last executing test programs: 28.827837569s ago: executing program 3 (id=231): bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x18) sendmsg$SMC_PNETID_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x34, r0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x0) sendmsg$SMC_PNETID_DEL(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r0, 0xe27, 0x70bd28, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000}, 0x4000) 28.782487781s ago: executing program 3 (id=233): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000c"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r0}, &(0x7f0000000200), &(0x7f0000000080)=r1}, 0x20) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000080)=0x655a, 0x4) bind$inet(r2, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x24}}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$sock_int(r2, 0x1, 0xc, &(0x7f0000000000)=0x1, 0x4) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) 28.666873976s ago: executing program 3 (id=237): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000050b6850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0, 0x0, 0x80}, 0x18) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000380)=0x20000, 0x4) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000000)=""/5, 0x204000, 0x1000}, 0x20) r2 = socket$phonet(0x23, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000040)=0x4000, 0x4) bind$xdp(r1, &(0x7f00000002c0)={0x2c, 0x4, r3, 0x30, r1}, 0x10) 28.55516469s ago: executing program 3 (id=239): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x18) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a42804000000000014003500626f6e6430000000000000000000000008000a00", @ANYRES32=r2], 0x3c}}, 0x8000) sendmsg$nl_route(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000011000119ac9560183432742500000000", @ANYRES32=r2], 0x20}, 0x1, 0x200000000000000, 0x0, 0x4}, 0x40cc040) 28.369550239s ago: executing program 3 (id=244): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x2c020400) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) io_setup(0x4, &(0x7f00000014c0)=0x0) r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='mounts\x00') io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0xfffe, r1, 0x0}]) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) 28.292816942s ago: executing program 3 (id=251): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r0, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r1, 0x0, 0x10007ffffffff}, 0x18) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r2, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r3, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x14) 13.253837784s ago: executing program 32 (id=251): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r0, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r1, 0x0, 0x10007ffffffff}, 0x18) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r2, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r3, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x14) 6.290418351s ago: executing program 0 (id=588): socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7f, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x3, 0x20002f7}) r1 = socket$inet(0x2, 0x80001, 0x84) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2}}, 0x20) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 6.231646234s ago: executing program 0 (id=590): r0 = getpgid(0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = pidfd_getfd(r1, r1, 0x0) setns(r2, 0x66020000) mount$9p_fd(0x0, 0x0, 0x0, 0x104000, 0x0) syz_clone(0x498144ee5f62e149, 0x0, 0x17, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x72) 5.228136237s ago: executing program 0 (id=605): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000003c0)='kfree\x00'}, 0x10) write$selinux_load(0xffffffffffffffff, 0x0, 0x44f0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x400c84, &(0x7f0000000340), 0x1, 0x789, &(0x7f0000000fc0)="$eJzs3c1rXFUbAPDnTpKmTfu+iSBo3RgQNFA6MTW2CgoVFyJYKOjadphMQ80kUzKT0oSALSK4EVRcCLrpyoUfdefWj63+Fy7EUjUtVlxI5E5m0kkzk07SZCaa3w9u5px77+ScZ879ODPncm8Ae9Zw+icTcTgi3ksiBmvzk4joq6Z6I06urHd7aTGfTkksL7/6W1Jd59bSYj4a3pM6WMs8HBHfvR1xJLO+3PL8wlSuWCzM1vKjlekLo+X5haPnp3OThcnCzPGx8fFjJ54+cXz7Yv3jx4VD199/6YkvT/711kPX3v0+iZNxqLasMY4te35tdjiGa59JX/oRrvHifRe2uyTdrgBbku6aPSt7eRyOweippgCA/7I3I2IZANhjEud/ANhj6r8D3FpazNen7v4i0Vk3XoiI/Svx18c3V5b01sbs9lfHQQduJWtGRpKIGNqG8ocj4pOvX/88nWK7xiEB2nD5SkScHRpef/xP1l2zsFlPbrBsX+11+K75aflGoKEzvkn7P8806/9lVvs/0aT/099k392KZvt/EnF5dcaBbShkAzc+jXiu4dq22w3x1wz11HL/q/b5+pJz54uF9Nj2/4gYib7+ND+2QRkjN/++2WpZY//v9w/e+CwtP329s0bml97+te+ZyFVy9xNzoxtXIh7pbRZ/str+SYv+7+k2y3j52Xc+brUsjT+Ntz6ti7/a/jt3Rli+GvF40/a/c0VbsuH1iaPVzWG0vlE08dVPHw20Kr+x/dMpLb/+XaAT0vYf2Dj+oaTxes3y5sv44ergt62W3Tv+5tv/vuS1arrej7iUq1RmxyL2Ja+sn3/sznsv5R6tpVbWT+Mfeaz5/r/R9p9+JzzbZvy913/9Yuvx76w0/olNtf/mE9duT/W0Kr+99h+vpkZqc9o5/rVbwfv57AAAAAAAAAAAAAAAAAAAAAAAAACgXZmIOBRJJruazmSy2ZVneD8YA5liqVw5cq40NzMR1WdlD0Vfpn6ry8GG+6GO1e6HX88fuyv/VEQ8EBEf9h9I6vdRnOhy7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQd7DF8/9TP/d3u3YAwI7Z3+0KAAAd5/wPAHuP8z8A7D3tnf97drweAEDn+P4PAHuP8z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA77PSpU+m0/OfSYj7NT1ycn5sqXTw6UShPZafn8tl8afZCdrJUmiwWsvnS9L3+X7FUujAeM3OXRiuFcmW0PL9wZro0N1M5c346N1k4U+jrSFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsDnl+YWpXLFYmJXYQmJ5d1Sj+4me2ua0W+rT0USyO6qxzYkuH5gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/iX+CQAA//8vWSHt") bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='kfree\x00'}, 0x10) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000040)={0x5, 0xfe, 0x8006}) 4.819540734s ago: executing program 0 (id=613): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000000)={0xa0000001}) ppoll(&(0x7f0000000200)=[{r3, 0x1}], 0x1, 0x0, 0x0, 0x3) epoll_wait(r3, &(0x7f0000000140)=[{}], 0x1, 0xffffffff) 3.385724125s ago: executing program 0 (id=635): setreuid(0xffffffffffffffff, 0xee00) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x8413, &(0x7f0000000080)={[{@noload}, {@acl}, {@jqfmt_vfsold}, {@mblk_io_submit}, {@usrquota}]}, 0x0, 0x533, &(0x7f0000000a80)="$eJzs3e9rHGkdAPDvbLK5pEkvOfWFHnh3eidp0e4mF+4u+OI8QfTVgXq+rzHZhJBNtmQ3d81y2BT/AEFEBV8piG9E/wBBCr7xZREK+lpRUURbfaGgnWN3Z9M02d1s2iTbJp8PTOf5MTPf55lmJ/PMTHYCOLfeyqb7aZpejojJrDyXTZ9sZHYiXoqIe3ffX2xMSaTpO/9IIsnK2ttKm56J8dYqzQ189UsR30gOxq1u19cWyuXSZpYv1tavFavb9Sur6wsrpZXSxtzc7Ovzb8y/Nj/zON1bHs8SFyPizS/85Xvf/ukX3/zVZ97749W/Xfpm0mrzjdjXjyMa7lXZ2p/5GN1T1thLm48Y7Ek0vDcx1t86N7MfEQAATlfjvPRD2Xn+5ZiMod6nswAAAMBTKP3cRPwvad+7O2CkSzkAAADwFMlFxEQkuUL2vO9E5HKFQjSf4f1IXMiVK9Xap5crWxtLjbqIqcjnllfLpZns2dapyCeN/Gwz/SD/6r78XEQ8FxHfnRxr5guLlfLSoC9+AAAAwDkxvm/8/+/J1vgfAAAAOGOmBt0AAAAA4MQZ/wMAAMDZZ/wPAAAAZ9qX3367MaXt918vvbu9tVZ598pSqbpWWN9aLCxWNq8VViqVleZ39q333NjuqwM3tq4Xa6VqrVjdrl9dr2xt1K6uPvQKbAAAAOAUPffird8nEbHz2bHm1DCyp/6/2XsCBtZA4MTsXrKLJJuPHFzoD8+25n8+pUYBp2Jo0A0ABmZ40A0ABiY/6AYAg3S73sdCXR/euZ3NP3F8DQIAAE7G9Me63//P9Vxzp3c18MTzIYbzy/1/OL+a9/87PPLXkZMFOFPyHc4Afj6QlgCDkhxSf+j9/0P5GyIAABi0ieaU5ArZ5b2JyOUKhYiLzdcC5JPl1XJpJiKejYjfTeafaeRnm2smh44ZAAAAAAAAAAAAAAAAAAAAAAAAAICWNE0iBQAAAM60iNxfk1+3vst/evKVif3XB0aS/0xG9orQ9374zvevL9Rqm7ON8n/ultd+kJW/euTLD/2+eRQAAAA4gvY4vT2OBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDjdO/u+4vt6TTj/v3zETHVKf5wjDbno5GPiAv/SmJ4z3pJRAwdQ/ydmxHx0U7xk0azdkN2ij928vFjKtsLneKPH0N8OM9uNY4/b3X6/OXipea88+dvOOKh/KPqfvyL3ePfUJfP/8U+Yzx/5xfFrvFvRjw/3Pn4046fdIn/cp/xv/61er1bXfqjiOmOv3+Sh2IVa+vXitXt+pXV9YWV0kppY25u9vX5N+Zfm58pLq+WS9m/HWN85+O/vN+r/xe6xJ86pP+v9Nn//9+5fvfDrWS+U/xLL3eI/5sfZ0scjJ/Lfvd9Kks36qfb6Z1Weq8XfvbbF3r1f6lL/w/7/7/UZ/8vf+Vbf+pzUQDgFFS362sL5XJp88wmGqP0x9/Oxk9a+6vnwiMx2C7HzpOww5+ixI2DVS/GI28wTdO08TPyGA1L+ooeoye2W5LdkgEfmAAAgGP34Oz/iCv2e/MJAAAAAAAAAAAAAAAAAAAAONRpfMva/pg7u6nkOL5CGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgWHwQAAD//7Do6tE=") r0 = msgget$private(0x0, 0x1c0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x0) accept4(r1, 0x0, 0x0, 0x0) msgctl$IPC_SET(r0, 0x1, &(0x7f0000258f88)={{0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x96}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) msgsnd(r0, &(0x7f0000000080)=ANY=[], 0x0, 0x0) msgctl$IPC_SET(r0, 0x1, &(0x7f0000258f88)={{0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x9, 0xff, 0x5, 0xe8}) 2.503012953s ago: executing program 0 (id=651): timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x200000000000000) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) 2.501409913s ago: executing program 2 (id=652): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r2 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x13) read$char_usb(0xffffffffffffffff, 0x0, 0x0) tkill(r2, 0x12) waitid(0x0, r2, 0x0, 0x2100000a, 0x0) 1.473142647s ago: executing program 2 (id=666): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0x475, 0x0, 0x0, 0x0, 0x2}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7b}]}, 0x0}, 0x94) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0xc2f00, 0x69, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000980)='mm_page_free\x00', r1}, 0x18) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 1.140149921s ago: executing program 5 (id=660): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 1.118710492s ago: executing program 5 (id=661): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001000030400000000fcffffff00000000", @ANYRES32=r2, @ANYBLOB="7fff00"], 0x20}}, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, r5, 0x40010, 0x24114}}}}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x50}}, 0x0) 1.084685754s ago: executing program 1 (id=662): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000500)='./bus\x00', 0x2008002, &(0x7f0000000080), 0x1, 0x549, &(0x7f0000001800)="$eJzs3c9vI1cdAPDvTH65222zCz1ABewChQWt1t5421XVS8sFhKpKiIoD4rANiTcKseMQO6UJkUj/BpBA4gR/AgckDkg9ceDGEYkDQpQDUoEItEHiYDRjJ+smNmtqx+7Gn480O/Pmzcz3PWdn3vNz4hfA1LoeEQcRMR8Rb0TEYmd/0lnilfaSHffgcH/l6HB/JYlW6/W/J3l+ti+6zsk82blmISK+/pWIbydn4zZ29zaWq9XKdiddata2So3dvVvrteW1ylpls1y+u3T39ot3XiiPrK7Xar9478vrr37j17/65Lu/O/ji97NiXe7kdddjlNpVnzuJk5mNiFfPI9gEzHTW8xMuBx9MGhEfiYjP5Pf/Yszk/zsBgIus1VqM1mJ3GgC46NJ8DCxJixGRpp1OQLE9hvdMXEqr9Ubz5v36zuZqe6zsSsyl99erldtXF/7w3fzguSRLL+V5eX6eLp9K34mIqxHxo4Un8nRxpV5dnUyXBwCm3pPd7X9E/GshTYvFgU7t8akeAPDYKEy6AADA2Gn/AWD6aP8BYPoM0P53Puw/OPeyAADj4f0/AEwf7T8ATB/tPwBMla+99lq2tI4633+9+ubuzkb9zVurlcZGsbazUlypb28V1+r1tfw7e2qPul61Xt9aej523io1K41mqbG7d69W39ls3su/1/teZW4stQIA/per1975fRIRBy89kS/RNZeDthoutnSERwGPl5lhTtZBgMea2b5geg3UhOedhN+ee1mAyej5Zd6Fnpvv95P/I4jfM4IPlRsfH3z83xzPcLEY2Yfp9cHG/18eeTmA8TP+D9Or1UpOz/k/f5IFAFxIQ/wKX+sHo+qEABP1qMm8R/L5PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFwwlyPiO5GkxXwu8DT7Ny0WI56KiCsxl9xfr1ZuR8TTcS0i5hay9NKkCw0ADCn9a9KZ/+vG4nOXT+fOJ/9eyNcR8b2fvv7jt5abze2lbP8/TvYvHE8fVn543hDzCgIAg/vzIAfl7Xe5s+56I//gcH/leDnHMp7x3pdOJh9dOTrcz5d2zmy0Wq1WRCHvS1z6ZxKznXMKEfFsRMyMIP7B2xHxsV71T/KxkSudmU+740cn9lNjjZ++L36a57XX2cv30RGUBabNO9nz55Ve918a1/N17/u/kD+hhpc//woRx8++o674s51IMz3iZ/f89UFjPP+br57Z2Vps570d8exsr/jJSfykT/znBoz/x0986ocv98lr/SziRvSO3x2r1KxtlRq7e7fWa8trlbXKZrl8d+nu7RfvvFAu5WPUpeOR6rP+9tLNp/uVLav/pT7xCz3rP39y7ucGrP/P//PGtz79MLlwOv4XPtv75/9Mz/htWZv4+QHjL1/6Zd/pu7P4q33q/6if/80B47/7l73VAQ8FAMagsbu3sVytVraH2sjehY7iOmc2siIOdvBxd3G4oH+KfGNEL0ufjawzNsjBc+f1qp77xuxJX3G0V/5mdsUxVycdeS2G2ngwrliTeyYB4/Hwpp90SQAAAAAAAAAAAAAAgH7G8adLk64jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF9d/AwAA//8+JMPM") creat(&(0x7f0000000140)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8ff20c2c10f0093d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f00000001c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x204bc2f, 0x0, 0x1, 0x0, &(0x7f0000000240)) lremovexattr(&(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000000)=@known='system.posix_acl_default\x00') 861.956673ms ago: executing program 5 (id=663): socket$inet6(0xa, 0x2, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f00000006c0)=ANY=[@ANYRES64=0x0, @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="0600eb"], 0x44}, 0x1, 0x0, 0x0, 0x4048020}, 0x20000) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000002c0)={0x0, 0x0, 0x0, 'queue1\x00', 0x49}) write$sndseq(r1, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x1, 0x20000006}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) close_range(r0, 0xffffffffffffffff, 0x400000000000000) 861.726643ms ago: executing program 4 (id=664): r0 = socket(0x10, 0x803, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x100, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x94, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x5, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x6fe2}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb380, 0x0, 0x0, 0x100d87, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x10}, 0x0) 818.655476ms ago: executing program 1 (id=665): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000008c0)=@newqdisc={0x78, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfb, {0x60, 0x0, 0x0, r3, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x6, 0xa, 0x7fff, 0x4, 0x4}, 0x1, 0x0, 0x9, 0xff, 0xfb44, 0xa, 0x0, 0xf, 0x1, 0x9, {0x1, 0xb, 0x7, 0xf6, 0x9, 0x1}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x55}, 0xc010) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) 818.466856ms ago: executing program 2 (id=667): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100202, 0x0, 0xfffffffb}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x13, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x4d, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r2, 0x400, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='leases_conflict\x00', r3}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) 768.117548ms ago: executing program 2 (id=668): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='cdg', 0x3) syz_mount_image$iso9660(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0039936da8abb4625380b974"], 0x1, 0x539, &(0x7f00000005c0)="$eJzs3V9v01YfwPGfS8tT5ZHQo+d5hFBV4FA2qZVKcBIIirjBc07SA44d2Q5qr1BFW1SRwkSZtPaOG7ZJ24vgdi9id7va7d4G2kvY5D8tKW2S0pIGVd9PBOfEPjnnd1LLPzmJbQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGK5ddsuWeIZv7Os+nPrYdAasH4i72/hQDFgXBEr+SfT03IlW3Tl/x9WX07+m5NZkT9FZFamk+fTsvvvy/+5/7/Jib3XDwjoTGzv7D5f7XbXX407kDFpat9EgWk5Ta1MFKhatWrfXmpEqmE8Ha1EsW4pN9ROHIRq3l1QpVqtonRxJej4zbrj6b2F926VbbuqHhbb2gmjwL/9sBi5S8bzjN9M2ySrkzb3kg3xkYlVrJ2WUhub3fXKsCCTRqXjNCoPa1S2y+VSqVwuVe/W7t6z7clDC+yPyKEW499oMV4j2IsDJzOR53/xxIgvHVkWdeTDlbqEEkjrwNIH+7VcmvgnZOHr2w8Gjtub/2ezRbNXPqyekTT/X8ueXeuX//vEenaPbdmRXXkuq9KVrqzLq5P2dH38cznJoylafDESSSBGWuKkS1S+RElNqlIVW57IkjQkEiUNMeKJlkhWJJJYdLpFuRKKFkdiCSQUJfPiyoIoKUlNalIRJVqKsiKBdMSXptTFSXvZkM30fa8MiHG/Uek4jcoDGpH/cXqj2I0DJ/L3Xv4HAAAAAADnlpV++p4c/0/J1bTWMJ62xx0WAAAAAAD4jNJv/meTYiqpXRWL438AAAAAAM4bKz3HzhKRglzPantnQvEhAAAAAAAA50T6/f+1pCgkteticfwPAAAAAMB58+P+1Xf7XWM3av/L+u0vCcMp6017+Stry0naOVsXstdd+LjHuDFjXco7SYvqZP7M1bNWfvXL/Ytgvs+LjWFxWJ8hAPlZbmRtbqxl5dremmyUQsN4uugG3v2SOM6liVgvx9+92Pxe0un/5LcuWbKx2V0vPn3ZXUtjeZP08mYrv4DioesoDojldXq9hfSciyNnPJWeiJGPW8jGtXvnn99yYeITxnwrc1mbuUJWFg7OfzoZs1S8X5LJo2afR1E65czfys2szc35m1lxRBTl4oe/wR95nweiKPdGcaL34hhRVIr9toQ8isopowCAcdkYkoWsw4n/BHu5Q9n94iiy+1uZz9rMz6Q71smZI/bo9rA9un3K7PbroXsg9cuxybi/fJRV3yUveNd33MgrW8lbeOH11rdyeXtn99bm1uqz9WfrL8rlStW+Y9t3yzKVTiMvyD0AgCMMv8fO0BbWnSFH1f/d/0lBUZ7KS+nKmiymZxukvzg4stdCz88QFocctRZ67vCyOOSortBzo5fjt62cwV8CAICzMzckDx8n/y8OOe4+mMsHHx335vIhBt9gEAAA9KXD91Yh/sEKQ9N+UqrVSk68pFUYuI9UaOpNrYwf69BdcvymVu0wiAM38JLKY1PXkYo67XYQxqoRhKodRGY5vfO7ym/9HumW48fGjdqediKt3MCPHTdWdRO5qt35xjPRkg7TF0dt7ZqG+T3/xDvohK4uKhVp3dPQ1LUfm4ZJqr5qh6blhCvqceB1WlrVdeSGph0HWYd7Yxm/EYQtJzaBXxz3mw0AwBdie2f3+Wq3u/5qhJVxzxEAABxElgYAAAAAAAAAAAAAAAAAAAAA4Ms3stP+LuYDjPTMQiojrHzqtjHxBcRM5eSVi3JgyZh3TABG7p8AAAD//xR6Tls=") socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000340)) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x8200, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e1e, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) close_range(r0, 0xffffffffffffffff, 0xff0f000000000000) 747.939749ms ago: executing program 4 (id=669): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x13732000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000027c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x2d, 0x20040040) writev(r2, &(0x7f0000000100)=[{&(0x7f0000000500)="87", 0x1}], 0x1) recvmmsg(r1, &(0x7f0000000d40), 0x40000000000038f, 0x10020, 0x0) 655.577952ms ago: executing program 2 (id=670): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x10, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000100)='kfree\x00', r1, 0x0, 0x4000000080000000}, 0x18) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)=@newqdisc={0x38, 0x24, 0xd0f, 0x4703d2d, 0xfffffffd, {0x60, 0x0, 0x0, r4, {0x0, 0xfff2}, {0xfff1, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000040}, 0x44080) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x4000) 654.767772ms ago: executing program 1 (id=681): r0 = socket(0x10, 0x803, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x100, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x94, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x5, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x6fe2}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb380, 0x0, 0x0, 0x100d87, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x10}, 0x0) 650.620773ms ago: executing program 5 (id=671): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000847fff)='X', 0xfff5, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0xfffffffd}, 0x1c) shutdown(r2, 0x1) sendto$inet6(r2, &(0x7f0000000540)="1a", 0x1, 0x0, 0x0, 0x0) 461.925671ms ago: executing program 4 (id=673): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x34, 0x2, [@TCA_CAKE_AUTORATE={0x8}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x2}, @TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x3}, @TCA_CAKE_INGRESS={0x8}, @TCA_CAKE_ATM={0x8, 0x4, 0x1}, @TCA_CAKE_INGRESS={0x8}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 460.667601ms ago: executing program 1 (id=684): socket$inet6(0xa, 0x2, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f00000006c0)=ANY=[@ANYRES64=0x0, @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="0600eb"], 0x44}, 0x1, 0x0, 0x0, 0x4048020}, 0x20000) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000002c0)={0x0, 0x0, 0x0, 'queue1\x00', 0x49}) write$sndseq(r1, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x1, 0x20000006}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) close_range(r0, 0xffffffffffffffff, 0x400000000000000) 460.07653ms ago: executing program 2 (id=674): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b7030000000000de850000000400000095"], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, 0x0, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = syz_io_uring_setup(0x121d, &(0x7f0000000500)={0x0, 0x7d10, 0x80, 0x0, 0x2b5}, &(0x7f0000000040)=0x0, &(0x7f0000000580)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x23457}) io_uring_enter(r1, 0x46bc, 0x3, 0x20, 0x0, 0x20) 456.798351ms ago: executing program 5 (id=675): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000818110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000073"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa100000000000007010000b8ffffffb702000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6_sctp(0xa, 0x1, 0x84) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='percpu_create_chunk\x00', r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0xa, 0x101, 0x7fff, 0xcc, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) 381.948084ms ago: executing program 4 (id=676): openat$selinux_policy(0xffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000380)=[{0x200000000006, 0x1, 0x7, 0x7ffc1ffb}]}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./bus\x00', 0x42, 0x61) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1202, 0x0) sendfile(r3, r2, 0x0, 0x3ffff) 317.083767ms ago: executing program 4 (id=677): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001000030400000000fcffffff00000000", @ANYRES32=r2, @ANYBLOB="7fff00"], 0x20}}, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, r5, 0x40010, 0x24114}}}}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x50}}, 0x0) 290.134588ms ago: executing program 5 (id=678): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0x475, 0x0, 0x0, 0x0, 0x2}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7b}]}, 0x0}, 0x94) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0xc2f00, 0x69, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000980)='mm_page_free\x00', r1}, 0x18) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 195.387642ms ago: executing program 1 (id=679): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r2 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x18022, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}, 0x1100, 0x0, 0xfffffffc, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000180), &(0x7f0000000000)=r2}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r4}, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003000000018000180140002007665746830"], 0x2c}}, 0x0) 866.55µs ago: executing program 4 (id=680): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000500)='./bus\x00', 0x2008002, &(0x7f0000000080), 0x1, 0x549, &(0x7f0000001800)="$eJzs3c9vI1cdAPDvTH65222zCz1ABewChQWt1t5421XVS8sFhKpKiIoD4rANiTcKseMQO6UJkUj/BpBA4gR/AgckDkg9ceDGEYkDQpQDUoEItEHiYDRjJ+smNmtqx+7Gn480O/Pmzcz3PWdn3vNz4hfA1LoeEQcRMR8Rb0TEYmd/0lnilfaSHffgcH/l6HB/JYlW6/W/J3l+ti+6zsk82blmISK+/pWIbydn4zZ29zaWq9XKdiddata2So3dvVvrteW1ylpls1y+u3T39ot3XiiPrK7Xar9478vrr37j17/65Lu/O/ji97NiXe7kdddjlNpVnzuJk5mNiFfPI9gEzHTW8xMuBx9MGhEfiYjP5Pf/Yszk/zsBgIus1VqM1mJ3GgC46NJ8DCxJixGRpp1OQLE9hvdMXEqr9Ubz5v36zuZqe6zsSsyl99erldtXF/7w3fzguSRLL+V5eX6eLp9K34mIqxHxo4Un8nRxpV5dnUyXBwCm3pPd7X9E/GshTYvFgU7t8akeAPDYKEy6AADA2Gn/AWD6aP8BYPoM0P53Puw/OPeyAADj4f0/AEwf7T8ATB/tPwBMla+99lq2tI4633+9+ubuzkb9zVurlcZGsbazUlypb28V1+r1tfw7e2qPul61Xt9aej523io1K41mqbG7d69W39ls3su/1/teZW4stQIA/per1975fRIRBy89kS/RNZeDthoutnSERwGPl5lhTtZBgMea2b5geg3UhOedhN+ee1mAyej5Zd6Fnpvv95P/I4jfM4IPlRsfH3z83xzPcLEY2Yfp9cHG/18eeTmA8TP+D9Or1UpOz/k/f5IFAFxIQ/wKX+sHo+qEABP1qMm8R/L5PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFwwlyPiO5GkxXwu8DT7Ny0WI56KiCsxl9xfr1ZuR8TTcS0i5hay9NKkCw0ADCn9a9KZ/+vG4nOXT+fOJ/9eyNcR8b2fvv7jt5abze2lbP8/TvYvHE8fVn543hDzCgIAg/vzIAfl7Xe5s+56I//gcH/leDnHMp7x3pdOJh9dOTrcz5d2zmy0Wq1WRCHvS1z6ZxKznXMKEfFsRMyMIP7B2xHxsV71T/KxkSudmU+740cn9lNjjZ++L36a57XX2cv30RGUBabNO9nz55Ve918a1/N17/u/kD+hhpc//woRx8++o674s51IMz3iZ/f89UFjPP+br57Z2Vps570d8exsr/jJSfykT/znBoz/x0986ocv98lr/SziRvSO3x2r1KxtlRq7e7fWa8trlbXKZrl8d+nu7RfvvFAu5WPUpeOR6rP+9tLNp/uVLav/pT7xCz3rP39y7ucGrP/P//PGtz79MLlwOv4XPtv75/9Mz/htWZv4+QHjL1/6Zd/pu7P4q33q/6if/80B47/7l73VAQ8FAMagsbu3sVytVraH2sjehY7iOmc2siIOdvBxd3G4oH+KfGNEL0ufjawzNsjBc+f1qp77xuxJX3G0V/5mdsUxVycdeS2G2ngwrliTeyYB4/Hwpp90SQAAAAAAAAAAAAAAgH7G8adLk64jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF9d/AwAA//8+JMPM") creat(&(0x7f0000000140)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8ff20c2c10f0093d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f00000001c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x204bc2f, 0x0, 0x1, 0x0, &(0x7f0000000240)) lremovexattr(&(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000000)=@known='system.posix_acl_default\x00') 0s ago: executing program 1 (id=692): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x1b, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xc}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f00000002c0)='kfree\x00', r1, 0x0, 0x40}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c0000000206010700000000000000000000000014000300686173683a69702c706f72742c6970000900020073797a31000000000500010007000000050005000a0000000500040001000000a28e4e4ad5"], 0x4c}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 16.460825][ T29] kauditd_printk_skb: 45 callbacks suppressed [ 16.460842][ T29] audit: type=1400 audit(1764872639.984:57): avc: denied { transition } for pid=3190 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.465596][ T29] audit: type=1400 audit(1764872639.984:58): avc: denied { noatsecure } for pid=3190 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.468381][ T29] audit: type=1400 audit(1764872639.994:59): avc: denied { write } for pid=3190 comm="sh" path="pipe:[424]" dev="pipefs" ino=424 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 16.471352][ T29] audit: type=1400 audit(1764872639.994:60): avc: denied { rlimitinh } for pid=3190 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.473868][ T29] audit: type=1400 audit(1764872639.994:61): avc: denied { siginh } for pid=3190 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 17.177689][ T3191] sshd-session (3191) used greatest stack depth: 10560 bytes left [ 19.590220][ T29] audit: type=1400 audit(1764872643.114:62): avc: denied { search } for pid=3196 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.612216][ T29] audit: type=1400 audit(1764872643.114:63): avc: denied { search } for pid=3196 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=477 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.634920][ T29] audit: type=1400 audit(1764872643.114:64): avc: denied { search } for pid=3196 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=481 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.658072][ T29] audit: type=1400 audit(1764872643.114:65): avc: denied { search } for pid=3196 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.681184][ T29] audit: type=1400 audit(1764872643.114:66): avc: denied { read open } for pid=3197 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.1.124' (ED25519) to the list of known hosts. [ 24.076187][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 24.076203][ T29] audit: type=1400 audit(1764872647.604:70): avc: denied { mounton } for pid=3301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.105372][ T29] audit: type=1400 audit(1764872647.634:71): avc: denied { mount } for pid=3301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.106131][ T3301] cgroup: Unknown subsys name 'net' [ 24.133213][ T29] audit: type=1400 audit(1764872647.664:72): avc: denied { unmount } for pid=3301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.273448][ T3301] cgroup: Unknown subsys name 'cpuset' [ 24.279876][ T3301] cgroup: Unknown subsys name 'rlimit' [ 24.408537][ T29] audit: type=1400 audit(1764872647.934:73): avc: denied { setattr } for pid=3301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.432022][ T29] audit: type=1400 audit(1764872647.934:74): avc: denied { create } for pid=3301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.452515][ T29] audit: type=1400 audit(1764872647.934:75): avc: denied { write } for pid=3301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.473007][ T29] audit: type=1400 audit(1764872647.934:76): avc: denied { read } for pid=3301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.493317][ T29] audit: type=1400 audit(1764872647.944:77): avc: denied { mounton } for pid=3301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.498960][ T3304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.518117][ T29] audit: type=1400 audit(1764872647.944:78): avc: denied { mount } for pid=3301 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.550134][ T29] audit: type=1400 audit(1764872647.954:79): avc: denied { read } for pid=3042 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 24.568720][ T3301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.790727][ T3313] chnl_net:caif_netlink_parms(): no params data found [ 25.837236][ T3314] chnl_net:caif_netlink_parms(): no params data found [ 25.871728][ T3311] chnl_net:caif_netlink_parms(): no params data found [ 25.884480][ T3313] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.891645][ T3313] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.899105][ T3313] bridge_slave_0: entered allmulticast mode [ 25.905642][ T3313] bridge_slave_0: entered promiscuous mode [ 25.921539][ T3313] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.928656][ T3313] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.935825][ T3313] bridge_slave_1: entered allmulticast mode [ 25.942146][ T3313] bridge_slave_1: entered promiscuous mode [ 25.971866][ T3312] chnl_net:caif_netlink_parms(): no params data found [ 26.005277][ T3313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.025811][ T3313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.054865][ T3322] chnl_net:caif_netlink_parms(): no params data found [ 26.068319][ T3314] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.075422][ T3314] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.082668][ T3314] bridge_slave_0: entered allmulticast mode [ 26.089102][ T3314] bridge_slave_0: entered promiscuous mode [ 26.109256][ T3314] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.116335][ T3314] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.123736][ T3314] bridge_slave_1: entered allmulticast mode [ 26.130125][ T3314] bridge_slave_1: entered promiscuous mode [ 26.139182][ T3313] team0: Port device team_slave_0 added [ 26.150113][ T3313] team0: Port device team_slave_1 added [ 26.155780][ T3311] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.162905][ T3311] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.170076][ T3311] bridge_slave_0: entered allmulticast mode [ 26.176657][ T3311] bridge_slave_0: entered promiscuous mode [ 26.199204][ T3311] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.206315][ T3311] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.213676][ T3311] bridge_slave_1: entered allmulticast mode [ 26.220040][ T3311] bridge_slave_1: entered promiscuous mode [ 26.242250][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.249233][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.275237][ T3313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.291635][ T3314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.308316][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.315290][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.341184][ T3313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.357261][ T3314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.366443][ T3312] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.373602][ T3312] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.380845][ T3312] bridge_slave_0: entered allmulticast mode [ 26.387173][ T3312] bridge_slave_0: entered promiscuous mode [ 26.403541][ T3311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.418013][ T3312] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.425092][ T3312] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.432225][ T3312] bridge_slave_1: entered allmulticast mode [ 26.438720][ T3312] bridge_slave_1: entered promiscuous mode [ 26.456058][ T3311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.475042][ T3312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.484237][ T3322] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.491246][ T3322] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.498470][ T3322] bridge_slave_0: entered allmulticast mode [ 26.505541][ T3322] bridge_slave_0: entered promiscuous mode [ 26.517171][ T3314] team0: Port device team_slave_0 added [ 26.528751][ T3312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.538029][ T3322] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.545119][ T3322] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.552319][ T3322] bridge_slave_1: entered allmulticast mode [ 26.558775][ T3322] bridge_slave_1: entered promiscuous mode [ 26.570681][ T3314] team0: Port device team_slave_1 added [ 26.590138][ T3311] team0: Port device team_slave_0 added [ 26.601708][ T3313] hsr_slave_0: entered promiscuous mode [ 26.607770][ T3313] hsr_slave_1: entered promiscuous mode [ 26.623635][ T3311] team0: Port device team_slave_1 added [ 26.634905][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.641854][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.667893][ T3314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.679363][ T3312] team0: Port device team_slave_0 added [ 26.686031][ T3322] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.699906][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.706906][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.732804][ T3314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.744141][ T3312] team0: Port device team_slave_1 added [ 26.750597][ T3322] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.781523][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.788618][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.814563][ T3311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.840623][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.847709][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.873716][ T3311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.885400][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.892341][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.918448][ T3312] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.934752][ T3322] team0: Port device team_slave_0 added [ 26.947836][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.954857][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.980949][ T3312] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.994459][ T3322] team0: Port device team_slave_1 added [ 27.022476][ T3314] hsr_slave_0: entered promiscuous mode [ 27.028657][ T3314] hsr_slave_1: entered promiscuous mode [ 27.034572][ T3314] debugfs: 'hsr0' already exists in 'hsr' [ 27.040291][ T3314] Cannot create hsr debugfs directory [ 27.059159][ T3322] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.066182][ T3322] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.092122][ T3322] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.116127][ T3322] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.123208][ T3322] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.149449][ T3322] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.162428][ T3311] hsr_slave_0: entered promiscuous mode [ 27.168503][ T3311] hsr_slave_1: entered promiscuous mode [ 27.174400][ T3311] debugfs: 'hsr0' already exists in 'hsr' [ 27.180113][ T3311] Cannot create hsr debugfs directory [ 27.204806][ T3312] hsr_slave_0: entered promiscuous mode [ 27.210864][ T3312] hsr_slave_1: entered promiscuous mode [ 27.216708][ T3312] debugfs: 'hsr0' already exists in 'hsr' [ 27.222410][ T3312] Cannot create hsr debugfs directory [ 27.274093][ T3322] hsr_slave_0: entered promiscuous mode [ 27.280170][ T3322] hsr_slave_1: entered promiscuous mode [ 27.286157][ T3322] debugfs: 'hsr0' already exists in 'hsr' [ 27.291875][ T3322] Cannot create hsr debugfs directory [ 27.374687][ T3313] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 27.385482][ T3313] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 27.406124][ T3313] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 27.422145][ T3313] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 27.477265][ T3314] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 27.494645][ T3314] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 27.506377][ T3314] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 27.519294][ T3314] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 27.528838][ T3322] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 27.540082][ T3322] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 27.552553][ T3322] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 27.561340][ T3322] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 27.586120][ T3312] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 27.601154][ T3312] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 27.609952][ T3312] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 27.618668][ T3312] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 27.659174][ T3311] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 27.669664][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.677921][ T3311] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 27.686545][ T3311] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 27.699541][ T3311] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 27.724176][ T3313] 8021q: adding VLAN 0 to HW filter on device team0 [ 27.747968][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.755130][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.767570][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.774758][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.793338][ T3314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.804100][ T3322] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.836497][ T3314] 8021q: adding VLAN 0 to HW filter on device team0 [ 27.847395][ T3322] 8021q: adding VLAN 0 to HW filter on device team0 [ 27.861008][ T958] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.868180][ T958] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.880034][ T958] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.887320][ T958] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.904838][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.911947][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.924252][ T3312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.937396][ T3311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.945664][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.952957][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.981435][ T3312] 8021q: adding VLAN 0 to HW filter on device team0 [ 27.996796][ T3311] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.016226][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.023368][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.040117][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.047190][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.055898][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.062955][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.079813][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.087004][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.112070][ T3313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.139963][ T3312] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 28.159654][ T3311] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 28.188019][ T3322] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.238128][ T3313] veth0_vlan: entered promiscuous mode [ 28.256530][ T3314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.267913][ T3312] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.276920][ T3313] veth1_vlan: entered promiscuous mode [ 28.308654][ T3313] veth0_macvtap: entered promiscuous mode [ 28.330543][ T3313] veth1_macvtap: entered promiscuous mode [ 28.357236][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 28.367146][ T3311] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.377877][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 28.410422][ T31] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.430199][ T31] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.456579][ T3322] veth0_vlan: entered promiscuous mode [ 28.470093][ T31] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.479332][ T3314] veth0_vlan: entered promiscuous mode [ 28.493527][ T31] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.511121][ T3313] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 28.527849][ T3322] veth1_vlan: entered promiscuous mode [ 28.534439][ T3314] veth1_vlan: entered promiscuous mode [ 28.560604][ T3311] veth0_vlan: entered promiscuous mode [ 28.570082][ T3312] veth0_vlan: entered promiscuous mode [ 28.586855][ T3311] veth1_vlan: entered promiscuous mode [ 28.597029][ T3312] veth1_vlan: entered promiscuous mode [ 28.606339][ T3314] veth0_macvtap: entered promiscuous mode [ 28.615365][ T3322] veth0_macvtap: entered promiscuous mode [ 28.622766][ T3314] veth1_macvtap: entered promiscuous mode [ 28.630199][ T3322] veth1_macvtap: entered promiscuous mode [ 28.644979][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 28.661359][ T3312] veth0_macvtap: entered promiscuous mode [ 28.668421][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 28.678496][ T3312] veth1_macvtap: entered promiscuous mode [ 28.685228][ T3311] veth0_macvtap: entered promiscuous mode [ 28.693131][ T3322] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 28.707187][ T3322] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 28.717140][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 28.727071][ T3311] veth1_macvtap: entered promiscuous mode [ 28.734367][ T41] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.749380][ T41] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.763782][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 28.782722][ T41] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.798787][ T41] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.812673][ T41] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.858118][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 28.878053][ T971] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.909605][ T971] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.926116][ T971] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.941098][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 28.967744][ T971] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.001344][ T971] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.017702][ T971] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.028646][ T971] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.063989][ T971] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.085862][ T971] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.098594][ T971] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.132070][ T3513] netlink: 'syz.1.10': attribute type 1 has an invalid length. [ 29.140114][ T29] kauditd_printk_skb: 73 callbacks suppressed [ 29.140126][ T29] audit: type=1400 audit(1764872652.674:153): avc: denied { create } for pid=3508 comm="syz.3.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 29.153414][ T3513] gretap0: entered promiscuous mode [ 29.170716][ T3513] gretap0: entered allmulticast mode [ 29.176403][ T3509] syz.3.9: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 [ 29.190726][ T3509] CPU: 0 UID: 0 PID: 3509 Comm: syz.3.9 Not tainted syzkaller #0 PREEMPT(voluntary) [ 29.190819][ T3509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 29.190838][ T3509] Call Trace: [ 29.190846][ T3509] [ 29.190856][ T3509] __dump_stack+0x1d/0x30 [ 29.190941][ T3509] dump_stack_lvl+0xe8/0x140 [ 29.190963][ T3509] dump_stack+0x15/0x1b [ 29.190980][ T3509] warn_alloc+0x12b/0x1a0 [ 29.191086][ T3509] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 29.191130][ T3509] __vmalloc_node_range_noprof+0x9d/0xed0 [ 29.191171][ T3509] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 29.191200][ T3509] ? slow_avc_audit+0x104/0x140 [ 29.191227][ T3509] ? should_fail_ex+0x30/0x280 [ 29.191330][ T3509] ? xskq_create+0x36/0xe0 [ 29.191364][ T3509] vmalloc_user_noprof+0x7d/0xb0 [ 29.191388][ T3509] ? xskq_create+0x80/0xe0 [ 29.191426][ T3509] xskq_create+0x80/0xe0 [ 29.191452][ T3509] xsk_init_queue+0x95/0xf0 [ 29.191477][ T3509] xsk_setsockopt+0x477/0x640 [ 29.191509][ T3509] ? __pfx_xsk_setsockopt+0x10/0x10 [ 29.191546][ T3509] __sys_setsockopt+0x184/0x200 [ 29.191575][ T3509] __x64_sys_setsockopt+0x64/0x80 [ 29.191663][ T3509] x64_sys_call+0x21d5/0x3000 [ 29.191691][ T3509] do_syscall_64+0xd8/0x2a0 [ 29.191760][ T3509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 29.191808][ T3509] RIP: 0033:0x7f4c6a22f749 [ 29.191831][ T3509] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 29.191913][ T3509] RSP: 002b:00007f4c68c97038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 29.191932][ T3509] RAX: ffffffffffffffda RBX: 00007f4c6a485fa0 RCX: 00007f4c6a22f749 [ 29.191947][ T3509] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000007 [ 29.191962][ T3509] RBP: 00007f4c6a2b3f91 R08: 0000000000000004 R09: 0000000000000000 [ 29.191976][ T3509] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 29.192059][ T3509] R13: 00007f4c6a486038 R14: 00007f4c6a485fa0 R15: 00007ffd70a55108 [ 29.192079][ T3509] [ 29.192091][ T3509] Mem-Info: [ 29.256735][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.258135][ T3509] active_anon:5713 inactive_anon:0 isolated_anon:0 [ 29.258135][ T3509] active_file:8014 inactive_file:2225 isolated_file:0 [ 29.258135][ T3509] unevictable:0 dirty:1358 writeback:0 [ 29.258135][ T3509] slab_reclaimable:3020 slab_unreclaimable:13517 [ 29.258135][ T3509] mapped:28992 shmem:175 pagetables:1025 [ 29.258135][ T3509] sec_pagetables:0 bounce:0 [ 29.258135][ T3509] kernel_misc_reclaimable:0 [ 29.258135][ T3509] free:1906882 free_pcp:6031 free_cma:0 [ 29.377097][ T29] audit: type=1400 audit(1764872652.704:154): avc: denied { setopt } for pid=3508 comm="syz.3.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 29.377170][ T3509] Node 0 active_anon:22968kB inactive_anon:0kB active_file:32056kB inactive_file:8900kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:115968kB dirty:5432kB writeback:0kB shmem:700kB kernel_stack:3456kB pagetables:4100kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 29.499681][ T3509] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 29.529518][ T3509] lowmem_reserve[]: 0 2880 7859 7859 [ 29.534951][ T3509] Node 0 DMA32 free:2946224kB boost:0kB min:4132kB low:7060kB high:9988kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:3129332kB managed:2949752kB mlocked:0kB bounce:0kB free_pcp:3528kB local_pcp:3528kB free_cma:0kB [ 29.566777][ T3509] lowmem_reserve[]: 0 0 4978 4978 [ 29.571823][ T3509] Node 0 Normal free:4665624kB boost:0kB min:7188kB low:12284kB high:17380kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23048kB inactive_anon:0kB active_file:32168kB inactive_file:8900kB unevictable:0kB writepending:5520kB zspages:0kB present:5242880kB managed:5098240kB mlocked:0kB bounce:0kB free_pcp:20536kB local_pcp:17040kB free_cma:0kB [ 29.604956][ T3509] lowmem_reserve[]: 0 0 0 0 [ 29.609559][ T3509] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 29.622365][ T3509] Node 0 DMA32: 4*4kB (M) 2*8kB (M) 3*16kB (M) 3*32kB (M) 4*64kB (M) 4*128kB (M) 3*256kB (M) 3*512kB (M) 4*1024kB (M) 3*2048kB (M) 716*4096kB (M) = 2946224kB [ 29.638741][ T3509] Node 0 Normal: 430*4kB (UME) 116*8kB (UME) 20*16kB (M) 16*32kB (M) 14*64kB (UM) 8*128kB (UM) 6*256kB (UM) 5*512kB (UM) 3*1024kB (UME) 2*2048kB (UE) 1135*4096kB (M) = 4665624kB [ 29.656792][ T3509] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 29.666178][ T3509] 10438 total pagecache pages [ 29.670843][ T3509] 0 pages in swap cache [ 29.675050][ T3509] Free swap = 124996kB [ 29.679274][ T3509] Total swap = 124996kB [ 29.683516][ T3509] 2097051 pages RAM [ 29.687309][ T3509] 0 pages HighMem/MovableOnly [ 29.692058][ T3509] 81213 pages reserved [ 29.807906][ T3513] syz.1.10 (3513) used greatest stack depth: 10328 bytes left [ 29.890228][ T29] audit: type=1400 audit(1764872653.414:155): avc: denied { create } for pid=3519 comm="syz.1.12" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 29.959458][ T3523] loop3: detected capacity change from 0 to 512 [ 29.983616][ T3523] EXT4-fs error (device loop3): ext4_xattr_inode_iget:441: inode #11: comm syz.3.13: iget: bad extra_isize 90 (inode size 256) [ 30.003421][ T3420] Process accounting resumed [ 30.041310][ T3523] EXT4-fs (loop3): Remounting filesystem read-only [ 30.062290][ T29] audit: type=1400 audit(1764872653.584:156): avc: denied { ioctl } for pid=3529 comm="syz.0.15" path="socket:[3860]" dev="sockfs" ino=3860 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.075876][ T3530] syzkaller0: entered promiscuous mode [ 30.093764][ T3530] syzkaller0: entered allmulticast mode [ 30.104378][ T3523] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2857: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 30.117382][ T3523] EXT4-fs warning (device loop3): ext4_evict_inode:256: couldn't mark inode dirty (err -30) [ 30.166178][ T29] audit: type=1400 audit(1764872653.644:157): avc: denied { read write } for pid=3311 comm="syz-executor" name="loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 30.179452][ T3523] EXT4-fs (loop3): 1 orphan inode deleted [ 30.190384][ T29] audit: type=1400 audit(1764872653.644:158): avc: denied { open } for pid=3311 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 30.201143][ T3523] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 30.220054][ T29] audit: type=1400 audit(1764872653.644:159): avc: denied { ioctl } for pid=3311 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=102 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 30.257592][ T29] audit: type=1400 audit(1764872653.644:160): avc: denied { create } for pid=3532 comm="syz.2.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 30.277076][ T29] audit: type=1400 audit(1764872653.654:161): avc: denied { bind } for pid=3532 comm="syz.2.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 30.296257][ T29] audit: type=1400 audit(1764872653.654:162): avc: denied { listen } for pid=3532 comm="syz.2.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 30.388553][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 30.455766][ T3537] netlink: 96 bytes leftover after parsing attributes in process `syz.0.19'. [ 30.637681][ T3554] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 31.019430][ T3581] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 31.527859][ T3581] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 31.597965][ T3581] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 31.641586][ T3595] netlink: 'syz.1.43': attribute type 1 has an invalid length. [ 31.687165][ T3581] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 31.709483][ T3595] veth1: entered promiscuous mode [ 31.714622][ T3595] veth1: entered allmulticast mode [ 31.817656][ T31] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.853063][ T31] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.861587][ T31] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.891326][ T31] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.972480][ T3616] netlink: 12 bytes leftover after parsing attributes in process `syz.4.53'. [ 31.980150][ T3617] bridge0: entered promiscuous mode [ 31.988958][ T3617] macsec1: entered promiscuous mode [ 31.995960][ T3617] bridge0: port 3(macsec1) entered blocking state [ 32.002542][ T3617] bridge0: port 3(macsec1) entered disabled state [ 32.009639][ T3617] macsec1: entered allmulticast mode [ 32.015075][ T3617] bridge0: entered allmulticast mode [ 32.021237][ T3617] macsec1: left allmulticast mode [ 32.026342][ T3617] bridge0: left allmulticast mode [ 32.042151][ T3617] bridge0: left promiscuous mode [ 32.256746][ T3629] syz.3.58 uses obsolete (PF_INET,SOCK_PACKET) [ 32.391696][ T3633] loop1: detected capacity change from 0 to 512 [ 32.399942][ T3633] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 32.414550][ T3633] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.427245][ T3633] ext4 filesystem being mounted at /13/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 32.464238][ T3314] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.523567][ T3647] Illegal XDP return value 446011425 on prog (id 46) dev syz_tun, expect packet loss! [ 32.547527][ T3646] ======================================================= [ 32.547527][ T3646] WARNING: The mand mount option has been deprecated and [ 32.547527][ T3646] and is ignored by this kernel. Remove the mand [ 32.547527][ T3646] option from the mount to silence this warning. [ 32.547527][ T3646] ======================================================= [ 32.585630][ T3649] netlink: 8 bytes leftover after parsing attributes in process `syz.1.66'. [ 32.595906][ T3649] netlink: 236 bytes leftover after parsing attributes in process `syz.1.66'. [ 32.622623][ T3651] loop3: detected capacity change from 0 to 512 [ 32.629493][ T3653] team0: Port device vlan2 added [ 32.638166][ T3651] EXT4-fs error (device loop3): ext4_orphan_get:1391: inode #15: comm syz.3.67: iget: bad i_size value: 38620345925642 [ 32.639221][ T3653] netlink: 'syz.1.68': attribute type 10 has an invalid length. [ 32.655251][ T3651] EXT4-fs error (device loop3): ext4_orphan_get:1396: comm syz.3.67: couldn't read orphan inode 15 (err -117) [ 32.667080][ T3653] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 32.680843][ T3651] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.708517][ T3653] syz.1.68 (3653) used greatest stack depth: 10016 bytes left [ 32.740467][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.983441][ T3681] netlink: 'syz.1.80': attribute type 4 has an invalid length. [ 33.137295][ T3697] loop0: detected capacity change from 0 to 2048 [ 33.155105][ T3697] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 33.193555][ T3312] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz-executor: bg 0: block 234: padding at end of block bitmap is not set [ 33.199375][ T3701] netlink: 'syz.1.88': attribute type 1 has an invalid length. [ 33.208317][ T3312] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6689: Corrupt filesystem [ 33.215908][ T3701] netlink: 'syz.1.88': attribute type 4 has an invalid length. [ 33.232147][ T3701] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.88'. [ 33.243663][ T3312] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.261322][ T3701] netlink: 'syz.1.88': attribute type 1 has an invalid length. [ 33.269138][ T3701] netlink: 'syz.1.88': attribute type 4 has an invalid length. [ 33.276714][ T3701] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.88'. [ 33.353779][ T3710] random: crng reseeded on system resumption [ 33.740019][ T3747] netlink: 24 bytes leftover after parsing attributes in process `syz.2.105'. [ 33.807430][ T3754] xt_hashlimit: max too large, truncated to 1048576 [ 33.850509][ T3758] loop3: detected capacity change from 0 to 164 [ 33.884727][ T3758] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 33.896380][ T3758] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 33.905838][ T3758] Symlink component flag not implemented [ 33.911497][ T3758] Symlink component flag not implemented [ 33.917900][ T3758] Symlink component flag not implemented (7) [ 33.923922][ T3758] Symlink component flag not implemented (116) [ 33.998131][ T3766] bridge0: entered promiscuous mode [ 34.004054][ T3766] bridge0: left promiscuous mode [ 34.197990][ C1] hrtimer: interrupt took 31165 ns [ 34.461205][ T29] kauditd_printk_skb: 453 callbacks suppressed [ 34.461223][ T29] audit: type=1400 audit(1764872657.984:616): avc: denied { tracepoint } for pid=3773 comm="syz.1.116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 34.499346][ T3776] netlink: 12 bytes leftover after parsing attributes in process `syz.4.117'. [ 34.553606][ T29] audit: type=1400 audit(1764872658.084:617): avc: denied { relabelfrom } for pid=3777 comm="syz.3.118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 34.573340][ T29] audit: type=1400 audit(1764872658.084:618): avc: denied { relabelto } for pid=3777 comm="syz.3.118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 34.654784][ T3783] IPv6: Can't replace route, no match found [ 34.979667][ T29] audit: type=1326 audit(1764872658.504:619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3796 comm="syz.3.124" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c6a22f749 code=0x7ffc0000 [ 35.009165][ T3797] loop3: detected capacity change from 0 to 1024 [ 35.034133][ T3797] EXT4-fs: Ignoring removed nomblk_io_submit option [ 35.067307][ T29] audit: type=1326 audit(1764872658.534:620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3796 comm="syz.3.124" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f4c6a22f749 code=0x7ffc0000 [ 35.090671][ T29] audit: type=1326 audit(1764872658.534:621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3796 comm="syz.3.124" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f4c6a22f783 code=0x7ffc0000 [ 35.113723][ T29] audit: type=1326 audit(1764872658.534:622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3796 comm="syz.3.124" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f4c6a22e1ff code=0x7ffc0000 [ 35.136779][ T29] audit: type=1326 audit(1764872658.534:623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3796 comm="syz.3.124" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f4c6a22f7d7 code=0x7ffc0000 [ 35.159934][ T29] audit: type=1326 audit(1764872658.534:624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3796 comm="syz.3.124" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4c6a22df90 code=0x7ffc0000 [ 35.183292][ T29] audit: type=1326 audit(1764872658.534:625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3796 comm="syz.3.124" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4c6a22f34b code=0x7ffc0000 [ 35.211475][ T3797] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.263837][ T3802] syzkaller0: entered promiscuous mode [ 35.269383][ T3802] syzkaller0: entered allmulticast mode [ 35.365735][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.476905][ T3809] netlink: 16 bytes leftover after parsing attributes in process `syz.3.127'. [ 35.503346][ T3810] netlink: 12 bytes leftover after parsing attributes in process `syz.1.128'. [ 36.044765][ T3828] loop0: detected capacity change from 0 to 8192 [ 36.737303][ T3841] loop4: detected capacity change from 0 to 1024 [ 36.744565][ T3839] loop0: detected capacity change from 0 to 4096 [ 36.763907][ T3839] EXT4-fs (loop0): couldn't mount as ext3 due to feature incompatibilities [ 36.816328][ T3841] EXT4-fs: Ignoring removed orlov option [ 36.856953][ T3841] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.018485][ T3868] loop2: detected capacity change from 0 to 256 [ 37.053266][ T3868] FAT-fs (loop2): error, corrupted file size (i_pos 196, 2097152) [ 37.061158][ T3868] FAT-fs (loop2): Filesystem has been set read-only [ 37.095748][ T3868] FAT-fs (loop2): error, corrupted file size (i_pos 196, 2097152) [ 37.285978][ T3890] netlink: 'syz.3.160': attribute type 4 has an invalid length. [ 37.324678][ T3890] netlink: 'syz.3.160': attribute type 4 has an invalid length. [ 37.358415][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.445013][ T3904] netlink: 4 bytes leftover after parsing attributes in process `syz.2.167'. [ 37.487249][ T3904] team0: Port device team_slave_1 removed [ 37.616031][ T3909] loop2: detected capacity change from 0 to 512 [ 37.650491][ T3909] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.673999][ T3909] ext4 filesystem being mounted at /19/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 37.704963][ T3909] EXT4-fs error (device loop2): ext4_do_update_inode:5617: inode #2: comm syz.2.168: corrupted inode contents [ 37.763223][ T3909] EXT4-fs error (device loop2): ext4_dirty_inode:6502: inode #2: comm syz.2.168: mark_inode_dirty error [ 37.816688][ T3909] EXT4-fs error (device loop2): ext4_do_update_inode:5617: inode #2: comm syz.2.168: corrupted inode contents [ 37.850545][ T3909] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #2: comm syz.2.168: mark_inode_dirty error [ 37.903627][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.959544][ T3917] lo: entered allmulticast mode [ 37.972209][ T3917] lo: entered promiscuous mode [ 37.977049][ T3917] lo: left allmulticast mode [ 38.327203][ T3935] netlink: 24 bytes leftover after parsing attributes in process `syz.3.177'. [ 38.352730][ T3935] netlink: 4 bytes leftover after parsing attributes in process `syz.3.177'. [ 38.938030][ T3983] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.001163][ T3983] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.050262][ T3983] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.082944][ T3993] netlink: 12 bytes leftover after parsing attributes in process `syz.1.193'. [ 39.125637][ T3983] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.224537][ T61] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.239959][ T61] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.251743][ T61] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.263949][ T61] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.353641][ T4016] netlink: 'syz.0.201': attribute type 29 has an invalid length. [ 39.362082][ T4009] netlink: 'syz.0.201': attribute type 29 has an invalid length. [ 39.452946][ T4030] syz.0.209 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 39.463416][ T29] kauditd_printk_skb: 102 callbacks suppressed [ 39.463430][ T29] audit: type=1326 audit(1764872662.984:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4027 comm="syz.4.210" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 39.494056][ T29] audit: type=1326 audit(1764872662.994:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4027 comm="syz.4.210" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 39.517696][ T3518] Bluetooth: hci0: sending frame failed (-49) [ 39.523932][ T44] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 39.621130][ T29] audit: type=1400 audit(1764872663.144:730): avc: denied { setopt } for pid=4032 comm="syz.0.211" laddr=::1 lport=35966 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 39.708856][ T29] audit: type=1326 audit(1764872663.234:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4042 comm="syz.0.215" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efeb61df749 code=0x7ffc0000 [ 39.733659][ T29] audit: type=1326 audit(1764872663.234:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4042 comm="syz.0.215" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7efeb61df749 code=0x7ffc0000 [ 39.756942][ T29] audit: type=1326 audit(1764872663.234:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4042 comm="syz.0.215" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efeb61df749 code=0x7ffc0000 [ 39.780238][ T29] audit: type=1326 audit(1764872663.234:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4042 comm="syz.0.215" exe="/root/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7efeb61df749 code=0x7ffc0000 [ 39.803863][ T29] audit: type=1326 audit(1764872663.314:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4046 comm="syz.3.216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c6a22f749 code=0x7ffc0000 [ 39.827263][ T29] audit: type=1326 audit(1764872663.314:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4046 comm="syz.3.216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c6a22f749 code=0x7ffc0000 [ 39.850488][ T29] audit: type=1326 audit(1764872663.314:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4046 comm="syz.3.216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f4c6a22f749 code=0x7ffc0000 [ 39.987986][ T4057] loop2: detected capacity change from 0 to 512 [ 40.006041][ T4057] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 40.019158][ T4057] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 40.033647][ T4057] EXT4-fs (loop2): 1 truncate cleaned up [ 40.039879][ T4057] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 40.169107][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.340387][ T4089] smc: net device bond0 applied user defined pnetid SYZ0 [ 40.347900][ T4089] smc: net device bond0 erased user defined pnetid SYZ0 [ 40.568328][ T4105] netlink: 12 bytes leftover after parsing attributes in process `syz.3.239'. [ 40.587550][ T4107] loop4: detected capacity change from 0 to 164 [ 40.591391][ T4105] 8021q: adding VLAN 0 to HW filter on device bond1 [ 40.601760][ T4107] ISOFS: unable to read i-node block [ 40.619867][ T4105] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.622028][ T4107] ISOFS: root inode is unusable. Disabling Rock Ridge and switching to Joliet. [ 40.654492][ T4105] bond1: (slave bond0): Enslaving as an active interface with an up link [ 40.663414][ T4112] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 40.677041][ T4105] bond1 (unregistering): (slave bond0): Releasing backup interface [ 40.686694][ T4105] bond1 (unregistering): Released all slaves [ 40.720591][ T4112] ªªªªªª: renamed from vlan0 (while UP) [ 40.827569][ T4124] bridge0: port 3(macsec1) entered blocking state [ 40.834273][ T4124] bridge0: port 3(macsec1) entered disabled state [ 40.844097][ T4124] macsec1: entered allmulticast mode [ 40.849981][ T4124] macsec1: left allmulticast mode [ 41.015207][ T4140] loop2: detected capacity change from 0 to 1024 [ 41.021881][ T4137] tipc: Started in network mode [ 41.026897][ T4137] tipc: Node identity d224f42567a3, cluster identity 4711 [ 41.034203][ T4137] tipc: Enabled bearer , priority 0 [ 41.064490][ T4136] tipc: Resetting bearer [ 41.085066][ T4140] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.113788][ T4136] tipc: Disabling bearer [ 41.170434][ T4140] ext4 filesystem being mounted at /37/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 41.204178][ T4147] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.253731][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.299156][ T4147] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.325617][ T4155] netlink: 'syz.2.259': attribute type 83 has an invalid length. [ 41.376639][ T4147] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.439058][ T4147] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.566491][ T4169] netlink: 4 bytes leftover after parsing attributes in process `syz.2.267'. [ 41.609790][ T4171] loop1: detected capacity change from 0 to 1024 [ 41.620390][ T3836] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.641774][ T4171] EXT4-fs: Ignoring removed bh option [ 41.647240][ T4169] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 41.676375][ T4171] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-001000000000 r/w without journal. Quota mode: writeback. [ 41.677051][ T4169] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 41.741728][ T3314] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-001000000000. [ 41.786177][ T3836] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.817085][ T3836] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.839579][ T3836] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.871143][ T4177] netlink: 12 bytes leftover after parsing attributes in process `syz.0.270'. [ 41.921093][ T4183] netlink: 'syz.4.273': attribute type 13 has an invalid length. [ 42.003910][ T4191] loop2: detected capacity change from 0 to 512 [ 42.035616][ T4191] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.094117][ T4191] ext4 filesystem being mounted at /44/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.328322][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.438975][ T4208] batman_adv: batadv0: Adding interface: dummy0 [ 42.445435][ T4208] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 42.479681][ T4208] batman_adv: batadv0: Interface activated: dummy0 [ 42.490358][ T4208] batadv0: mtu less than device minimum [ 42.496602][ T4208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 42.507612][ T4208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 42.518483][ T4208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 42.529658][ T4208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 42.540530][ T4208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 42.551574][ T4208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 42.562712][ T4208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 42.573958][ T4208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 42.584980][ T4208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 43.332964][ T4223] netlink: 4 bytes leftover after parsing attributes in process `syz.2.289'. [ 43.355721][ T4223] veth1_macvtap: left promiscuous mode [ 43.396081][ T4225] bridge: RTM_NEWNEIGH with invalid ether address [ 43.451049][ T4229] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 43.883557][ T4249] ip6gre1: entered allmulticast mode [ 43.936117][ T4253] batman_adv: batadv0: Interface deactivated: dummy0 [ 43.942892][ T4253] batman_adv: batadv0: Removing interface: dummy0 [ 43.956355][ T4253] bridge_slave_0: left allmulticast mode [ 43.962079][ T4253] bridge_slave_0: left promiscuous mode [ 43.967975][ T4253] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.978109][ T4253] bridge_slave_1: left allmulticast mode [ 43.983971][ T4253] bridge_slave_1: left promiscuous mode [ 43.989710][ T4253] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.002223][ T4253] bond0: (slave bond_slave_0): Releasing backup interface [ 44.012326][ T4253] bond0: (slave bond_slave_1): Releasing backup interface [ 44.026121][ T4253] team0: Port device team_slave_0 removed [ 44.035096][ T4253] team0: Port device team_slave_1 removed [ 44.042274][ T4253] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 44.049949][ T4253] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 44.059767][ T4253] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 44.067281][ T4253] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 44.121802][ T4258] netlink: 'syz.0.304': attribute type 30 has an invalid length. [ 44.163974][ T4258] Zero length message leads to an empty skb [ 44.392691][ T4268] loop2: detected capacity change from 0 to 512 [ 44.395480][ T44] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 44.455441][ T4268] EXT4-fs: Ignoring removed oldalloc option [ 44.496830][ T4268] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 44.536233][ T4268] EXT4-fs (loop2): 1 truncate cleaned up [ 44.553373][ T4268] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 44.601236][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.657987][ T4281] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 44.764685][ T4286] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.777168][ T4288] netlink: 12 bytes leftover after parsing attributes in process `syz.2.317'. [ 44.834882][ T4286] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.887047][ T4286] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.954944][ T4286] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.122511][ T4296] xt_hashlimit: max too large, truncated to 1048576 [ 45.421263][ T41] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.437385][ T41] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.470599][ T41] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.503714][ T41] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.524535][ T29] kauditd_printk_skb: 121 callbacks suppressed [ 45.524549][ T29] audit: type=1400 audit(1764872669.054:859): avc: denied { write } for pid=4315 comm="syz.2.330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 45.598966][ T4322] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4322 comm=syz.2.332 [ 45.665852][ T4328] loop2: detected capacity change from 0 to 128 [ 45.696157][ T4328] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 45.708590][ T4328] ext4 filesystem being mounted at /60/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 45.720260][ T29] audit: type=1400 audit(1764872669.244:860): avc: denied { add_name } for pid=4327 comm="syz.2.335" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 45.762876][ T29] audit: type=1400 audit(1764872669.244:861): avc: denied { create } for pid=4327 comm="syz.2.335" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 45.804987][ T29] audit: type=1400 audit(1764872669.264:862): avc: denied { remove_name } for pid=4327 comm="syz.2.335" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop2" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 45.848675][ T29] audit: type=1400 audit(1764872669.264:863): avc: denied { rename } for pid=4327 comm="syz.2.335" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop2" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 45.890279][ T4310] bridge0: entered promiscuous mode [ 45.900172][ T4310] macsec1: entered promiscuous mode [ 45.906576][ T3311] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 45.919241][ T4319] loop4: detected capacity change from 0 to 1024 [ 45.923411][ T4310] bridge0: port 3(macsec1) entered blocking state [ 45.932368][ T4310] bridge0: port 3(macsec1) entered disabled state [ 45.949225][ T4310] macsec1: entered allmulticast mode [ 45.954604][ T4310] bridge0: entered allmulticast mode [ 45.967083][ T4310] macsec1: left allmulticast mode [ 45.967606][ T4319] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 45.972122][ T4310] bridge0: left allmulticast mode [ 45.984704][ T4319] ext4 filesystem being mounted at /56/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 46.019449][ T4310] bridge0: left promiscuous mode [ 46.034260][ T29] audit: type=1326 audit(1764872669.564:864): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4337 comm="syz.2.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 46.057571][ T29] audit: type=1326 audit(1764872669.564:865): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4337 comm="syz.2.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 46.080898][ T29] audit: type=1326 audit(1764872669.564:866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4337 comm="syz.2.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 46.104209][ T29] audit: type=1326 audit(1764872669.564:867): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4337 comm="syz.2.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 46.127675][ T29] audit: type=1326 audit(1764872669.564:868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4337 comm="syz.2.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 46.165947][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 46.183320][ T4344] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.225607][ T4344] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.535370][ T4371] loop4: detected capacity change from 0 to 512 [ 46.557215][ T4371] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 46.584610][ T4371] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.597325][ T4371] ext4 filesystem being mounted at /62/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 46.640199][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.994372][ T4390] loop2: detected capacity change from 0 to 256 [ 47.033423][ T4390] FAT-fs (loop2): codepage cp855 not found [ 47.051890][ T4385] bridge0: entered promiscuous mode [ 47.067110][ T4385] macsec1: entered promiscuous mode [ 47.073193][ T4385] bridge0: port 1(macsec1) entered blocking state [ 47.079770][ T4385] bridge0: port 1(macsec1) entered disabled state [ 47.086722][ T4385] macsec1: entered allmulticast mode [ 47.092086][ T4385] bridge0: entered allmulticast mode [ 47.099072][ T4385] macsec1: left allmulticast mode [ 47.104200][ T4385] bridge0: left allmulticast mode [ 47.121188][ T4395] netlink: 12 bytes leftover after parsing attributes in process `syz.2.356'. [ 47.130665][ T4385] bridge0: left promiscuous mode [ 47.321354][ T4410] netlink: 'syz.0.363': attribute type 12 has an invalid length. [ 47.403360][ T4414] netlink: 'syz.0.365': attribute type 13 has an invalid length. [ 47.523016][ T4422] loop1: detected capacity change from 0 to 512 [ 47.567350][ T4422] EXT4-fs error (device loop1): ext4_xattr_inode_iget:441: inode #11: comm syz.1.378: iget: bad extra_isize 90 (inode size 256) [ 47.622967][ T9] Process accounting resumed [ 47.635631][ T31] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.635785][ T4422] EXT4-fs (loop1): Remounting filesystem read-only [ 47.644173][ T31] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.644205][ T31] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.658513][ T4422] EXT4-fs warning (device loop1): ext4_evict_inode:256: couldn't mark inode dirty (err -30) [ 47.662813][ T31] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.692928][ T4422] EXT4-fs (loop1): 1 orphan inode deleted [ 47.699150][ T4422] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 47.733401][ T3314] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.527993][ T4458] loop4: detected capacity change from 0 to 512 [ 48.536901][ T4460] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.549033][ T4458] EXT4-fs error (device loop4): ext4_xattr_inode_iget:441: inode #11: comm syz.4.382: iget: bad extra_isize 90 (inode size 256) [ 48.583129][ T4458] EXT4-fs (loop4): Remounting filesystem read-only [ 48.596320][ T4458] EXT4-fs warning (device loop4): ext4_evict_inode:256: couldn't mark inode dirty (err -30) [ 48.612879][ T4458] EXT4-fs (loop4): 1 orphan inode deleted [ 48.619371][ T4458] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 48.632949][ T4460] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.658867][ T4453] bridge0: entered promiscuous mode [ 48.660238][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.669814][ T4453] macsec0: entered promiscuous mode [ 48.681086][ T4453] bridge0: port 3(macsec0) entered blocking state [ 48.687681][ T4453] bridge0: port 3(macsec0) entered disabled state [ 48.694806][ T4453] macsec0: entered allmulticast mode [ 48.700126][ T4453] bridge0: entered allmulticast mode [ 48.706213][ T4453] macsec0: left allmulticast mode [ 48.711266][ T4453] bridge0: left allmulticast mode [ 48.717077][ T4453] bridge0: left promiscuous mode [ 48.735040][ T4460] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.749450][ T4464] netlink: 360 bytes leftover after parsing attributes in process `wÞ£ÿ'. [ 48.796072][ T4460] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.809091][ T4466] netlink: 'syz.4.386': attribute type 1 has an invalid length. [ 48.844500][ T12] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.863521][ T4468] bond1: entered promiscuous mode [ 48.868640][ T4468] bond1: entered allmulticast mode [ 48.885135][ T4468] 8021q: adding VLAN 0 to HW filter on device bond1 [ 48.897060][ T12] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.919844][ T12] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.943958][ T4466] bridge1: entered promiscuous mode [ 48.949379][ T4466] bridge1: entered allmulticast mode [ 48.963276][ T4466] bond1: (slave bridge1): Enslaving as a backup interface with an up link [ 48.972025][ T12] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.980491][ T31] net_ratelimit: 12 callbacks suppressed [ 48.980506][ T31] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 49.084816][ T4482] geneve2: entered promiscuous mode [ 49.090294][ T4482] geneve2: entered allmulticast mode [ 49.102863][ T12] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 49.543814][ T4498] bridge0: entered promiscuous mode [ 49.561582][ T4498] macsec1: entered promiscuous mode [ 49.581589][ T4498] bridge0: port 3(macsec1) entered blocking state [ 49.588128][ T4498] bridge0: port 3(macsec1) entered disabled state [ 49.604684][ T4498] macsec1: entered allmulticast mode [ 49.610085][ T4498] bridge0: entered allmulticast mode [ 49.623458][ T4498] macsec1: left allmulticast mode [ 49.628567][ T4498] bridge0: left allmulticast mode [ 49.634307][ T4498] bridge0: left promiscuous mode [ 49.763911][ T4506] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.817486][ T4506] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.894361][ T4506] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.964495][ T4506] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.042416][ T31] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.074510][ T31] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.083871][ T4523] tipc: Started in network mode [ 50.088765][ T4523] tipc: Node identity ac14140f, cluster identity 4711 [ 50.107300][ T4523] tipc: New replicast peer: 255.255.255.255 [ 50.113404][ T4523] tipc: Enabled bearer , priority 10 [ 50.119413][ T31] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.133638][ T31] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.446410][ T4536] netlink: 'syz.4.411': attribute type 7 has an invalid length. [ 50.454313][ T4536] netlink: 8 bytes leftover after parsing attributes in process `syz.4.411'. [ 51.112880][ T23] tipc: Node number set to 2886997007 [ 51.134270][ T29] kauditd_printk_skb: 650 callbacks suppressed [ 51.134286][ T29] audit: type=1400 audit(1764872674.664:1519): avc: denied { setopt } for pid=4560 comm="syz.1.420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 51.180564][ T29] audit: type=1400 audit(1764872674.664:1520): avc: denied { write } for pid=4560 comm="syz.1.420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 51.295996][ T29] audit: type=1326 audit(1764872674.824:1521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4565 comm="syz.2.422" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 51.352793][ T29] audit: type=1326 audit(1764872674.854:1522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4565 comm="syz.2.422" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 51.377239][ T29] audit: type=1326 audit(1764872674.854:1523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4565 comm="syz.2.422" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 51.384464][ C0] vcan0: j1939_tp_rxtimer: 0xffff88811adda200: rx timeout, send abort [ 51.400645][ T29] audit: type=1326 audit(1764872674.854:1524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4565 comm="syz.2.422" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 51.432111][ T29] audit: type=1326 audit(1764872674.854:1525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4565 comm="syz.2.422" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 51.455533][ T29] audit: type=1326 audit(1764872674.854:1526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4565 comm="syz.2.422" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 51.478899][ T29] audit: type=1326 audit(1764872674.854:1527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4565 comm="syz.2.422" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 51.502448][ T29] audit: type=1326 audit(1764872674.854:1528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4565 comm="syz.2.422" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 51.617088][ T4570] netlink: 24 bytes leftover after parsing attributes in process `syz.4.423'. [ 51.884473][ C0] vcan0: j1939_tp_rxtimer: 0xffff88811adda400: rx timeout, send abort [ 51.908801][ C0] vcan0: j1939_tp_rxtimer: 0xffff88811adda200: abort rx timeout. Force session deactivation [ 52.165679][ T4594] team0: Port device vlan2 added [ 52.180168][ T4594] netlink: 'syz.4.431': attribute type 10 has an invalid length. [ 52.211643][ T4594] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 52.282636][ T4601] loop4: detected capacity change from 0 to 512 [ 52.297261][ T4601] EXT4-fs error (device loop4): ext4_orphan_get:1391: inode #15: comm syz.4.435: iget: bad i_size value: 38620345925642 [ 52.313323][ T4601] EXT4-fs error (device loop4): ext4_orphan_get:1396: comm syz.4.435: couldn't read orphan inode 15 (err -117) [ 52.336865][ T4601] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 52.392855][ C0] vcan0: j1939_tp_rxtimer: 0xffff88811adda400: abort rx timeout. Force session deactivation [ 52.412255][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.672572][ T4606] loop4: detected capacity change from 0 to 8192 [ 52.972514][ T4614] syzkaller0: entered promiscuous mode [ 52.978051][ T4614] syzkaller0: entered allmulticast mode [ 53.045567][ T4622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.439'. [ 53.065646][ T4622] netlink: 236 bytes leftover after parsing attributes in process `syz.2.439'. [ 53.488092][ T4647] loop1: detected capacity change from 0 to 128 [ 53.547336][ T4647] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 53.563375][ T4647] ext4 filesystem being mounted at /83/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 53.673598][ T3314] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 56.064797][ T4679] netlink: 24 bytes leftover after parsing attributes in process `syz.0.463'. [ 56.241126][ T41] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.263302][ T4697] loop4: detected capacity change from 0 to 1024 [ 56.274713][ T4697] EXT4-fs: Ignoring removed orlov option [ 56.291396][ T4697] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 56.303850][ T4667] chnl_net:caif_netlink_parms(): no params data found [ 56.313735][ T4697] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.327870][ T4699] netlink: 12 bytes leftover after parsing attributes in process `syz.2.470'. [ 56.357119][ T41] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.398467][ T4667] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.405603][ T4667] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.430734][ T4667] bridge_slave_0: entered allmulticast mode [ 56.437984][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.447518][ T4667] bridge_slave_0: entered promiscuous mode [ 56.465632][ T41] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.488222][ T4667] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.495356][ T4667] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.502569][ T4667] bridge_slave_1: entered allmulticast mode [ 56.509600][ T4667] bridge_slave_1: entered promiscuous mode [ 56.539873][ T41] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.556166][ T4667] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.567020][ T4667] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.579200][ T29] kauditd_printk_skb: 132 callbacks suppressed [ 56.579215][ T29] audit: type=1400 audit(1764872680.104:1661): avc: denied { create } for pid=4710 comm="syz.2.473" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 56.607834][ T29] audit: type=1400 audit(1764872680.134:1662): avc: denied { ioctl } for pid=4710 comm="syz.2.473" path="socket:[10544]" dev="sockfs" ino=10544 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 56.644942][ T4667] team0: Port device team_slave_0 added [ 56.657338][ T4667] team0: Port device team_slave_1 added [ 56.692399][ T4667] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.699480][ T4667] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.725696][ T4667] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.746132][ T41] bridge_slave_1: left allmulticast mode [ 56.751914][ T41] bridge_slave_1: left promiscuous mode [ 56.757640][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.793490][ T41] bridge_slave_0: left allmulticast mode [ 56.799192][ T41] bridge_slave_0: left promiscuous mode [ 56.805086][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.832490][ T4720] loop1: detected capacity change from 0 to 512 [ 56.987418][ T41] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 57.000481][ T4726] sctp: [Deprecated]: syz.0.480 (pid 4726) Use of struct sctp_assoc_value in delayed_ack socket option. [ 57.000481][ T4726] Use struct sctp_sack_info instead [ 57.034221][ T41] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 57.056387][ T41] bond0 (unregistering): Released all slaves [ 57.075277][ T4715] tipc: Enabling of bearer rejected, failed to enable media [ 57.090452][ T4667] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 57.097475][ T4667] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 57.123889][ T4667] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 57.166835][ T4733] netlink: 'syz.2.482': attribute type 7 has an invalid length. [ 57.174521][ T4733] netlink: 8 bytes leftover after parsing attributes in process `syz.2.482'. [ 57.215357][ T4667] hsr_slave_0: entered promiscuous mode [ 57.239979][ T4667] hsr_slave_1: entered promiscuous mode [ 57.252091][ T4667] debugfs: 'hsr0' already exists in 'hsr' [ 57.257879][ T4667] Cannot create hsr debugfs directory [ 57.280448][ T41] hsr_slave_0: left promiscuous mode [ 57.281896][ T4738] netlink: 176 bytes leftover after parsing attributes in process `syz.4.485'. [ 57.295328][ T41] hsr_slave_1: left promiscuous mode [ 57.301724][ T41] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 57.309305][ T41] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 57.322144][ T41] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 57.329583][ T41] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 57.369945][ T41] veth1_macvtap: left promiscuous mode [ 57.383063][ T29] audit: type=1326 audit(1764872680.894:1663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4749 comm="syz.1.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83d69bf749 code=0x7ffc0000 [ 57.406882][ T29] audit: type=1326 audit(1764872680.894:1664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4749 comm="syz.1.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83d69bf749 code=0x7ffc0000 [ 57.409016][ T41] veth0_macvtap: left promiscuous mode [ 57.430680][ T29] audit: type=1326 audit(1764872680.894:1665): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4749 comm="syz.1.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83d69bf749 code=0x7ffc0000 [ 57.448207][ T41] veth1_vlan: left promiscuous mode [ 57.459448][ T29] audit: type=1326 audit(1764872680.894:1666): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4749 comm="syz.1.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=210 compat=0 ip=0x7f83d69bf749 code=0x7ffc0000 [ 57.487944][ T29] audit: type=1326 audit(1764872680.894:1667): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4749 comm="syz.1.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83d69bf749 code=0x7ffc0000 [ 57.488056][ T41] veth0_vlan: left promiscuous mode [ 57.511387][ T29] audit: type=1326 audit(1764872680.894:1668): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4749 comm="syz.1.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83d69bf749 code=0x7ffc0000 [ 57.539948][ T29] audit: type=1326 audit(1764872680.894:1669): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4749 comm="syz.1.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83d69bf749 code=0x7ffc0000 [ 57.563269][ T29] audit: type=1326 audit(1764872680.894:1670): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4749 comm="syz.1.489" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83d69bf749 code=0x7ffc0000 [ 57.591804][ T4753] netlink: 4 bytes leftover after parsing attributes in process `syz.0.491'. [ 57.679575][ T4761] loop1: detected capacity change from 0 to 128 [ 57.686405][ T41] team0 (unregistering): Port device team_slave_1 removed [ 57.706122][ T4761] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 57.720404][ T41] team0 (unregistering): Port device team_slave_0 removed [ 57.743248][ T4761] ext4 filesystem being mounted at /93/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 57.756290][ T4767] netlink: 4 bytes leftover after parsing attributes in process `syz.2.496'. [ 57.767140][ T4768] kernel profiling enabled (shift: 63) [ 57.772614][ T4768] profiling shift: 63 too large [ 57.797396][ T4767] team1: entered promiscuous mode [ 57.802558][ T4767] team1: entered allmulticast mode [ 57.808221][ T4767] 8021q: adding VLAN 0 to HW filter on device team1 [ 57.832573][ T3314] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 58.004084][ T4667] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 58.051187][ T4667] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 58.130565][ T4667] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 58.157378][ T4667] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 58.255406][ T4667] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.269968][ T4667] 8021q: adding VLAN 0 to HW filter on device team0 [ 58.279816][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.286933][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.324423][ T4827] netlink: 4 bytes leftover after parsing attributes in process `syz.0.511'. [ 58.333728][ T4827] netlink: 12 bytes leftover after parsing attributes in process `syz.0.511'. [ 58.389168][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.396780][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.431276][ T4667] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 58.454368][ T4831] sch_tbf: burst 6 is lower than device ip6gre0 mtu (1448) ! [ 58.508798][ T4667] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 58.563063][ T4843] loop4: detected capacity change from 0 to 512 [ 58.569793][ T4843] journal_path: Non-blockdev passed as './file1' [ 58.576295][ T4843] EXT4-fs: error: could not find journal device path [ 58.773615][ T4667] veth0_vlan: entered promiscuous mode [ 58.801606][ T4667] veth1_vlan: entered promiscuous mode [ 58.835606][ T4667] veth0_macvtap: entered promiscuous mode [ 58.860008][ T4667] veth1_macvtap: entered promiscuous mode [ 58.900565][ T4667] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 58.913489][ T4891] loop4: detected capacity change from 0 to 1024 [ 58.927901][ T4667] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 58.946655][ T4891] EXT4-fs: Ignoring removed bh option [ 58.957211][ T31] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.984397][ T31] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.987516][ T4891] EXT4-fs: inline encryption not supported [ 59.001407][ T31] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.030830][ T31] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.040731][ T4891] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 59.061783][ T4891] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 59.071248][ T4891] EXT4-fs error (device loop4): ext4_map_blocks:783: inode #3: block 2: comm syz.4.526: lblock 2 mapped to illegal pblock 2 (length 1) [ 59.089268][ T4891] EXT4-fs error (device loop4): ext4_map_blocks:783: inode #3: block 48: comm syz.4.526: lblock 0 mapped to illegal pblock 48 (length 1) [ 59.186034][ T4891] EXT4-fs error (device loop4): ext4_acquire_dquot:6986: comm syz.4.526: Failed to acquire dquot type 0 [ 59.212036][ T4891] EXT4-fs error (device loop4) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 59.221923][ T4891] EXT4-fs error (device loop4): ext4_evict_inode:253: inode #11: comm syz.4.526: mark_inode_dirty error [ 59.233941][ T4891] EXT4-fs warning (device loop4): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 59.244470][ T4891] EXT4-fs (loop4): 1 orphan inode deleted [ 59.268633][ T4891] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 59.282147][ T41] EXT4-fs error (device loop4): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 59.309975][ T41] EXT4-fs error (device loop4): ext4_release_dquot:7022: comm kworker/u8:2: Failed to release dquot type 0 [ 59.331796][ T4912] netlink: 'syz.1.527': attribute type 10 has an invalid length. [ 59.354134][ T4891] EXT4-fs error (device loop4): ext4_map_blocks:783: inode #3: block 48: comm syz.4.526: lblock 0 mapped to illegal pblock 48 (length 1) [ 59.385048][ T4918] netlink: 'syz.1.527': attribute type 10 has an invalid length. [ 59.409683][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.429042][ T4912] bond0: (slave dummy0): Releasing backup interface [ 59.447502][ T4912] team0: Device dummy0 is already a lower device of the team interface [ 59.465674][ T4918] team0: Failed to send port change of device vlan2 via netlink (err -105) [ 59.504323][ T4918] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 59.513374][ T4929] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 59.549230][ T4918] syz.1.527 (4918) used greatest stack depth: 10000 bytes left [ 59.617787][ T4935] loop1: detected capacity change from 0 to 512 [ 59.658091][ T4935] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 59.686095][ T4935] EXT4-fs (loop1): orphan cleanup on readonly fs [ 59.713826][ T4935] EXT4-fs warning (device loop1): ext4_enable_quotas:7221: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 59.790205][ T4935] EXT4-fs (loop1): Cannot turn on quotas: error -117 [ 59.800327][ T4935] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.530: bg 0: block 40: padding at end of block bitmap is not set [ 59.834728][ T4935] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6689: Corrupt filesystem [ 59.848747][ T4935] EXT4-fs (loop1): 1 truncate cleaned up [ 59.855269][ T4935] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 59.914954][ T3314] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.971373][ T4951] xt_CT: You must specify a L4 protocol and not use inversions on it [ 60.181511][ T4967] netlink: 'syz.5.540': attribute type 83 has an invalid length. [ 60.191836][ T4965] netlink: 300 bytes leftover after parsing attributes in process `syz.2.551'. [ 60.288255][ T4974] netlink: 4 bytes leftover after parsing attributes in process `syz.2.542'. [ 60.313457][ T4974] netlink: 12 bytes leftover after parsing attributes in process `syz.2.542'. [ 60.735590][ T5001] loop4: detected capacity change from 0 to 512 [ 60.796327][ T5001] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 60.809180][ T5001] ext4 filesystem being mounted at /114/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 60.894225][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 61.122277][ T5015] netlink: 12 bytes leftover after parsing attributes in process `syz.2.557'. [ 61.302281][ T5021] tipc: Enabling of bearer rejected, failed to enable media [ 61.344785][ T5026] loop4: detected capacity change from 0 to 256 [ 61.551491][ T5042] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 61.610811][ T29] kauditd_printk_skb: 177 callbacks suppressed [ 61.610827][ T29] audit: type=1400 audit(1764872685.134:1843): avc: denied { ioctl } for pid=5040 comm="syz.0.571" path="socket:[11600]" dev="sockfs" ino=11600 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 61.693007][ T29] audit: type=1326 audit(1764872685.154:1844): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5047 comm="syz.2.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 61.716606][ T29] audit: type=1326 audit(1764872685.154:1845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5047 comm="syz.2.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 61.739964][ T29] audit: type=1326 audit(1764872685.154:1846): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5047 comm="syz.2.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 61.763690][ T29] audit: type=1326 audit(1764872685.154:1847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5047 comm="syz.2.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 61.787227][ T29] audit: type=1326 audit(1764872685.154:1848): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5047 comm="syz.2.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 61.810685][ T29] audit: type=1326 audit(1764872685.154:1849): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5047 comm="syz.2.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 61.834475][ T29] audit: type=1326 audit(1764872685.154:1850): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5047 comm="syz.2.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 61.857846][ T29] audit: type=1326 audit(1764872685.154:1851): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5047 comm="syz.2.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 61.881563][ T29] audit: type=1326 audit(1764872685.154:1852): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5047 comm="syz.2.574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6e18f749 code=0x7ffc0000 [ 61.963906][ T5056] netlink: 'syz.0.577': attribute type 14 has an invalid length. [ 61.971661][ T5056] netem: change failed [ 62.285850][ T5072] random: crng reseeded on system resumption [ 62.650018][ T5079] process 'syz.4.584' launched './file0' with NULL argv: empty string added [ 62.768876][ T5067] netlink: 7 bytes leftover after parsing attributes in process `syz.2.581'. [ 62.933168][ T5089] netlink: 14 bytes leftover after parsing attributes in process `syz.4.589'. [ 62.983015][ T5089] hsr_slave_0: left promiscuous mode [ 62.993293][ T5089] hsr_slave_1: left promiscuous mode [ 63.512186][ T5110] 8021q: adding VLAN 0 to HW filter on device bond1 [ 63.673916][ T5121] lo: left promiscuous mode [ 63.696599][ T5121] gretap0: left promiscuous mode [ 63.701743][ T5121] gretap0: left allmulticast mode [ 63.742483][ T5121] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.749742][ T5121] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.787129][ T5124] random: crng reseeded on system resumption [ 63.845309][ T5121] veth1: left promiscuous mode [ 63.850174][ T5121] veth1: left allmulticast mode [ 63.886827][ T5126] netlink: 12 bytes leftover after parsing attributes in process `syz.2.604'. [ 63.895853][ T5126] netlink: 16 bytes leftover after parsing attributes in process `syz.2.604'. [ 63.896080][ T5121] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 63.927014][ T5121] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 63.986194][ T41] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.996221][ T41] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.019565][ T5132] netlink: 12 bytes leftover after parsing attributes in process `syz.2.607'. [ 64.027625][ T5128] loop0: detected capacity change from 0 to 2048 [ 64.042101][ T41] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.067663][ T41] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.087380][ T5128] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 64.119964][ T5139] netlink: 8 bytes leftover after parsing attributes in process `syz.1.609'. [ 64.353608][ T3312] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 65.309774][ T5192] loop1: detected capacity change from 0 to 512 [ 65.317623][ T5193] loop4: detected capacity change from 0 to 164 [ 65.335936][ T5193] netlink: 'syz.4.627': attribute type 29 has an invalid length. [ 65.373832][ T5192] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 65.379339][ T5190] netlink: 'syz.4.627': attribute type 29 has an invalid length. [ 65.413570][ T5192] ext4 filesystem being mounted at /117/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 65.429098][ T5190] netlink: 'syz.4.627': attribute type 29 has an invalid length. [ 65.475741][ T5192] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 65.567039][ T3314] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 65.685139][ T5215] loop4: detected capacity change from 0 to 164 [ 65.692384][ T5215] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 65.917109][ T5230] netlink: 12 bytes leftover after parsing attributes in process `syz.1.639'. [ 66.542198][ T5258] netlink: 4 bytes leftover after parsing attributes in process `syz.1.649'. [ 66.571168][ T5258] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 66.839739][ T29] kauditd_printk_skb: 194 callbacks suppressed [ 66.839754][ T29] audit: type=1400 audit(1764872690.364:2047): avc: denied { setopt } for pid=5269 comm="syz.5.653" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 66.880630][ T5270] batman_adv: batadv0: Adding interface: dummy0 [ 66.887029][ T5270] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.918787][ T5270] batman_adv: batadv0: Interface activated: dummy0 [ 66.929149][ T5270] batadv0: mtu less than device minimum [ 66.935297][ T5270] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.946475][ T5270] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.957379][ T5270] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.968511][ T5270] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.979483][ T5270] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 66.990431][ T5270] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 67.001556][ T5270] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 67.012490][ T5270] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 67.023458][ T5270] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 67.701327][ T5280] netlink: 12 bytes leftover after parsing attributes in process `syz.4.656'. [ 67.759368][ T5282] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.854522][ T5282] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.924744][ T5282] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.974753][ T5282] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.070652][ T5292] netlink: 'syz.5.661': attribute type 1 has an invalid length. [ 68.083322][ T5294] loop1: detected capacity change from 0 to 512 [ 68.105088][ T971] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.115203][ T5292] veth1_to_hsr: entered promiscuous mode [ 68.120872][ T5292] veth1_to_hsr: entered allmulticast mode [ 68.133601][ T5294] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 68.146413][ T5294] ext4 filesystem being mounted at /127/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 68.160592][ T5294] EXT4-fs error (device loop1): ext4_do_update_inode:5617: inode #2: comm syz.1.662: corrupted inode contents [ 68.164334][ T63] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.180915][ T5294] EXT4-fs error (device loop1): ext4_dirty_inode:6502: inode #2: comm syz.1.662: mark_inode_dirty error [ 68.203206][ T5294] EXT4-fs error (device loop1): ext4_do_update_inode:5617: inode #2: comm syz.1.662: corrupted inode contents [ 68.216120][ T63] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.230358][ T5294] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.662: mark_inode_dirty error [ 68.241542][ T63] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.340335][ T3314] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.695843][ T5321] netlink: 12 bytes leftover after parsing attributes in process `syz.4.673'. [ 68.786372][ T29] audit: type=1326 audit(1764872692.314:2048): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5329 comm="syz.4.676" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 68.844282][ T5332] netlink: 'syz.4.677': attribute type 1 has an invalid length. [ 68.862965][ T29] audit: type=1326 audit(1764872692.344:2049): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5329 comm="syz.4.676" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 68.886548][ T29] audit: type=1326 audit(1764872692.344:2050): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5329 comm="syz.4.676" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 68.910166][ T29] audit: type=1326 audit(1764872692.344:2051): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5329 comm="syz.4.676" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 68.933799][ T29] audit: type=1326 audit(1764872692.344:2052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5329 comm="syz.4.676" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 68.957728][ T29] audit: type=1326 audit(1764872692.344:2053): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5329 comm="syz.4.676" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 68.981496][ T29] audit: type=1326 audit(1764872692.344:2054): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5329 comm="syz.4.676" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 69.005152][ T29] audit: type=1326 audit(1764872692.344:2055): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5329 comm="syz.4.676" exe="/root/syz-executor" sig=0 arch=c000003e syscall=40 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 69.028587][ T29] audit: type=1326 audit(1764872692.344:2056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5329 comm="syz.4.676" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3d13af749 code=0x7ffc0000 [ 69.062299][ T5334] bond2: entered promiscuous mode [ 69.067847][ T5334] bond2: entered allmulticast mode [ 69.073640][ T5334] 8021q: adding VLAN 0 to HW filter on device bond2 [ 69.096808][ T5341] veth5: entered promiscuous mode [ 69.102001][ T5341] veth5: entered allmulticast mode [ 69.108485][ T5341] bond2: (slave veth5): Enslaving as a backup interface with a down link [ 69.177970][ T5345] loop4: detected capacity change from 0 to 512 [ 69.195317][ T5268] ================================================================== [ 69.203512][ T5268] BUG: KCSAN: data-race in fifo_open / wait_for_partner [ 69.210479][ T5268] [ 69.212796][ T5268] read-write to 0xffff88811b7b9aec of 4 bytes by task 5263 on cpu 1: [ 69.220854][ T5268] fifo_open+0x86/0x5d0 [ 69.225017][ T5268] do_dentry_open+0x54b/0xa60 [ 69.229685][ T5268] vfs_open+0x37/0x1e0 [ 69.233747][ T5268] path_openat+0x1ddd/0x23b0 [ 69.238330][ T5268] do_file_open_root+0x1d0/0x400 [ 69.243262][ T5268] file_open_root+0xfd/0x130 [ 69.247845][ T5268] do_handle_open+0x630/0x710 [ 69.252518][ T5268] __x64_sys_open_by_handle_at+0x44/0x50 [ 69.258232][ T5268] x64_sys_call+0x2b6a/0x3000 [ 69.262899][ T5268] do_syscall_64+0xd8/0x2a0 [ 69.267409][ T5268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.273300][ T5268] [ 69.275608][ T5268] read to 0xffff88811b7b9aec of 4 bytes by task 5268 on cpu 0: [ 69.283144][ T5268] wait_for_partner+0xb5/0x1c0 [ 69.287919][ T5268] fifo_open+0x462/0x5d0 [ 69.292159][ T5268] do_dentry_open+0x54b/0xa60 [ 69.296824][ T5268] vfs_open+0x37/0x1e0 [ 69.300881][ T5268] path_openat+0x1ddd/0x23b0 [ 69.305466][ T5268] do_filp_open+0x109/0x230 [ 69.310047][ T5268] do_sys_openat2+0xa6/0x150 [ 69.314642][ T5268] __x64_sys_openat+0xf2/0x120 [ 69.319422][ T5268] x64_sys_call+0x2b07/0x3000 [ 69.324126][ T5268] do_syscall_64+0xd8/0x2a0 [ 69.328625][ T5268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.334510][ T5268] [ 69.336814][ T5268] value changed: 0x00000001 -> 0x00000002 [ 69.342563][ T5268] [ 69.344870][ T5268] Reported by Kernel Concurrency Sanitizer on: [ 69.351090][ T5268] CPU: 0 UID: 0 PID: 5268 Comm: syz.0.651 Not tainted syzkaller #0 PREEMPT(voluntary) [ 69.360712][ T5268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 69.370848][ T5268] ================================================================== [ 69.458127][ T5345] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 69.516647][ T5345] ext4 filesystem being mounted at /151/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 69.657569][ T5345] EXT4-fs error (device loop4): ext4_do_update_inode:5617: inode #2: comm syz.4.680: corrupted inode contents [ 69.687737][ T5345] EXT4-fs error (device loop4): ext4_dirty_inode:6502: inode #2: comm syz.4.680: mark_inode_dirty error [ 69.703158][ T5345] EXT4-fs error (device loop4): ext4_do_update_inode:5617: inode #2: comm syz.4.680: corrupted inode contents [ 69.735650][ T5345] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #2: comm syz.4.680: mark_inode_dirty error [ 69.766185][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.