last executing test programs: 3.647768473s ago: executing program 2 (id=438): r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0xffffffffffffffff, 0xdb, 0x18}, 0xc) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r0, &(0x7f00000018c0)="80a5b4b903b1cf64e3790cf6324cb1f4efb2db361293d8f3af7afe7289bc9a9cace319011fe07adf17b91bd8a369924b43b45f355ad35a2d72eacf37992a385f85cc988fe60446339d111f3045f01a2b0ba576720f43cb6ed88876a5669c07fc0db0740b78dc9e1b903e8de922bcbb00cd5a60bf1b1f44ac8a0ffdb421b51cf572f8e218b874a40c60d8bbba46d2c5f1070ef775b37722b035219a9e21450564d641aa25f7901ef108a7c77ed39f68abcc49b6d015ee5ac6d086d7db14f5f00053efe7d5b74326751b133552ef0ed5aaa565baba2d580b256354a5c1317715056241d1b19636c9aa2bf886c8293e2edb094f7cd8f39498ef35cb09b05afd61fbfb000018000000000000814c6a6f59c72dc6788c77dba6bc8a293c455de5ed81ae796408657744a931c42255433c431c485b30c5c1463da0d0b668d7d1753a3564945a110aad5e6fa26d591ca0a73a5c1cb44c9c5e4b8090c8ee1af13e4a276906a3a7b3d25f6f52", &(0x7f00000008c0)=""/4096, 0x4}, 0x1f) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xff05, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x4a00, 0x0, 0x8001}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0xd0}, 0x0) r4 = syz_io_uring_complete(0x0) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r4, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r5, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x20004401}, 0x24000800) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r4) sendmsg$NL80211_CMD_REQ_SET_REG(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000001a40)={0x150, r6, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_REG_RULES={0x130, 0x22, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xb}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x4}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xb26}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xb5a}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x9}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x80}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xffffffff}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x42ea}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xce740000}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x81}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xed66d00c}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x3}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xea}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xcd}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xfffffff7}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x217a}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x4}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x5}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x80000000}]}, {0x44, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xffffff48}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x1}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x800}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x5}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xa}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xffffff80}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x7}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x2}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x3}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x3}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x7fffffff}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x8}]}]}]}, 0x150}, 0x1, 0x0, 0x0, 0x40010}, 0x81) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) socket(0xa, 0x2, 0x0) poll(0x0, 0x0, 0xffffffffffbffff8) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000016"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x84, &(0x7f0000000440)={0x0, @in={{0x2, 0x4e24, @multicast1}}, 0xfffc, 0x86}, &(0x7f0000000500)=0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = io_uring_setup(0x1fb8, &(0x7f0000000540)={0x0, 0x1ae0, 0x400, 0x0, 0xea}) io_uring_register$IORING_REGISTER_BUFFERS(r8, 0x0, &(0x7f0000000940)=[{&(0x7f0000000a00)=""/181, 0xb5}, {&(0x7f0000000200)=""/38, 0x26}, {0x0}, {&(0x7f0000000380)=""/88, 0x58}, {&(0x7f0000000ac0)=""/173, 0xad}], 0x5) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000000)=[r8], 0x1) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x100000000000600d, 0x1) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x3000010, &(0x7f0000000040)={[{@errors_remount}, {@discard}]}, 0x1, 0x512, &(0x7f0000000380)="$eJzs3d9rY1kdAPDvvW1mOzNdk1WRdcF1cVc6i07Sbt3dIqLriz4tqOv7WNu0lCZNadJ1Whbt4H8ggoJPPvki+AcIwzz4B8jAgL6ID6KiiM7og6DOlSQ3TidN2rrTNp3m84HTnHPvzf2ec0NO7o/TewMYWy9FxFsRMRERr0ZEMZ+e5in2uqm93IP77y21UxJZ9s5fk0jyab11tdcxGRFX87dNRcTXvhzxzeRg3ObO7vpirVbdysuVVn2z0tzZvb5WX1ytrlY35ufn3lh4c+H1hdks90TtLPUyP/nS529/+lu/u/Hna99uV+tzH4lC9LXjJHWbXuhsi572Nto6jWAj0PvMC6OuCAAAx9Lex/9gRHyis/9fjInO3lyfiVHUDAAAADgp2Rem499JRAYAAABcWGlETEeSlvOxANORppfycwMfjitprdFsfWqlsb2x3J4XUYpCurJWq87mY4VLUUja5bl8jG2v/FpfeT4inouI7xcvd8rlpUZtecTnPgAAAGBcXO07/v9HMe3kjzbg/wQAAACA86s0tAAAAABcFA75AQAA4OLrP/6/PaJ6AAAAAKfiK2+/3U5Z7/nXy+/ubK833r2+XG2ul+vbS+WlxtZmebXRWO3cs69+1PpqjcbmZ2Jj+2alVW22Ks2d3Rv1xvZG68baY4/ABgAAAM7Qcx+/8+skIvY+e7mTIr8PIMBj/jDqCgAnaWLUFQBGxl28YXwVRl0BYOSSI+YbvAMAAE+/mY8evP7fe/6/cwNwsRnrAwDjx/V/GF8FIwBhrKUR8YFu9plhywy9/v/L40bJsoi7xf1TnF8EAICzNd1JSVrOjwOmI03L5YhnI9JSFJKVtVp1Nj8++FWx8Ey7PNd5Z3LkmGEAAAAAAAAAAAAAAAAAAAAAAAAAoCvLksgAAACACy0i/VPSuZt/xEzxlen+8wOXkn8W44954Ufv/ODmYqu1Ndee/rfOs7wuRUTrh/n014Y+PgwAAAA4acne0Fnd4/T8de5MawUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAGHhw/72lXjrLuH/5YkSUBsWfjKnO61QUIuLK35OY3Pe+JCImTiD+3q2IeH5Q/CQeZllWymvRHz+NiMunHL/U2TTD4189gfgwzu60+5+3Bn3/0nip8zr4+zeZpyc1vP9L88jPd/q5Qf3fswfWVh8Y44V7P6sMjX8r4oXJwf1Pr/9NhsR/+cDa/pVl2cEY3/j67u6w+NmPI2YG/v4kj8WqtOqblebO7vW1+uJqdbW6MT8/98bCmwuvL8xWVtZq1fzvwBjf+9jPHx7W/isD4v/2N93+97D2vzJspX3+c+/m/Q91s4VB8a+9PPD3dyqGxE/z375P5vn2/Jlefq+b3+/Fn9598bD2Lw/Z/kd9/teO2f5Xv/rd3x9zUQDgDDR3dtcXa7Xq1iGZqWMs8zRmfjF1Lqrxf2ay73Q/ufNSn/ebae+tPprSa9U5qNi+THZmsSbinDT5f5mRdksAAMApeLTTP+qaAAAAAAAAAAAAAAAAAAAAwPg6i9uJ9cfcG01TAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO9d8AAAD//yLg4A8=") 3.325463559s ago: executing program 1 (id=441): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="1801000000000000000000006dfeff00850000007b00000095"], &(0x7f0000000600)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x28, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x110004}, 0x94) creat(&(0x7f0000000040)='./file0\x00', 0x0) removexattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='security.selinux\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='kfree\x00', r0, 0x0, 0x401}, 0x18) r1 = memfd_create(&(0x7f0000000100)='\vem\xda\x99R@m\xfc\xfe\x9b#*\xff', 0x0) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r2 = syz_open_dev$evdev(&(0x7f0000000040), 0x2, 0x0) close(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b7030000e8ffff05850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0xc0109207, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)={0x3c, r4, 0x1b, 0x0, 0x3, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x3ff}, @ETHTOOL_A_LINKMODES_OURS={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}]}]}, 0x3c}}, 0x0) 2.590061959s ago: executing program 2 (id=443): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a000000030000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x18) r2 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r3 = openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) close(r3) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='mm_page_alloc\x00'}, 0x18) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r4}, &(0x7f0000000200), &(0x7f00000002c0)=r5}, 0x20) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x3) r6 = socket$vsock_stream(0x28, 0x1, 0x0) fgetxattr(r6, &(0x7f0000000000)=ANY=[], 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) rt_sigpending(0x0, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="780000000201010300000000000000000100000408001540000000010800170000000007080003"], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x4008800) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x2000) socket$kcm(0xa, 0x3, 0x73) syz_emit_ethernet(0x82, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x0) 2.526804674s ago: executing program 4 (id=446): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="020000000400433710d976efd2"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000009500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xfff8}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x44, 0x24, 0x100, 0x70bd28, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_ATM={0x8, 0x4, 0x2}, @TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x55}, 0x4000) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x3, 0x7, @loopback, 0x800000}, 0x1c) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='rxrpc_client\x00', r3, 0x0, 0x3}, 0x18) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206010100000000000000000000000005000100070000000900020073797a300000000014000780050015000000000008001240000000000d000300686173683a6e657400000000050005000a000000050004"], 0x5c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="6d000000030605000000000000000000000000060500010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x24040800}, 0x8d0) fchownat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000640)={{0x1, 0x1, 0x18, r4, {0x2}}, './file0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = mq_open(&(0x7f0000000040)='!se\xf7ih,\x17i\xacP\xe6lNnuxselinux\x00', 0x6e93ebbbcc0884f2, 0x2, &(0x7f0000000300)={0x0, 0x1, 0x6}) mq_timedsend(r6, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r6, 0x0, 0x0, 0x2, 0x0) 2.45659141s ago: executing program 2 (id=448): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x418142) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) umount2(&(0x7f0000000000)='./file0\x00', 0x5) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000000040)={0x401, 0x2, {0x1, 0x1, 0x6, 0x0, 0x64f}, 0xffffff80}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000000000000000000001000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000280)='netlink_extack\x00', r2}, 0x10) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r3}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000200)='kfree\x00', r4}, 0x18) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r6, 0x1, 0x70bd2b, 0x25dfdbfc}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x10000) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38000000540001000000000000c4000007008209", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv4_deladdr={0x20, 0x15, 0x115, 0x70bd26, 0x25dfdbfc, {0x2, 0x8, 0x80, 0xff, r10}, [@IFA_ADDRESS={0x8, 0x1, @private=0xa010102}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x4d884) syz_usb_disconnect(0xffffffffffffffff) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40095505, 0x0) 2.372358067s ago: executing program 1 (id=449): r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000938500000071000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000009900000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x64, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x18) r4 = socket(0x10, 0x3, 0x0) r5 = perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_config_ext={0x1, 0xa}, 0x1184c, 0x9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r5, &(0x7f0000000040)={0xa0000004}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0x10}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x3c, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x1}, @TCA_FQ_CODEL_DROP_BATCH_SIZE={0x8, 0x8, 0x9d}, @TCA_FQ_CODEL_INTERVAL={0x8, 0x3, 0xf384}, @TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0xffffdfff}, @TCA_FQ_CODEL_FLOWS={0xfffffffffffffc29, 0x5, 0x8f}, @TCA_FQ_CODEL_TARGET={0x8}, @TCA_FQ_CODEL_ECN={0x8}]}}, @TCA_RATE={0x6, 0x5, {0x4}}]}, 0x78}, 0x1, 0x0, 0x0, 0x20040800}, 0x2200c000) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) uname(&(0x7f0000000040)=""/84) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r1, 0x0, 0x1ffffffffffffffd}, 0x18) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) close(r0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r10 = dup(r9) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r10}, 0x2c, {[], [], 0x6b}}) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r10, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x42000004}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r11, 0x200, 0x70bd26, 0x25dfdbff, {{}, {}, {0x14, 0x17, {0x1c, 0x9d57, @l2={'eth', 0x3a, 'lo\x00'}}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x20040044) r12 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r12, 0x84, 0x6b, &(0x7f0000000080)=[@in={0x2, 0x4e24, @remote}, @in={0x2, 0x4e20, @multicast2}, @in6={0xa, 0x4e20, 0x5, @loopback, 0x7f}, @in6={0xa, 0x4e23, 0x0, @mcast2, 0x8}, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @in6={0xa, 0x2, 0xdf89, @private0, 0x800}, @in6={0xa, 0x4e23, 0x2, @local, 0x4}, @in={0x2, 0x4e22, @rand_addr=0x64010102}, @in={0x2, 0x4e23, @multicast2}], 0xcc) dup(0xffffffffffffffff) 2.371715637s ago: executing program 3 (id=451): r0 = socket(0xa, 0x5, 0x0) syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x20002) listen(r0, 0x100) sendmsg$inet_sctp(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@authinfo={0x12, 0x84, 0x6, {0x6}}], 0x18, 0x48d1}, 0x8850) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x10) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty, 0x5}, 0x1c) recvmmsg(r2, &(0x7f0000006d00)=[{{0x0, 0x0, 0x0}, 0x20}], 0x1, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x46, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x35, &(0x7f0000000100)=0x5, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) fcntl$setlease(r1, 0x400, 0x0) r3 = syz_io_uring_setup(0x30da, &(0x7f0000000080)={0x0, 0x4ddb, 0x10000, 0x1, 0x2ca}, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_BUFFERS2(r3, 0xf, &(0x7f0000001540)={0x3, 0x0, 0x0, &(0x7f0000001480)=[{0x0}, {&(0x7f0000001180)=""/237, 0xed}, {&(0x7f0000001280)=""/39, 0x27}], &(0x7f0000001500)=[0x0, 0x4, 0x3]}, 0x20) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0x10, &(0x7f0000001cc0)={0x2, 0x0, &(0x7f0000001c40)=[{0x0}], 0x0, 0x1}, 0x20) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000100)={@loopback, 0x0}, &(0x7f0000000140)=0x14) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={r1, 0x20, &(0x7f0000000340)={&(0x7f0000000200)=""/31, 0x1f, 0x0, &(0x7f0000000240)=""/220, 0xdc}}, 0x10) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018", @ANYRES32=r6, @ANYBLOB="0000000000000000b704000008000000850000009500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000540)={{0x1, 0x1, 0x18, r7}, './file0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x6, 0x6, &(0x7f0000000700)=ANY=[@ANYBLOB="6b73f0fff0ffffff18120000", @ANYBLOB="92f308dbd0dd8ab4b6bacca3fc1cebef5273a397df3b345c053737ddcf5efd2f8964431211e5681835355cfcbd9005b93d8170b8c947ed679af7cbe9b1949598a254cbd638749522e4e20eae26d5a376e5c4b86adc67a8cdde4938f00a2f104f6f0b3422139f7f5c2c5dbfce5d7c3248b3ce51d989a3232cfc2da5e498e25625464e64e0336a2f39d70a7e7ac14c2a00b2d6d0a15372df53428e2cc7c3e53e1ffc46bcea2b262eb22be2a26043d58fb6fb2bac46e8f816", @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000002df28bbc587fbb6858fac1dc85f"], &(0x7f0000000040)='GPL\x00', 0x3, 0x46, &(0x7f0000000080)=""/70, 0x100, 0x58, '\x00', r4, @fallback=0x12, r1, 0x8, &(0x7f0000000180)={0x8, 0x1}, 0x8, 0x10, &(0x7f00000001c0)={0x5, 0x2, 0xb, 0x8}, 0x10, r5, r1, 0x6, &(0x7f00000003c0), &(0x7f0000000400)=[{0x5, 0x2, 0x3, 0xc}, {0x5, 0x4, 0xd}, {0x4, 0x2, 0x5, 0x3}, {0x4, 0x2, 0x1, 0x2}, {0x3, 0x3, 0xa, 0xc}, {0x0, 0x5, 0x10, 0x3}], 0x10, 0x80000001}, 0x94) fcntl$setlease(r1, 0x400, 0x2) 2.298522493s ago: executing program 3 (id=453): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mount$9p_unix(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x0, 0x0, 0x301200a, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d70300000000000000d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df6c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8a9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2a9e99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8be1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaa072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a3ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a98838156ff00000000000000cdbf91f7582ab314be3e67b8c9459564c856339a80919ecf839560c62e69df8667b274cc53f83f2086cfd2664252471fad9081824d60741d663ee258705c364e162b84a09870acd0a19399103474444f4fa12dcbd10b40195b6088513029b60a34e4161fe48c092693eb07dc8ddcba2eac2efe30b285a877c862c73ff8a60cf73f1b17da0000000000005664181c1f28cd2880e6872bae932eaf4b0000000000007b662c0fe22cfd6d4bd7b851ae928cebeec6375b16af342e93c39d97e5d74d5a8e96c15fdcde7526b0af54b145e61b042c1e600390590a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340)={0x0, 0x7}, 0x10}, 0x94) bpf$BPF_LINK_CREATE(0xa, &(0x7f0000000040)={r1, 0xffffffffffffffff, 0x10, 0x0, @val=@iter={&(0x7f0000001a40)=@cgroup, 0x10}}, 0x40) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0700000004000000080200000e00000000000000", @ANYRES32], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7030000ec000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r3}, 0x18) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000280)='kfree\x00', r4, 0x0, 0x1c000000}, 0x18) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000181100"/20, @ANYRES32, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa100000000000007010000b8ffffffb70200"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000001c931, r5, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{}, &(0x7f0000000380), &(0x7f00000003c0)}, 0x20) r6 = openat$uhid(0xffffffffffffff9c, &(0x7f0000001440), 0x2, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) readv(r6, &(0x7f0000000300)=[{&(0x7f0000000380)=""/4096, 0x1000}], 0x1) 2.257097926s ago: executing program 3 (id=454): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000200)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r2, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000650000000800000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x25, 0x1, 0x0, 0x0, 0x0, 0x4, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xb, 0xff, 0x4932, 0x7f, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000001c0)={{r5, 0xffffffffffffffff}, &(0x7f0000000100)=0x7d8, &(0x7f0000000140)='%pi6 \x00'}, 0x20) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x2, r6}, 0x38) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r4}, 0x10) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x0) sendmsg$SMC_PNETID_DEL(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r1, 0xe27, 0x70bd28, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000}, 0x4000) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='kmem_cache_free\x00', r8}, 0x10) stat(0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r6, 0xf507, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$SEG6(&(0x7f00000011c0), 0xffffffffffffffff) sendmsg$SEG6_CMD_DUMPHMAC(r10, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001200)={0x14, r11, 0xf21, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x810}, 0x8010) sendmsg$SEG6_CMD_SETHMAC(r9, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r11, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRETLEN={0x5}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x6}, @SEG6_ATTR_SECRET={0x18, 0x4, [0x0, 0x4000000, 0x6, 0xffff4a2f, 0x8]}, @SEG6_ATTR_DST={0x14, 0x1, @remote}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x7}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000080}, 0x20040090) io_uring_setup(0x35, &(0x7f0000000340)={0x0, 0x94f9, 0x2000, 0x0, 0x253}) 2.223612069s ago: executing program 1 (id=455): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) accept4$inet(r0, &(0x7f0000000040), 0x0, 0x800) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)='F', 0x1}, {0x0, 0xe0}], 0x2, &(0x7f00000000c0)=[@sndinfo={0x20, 0x84, 0x2, {0xa, 0x4, 0x28, 0x200000b, r1}}], 0x20, 0x2400e044}, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000340)={0x8, 0x1, 0x8000, 0xb, 0x6, 0xff, 0x3, 0x5, r1}, &(0x7f0000000380)=0x20) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={r1, 0x8}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000040)=@assoc_id=r1, &(0x7f0000000080)=0x4) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000300)={r1, 0x10001}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0}, 0x94) socket(0x2a, 0x1, 0xfffffff9) r2 = socket$netlink(0x10, 0x3, 0x8000000004) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x2c) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x1b, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) clock_settime(0x0, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDSKBSENT(r4, 0x4b49, &(0x7f0000000b00)={0xff, "810a3e6466ebc96a44e1c6af948e8f1c87fe0c97a067f6ab17a49158d8754880045e66c4f1eb5dc084fce79d297bfa39c1123c09ab79b4c605693601d0dc438c6874e31639d475b5b6cff30a9dbb7a0205ac12dea5f21fbcba82f4defc30fc3e267078af3fbe9c63b5a56d8c27d0118691ad55c90713e73dd14136e0c8715fc5387e90f4428a8128662472568e1c89270c12c978bbb93840e5111d7bcd50ab0831ba7fa54fb21dabf3a0abd862532603cd0216f2451ca3c1265b2e1b98c1cc78e267cf433dfce69c376a6c145019978bc117cfbf9b3b038f361e9a040bbac372645fd9eebdfc498db8c96325415cb89e535a3f05a443c1090731d1a4334a220a8fc31c8af26d3ca63674f6a20cff739de05badf4c6bd984388a9e92aa20030a06efeea1f54adda95256359ab4dd8a838aadd49ef36e448f1b3e95da38e29c3d4925e0b2697d727f2c4a716bcbc77d97bc4406103b1122bbb911e7ad1596f093c05b96e7a255953dba05afe9cb6d159d99010ab0291414146cfdab4b0a9c02609969adb986b437b8591275b3c3f5330e53736a3b8d4cfcf2206f5b72c895da822dc249d1371da996540ba64e272fbdcde1652be8eba8885aeea6ff82b9420ac81f5c706342b86fecb1838bff2d8c0ec226ca3988919237f377e7f1b87f9d02c0099cfa5db0c9a32b9848de87d29d67394fea65a8cb5c0be66a19ea0448b585bdd"}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000700)={r3, r5, 0x25, 0x0, @val=@perf_event}, 0x18) syz_emit_ethernet(0xfdef, &(0x7f0000000100)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@response={0x2, 0x0, 0x0, "82d18160f7d8dda36479a6b179161b4bbff2d0508977b3928ebd2dee05607d17", "0194bd7b1b0303c5ba7f602606a285b3", {"30da2d58da817f8a5f77a23de36a2164", "3b33cfa231a427159c7b9f0eceb155f0"}}}}}}}, 0x0) socket$packet(0x11, 0x3, 0x300) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000400)="580000001400192340834b80040d8c560a067fbc45ff810500000000070058000b480400945f640094272d7061d328b92d0000000000008000f0fffeffe809000000fff5dd00000010000100090808004149004001040800", 0x58}], 0x1) 2.157337254s ago: executing program 3 (id=456): r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r1) socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x3406c012) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x1}) write$cgroup_type(r1, &(0x7f0000000080), 0x11ffffce1) sendmsg$kcm(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000c80)=ANY=[], 0xe0}, 0x20004065) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000080)={0x4, 0x6}, 0x4) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x7f, 0x80000000, 0x6, 0x0, 0x9}) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$netlink(r2, 0x0, 0x4) sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0d030000000000000000130000001c000980080002"], 0x30}}, 0x0) close(r0) 2.105429218s ago: executing program 1 (id=457): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000181100"/20, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000208500000004"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa100000000000007010000b8ffffffb702000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r0, 0x58, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000800)={0x6, 0x0}, 0x8) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', r2, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000640)='console\x00', r5}, 0x10) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000500a8000600200006400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0x11a}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r7, 0x84, 0x16, &(0x7f0000000340)={0x4, [0x6, 0x2, 0xffff, 0x2]}, &(0x7f0000000380)=0xc) r8 = openat$cgroup_type(r3, &(0x7f0000000840), 0x2, 0x0) write$cgroup_type(r8, &(0x7f00000008c0), 0x9) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1, 0x0, 0x7fff}, 0x18) syz_usbip_server_init(0x1) 1.72186628s ago: executing program 2 (id=462): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="1801000000000000000000006dfeff00850000007b00000095"], &(0x7f0000000600)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x28, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x110004}, 0x94) creat(&(0x7f0000000040)='./file0\x00', 0x0) removexattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='security.selinux\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='kfree\x00', r0, 0x0, 0x401}, 0x18) r1 = memfd_create(&(0x7f0000000100)='\vem\xda\x99R@m\xfc\xfe\x9b#*\xff', 0x0) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r2 = syz_open_dev$evdev(&(0x7f0000000040), 0x2, 0x0) close(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b7030000e8ffff05850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0xc0109207, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)={0x3c, r4, 0x1b, 0x0, 0x3, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x3ff}, @ETHTOOL_A_LINKMODES_OURS={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}]}]}, 0x3c}}, 0x0) 1.676785473s ago: executing program 4 (id=463): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) socket$packet(0x11, 0xa, 0x300) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, 0x0) write$tun(0xffffffffffffffff, 0x0, 0xfdef) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_emit_ethernet(0x46, 0x0, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b707000008000000850000006900000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_DEAUTHENTICATE(r5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$selinux_create(0xffffffffffffff9c, 0x0, 0x2, 0x0) connect$inet(r0, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) shutdown(r0, 0x1) 1.534014095s ago: executing program 4 (id=465): r0 = fsopen(&(0x7f0000000100)='bfs\x00', 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000001c80)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x1, @private0, 0x5}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}], 0x1, 0x931766f6319eed40) shutdown(r1, 0x1) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000080)={r3}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000080)={r3, 0x0, 0x0}, &(0x7f00000000c0)=0x10) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x20081e, &(0x7f0000000100), 0x1, 0x502, &(0x7f0000000a00)="$eJzs3c9vI1cdAPCvnV9OmjZp6QEQokspLGi1TuJto6oHKCeEUCVEjyBtQ+KNothxFDulCXvY/g9IVOIER/4Azj3xJyC4cYEDEj8iULMSSFPNeLzrzdob7yaxs/HnI41m3ryxv+/t7rzn+W7iF8DYuhYR9yJiOiI+iIiF/Hwh3+Ld9pZe99nR3fXjo7vrhUiS9/9VyOrTc9H1mtQL+XuWIuLH34/4WeHxuM2Dw+21Wq261y7OLrXqu0vNg8ObW/W1zepmdadSWV1ZXX771luVc+vra/Xp9sFE2sBv/yJt1nxe192Pc/T/JDP1IE5qMiJ+eAHBRmEi78/0qBvCMylGxCsR8Xp2/y/ERPa3CQBcZUmyEMlCdxkAuOqKWQ6sUCznuYD5KBbL5XYO79WYK9YazdaNO439nY12rmwxpop3tmrV5TxXuBhThbS8kh0/LFdOlG9FxMsR8cuZ2axcXm/UNkb5wQcAxtgLJ+b//860538A4IorjboBAMDQmf8BYPyY/wFg/Jj/AWD8mP8BYPyY/wFg/Jj/AWCs/Oi999ItOc6//3rjw4P97caHNzeqze1yfX+9vN7Y2y1vNhqb2Xf21E97v1qjsbvyZux/tPid3WZrqXlweLve2N9p3c6+1/t2dWoovQIAnuTl1z79cyEi7r0zm23RtZaDuRqutuJZXjx7fu0Ahm9i1A0ARsZqXzC+zvCMLz0AV0SPJXofUXrkcT+/OkmS5GKbBVyg61+S/4dx1ZX/91PAMGbk/2F8DZr/Py0/ADx/kqQw6Jr/MeiFAMDlJscP9Hm+fyXf/y7/z4Gfbpy84pOLbBUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABcbp31f8v5WuDzUSyWyxEvRsRiTBXubNWqyxHxUkT8aWZqJi2vjLjNAMBZFf9eyNf/ur7wxvzJ2unC/ZlsHxE///X7v/pordXa+2N6/t8Pzrc+yc9XRtF+AOA0nXk623c9yH92dHe9sw2zPf/4XkSU2vGPj6bj+EH8yZjM9qWYioi5/xTycluhK3dxFvc+jogv9up/IeazHEh75dOT8dPYLw41fvGR+MWsrr1P/yy+8NSRk4VzaD481z5Nx593e91/xbiW7Xvf/6VshDq7fPxL32r9OBsDH8bvjH8Tfca/a4PGePMPP2gfzT5e93HElycjOrGPu8afTvxCn/hvDBj/L1/56uv96pLfRFyP3vG7Yy216rtLzYPDm1v1tc3qZnWnUlldWV1++9ZblaUsR73Ufzb45zs3XupXl/Z/rk/80in9/8aA/f/t/z74ydeeEP9bX+8VvxivPiF+Oid+c8D4a3O/L/WrS+Nv9Ox/R//+3xgw/l//dvjYsuEAwOg0Dw6312q16t4wDzofJIYa1MEVOEj/1VyCZvQ8+O6wYk3HU70qSZ4pVr8R4zyybsBl0L7Xk+peRNwfdWMAAAAAAAAAAAAAAICehvEbS6PuIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFfX5wEAAP//90HVog==") bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d00000085"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r5}, 0x10) syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x0, 0x2, 0x4, 0x10000}, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0700000004000000200100000102000028"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xd, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r6}, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c00000003060104000000000000000018e2f709184fc817e7d2ad97304207000000050001ff03000000"], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x10) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x8280) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000880)=[{&(0x7f0000000180)="04", 0x1}, {&(0x7f0000000200)='\b', 0x1}, {&(0x7f0000001300)="da", 0x1}, {&(0x7f00000002c0)='@', 0x1}], 0x4, 0x0) 1.511798377s ago: executing program 0 (id=466): r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000938500000071000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000009900000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x64, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x18) r4 = socket(0x10, 0x3, 0x0) r5 = perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_config_ext={0x1, 0xa}, 0x1184c, 0x9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r5, &(0x7f0000000040)={0xa0000004}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0x10}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x3c, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x1}, @TCA_FQ_CODEL_DROP_BATCH_SIZE={0x8, 0x8, 0x9d}, @TCA_FQ_CODEL_INTERVAL={0x8, 0x3, 0xf384}, @TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0xffffdfff}, @TCA_FQ_CODEL_FLOWS={0xfffffffffffffc29, 0x5, 0x8f}, @TCA_FQ_CODEL_TARGET={0x8}, @TCA_FQ_CODEL_ECN={0x8}]}}, @TCA_RATE={0x6, 0x5, {0x4}}]}, 0x78}, 0x1, 0x0, 0x0, 0x20040800}, 0x2200c000) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) uname(&(0x7f0000000040)=""/84) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r1, 0x0, 0x1ffffffffffffffd}, 0x18) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) close(r0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r10 = dup(r9) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r10}, 0x2c, {[], [], 0x6b}}) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r10, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x42000004}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r11, 0x200, 0x70bd26, 0x25dfdbff, {{}, {}, {0x14, 0x17, {0x1c, 0x9d57, @l2={'eth', 0x3a, 'lo\x00'}}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x20040044) r12 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r12, 0x84, 0x6b, &(0x7f0000000080)=[@in={0x2, 0x4e24, @remote}, @in={0x2, 0x4e20, @multicast2}, @in6={0xa, 0x4e20, 0x5, @loopback, 0x7f}, @in6={0xa, 0x4e23, 0x0, @mcast2, 0x8}, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @in6={0xa, 0x2, 0xdf89, @private0, 0x800}, @in6={0xa, 0x4e23, 0x2, @local, 0x4}, @in={0x2, 0x4e22, @rand_addr=0x64010102}, @in={0x2, 0x4e23, @multicast2}], 0xcc) dup(0xffffffffffffffff) 1.509365747s ago: executing program 1 (id=467): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010029bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8a4301000000000014001680100001800c00090009000000060000001400030062617461"], 0x50}, 0x1, 0x0, 0x0, 0x4000884}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="182aad6835d0ed00aebba5d500000000000000000000000000000018011d002020702500000000002039203b1af8ff00000000bfa10000000000010000f8ffffffb732a7dd8f000000b70300009e56"], &(0x7f0000001c00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='rpcgss_createauth\x00', r0}, 0x18) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/vmallocinfo\x00', 0x0, 0x0) read$hiddev(r2, &(0x7f00000000c0)=""/4092, 0xffc) perf_event_open(&(0x7f00000002c0)={0x2, 0x80, 0xff, 0x4, 0x8, 0xa9, 0x0, 0x3, 0x10942, 0x8, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0xfffffff7, 0x1, @perf_bp={&(0x7f0000000000), 0x2}, 0x400, 0x7, 0x0, 0x5, 0x4d4b, 0xfffffff8, 0x45, 0x0, 0x4, 0x0, 0x7}, 0x0, 0xe, r1, 0x9) inotify_init1(0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x129c81, 0x0) ppoll(&(0x7f0000000280)=[{r4, 0x6200}], 0x1, 0x0, 0x0, 0x0) write$binfmt_aout(r4, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r4, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x7f, 0x6, 0x1, "42341f9b1000007e4f00"}) r5 = syz_open_pts(r4, 0x40000) dup3(r5, r4, 0x0) splice(r4, 0x0, r3, 0x0, 0x7ffff000, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) io_uring_enter(0xffffffffffffffff, 0x1d69, 0x4b5d, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000bc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000006c0), &(0x7f0000000700), 0x2, 0x1) syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000000)='./file0\x00', 0x2000844, &(0x7f0000000300)={[{@fat=@allow_utime={'allow_utime', 0x3d, 0x80}}, {@dots}, {@fat=@quiet}, {@fat=@usefree}, {@fat=@nfs_nostale_ro}, {@fat=@umask={'umask', 0x3d, 0x87}}, {@dots}, {@fat=@nfs_stale_rw}, {@nodots}, {@nodots}, {@dots}, {@fat=@errors_continue}, {@fat=@time_offset={'time_offset', 0x3d, 0xfffffffffffffe28}}]}, 0x0, 0x262, &(0x7f0000001100)="$eJzs3UFr02AYB/BnW9dmA3Fn8RDw4mmo36BIBTEgVHrQk4XpZRMhu1RP/Rh+Bj+SH2On3SouoZ1ZFTvTpprfD0oe8s9b3uTQt4fnbd/e/3B68vH8/ezbl0iSNDoR07iMOIrd2IvCTnncvaq7cd00/tydFa4FANZnOBz3m54DNdq5eSrP++P9iOjdSEZfNzMpAAAAAAAAAAAA6ra0/7/SQ1ZX/z8AsB30////8rw/Piy/v/1M/z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQnMvZ7O7sN6+m5wcA1M/6DwDtY/0HgPax/gNA+7x6/eZFP8sGwzRNIi6mk9FkVByL/NnzbPAovXK0GHUxmYz2yzobPC7ytJofluOfLM278fBBkf/Inr7MKnkvTtZ98wAAAAAAAAAAAAAAAAAAALAljtO5yv7+vSI//lVeVNd+H6Cyf78T9zobuw0AAAAAAAAAAAAAAAAAAAD4p51/+nw6Pjt7lysU8+IgbjEqifmZ2wxfrehGxKqjerElj3d9RVLfk2/6kwkAAAAAAAAAAAAAAAAAANpnsem36ZkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQHMW////N8VB+W7Lr2n4FgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICW+B4AAP//C6SJig==") bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, 0x2}, 0x94) syz_usbip_server_init(0x1) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f00000002c0)=@req3={0x8001, 0xfc, 0x1, 0x3, 0x6, 0xcb, 0x4}, 0x1c) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000001c80)) recvfrom$inet_nvme(r6, &(0x7f0000000180)=""/8, 0x8, 0x40010010, 0x0, 0x0) 1.35356681s ago: executing program 0 (id=468): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c30000"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x64, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xffe0}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_flow={{0x9}, {0x34, 0x2, [@TCA_FLOW_EMATCHES={0x30, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x7}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{0x8, 0x9, 0x40}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x2}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x2008c014) 1.338291431s ago: executing program 2 (id=469): r0 = perf_event_open(&(0x7f0000000800)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close(r0) syz_clone(0x20100000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000580)={0x34, r5, 0x1, 0x0, 0xffffffff, {0x54}, [@nsim={{0xe, 0x2}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000bc0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000059000000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6, 0x0, 0x7fff}, 0x18) connect$inet6(r2, &(0x7f0000000200)={0xa, 0xffff, 0x0, @loopback, 0x40000000}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000040), 0x4) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000003c0)={'\x00', 0x7, 0x3ff, 0x7, 0x3, 0x0, r1}) syz_open_procfs(r7, &(0x7f0000000340)='net/dev\x00') perf_event_open(&(0x7f0000000000)={0x2, 0xa7, 0x24, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0}, 0x2000, 0x10000, 0x7, 0x1, 0x8, 0x20005, 0x100b, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r8 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100), &(0x7f0000000080)) io_uring_register$IORING_REGISTER_PBUF_RING(r8, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000b80)=@ccm_128={{0x304}, "7ba11d27a9e02909", "7d70211c7bf1ac7a0d742ecbc81422f4", "d01f1c43", "cadea6b75a9723ce"}, 0x28) close(r2) r9 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDSKBENT(r9, 0x4b47, &(0x7f0000000380)={0x81, 0x8, 0xff80}) read(r0, &(0x7f0000000740)=""/21, 0x15) 1.22282844s ago: executing program 3 (id=470): bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x20, &(0x7f0000000000)={&(0x7f0000000140)=""/181, 0xb5, 0x0, &(0x7f0000000200)=""/108, 0x6c}}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x8d) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x1c, &(0x7f0000000100)=[@in6={0xa, 0x4e23, 0x1574, @private1={0xfc, 0x1, '\x00', 0x1}, 0xc83}]}, &(0x7f0000000080)=0x10) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000240)={r6, 0x5}, &(0x7f0000000280)=0x8) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) write$P9_RGETLOCK(r2, &(0x7f0000000640)=ANY=[], 0x200002e6) fcntl$setpipe(r2, 0x407, 0x7000000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0xf2de1000) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='mpol=bind:0-0B']) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) r8 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x1f, 0x0, 0x30) writev(r8, &(0x7f0000000400)=[{&(0x7f0000000040)="aa1d484ea0000000f7fc08fcd111fbdf23ea32db0e8f21d5bc27bd49eb067a0689fff2a41cfbf0e9d85e44", 0x2b}], 0x1) 1.22193748s ago: executing program 0 (id=471): sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x810}, 0x40000) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x0, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x46, '\x00', 0x0, 0x2}, 0x94) r2 = socket$inet_sctp(0x2, 0x1, 0x84) openat$zero(0xffffffffffffff9c, 0x0, 0x2000, 0x0) r3 = gettid() move_pages(r3, 0x8, &(0x7f0000000040)=[&(0x7f0000934000/0x2000)=nil, &(0x7f0000163000/0x3000)=nil, &(0x7f000028a000/0x4000)=nil, &(0x7f000093b000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060a000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil], &(0x7f00000000c0)=[0x2, 0x10000], &(0x7f0000000100)=[0x0], 0x2) timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0}, 0x18) r4 = open_tree(0xffffffffffffff9c, 0x0, 0x89901) open_tree(r4, &(0x7f0000000cc0)='./file0\x00', 0x89901) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x35, 0x2, @thr={&(0x7f0000000400)="85d231ec553d0b310653535a502bd73f12a2e544f8e38062ef506764766df92fa69daf0a340cc0e142f94d1cb6452ae6a24e295bd1e910b9ef68cf4e95135719391c5978ac3c34c239b90345778d81c708b392c6355bdbbcbf442159db0f6926bfbf436f1a121b89271032801fb586db6fe3630afdc5a0c96bd20b7941527e0b3b2db37e2c0de3870f3a00cea91100db54590ee93e4c33f4", &(0x7f00000004c0)="d9c08904fa4c76b8bed16e93f35c5b438a628bc76685e4b4df768e74230db119ed028770fbb34258ba6ec7db1c6b7ce5a952e4c67dd8914e7ff6062701eedb8a50d66540c121cb69e2c2763ebc"}}, &(0x7f0000bbdffc)) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x22081) setsockopt$inet_group_source_req(r2, 0x0, 0x2e, &(0x7f0000000000)={0x1, {{0x2, 0x4e21, @empty=0xe0000000}}, {{0x2, 0x4e25, @broadcast}}}, 0x108) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x20, 0xfc, 0x2, 0x0, @rand_addr=0x1c, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x6, 0x0, 0x0, 0xfa, 0x9, {0x5, 0x4, 0x0, 0x3d, 0xfff6, 0x65, 0x5, 0x1, 0x89, 0x3, @private=0xa010102, @local}}}}}}, 0x0) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000080)={0x1, 0x1, 0x4, 0x2, @vifc_lcl_addr=@loopback, @remote}, 0x10) 1.141168377s ago: executing program 4 (id=472): r0 = perf_event_open(&(0x7f00000000c0)={0x5, 0x80, 0x8, 0x26, 0x40, 0x7, 0x0, 0x0, 0xa005a, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_config_ext={0x7, 0x1}, 0x100987, 0x2, 0xb, 0x4, 0x81, 0x2, 0x5, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x5) msgsnd(0x0, 0x0, 0xff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) r2 = io_uring_setup(0x28d5, 0x0) close(r2) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000500)=""/164) r3 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000001d80)=@raw={'raw\x00', 0x3c1, 0x3, 0xb18, 0x18e8, 0xffffff80, 0x178, 0x0, 0x178, 0x1a78, 0x22b, 0x258, 0x1a78, 0x258, 0x2034, 0x0, {[{{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xffffffff, 0xff, 0xff], [0x0, 0xff, 0xffffffff, 0xff000000], 'wlan1\x00', 'lo\x00', {}, {0xff}, 0x29, 0x4, 0x1}, 0x1d, 0x888, 0x8b8, 0x340, {0x1e0002a8, 0x7203000000000000}, [@common=@unspec=@u32={{0x7e0}, {[{[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x3}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1000}]}, {}, {[{}, {}, {}, {}, {0x9}], [{}, {}, {}, {}, {}, {}, {0x0, 0x8}, {0x0, 0x2}]}, {[{}, {0x0, 0x3}, {}, {}, {0x100}]}, {[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x2}], [{}, {}, {0x0, 0xfffffffd}, {}, {}, {}, {0x0, 0x2}]}, {[], [{}, {}, {}, {}, {}, {0x0, 0xffffffff}]}, {[], [{0x5}, {0x0, 0x8000000}]}, {[], [{0xfffffffe}, {}, {}, {}, {}, {0x0, 0x6}], 0x7, 0x7}, {[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x100}], [{}, {0x8000}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x3}]}, {[{0x0, 0x3}, {0x3416}, {}, {0x0, 0x1}], [{}, {}, {}, {}, {}, {}, {}, {0x0, 0x3}], 0x0, 0xa}, {[{}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {0x0, 0x2}]}]}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x46, 0x6, 0x1}}}, {{@ipv6={@loopback, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'veth1_to_bridge\x00', 'ip6gre0\x00', {0xff}}, 0x0, 0x160, 0x190, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @local, @private1, [], [], [], 0x0, 0xc}}, @common=@ipv6header={{0x28}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0xb78) r5 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f00000004c0)={'ip6_vti0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000600)={'syztnl1\x00', 0x0}) ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000080)={0x0}) clock_nanosleep(0x9, 0x0, &(0x7f0000000080)={0x0, 0x3938700}, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12011, r0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x24, 0x1, 0x0, 0x0, 0x0, 0x7, 0x539, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sigaltstack(0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0xac, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x22, 0x1, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x8}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0xd, 0x3, 0x6}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0xfffffffffffffd78, 0x5, 0x7}]}}]}, 0xac}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x34}}, 0x0) 489.26064ms ago: executing program 2 (id=473): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x24, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0, 0x4}, 0x1000, 0x0, 0x8, 0x1, 0xe3, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="5400000010000104000000000000000100000000", @ANYRES32=0x0, @ANYBLOB="fff00000000000002c0012800e00010069703667726574617000000018000280140007002001000000000000000000000000000208000a00", @ANYRES32], 0x54}, 0x1, 0x0, 0x0, 0x20081}, 0x0) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0x1000) listen(r1, 0x4) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x4}, 0x8) r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) r5 = openat$cgroup_subtree(r4, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r5, &(0x7f0000000140)={[{0x2b, 'cpu'}]}, 0x5) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r1, 0xf507, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r6, 0x84, 0xc, &(0x7f00000000c0), 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r6, 0x84, 0x6c, &(0x7f00000008c0)={r7, 0x10, "83cd73d913625563f3877450d9e218b0"}, &(0x7f0000000340)=0x18) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r6, 0x84, 0x6d, &(0x7f0000000240)={r8}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000444ff8)={r8, 0x7}, 0xfffffffffffffe4f) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xca}, 0x8) sendmmsg$inet6(r0, &(0x7f0000003c40)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000140)='j', 0x1}], 0x1}}], 0x1, 0x0) 360.30327ms ago: executing program 0 (id=474): syz_mount_image$ext4(&(0x7f00000004c0)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x3804402, &(0x7f0000000340), 0xfd, 0x564, &(0x7f0000000b00)="$eJzs3d9rW+UbAPDnpE33+7sOxvgqIoVdOJlL19YfE7yYl6LDgd7P0mZlNFlGk461Dtwu3I03MgQRB8Nr9d7L4T/gXzHQwZBRFPEmctKTmK3JmnXZmprPB872vjkne8+T9zzv3jcnIQEMrYn0j1zECxHxZRJxsG3faGQ7J9aPW3twdS7dkqjXP/o9iSR7rHl8kv29L6v8PyJ+/jzieG5ju9WV1cXZUqm4lNUna+VLk9WV1RMXyrMLxYXixemZmVNvzEy//dabfYv11bN/fvPhnfdOfXF07esf7x26mcTp2J/ta4/jKVxrr0zERPaa5OP0IwdO9aGxQZJs9wmwJSNZnucjHQMOxkiW9cB/32cRUQeGVCL/YUg15wHNtX2f1sE7xv131xdAG+MfXX9vJHY31kZ715KHVkbpene8D+2nbfz0262b6Rb9ex8CYFPXrkfEydHRjeNfko1/W3eyh2MebcP4B8/PnXT+81qn+U+uNf+JDvOffR1ydys2z//cvT4001U6/3un4/y3ddNqfCSrHWjM+fLJ+QulYjq2/S8ijkV+V1p/3P2cU2t36932tc//0i1tvzkXzM7j3uiuh58zP1ubfZqY292/HvFix/lv0ur/pEP/p6/H2R7bOFK89XK3fZvH/2zVv4t4pWP/51vHJI+/PznZuB4mm1fFRn/cOPJLt/a3O/60//eux/9XtiRs9X9mPGm/X1t98jZu7/672G3fVq//seTjRnkse+zKbK22NBUxlnyw8fHpf5/brDePT+M/dvTx41+n639PRHzSY/w3Dv/w0tbjf7bS+Oc7Xv/d+v/JC3ff//Tbzq3f7rH/X4+k7QZzL+Nfryf4VC8eAAAAAAAADJhcROyPJFdolXO5QmH98x2HY2+uVKnWjp+vLF+cj8Z3Zccjn2ve6T7Y9nmIqezzsM369CP1mYg4FBFfjexp1AtzldL8dgcPAAAAAAAAAAAAAAAAAAAAA2Jfl+//p34d2e6zA545P/kNw2vT/O/HLz0BA8n//zC85D8ML/kPw0v+w/CS/zC85D8ML/kPw0v+AwAAAAAAAAAAAAAAAAAAAAAAAAAAQF+dPXMm3eprD67OpfX5yyvLi5XLJ+aL1cVCeXmuMFdZulRYqFQWSsXCXKW82b9XqlQuTU3H8pXJWrFam6yurJ4rV5Yv1s5dKH9/IKKYfy5RAQAAAAAAAAAAAAAAAAAAwM5SXVldnC2ViksKjcKuGIjT2EGF0cE4DYU+FzoMFmPbMEABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQET8EwAA//+ndDnV") r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000000101010300000000000000000a0000030c0019800800010008000000100001800c0002"], 0x30}, 0x1, 0x0, 0x0, 0x8008001}, 0x24008854) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b}, 0x94) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) shutdown(r2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$nci(r3, 0x0, 0xfffffeea) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0x0}, 0x18) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8040) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/asound/seq/clients\x00', 0x0, 0x0) read$char_usb(r4, &(0x7f0000000000)=""/38, 0x26) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x6, &(0x7f0000000140)) r5 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$KDSKBENT(r5, 0x4b47, &(0x7f0000000400)={0x0, 0x7f, 0x20f}) 315.923034ms ago: executing program 4 (id=475): r0 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$restrict_keyring(0x1d, r0, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000040)='asymmetric\x00', &(0x7f0000000000)=@chain) request_key(&(0x7f0000000440)='trusted\x00', &(0x7f0000000480)={'syz', 0x3}, &(0x7f0000000640)='/d\v\xffa\x01\x00v/vcsu#\x00\xcd\xc0-4\x1dNJ\x9b9]\xe6\x1a\xe1\xe0%\x7f7\xc3R\xa5\xd1\xcd3\xa4\x1a\x05\xa0\x95\x7fO\xa0\x156\x8fK[\xeb\xb8&0\x0ew\xd8\xed\xd2\xc7\xa2/\xfe\xc6;\xe5F\x17\x86\xb6\xe5\x1fAtb\x1eT\x94\x86Z\xf6%\xdc\x84\xa6F\xe7\x9cs3\xa9\xd1\r\xe9\xd9\x900\x9dD*\b\x87\x98\xcb\xf6w\xb7\x1c\x0e\xe2\x0f[\x944\x91\xfc\xea}\x8by>c[\x04\x0e\xff\xe3*d\xf2\xb6\xde\xdbg\xd3\xa4\xab\xe82\xe5\xfc6\xdd\x10e\xf6\xc5\xd6\xe9\xab\x1c\xa2\xad\xcfS\x030\r0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x64, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0xffe0}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_flow={{0x9}, {0x34, 0x2, [@TCA_FLOW_EMATCHES={0x30, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x7}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{0x8, 0x9, 0x40}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x2}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x2008c014) syz_emit_ethernet(0x66, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=ANY=[@ANYBLOB="05000000040000000800000044"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fcntl$setsig(r7, 0xa, 0x13) fcntl$setlease(r7, 0x400, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x0) fcntl$setlease(r7, 0x400, 0x2) 156.949887ms ago: executing program 1 (id=477): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x100002, 0x0) write$cgroup_type(r0, 0x0, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x8801) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000001480)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$BLKTRACESETUP(r6, 0xc0481273, 0x0) getpid() syz_clone(0x6a000000, 0x0, 0x0, 0x0, 0x0, 0x0) 154.884247ms ago: executing program 0 (id=487): r0 = socket(0x28, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYRES64=r0], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x100000000000600d, 0x1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{}, &(0x7f0000000800), &(0x7f0000000840)}, 0x20) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x863, 0x0) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0xc9028ba210c11ff0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000093850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='kfree\x00', r3, 0x0, 0x10}, 0x18) ioctl$BLKTRACESETUP(r2, 0xc0481273, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) connect$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) connect$vsock_stream(r0, &(0x7f0000000400)={0x28, 0x0, 0x2710, @host}, 0x10) 54.749005ms ago: executing program 0 (id=478): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000d00)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x101000, 0x2) r2 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB], 0x30}}, 0x800) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) r4 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) write$selinux_validatetrans(r4, &(0x7f0000000300)={'system_u:object_r:restorecond_var_run_t:s0', 0x20, 'system_u:object_r:groupadd_exec_t:s0', 0x20, 0x2, 0x20, '/usr/lib/telepathy/mission-control-5\x00'}, 0x8a) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r5}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r6}, 0x10) r7 = syz_io_uring_setup(0x5c2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000000300)=0x0, &(0x7f0000000580)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_TIMEOUT={0xb, 0x1e, 0x0, 0x0, 0x3, &(0x7f0000000280)={0x0, 0x989680}}) io_uring_enter(r7, 0x6e2, 0x3900, 0x1, 0x0, 0xe00) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x2}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079d}) socketpair(0x1, 0x1, 0x1, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30a) ioctl$PERF_EVENT_IOC_SET_FILTER(r10, 0x8914, &(0x7f0000000080)) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f00000001c0)={'gre0\x00', 0x200}) 0s ago: executing program 4 (id=479): socket$kcm(0x10, 0x3, 0x10) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x22) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x80002, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x9, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, 0x0, 0x0) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x20000010) socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) dup3(r1, 0xffffffffffffffff, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES8=r1], 0x20}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) kernel console output (not intermixed with test programs): permissive=1 [ 34.081388][ T29] audit: type=1400 audit(1756558554.879:64): avc: denied { unmount } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.224256][ T3295] cgroup: Unknown subsys name 'cpuset' [ 34.230647][ T3295] cgroup: Unknown subsys name 'rlimit' [ 34.322526][ T29] audit: type=1400 audit(1756558555.139:65): avc: denied { setattr } for pid=3295 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.347015][ T29] audit: type=1400 audit(1756558555.149:66): avc: denied { create } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.367603][ T29] audit: type=1400 audit(1756558555.149:67): avc: denied { write } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.388188][ T29] audit: type=1400 audit(1756558555.149:68): avc: denied { read } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.408599][ T29] audit: type=1400 audit(1756558555.149:69): avc: denied { mounton } for pid=3295 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 34.433415][ T29] audit: type=1400 audit(1756558555.149:70): avc: denied { mount } for pid=3295 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 34.442363][ T3298] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 34.465765][ T29] audit: type=1400 audit(1756558555.289:71): avc: denied { relabelto } for pid=3298 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.498196][ T3295] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 36.423096][ T3305] chnl_net:caif_netlink_parms(): no params data found [ 36.467454][ T3308] chnl_net:caif_netlink_parms(): no params data found [ 36.535855][ T3305] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.543063][ T3305] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.550460][ T3305] bridge_slave_0: entered allmulticast mode [ 36.556958][ T3305] bridge_slave_0: entered promiscuous mode [ 36.563846][ T3305] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.570914][ T3305] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.578131][ T3305] bridge_slave_1: entered allmulticast mode [ 36.585145][ T3305] bridge_slave_1: entered promiscuous mode [ 36.615848][ T3308] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.623087][ T3308] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.630340][ T3308] bridge_slave_0: entered allmulticast mode [ 36.636924][ T3308] bridge_slave_0: entered promiscuous mode [ 36.643855][ T3308] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.650924][ T3308] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.658156][ T3308] bridge_slave_1: entered allmulticast mode [ 36.664546][ T3308] bridge_slave_1: entered promiscuous mode [ 36.680831][ T3313] chnl_net:caif_netlink_parms(): no params data found [ 36.702424][ T3305] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.712685][ T3308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.731921][ T3306] chnl_net:caif_netlink_parms(): no params data found [ 36.742312][ T3308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.752570][ T3305] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.800501][ T3308] team0: Port device team_slave_0 added [ 36.811818][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 36.826362][ T3308] team0: Port device team_slave_1 added [ 36.832846][ T3305] team0: Port device team_slave_0 added [ 36.839390][ T3305] team0: Port device team_slave_1 added [ 36.871525][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.878542][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.904485][ T3308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.935348][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.942342][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.968558][ T3308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.979637][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.986642][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.012699][ T3305] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.024096][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.031103][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.057068][ T3305] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.084816][ T3313] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.091971][ T3313] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.099322][ T3313] bridge_slave_0: entered allmulticast mode [ 37.105725][ T3313] bridge_slave_0: entered promiscuous mode [ 37.112268][ T3306] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.119502][ T3306] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.126676][ T3306] bridge_slave_0: entered allmulticast mode [ 37.133120][ T3306] bridge_slave_0: entered promiscuous mode [ 37.144401][ T3313] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.151477][ T3313] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.158666][ T3313] bridge_slave_1: entered allmulticast mode [ 37.165098][ T3313] bridge_slave_1: entered promiscuous mode [ 37.171334][ T3306] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.178477][ T3306] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.185754][ T3306] bridge_slave_1: entered allmulticast mode [ 37.192260][ T3306] bridge_slave_1: entered promiscuous mode [ 37.251547][ T3308] hsr_slave_0: entered promiscuous mode [ 37.257750][ T3308] hsr_slave_1: entered promiscuous mode [ 37.265665][ T3305] hsr_slave_0: entered promiscuous mode [ 37.271645][ T3305] hsr_slave_1: entered promiscuous mode [ 37.277699][ T3305] debugfs: 'hsr0' already exists in 'hsr' [ 37.283550][ T3305] Cannot create hsr debugfs directory [ 37.290033][ T3313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.300500][ T3306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.309969][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.317117][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.324378][ T3307] bridge_slave_0: entered allmulticast mode [ 37.330764][ T3307] bridge_slave_0: entered promiscuous mode [ 37.337806][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.344922][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.352096][ T3307] bridge_slave_1: entered allmulticast mode [ 37.358649][ T3307] bridge_slave_1: entered promiscuous mode [ 37.365595][ T3313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.380520][ T3306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.425125][ T3306] team0: Port device team_slave_0 added [ 37.439694][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.456667][ T3313] team0: Port device team_slave_0 added [ 37.462822][ T3306] team0: Port device team_slave_1 added [ 37.477733][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.492427][ T3313] team0: Port device team_slave_1 added [ 37.530946][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.538029][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.564308][ T3306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.577859][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.584928][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.610906][ T3306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.625070][ T3307] team0: Port device team_slave_0 added [ 37.633754][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.640965][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.666929][ T3313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.688164][ T3307] team0: Port device team_slave_1 added [ 37.694114][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.701065][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.727108][ T3313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.762633][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.769648][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.795708][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.827412][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.834424][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.860576][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.900783][ T3313] hsr_slave_0: entered promiscuous mode [ 37.906737][ T3313] hsr_slave_1: entered promiscuous mode [ 37.912651][ T3313] debugfs: 'hsr0' already exists in 'hsr' [ 37.918437][ T3313] Cannot create hsr debugfs directory [ 37.925995][ T3306] hsr_slave_0: entered promiscuous mode [ 37.932082][ T3306] hsr_slave_1: entered promiscuous mode [ 37.938117][ T3306] debugfs: 'hsr0' already exists in 'hsr' [ 37.943874][ T3306] Cannot create hsr debugfs directory [ 37.989930][ T3307] hsr_slave_0: entered promiscuous mode [ 37.995988][ T3307] hsr_slave_1: entered promiscuous mode [ 38.001859][ T3307] debugfs: 'hsr0' already exists in 'hsr' [ 38.007707][ T3307] Cannot create hsr debugfs directory [ 38.039352][ T3308] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.062214][ T3308] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.088816][ T3308] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.112023][ T3308] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.159004][ T3305] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 38.172875][ T3305] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 38.190149][ T3305] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 38.206587][ T3305] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 38.233058][ T3306] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 38.245651][ T3306] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 38.255726][ T3306] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 38.265791][ T3306] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 38.315394][ T3307] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 38.328119][ T3307] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 38.337965][ T3307] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 38.347256][ T3307] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 38.393255][ T3313] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 38.403298][ T3313] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 38.412229][ T3313] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 38.421873][ T3313] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 38.435621][ T3308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.445966][ T3305] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.473294][ T3308] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.485201][ T3305] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.499316][ T3306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.510054][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.517240][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.526648][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.533776][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.553575][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.560678][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.570819][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.577981][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.587738][ T3306] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.611077][ T3305] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 38.621523][ T3305] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 38.657520][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.664834][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.674535][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.681690][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.720467][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.733428][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.755214][ T3306] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 38.765772][ T3306] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 38.795116][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.812460][ T3313] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.830896][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.837997][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.849302][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.856523][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.865857][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.873205][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.883489][ T3305] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.902071][ T3308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.926484][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.933636][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.961502][ T3306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.988333][ T3307] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 39.062163][ T3305] veth0_vlan: entered promiscuous mode [ 39.086154][ T3305] veth1_vlan: entered promiscuous mode [ 39.112222][ T3313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.127118][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.139180][ T3305] veth0_macvtap: entered promiscuous mode [ 39.165717][ T3306] veth0_vlan: entered promiscuous mode [ 39.185794][ T3306] veth1_vlan: entered promiscuous mode [ 39.198302][ T3305] veth1_macvtap: entered promiscuous mode [ 39.210754][ T3308] veth0_vlan: entered promiscuous mode [ 39.228835][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.241203][ T3308] veth1_vlan: entered promiscuous mode [ 39.255087][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.271837][ T3308] veth0_macvtap: entered promiscuous mode [ 39.291622][ T3306] veth0_macvtap: entered promiscuous mode [ 39.304359][ T383] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.321408][ T3308] veth1_macvtap: entered promiscuous mode [ 39.333735][ T383] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.348399][ T3306] veth1_macvtap: entered promiscuous mode [ 39.355769][ T383] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.369535][ T383] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.384065][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.398318][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.413840][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.413787][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 39.413869][ T29] audit: type=1400 audit(1756558560.239:81): avc: denied { mounton } for pid=3305 comm="syz-executor" path="/root/syzkaller.VtQ7wI/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 39.430881][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.451589][ T29] audit: type=1400 audit(1756558560.239:82): avc: denied { mount } for pid=3305 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 39.480749][ T29] audit: type=1400 audit(1756558560.239:83): avc: denied { mounton } for pid=3305 comm="syz-executor" path="/root/syzkaller.VtQ7wI/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 39.506041][ T29] audit: type=1400 audit(1756558560.239:84): avc: denied { mount } for pid=3305 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 39.527811][ T29] audit: type=1400 audit(1756558560.239:85): avc: denied { mounton } for pid=3305 comm="syz-executor" path="/root/syzkaller.VtQ7wI/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 39.554476][ T29] audit: type=1400 audit(1756558560.239:86): avc: denied { mounton } for pid=3305 comm="syz-executor" path="/root/syzkaller.VtQ7wI/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 39.583134][ T29] audit: type=1400 audit(1756558560.239:87): avc: denied { unmount } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 39.602675][ T29] audit: type=1400 audit(1756558560.399:88): avc: denied { mounton } for pid=3305 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 39.626333][ T29] audit: type=1400 audit(1756558560.409:89): avc: denied { mount } for pid=3305 comm="syz-executor" name="/" dev="gadgetfs" ino=4750 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 39.633877][ T383] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.664590][ T3305] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 39.681799][ T383] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.690980][ T383] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.700021][ T383] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.723600][ T29] audit: type=1400 audit(1756558560.529:90): avc: denied { read write } for pid=3305 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 39.735315][ T3307] veth0_vlan: entered promiscuous mode [ 39.749056][ T3476] loop1: detected capacity change from 0 to 1024 [ 39.761796][ T3476] ======================================================= [ 39.761796][ T3476] WARNING: The mand mount option has been deprecated and [ 39.761796][ T3476] and is ignored by this kernel. Remove the mand [ 39.761796][ T3476] option from the mount to silence this warning. [ 39.761796][ T3476] ======================================================= [ 39.762599][ T383] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.806698][ T3476] EXT4-fs: inline encryption not supported [ 39.828112][ T3313] veth0_vlan: entered promiscuous mode [ 39.835506][ T383] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.864846][ T3313] veth1_vlan: entered promiscuous mode [ 39.871764][ T3307] veth1_vlan: entered promiscuous mode [ 39.874115][ T3476] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 39.889217][ T3307] veth0_macvtap: entered promiscuous mode [ 39.891188][ T3307] veth1_macvtap: entered promiscuous mode [ 39.903482][ T383] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.912413][ T3476] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.932706][ T3313] veth0_macvtap: entered promiscuous mode [ 39.952472][ T383] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.974951][ T3313] veth1_macvtap: entered promiscuous mode [ 39.983222][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.995372][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.007908][ T3486] tipc: Started in network mode [ 40.012852][ T3486] tipc: Node identity 06801a07ec29, cluster identity 4711 [ 40.020127][ T3486] tipc: Enabled bearer , priority 0 [ 40.033350][ T3486] syzkaller0: entered promiscuous mode [ 40.038907][ T3486] syzkaller0: entered allmulticast mode [ 40.045650][ T1387] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.057026][ T1387] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.066435][ T1387] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.075944][ T1387] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.086144][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.109014][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.120647][ T3486] tipc: Resetting bearer [ 40.138090][ T3486] tipc: Enabling of bearer rejected, already enabled [ 40.150028][ T383] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.162075][ T3486] +: renamed from syzkaller0 (while UP) [ 40.171765][ T3486] tipc: Disabling bearer [ 40.180141][ T383] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.188848][ C0] hrtimer: interrupt took 30243 ns [ 40.201814][ T383] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.230302][ T383] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.295132][ T3499] loop4: detected capacity change from 0 to 512 [ 40.327460][ T3499] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.347753][ T3499] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 40.573695][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 40.630745][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.670107][ T3513] smc: net device bond0 applied user defined pnetid SYZ0 [ 40.678034][ T3513] smc: net device bond0 erased user defined pnetid SYZ0 [ 40.682256][ T3515] syz.4.10 uses obsolete (PF_INET,SOCK_PACKET) [ 40.850185][ T3520] loop1: detected capacity change from 0 to 2048 [ 40.888965][ T3520] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 40.905596][ T3520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12'. [ 40.919270][ T3524] pim6reg: entered allmulticast mode [ 40.929077][ T3520] Driver unsupported XDP return value 0 on prog (id 9) dev N/A, expect packet loss! [ 40.931706][ T3518] pim6reg: left allmulticast mode [ 40.957855][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.041913][ T3518] syz.3.11 (3518) used greatest stack depth: 10200 bytes left [ 41.253381][ T3541] netlink: 24 bytes leftover after parsing attributes in process `syz.0.16'. [ 41.340642][ T3544] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2578 sclass=netlink_route_socket pid=3544 comm=syz.2.17 [ 41.408323][ T3544] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17'. [ 41.598955][ T3556] loop2: detected capacity change from 0 to 1024 [ 41.635872][ T3556] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.668062][ T3556] netlink: 61211 bytes leftover after parsing attributes in process `syz.2.20'. [ 41.679239][ T3562] smc: net device bond0 applied user defined pnetid SYZ2 [ 41.681342][ T3562] netlink: 14 bytes leftover after parsing attributes in process `syz.0.21'. [ 41.692013][ T3562] smc: removing net device bond0 with user defined pnetid SYZ2 [ 41.708863][ T3562] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 41.719402][ T3562] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 41.729632][ T3562] bond0 (unregistering): Released all slaves [ 41.806026][ T3307] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.867285][ T3568] loop2: detected capacity change from 0 to 512 [ 41.884710][ T3568] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 41.900152][ T3565] netlink: 4 bytes leftover after parsing attributes in process `syz.4.22'. [ 41.909286][ T3565] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 41.916763][ T3565] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 41.924997][ T3565] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 41.932398][ T3565] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 41.935741][ T3568] EXT4-fs (loop2): orphan cleanup on readonly fs [ 41.952229][ T3568] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:517: comm wޣ: Block bitmap for bg 0 marked uninitialized [ 41.968101][ T3568] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 41.978583][ T3414] IPVS: starting estimator thread 0... [ 41.985506][ T3568] EXT4-fs (loop2): 1 orphan inode deleted [ 41.993949][ T3568] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 42.125821][ T3577] netlink: 20 bytes leftover after parsing attributes in process `syz.3.26'. [ 42.137207][ T3577] netlink: 'syz.3.26': attribute type 10 has an invalid length. [ 42.143451][ T3572] IPVS: using max 2400 ests per chain, 120000 per kthread [ 42.156601][ T3577] team0: Port device dummy0 added [ 42.214846][ T3307] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.235016][ T3578] loop1: detected capacity change from 0 to 512 [ 42.245423][ T3578] EXT4-fs error (device loop1): ext4_orphan_get:1392: inode #15: comm syz.1.25: casefold flag without casefold feature [ 42.258584][ T3578] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.25: couldn't read orphan inode 15 (err -117) [ 42.272100][ T3578] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.742513][ T3588] netlink: 28 bytes leftover after parsing attributes in process `syz.2.29'. [ 42.751433][ T3588] netlink: 108 bytes leftover after parsing attributes in process `syz.2.29'. [ 42.761661][ T3588] netlink: 28 bytes leftover after parsing attributes in process `syz.2.29'. [ 42.985065][ T3590] mmap: syz.2.30 (3590) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 43.005269][ T3592] loop3: detected capacity change from 0 to 512 [ 43.091480][ T3596] loop0: detected capacity change from 0 to 512 [ 43.115393][ T3596] EXT4-fs (loop0): orphan cleanup on readonly fs [ 43.120950][ T3598] loop4: detected capacity change from 0 to 512 [ 43.121843][ T3596] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -13 [ 43.138173][ T3596] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 43.153628][ T3596] EXT4-fs error (device loop0): ext4_clear_blocks:876: inode #13: comm syz.0.32: attempt to clear invalid blocks 2 len 1 [ 43.178343][ T3596] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #13: comm syz.0.32: invalid indirect mapped block 1819239214 (level 0) [ 43.193064][ T3596] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #13: comm syz.0.32: invalid indirect mapped block 1819239214 (level 1) [ 43.194394][ T3598] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.209153][ T3596] EXT4-fs (loop0): 1 truncate cleaned up [ 43.220082][ T3598] ext4 filesystem being mounted at /4/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 43.226689][ T3596] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 43.258395][ T3606] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.270779][ T3596] EXT4-fs (loop0): warning: mounting fs with errors, running e2fsck is recommended [ 43.280758][ T3596] EXT4-fs error (device loop0): __ext4_remount:6740: comm syz.0.32: Abort forced by user [ 43.293055][ T3596] EXT4-fs (loop0): Remounting filesystem read-only [ 43.299738][ T3596] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 43.311260][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.355135][ T3308] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.355593][ T3606] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.412539][ T3615] loop0: detected capacity change from 0 to 1024 [ 43.423855][ T3606] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.435260][ T3615] EXT4-fs: Ignoring removed nobh option [ 43.440887][ T3615] EXT4-fs: Ignoring removed bh option [ 43.455801][ T3615] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.489063][ T3606] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.505482][ T3623] netlink: 'syz.4.39': attribute type 11 has an invalid length. [ 43.573157][ T383] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.583846][ T383] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.592713][ T383] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.601517][ T383] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.726145][ T3308] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.054302][ T3623] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 44.217326][ T3645] hub 9-0:1.0: USB hub found [ 44.223461][ T3645] hub 9-0:1.0: 8 ports detected [ 44.226924][ T3648] 9pnet_fd: p9_fd_create_tcp (3648): problem connecting socket to 127.0.0.1 [ 44.250589][ T3645] loop0: detected capacity change from 0 to 1024 [ 44.264940][ T3645] EXT4-fs: Ignoring removed bh option [ 44.270975][ T3645] EXT4-fs: inline encryption not supported [ 44.277583][ T3645] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 44.288795][ T3645] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 44.299242][ T3645] EXT4-fs error (device loop0): ext4_map_blocks:778: inode #3: block 2: comm syz.0.42: lblock 2 mapped to illegal pblock 2 (length 1) [ 44.303275][ T3652] netlink: 'syz.4.44': attribute type 21 has an invalid length. [ 44.314917][ T3645] EXT4-fs error (device loop0): ext4_map_blocks:778: inode #3: block 48: comm syz.0.42: lblock 0 mapped to illegal pblock 48 (length 1) [ 44.320920][ T3652] netlink: 'syz.4.44': attribute type 4 has an invalid length. [ 44.338342][ T3645] EXT4-fs error (device loop0): ext4_acquire_dquot:6937: comm syz.0.42: Failed to acquire dquot type 0 [ 44.354793][ T3645] EXT4-fs error (device loop0) in ext4_reserve_inode_write:6334: Corrupt filesystem [ 44.364462][ T3645] EXT4-fs error (device loop0): ext4_evict_inode:254: inode #11: comm syz.0.42: mark_inode_dirty error [ 44.376176][ T3645] EXT4-fs warning (device loop0): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 44.387042][ T3645] EXT4-fs (loop0): 1 orphan inode deleted [ 44.393267][ T3645] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 44.406983][ T51] EXT4-fs error (device loop0): ext4_map_blocks:778: inode #3: block 1: comm kworker/u8:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 44.425955][ T51] __quota_error: 603 callbacks suppressed [ 44.425973][ T51] Quota error (device loop0): remove_tree: Can't read quota data block 1 [ 44.440321][ T51] EXT4-fs error (device loop0): ext4_release_dquot:6973: comm kworker/u8:3: Failed to release dquot type 0 [ 44.490595][ T3655] IPv6: Can't replace route, no match found [ 44.533882][ T3308] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.544360][ T3308] EXT4-fs error (device loop0): __ext4_get_inode_loc:4861: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 44.550840][ T3657] loop4: detected capacity change from 0 to 512 [ 44.559819][ T3308] EXT4-fs error (device loop0) in ext4_reserve_inode_write:6334: Corrupt filesystem [ 44.574336][ T29] audit: type=1400 audit(1756558565.399:692): avc: denied { firmware_load } for pid=3654 comm="syz.3.45" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 44.587355][ T3308] EXT4-fs error (device loop0): ext4_quota_off:7221: inode #3: comm syz-executor: mark_inode_dirty error [ 44.612709][ T3657] EXT4-fs error (device loop4): ext4_iget_extra_inode:5104: inode #15: comm syz.4.46: corrupted in-inode xattr: bad e_name length [ 44.633538][ T3657] EXT4-fs error (device loop4): ext4_orphan_get:1397: comm syz.4.46: couldn't read orphan inode 15 (err -117) [ 44.652595][ T3657] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.669237][ T3657] EXT4-fs warning (device loop4): dx_probe:861: inode #2: comm syz.4.46: dx entry: limit 0 != root limit 125 [ 44.680957][ T3657] EXT4-fs warning (device loop4): dx_probe:934: inode #2: comm syz.4.46: Corrupt directory, running e2fsck is recommended [ 44.693823][ T3657] EXT4-fs error (device loop4): ext4_readdir:264: inode #2: block 3: comm syz.4.46: path /8/file7: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=4294967295, rec_len=7, size=1024 fake=0 [ 44.703061][ T3662] netlink: 'syz.0.47': attribute type 36 has an invalid length. [ 44.723232][ T3655] syz.3.45 (3655) used greatest stack depth: 9440 bytes left [ 44.751355][ T29] audit: type=1326 audit(1756558565.569:693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3656 comm="syz.4.46" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 44.774835][ T29] audit: type=1326 audit(1756558565.569:694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3656 comm="syz.4.46" exe="/root/syz-executor" sig=0 arch=c000003e syscall=447 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 44.798014][ T29] audit: type=1326 audit(1756558565.569:695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3656 comm="syz.4.46" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 44.821477][ T29] audit: type=1326 audit(1756558565.569:696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3656 comm="syz.4.46" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 44.844942][ T29] audit: type=1326 audit(1756558565.569:697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3656 comm="syz.4.46" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 44.868328][ T29] audit: type=1326 audit(1756558565.569:698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3656 comm="syz.4.46" exe="/root/syz-executor" sig=0 arch=c000003e syscall=51 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 44.892116][ T29] audit: type=1326 audit(1756558565.569:699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3656 comm="syz.4.46" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 44.915683][ T29] audit: type=1326 audit(1756558565.569:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3656 comm="syz.4.46" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 44.978568][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.064064][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.167839][ T3681] loop1: detected capacity change from 0 to 1024 [ 45.176908][ T3681] ext4: Unknown parameter 'uid<00000000000000000000' [ 45.484474][ T3687] vhci_hcd: invalid port number 67 [ 45.772165][ T3691] loop4: detected capacity change from 0 to 1024 [ 45.786375][ T3695] capability: warning: `syz.3.58' uses deprecated v2 capabilities in a way that may be insecure [ 45.799755][ T3691] journal_path: Non-blockdev passed as './file0' [ 45.806241][ T3691] EXT4-fs: error: could not find journal device path [ 45.916169][ T3705] netlink: 'syz.3.60': attribute type 1 has an invalid length. [ 46.105043][ T3723] __nla_validate_parse: 11 callbacks suppressed [ 46.105059][ T3723] netlink: 8 bytes leftover after parsing attributes in process `syz.0.64'. [ 46.134953][ T3723] netlink: 12 bytes leftover after parsing attributes in process `syz.0.64'. [ 46.890747][ T3744] netlink: 24 bytes leftover after parsing attributes in process `syz.0.65'. [ 46.945881][ T3745] atomic_op ffff88811a114d28 conn xmit_atomic 0000000000000000 [ 47.398582][ T3751] netlink: 36 bytes leftover after parsing attributes in process `syz.2.68'. [ 47.407521][ T3751] netlink: 36 bytes leftover after parsing attributes in process `syz.2.68'. [ 47.454000][ T3759] loop1: detected capacity change from 0 to 512 [ 47.472061][ T3751] wireguard0: entered promiscuous mode [ 47.477840][ T3751] wireguard0: entered allmulticast mode [ 47.489255][ T3763] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.498080][ T3763] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.506849][ T3759] EXT4-fs (loop1): orphan cleanup on readonly fs [ 47.519196][ T3759] EXT4-fs error (device loop1): ext4_acquire_dquot:6937: comm syz.1.71: Failed to acquire dquot type 1 [ 47.531679][ T3763] netlink: 'syz.4.72': attribute type 5 has an invalid length. [ 47.552305][ T3759] EXT4-fs (loop1): 1 truncate cleaned up [ 47.560177][ T3759] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 47.582069][ T3759] EXT4-fs (loop1): warning: mounting fs with errors, running e2fsck is recommended [ 47.592529][ T3759] EXT4-fs warning (device loop1): read_mmp_block:115: Error -117 while reading MMP block 8 [ 47.616806][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.777984][ T3773] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 47.996059][ T3783] netlink: 4 bytes leftover after parsing attributes in process `syz.1.77'. [ 48.013786][ T3783] netlink: 4 bytes leftover after parsing attributes in process `syz.1.77'. [ 48.927108][ T3832] loop1: detected capacity change from 0 to 512 [ 48.956923][ T3832] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 48.970175][ T3832] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 49.007234][ T3832] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #16: comm syz.1.83: invalid indirect mapped block 4294967295 (level 0) [ 49.047231][ T3832] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #16: comm syz.1.83: invalid indirect mapped block 4294967295 (level 1) [ 49.082099][ T3832] EXT4-fs (loop1): 1 orphan inode deleted [ 49.087928][ T3832] EXT4-fs (loop1): 1 truncate cleaned up [ 49.105489][ T3832] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 49.119445][ T3840] netlink: 28 bytes leftover after parsing attributes in process `syz.2.85'. [ 49.130785][ T3840] netem: change failed [ 49.177910][ T3844] loop4: detected capacity change from 0 to 2048 [ 49.241333][ T3844] EXT4-fs (loop4): mounted filesystem 00000800-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 49.255652][ T3832] EXT4-fs error (device loop1): ext4_find_dest_de:2052: inode #2: block 13: comm syz.1.83: bad entry in directory: rec_len is too small for name_len - offset=12, inode=2, rec_len=12, size=1024 fake=0 [ 49.295537][ T3857] random: crng reseeded on system resumption [ 49.310205][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.375769][ T3872] netlink: 5 bytes leftover after parsing attributes in process `syz.1.92'. [ 49.384724][ T3872] 0{X: renamed from gretap0 (while UP) [ 49.392072][ T3872] 0{X: entered allmulticast mode [ 49.398274][ T3872] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 49.564244][ T29] kauditd_printk_skb: 517 callbacks suppressed [ 49.564261][ T29] audit: type=1400 audit(1756558570.389:1216): avc: denied { write } for pid=3880 comm="syz.2.94" name="event2" dev="devtmpfs" ino=245 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 49.595879][ T29] audit: type=1400 audit(1756558570.389:1217): avc: denied { open } for pid=3880 comm="syz.2.94" path="/dev/input/event2" dev="devtmpfs" ino=245 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 49.619909][ T29] audit: type=1400 audit(1756558570.399:1218): avc: denied { ioctl } for pid=3880 comm="syz.2.94" path="/dev/input/event2" dev="devtmpfs" ino=245 ioctlcmd=0x4518 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 49.645568][ T29] audit: type=1400 audit(1756558570.399:1219): avc: denied { watch watch_reads } for pid=3880 comm="syz.2.94" path="/22" dev="tmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 49.668326][ T29] audit: type=1326 audit(1756558570.399:1220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3880 comm="syz.2.94" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb52825ebe9 code=0x7ffc0000 [ 49.695696][ T29] audit: type=1326 audit(1756558570.399:1221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3880 comm="syz.2.94" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fb52825ebe9 code=0x7ffc0000 [ 49.747594][ T29] audit: type=1326 audit(1756558570.569:1222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3888 comm="syz.1.95" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbb86dfebe9 code=0x7ffc0000 [ 49.772116][ T29] audit: type=1326 audit(1756558570.569:1223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3888 comm="syz.1.95" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbb86dfebe9 code=0x7ffc0000 [ 49.795592][ T29] audit: type=1326 audit(1756558570.569:1224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3888 comm="syz.1.95" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fbb86dfebe9 code=0x7ffc0000 [ 49.795643][ T29] audit: type=1326 audit(1756558570.569:1225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3888 comm="syz.1.95" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbb86dfebe9 code=0x7ffc0000 [ 49.963689][ T3893] batman_adv: batadv0: Adding interface: dummy0 [ 49.969999][ T3893] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 49.996825][ T3893] batman_adv: batadv0: Interface activated: dummy0 [ 50.013544][ T3313] EXT4-fs (loop4): unmounting filesystem 00000800-0000-0000-0000-000000000000. [ 50.017414][ T3893] batadv0: mtu less than device minimum [ 50.028739][ T3893] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 50.039522][ T3893] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 50.050416][ T3893] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 50.061199][ T3893] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 50.071949][ T3893] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 50.082901][ T3893] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 50.083796][ T3894] netlink: 'syz.1.96': attribute type 10 has an invalid length. [ 50.093727][ T3893] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 50.112009][ T3893] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 50.132276][ T3894] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.189223][ T3894] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 50.238034][ T3908] netlink: 4 bytes leftover after parsing attributes in process `syz.4.99'. [ 50.258574][ T3908] netlink: 'syz.4.99': attribute type 14 has an invalid length. [ 50.386295][ T3918] loop1: detected capacity change from 0 to 512 [ 50.397055][ T3918] EXT4-fs: Ignoring removed i_version option [ 50.440533][ T3918] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=e000c018, mo2=0002] [ 50.457118][ T3918] System zones: 0-2, 18-18, 34-35 [ 50.463012][ T3918] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 50.483485][ T3918] ext4 filesystem being mounted at /19/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 50.548790][ T3918] program syz.1.103 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 50.600988][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.704720][ T3952] loop1: detected capacity change from 0 to 1024 [ 50.712930][ T3957] loop4: detected capacity change from 0 to 128 [ 50.735142][ T3952] EXT4-fs: Ignoring removed oldalloc option [ 50.741151][ T3952] EXT4-fs: Ignoring removed bh option [ 50.816262][ T3952] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 51.145406][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.322792][ T3975] GUP no longer grows the stack in syz.1.111 (3975): 200000005000-200000008000 (200000004000) [ 51.333196][ T3975] CPU: 0 UID: 0 PID: 3975 Comm: syz.1.111 Not tainted syzkaller #0 PREEMPT(voluntary) [ 51.333265][ T3975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 51.333280][ T3975] Call Trace: [ 51.333287][ T3975] [ 51.333296][ T3975] __dump_stack+0x1d/0x30 [ 51.333328][ T3975] dump_stack_lvl+0xe8/0x140 [ 51.333404][ T3975] dump_stack+0x15/0x1b [ 51.333422][ T3975] fixup_user_fault+0x50e/0x560 [ 51.333468][ T3975] fault_in_user_writeable+0x5d/0xd0 [ 51.333526][ T3975] futex_lock_pi+0x597/0x780 [ 51.333559][ T3975] ? __pfx_futex_wake_mark+0x10/0x10 [ 51.333681][ T3975] do_futex+0x21f/0x380 [ 51.333710][ T3975] __se_sys_futex+0x2ed/0x360 [ 51.333741][ T3975] __x64_sys_futex+0x78/0x90 [ 51.333829][ T3975] x64_sys_call+0x2e39/0x2ff0 [ 51.333852][ T3975] do_syscall_64+0xd2/0x200 [ 51.333883][ T3975] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 51.333968][ T3975] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 51.333997][ T3975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 51.334096][ T3975] RIP: 0033:0x7fbb86dfebe9 [ 51.334113][ T3975] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 51.334134][ T3975] RSP: 002b:00007fbb8585f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 51.334155][ T3975] RAX: ffffffffffffffda RBX: 00007fbb87035fa0 RCX: 00007fbb86dfebe9 [ 51.334169][ T3975] RDX: 00000000fffffffd RSI: 000000000000008d RDI: 0000200000004000 [ 51.334187][ T3975] RBP: 00007fbb86e81e19 R08: 0000000000000000 R09: 0000000000000000 [ 51.334202][ T3975] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 51.334215][ T3975] R13: 00007fbb87036038 R14: 00007fbb87035fa0 R15: 00007fffd60efea8 [ 51.334236][ T3975] [ 51.643171][ T3986] loop1: detected capacity change from 0 to 2048 [ 51.696008][ T3986] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 51.729531][ T3986] netlink: 'syz.1.114': attribute type 27 has an invalid length. [ 51.778814][ T3986] 0{X: left allmulticast mode [ 51.807225][ T3998] loop4: detected capacity change from 0 to 128 [ 51.905249][ T3986] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.912651][ T3986] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.930576][ T3363] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 51.938186][ T3363] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 51.945668][ T3363] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 51.980659][ T3986] batman_adv: batadv0: Interface deactivated: dummy0 [ 51.998211][ T3363] hid-generic 0003:0004:0000.0001: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 52.031285][ T3986] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 52.043514][ T3986] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 52.094728][ T1387] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.126272][ T1387] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.154734][ T1387] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.183914][ T1387] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.214066][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.325474][ T4017] netlink: 'syz.1.118': attribute type 21 has an invalid length. [ 52.333268][ T4017] __nla_validate_parse: 2 callbacks suppressed [ 52.339566][ T4017] netlink: 128 bytes leftover after parsing attributes in process `syz.1.118'. [ 52.387894][ T4017] netlink: 'syz.1.118': attribute type 5 has an invalid length. [ 52.395599][ T4017] netlink: 'syz.1.118': attribute type 6 has an invalid length. [ 52.403408][ T4017] netlink: 3 bytes leftover after parsing attributes in process `syz.1.118'. [ 52.435691][ T4016] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 52.442357][ T4016] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 52.449909][ T4016] vhci_hcd vhci_hcd.0: Device attached [ 52.514554][ T4019] vhci_hcd: connection closed [ 52.516006][ T1456] vhci_hcd: stop threads [ 52.525055][ T1456] vhci_hcd: release socket [ 52.529531][ T1456] vhci_hcd: disconnect device [ 52.685194][ T4030] netlink: 4 bytes leftover after parsing attributes in process `syz.3.120'. [ 52.874059][ T4046] netlink: 4 bytes leftover after parsing attributes in process `syz.3.124'. [ 52.929613][ T4046] team0 (unregistering): Port device team_slave_0 removed [ 52.938778][ T4046] team0 (unregistering): Port device team_slave_1 removed [ 52.948595][ T4046] team0 (unregistering): Port device dummy0 removed [ 52.967374][ T4088] netlink: 4 bytes leftover after parsing attributes in process `syz.2.125'. [ 52.977117][ T4088] netlink: 4 bytes leftover after parsing attributes in process `syz.2.125'. [ 53.070858][ T4116] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 53.135498][ T4118] netlink: 'syz.3.128': attribute type 3 has an invalid length. [ 53.336085][ T4119] random: crng reseeded on system resumption [ 53.421175][ T4134] lo speed is unknown, defaulting to 1000 [ 53.427304][ T4134] lo speed is unknown, defaulting to 1000 [ 53.433703][ T4134] lo speed is unknown, defaulting to 1000 [ 53.440709][ T4134] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 53.449289][ T4134] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 53.466598][ T4134] lo speed is unknown, defaulting to 1000 [ 53.473842][ T4134] lo speed is unknown, defaulting to 1000 [ 53.480055][ T4134] lo speed is unknown, defaulting to 1000 [ 53.507187][ T4134] lo speed is unknown, defaulting to 1000 [ 53.529417][ T4134] lo speed is unknown, defaulting to 1000 [ 53.640507][ T4142] bridge_slave_0: left allmulticast mode [ 53.646247][ T4142] bridge_slave_0: left promiscuous mode [ 53.651934][ T4142] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.672541][ T4145] loop4: detected capacity change from 0 to 1024 [ 53.681238][ T4142] bridge_slave_1: left allmulticast mode [ 53.687179][ T4142] bridge_slave_1: left promiscuous mode [ 53.692919][ T4142] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.712873][ T4142] bond0: (slave bond_slave_0): Releasing backup interface [ 53.737476][ T4142] bond0: (slave bond_slave_1): Releasing backup interface [ 53.775881][ T4142] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 53.783553][ T4142] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 53.803035][ T4142] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 53.810627][ T4142] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 53.847669][ T10] lo speed is unknown, defaulting to 1000 [ 53.870116][ T4145] EXT4-fs (loop4): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 53.881091][ T4145] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 53.896811][ T4145] JBD2: no valid journal superblock found [ 53.902587][ T4145] EXT4-fs (loop4): Could not load journal inode [ 53.972638][ T4145] SELinux: security_context_str_to_sid (-Xܘ7.H\ %u@) failed with errno=-22 [ 53.987019][ T3396] IPVS: starting estimator thread 0... [ 54.025700][ T4167] netlink: 12 bytes leftover after parsing attributes in process `syz.2.136'. [ 54.062574][ T4167] lo speed is unknown, defaulting to 1000 [ 54.074601][ T4165] IPVS: using max 2400 ests per chain, 120000 per kthread [ 54.087376][ T4169] SELinux: failed to load policy [ 54.138580][ T4181] Zero length message leads to an empty skb [ 54.511736][ T4189] lo speed is unknown, defaulting to 1000 [ 54.570801][ T4215] vxcan3: entered promiscuous mode [ 54.576021][ T4215] vxcan3: entered allmulticast mode [ 54.708213][ T29] kauditd_printk_skb: 493 callbacks suppressed [ 54.708229][ T29] audit: type=1400 audit(1756558575.529:1719): avc: denied { open } for pid=4214 comm="syz.2.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 54.733712][ T29] audit: type=1400 audit(1756558575.529:1720): avc: denied { kernel } for pid=4214 comm="syz.2.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 54.771675][ T29] audit: type=1400 audit(1756558575.589:1721): avc: denied { block_suspend } for pid=4214 comm="syz.2.142" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 54.897626][ T29] audit: type=1326 audit(1756558575.719:1722): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4243 comm="syz.0.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fd8e8ebe9 code=0x7ffc0000 [ 54.921147][ T29] audit: type=1326 audit(1756558575.719:1723): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4243 comm="syz.0.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fd8e8ebe9 code=0x7ffc0000 [ 54.944730][ T29] audit: type=1326 audit(1756558575.719:1724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4243 comm="syz.0.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f4fd8e8ebe9 code=0x7ffc0000 [ 54.968113][ T29] audit: type=1326 audit(1756558575.719:1725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4243 comm="syz.0.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fd8e8ebe9 code=0x7ffc0000 [ 54.991572][ T29] audit: type=1326 audit(1756558575.719:1726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4243 comm="syz.0.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=275 compat=0 ip=0x7f4fd8e8ebe9 code=0x7ffc0000 [ 55.015138][ T29] audit: type=1326 audit(1756558575.719:1727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4243 comm="syz.0.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f4fd8e85ba7 code=0x7ffc0000 [ 55.040172][ T29] audit: type=1326 audit(1756558575.719:1728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4243 comm="syz.0.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4fd8e2adb9 code=0x7ffc0000 [ 55.148361][ T4246] netlink: 20 bytes leftover after parsing attributes in process `syz.1.144'. [ 55.817719][ T4304] netlink: 8 bytes leftover after parsing attributes in process `syz.3.153'. [ 55.915190][ T4304] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=25 sclass=netlink_audit_socket pid=4304 comm=syz.3.153 [ 55.996846][ T4318] netlink: 16 bytes leftover after parsing attributes in process `syz.1.156'. [ 56.027302][ T4318] net_ratelimit: 113 callbacks suppressed [ 56.027356][ T4318] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 56.251469][ T4321] lo speed is unknown, defaulting to 1000 [ 56.318740][ T4355] loop1: detected capacity change from 0 to 512 [ 56.337919][ T4355] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 56.377717][ T4355] EXT4-fs (loop1): 1 truncate cleaned up [ 56.386112][ T4355] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 56.464546][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.489159][ T4368] loop1: detected capacity change from 0 to 512 [ 56.543710][ T4370] loop4: detected capacity change from 0 to 128 [ 56.562680][ T4370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.571844][ T4370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.721976][ T4405] hsr_slave_1 (unregistering): left promiscuous mode [ 56.866700][ T4424] netlink: 'syz.1.167': attribute type 6 has an invalid length. [ 56.908598][ T4431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.917609][ T4431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.924404][ T4438] netlink: 'syz.1.171': attribute type 1 has an invalid length. [ 56.935547][ T4438] loop1: detected capacity change from 0 to 128 [ 56.955000][ T4438] FAT-fs (loop1): error, invalid access to FAT (entry 0x00000100) [ 56.962905][ T4438] FAT-fs (loop1): Filesystem has been set read-only [ 56.969891][ T4438] syz.1.171: attempt to access beyond end of device [ 56.969891][ T4438] loop1: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 56.983575][ T4438] FAT-fs (loop1): error, invalid access to FAT (entry 0x00000100) [ 56.991402][ T4438] FAT-fs (loop1): error, invalid access to FAT (entry 0x00000100) [ 57.000099][ T4438] syz.1.171: attempt to access beyond end of device [ 57.000099][ T4438] loop1: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 57.024143][ T4438] syz.1.171: attempt to access beyond end of device [ 57.024143][ T4438] loop1: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 57.145933][ T4454] loop9: detected capacity change from 0 to 7 [ 57.152558][ T4454] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.160676][ T4454] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.168588][ T4454] loop9: unable to read partition table [ 57.174395][ T4454] loop_reread_partitions: partition scan of loop9 (被xڬdGݡ [ 57.174395][ T4454] ) failed (rc=-5) [ 57.176402][ T3297] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.191036][ T4454] netlink: 'syz.1.174': attribute type 4 has an invalid length. [ 57.198204][ T3297] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.211872][ T3297] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.220098][ T3297] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.228473][ T3297] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.346410][ T4448] lo speed is unknown, defaulting to 1000 [ 57.470211][ T4466] netlink: 'syz.4.175': attribute type 10 has an invalid length. [ 57.478159][ T4466] __nla_validate_parse: 10 callbacks suppressed [ 57.478180][ T4466] netlink: 40 bytes leftover after parsing attributes in process `syz.4.175'. [ 57.587510][ T4501] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4501 comm=syz.1.180 [ 57.628870][ T4501] netlink: 12 bytes leftover after parsing attributes in process `syz.1.180'. [ 57.660765][ T4466] dummy0: entered promiscuous mode [ 57.667126][ T4466] bridge0: port 3(dummy0) entered blocking state [ 57.673556][ T4466] bridge0: port 3(dummy0) entered disabled state [ 57.680186][ T4466] dummy0: entered allmulticast mode [ 57.686409][ T4466] bridge0: port 3(dummy0) entered blocking state [ 57.692955][ T4466] bridge0: port 3(dummy0) entered forwarding state [ 57.938105][ T4501] netlink: 8 bytes leftover after parsing attributes in process `syz.1.180'. [ 58.039453][ T4551] loop4: detected capacity change from 0 to 512 [ 58.113115][ T4551] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 58.286899][ T4564] !: renamed from dummy0 (while UP) [ 58.334838][ T4570] lo speed is unknown, defaulting to 1000 [ 58.437871][ T4565] lo speed is unknown, defaulting to 1000 [ 58.610934][ T4637] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 58.630848][ T4570] veth1_macvtap: left promiscuous mode [ 58.631614][ T4637] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 58.657168][ T4637] loop1: detected capacity change from 0 to 1024 [ 58.676045][ T4637] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 58.688298][ T4637] ext4 filesystem being mounted at /40/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 58.706560][ T4637] process 'syz.1.189' launched './file1' with NULL argv: empty string added [ 58.982291][ T4664] loop4: detected capacity change from 0 to 1024 [ 58.995750][ T4664] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 59.074466][ T4670] block device autoloading is deprecated and will be removed. [ 59.113337][ T4670] lo speed is unknown, defaulting to 1000 [ 59.254563][ T4645] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm ext4lazyinit: bg 0: block 393: padding at end of block bitmap is not set [ 59.488302][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.502186][ T4696] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4183: comm syz.4.193: Allocating blocks 449-513 which overlap fs metadata [ 59.599211][ T4712] netlink: 8 bytes leftover after parsing attributes in process `syz.1.196'. [ 59.767086][ T4714] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=25 sclass=netlink_audit_socket pid=4714 comm=syz.1.196 [ 59.785940][ T29] kauditd_printk_skb: 503 callbacks suppressed [ 59.785956][ T29] audit: type=1400 audit(1756558580.569:2232): avc: denied { unlink } for pid=3308 comm="syz-executor" name="file0" dev="tmpfs" ino=202 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 59.815036][ T4662] EXT4-fs (loop4): pa ffff8881055360e0: logic 48, phys. 177, len 21 [ 59.823273][ T4662] EXT4-fs error (device loop4): ext4_mb_release_inode_pa:5434: group 0, free 0, pa_free 4 [ 60.004525][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 60.179668][ T29] audit: type=1400 audit(1756558580.979:2233): avc: denied { load_policy } for pid=4726 comm="syz.4.198" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 60.390343][ T4727] SELinux: failed to load policy [ 60.858635][ T29] audit: type=1400 audit(1756558581.319:2234): avc: denied { connect } for pid=4731 comm="syz.2.200" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 60.878192][ T29] audit: type=1400 audit(1756558581.319:2235): avc: denied { write } for pid=4731 comm="syz.2.200" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 60.941708][ T4736] lo speed is unknown, defaulting to 1000 [ 61.015455][ T4752] loop4: detected capacity change from 0 to 1024 [ 61.042299][ T4752] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 61.057861][ T4752] ext4 filesystem being mounted at /39/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 61.108121][ T29] audit: type=1326 audit(1756558581.929:2236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4751 comm="syz.4.203" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 61.131639][ T29] audit: type=1326 audit(1756558581.929:2237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4751 comm="syz.4.203" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 61.157864][ T29] audit: type=1326 audit(1756558581.979:2238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4751 comm="syz.4.203" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 61.181485][ T29] audit: type=1326 audit(1756558581.979:2239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4751 comm="syz.4.203" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 61.204953][ T29] audit: type=1326 audit(1756558581.979:2240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4751 comm="syz.4.203" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 61.233805][ T29] audit: type=1326 audit(1756558582.059:2241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4751 comm="syz.4.203" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 61.267270][ T4752] netlink: 8 bytes leftover after parsing attributes in process `syz.4.203'. [ 61.277062][ T4752] netlink: 'syz.4.203': attribute type 1 has an invalid length. [ 61.284788][ T4752] netlink: 224 bytes leftover after parsing attributes in process `syz.4.203'. [ 61.347676][ T4736] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.357346][ T4736] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.428105][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 61.506663][ T4795] loop0: detected capacity change from 0 to 128 [ 61.595669][ T4803] netlink: 'syz.4.206': attribute type 36 has an invalid length. [ 61.825905][ T4807] usb usb1: check_ctrlrecip: process 4807 (syz.2.208) requesting ep 01 but needs 81 [ 61.835504][ T4807] vhci_hcd: default hub control req: 020f v0004 i0001 l0 [ 61.964884][ T4810] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4810 comm=syz.2.210 [ 61.965695][ T4812] vxcan3: entered promiscuous mode [ 61.978854][ T4810] netlink: 12 bytes leftover after parsing attributes in process `syz.2.210'. [ 61.982355][ T4812] vxcan3: entered allmulticast mode [ 62.035269][ T4820] netlink: 8 bytes leftover after parsing attributes in process `syz.2.210'. [ 62.447960][ T4871] netlink: 16 bytes leftover after parsing attributes in process `syz.4.214'. [ 62.464465][ T4871] netlink: 4 bytes leftover after parsing attributes in process `syz.4.214'. [ 62.480215][ T4871] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 62.842045][ T4879] loop4: detected capacity change from 0 to 512 [ 63.128111][ T4891] loop4: detected capacity change from 0 to 1024 [ 63.143848][ T4891] EXT4-fs: dax option not supported [ 63.225372][ T4897] netlink: 16 bytes leftover after parsing attributes in process `syz.2.227'. [ 63.263048][ T4899] loop0: detected capacity change from 0 to 1024 [ 63.285054][ T4899] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 63.301192][ T4905] netlink: 20 bytes leftover after parsing attributes in process `syz.4.218'. [ 63.310157][ T4905] netlink: 8 bytes leftover after parsing attributes in process `syz.4.218'. [ 63.324508][ T4899] ext4 filesystem being mounted at /40/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 63.376675][ T4899] netlink: 8 bytes leftover after parsing attributes in process `syz.0.217'. [ 63.391091][ T4899] netlink: 'syz.0.217': attribute type 1 has an invalid length. [ 63.398822][ T4899] netlink: 224 bytes leftover after parsing attributes in process `syz.0.217'. [ 63.462276][ T3308] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 63.523166][ T4921] netlink: 28 bytes leftover after parsing attributes in process `syz.0.219'. [ 63.541966][ T4921] netem: change failed [ 63.559732][ T4921] loop0: detected capacity change from 0 to 1024 [ 63.576779][ T4921] EXT4-fs: Ignoring removed orlov option [ 63.582502][ T4921] EXT4-fs: Ignoring removed nomblk_io_submit option [ 63.614344][ T4921] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 63.732122][ T4941] netlink: 20 bytes leftover after parsing attributes in process `syz.4.224'. [ 63.746679][ T4935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 63.774156][ T4935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.874885][ T3308] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 63.932417][ T4963] loop0: detected capacity change from 0 to 512 [ 64.252619][ T4982] netlink: 'syz.0.229': attribute type 1 has an invalid length. [ 64.295236][ T4982] loop0: detected capacity change from 0 to 128 [ 64.356503][ T4982] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000100) [ 64.364452][ T4982] FAT-fs (loop0): Filesystem has been set read-only [ 64.371813][ T4982] syz.0.229: attempt to access beyond end of device [ 64.371813][ T4982] loop0: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 64.386654][ T4982] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000100) [ 64.394657][ T4982] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000100) [ 64.403005][ T4982] syz.0.229: attempt to access beyond end of device [ 64.403005][ T4982] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 64.441814][ T4982] syz.0.229: attempt to access beyond end of device [ 64.441814][ T4982] loop0: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 64.473161][ T4988] netlink: 8 bytes leftover after parsing attributes in process `syz.0.229'. [ 64.807213][ T29] kauditd_printk_skb: 420 callbacks suppressed [ 64.807230][ T29] audit: type=1400 audit(1756558585.629:2662): avc: denied { sys_module } for pid=5002 comm="syz.0.232" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 64.984436][ T29] audit: type=1400 audit(1756558585.789:2663): avc: denied { bind } for pid=5008 comm="syz.0.244" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 65.005070][ T29] audit: type=1400 audit(1756558585.799:2664): avc: denied { create } for pid=5008 comm="syz.0.244" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 65.024557][ T29] audit: type=1400 audit(1756558585.799:2665): avc: denied { setopt } for pid=5008 comm="syz.0.244" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 65.044789][ T29] audit: type=1400 audit(1756558585.799:2666): avc: denied { write } for pid=5008 comm="syz.0.244" name="sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 65.068285][ T29] audit: type=1400 audit(1756558585.799:2667): avc: denied { open } for pid=5008 comm="syz.0.244" path="/dev/sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 65.093748][ T5009] sg_write: data in/out 49276/1 bytes for SCSI command 0x1c-- guessing data in; [ 65.093748][ T5009] program syz.0.244 not setting count and/or reply_len properly [ 65.224628][ T5013] loop4: detected capacity change from 0 to 512 [ 65.247823][ T29] audit: type=1400 audit(1756558586.039:2668): avc: denied { read } for pid=5014 comm="syz.2.235" name="loop-control" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 65.272105][ T29] audit: type=1400 audit(1756558586.039:2669): avc: denied { open } for pid=5014 comm="syz.2.235" path="/dev/loop-control" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 65.286833][ T5017] netlink: 12 bytes leftover after parsing attributes in process `syz.0.244'. [ 65.307299][ T5013] EXT4-fs: Ignoring removed orlov option [ 65.313270][ T5013] ext4: Unknown parameter 'noacl' [ 65.326014][ T5013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 65.370904][ T29] audit: type=1400 audit(1756558586.189:2670): avc: denied { ioctl } for pid=5014 comm="syz.2.235" path="/dev/loop-control" dev="devtmpfs" ino=99 ioctlcmd=0x4c82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 65.379274][ T5013] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 65.410277][ T29] audit: type=1400 audit(1756558586.189:2671): avc: denied { mount } for pid=5032 comm="syz.3.236" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 65.581903][ T5047] loop1: detected capacity change from 0 to 1024 [ 65.627142][ T5047] EXT4-fs: Ignoring removed nobh option [ 65.632781][ T5047] EXT4-fs: Ignoring removed bh option [ 65.675658][ T5047] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 65.705001][ T5055] lo speed is unknown, defaulting to 1000 [ 65.782979][ T5062] netlink: 8 bytes leftover after parsing attributes in process `syz.0.242'. [ 65.967160][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 66.017661][ T5094] pim6reg1: entered promiscuous mode [ 66.023048][ T5094] pim6reg1: entered allmulticast mode [ 66.122767][ T5101] vlan2: entered promiscuous mode [ 66.127894][ T5101] bridge0: entered promiscuous mode [ 66.492822][ T5119] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 66.506670][ T5118] IPVS: stopping master sync thread 5119 ... [ 67.771920][ T5173] loop4: detected capacity change from 0 to 2048 [ 67.784966][ T5177] IPVS: stopping master sync thread 5180 ... [ 67.807854][ T5179] lo speed is unknown, defaulting to 1000 [ 67.825033][ T5173] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 67.859802][ T5183] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 67.868995][ T5173] EXT4-fs error (device loop4): ext4_free_inode:354: comm syz.4.262: bit already cleared for inode 15 [ 67.909161][ T5213] sg_write: data in/out 49276/1 bytes for SCSI command 0x1c-- guessing data in; [ 67.909161][ T5213] program syz.2.266 not setting count and/or reply_len properly [ 67.911565][ T5214] syz.0.276: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 [ 67.940836][ T5214] CPU: 0 UID: 0 PID: 5214 Comm: syz.0.276 Not tainted syzkaller #0 PREEMPT(voluntary) [ 67.940868][ T5214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 67.940883][ T5214] Call Trace: [ 67.940891][ T5214] [ 67.940900][ T5214] __dump_stack+0x1d/0x30 [ 67.940964][ T5214] dump_stack_lvl+0xe8/0x140 [ 67.940989][ T5214] dump_stack+0x15/0x1b [ 67.941011][ T5214] warn_alloc+0x12b/0x1a0 [ 67.941065][ T5214] ? audit_log_end+0x1d7/0x1f0 [ 67.941109][ T5214] ? audit_log_end+0x1d7/0x1f0 [ 67.941150][ T5214] __vmalloc_node_range_noprof+0x9c/0xe00 [ 67.941207][ T5214] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 67.941240][ T5214] ? slow_avc_audit+0x104/0x140 [ 67.941313][ T5214] ? should_fail_ex+0x30/0x280 [ 67.941368][ T5214] ? xskq_create+0x36/0xe0 [ 67.941407][ T5214] vmalloc_user_noprof+0x7d/0xb0 [ 67.941448][ T5214] ? xskq_create+0x80/0xe0 [ 67.941491][ T5214] xskq_create+0x80/0xe0 [ 67.941524][ T5214] xsk_init_queue+0x95/0xf0 [ 67.941598][ T5214] xsk_setsockopt+0x477/0x640 [ 67.941630][ T5214] ? __pfx_xsk_setsockopt+0x10/0x10 [ 67.941661][ T5214] __sys_setsockopt+0x184/0x200 [ 67.941700][ T5214] __x64_sys_setsockopt+0x64/0x80 [ 67.941723][ T5214] x64_sys_call+0x20ec/0x2ff0 [ 67.941745][ T5214] do_syscall_64+0xd2/0x200 [ 67.941774][ T5214] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 67.941871][ T5214] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 67.941905][ T5214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.941939][ T5214] RIP: 0033:0x7f4fd8e8ebe9 [ 67.941977][ T5214] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 67.941998][ T5214] RSP: 002b:00007f4fd78f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 67.942022][ T5214] RAX: ffffffffffffffda RBX: 00007f4fd90c5fa0 RCX: 00007f4fd8e8ebe9 [ 67.942076][ T5214] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000005 [ 67.942092][ T5214] RBP: 00007f4fd8f11e19 R08: 0000000000000004 R09: 0000000000000000 [ 67.942107][ T5214] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 67.942151][ T5214] R13: 00007f4fd90c6038 R14: 00007f4fd90c5fa0 R15: 00007ffd3959f568 [ 67.942175][ T5214] [ 67.942196][ T5214] Mem-Info: [ 68.166444][ T5214] active_anon:7287 inactive_anon:0 isolated_anon:0 [ 68.166444][ T5214] active_file:8590 inactive_file:2429 isolated_file:0 [ 68.166444][ T5214] unevictable:0 dirty:130 writeback:29 [ 68.166444][ T5214] slab_reclaimable:3179 slab_unreclaimable:14723 [ 68.166444][ T5214] mapped:29683 shmem:455 pagetables:1366 [ 68.166444][ T5214] sec_pagetables:0 bounce:0 [ 68.166444][ T5214] kernel_misc_reclaimable:0 [ 68.166444][ T5214] free:1887234 free_pcp:14289 free_cma:0 [ 68.211599][ T5214] Node 0 active_anon:29148kB inactive_anon:0kB active_file:34360kB inactive_file:9716kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:118732kB dirty:520kB writeback:116kB shmem:1820kB kernel_stack:3712kB pagetables:5580kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 68.238970][ T5214] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 68.252827][ T5226] loop1: detected capacity change from 0 to 2048 [ 68.268460][ T5214] lowmem_reserve[]: 0 2883 7862 7862 [ 68.280332][ T5214] Node 0 DMA32 free:2949196kB boost:0kB min:4132kB low:7064kB high:9996kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2952828kB mlocked:0kB bounce:0kB free_pcp:3632kB local_pcp:100kB free_cma:0kB [ 68.310676][ T5214] lowmem_reserve[]: 0 0 4978 4978 [ 68.315934][ T5214] Node 0 Normal free:4584380kB boost:0kB min:7184kB low:12280kB high:17376kB reserved_highatomic:0KB free_highatomic:0KB active_anon:30192kB inactive_anon:0kB active_file:34360kB inactive_file:9832kB unevictable:0kB writepending:404kB present:5242880kB managed:5098240kB mlocked:0kB bounce:0kB free_pcp:52280kB local_pcp:19800kB free_cma:0kB [ 68.347973][ T5214] lowmem_reserve[]: 0 0 0 0 [ 68.352533][ T5214] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 68.365402][ T5214] Node 0 DMA32: 3*4kB (M) 2*8kB (M) 3*16kB (M) 2*32kB (M) 3*64kB (M) 4*128kB (M) 3*256kB (M) 3*512kB (M) 3*1024kB (M) 3*2048kB (M) 717*4096kB (M) = 2949196kB [ 68.381835][ T5214] Node 0 Normal: 498*4kB (UME) 1122*8kB (UME) 616*16kB (UME) 384*32kB (UME) 348*64kB (UME) 244*128kB (UME) 153*256kB (UME) 122*512kB (UM) 89*1024kB (UM) 34*2048kB (UME) 1034*4096kB (M) = 4584280kB [ 68.401397][ T5214] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 68.410832][ T5214] 11729 total pagecache pages [ 68.415537][ T5214] 0 pages in swap cache [ 68.419763][ T5214] Free swap = 124996kB [ 68.423967][ T5214] Total swap = 124996kB [ 68.428175][ T5214] 2097051 pages RAM [ 68.432003][ T5214] 0 pages HighMem/MovableOnly [ 68.436769][ T5214] 80444 pages reserved [ 68.467045][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.480016][ T5226] Alternate GPT is invalid, using primary GPT. [ 68.486431][ T5226] loop1: p2 p3 p7 [ 68.584704][ T5241] SELinux: security_context_str_to_sid (-Xܘ7.H\ %u@) failed with errno=-22 [ 68.619616][ T5248] syzkaller0: entered promiscuous mode [ 68.625251][ T5248] syzkaller0: entered allmulticast mode [ 68.682486][ T3557] udevd[3557]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 68.710192][ T3299] udevd[3299]: inotify_add_watch(7, /dev/loop1p7, 10) failed: No such file or directory [ 68.769833][ T5263] netlink: 'syz.1.274': attribute type 1 has an invalid length. [ 68.828191][ T5267] bridge_slave_0: left allmulticast mode [ 68.833969][ T5267] bridge_slave_0: left promiscuous mode [ 68.839753][ T5267] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.872901][ T5267] bridge_slave_1: left allmulticast mode [ 68.878702][ T5267] bridge_slave_1: left promiscuous mode [ 68.885109][ T5267] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.909245][ T5267] team0: Port device team_slave_0 removed [ 68.936136][ T5267] team0: Port device team_slave_1 removed [ 68.945488][ T5267] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 68.952972][ T5267] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 69.080257][ T5281] __nla_validate_parse: 6 callbacks suppressed [ 69.080273][ T5281] netlink: 260 bytes leftover after parsing attributes in process `syz.2.271'. [ 69.095557][ T5281] netlink: 260 bytes leftover after parsing attributes in process `syz.2.271'. [ 69.185701][ T5267] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 69.193165][ T5267] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 69.536809][ T5278] IPVS: Error connecting to the multicast addr [ 69.696826][ T5301] netlink: 'syz.3.283': attribute type 1 has an invalid length. [ 69.706764][ T5306] loop4: detected capacity change from 0 to 2048 [ 69.710182][ T5307] netlink: 16 bytes leftover after parsing attributes in process `syz.0.292'. [ 69.727731][ T5301] netlink: 8 bytes leftover after parsing attributes in process `syz.3.283'. [ 69.738856][ T5306] Alternate GPT is invalid, using primary GPT. [ 69.745338][ T5306] loop4: p2 p3 p7 [ 69.804601][ T5314] SELinux: security_context_str_to_sid (-Xܘ7.H\ %u@) failed with errno=-22 [ 69.814849][ T29] kauditd_printk_skb: 349 callbacks suppressed [ 69.814867][ T29] audit: type=1326 audit(1756558590.629:3021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5304 comm="syz.4.284" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 69.844588][ T29] audit: type=1326 audit(1756558590.629:3022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5304 comm="syz.4.284" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 69.868045][ T29] audit: type=1326 audit(1756558590.629:3023): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5304 comm="syz.4.284" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 69.891570][ T29] audit: type=1326 audit(1756558590.629:3024): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5304 comm="syz.4.284" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 69.915103][ T29] audit: type=1326 audit(1756558590.629:3025): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5304 comm="syz.4.284" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 69.938661][ T29] audit: type=1326 audit(1756558590.629:3026): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5304 comm="syz.4.284" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 69.962051][ T29] audit: type=1326 audit(1756558590.629:3027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5304 comm="syz.4.284" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 69.985633][ T29] audit: type=1326 audit(1756558590.629:3028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5304 comm="syz.4.284" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 70.009723][ T29] audit: type=1326 audit(1756558590.639:3029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5304 comm="syz.4.284" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 70.033126][ T29] audit: type=1326 audit(1756558590.649:3030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5304 comm="syz.4.284" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 70.096268][ T5327] netlink: 12 bytes leftover after parsing attributes in process `syz.3.287'. [ 70.140226][ T5334] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.177578][ T5340] netlink: 20 bytes leftover after parsing attributes in process `syz.3.289'. [ 70.315905][ T5334] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.352664][ T5341] lo speed is unknown, defaulting to 1000 [ 70.399112][ T5334] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.586891][ T5334] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.655125][ T56] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.669361][ T51] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.705552][ T51] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.986718][ T5399] loop4: detected capacity change from 0 to 1024 [ 71.004048][ T51] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.021778][ T5399] EXT4-fs: Ignoring removed nobh option [ 71.027443][ T5399] EXT4-fs: Ignoring removed bh option [ 71.100083][ T5399] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 71.176344][ T5411] batman_adv: batadv0: Removing interface: dummy0 [ 71.196322][ T5411] bond0: (slave batadv0): Releasing backup interface [ 71.205546][ T5411] bridge_slave_0: left allmulticast mode [ 71.211289][ T5411] bridge_slave_0: left promiscuous mode [ 71.217119][ T5411] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.233530][ T5411] bridge_slave_1: left allmulticast mode [ 71.239232][ T5411] bridge_slave_1: left promiscuous mode [ 71.245086][ T5411] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.255888][ T5411] bond0: (slave bond_slave_0): Releasing backup interface [ 71.267033][ T5411] bond0: (slave bond_slave_1): Releasing backup interface [ 71.276565][ T5411] team0: Port device team_slave_0 removed [ 71.283274][ T5411] team0: Port device team_slave_1 removed [ 71.290189][ T5411] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 71.306051][ T5399] netlink: 260 bytes leftover after parsing attributes in process `syz.4.290'. [ 71.315175][ T5399] netlink: 260 bytes leftover after parsing attributes in process `syz.4.290'. [ 71.325927][ T5411] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 71.338244][ T5418] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 71.338271][ T5416] IPVS: stopping master sync thread 5418 ... [ 71.385320][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.398972][ T5448] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.539165][ T5455] loop4: detected capacity change from 0 to 512 [ 72.631998][ T5455] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 72.717102][ T5448] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.810419][ T5455] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #13: comm syz.4.304: invalid indirect mapped block 8 (level 2) [ 72.826548][ T5455] EXT4-fs (loop4): Remounting filesystem read-only [ 72.833534][ T5455] EXT4-fs (loop4): 1 truncate cleaned up [ 72.839851][ T5455] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 72.854715][ T5448] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.874392][ T5449] EXT4-fs: Cannot specify journal on remount [ 72.904827][ T5448] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 73.194314][ T5480] netlink: 20 bytes leftover after parsing attributes in process `syz.2.309'. [ 73.258380][ T5483] loop1: detected capacity change from 0 to 1024 [ 73.266484][ T5483] EXT4-fs: Ignoring removed nobh option [ 73.272185][ T5483] EXT4-fs: Ignoring removed bh option [ 73.287953][ T5483] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 73.466463][ T5483] netlink: 260 bytes leftover after parsing attributes in process `syz.1.310'. [ 73.508722][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.778977][ T5510] loop1: detected capacity change from 0 to 8192 [ 73.791218][ T5514] bridge_slave_0: left allmulticast mode [ 73.796974][ T5514] bridge_slave_0: left promiscuous mode [ 73.802763][ T5514] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.845770][ T5514] bridge_slave_1: left allmulticast mode [ 73.851473][ T5514] bridge_slave_1: left promiscuous mode [ 73.857301][ T5514] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.884078][ T5514] bond0: (slave bond_slave_0): Releasing backup interface [ 73.898617][ T5514] bond0: (slave bond_slave_1): Releasing backup interface [ 73.918656][ T5514] team0: Port device team_slave_0 removed [ 73.932640][ T5514] team0: Port device team_slave_1 removed [ 73.940287][ T5514] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 73.947819][ T5514] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 73.957410][ T5514] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 73.964993][ T5514] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 73.986625][ T5515] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 74.440500][ T5532] netlink: 'syz.2.317': attribute type 27 has an invalid length. [ 74.549677][ T5532] vxcan3: left promiscuous mode [ 74.554643][ T5532] vxcan3: left allmulticast mode [ 74.561101][ T51] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.571125][ T51] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.580583][ T51] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.589355][ T51] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.742958][ T5561] loop1: detected capacity change from 0 to 128 [ 74.760435][ T5571] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 74.765117][ T5561] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 74.783609][ T5561] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 74.987645][ T5555] syzkaller0: entered promiscuous mode [ 74.996435][ T5555] syzkaller0: entered allmulticast mode [ 75.027868][ T37] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.045364][ T37] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.053750][ T37] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.065715][ T1387] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.086530][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 75.105694][ T29] kauditd_printk_skb: 102 callbacks suppressed [ 75.105708][ T29] audit: type=1326 audit(1756558595.929:3133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5617 comm="syz.4.324" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 75.135726][ T29] audit: type=1326 audit(1756558595.939:3134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5617 comm="syz.4.324" exe="/root/syz-executor" sig=0 arch=c000003e syscall=424 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 75.159190][ T29] audit: type=1326 audit(1756558595.939:3135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5617 comm="syz.4.324" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 75.182548][ T29] audit: type=1326 audit(1756558595.939:3136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5617 comm="syz.4.324" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 75.206040][ T29] audit: type=1326 audit(1756558595.939:3137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5617 comm="syz.4.324" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 75.229303][ T29] audit: type=1326 audit(1756558595.939:3138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5617 comm="syz.4.324" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 75.252742][ T29] audit: type=1326 audit(1756558595.939:3139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5617 comm="syz.4.324" exe="/root/syz-executor" sig=0 arch=c000003e syscall=217 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 75.276266][ T29] audit: type=1326 audit(1756558595.939:3140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5617 comm="syz.4.324" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 75.299891][ T29] audit: type=1326 audit(1756558595.939:3141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5617 comm="syz.4.324" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 75.323365][ T29] audit: type=1326 audit(1756558595.939:3142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5617 comm="syz.4.324" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f07f041ebe9 code=0x7ffc0000 [ 75.963575][ T5633] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 75.964043][ T5629] lo speed is unknown, defaulting to 1000 [ 75.970133][ T5633] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 75.970209][ T5633] vhci_hcd vhci_hcd.0: Device attached [ 76.002293][ T5633] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 76.022606][ T5632] netlink: 'syz.3.338': attribute type 27 has an invalid length. [ 76.034545][ T5633] vhci_hcd vhci_hcd.0: pdev(1) rhport(2) sockfd(10) [ 76.041241][ T5633] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 76.048996][ T5633] vhci_hcd vhci_hcd.0: Device attached [ 76.081021][ T5633] vhci_hcd vhci_hcd.0: pdev(1) rhport(3) sockfd(12) [ 76.087719][ T5633] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 76.091024][ T5629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.095384][ T5633] vhci_hcd vhci_hcd.0: Device attached [ 76.112869][ T5629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.152414][ T5635] vhci_hcd: connection closed [ 76.152589][ T5657] vhci_hcd: connection closed [ 76.152689][ T1387] vhci_hcd: stop threads [ 76.157364][ T5659] vhci_hcd: connection closed [ 76.162056][ T1387] vhci_hcd: release socket [ 76.175641][ T1387] vhci_hcd: disconnect device [ 76.181635][ T1387] vhci_hcd: stop threads [ 76.186075][ T1387] vhci_hcd: release socket [ 76.190508][ T1387] vhci_hcd: disconnect device [ 76.203535][ T1387] vhci_hcd: stop threads [ 76.207838][ T1387] vhci_hcd: release socket [ 76.212281][ T1387] vhci_hcd: disconnect device [ 76.230017][ T3363] lo speed is unknown, defaulting to 1000 [ 76.235901][ T3363] syz2: Port: 1 Link DOWN [ 76.240407][ T10] usb 3-1: new high-speed USB device number 2 using vhci_hcd [ 76.251315][ T1387] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.251792][ T5666] netlink: 'syz.0.328': attribute type 3 has an invalid length. [ 76.270003][ T1387] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.270879][ T10] usb 3-1: enqueue for inactive port 0 [ 76.278976][ T1387] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.284598][ T10] usb 3-1: enqueue for inactive port 0 [ 76.294374][ T1387] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.322170][ T10] usb 3-1: enqueue for inactive port 0 [ 76.393425][ T10] vhci_hcd: vhci_device speed not set [ 76.764772][ T5696] loop1: detected capacity change from 0 to 1024 [ 76.799464][ T5696] EXT4-fs: Ignoring removed nobh option [ 76.805240][ T5696] EXT4-fs: Ignoring removed bh option [ 76.858455][ T5696] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 76.893091][ T5704] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 77.125273][ T5696] __nla_validate_parse: 1 callbacks suppressed [ 77.125291][ T5696] netlink: 260 bytes leftover after parsing attributes in process `syz.1.335'. [ 77.140602][ T5696] netlink: 260 bytes leftover after parsing attributes in process `syz.1.335'. [ 77.198522][ T3305] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.289511][ T3381] IPVS: starting estimator thread 0... [ 77.365592][ T5732] netlink: 'syz.1.341': attribute type 21 has an invalid length. [ 77.373517][ T5732] netlink: 128 bytes leftover after parsing attributes in process `syz.1.341'. [ 77.382555][ T5732] netlink: 'syz.1.341': attribute type 5 has an invalid length. [ 77.390332][ T5732] netlink: 'syz.1.341': attribute type 6 has an invalid length. [ 77.398013][ T5732] netlink: 3 bytes leftover after parsing attributes in process `syz.1.341'. [ 77.407321][ T5729] IPVS: using max 2400 ests per chain, 120000 per kthread [ 77.417015][ T5732] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 77.423708][ T5732] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 77.431289][ T5732] vhci_hcd vhci_hcd.0: Device attached [ 77.437232][ T5734] vhci_hcd: connection closed [ 77.437447][ T383] vhci_hcd: stop threads [ 77.446521][ T383] vhci_hcd: release socket [ 77.451035][ T383] vhci_hcd: disconnect device [ 77.528334][ T5739] loop9: detected capacity change from 0 to 7 [ 77.536041][ T5739] Buffer I/O error on dev loop9, logical block 0, async page read [ 77.544477][ T5739] Buffer I/O error on dev loop9, logical block 0, async page read [ 77.552395][ T5739] loop9: unable to read partition table [ 77.561810][ T5739] loop_reread_partitions: partition scan of loop9 (被xڬdGݡ [ 77.561810][ T5739] ) failed (rc=-5) [ 77.562932][ T3297] Buffer I/O error on dev loop9, logical block 0, async page read [ 77.584505][ T3297] Buffer I/O error on dev loop9, logical block 0, async page read [ 77.590034][ T5739] netlink: 'syz.2.353': attribute type 4 has an invalid length. [ 77.613417][ T3297] Buffer I/O error on dev loop9, logical block 0, async page read [ 77.624240][ T3297] Buffer I/O error on dev loop9, logical block 0, async page read [ 77.632667][ T3297] Buffer I/O error on dev loop9, logical block 0, async page read [ 78.670856][ T5783] hub 9-0:1.0: USB hub found [ 78.675730][ T5783] hub 9-0:1.0: 8 ports detected [ 78.692143][ T5783] loop4: detected capacity change from 0 to 1024 [ 78.705005][ T5788] netlink: 16 bytes leftover after parsing attributes in process `syz.2.349'. [ 78.708325][ T5783] EXT4-fs: Ignoring removed bh option [ 78.724470][ T5783] EXT4-fs: inline encryption not supported [ 78.732400][ T5783] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 78.755536][ T5783] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 78.775635][ T5783] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #3: block 2: comm syz.4.351: lblock 2 mapped to illegal pblock 2 (length 1) [ 78.824146][ T5783] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #3: block 48: comm syz.4.351: lblock 0 mapped to illegal pblock 48 (length 1) [ 78.869677][ T5783] EXT4-fs error (device loop4): ext4_acquire_dquot:6937: comm syz.4.351: Failed to acquire dquot type 0 [ 78.895742][ T5767] lo speed is unknown, defaulting to 1000 [ 78.909774][ T5783] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6334: Corrupt filesystem [ 78.928650][ T5783] EXT4-fs error (device loop4): ext4_evict_inode:254: inode #11: comm syz.4.351: mark_inode_dirty error [ 78.952727][ T5783] EXT4-fs warning (device loop4): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 78.975520][ T5783] EXT4-fs (loop4): 1 orphan inode deleted [ 78.988986][ T5783] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 79.003600][ T37] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #3: block 1: comm kworker/u8:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 79.030188][ T37] EXT4-fs error (device loop4): ext4_release_dquot:6973: comm kworker/u8:2: Failed to release dquot type 0 [ 79.170706][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 79.180688][ T3313] EXT4-fs error (device loop4): __ext4_get_inode_loc:4861: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 79.203883][ T3313] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6334: Corrupt filesystem [ 79.223834][ T3313] EXT4-fs error (device loop4): ext4_quota_off:7221: inode #3: comm syz-executor: mark_inode_dirty error [ 79.538747][ T5856] loop4: detected capacity change from 0 to 512 [ 79.545737][ T5856] EXT4-fs: Ignoring removed orlov option [ 79.640273][ T5856] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 79.648831][ T5856] EXT4-fs (loop4): blocks per group (95) and clusters per group (32768) inconsistent [ 80.372474][ T29] kauditd_printk_skb: 457 callbacks suppressed [ 80.372488][ T29] audit: type=1400 audit(1756558601.189:3597): avc: denied { create } for pid=5857 comm="syz.1.359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 80.461355][ T29] audit: type=1400 audit(1756558601.229:3598): avc: denied { create } for pid=5857 comm="syz.1.359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 80.481016][ T29] audit: type=1400 audit(1756558601.239:3599): avc: denied { bind } for pid=5857 comm="syz.1.359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 80.577198][ T36] IPVS: starting estimator thread 0... [ 80.693813][ T5882] IPVS: using max 2400 ests per chain, 120000 per kthread [ 80.811109][ T29] audit: type=1400 audit(1756558601.629:3600): avc: denied { map } for pid=5893 comm="syz.3.364" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=9778 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 80.835183][ T29] audit: type=1400 audit(1756558601.629:3601): avc: denied { read write } for pid=5893 comm="syz.3.364" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=9778 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 80.938710][ T5903] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2578 sclass=netlink_route_socket pid=5903 comm=syz.3.364 [ 80.975722][ T5907] netlink: 16 bytes leftover after parsing attributes in process `syz.1.368'. [ 80.991634][ T5903] netlink: 8 bytes leftover after parsing attributes in process `syz.3.364'. [ 81.021304][ T29] audit: type=1400 audit(1756558601.699:3602): avc: denied { block_suspend } for pid=5893 comm="syz.3.364" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 81.115319][ T5917] netlink: 12 bytes leftover after parsing attributes in process `syz.4.372'. [ 81.141160][ T5922] hub 9-0:1.0: USB hub found [ 81.147304][ T5917] netlink: 'syz.4.372': attribute type 1 has an invalid length. [ 81.147874][ T5922] hub 9-0:1.0: 8 ports detected [ 81.185400][ T29] audit: type=1400 audit(1756558602.009:3603): avc: denied { remount } for pid=5918 comm="syz.3.371" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 81.225351][ T29] audit: type=1326 audit(1756558602.049:3604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5930 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbb86dfebe9 code=0x7ffc0000 [ 81.258237][ T29] audit: type=1326 audit(1756558602.079:3605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5930 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=115 compat=0 ip=0x7fbb86dfebe9 code=0x7ffc0000 [ 81.265658][ T3381] IPVS: starting estimator thread 0... [ 81.281744][ T29] audit: type=1326 audit(1756558602.079:3606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5930 comm="syz.1.375" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbb86dfebe9 code=0x7ffc0000 [ 81.363113][ T5952] netlink: 8 bytes leftover after parsing attributes in process `syz.0.380'. [ 81.378134][ T5942] IPVS: using max 1728 ests per chain, 86400 per kthread [ 81.387923][ T5952] netlink: 4 bytes leftover after parsing attributes in process `syz.0.380'. [ 81.405505][ T5956] 9pnet_fd: p9_fd_create_tcp (5956): problem connecting socket to 127.0.0.1 [ 81.426327][ T5952] hsr_slave_1 (unregistering): left promiscuous mode [ 83.301416][ T5986] __nla_validate_parse: 3 callbacks suppressed [ 83.301449][ T5986] netlink: 24 bytes leftover after parsing attributes in process `syz.3.389'. [ 83.325715][ T5987] netlink: 8 bytes leftover after parsing attributes in process `syz.1.387'. [ 83.337968][ T5991] netlink: 'syz.2.388': attribute type 21 has an invalid length. [ 83.345795][ T5991] netlink: 128 bytes leftover after parsing attributes in process `syz.2.388'. [ 83.382511][ T5991] netlink: 'syz.2.388': attribute type 5 has an invalid length. [ 83.390357][ T5991] netlink: 'syz.2.388': attribute type 6 has an invalid length. [ 83.398183][ T5991] netlink: 3 bytes leftover after parsing attributes in process `syz.2.388'. [ 83.467634][ T6010] netlink: 8 bytes leftover after parsing attributes in process `syz.2.393'. [ 83.504226][ T6010] netlink: 4 bytes leftover after parsing attributes in process `syz.2.393'. [ 83.516443][ T6010] hsr_slave_1 (unregistering): left promiscuous mode [ 83.527453][ T6014] netlink: 16 bytes leftover after parsing attributes in process `syz.1.394'. [ 83.671358][ T6025] netlink: 'syz.1.397': attribute type 10 has an invalid length. [ 83.679270][ T6025] netlink: 40 bytes leftover after parsing attributes in process `syz.1.397'. [ 83.707489][ T6033] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.734416][ T6025] dummy0: entered promiscuous mode [ 83.739933][ T6025] bridge0: port 1(dummy0) entered blocking state [ 83.746567][ T6025] bridge0: port 1(dummy0) entered disabled state [ 83.763625][ T6025] dummy0: entered allmulticast mode [ 83.897253][ T6033] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.011028][ T6033] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.118750][ T6033] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.212902][ T37] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.229303][ T37] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.262859][ T37] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.278621][ T6055] lo speed is unknown, defaulting to 1000 [ 84.284794][ T37] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.323210][ T6068] lo speed is unknown, defaulting to 1000 [ 84.474178][ T3381] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 84.548818][ T3381] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 84.709890][ T6132] netlink: 76 bytes leftover after parsing attributes in process `syz.1.407'. [ 84.767760][ T6140] netlink: 16 bytes leftover after parsing attributes in process `syz.1.409'. [ 84.804877][ T6143] hub 9-0:1.0: USB hub found [ 84.809611][ T6143] hub 9-0:1.0: 8 ports detected [ 85.360730][ T6153] hsr_slave_1 (unregistering): left promiscuous mode [ 85.379356][ T6127] 9pnet_fd: p9_fd_create_tcp (6127): problem connecting socket to 127.0.0.1 [ 85.402608][ T29] kauditd_printk_skb: 263 callbacks suppressed [ 85.402624][ T29] audit: type=1400 audit(1756558606.219:3870): avc: denied { write } for pid=6160 comm="syz.1.412" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 85.461248][ T6161] infiniband syz!: set down [ 85.465854][ T6161] infiniband syz!: added team_slave_0 [ 85.514385][ T6161] RDS/IB: syz!: added [ 85.526137][ T6161] smc: adding ib device syz! with port count 1 [ 85.532430][ T6161] smc: ib device syz! port 1 has pnetid [ 85.654037][ T6172] lo speed is unknown, defaulting to 1000 [ 85.951093][ T6181] loop4: detected capacity change from 0 to 4096 [ 85.958359][ T6181] EXT4-fs: Ignoring removed mblk_io_submit option [ 85.964871][ T6181] EXT4-fs: test_dummy_encryption option not supported [ 86.002173][ T6181] loop4: detected capacity change from 0 to 128 [ 86.993700][ T6168] lo speed is unknown, defaulting to 1000 [ 87.297004][ T6258] netlink: 'syz.0.418': attribute type 21 has an invalid length. [ 87.442157][ T6258] netlink: 'syz.0.418': attribute type 5 has an invalid length. [ 87.449916][ T6258] netlink: 'syz.0.418': attribute type 6 has an invalid length. [ 87.471104][ T6263] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(11) [ 87.477746][ T6263] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 87.485310][ T6263] vhci_hcd vhci_hcd.0: Device attached [ 87.998324][ T6266] netlink: 'syz.3.420': attribute type 7 has an invalid length. [ 88.012392][ T6264] vhci_hcd: connection closed [ 88.012636][ T383] vhci_hcd: stop threads [ 88.021656][ T383] vhci_hcd: release socket [ 88.026128][ T383] vhci_hcd: disconnect device [ 88.043850][ T29] audit: type=1400 audit(1756558608.859:3871): avc: denied { connect } for pid=6270 comm="syz.4.422" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 88.071282][ T6273] netlink: 'syz.2.423': attribute type 21 has an invalid length. [ 88.071312][ T6273] netlink: 'syz.2.423': attribute type 5 has an invalid length. [ 88.071403][ T6273] netlink: 'syz.2.423': attribute type 6 has an invalid length. [ 88.081151][ T6273] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(12) [ 88.103142][ T6273] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 88.103442][ T6273] vhci_hcd vhci_hcd.0: Device attached [ 88.120550][ T29] audit: type=1400 audit(1756558608.899:3872): avc: denied { write } for pid=6270 comm="syz.4.422" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 88.144602][ T6274] vhci_hcd: connection closed [ 88.144933][ T1859] vhci_hcd: stop threads [ 88.144946][ T1859] vhci_hcd: release socket [ 88.144956][ T1859] vhci_hcd: disconnect device [ 88.201222][ T29] audit: type=1400 audit(1756558609.019:3873): avc: denied { write } for pid=6277 comm="syz.3.424" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 88.237449][ T29] audit: type=1400 audit(1756558609.059:3874): avc: denied { create } for pid=6279 comm="syz.1.425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 88.265137][ T6280] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=6280 comm=syz.1.425 [ 88.289664][ T29] audit: type=1400 audit(1756558609.109:3875): avc: denied { wake_alarm } for pid=6277 comm="syz.3.424" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 88.404832][ T29] audit: type=1400 audit(1756558609.229:3876): avc: denied { write } for pid=6284 comm="syz.4.426" name="tcp" dev="proc" ino=4026532736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 88.440786][ T6293] __nla_validate_parse: 8 callbacks suppressed [ 88.440801][ T6293] netlink: 12 bytes leftover after parsing attributes in process `syz.3.427'. [ 88.465547][ T6293] netlink: 'syz.3.427': attribute type 1 has an invalid length. [ 88.512186][ T29] audit: type=1400 audit(1756558609.329:3877): avc: denied { create } for pid=6296 comm="syz.3.428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 89.083435][ T6315] lo speed is unknown, defaulting to 1000 [ 89.443560][ T29] audit: type=1400 audit(1756558610.259:3878): avc: denied { read write } for pid=6338 comm="syz.1.432" name="usbmon0" dev="devtmpfs" ino=141 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 89.467563][ T29] audit: type=1400 audit(1756558610.259:3879): avc: denied { open } for pid=6338 comm="syz.1.432" path="/dev/usbmon0" dev="devtmpfs" ino=141 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 90.511382][ T6346] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 90.575226][ T6347] loop4: detected capacity change from 0 to 256 [ 90.603707][ T6347] netlink: 256 bytes leftover after parsing attributes in process `syz.4.434'. [ 90.815788][ T6349] wireguard0: entered promiscuous mode [ 90.821346][ T6349] wireguard0: entered allmulticast mode [ 90.873397][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 90.873414][ T29] audit: type=1400 audit(1756558611.689:3881): avc: denied { search } for pid=3034 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.900978][ T29] audit: type=1400 audit(1756558611.689:3882): avc: denied { search } for pid=3034 comm="dhcpcd" name="udev" dev="tmpfs" ino=9 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.922762][ T29] audit: type=1400 audit(1756558611.689:3883): avc: denied { search } for pid=3034 comm="dhcpcd" name="data" dev="tmpfs" ino=13 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.944701][ T29] audit: type=1400 audit(1756558611.689:3884): avc: denied { read } for pid=3034 comm="dhcpcd" name="n26" dev="tmpfs" ino=2522 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 90.966515][ T29] audit: type=1400 audit(1756558611.689:3885): avc: denied { open } for pid=3034 comm="dhcpcd" path="/run/udev/data/n26" dev="tmpfs" ino=2522 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 90.989517][ T29] audit: type=1400 audit(1756558611.689:3886): avc: denied { getattr } for pid=3034 comm="dhcpcd" path="/run/udev/data/n26" dev="tmpfs" ino=2522 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 91.073334][ T29] audit: type=1326 audit(1756558611.729:3887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6356 comm="syz.0.436" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fd8e8ebe9 code=0x7ffc0000 [ 91.096894][ T29] audit: type=1326 audit(1756558611.729:3888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6356 comm="syz.0.436" exe="/root/syz-executor" sig=0 arch=c000003e syscall=29 compat=0 ip=0x7f4fd8e8ebe9 code=0x7ffc0000 [ 91.120177][ T29] audit: type=1326 audit(1756558611.729:3889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6356 comm="syz.0.436" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fd8e8ebe9 code=0x7ffc0000 [ 91.143620][ T29] audit: type=1326 audit(1756558611.729:3890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6356 comm="syz.0.436" exe="/root/syz-executor" sig=0 arch=c000003e syscall=30 compat=0 ip=0x7f4fd8e8ebe9 code=0x7ffc0000 [ 91.267814][ T6379] 9pnet_fd: Insufficient options for proto=fd [ 91.343116][ T6383] netlink: 'syz.0.439': attribute type 21 has an invalid length. [ 91.350945][ T6383] netlink: 128 bytes leftover after parsing attributes in process `syz.0.439'. [ 91.377512][ T6383] netlink: 'syz.0.439': attribute type 5 has an invalid length. [ 91.385267][ T6383] netlink: 3 bytes leftover after parsing attributes in process `syz.0.439'. [ 91.396164][ T6383] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(10) [ 91.402816][ T6383] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 91.410409][ T6383] vhci_hcd vhci_hcd.0: Device attached [ 91.417183][ T6389] vhci_hcd: connection closed [ 91.417535][ T37] vhci_hcd: stop threads [ 91.426674][ T37] vhci_hcd: release socket [ 91.431141][ T37] vhci_hcd: disconnect device [ 91.757678][ T6404] lo speed is unknown, defaulting to 1000 [ 92.452210][ T6432] netlink: 76 bytes leftover after parsing attributes in process `syz.2.443'. [ 92.611116][ T6452] netlink: 24 bytes leftover after parsing attributes in process `syz.1.449'. [ 92.844016][ T6469] validate_nla: 1 callbacks suppressed [ 92.844037][ T6469] netlink: 'syz.1.457': attribute type 21 has an invalid length. [ 92.857379][ T6469] netlink: 128 bytes leftover after parsing attributes in process `syz.1.457'. [ 92.866481][ T6469] netlink: 'syz.1.457': attribute type 5 has an invalid length. [ 92.874282][ T6469] netlink: 'syz.1.457': attribute type 6 has an invalid length. [ 92.881999][ T6469] netlink: 3 bytes leftover after parsing attributes in process `syz.1.457'. [ 92.892721][ T6469] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(11) [ 92.899379][ T6469] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 92.906965][ T6469] vhci_hcd vhci_hcd.0: Device attached [ 92.913276][ T6471] vhci_hcd: connection closed [ 92.913481][ T51] vhci_hcd: stop threads [ 92.922493][ T51] vhci_hcd: release socket [ 92.927072][ T51] vhci_hcd: disconnect device [ 92.941985][ T6474] netlink: 4 bytes leftover after parsing attributes in process `syz.0.458'. [ 93.000609][ T6481] netlink: 20 bytes leftover after parsing attributes in process `syz.0.460'. [ 93.043221][ T6483] syzkaller0: entered promiscuous mode [ 93.048783][ T6483] syzkaller0: entered allmulticast mode [ 93.067895][ T6483] lo speed is unknown, defaulting to 1000 [ 93.132203][ T6497] lo speed is unknown, defaulting to 1000 [ 93.468806][ T6550] netlink: 24 bytes leftover after parsing attributes in process `syz.0.466'. [ 93.586308][ T6546] loop4: detected capacity change from 0 to 512 [ 93.690458][ T6546] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 93.717311][ T6552] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 93.723871][ T6552] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 93.731465][ T6552] vhci_hcd vhci_hcd.0: Device attached [ 93.744022][ T6546] ext4 filesystem being mounted at /88/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 93.755832][ T6574] lo: entered allmulticast mode [ 93.759235][ T6546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.465'. [ 93.779739][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.899539][ T6589] tmpfs: Bad value for 'mpol' [ 94.013429][ T23] usb 3-1: new low-speed USB device number 3 using vhci_hcd [ 94.294586][ T6569] vhci_hcd: connection reset by peer [ 94.300109][ T37] vhci_hcd: stop threads [ 94.304431][ T37] vhci_hcd: release socket [ 94.308870][ T37] vhci_hcd: disconnect device [ 94.586373][ T6573] lo: left allmulticast mode [ 94.617737][ T6599] netlink: 8 bytes leftover after parsing attributes in process `syz.0.474'. [ 94.832234][ T6608] loop4: detected capacity change from 0 to 128 [ 94.855354][ T6618] block device autoloading is deprecated and will be removed. [ 94.991447][ T6628] ================================================================== [ 94.999577][ T6628] BUG: KCSAN: data-race in io_flush_timeouts / io_issue_sqe [ 95.006877][ T6628] [ 95.009196][ T6628] read-write to 0xffff8881186cf210 of 4 bytes by task 6634 on cpu 1: [ 95.017263][ T6628] io_issue_sqe+0x19c/0x970 [ 95.021766][ T6628] io_wq_submit_work+0x3f7/0x5f0 [ 95.026722][ T6628] io_worker_handle_work+0x44e/0x9b0 [ 95.032090][ T6628] io_wq_worker+0x22e/0x870 [ 95.036587][ T6628] ret_from_fork+0xda/0x150 [ 95.041090][ T6628] ret_from_fork_asm+0x1a/0x30 [ 95.045854][ T6628] [ 95.048171][ T6628] read to 0xffff8881186cf210 of 4 bytes by task 6628 on cpu 0: [ 95.055705][ T6628] io_flush_timeouts+0x56/0x1d0 [ 95.060559][ T6628] __io_commit_cqring_flush+0xeb/0x100 [ 95.066022][ T6628] io_issue_sqe+0x7cb/0x970 [ 95.070536][ T6628] io_wq_submit_work+0x3f7/0x5f0 [ 95.075467][ T6628] io_worker_handle_work+0x44e/0x9b0 [ 95.080748][ T6628] io_wq_worker+0x22e/0x870 [ 95.085261][ T6628] ret_from_fork+0xda/0x150 [ 95.089763][ T6628] ret_from_fork_asm+0x1a/0x30 [ 95.094528][ T6628] [ 95.096850][ T6628] value changed: 0x000002b7 -> 0x000002b8 [ 95.102569][ T6628] [ 95.104903][ T6628] Reported by Kernel Concurrency Sanitizer on: [ 95.111045][ T6628] CPU: 0 UID: 0 PID: 6628 Comm: iou-wrk-6627 Not tainted syzkaller #0 PREEMPT(voluntary) [ 95.121019][ T6628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 95.131073][ T6628] ================================================================== [ 95.159407][ T6633] bridge0: port 3(0!) entered disabled state [ 95.165701][ T6633] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.172897][ T6633] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.401141][ T6636] lo speed is unknown, defaulting to 1000 [ 95.608584][ T6638] syzkaller0: entered promiscuous mode [ 95.614171][ T6638] syzkaller0: entered allmulticast mode [ 95.621399][ T1387] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 95.630421][ T1387] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 95.639002][ T1387] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 95.661427][ T1387] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.053432][ T23] usb 3-1: enqueue for inactive port 0 [ 99.058954][ T23] usb 3-1: enqueue for inactive port 0 [ 99.133457][ T23] vhci_hcd: vhci_device speed not set