1\x00', 0x40, &(0x7f00000000c0)={[{@user_xattr}, {@nodioread_nolock}]}, 0x1, 0x576, &(0x7f0000000140)="$eJzs3T1sG2UfAPD/neO3X3nf9JXeVwLUoQKkIlV1kn5AYWpXRKVKHZBYIHLcqIoTV7EDTZQh3StEBwSoS9lgYAQxMCAWRlYWEDNSRSOQmg5g5K80TZzglDouud9POvuee87+P8+d/499pzs5gMw62nhII56OiItJxMi6uqFoVx5trbe6slS8v7JUTKJev/RLEklE3FtZKnbWT9rPhyJiOSKeiohv8hHH081xqwuL0xPlcmmuXR6tzVwdrS4snrgyMzFVmirNnnrp5TNnT58ZPzm+/mX36+tL+Z319caPN9+98d2rt29++tmR5eL7E0mci+F23fp+PE6tbZKPcxuWn+5HsAFKBt0AHkmuneeNVPp/jESunfXd1Ed2tWlAn9X3RdSBjErkP2RU53dA4/i3M+3m748751sHII24q+2pVTPUOjcR+5vHJgd/TR46Mmkcbx7ezYayJy1fj4ixoaHNn/+k/fl7dGOPo4H01dfnWztq8/5P18af6DL+DHfOnf5NnfFvddP49yB+bovx72KPMX5/46ePtox/PeKZrvGTtfhJl/hpRLzVY/xbr395dqu6+scRx6J7/I5k+/PDo5evlEtjrceuMb46duSV7fp/cIv4rXO2+5tfM922f5fT2l198e3nzy5vE/+F57bf/922/4GIeK/H+P+998lrW9XduZ7cbfwK2On+TyIft3uM/+K5oz/0uCoAAAAAAAAAALADafNatiQtrM2naaHQuof3f3EwLVeqteOXK/Ozk61r3g5HPu1caTXSKieN8nj7etxO+eSG8qlcO2DuQLNcKFbKkwPuOwAAAAAAAAAAAAAAAAAAADwpDm24//+3XPP+/41/Vw3sVVv/5Tew18l/yK6H8z8ZWDuA3ef7HzKrLv8hu+Q/ZJf8h+yS/5Bd8h+yS/5Ddsl/AAAAAAAAAAAAAAAAAAAAAAAAAADoi4sXLjSm+v2VpWKjPDm0MD9defvEZKk6XZiZLxaKlbmrhalKZapcKhQrM3/1fkmlcnUsZuevjdZK1dpodWHxzZnK/GznP0VL+b73CAAAAAAAAAAAAAAAAAAAAP55hptTkhYiIm3Op2mhEPHviDicRHL5Srk0FhH/iYjvc/l9jfL4oBsNAAAAAAAAAAAAAAAAAAAAe0x1YXF6olwuzWVkZmgnK0fE8uNtRuMdd/yqfHtfPSnb0EwWZgY8MAEAAAAAAAAAAAAAAAAAQAY9uOm311f80d8GAQAAAAAAAAAAAAAAAAAAQCalPycR0ZiOjTw/vLH2X8lqrvkcEe/cuvTBtYlabW68sfzu2vLah+3lJwfRfqBXnTzt5DEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwQHVhcXqiXC7N9XFm0H0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeBR/BgAA///eANcP") openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) kernel console output (not intermixed with test programs): 4-fs error (device loop3): ext4_get_journal_inode:5800: inode #5: comm syz.3.12: unexpected bad inode w/o EXT4_IGET_BAD [ 30.231545][ T3504] EXT4-fs (loop3): no journal found [ 30.265550][ T3496] FAULT_INJECTION: forcing a failure. [ 30.265550][ T3496] name failslab, interval 1, probability 0, space 0, times 1 [ 30.274786][ T3520] netlink: 168 bytes leftover after parsing attributes in process `syz.2.16'. [ 30.278477][ T3496] CPU: 1 UID: 0 PID: 3496 Comm: syz.0.9 Not tainted syzkaller #0 PREEMPT(voluntary) [ 30.278540][ T3496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 30.278552][ T3496] Call Trace: [ 30.278557][ T3496] [ 30.278565][ T3496] __dump_stack+0x1d/0x30 [ 30.278587][ T3496] dump_stack_lvl+0xe8/0x140 [ 30.278606][ T3496] dump_stack+0x15/0x1b [ 30.278664][ T3496] should_fail_ex+0x265/0x280 [ 30.278685][ T3496] should_failslab+0x8c/0xb0 [ 30.278709][ T3496] kmem_cache_alloc_noprof+0x50/0x310 [ 30.278767][ T3496] ? alloc_empty_file+0x76/0x200 [ 30.278799][ T3496] ? mntput+0x4b/0x80 [ 30.278828][ T3496] alloc_empty_file+0x76/0x200 [ 30.278885][ T3496] path_openat+0x68/0x2170 [ 30.278904][ T3496] ? _parse_integer_limit+0x170/0x190 [ 30.278927][ T3496] ? kstrtoull+0x111/0x140 [ 30.278946][ T3496] ? kstrtouint+0x76/0xc0 [ 30.279016][ T3496] do_filp_open+0x109/0x230 [ 30.279082][ T3496] do_sys_openat2+0xa6/0x110 [ 30.279112][ T3496] __x64_sys_openat+0xf2/0x120 [ 30.279197][ T3496] x64_sys_call+0x2e9c/0x2ff0 [ 30.279217][ T3496] do_syscall_64+0xd2/0x200 [ 30.279243][ T3496] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 30.279278][ T3496] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 30.279301][ T3496] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 30.279321][ T3496] RIP: 0033:0x7f543801d550 [ 30.279337][ T3496] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 [ 30.279422][ T3496] RSP: 002b:00007f5436a7eb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 30.279442][ T3496] RAX: ffffffffffffffda RBX: 0000000000109301 RCX: 00007f543801d550 [ 30.279455][ T3496] RDX: 0000000000109301 RSI: 00007f5436a7ec10 RDI: 00000000ffffff9c [ 30.279468][ T3496] RBP: 00007f5436a7ec10 R08: 0000000000000000 R09: 0000000000000000 [ 30.279480][ T3496] R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd [ 30.279550][ T3496] R13: 00007f5438256038 R14: 00007f5438255fa0 R15: 00007ffcb5a2a878 [ 30.279567][ T3496] [ 30.295890][ T3496] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9'. [ 30.513203][ T3520] C: renamed from team_slave_0 (while UP) [ 30.523641][ T3496] bridge_slave_1: left allmulticast mode [ 30.529313][ T3496] bridge_slave_1: left promiscuous mode [ 30.535311][ T3496] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.561788][ T3496] bridge_slave_0: left allmulticast mode [ 30.567508][ T3496] bridge_slave_0: left promiscuous mode [ 30.573574][ T3496] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.634747][ T3525] loop2: detected capacity change from 0 to 128 [ 30.664088][ T3529] netlink: 40 bytes leftover after parsing attributes in process `syz.3.18'. [ 30.756488][ T3534] capability: warning: `syz.3.20' uses deprecated v2 capabilities in a way that may be insecure [ 30.809865][ T3538] loop2: detected capacity change from 0 to 512 [ 30.826376][ T3539] loop3: detected capacity change from 0 to 512 [ 30.848330][ T3538] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 30.872523][ T3539] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 30.881513][ T3538] ext4 filesystem being mounted at /6/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 30.923318][ T3538] batman_adv: batadv0: Adding interface: dummy0 [ 30.929802][ T3538] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.955475][ T3539] ext4 filesystem being mounted at /7/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 30.966478][ T3538] batman_adv: batadv0: Interface activated: dummy0 [ 30.997501][ T3538] batadv0: mtu less than device minimum [ 31.003953][ T3538] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 31.014809][ T3538] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 31.025621][ T3538] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 31.036385][ T3538] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 31.047170][ T3538] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 31.058039][ T3538] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 31.068770][ T3538] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 31.079876][ T3538] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 31.090698][ T3538] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 31.119435][ T3549] loop0: detected capacity change from 0 to 512 [ 31.138019][ T3549] EXT4-fs: Ignoring removed nomblk_io_submit option [ 31.145907][ T3549] EXT4-fs: Ignoring removed nomblk_io_submit option [ 31.171414][ T3549] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 31.172974][ T3534] syz.3.20 (3534) used greatest stack depth: 10008 bytes left [ 31.181828][ T3549] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 31.197515][ T3549] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2 [ 31.227101][ T3549] EXT4-fs (loop0): 1 truncate cleaned up [ 31.243267][ T3549] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.259381][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.291424][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.365818][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.368200][ T3559] loop2: detected capacity change from 0 to 512 [ 31.390608][ T3559] EXT4-fs: Ignoring removed mblk_io_submit option [ 31.391240][ T3559] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 31.391256][ T3559] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 31.402214][ T3559] EXT4-fs (loop2): 1 orphan inode deleted [ 31.402238][ T3559] EXT4-fs (loop2): 1 truncate cleaned up [ 31.402749][ T3559] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 31.433707][ T3559] EXT4-fs error (device loop2): ext4_inlinedir_to_tree:1314: inode #12: block 7: comm syz.2.27: path /7/file0/file0: bad entry in directory: directory entry overrun - offset=788, inode=13, rec_len=784, size=60 fake=0 [ 31.535018][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.618313][ T3571] netlink: 'syz.0.34': attribute type 10 has an invalid length. [ 31.629540][ T3571] team0: Port device dummy0 added [ 31.695978][ T3581] delete_channel: no stack [ 31.773891][ T3587] loop3: detected capacity change from 0 to 128 [ 31.877700][ T3587] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 31.974285][ T3596] FAULT_INJECTION: forcing a failure. [ 31.974285][ T3596] name failslab, interval 1, probability 0, space 0, times 0 [ 31.982285][ T3587] ext4 filesystem being mounted at /11/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.987155][ T3596] CPU: 1 UID: 0 PID: 3596 Comm: syz.4.41 Not tainted syzkaller #0 PREEMPT(voluntary) [ 31.987235][ T3596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 31.987320][ T3596] Call Trace: [ 31.987327][ T3596] [ 31.987335][ T3596] __dump_stack+0x1d/0x30 [ 31.987357][ T3596] dump_stack_lvl+0xe8/0x140 [ 31.987376][ T3596] dump_stack+0x15/0x1b [ 31.987392][ T3596] should_fail_ex+0x265/0x280 [ 31.987413][ T3596] should_failslab+0x8c/0xb0 [ 31.987522][ T3596] kmem_cache_alloc_node_noprof+0x57/0x320 [ 31.987550][ T3596] ? __alloc_skb+0x101/0x320 [ 31.987570][ T3596] __alloc_skb+0x101/0x320 [ 31.987646][ T3596] ? audit_log_start+0x365/0x6c0 [ 31.987674][ T3596] audit_log_start+0x380/0x6c0 [ 31.987769][ T3596] audit_seccomp+0x48/0x100 [ 31.987793][ T3596] ? __seccomp_filter+0x68c/0x10d0 [ 31.987814][ T3596] __seccomp_filter+0x69d/0x10d0 [ 31.987835][ T3596] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 31.987900][ T3596] ? vfs_write+0x7e8/0x960 [ 31.987920][ T3596] ? __rcu_read_unlock+0x4f/0x70 [ 31.987941][ T3596] ? __fget_files+0x184/0x1c0 [ 31.987966][ T3596] __secure_computing+0x82/0x150 [ 31.988031][ T3596] syscall_trace_enter+0xcf/0x1e0 [ 31.988055][ T3596] do_syscall_64+0xac/0x200 [ 31.988085][ T3596] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 31.988165][ T3596] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 31.988190][ T3596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 31.988211][ T3596] RIP: 0033:0x7f6a602febe9 [ 31.988227][ T3596] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 31.988329][ T3596] RSP: 002b:00007f6a5ed5f038 EFLAGS: 00000246 ORIG_RAX: 00000000000001c3 [ 31.988349][ T3596] RAX: ffffffffffffffda RBX: 00007f6a60535fa0 RCX: 00007f6a602febe9 [ 31.988362][ T3596] RDX: 000020000009de80 RSI: 0000200000001180 RDI: 0000000000000005 [ 31.988374][ T3596] RBP: 00007f6a5ed5f090 R08: 0000000000000000 R09: 0000000000000000 [ 31.988386][ T3596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 31.988442][ T3596] R13: 00007f6a60536038 R14: 00007f6a60535fa0 R15: 00007ffedd4bd318 [ 31.988459][ T3596] [ 32.092205][ T3578] loop0: detected capacity change from 0 to 2048 [ 32.245721][ T3600] FAULT_INJECTION: forcing a failure. [ 32.245721][ T3600] name failslab, interval 1, probability 0, space 0, times 0 [ 32.258527][ T3600] CPU: 0 UID: 0 PID: 3600 Comm: syz.4.42 Not tainted syzkaller #0 PREEMPT(voluntary) [ 32.258560][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 32.258574][ T3600] Call Trace: [ 32.258581][ T3600] [ 32.258590][ T3600] __dump_stack+0x1d/0x30 [ 32.258677][ T3600] dump_stack_lvl+0xe8/0x140 [ 32.258694][ T3600] dump_stack+0x15/0x1b [ 32.258712][ T3600] should_fail_ex+0x265/0x280 [ 32.258739][ T3600] should_failslab+0x8c/0xb0 [ 32.258764][ T3600] kmem_cache_alloc_lru_noprof+0x55/0x310 [ 32.258853][ T3600] ? __d_alloc+0x3d/0x340 [ 32.258885][ T3600] __d_alloc+0x3d/0x340 [ 32.258913][ T3600] ? from_vfsgid+0x70/0xa0 [ 32.258941][ T3600] d_alloc_pseudo+0x1e/0x80 [ 32.259025][ T3600] alloc_file_pseudo+0x71/0x160 [ 32.259053][ T3600] hugetlb_file_setup+0x2a6/0x3d0 [ 32.259074][ T3600] ksys_mmap_pgoff+0x157/0x310 [ 32.259092][ T3600] x64_sys_call+0x14a3/0x2ff0 [ 32.259141][ T3600] do_syscall_64+0xd2/0x200 [ 32.259172][ T3600] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 32.259196][ T3600] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 32.259272][ T3600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 32.259299][ T3600] RIP: 0033:0x7f6a602febe9 [ 32.259314][ T3600] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 32.259333][ T3600] RSP: 002b:00007f6a5ed5f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 32.259354][ T3600] RAX: ffffffffffffffda RBX: 00007f6a60535fa0 RCX: 00007f6a602febe9 [ 32.259368][ T3600] RDX: 0000000000000003 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 32.259382][ T3600] RBP: 00007f6a5ed5f090 R08: ffffffffffffffff R09: 0000000000000000 [ 32.259395][ T3600] R10: 00020000000ec071 R11: 0000000000000246 R12: 0000000000000001 [ 32.259487][ T3600] R13: 00007f6a60536038 R14: 00007f6a60535fa0 R15: 00007ffedd4bd318 [ 32.259506][ T3600] [ 32.504062][ T3509] loop0: p2 p3 p7 [ 32.564568][ T3610] loop4: detected capacity change from 0 to 1024 [ 32.594115][ T3612] Zero length message leads to an empty skb [ 32.600836][ T3578] loop_reread_partitions: partition scan of loop0 () failed (rc=-16) [ 32.609173][ T3612] loop2: detected capacity change from 0 to 512 [ 32.611472][ T3610] ======================================================= [ 32.611472][ T3610] WARNING: The mand mount option has been deprecated and [ 32.611472][ T3610] and is ignored by this kernel. Remove the mand [ 32.611472][ T3610] option from the mount to silence this warning. [ 32.611472][ T3610] ======================================================= [ 32.681604][ T3612] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e842c11c, mo2=0002] [ 32.695130][ T2994] loop0: p2 p3 p7 [ 32.700227][ T3612] System zones: 0-2, 18-18, 34-34 [ 32.706768][ T3610] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.737812][ T3310] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 32.757324][ T3612] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.46: bg 0: block 248: padding at end of block bitmap is not set [ 32.772264][ T3612] EXT4-fs error (device loop2): ext4_acquire_dquot:6937: comm syz.2.46: Failed to acquire dquot type 1 [ 32.789101][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.799694][ T3612] EXT4-fs (loop2): 1 truncate cleaned up [ 32.850742][ T3612] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.905586][ T3622] loop4: detected capacity change from 0 to 1024 [ 32.911728][ T3612] ext4 filesystem being mounted at /11/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 32.914960][ T3622] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.949326][ T3612] syz.2.46 (3612) used greatest stack depth: 9280 bytes left [ 32.962481][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.020118][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.056668][ T3628] syz.3.51 uses obsolete (PF_INET,SOCK_PACKET) [ 33.098501][ T3637] loop4: detected capacity change from 0 to 256 [ 33.168715][ T3642] C: renamed from team_slave_0 (while UP) [ 33.328226][ T3659] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.370564][ T3659] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.445478][ T3668] loop4: detected capacity change from 0 to 512 [ 33.519114][ T3668] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.533454][ T3668] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.546537][ T3668] mmap: syz.4.66 (3668) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 33.560893][ T3672] smc: net device bond0 applied user defined pnetid SYZ0 [ 33.565178][ T3668] netlink: 'syz.4.66': attribute type 7 has an invalid length. [ 33.582755][ T3659] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.608413][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.646253][ T3659] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.733775][ T2549] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.747048][ T2549] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.763429][ T3681] binfmt_misc: register: failed to install interpreter file ./file0 [ 33.773138][ T2549] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.803827][ T2549] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.828995][ T3683] loop1: detected capacity change from 0 to 1024 [ 33.864163][ T3683] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 33.926900][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.940728][ T3690] loop0: detected capacity change from 0 to 128 [ 33.954866][ T29] kauditd_printk_skb: 442 callbacks suppressed [ 33.954881][ T29] audit: type=1400 audit(1756995298.537:529): avc: denied { bind } for pid=3691 comm="syz.2.74" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.957797][ T3692] netlink: 'syz.2.74': attribute type 10 has an invalid length. [ 33.962605][ T29] audit: type=1400 audit(1756995298.537:530): avc: denied { setopt } for pid=3691 comm="syz.2.74" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.984699][ T3692] batman_adv: batadv0: Interface deactivated: dummy0 [ 34.027883][ T3692] batman_adv: batadv0: Removing interface: dummy0 [ 34.037592][ T3692] team0: Port device dummy0 added [ 34.088524][ T29] audit: type=1400 audit(1756995298.607:531): avc: denied { mounton } for pid=3689 comm="syz.0.73" path="/13/file0" dev="loop0" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=dir permissive=1 [ 34.303662][ T29] audit: type=1326 audit(1756995298.887:532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3699 comm="syz.2.76" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 34.327118][ T29] audit: type=1326 audit(1756995298.887:533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3699 comm="syz.2.76" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 34.366675][ T3700] loop2: detected capacity change from 0 to 128 [ 34.450384][ T3700] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 34.501013][ T3700] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.583241][ T29] audit: type=1326 audit(1756995298.937:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3699 comm="syz.2.76" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 34.606691][ T29] audit: type=1326 audit(1756995298.937:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3699 comm="syz.2.76" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f2889f3ec23 code=0x7ffc0000 [ 34.631327][ T29] audit: type=1326 audit(1756995298.937:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3699 comm="syz.2.76" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f2889f3d69f code=0x7ffc0000 [ 34.654902][ T29] audit: type=1326 audit(1756995298.937:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3699 comm="syz.2.76" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f2889f3ec77 code=0x7ffc0000 [ 34.678323][ T29] audit: type=1326 audit(1756995298.937:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3699 comm="syz.2.76" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2889f3d550 code=0x7ffc0000 [ 34.816585][ T3308] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 34.840758][ T3715] loop3: detected capacity change from 0 to 512 [ 34.842680][ T3708] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3708 comm=syz.4.78 [ 34.850424][ T3715] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 34.878738][ T3707] __nla_validate_parse: 12 callbacks suppressed [ 34.878764][ T3707] netlink: 4 bytes leftover after parsing attributes in process `syz.4.78'. [ 34.949021][ T3715] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2848: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 34.965736][ T3715] EXT4-fs (loop3): 1 truncate cleaned up [ 34.997648][ T3715] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.022071][ T3729] netlink: 4 bytes leftover after parsing attributes in process `syz.2.86'. [ 35.031041][ T3727] loop0: detected capacity change from 0 to 1024 [ 35.068633][ T3727] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.110483][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.158530][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.195953][ T3733] unsupported nla_type 52263 [ 35.401071][ T3746] netlink: 52 bytes leftover after parsing attributes in process `syz.0.90'. [ 35.410142][ T3746] netlink: 12 bytes leftover after parsing attributes in process `syz.0.90'. [ 35.419453][ T3746] netlink: 52 bytes leftover after parsing attributes in process `syz.0.90'. [ 35.428471][ T3746] netlink: 12 bytes leftover after parsing attributes in process `syz.0.90'. [ 35.437567][ T3746] netlink: 52 bytes leftover after parsing attributes in process `syz.0.90'. [ 35.827212][ T3759] binfmt_misc: register: failed to install interpreter file ./file0 [ 35.904026][ T3773] loop3: detected capacity change from 0 to 1024 [ 35.920134][ T3774] netlink: 32 bytes leftover after parsing attributes in process `syz.0.99'. [ 35.929863][ T3774] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3774 comm=syz.0.99 [ 35.931153][ T3773] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.976402][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.985150][ T3770] netlink: 4 bytes leftover after parsing attributes in process `syz.0.99'. [ 36.018004][ T3780] FAULT_INJECTION: forcing a failure. [ 36.018004][ T3780] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 36.031248][ T3780] CPU: 0 UID: 0 PID: 3780 Comm: syz.3.102 Not tainted syzkaller #0 PREEMPT(voluntary) [ 36.031270][ T3780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 36.031279][ T3780] Call Trace: [ 36.031284][ T3780] [ 36.031291][ T3780] __dump_stack+0x1d/0x30 [ 36.031309][ T3780] dump_stack_lvl+0xe8/0x140 [ 36.031325][ T3780] dump_stack+0x15/0x1b [ 36.031381][ T3780] should_fail_ex+0x265/0x280 [ 36.031396][ T3780] should_fail+0xb/0x20 [ 36.031408][ T3780] should_fail_usercopy+0x1a/0x20 [ 36.031423][ T3780] _copy_from_iter+0xd2/0xe80 [ 36.031445][ T3780] ? __build_skb_around+0x1a0/0x200 [ 36.031462][ T3780] ? __alloc_skb+0x223/0x320 [ 36.031478][ T3780] netlink_sendmsg+0x471/0x6b0 [ 36.031571][ T3780] ? __pfx_netlink_sendmsg+0x10/0x10 [ 36.031587][ T3780] __sock_sendmsg+0x142/0x180 [ 36.031622][ T3780] ____sys_sendmsg+0x31e/0x4e0 [ 36.031641][ T3780] ___sys_sendmsg+0x17b/0x1d0 [ 36.031675][ T3780] __x64_sys_sendmsg+0xd4/0x160 [ 36.031705][ T3780] x64_sys_call+0x191e/0x2ff0 [ 36.031728][ T3780] do_syscall_64+0xd2/0x200 [ 36.031755][ T3780] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 36.031781][ T3780] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 36.031835][ T3780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 36.031858][ T3780] RIP: 0033:0x7fbe691bebe9 [ 36.031872][ T3780] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 36.031888][ T3780] RSP: 002b:00007fbe67c1f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 36.031906][ T3780] RAX: ffffffffffffffda RBX: 00007fbe693f5fa0 RCX: 00007fbe691bebe9 [ 36.031983][ T3780] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 36.031998][ T3780] RBP: 00007fbe67c1f090 R08: 0000000000000000 R09: 0000000000000000 [ 36.032011][ T3780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 36.032025][ T3780] R13: 00007fbe693f6038 R14: 00007fbe693f5fa0 R15: 00007ffe65fd9918 [ 36.032043][ T3780] [ 36.307258][ T3782] SELinux: Context @ is not valid (left unmapped). [ 36.331724][ T3782] loop3: detected capacity change from 0 to 1024 [ 36.367291][ T3782] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 36.382462][ T3782] ext4 filesystem being mounted at /31/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 36.434110][ T47] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 36.471119][ T47] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 319 with max blocks 1 with error 28 [ 36.483765][ T47] EXT4-fs (loop3): This should not happen!! Data will be lost [ 36.483765][ T47] [ 36.493537][ T47] EXT4-fs (loop3): Total free blocks count 0 [ 36.499536][ T47] EXT4-fs (loop3): Free/Dirty block details [ 36.505653][ T47] EXT4-fs (loop3): free_blocks=4293918720 [ 36.511453][ T47] EXT4-fs (loop3): dirty_blocks=16 [ 36.516573][ T47] EXT4-fs (loop3): Block reservation details [ 36.522626][ T47] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 36.534845][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.657778][ T3803] FAULT_INJECTION: forcing a failure. [ 36.657778][ T3803] name failslab, interval 1, probability 0, space 0, times 0 [ 36.670567][ T3803] CPU: 0 UID: 0 PID: 3803 Comm: syz.1.110 Not tainted syzkaller #0 PREEMPT(voluntary) [ 36.670596][ T3803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 36.670607][ T3803] Call Trace: [ 36.670614][ T3803] [ 36.670622][ T3803] __dump_stack+0x1d/0x30 [ 36.670644][ T3803] dump_stack_lvl+0xe8/0x140 [ 36.670666][ T3803] dump_stack+0x15/0x1b [ 36.670683][ T3803] should_fail_ex+0x265/0x280 [ 36.670705][ T3803] should_failslab+0x8c/0xb0 [ 36.670814][ T3803] __kmalloc_cache_node_noprof+0x54/0x320 [ 36.670874][ T3803] ? page_pool_create_percpu+0x4d/0x650 [ 36.670966][ T3803] page_pool_create_percpu+0x4d/0x650 [ 36.670992][ T3803] ? __kvmalloc_node_noprof+0x260/0x4e0 [ 36.671063][ T3803] ? bpf_test_run_xdp_live+0x114/0xfe0 [ 36.671090][ T3803] page_pool_create+0x1a/0x30 [ 36.671116][ T3803] bpf_test_run_xdp_live+0x12e/0xfe0 [ 36.671163][ T3803] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 36.671190][ T3803] ? __pfx_autoremove_wake_function+0x10/0x10 [ 36.671279][ T3803] ? 0xffffffffa02053c0 [ 36.671294][ T3803] ? synchronize_rcu+0x45/0x320 [ 36.671324][ T3803] ? 0xffffffffa02053c0 [ 36.671337][ T3803] ? 0xffffffffa02053c0 [ 36.671385][ T3803] ? bpf_dispatcher_change_prog+0x6ec/0x7f0 [ 36.671417][ T3803] ? 0xffffffffa0205350 [ 36.671439][ T3803] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 36.671630][ T3803] bpf_prog_test_run_xdp+0x4f5/0x910 [ 36.671656][ T3803] ? __rcu_read_unlock+0x4f/0x70 [ 36.671679][ T3803] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 36.671759][ T3803] bpf_prog_test_run+0x227/0x390 [ 36.671855][ T3803] __sys_bpf+0x4b9/0x7b0 [ 36.671894][ T3803] __x64_sys_bpf+0x41/0x50 [ 36.671915][ T3803] x64_sys_call+0x2aea/0x2ff0 [ 36.671935][ T3803] do_syscall_64+0xd2/0x200 [ 36.671961][ T3803] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 36.671987][ T3803] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 36.672081][ T3803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 36.672120][ T3803] RIP: 0033:0x7f394f35ebe9 [ 36.672135][ T3803] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 36.672153][ T3803] RSP: 002b:00007f394ddbf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 36.672240][ T3803] RAX: ffffffffffffffda RBX: 00007f394f595fa0 RCX: 00007f394f35ebe9 [ 36.672254][ T3803] RDX: 0000000000000050 RSI: 0000200000000000 RDI: 000000000000000a [ 36.672268][ T3803] RBP: 00007f394ddbf090 R08: 0000000000000000 R09: 0000000000000000 [ 36.672359][ T3803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 36.672372][ T3803] R13: 00007f394f596038 R14: 00007f394f595fa0 R15: 00007ffcba259ae8 [ 36.672388][ T3803] [ 36.978553][ T3806] netlink: 96 bytes leftover after parsing attributes in process `syz.4.111'. [ 37.054970][ T3814] loop4: detected capacity change from 0 to 512 [ 37.062531][ T3814] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 37.075378][ T3814] EXT4-fs (loop4): 1 truncate cleaned up [ 37.091502][ T3814] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.124821][ T3799] loop3: detected capacity change from 0 to 32768 [ 37.144351][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.230772][ T3826] net_ratelimit: 10 callbacks suppressed [ 37.230789][ T3826] netlink: zone id is out of range [ 37.241931][ T3826] netlink: zone id is out of range [ 37.290522][ T3828] binfmt_misc: register: failed to install interpreter file ./file0 [ 37.324117][ T3833] binfmt_misc: register: failed to install interpreter file ./file0 [ 37.349549][ T3837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.362712][ T3839] loop3: detected capacity change from 0 to 512 [ 37.366873][ T3837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.371143][ T3839] EXT4-fs: Ignoring removed nomblk_io_submit option [ 37.387722][ T3839] EXT4-fs: Ignoring removed nomblk_io_submit option [ 37.404855][ T3839] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 37.417756][ T3839] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 37.427032][ T3839] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 37.435805][ T3839] EXT4-fs (loop3): 1 truncate cleaned up [ 37.442043][ T3839] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.476948][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.998353][ T3858] loop1: detected capacity change from 0 to 128 [ 38.000414][ T3858] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 38.000600][ T3858] ext4 filesystem being mounted at /14/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 38.050924][ T3305] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 38.103538][ T3862] 9pnet_fd: Insufficient options for proto=fd [ 38.134949][ T3862] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 38.210755][ C0] hrtimer: interrupt took 46363 ns [ 38.242578][ T3874] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.249860][ T3874] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.259360][ T3874] bridge0: entered allmulticast mode [ 38.274318][ T3868] bridge_slave_1: left allmulticast mode [ 38.280268][ T3868] bridge_slave_1: left promiscuous mode [ 38.286153][ T3868] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.317837][ T3868] bridge_slave_0: left allmulticast mode [ 38.323743][ T3868] bridge_slave_0: left promiscuous mode [ 38.329638][ T3868] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.356990][ T3879] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.381297][ T3879] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.592926][ T3901] binfmt_misc: register: failed to install interpreter file ./file0 [ 38.620462][ T3903] loop2: detected capacity change from 0 to 1024 [ 38.632842][ T3903] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 38.653554][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.010842][ T29] kauditd_printk_skb: 469 callbacks suppressed [ 39.010889][ T29] audit: type=1400 audit(1756995303.587:1008): avc: denied { sqpoll } for pid=3915 comm="syz.1.149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 39.157347][ T29] audit: type=1400 audit(1756995303.617:1009): avc: denied { create } for pid=3915 comm="syz.1.149" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 39.178543][ T29] audit: type=1400 audit(1756995303.617:1010): avc: denied { map } for pid=3915 comm="syz.1.149" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=6647 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 39.202941][ T29] audit: type=1400 audit(1756995303.617:1011): avc: denied { read write } for pid=3915 comm="syz.1.149" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=6647 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 39.300102][ T29] audit: type=1326 audit(1756995303.767:1012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3923 comm="syz.3.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 39.323480][ T29] audit: type=1326 audit(1756995303.767:1013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3923 comm="syz.3.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=133 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 39.323504][ T29] audit: type=1326 audit(1756995303.767:1014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3923 comm="syz.3.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 39.323561][ T29] audit: type=1326 audit(1756995303.767:1015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3923 comm="syz.3.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 39.323578][ T29] audit: type=1326 audit(1756995303.767:1016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3923 comm="syz.3.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 39.323595][ T29] audit: type=1326 audit(1756995303.767:1017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3923 comm="syz.3.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 39.469199][ T3936] loop4: detected capacity change from 0 to 1024 [ 39.481011][ T3938] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.489833][ T3938] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.520952][ T3936] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 39.567774][ T3946] loop0: detected capacity change from 0 to 128 [ 39.574631][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.585407][ T3946] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 39.600681][ T3946] ext4 filesystem being mounted at /24/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.657105][ T3304] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 39.701789][ T3952] bridge_slave_0: left allmulticast mode [ 39.707584][ T3952] bridge_slave_0: left promiscuous mode [ 39.713424][ T3952] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.732682][ T3952] bridge_slave_1: left allmulticast mode [ 39.738393][ T3952] bridge_slave_1: left promiscuous mode [ 39.744310][ T3952] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.753929][ T3957] loop0: detected capacity change from 0 to 512 [ 39.762214][ T3957] EXT4-fs: Ignoring removed nomblk_io_submit option [ 39.769205][ T3957] EXT4-fs: Ignoring removed nomblk_io_submit option [ 39.769259][ T3952] bond0: (slave bond_slave_0): Releasing backup interface [ 39.784787][ T3957] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 39.800198][ T3952] bond0: (slave bond_slave_1): Releasing backup interface [ 39.807898][ T3957] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 39.816226][ T3957] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2 [ 39.828496][ T3952] team0: Port device team_slave_0 removed [ 39.837649][ T3952] team0: Port device team_slave_1 removed [ 39.842901][ T3957] EXT4-fs (loop0): 1 truncate cleaned up [ 39.844417][ T3952] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.849969][ T3957] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.856526][ T3952] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 39.878246][ T3952] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.885899][ T3952] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 39.886294][ T3954] loop2: detected capacity change from 0 to 2048 [ 39.944643][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.970326][ T3954] loop2: p2 p3 p7 [ 40.068615][ T3972] binfmt_misc: register: failed to install interpreter file ./file0 [ 40.296772][ T3979] FAULT_INJECTION: forcing a failure. [ 40.296772][ T3979] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 40.309962][ T3979] CPU: 0 UID: 0 PID: 3979 Comm: syz.1.168 Not tainted syzkaller #0 PREEMPT(voluntary) [ 40.310013][ T3979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 40.310024][ T3979] Call Trace: [ 40.310030][ T3979] [ 40.310038][ T3979] __dump_stack+0x1d/0x30 [ 40.310061][ T3979] dump_stack_lvl+0xe8/0x140 [ 40.310083][ T3979] dump_stack+0x15/0x1b [ 40.310130][ T3979] should_fail_ex+0x265/0x280 [ 40.310150][ T3979] should_fail+0xb/0x20 [ 40.310235][ T3979] should_fail_usercopy+0x1a/0x20 [ 40.310254][ T3979] strncpy_from_user+0x25/0x230 [ 40.310284][ T3979] ? kmem_cache_alloc_noprof+0x186/0x310 [ 40.310445][ T3979] ? getname_flags+0x80/0x3b0 [ 40.310486][ T3979] getname_flags+0xae/0x3b0 [ 40.310516][ T3979] user_path_at+0x28/0x130 [ 40.310618][ T3979] __se_sys_mount+0x25b/0x2e0 [ 40.310638][ T3979] ? fput+0x8f/0xc0 [ 40.310675][ T3979] __x64_sys_mount+0x67/0x80 [ 40.310695][ T3979] x64_sys_call+0x2b4d/0x2ff0 [ 40.310714][ T3979] do_syscall_64+0xd2/0x200 [ 40.310757][ T3979] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 40.310786][ T3979] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 40.310817][ T3979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 40.310840][ T3979] RIP: 0033:0x7f394f35ebe9 [ 40.310862][ T3979] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 40.310881][ T3979] RSP: 002b:00007f394dd7d038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 40.310900][ T3979] RAX: ffffffffffffffda RBX: 00007f394f596180 RCX: 00007f394f35ebe9 [ 40.310941][ T3979] RDX: 0000200000000580 RSI: 0000200000000540 RDI: 0000000000000000 [ 40.310954][ T3979] RBP: 00007f394dd7d090 R08: 0000200000000000 R09: 0000000000000000 [ 40.310967][ T3979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 40.310981][ T3979] R13: 00007f394f596218 R14: 00007f394f596180 R15: 00007ffcba259ae8 [ 40.311019][ T3979] [ 40.590301][ T3983] loop4: detected capacity change from 0 to 1024 [ 40.613059][ T3983] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 40.633407][ T3990] loop2: detected capacity change from 0 to 128 [ 40.642495][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.643387][ T3990] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 40.664250][ T3990] ext4 filesystem being mounted at /34/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 40.716626][ T3995] loop4: detected capacity change from 0 to 512 [ 40.726100][ T3308] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 40.736732][ T3995] EXT4-fs (loop4): too many log groups per flexible block group [ 40.744606][ T3995] EXT4-fs (loop4): failed to initialize mballoc (-12) [ 40.751725][ T3995] EXT4-fs (loop4): mount failed [ 40.800764][ T4003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.803429][ T4001] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 40.810868][ T4003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.830507][ T4001] process 'syz.4.177' launched './file0' with NULL argv: empty string added [ 40.931845][ T4020] loop3: detected capacity change from 0 to 512 [ 40.986924][ T4018] loop4: detected capacity change from 0 to 128 [ 41.003728][ T4020] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 41.014585][ T4018] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 41.027107][ T4030] __nla_validate_parse: 12 callbacks suppressed [ 41.027123][ T4030] netlink: 4 bytes leftover after parsing attributes in process `syz.0.187'. [ 41.040559][ T4020] EXT4-fs (loop3): 1 truncate cleaned up [ 41.048603][ T4018] ext4 filesystem being mounted at /44/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 41.065127][ T4020] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 41.090021][ T3302] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 41.155318][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.225283][ T4044] binfmt_misc: register: failed to install interpreter file ./file0 [ 41.231842][ T4040] FAULT_INJECTION: forcing a failure. [ 41.231842][ T4040] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 41.246817][ T4040] CPU: 1 UID: 0 PID: 4040 Comm: syz.3.192 Not tainted syzkaller #0 PREEMPT(voluntary) [ 41.246853][ T4040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 41.246867][ T4040] Call Trace: [ 41.246874][ T4040] [ 41.246894][ T4040] __dump_stack+0x1d/0x30 [ 41.246919][ T4040] dump_stack_lvl+0xe8/0x140 [ 41.246938][ T4040] dump_stack+0x15/0x1b [ 41.246953][ T4040] should_fail_ex+0x265/0x280 [ 41.246977][ T4040] should_fail_alloc_page+0xf2/0x100 [ 41.247015][ T4040] __alloc_frozen_pages_noprof+0xff/0x360 [ 41.247108][ T4040] alloc_pages_mpol+0xb3/0x250 [ 41.247144][ T4040] vma_alloc_folio_noprof+0x1aa/0x300 [ 41.247173][ T4040] do_wp_page+0x5db/0x24e0 [ 41.247216][ T4040] ? __rcu_read_lock+0x37/0x50 [ 41.247243][ T4040] handle_mm_fault+0x77d/0x2c20 [ 41.247330][ T4040] ? __rcu_read_unlock+0x4f/0x70 [ 41.247355][ T4040] do_user_addr_fault+0x3fe/0x1090 [ 41.247467][ T4040] exc_page_fault+0x62/0xa0 [ 41.247494][ T4040] asm_exc_page_fault+0x26/0x30 [ 41.247514][ T4040] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 41.247535][ T4040] Code: f6 01 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 41.247580][ T4040] RSP: 0018:ffffc9000f383930 EFLAGS: 00050206 [ 41.247597][ T4040] RAX: ffff88811b071b20 RBX: ffff88811dc41000 RCX: 00000000000006c0 [ 41.247609][ T4040] RDX: 0000000000000000 RSI: ffff88811dc41940 RDI: 0000200000002000 [ 41.247621][ T4040] RBP: 00002000000016c0 R08: 00000000000006d2 R09: 0000000000000000 [ 41.247632][ T4040] R10: 000188811dc41000 R11: 000188811dc41fff R12: 00002000000026c0 [ 41.247644][ T4040] R13: ffffc9000f383e80 R14: 0000000000001000 R15: 00007ffffffff000 [ 41.247661][ T4040] _copy_to_iter+0x141/0xe70 [ 41.247725][ T4040] ? xfd_validate_state+0x45/0xf0 [ 41.247761][ T4040] ? save_fpregs_to_fpstate+0x100/0x160 [ 41.247888][ T4040] copy_page_to_iter+0x18f/0x2d0 [ 41.247915][ T4040] sk_msg_recvmsg+0x1e4/0x900 [ 41.247943][ T4040] ? __list_del_entry_valid_or_report+0x65/0x130 [ 41.248020][ T4040] unix_bpf_recvmsg+0x272/0x730 [ 41.248050][ T4040] ? __pfx_woken_wake_function+0x10/0x10 [ 41.248119][ T4040] unix_dgram_recvmsg+0x67/0x90 [ 41.248143][ T4040] ? __pfx_unix_dgram_recvmsg+0x10/0x10 [ 41.248182][ T4040] sock_recvmsg+0x136/0x170 [ 41.248220][ T4040] ____sys_recvmsg+0xf5/0x280 [ 41.248247][ T4040] ___sys_recvmsg+0x11f/0x370 [ 41.248321][ T4040] __x64_sys_recvmsg+0xd1/0x160 [ 41.248346][ T4040] x64_sys_call+0x2b42/0x2ff0 [ 41.248367][ T4040] do_syscall_64+0xd2/0x200 [ 41.248392][ T4040] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 41.248485][ T4040] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 41.248512][ T4040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 41.248535][ T4040] RIP: 0033:0x7fbe691bebe9 [ 41.248551][ T4040] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 41.248590][ T4040] RSP: 002b:00007fbe67c1f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 41.248606][ T4040] RAX: ffffffffffffffda RBX: 00007fbe693f5fa0 RCX: 00007fbe691bebe9 [ 41.248618][ T4040] RDX: 0000000000000000 RSI: 00002000000004c0 RDI: 0000000000000005 [ 41.248631][ T4040] RBP: 00007fbe67c1f090 R08: 0000000000000000 R09: 0000000000000000 [ 41.248696][ T4040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 41.248707][ T4040] R13: 00007fbe693f6038 R14: 00007fbe693f5fa0 R15: 00007ffe65fd9918 [ 41.248723][ T4040] [ 41.658062][ T4059] loop3: detected capacity change from 0 to 128 [ 41.667227][ T4059] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 41.699095][ T4059] ext4 filesystem being mounted at /49/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 41.751864][ T3310] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 41.815321][ T4076] loop3: detected capacity change from 0 to 1024 [ 41.830048][ T4078] loop2: detected capacity change from 0 to 512 [ 41.848104][ T4078] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 41.860409][ T4076] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.916604][ T4057] SELinux: failed to load policy [ 41.923978][ T4078] EXT4-fs (loop2): 1 truncate cleaned up [ 41.940123][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.951663][ T4078] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.019885][ T4087] loop4: detected capacity change from 0 to 512 [ 42.071340][ T4087] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 42.089667][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.118144][ T4097] loop3: detected capacity change from 0 to 1024 [ 42.139013][ T4087] EXT4-fs (loop4): 1 truncate cleaned up [ 42.164025][ T4097] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.178221][ T4087] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.198871][ T4101] loop0: detected capacity change from 0 to 1024 [ 42.246265][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.255705][ T4101] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 42.266811][ T4101] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 42.278692][ T4101] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #2: comm syz.0.216: pblk 0 bad header/extent: invalid eh_entries - magic f30a, entries 2, max 1(4), depth 0(0) [ 42.297285][ T4101] EXT4-fs (loop0): no journal found [ 42.352089][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.411966][ T4116] loop4: detected capacity change from 0 to 1024 [ 42.440328][ T4111] netlink: 52 bytes leftover after parsing attributes in process `syz.2.220'. [ 42.449407][ T4111] netlink: 12 bytes leftover after parsing attributes in process `syz.2.220'. [ 42.458463][ T4111] netlink: 52 bytes leftover after parsing attributes in process `syz.2.220'. [ 42.467403][ T4111] netlink: 12 bytes leftover after parsing attributes in process `syz.2.220'. [ 42.476289][ T4111] netlink: 52 bytes leftover after parsing attributes in process `syz.2.220'. [ 42.485762][ T4123] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 42.503501][ T4116] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.549854][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.649905][ T4136] netlink: 4 bytes leftover after parsing attributes in process `syz.4.224'. [ 42.660980][ T4140] loop2: detected capacity change from 0 to 512 [ 42.668388][ T4140] EXT4-fs: Ignoring removed nomblk_io_submit option [ 42.668481][ T4140] EXT4-fs: Ignoring removed nomblk_io_submit option [ 42.669241][ T4140] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 42.677445][ T4140] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 42.677473][ T4140] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -2 [ 42.687540][ T4140] EXT4-fs (loop2): 1 truncate cleaned up [ 42.688079][ T4140] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.740170][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.790320][ T4147] netlink: 'syz.2.228': attribute type 10 has an invalid length. [ 42.823128][ T4151] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 43.227875][ T4172] netlink: 4 bytes leftover after parsing attributes in process `syz.3.237'. [ 43.484264][ T4180] FAULT_INJECTION: forcing a failure. [ 43.484264][ T4180] name failslab, interval 1, probability 0, space 0, times 0 [ 43.497067][ T4180] CPU: 1 UID: 0 PID: 4180 Comm: syz.3.241 Not tainted syzkaller #0 PREEMPT(voluntary) [ 43.497099][ T4180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 43.497112][ T4180] Call Trace: [ 43.497119][ T4180] [ 43.497126][ T4180] __dump_stack+0x1d/0x30 [ 43.497193][ T4180] dump_stack_lvl+0xe8/0x140 [ 43.497215][ T4180] dump_stack+0x15/0x1b [ 43.497230][ T4180] should_fail_ex+0x265/0x280 [ 43.497249][ T4180] should_failslab+0x8c/0xb0 [ 43.497271][ T4180] __kmalloc_noprof+0xa5/0x3e0 [ 43.497363][ T4180] ? tcp_sigpool_start+0xe7/0x1d0 [ 43.497383][ T4180] ? tcp_sigpool_start+0x1d/0x1d0 [ 43.497401][ T4180] tcp_sigpool_start+0xe7/0x1d0 [ 43.497498][ T4180] tcp_v4_md5_hash_skb+0xf7/0x2c0 [ 43.497543][ T4180] __tcp_transmit_skb+0x19d7/0x1a60 [ 43.497574][ T4180] ? skb_release_data+0x34a/0x370 [ 43.497616][ T4180] tcp_send_synack+0x459/0x470 [ 43.497637][ T4180] tcp_rcv_state_process+0xcda/0x1f90 [ 43.497715][ T4180] tcp_v4_do_rcv+0x489/0x740 [ 43.497755][ T4180] ? __pfx_tcp_v4_do_rcv+0x10/0x10 [ 43.497781][ T4180] sk_backlog_rcv+0x71/0x190 [ 43.497808][ T4180] __release_sock+0xb4/0x130 [ 43.497847][ T4180] ? __pfx_tcp_sendmsg+0x10/0x10 [ 43.497881][ T4180] release_sock+0x44/0x150 [ 43.497916][ T4180] tcp_sendmsg+0x39/0x50 [ 43.498003][ T4180] inet_sendmsg+0x76/0xd0 [ 43.498025][ T4180] __sock_sendmsg+0x102/0x180 [ 43.498050][ T4180] __sys_sendto+0x268/0x330 [ 43.498078][ T4180] __x64_sys_sendto+0x76/0x90 [ 43.498175][ T4180] x64_sys_call+0x2d05/0x2ff0 [ 43.498203][ T4180] do_syscall_64+0xd2/0x200 [ 43.498302][ T4180] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 43.498365][ T4180] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 43.498390][ T4180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 43.498410][ T4180] RIP: 0033:0x7fbe691bebe9 [ 43.498425][ T4180] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 43.498488][ T4180] RSP: 002b:00007fbe67c1f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 43.498507][ T4180] RAX: ffffffffffffffda RBX: 00007fbe693f5fa0 RCX: 00007fbe691bebe9 [ 43.498519][ T4180] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 43.498530][ T4180] RBP: 00007fbe67c1f090 R08: 0000200000000100 R09: 0000000000000010 [ 43.498541][ T4180] R10: 00000000240087f9 R11: 0000000000000246 R12: 0000000000000002 [ 43.498554][ T4180] R13: 00007fbe693f6038 R14: 00007fbe693f5fa0 R15: 00007ffe65fd9918 [ 43.498611][ T4180] [ 43.767917][ T4182] netlink: 'syz.4.242': attribute type 10 has an invalid length. [ 43.778772][ T4182] team0: Port device dummy0 added [ 43.992407][ T4199] netlink: 4 bytes leftover after parsing attributes in process `syz.4.246'. [ 44.081157][ T29] kauditd_printk_skb: 379 callbacks suppressed [ 44.081173][ T29] audit: type=1400 audit(1756995308.657:1397): avc: denied { create } for pid=4208 comm="syz.0.253" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 44.135890][ T4214] loop2: detected capacity change from 0 to 128 [ 44.150084][ T29] audit: type=1400 audit(1756995308.667:1398): avc: denied { sys_admin } for pid=4208 comm="syz.0.253" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 44.171316][ T29] audit: type=1326 audit(1756995308.717:1399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4213 comm="syz.2.254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 44.194632][ T29] audit: type=1326 audit(1756995308.717:1400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4213 comm="syz.2.254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 44.218284][ T29] audit: type=1326 audit(1756995308.717:1401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4213 comm="syz.2.254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 44.241675][ T29] audit: type=1326 audit(1756995308.717:1402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4213 comm="syz.2.254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f2889f3ec23 code=0x7ffc0000 [ 44.255798][ T4204] netlink: 4 bytes leftover after parsing attributes in process `syz.4.251'. [ 44.265106][ T29] audit: type=1326 audit(1756995308.717:1403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4213 comm="syz.2.254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f2889f3d69f code=0x7ffc0000 [ 44.297488][ T29] audit: type=1326 audit(1756995308.717:1404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4213 comm="syz.2.254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f2889f3ec77 code=0x7ffc0000 [ 44.297550][ T29] audit: type=1326 audit(1756995308.717:1405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4213 comm="syz.2.254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2889f3d550 code=0x7ffc0000 [ 44.297572][ T29] audit: type=1326 audit(1756995308.717:1406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4213 comm="syz.2.254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f2889f3e7eb code=0x7ffc0000 [ 44.325706][ T4214] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 44.326180][ T4214] ext4 filesystem being mounted at /52/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.341742][ T3308] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 44.478014][ T4222] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 44.511675][ T4222] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 44.547937][ T47] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.558882][ T47] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.592208][ T4228] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.601550][ T4228] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.607692][ T47] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.625453][ T47] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.661264][ T4231] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.692337][ T4236] C: renamed from team_slave_0 [ 44.739481][ T4231] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.807645][ T4246] loop3: detected capacity change from 0 to 512 [ 44.862840][ T4231] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.894219][ T4246] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 44.959751][ T4231] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.984770][ T4246] EXT4-fs (loop3): 1 truncate cleaned up [ 44.994644][ T4246] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.054215][ T31] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.067830][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.085291][ T31] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.132534][ T3438] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.150429][ T3438] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.386796][ T4251] netlink: 'syz.3.267': attribute type 27 has an invalid length. [ 45.394735][ T4251] netlink: 'syz.3.267': attribute type 3 has an invalid length. [ 45.446004][ T4253] netlink: 'syz.1.268': attribute type 27 has an invalid length. [ 45.453950][ T4253] netlink: 'syz.1.268': attribute type 3 has an invalid length. [ 46.111078][ T4281] __nla_validate_parse: 3 callbacks suppressed [ 46.117535][ T4281] netlink: 4 bytes leftover after parsing attributes in process `syz.1.277'. [ 46.500178][ T4291] 9pnet_fd: Insufficient options for proto=fd [ 46.609681][ T4293] loop2: detected capacity change from 0 to 2048 [ 46.665895][ T4293] loop2: p2 p3 p7 [ 46.758806][ T4296] netlink: 168 bytes leftover after parsing attributes in process `syz.4.283'. [ 46.810485][ T4300] loop4: detected capacity change from 0 to 512 [ 46.818670][ T4300] EXT4-fs: Ignoring removed nomblk_io_submit option [ 46.826768][ T4300] EXT4-fs: Ignoring removed nomblk_io_submit option [ 46.834058][ T4300] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 46.843602][ T4300] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 46.851977][ T4300] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -2 [ 46.860595][ T4300] EXT4-fs (loop4): 1 truncate cleaned up [ 46.866736][ T4300] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.893842][ T4304] netlink: 256 bytes leftover after parsing attributes in process `syz.3.286'. [ 46.944511][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.026882][ T4299] netlink: 'syz.2.284': attribute type 27 has an invalid length. [ 47.034781][ T4299] netlink: 'syz.2.284': attribute type 3 has an invalid length. [ 47.042614][ T4299] netlink: 132 bytes leftover after parsing attributes in process `syz.2.284'. [ 47.106799][ T4327] 9pnet_fd: Insufficient options for proto=fd [ 47.655648][ T4345] loop0: detected capacity change from 0 to 512 [ 47.662478][ T4345] EXT4-fs: Ignoring removed nomblk_io_submit option [ 47.669344][ T4345] EXT4-fs: Ignoring removed nomblk_io_submit option [ 47.676551][ T4345] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 47.685785][ T4345] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 47.694295][ T4345] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2 [ 47.703118][ T4345] EXT4-fs (loop0): 1 truncate cleaned up [ 47.709520][ T4345] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.740838][ T4346] loop2: detected capacity change from 0 to 1024 [ 47.757536][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.775511][ T4346] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 47.795353][ T4346] ext4 filesystem being mounted at /62/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 47.804750][ T4356] FAULT_INJECTION: forcing a failure. [ 47.804750][ T4356] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 47.819004][ T4356] CPU: 0 UID: 0 PID: 4356 Comm: syz.0.301 Not tainted syzkaller #0 PREEMPT(voluntary) [ 47.819032][ T4356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 47.819044][ T4356] Call Trace: [ 47.819051][ T4356] [ 47.819059][ T4356] __dump_stack+0x1d/0x30 [ 47.819082][ T4356] dump_stack_lvl+0xe8/0x140 [ 47.819123][ T4356] dump_stack+0x15/0x1b [ 47.819141][ T4356] should_fail_ex+0x265/0x280 [ 47.819163][ T4356] should_fail+0xb/0x20 [ 47.819216][ T4356] should_fail_usercopy+0x1a/0x20 [ 47.819239][ T4356] _copy_from_iter+0x390/0xe80 [ 47.819269][ T4356] ? __alloc_skb+0x24c/0x320 [ 47.819288][ T4356] tipc_msg_build+0x2e1/0x840 [ 47.819360][ T4356] ? __rcu_read_unlock+0x4f/0x70 [ 47.819386][ T4356] __tipc_sendstream+0x668/0xb30 [ 47.819413][ T4356] ? __pfx_woken_wake_function+0x10/0x10 [ 47.819434][ T4356] tipc_sendstream+0x3e/0x60 [ 47.819513][ T4356] ? __pfx_tipc_sendstream+0x10/0x10 [ 47.819545][ T4356] __sock_sendmsg+0x142/0x180 [ 47.819588][ T4356] ____sys_sendmsg+0x31e/0x4e0 [ 47.819616][ T4356] ___sys_sendmsg+0x17b/0x1d0 [ 47.819651][ T4356] __x64_sys_sendmsg+0xd4/0x160 [ 47.819765][ T4356] x64_sys_call+0x191e/0x2ff0 [ 47.819788][ T4356] do_syscall_64+0xd2/0x200 [ 47.819818][ T4356] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 47.819843][ T4356] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 47.819870][ T4356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 47.819940][ T4356] RIP: 0033:0x7f543801ebe9 [ 47.819958][ T4356] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 47.819982][ T4356] RSP: 002b:00007f5436a7f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 47.820002][ T4356] RAX: ffffffffffffffda RBX: 00007f5438255fa0 RCX: 00007f543801ebe9 [ 47.820015][ T4356] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 47.820026][ T4356] RBP: 00007f5436a7f090 R08: 0000000000000000 R09: 0000000000000000 [ 47.820038][ T4356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 47.820051][ T4356] R13: 00007f5438256038 R14: 00007f5438255fa0 R15: 00007ffcb5a2a878 [ 47.820086][ T4356] [ 48.078184][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.134584][ T4364] netlink: 4 bytes leftover after parsing attributes in process `syz.0.305'. [ 48.140817][ T4366] syz_tun: entered allmulticast mode [ 48.161560][ T4368] usb usb1: usbfs: process 4368 (syz.3.306) did not claim interface 0 before use [ 48.215316][ T4376] netlink: 'syz.3.309': attribute type 10 has an invalid length. [ 48.233180][ T4376] team0: Port device dummy0 added [ 48.243345][ T4380] netlink: 4 bytes leftover after parsing attributes in process `syz.0.312'. [ 48.267276][ T4385] FAULT_INJECTION: forcing a failure. [ 48.267276][ T4385] name failslab, interval 1, probability 0, space 0, times 0 [ 48.279972][ T4385] CPU: 1 UID: 0 PID: 4385 Comm: syz.3.313 Not tainted syzkaller #0 PREEMPT(voluntary) [ 48.279988][ T4385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 48.279994][ T4385] Call Trace: [ 48.279997][ T4385] [ 48.280082][ T4385] __dump_stack+0x1d/0x30 [ 48.280099][ T4385] dump_stack_lvl+0xe8/0x140 [ 48.280152][ T4385] dump_stack+0x15/0x1b [ 48.280160][ T4385] should_fail_ex+0x265/0x280 [ 48.280203][ T4385] ? selinux_bpf_map_create+0x36/0xd0 [ 48.280215][ T4385] should_failslab+0x8c/0xb0 [ 48.280266][ T4385] __kmalloc_cache_noprof+0x4c/0x320 [ 48.280281][ T4385] selinux_bpf_map_create+0x36/0xd0 [ 48.280337][ T4385] security_bpf_map_create+0x54/0xa0 [ 48.280347][ T4385] map_create+0xbac/0xca0 [ 48.280360][ T4385] ? security_bpf+0x2b/0x90 [ 48.280375][ T4385] __sys_bpf+0x545/0x7b0 [ 48.280459][ T4385] __x64_sys_bpf+0x41/0x50 [ 48.280471][ T4385] x64_sys_call+0x2aea/0x2ff0 [ 48.280523][ T4385] do_syscall_64+0xd2/0x200 [ 48.280537][ T4385] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 48.280629][ T4385] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 48.280642][ T4385] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 48.280701][ T4385] RIP: 0033:0x7fbe691bebe9 [ 48.280710][ T4385] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 48.280729][ T4385] RSP: 002b:00007fbe67c1f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 48.280833][ T4385] RAX: ffffffffffffffda RBX: 00007fbe693f5fa0 RCX: 00007fbe691bebe9 [ 48.280839][ T4385] RDX: 0000000000000050 RSI: 0000200000000640 RDI: 1900000000000000 [ 48.280845][ T4385] RBP: 00007fbe67c1f090 R08: 0000000000000000 R09: 0000000000000000 [ 48.280851][ T4385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 48.280857][ T4385] R13: 00007fbe693f6038 R14: 00007fbe693f5fa0 R15: 00007ffe65fd9918 [ 48.280868][ T4385] [ 48.471840][ T4370] netlink: 'syz.4.307': attribute type 27 has an invalid length. [ 48.479595][ T4370] netlink: 'syz.4.307': attribute type 3 has an invalid length. [ 48.487427][ T4370] netlink: 132 bytes leftover after parsing attributes in process `syz.4.307'. [ 48.575995][ T4389] loop3: detected capacity change from 0 to 1024 [ 48.594030][ T4389] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 48.606295][ T4389] ext4 filesystem being mounted at /74/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 48.639288][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.749132][ T4404] loop0: detected capacity change from 0 to 764 [ 48.756596][ T4404] rock: directory entry would overflow storage [ 48.763047][ T4404] rock: sig=0x4654, size=5, remaining=4 [ 48.797733][ T4407] lo: entered allmulticast mode [ 48.812597][ T4406] lo: left allmulticast mode [ 49.119966][ T4417] netlink: 'syz.2.324': attribute type 10 has an invalid length. [ 49.187554][ T29] kauditd_printk_skb: 489 callbacks suppressed [ 49.187587][ T29] audit: type=1400 audit(1756995313.757:1894): avc: denied { create } for pid=4422 comm="syz.2.326" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 49.214584][ T29] audit: type=1400 audit(1756995313.757:1895): avc: denied { mounton } for pid=4422 comm="syz.2.326" path="/66/file0" dev="tmpfs" ino=381 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 49.237838][ T29] audit: type=1400 audit(1756995313.757:1896): avc: denied { mount } for pid=4422 comm="syz.2.326" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 49.359725][ T29] audit: type=1400 audit(1756995313.867:1897): avc: denied { unmount } for pid=3308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 49.428363][ T29] audit: type=1400 audit(1756995313.967:1898): avc: denied { unlink } for pid=3308 comm="syz-executor" name="file0" dev="tmpfs" ino=381 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 49.451161][ T29] audit: type=1326 audit(1756995313.987:1899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4433 comm="syz.2.330" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 49.474723][ T29] audit: type=1326 audit(1756995313.987:1900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4433 comm="syz.2.330" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 49.498147][ T29] audit: type=1326 audit(1756995313.987:1901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4433 comm="syz.2.330" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 49.522028][ T29] audit: type=1326 audit(1756995313.987:1902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4433 comm="syz.2.330" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 49.545476][ T29] audit: type=1326 audit(1756995313.987:1903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4433 comm="syz.2.330" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2889f3ebe9 code=0x7ffc0000 [ 49.735934][ T4442] loop3: detected capacity change from 0 to 512 [ 49.771818][ T4442] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 49.808006][ T4442] EXT4-fs (loop3): 1 truncate cleaned up [ 49.817431][ T4442] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.885256][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.106696][ T4455] loop3: detected capacity change from 0 to 512 [ 50.107977][ T4459] loop0: detected capacity change from 0 to 164 [ 50.123521][ T4455] EXT4-fs: Ignoring removed nobh option [ 50.140635][ T4455] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 50.149803][ T4455] EXT4-fs (loop3): blocks per group (42) and clusters per group (32768) inconsistent [ 50.169217][ T4455] Driver unsupported XDP return value 0 on prog (id 348) dev N/A, expect packet loss! [ 50.180427][ T4455] I/O error, dev loop3, sector 2 op 0x0:(READ) flags 0x1000 phys_seg 1 prio class 2 [ 50.184062][ T4461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.190996][ T4455] EXT4-fs (loop3): unable to read superblock [ 50.203394][ T4461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.266066][ T4467] loop2: detected capacity change from 0 to 256 [ 50.287317][ T4469] loop0: detected capacity change from 0 to 128 [ 50.308432][ T4469] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000100) [ 50.316481][ T4469] FAT-fs (loop0): Filesystem has been set read-only [ 50.323193][ T4467] FAT-fs (loop2): codepage cp932 not found [ 50.325423][ T4469] syz.0.343: attempt to access beyond end of device [ 50.325423][ T4469] loop0: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 50.343651][ T4469] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000100) [ 50.351657][ T4469] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000100) [ 50.365101][ T4469] syz.0.343: attempt to access beyond end of device [ 50.365101][ T4469] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 50.378794][ T4469] syz.0.343: attempt to access beyond end of device [ 50.378794][ T4469] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 50.392237][ T4469] syz.0.343: attempt to access beyond end of device [ 50.392237][ T4469] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 50.414563][ T4469] syz.0.343: attempt to access beyond end of device [ 50.414563][ T4469] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 50.438323][ T4469] syz.0.343: attempt to access beyond end of device [ 50.438323][ T4469] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 50.452164][ T4469] syz.0.343: attempt to access beyond end of device [ 50.452164][ T4469] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 50.472883][ T4469] syz.0.343: attempt to access beyond end of device [ 50.472883][ T4469] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 50.487065][ T4469] syz.0.343: attempt to access beyond end of device [ 50.487065][ T4469] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 50.489863][ T4477] syz_tun: entered allmulticast mode [ 50.500572][ T4469] syz.0.343: attempt to access beyond end of device [ 50.500572][ T4469] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 50.550264][ T4481] serio: Serial port ptm1 [ 50.555039][ T4476] syz_tun: left allmulticast mode [ 50.588064][ T4483] netlink: 4 bytes leftover after parsing attributes in process `syz.3.350'. [ 51.115519][ C0] vcan0: j1939_tp_rxtimer: 0xffff88811b0da600: rx timeout, send abort [ 51.488440][ T4509] 9pnet_fd: Insufficient options for proto=fd [ 51.556350][ T4515] loop0: detected capacity change from 0 to 2048 [ 51.581247][ T4515] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 51.601588][ T4515] EXT4-fs error (device loop0): ext4_find_inline_data_nolock:169: inode #12: comm +}[@: inline data xattr refers to an external xattr inode [ 51.615546][ C0] vcan0: j1939_tp_rxtimer: 0xffff88811b0da800: rx timeout, send abort [ 51.617244][ T4515] EXT4-fs (loop0): Remounting filesystem read-only [ 51.624746][ C0] vcan0: j1939_tp_rxtimer: 0xffff88811b0da600: abort rx timeout. Force session deactivation [ 51.680895][ T4525] netlink: 4 bytes leftover after parsing attributes in process `syz.1.364'. [ 51.755919][ T4533] netlink: 168 bytes leftover after parsing attributes in process `syz.3.366'. [ 51.785547][ T4542] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.804695][ T4533] C: renamed from team_slave_0 (while UP) [ 51.817838][ T4542] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.923559][ T4547] FAULT_INJECTION: forcing a failure. [ 51.923559][ T4547] name failslab, interval 1, probability 0, space 0, times 0 [ 51.936465][ T4547] CPU: 0 UID: 0 PID: 4547 Comm: syz.4.368 Not tainted syzkaller #0 PREEMPT(voluntary) [ 51.936506][ T4547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 51.936517][ T4547] Call Trace: [ 51.936580][ T4547] [ 51.936589][ T4547] __dump_stack+0x1d/0x30 [ 51.936611][ T4547] dump_stack_lvl+0xe8/0x140 [ 51.936628][ T4547] dump_stack+0x15/0x1b [ 51.936684][ T4547] should_fail_ex+0x265/0x280 [ 51.936708][ T4547] should_failslab+0x8c/0xb0 [ 51.936785][ T4547] __kmalloc_noprof+0xa5/0x3e0 [ 51.936809][ T4547] ? ethnl_default_doit+0x13d/0x970 [ 51.936900][ T4547] ethnl_default_doit+0x13d/0x970 [ 51.936925][ T4547] ? genl_family_rcv_msg_attrs_parse+0x13b/0x190 [ 51.936953][ T4547] ? genl_family_rcv_msg_attrs_parse+0x184/0x190 [ 51.936990][ T4547] genl_family_rcv_msg_doit+0x140/0x1b0 [ 51.937161][ T4547] genl_rcv_msg+0x422/0x460 [ 51.937185][ T4547] ? __pfx_ethnl_default_doit+0x10/0x10 [ 51.937211][ T4547] netlink_rcv_skb+0x120/0x220 [ 51.937233][ T4547] ? __pfx_genl_rcv_msg+0x10/0x10 [ 51.937294][ T4547] genl_rcv+0x28/0x40 [ 51.937317][ T4547] netlink_unicast+0x5c0/0x690 [ 51.937411][ T4547] netlink_sendmsg+0x58b/0x6b0 [ 51.937438][ T4547] ? __pfx_netlink_sendmsg+0x10/0x10 [ 51.937460][ T4547] __sock_sendmsg+0x142/0x180 [ 51.937485][ T4547] ____sys_sendmsg+0x31e/0x4e0 [ 51.937547][ T4547] ___sys_sendmsg+0x17b/0x1d0 [ 51.937583][ T4547] __x64_sys_sendmsg+0xd4/0x160 [ 51.937612][ T4547] x64_sys_call+0x191e/0x2ff0 [ 51.937688][ T4547] do_syscall_64+0xd2/0x200 [ 51.937720][ T4547] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 51.937747][ T4547] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 51.937808][ T4547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 51.937896][ T4547] RIP: 0033:0x7f6a602febe9 [ 51.937913][ T4547] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 51.937933][ T4547] RSP: 002b:00007f6a5ed5f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 51.937952][ T4547] RAX: ffffffffffffffda RBX: 00007f6a60535fa0 RCX: 00007f6a602febe9 [ 51.937964][ T4547] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 51.937976][ T4547] RBP: 00007f6a5ed5f090 R08: 0000000000000000 R09: 0000000000000000 [ 51.937988][ T4547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 51.938001][ T4547] R13: 00007f6a60536038 R14: 00007f6a60535fa0 R15: 00007ffedd4bd318 [ 51.938081][ T4547] [ 52.184072][ C0] vcan0: j1939_tp_rxtimer: 0xffff88811b0da800: abort rx timeout. Force session deactivation [ 52.203116][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.289159][ T4559] netlink: 72 bytes leftover after parsing attributes in process `syz.4.373'. [ 52.382534][ T4564] netlink: 4 bytes leftover after parsing attributes in process `syz.3.374'. [ 52.498396][ T4571] netlink: 4 bytes leftover after parsing attributes in process `syz.4.375'. [ 52.874513][ T4576] netlink: 4 bytes leftover after parsing attributes in process `syz.4.378'. [ 52.952692][ T4582] netlink: 4 bytes leftover after parsing attributes in process `syz.4.378'. [ 53.156707][ T4587] netlink: 52 bytes leftover after parsing attributes in process `syz.1.382'. [ 53.165755][ T4587] netlink: 12 bytes leftover after parsing attributes in process `syz.1.382'. [ 53.174692][ T4587] netlink: 52 bytes leftover after parsing attributes in process `syz.1.382'. [ 53.207915][ T4591] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.263364][ T4591] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.315334][ T4594] netlink: 'syz.0.385': attribute type 13 has an invalid length. [ 53.325088][ T4591] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.335206][ T4589] loop4: detected capacity change from 0 to 2048 [ 53.344551][ T4594] FAULT_INJECTION: forcing a failure. [ 53.344551][ T4594] name failslab, interval 1, probability 0, space 0, times 0 [ 53.357312][ T4594] CPU: 0 UID: 0 PID: 4594 Comm: syz.0.385 Not tainted syzkaller #0 PREEMPT(voluntary) [ 53.357374][ T4594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 53.357450][ T4594] Call Trace: [ 53.357457][ T4594] [ 53.357465][ T4594] __dump_stack+0x1d/0x30 [ 53.357486][ T4594] dump_stack_lvl+0xe8/0x140 [ 53.357565][ T4594] dump_stack+0x15/0x1b [ 53.357583][ T4594] should_fail_ex+0x265/0x280 [ 53.357605][ T4594] ? ____ip_mc_inc_group+0x1c9/0x5c0 [ 53.357628][ T4594] should_failslab+0x8c/0xb0 [ 53.357650][ T4594] __kmalloc_cache_noprof+0x4c/0x320 [ 53.357723][ T4594] ____ip_mc_inc_group+0x1c9/0x5c0 [ 53.357753][ T4594] ip_mc_up+0xbd/0x150 [ 53.357838][ T4594] inetdev_event+0x9f9/0xc10 [ 53.357858][ T4594] ? ib_netdevice_event+0x281/0x5f0 [ 53.357880][ T4594] ? __pfx_arp_netdev_event+0x10/0x10 [ 53.357906][ T4594] ? __pfx_inetdev_event+0x10/0x10 [ 53.357927][ T4594] raw_notifier_call_chain+0x6c/0x1b0 [ 53.357978][ T4594] ? call_netdevice_notifiers_info+0x9c/0x100 [ 53.358019][ T4594] call_netdevice_notifiers_info+0xae/0x100 [ 53.358052][ T4594] __dev_notify_flags+0xff/0x1a0 [ 53.358090][ T4594] netif_change_flags+0xac/0xd0 [ 53.358112][ T4594] do_setlink+0x9d2/0x2810 [ 53.358149][ T4594] ? __schedule+0x6b9/0xb30 [ 53.358206][ T4594] ? __list_del_entry_valid_or_report+0x65/0x130 [ 53.358232][ T4594] ? _raw_spin_unlock_irqrestore+0x2b/0x60 [ 53.358253][ T4594] ? __mutex_lock+0x25d/0xcc0 [ 53.358283][ T4594] rtnl_newlink+0xd8b/0x12d0 [ 53.358380][ T4594] ? xas_load+0x413/0x430 [ 53.358406][ T4594] ? xas_load+0x413/0x430 [ 53.358428][ T4594] ? css_rstat_updated+0xb7/0x240 [ 53.358488][ T4594] ? mod_memcg_lruvec_state+0x1fc/0x2c0 [ 53.358518][ T4594] ? __rcu_read_unlock+0x4f/0x70 [ 53.358548][ T4594] ? avc_has_perm_noaudit+0x1b1/0x200 [ 53.358614][ T4594] ? cred_has_capability+0x210/0x280 [ 53.358640][ T4594] ? selinux_capable+0x31/0x40 [ 53.358688][ T4594] ? security_capable+0x83/0x90 [ 53.358709][ T4594] ? ns_capable+0x7d/0xb0 [ 53.358751][ T4594] ? __pfx_rtnl_newlink+0x10/0x10 [ 53.358781][ T4594] rtnetlink_rcv_msg+0x5fb/0x6d0 [ 53.358813][ T4594] ? avc_has_perm_noaudit+0x1b1/0x200 [ 53.358888][ T4594] netlink_rcv_skb+0x120/0x220 [ 53.358913][ T4594] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 53.358948][ T4594] rtnetlink_rcv+0x1c/0x30 [ 53.359050][ T4594] netlink_unicast+0x5c0/0x690 [ 53.359069][ T4594] netlink_sendmsg+0x58b/0x6b0 [ 53.359091][ T4594] ? __pfx_netlink_sendmsg+0x10/0x10 [ 53.359179][ T4594] __sock_sendmsg+0x142/0x180 [ 53.359210][ T4594] ____sys_sendmsg+0x31e/0x4e0 [ 53.359238][ T4594] ___sys_sendmsg+0x17b/0x1d0 [ 53.359348][ T4594] __x64_sys_sendmsg+0xd4/0x160 [ 53.359376][ T4594] x64_sys_call+0x191e/0x2ff0 [ 53.359398][ T4594] do_syscall_64+0xd2/0x200 [ 53.359486][ T4594] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 53.359552][ T4594] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 53.359581][ T4594] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 53.359675][ T4594] RIP: 0033:0x7f543801ebe9 [ 53.359692][ T4594] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 53.359711][ T4594] RSP: 002b:00007f5436a7f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 53.359731][ T4594] RAX: ffffffffffffffda RBX: 00007f5438255fa0 RCX: 00007f543801ebe9 [ 53.359745][ T4594] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 53.359758][ T4594] RBP: 00007f5436a7f090 R08: 0000000000000000 R09: 0000000000000000 [ 53.359771][ T4594] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 53.359836][ T4594] R13: 00007f5438256038 R14: 00007f5438255fa0 R15: 00007ffcb5a2a878 [ 53.359855][ T4594] [ 53.727542][ T4594] gretap0: refused to change device tx_queue_len [ 53.738208][ T4594] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 53.756227][ T4589] loop4: p2 p3 p7 [ 53.773059][ T4591] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.905944][ T41] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.926985][ T56] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.983346][ T56] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.987824][ T4606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.001984][ T56] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.024354][ T4606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.754305][ T4653] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 54.778544][ T4653] FAULT_INJECTION: forcing a failure. [ 54.778544][ T4653] name failslab, interval 1, probability 0, space 0, times 0 [ 54.791283][ T4653] CPU: 1 UID: 0 PID: 4653 Comm: syz.2.403 Not tainted syzkaller #0 PREEMPT(voluntary) [ 54.791312][ T4653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 54.791326][ T4653] Call Trace: [ 54.791334][ T4653] [ 54.791343][ T4653] __dump_stack+0x1d/0x30 [ 54.791431][ T4653] dump_stack_lvl+0xe8/0x140 [ 54.791449][ T4653] dump_stack+0x15/0x1b [ 54.791465][ T4653] should_fail_ex+0x265/0x280 [ 54.791484][ T4653] should_failslab+0x8c/0xb0 [ 54.791506][ T4653] kmem_cache_alloc_lru_noprof+0x55/0x310 [ 54.791566][ T4653] ? debugfs_alloc_inode+0x34/0x40 [ 54.791667][ T4653] ? lookup_noperm+0xc9/0x180 [ 54.791695][ T4653] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 54.791725][ T4653] debugfs_alloc_inode+0x34/0x40 [ 54.791797][ T4653] alloc_inode+0x40/0x170 [ 54.791820][ T4653] new_inode+0x1d/0xe0 [ 54.791846][ T4653] __debugfs_create_file+0x109/0x330 [ 54.791876][ T4653] debugfs_create_file_full+0x3f/0x60 [ 54.791956][ T4653] ? __pfx_wg_setup+0x10/0x10 [ 54.791985][ T4653] ref_tracker_dir_debugfs+0x100/0x1e0 [ 54.792016][ T4653] alloc_netdev_mqs+0x1a2/0xa30 [ 54.792042][ T4653] rtnl_create_link+0x239/0x710 [ 54.792074][ T4653] rtnl_newlink_create+0x14c/0x620 [ 54.792108][ T4653] ? security_capable+0x83/0x90 [ 54.792139][ T4653] ? netlink_ns_capable+0x86/0xa0 [ 54.792208][ T4653] rtnl_newlink+0xf29/0x12d0 [ 54.792237][ T4653] ? xas_load+0x413/0x430 [ 54.792263][ T4653] ? __memcg_slab_free_hook+0x135/0x230 [ 54.792377][ T4653] ? __rcu_read_unlock+0x4f/0x70 [ 54.792400][ T4653] ? avc_has_perm_noaudit+0x1b1/0x200 [ 54.792460][ T4653] ? cred_has_capability+0x210/0x280 [ 54.792486][ T4653] ? selinux_capable+0x31/0x40 [ 54.792599][ T4653] ? security_capable+0x83/0x90 [ 54.792631][ T4653] ? ns_capable+0x7d/0xb0 [ 54.792702][ T4653] ? __pfx_rtnl_newlink+0x10/0x10 [ 54.792744][ T4653] rtnetlink_rcv_msg+0x5fb/0x6d0 [ 54.792779][ T4653] netlink_rcv_skb+0x120/0x220 [ 54.792848][ T4653] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 54.792881][ T4653] rtnetlink_rcv+0x1c/0x30 [ 54.792911][ T4653] netlink_unicast+0x5c0/0x690 [ 54.792936][ T4653] netlink_sendmsg+0x58b/0x6b0 [ 54.793022][ T4653] ? __pfx_netlink_sendmsg+0x10/0x10 [ 54.793046][ T4653] __sock_sendmsg+0x142/0x180 [ 54.793078][ T4653] ____sys_sendmsg+0x31e/0x4e0 [ 54.793130][ T4653] ___sys_sendmsg+0x17b/0x1d0 [ 54.793164][ T4653] __x64_sys_sendmsg+0xd4/0x160 [ 54.793264][ T4653] x64_sys_call+0x191e/0x2ff0 [ 54.793294][ T4653] do_syscall_64+0xd2/0x200 [ 54.793395][ T4653] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 54.793421][ T4653] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 54.793469][ T4653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 54.793494][ T4653] RIP: 0033:0x7f2889f3ebe9 [ 54.793579][ T4653] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 54.793599][ T4653] RSP: 002b:00007f28889a7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 54.793655][ T4653] RAX: ffffffffffffffda RBX: 00007f288a175fa0 RCX: 00007f2889f3ebe9 [ 54.793667][ T4653] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 54.793679][ T4653] RBP: 00007f28889a7090 R08: 0000000000000000 R09: 0000000000000000 [ 54.793690][ T4653] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 54.793765][ T4653] R13: 00007f288a176038 R14: 00007f288a175fa0 R15: 00007ffedf1c6138 [ 54.793790][ T4653] [ 54.793796][ T4653] debugfs: out of free dentries, can not create file 'netdev@ffff88811a98c550' [ 55.171267][ T4653] wireguard0: entered promiscuous mode [ 55.176964][ T4653] wireguard0: entered allmulticast mode [ 55.178989][ T4658] FAULT_INJECTION: forcing a failure. [ 55.178989][ T4658] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 55.195737][ T4658] CPU: 1 UID: 0 PID: 4658 Comm: syz.1.405 Not tainted syzkaller #0 PREEMPT(voluntary) [ 55.195802][ T4658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 55.195813][ T4658] Call Trace: [ 55.195819][ T4658] [ 55.195826][ T4658] __dump_stack+0x1d/0x30 [ 55.195848][ T4658] dump_stack_lvl+0xe8/0x140 [ 55.195868][ T4658] dump_stack+0x15/0x1b [ 55.195888][ T4658] should_fail_ex+0x265/0x280 [ 55.195941][ T4658] should_fail+0xb/0x20 [ 55.195958][ T4658] should_fail_usercopy+0x1a/0x20 [ 55.195980][ T4658] _copy_from_iter+0xd2/0xe80 [ 55.196006][ T4658] ? __build_skb_around+0x1a0/0x200 [ 55.196105][ T4658] ? __alloc_skb+0x223/0x320 [ 55.196214][ T4658] netlink_sendmsg+0x471/0x6b0 [ 55.196239][ T4658] ? __pfx_netlink_sendmsg+0x10/0x10 [ 55.196259][ T4658] __sock_sendmsg+0x142/0x180 [ 55.196383][ T4658] ____sys_sendmsg+0x31e/0x4e0 [ 55.196410][ T4658] ___sys_sendmsg+0x17b/0x1d0 [ 55.196512][ T4658] __x64_sys_sendmsg+0xd4/0x160 [ 55.196538][ T4658] x64_sys_call+0x191e/0x2ff0 [ 55.196556][ T4658] do_syscall_64+0xd2/0x200 [ 55.196581][ T4658] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 55.196691][ T4658] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 55.196733][ T4658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 55.196755][ T4658] RIP: 0033:0x7f394f35ebe9 [ 55.196773][ T4658] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 55.196792][ T4658] RSP: 002b:00007f394ddbf038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 55.196811][ T4658] RAX: ffffffffffffffda RBX: 00007f394f595fa0 RCX: 00007f394f35ebe9 [ 55.196825][ T4658] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 55.196838][ T4658] RBP: 00007f394ddbf090 R08: 0000000000000000 R09: 0000000000000000 [ 55.196894][ T4658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 55.196905][ T4658] R13: 00007f394f596038 R14: 00007f394f595fa0 R15: 00007ffcba259ae8 [ 55.196921][ T4658] [ 55.421217][ T29] kauditd_printk_skb: 278 callbacks suppressed [ 55.421234][ T29] audit: type=1400 audit(1756995319.997:2182): avc: denied { create } for pid=4659 comm="syz.1.406" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 55.446985][ T29] audit: type=1400 audit(1756995319.997:2183): avc: denied { ioctl } for pid=4659 comm="syz.1.406" path="socket:[8107]" dev="sockfs" ino=8107 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 55.574808][ T4673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.575005][ T4673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.595087][ T29] audit: type=1326 audit(1756995320.167:2184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.0.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f543801ebe9 code=0x7ffc0000 [ 55.595124][ T29] audit: type=1326 audit(1756995320.177:2185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.0.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=255 compat=0 ip=0x7f543801ebe9 code=0x7ffc0000 [ 55.595153][ T29] audit: type=1326 audit(1756995320.177:2186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.0.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f543801ebe9 code=0x7ffc0000 [ 55.595240][ T29] audit: type=1326 audit(1756995320.177:2187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.0.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7f543801ebe9 code=0x7ffc0000 [ 55.595348][ T29] audit: type=1326 audit(1756995320.177:2188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.0.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f543801ebe9 code=0x7ffc0000 [ 55.595375][ T29] audit: type=1326 audit(1756995320.177:2189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.0.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f543801ebe9 code=0x7ffc0000 [ 55.595402][ T29] audit: type=1326 audit(1756995320.177:2190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.0.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f543801ebe9 code=0x7ffc0000 [ 55.595480][ T29] audit: type=1326 audit(1756995320.177:2191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4665 comm="syz.0.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f543801ebe9 code=0x7ffc0000 [ 55.664708][ T4679] usb usb1: check_ctrlrecip: process 4679 (syz.3.413) requesting ep 01 but needs 81 [ 55.664739][ T4679] usb usb1: usbfs: process 4679 (syz.3.413) did not claim interface 0 before use [ 55.707158][ T4682] FAULT_INJECTION: forcing a failure. [ 55.707158][ T4682] name failslab, interval 1, probability 0, space 0, times 0 [ 55.707189][ T4682] CPU: 1 UID: 0 PID: 4682 Comm: syz.0.414 Not tainted syzkaller #0 PREEMPT(voluntary) [ 55.707286][ T4682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 55.707298][ T4682] Call Trace: [ 55.707306][ T4682] [ 55.707315][ T4682] __dump_stack+0x1d/0x30 [ 55.707340][ T4682] dump_stack_lvl+0xe8/0x140 [ 55.707362][ T4682] dump_stack+0x15/0x1b [ 55.707380][ T4682] should_fail_ex+0x265/0x280 [ 55.707413][ T4682] should_failslab+0x8c/0xb0 [ 55.707439][ T4682] kmem_cache_alloc_node_noprof+0x57/0x320 [ 55.707470][ T4682] ? __alloc_skb+0x101/0x320 [ 55.707491][ T4682] __alloc_skb+0x101/0x320 [ 55.707583][ T4682] alloc_uevent_skb+0x5c/0x120 [ 55.707604][ T4682] kobject_uevent_net_broadcast+0x23c/0x410 [ 55.707626][ T4682] kobject_uevent_env+0x43d/0x570 [ 55.707647][ T4682] kobject_uevent+0x1d/0x30 [ 55.707705][ T4682] device_del+0x710/0x790 [ 55.707732][ T4682] ? __try_to_del_timer_sync+0x152/0x170 [ 55.707816][ T4682] device_unregister+0x15/0x40 [ 55.707840][ T4682] wakeup_source_sysfs_remove+0x25/0x30 [ 55.707933][ T4682] wakeup_source_unregister+0xf0/0x330 [ 55.707963][ T4682] ep_destroy_wakeup_source+0x3a/0x50 [ 55.707996][ T4682] ep_modify+0xb0/0x450 [ 55.708041][ T4682] do_epoll_ctl+0x611/0x8a0 [ 55.708072][ T4682] __x64_sys_epoll_ctl+0xcb/0x100 [ 55.708107][ T4682] x64_sys_call+0x706/0x2ff0 [ 55.708130][ T4682] do_syscall_64+0xd2/0x200 [ 55.708237][ T4682] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 55.708272][ T4682] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 55.708300][ T4682] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 55.708322][ T4682] RIP: 0033:0x7f543801ebe9 [ 55.708339][ T4682] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 55.708357][ T4682] RSP: 002b:00007f5436a7f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 55.708418][ T4682] RAX: ffffffffffffffda RBX: 00007f5438255fa0 RCX: 00007f543801ebe9 [ 55.708502][ T4682] RDX: 0000000000000004 RSI: 0000000000000003 RDI: 0000000000000003 [ 55.708514][ T4682] RBP: 00007f5436a7f090 R08: 0000000000000000 R09: 0000000000000000 [ 55.708526][ T4682] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 55.708538][ T4682] R13: 00007f5438256038 R14: 00007f5438255fa0 R15: 00007ffcb5a2a878 [ 55.708554][ T4682] [ 55.735887][ T4684] loop3: detected capacity change from 0 to 512 [ 55.745427][ T4684] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 55.771473][ T4684] EXT4-fs (loop3): 1 truncate cleaned up [ 56.126053][ T4684] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.199428][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.219741][ T4697] team_slave_0: entered promiscuous mode [ 56.225605][ T4697] team_slave_1: entered promiscuous mode [ 56.236469][ T4701] 9pnet_fd: Insufficient options for proto=fd [ 56.253594][ T4697] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 56.266490][ T4701] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 56.314441][ T4707] loop2: detected capacity change from 0 to 512 [ 56.315903][ T4705] C: renamed from team_slave_0 (while UP) [ 56.324307][ T4707] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 56.365316][ T4707] EXT4-fs (loop2): 1 truncate cleaned up [ 56.375991][ T4707] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.407557][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.462169][ T4720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.474920][ T4712] loop4: detected capacity change from 0 to 1024 [ 56.484503][ T4720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.495900][ T4712] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 56.518525][ T4712] ext4 filesystem being mounted at /102/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 56.613254][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.613335][ T4729] loop2: detected capacity change from 0 to 2048 [ 56.667390][ T3296] loop2: p2 p3 p7 [ 56.690199][ T4729] loop2: p2 p3 p7 [ 56.748439][ T4742] 9pnet_fd: Insufficient options for proto=fd [ 56.793449][ T4742] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 56.900511][ T4748] __nla_validate_parse: 13 callbacks suppressed [ 56.900526][ T4748] netlink: 52 bytes leftover after parsing attributes in process `syz.4.439'. [ 56.916144][ T4748] netlink: 12 bytes leftover after parsing attributes in process `syz.4.439'. [ 56.925261][ T4748] netlink: 52 bytes leftover after parsing attributes in process `syz.4.439'. [ 56.934175][ T4748] netlink: 12 bytes leftover after parsing attributes in process `syz.4.439'. [ 56.943530][ T4748] netlink: 52 bytes leftover after parsing attributes in process `syz.4.439'. [ 56.960893][ T3288] udevd[3288]: inotify_add_watch(7, /dev/loop2p7, 10) failed: No such file or directory [ 56.960919][ T3509] udevd[3509]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 56.961227][ T3296] udevd[3296]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 56.971848][ T4754] loop0: detected capacity change from 0 to 1024 [ 56.999955][ T4761] netlink: 8 bytes leftover after parsing attributes in process `syz.4.443'. [ 57.043691][ T4754] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 57.056759][ T4754] ext4 filesystem being mounted at /77/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 57.088146][ T4756] netlink: 4 bytes leftover after parsing attributes in process `syz.2.441'. [ 57.295217][ T4778] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.323744][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.363416][ T4778] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.423706][ T4778] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.472753][ T4778] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.487985][ T4784] netlink: 32 bytes leftover after parsing attributes in process `syz.3.451'. [ 57.498871][ T4784] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4784 comm=syz.3.451 [ 57.545420][ T4788] netlink: 'syz.2.453': attribute type 10 has an invalid length. [ 57.556436][ T4782] netlink: 4 bytes leftover after parsing attributes in process `syz.3.451'. [ 57.587886][ T4790] netlink: 4 bytes leftover after parsing attributes in process `syz.2.454'. [ 57.857124][ T4806] loop3: detected capacity change from 0 to 1024 [ 58.024489][ T4806] ext4 filesystem being mounted at /115/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 58.111236][ T4811] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 58.305153][ T4819] netlink: 'syz.4.464': attribute type 10 has an invalid length. [ 58.340965][ T4823] loop4: detected capacity change from 0 to 512 [ 58.350420][ T4823] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 58.369445][ T4823] EXT4-fs (loop4): 1 truncate cleaned up [ 58.459740][ T4821] team0: Port device dummy0 removed [ 58.469652][ T4821] bridge_slave_0: left allmulticast mode [ 58.475055][ T4833] EXT4-fs error (device loop4): ext4_iget_extra_inode:5104: inode #12: comm syz.4.466: corrupted in-inode xattr: bad e_name length [ 58.475377][ T4821] bridge_slave_0: left promiscuous mode [ 58.494955][ T4821] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.505099][ T4821] bridge_slave_1: left allmulticast mode [ 58.510849][ T4821] bridge_slave_1: left promiscuous mode [ 58.516599][ T4821] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.522790][ T4833] EXT4-fs error (device loop4): ext4_iget_extra_inode:5104: inode #12: comm syz.4.466: corrupted in-inode xattr: bad e_name length [ 58.542306][ T4821] bond0: (slave bond_slave_0): Releasing backup interface [ 58.553874][ T4821] bond0: (slave bond_slave_1): Releasing backup interface [ 58.616636][ T4821] team0: Port device C removed [ 58.624871][ T4821] team0: Port device team_slave_1 removed [ 58.632463][ T4821] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 58.639923][ T4821] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 58.653222][ T4821] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 58.660718][ T4821] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 58.743624][ T4832] IPVS: Error connecting to the multicast addr [ 59.106025][ T4843] loop4: detected capacity change from 0 to 2048 [ 59.170537][ T3296] loop4: p2 p3 p7 [ 59.319522][ T4843] loop4: p2 p3 p7 [ 59.453941][ T4856] loop3: detected capacity change from 0 to 1024 [ 59.474327][ T41] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.484235][ T4856] ext4 filesystem being mounted at /120/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 59.535984][ T56] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.558828][ T56] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.567974][ T56] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.605991][ T4865] 9pnet_fd: Insufficient options for proto=fd [ 59.676097][ T4871] loop2: detected capacity change from 0 to 512 [ 59.699658][ T4871] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 59.797996][ T4871] EXT4-fs (loop2): 1 truncate cleaned up [ 60.040805][ T4881] loop4: detected capacity change from 0 to 2048 [ 60.330178][ T4881] loop4: p2 p3 p7 [ 60.352744][ T2994] loop4: p2 p3 p7 [ 60.430755][ T4896] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 60.498230][ T4901] loop2: detected capacity change from 0 to 512 [ 60.506875][ T4901] EXT4-fs: Ignoring removed nomblk_io_submit option [ 60.522011][ T4901] EXT4-fs: Ignoring removed nomblk_io_submit option [ 60.529662][ T4896] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 60.530827][ T4901] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 60.552050][ T29] kauditd_printk_skb: 564 callbacks suppressed [ 60.552064][ T29] audit: type=1326 audit(1756995325.127:2756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="syz.4.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a602febe9 code=0x7ffc0000 [ 60.557806][ T3509] udevd[3509]: inotify_add_watch(7, /dev/loop4p7, 10) failed: No such file or directory [ 60.558343][ T29] audit: type=1326 audit(1756995325.127:2757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="syz.4.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=255 compat=0 ip=0x7f6a602febe9 code=0x7ffc0000 [ 60.558367][ T29] audit: type=1326 audit(1756995325.127:2758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="syz.4.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a602febe9 code=0x7ffc0000 [ 60.558389][ T29] audit: type=1326 audit(1756995325.137:2759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="syz.4.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a602febe9 code=0x7ffc0000 [ 60.558410][ T29] audit: type=1326 audit(1756995325.137:2760): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="syz.4.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7f6a602febe9 code=0x7ffc0000 [ 60.584201][ T3296] udevd[3296]: inotify_add_watch(7, /dev/loop4p3, 10) failed: No such file or directory [ 60.601595][ T4902] loop4: detected capacity change from 0 to 1024 [ 60.644863][ T29] audit: type=1326 audit(1756995325.177:2761): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="syz.4.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a602febe9 code=0x7ffc0000 [ 60.725374][ T29] audit: type=1326 audit(1756995325.177:2762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="syz.4.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6a602febe9 code=0x7ffc0000 [ 60.748892][ T29] audit: type=1326 audit(1756995325.177:2763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="syz.4.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a602febe9 code=0x7ffc0000 [ 60.758229][ T4906] FAULT_INJECTION: forcing a failure. [ 60.758229][ T4906] name failslab, interval 1, probability 0, space 0, times 0 [ 60.772295][ T29] audit: type=1326 audit(1756995325.177:2764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="syz.4.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f6a602febe9 code=0x7ffc0000 [ 60.784986][ T4906] CPU: 1 UID: 0 PID: 4906 Comm: syz.3.492 Not tainted syzkaller #0 PREEMPT(voluntary) [ 60.785021][ T4906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 60.785111][ T4906] Call Trace: [ 60.785119][ T4906] [ 60.785127][ T4906] __dump_stack+0x1d/0x30 [ 60.785150][ T4906] dump_stack_lvl+0xe8/0x140 [ 60.785169][ T4906] dump_stack+0x15/0x1b [ 60.785185][ T4906] should_fail_ex+0x265/0x280 [ 60.785206][ T4906] should_failslab+0x8c/0xb0 [ 60.785297][ T4906] kmem_cache_alloc_noprof+0x50/0x310 [ 60.785396][ T4906] ? getname_flags+0x80/0x3b0 [ 60.785444][ T4906] getname_flags+0x80/0x3b0 [ 60.785470][ T4906] do_sys_openat2+0x60/0x110 [ 60.785501][ T4906] __x64_sys_openat+0xf2/0x120 [ 60.785608][ T4906] x64_sys_call+0x2e9c/0x2ff0 [ 60.785635][ T4906] do_syscall_64+0xd2/0x200 [ 60.785747][ T4906] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 60.785816][ T4906] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 60.785842][ T4906] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.785863][ T4906] RIP: 0033:0x7fbe691bebe9 [ 60.785879][ T4906] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 60.785899][ T4906] RSP: 002b:00007fbe67c1f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 60.785918][ T4906] RAX: ffffffffffffffda RBX: 00007fbe693f5fa0 RCX: 00007fbe691bebe9 [ 60.785931][ T4906] RDX: 0000000000040801 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 60.785943][ T4906] RBP: 00007fbe67c1f090 R08: 0000000000000000 R09: 0000000000000000 [ 60.785955][ T4906] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 60.785967][ T4906] R13: 00007fbe693f6038 R14: 00007fbe693f5fa0 R15: 00007ffe65fd9918 [ 60.785985][ T4906] [ 60.794336][ T4901] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 60.808623][ T29] audit: type=1326 audit(1756995325.177:2765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="syz.4.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a602febe9 code=0x7ffc0000 [ 60.830136][ T4901] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -2 [ 60.837325][ T4902] ext4 filesystem being mounted at /115/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 60.839824][ T4901] EXT4-fs (loop2): 1 truncate cleaned up [ 60.943027][ T4911] netlink: 'syz.3.494': attribute type 4 has an invalid length. [ 61.065816][ T4896] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.113141][ T4896] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.394130][ T4948] loop0: detected capacity change from 0 to 512 [ 61.433480][ T4948] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 61.467592][ T4948] EXT4-fs (loop0): 1 truncate cleaned up [ 61.646429][ T4955] 9pnet_fd: Insufficient options for proto=fd [ 61.664985][ T4955] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 61.785751][ T4959] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 61.801989][ T4959] FAT-fs (loop9): unable to read boot sector [ 62.199755][ T4977] loop2: detected capacity change from 0 to 512 [ 62.216477][ T4977] EXT4-fs: Ignoring removed nomblk_io_submit option [ 62.223696][ T4977] EXT4-fs: Ignoring removed nomblk_io_submit option [ 62.232315][ T4974] netlink: 'syz.4.516': attribute type 27 has an invalid length. [ 62.240138][ T4974] netlink: 'syz.4.516': attribute type 3 has an invalid length. [ 62.240592][ T4977] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 62.247932][ T4974] __nla_validate_parse: 7 callbacks suppressed [ 62.247949][ T4974] netlink: 132 bytes leftover after parsing attributes in process `syz.4.516'. [ 62.287796][ T4977] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 62.295978][ T4977] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -2 [ 62.305857][ T4977] EXT4-fs (loop2): 1 truncate cleaned up [ 62.306350][ T4984] FAULT_INJECTION: forcing a failure. [ 62.306350][ T4984] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 62.324937][ T4984] CPU: 1 UID: 0 PID: 4984 Comm: syz.3.520 Not tainted syzkaller #0 PREEMPT(voluntary) [ 62.325000][ T4984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 62.325020][ T4984] Call Trace: [ 62.325033][ T4984] [ 62.325042][ T4984] __dump_stack+0x1d/0x30 [ 62.325067][ T4984] dump_stack_lvl+0xe8/0x140 [ 62.325088][ T4984] dump_stack+0x15/0x1b [ 62.325177][ T4984] should_fail_ex+0x265/0x280 [ 62.325263][ T4984] should_fail+0xb/0x20 [ 62.325285][ T4984] should_fail_usercopy+0x1a/0x20 [ 62.325310][ T4984] _copy_from_user+0x1c/0xb0 [ 62.325338][ T4984] __sys_bpf+0x178/0x7b0 [ 62.325397][ T4984] __x64_sys_bpf+0x41/0x50 [ 62.325477][ T4984] x64_sys_call+0x2aea/0x2ff0 [ 62.325497][ T4984] do_syscall_64+0xd2/0x200 [ 62.325521][ T4984] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 62.325604][ T4984] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 62.325662][ T4984] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.325682][ T4984] RIP: 0033:0x7fbe691bebe9 [ 62.325713][ T4984] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 62.325729][ T4984] RSP: 002b:00007fbe67c1f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 62.325749][ T4984] RAX: ffffffffffffffda RBX: 00007fbe693f5fa0 RCX: 00007fbe691bebe9 [ 62.325762][ T4984] RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005 [ 62.325774][ T4984] RBP: 00007fbe67c1f090 R08: 0000000000000000 R09: 0000000000000000 [ 62.325786][ T4984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 62.325819][ T4984] R13: 00007fbe693f6038 R14: 00007fbe693f5fa0 R15: 00007ffe65fd9918 [ 62.325836][ T4984] [ 62.526043][ T4989] loop3: detected capacity change from 0 to 512 [ 62.546667][ T4989] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 62.567224][ T4989] EXT4-fs (loop3): 1 truncate cleaned up [ 62.623925][ T5002] netlink: 'syz.3.526': attribute type 10 has an invalid length. [ 62.638167][ T5002] team0: Port device dummy0 added [ 62.645282][ T5004] netlink: 'syz.2.528': attribute type 12 has an invalid length. [ 62.869494][ T5012] netlink: 4 bytes leftover after parsing attributes in process `syz.0.531'. [ 62.940466][ T5016] loop3: detected capacity change from 0 to 1024 [ 62.961475][ T5023] FAULT_INJECTION: forcing a failure. [ 62.961475][ T5023] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 62.974743][ T5023] CPU: 1 UID: 0 PID: 5023 Comm: syz.0.535 Not tainted syzkaller #0 PREEMPT(voluntary) [ 62.974782][ T5023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 62.974793][ T5023] Call Trace: [ 62.974840][ T5023] [ 62.974849][ T5023] __dump_stack+0x1d/0x30 [ 62.974873][ T5023] dump_stack_lvl+0xe8/0x140 [ 62.974893][ T5023] dump_stack+0x15/0x1b [ 62.974911][ T5023] should_fail_ex+0x265/0x280 [ 62.974978][ T5023] should_fail+0xb/0x20 [ 62.974994][ T5023] should_fail_usercopy+0x1a/0x20 [ 62.975015][ T5023] _copy_from_user+0x1c/0xb0 [ 62.975046][ T5023] __sys_bpf+0x178/0x7b0 [ 62.975082][ T5023] __x64_sys_bpf+0x41/0x50 [ 62.975124][ T5023] x64_sys_call+0x2aea/0x2ff0 [ 62.975186][ T5023] do_syscall_64+0xd2/0x200 [ 62.975215][ T5023] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 62.975321][ T5023] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 62.975344][ T5023] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.975366][ T5023] RIP: 0033:0x7f543801ebe9 [ 62.975403][ T5023] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 62.975419][ T5023] RSP: 002b:00007f5436a7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 62.975438][ T5023] RAX: ffffffffffffffda RBX: 00007f5438255fa0 RCX: 00007f543801ebe9 [ 62.975451][ T5023] RDX: 0000000000000010 RSI: 0000200000000580 RDI: 000000000000000f [ 62.975465][ T5023] RBP: 00007f5436a7f090 R08: 0000000000000000 R09: 0000000000000000 [ 62.975553][ T5023] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 62.975564][ T5023] R13: 00007f5438256038 R14: 00007f5438255fa0 R15: 00007ffcb5a2a878 [ 62.975581][ T5023] [ 63.155594][ T5016] ext4 filesystem being mounted at /132/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 63.295416][ T5034] netlink: 52 bytes leftover after parsing attributes in process `syz.3.540'. [ 63.304375][ T5034] netlink: 12 bytes leftover after parsing attributes in process `syz.3.540'. [ 63.313400][ T5034] netlink: 52 bytes leftover after parsing attributes in process `syz.3.540'. [ 63.322320][ T5034] netlink: 12 bytes leftover after parsing attributes in process `syz.3.540'. [ 63.331299][ T5034] netlink: 52 bytes leftover after parsing attributes in process `syz.3.540'. [ 63.379430][ T5042] loop0: detected capacity change from 0 to 512 [ 63.398202][ T5042] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 63.411884][ T5044] netlink: 4 bytes leftover after parsing attributes in process `syz.3.544'. [ 63.424698][ T5042] EXT4-fs (loop0): 1 truncate cleaned up [ 63.537747][ T5055] FAULT_INJECTION: forcing a failure. [ 63.537747][ T5055] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 63.551192][ T5055] CPU: 1 UID: 0 PID: 5055 Comm: syz.2.548 Not tainted syzkaller #0 PREEMPT(voluntary) [ 63.551223][ T5055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 63.551237][ T5055] Call Trace: [ 63.551244][ T5055] [ 63.551252][ T5055] __dump_stack+0x1d/0x30 [ 63.551313][ T5055] dump_stack_lvl+0xe8/0x140 [ 63.551341][ T5055] dump_stack+0x15/0x1b [ 63.551358][ T5055] should_fail_ex+0x265/0x280 [ 63.551406][ T5055] should_fail+0xb/0x20 [ 63.551425][ T5055] should_fail_usercopy+0x1a/0x20 [ 63.551445][ T5055] strncpy_from_user+0x25/0x230 [ 63.551505][ T5055] path_setxattrat+0xeb/0x310 [ 63.551540][ T5055] __x64_sys_fsetxattr+0x6b/0x80 [ 63.551632][ T5055] x64_sys_call+0x1ced/0x2ff0 [ 63.551657][ T5055] do_syscall_64+0xd2/0x200 [ 63.551753][ T5055] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 63.551778][ T5055] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 63.551923][ T5055] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.551946][ T5055] RIP: 0033:0x7f2889f3ebe9 [ 63.551964][ T5055] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 63.551982][ T5055] RSP: 002b:00007f28889a7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000be [ 63.552004][ T5055] RAX: ffffffffffffffda RBX: 00007f288a175fa0 RCX: 00007f2889f3ebe9 [ 63.552023][ T5055] RDX: 0000200000000080 RSI: 0000200000000000 RDI: 0000000000000006 [ 63.552035][ T5055] RBP: 00007f28889a7090 R08: 0000000000000000 R09: 0000000000000000 [ 63.552075][ T5055] R10: 00000000000003c8 R11: 0000000000000246 R12: 0000000000000001 [ 63.552088][ T5055] R13: 00007f288a176038 R14: 00007f288a175fa0 R15: 00007ffedf1c6138 [ 63.552105][ T5055] [ 63.776649][ T5064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 63.808395][ T5064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.843754][ T5070] loop3: detected capacity change from 0 to 512 [ 63.849186][ T5070] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 63.872110][ T5070] EXT4-fs (loop3): 1 truncate cleaned up [ 63.892274][ T5079] loop0: detected capacity change from 0 to 512 [ 63.899136][ T5079] EXT4-fs: Ignoring removed orlov option [ 63.907160][ T5079] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 63.915592][ T5072] netlink: 4 bytes leftover after parsing attributes in process `syz.4.556'. [ 63.938344][ T5079] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8042c119, mo2=0002] [ 63.958018][ T5079] EXT4-fs error (device loop0): ext4_iget_extra_inode:5104: inode #15: comm syz.0.558: corrupted in-inode xattr: e_value size too large [ 63.978437][ T5079] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.558: couldn't read orphan inode 15 (err -117) [ 64.072210][ T5094] netlink: 'syz.3.561': attribute type 12 has an invalid length. [ 64.097662][ T5097] pimreg: entered allmulticast mode [ 64.144628][ T5103] netlink: 2028 bytes leftover after parsing attributes in process `syz.3.561'. [ 64.146290][ T5102] netlink: 'syz.0.564': attribute type 10 has an invalid length. [ 64.272579][ T2940] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.291603][ T56] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.300022][ T56] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.312740][ T56] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.510608][ T5126] vlan2: entered allmulticast mode [ 64.590223][ T5133] netlink: 'syz.2.576': attribute type 10 has an invalid length. [ 64.618081][ T5130] FAULT_INJECTION: forcing a failure. [ 64.618081][ T5130] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 64.631247][ T5130] CPU: 1 UID: 0 PID: 5130 Comm: syz.0.575 Not tainted syzkaller #0 PREEMPT(voluntary) [ 64.631275][ T5130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 64.631359][ T5130] Call Trace: [ 64.631366][ T5130] [ 64.631373][ T5130] __dump_stack+0x1d/0x30 [ 64.631397][ T5130] dump_stack_lvl+0xe8/0x140 [ 64.631418][ T5130] dump_stack+0x15/0x1b [ 64.631436][ T5130] should_fail_ex+0x265/0x280 [ 64.631460][ T5130] should_fail+0xb/0x20 [ 64.631541][ T5130] should_fail_usercopy+0x1a/0x20 [ 64.631565][ T5130] _copy_to_user+0x20/0xa0 [ 64.631609][ T5130] simple_read_from_buffer+0xb5/0x130 [ 64.631697][ T5130] proc_fail_nth_read+0x10e/0x150 [ 64.631738][ T5130] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 64.631763][ T5130] vfs_read+0x1a5/0x770 [ 64.631926][ T5130] ? __rcu_read_unlock+0x4f/0x70 [ 64.631951][ T5130] ? __fget_files+0x184/0x1c0 [ 64.632004][ T5130] ksys_read+0xda/0x1a0 [ 64.632024][ T5130] __x64_sys_read+0x40/0x50 [ 64.632043][ T5130] x64_sys_call+0x27bc/0x2ff0 [ 64.632063][ T5130] do_syscall_64+0xd2/0x200 [ 64.632136][ T5130] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 64.632165][ T5130] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 64.632245][ T5130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 64.632269][ T5130] RIP: 0033:0x7f543801d5fc [ 64.632286][ T5130] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 64.632302][ T5130] RSP: 002b:00007f5436a7f030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 64.632341][ T5130] RAX: ffffffffffffffda RBX: 00007f5438255fa0 RCX: 00007f543801d5fc [ 64.632353][ T5130] RDX: 000000000000000f RSI: 00007f5436a7f0a0 RDI: 0000000000000007 [ 64.632493][ T5130] RBP: 00007f5436a7f090 R08: 0000000000000000 R09: 0000000000000000 [ 64.632505][ T5130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 64.632516][ T5130] R13: 00007f5438256038 R14: 00007f5438255fa0 R15: 00007ffcb5a2a878 [ 64.632532][ T5130] [ 65.665633][ T5168] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5168 comm=syz.0.586 [ 65.973684][ T5172] loop4: detected capacity change from 0 to 512 [ 66.023842][ T5172] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 66.071136][ T5172] EXT4-fs (loop4): 1 truncate cleaned up [ 66.080528][ T5172] EXT4-fs mount: 26 callbacks suppressed [ 66.080544][ T5172] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 66.162513][ T29] kauditd_printk_skb: 336 callbacks suppressed [ 66.162528][ T29] audit: type=1326 audit(1756995330.747:3102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5178 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 66.197087][ T29] audit: type=1326 audit(1756995330.747:3103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5178 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 66.220835][ T29] audit: type=1326 audit(1756995330.747:3104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5178 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 66.244322][ T29] audit: type=1326 audit(1756995330.747:3105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5178 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 66.244417][ T29] audit: type=1326 audit(1756995330.747:3106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5178 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 66.244443][ T29] audit: type=1326 audit(1756995330.747:3107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5178 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 66.244464][ T29] audit: type=1326 audit(1756995330.747:3108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5178 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 66.244489][ T29] audit: type=1326 audit(1756995330.747:3109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5178 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 66.244580][ T29] audit: type=1326 audit(1756995330.747:3110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5178 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=c000003e syscall=279 compat=0 ip=0x7fbe691bebe9 code=0x7ffc0000 [ 66.244623][ T29] audit: type=1326 audit(1756995330.747:3111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5182 comm="syz.0.592" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f543801ebe9 code=0x7ffc0000 [ 66.254219][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 66.289996][ T3383] ================================================================== [ 66.290021][ T3383] BUG: KCSAN: data-race in kick_pool / wq_worker_running [ 66.290039][ T3383] [ 66.290044][ T3383] read-write to 0xffff888237c29d64 of 4 bytes by task 10 on cpu 0: [ 66.290059][ T3383] wq_worker_running+0x95/0x120 [ 66.290075][ T3383] schedule_timeout+0xb7/0x170 [ 66.290101][ T3383] msleep+0x50/0x90 [ 66.290119][ T3383] nsim_fib_event_work+0x14a2/0x21a0 [ 66.290138][ T3383] process_scheduled_works+0x4ce/0x9d0 [ 66.290163][ T3383] worker_thread+0x582/0x770 [ 66.290187][ T3383] kthread+0x486/0x510 [ 66.290203][ T3383] ret_from_fork+0xda/0x150 [ 66.290220][ T3383] ret_from_fork_asm+0x1a/0x30 [ 66.290239][ T3383] [ 66.290243][ T3383] read to 0xffff888237c29d64 of 4 bytes by task 3383 on cpu 1: [ 66.290258][ T3383] kick_pool+0x49/0x2d0 [ 66.290272][ T3383] __queue_work+0x8cb/0xb50 [ 66.290287][ T3383] queue_work_on+0xd1/0x160 [ 66.290302][ T3383] process_srcu+0x999/0xbc0 [ 66.290324][ T3383] process_scheduled_works+0x4ce/0x9d0 [ 66.290348][ T3383] worker_thread+0x582/0x770 [ 66.290372][ T3383] kthread+0x486/0x510 [ 66.290388][ T3383] ret_from_fork+0xda/0x150 [ 66.290404][ T3383] ret_from_fork_asm+0x1a/0x30 [ 66.290421][ T3383] [ 66.290425][ T3383] value changed: 0x00000000 -> 0x00000001 [ 66.290434][ T3383] [ 66.290437][ T3383] Reported by Kernel Concurrency Sanitizer on: [ 66.290446][ T3383] CPU: 1 UID: 0 PID: 3383 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(voluntary) [ 66.290469][ T3383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 66.290481][ T3383] Workqueue: rcu_gp process_srcu [ 66.290503][ T3383] ================================================================== [ 66.438598][ T5200] 9pnet_fd: Insufficient options for proto=fd [ 66.447835][ T5200] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 66.568643][ T5202] loop0: detected capacity change from 0 to 1024 [ 66.589667][ T5202] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 66.589739][ T5202] ext4 filesystem being mounted at /123/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 66.630131][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.