last executing test programs: 1.751879822s ago: executing program 4 (id=5): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async, rerun: 64) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000020000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) (rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'tunl0\x00', 0x0}) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x24, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\a\x00\x00\x00'], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="09000000070000000080000001"], 0x48) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/20, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r3, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000280)=r4}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xd, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000020d0039000000000000b4a518110000", @ANYRES32=r5], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async, rerun: 64) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001300)={&(0x7f0000000c00)='net_dev_start_xmit\x00', r6}, 0x10) (async) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001240)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d19f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981179186e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2a434b9048ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d6356e4450d043ed20d313cd56a56d2e4cdf26f19af9a41695a58a9b6b45af1ca939b18d7b57791b99cfc6ec2a0848c29fea4eb8b82395a38e8aca5ab4bfc2ad8acf2e51b766f8ecd16194ad41ec097082f7fa32179ef99dafa6c2aa206a25ddc33e6f0a09169eeff428c71f54e1dfcfcd7cfc8f6e169f11c47d504"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000300)={0x0, 0x8000}, 0x4) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x18000000000002a0, 0xe40, 0x0, &(0x7f0000000140)="b9ff03076804268cb89e14f088a847e0ffff2000000000000000ac141416e0885a049a179424", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r9, 0x107, 0x12, &(0x7f0000001780)={0x0, 0x9005}, 0x4) syz_emit_ethernet(0x66, &(0x7f0000000440)={@multicast, @random="fd137b07daa7", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "02adf7", 0x30, 0x3a, 0x0, @ipv4={'\x00', '\xff\xff', @private}, @mcast2, {[], @time_exceed={0x3, 0x1, 0x0, 0x0, '\x00', {0x0, 0x6, "fd9063", 0x0, 0x2f, 0x0, @mcast1, @loopback={0x0, 0xffffac1414aa}}}}}}}}, 0x0) (async) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) (async) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0, 0xffffffffffffffff) (async) sendmsg$NLBL_UNLABEL_C_STATICLIST(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000040}, 0x40) (async, rerun: 64) r10 = socket$netlink(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x6, 0x0, 0x0, 0xffffff81}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x40}}, 0x0) 1.430490118s ago: executing program 4 (id=6): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000300)='./file0\x00', 0x80079c, &(0x7f0000000500), 0xff, 0x485, &(0x7f0000001500)="$eJzs3M9rHFUcAPDvTJL+bhNrrba2Gq1i8UfSpFV78KCi4EFB0EM9xiSttdtGmgi2BI0i9SgF7+JR8C/w5kXUgwheFTxKoWgQmnqKzK9mu9mkSZpkbfbzgc2+t/Nm3/vOzNt9My+zAbSt3uxPErEjIn6LiO4ie3OB3uJpZnpy+Pr05HASs7Nv/JXk5a5NTw5XRav1tpeZw2lE+mkSzyfz6x2/cPHMUK02er7M90+cfa9//MLFp06fHTo1emr03ODx48eODjz7zODTqxJnFte1/R+OHdj3yluXXxs+cfntH7/JmrX3YLG8Po5but4koCZ6s63292yucdmjy2j7nWBnXTrpbGFDWJaOiMh2V1fe/7ujI+Z2Xne8/ElLGwesqey7afPCi6dmgQ0siVa3AGiN6os+O/+tHus09PhfuPpCxKYyPTM9OTxzI/7OSMvXu9aw/t6IODH175fZI5Z7HQIAYAXysc2TzcZ/aezNn4u5jl3lHEpPRNwVEbsj4u6I2BMR90TkZe+NiPuKlWe7l1h/b0N+/vgnvdK0zaskG/89Vzf2m6mLv3zq6ShzO/P4u5KTp2ujR8ptcji6Nmf5gUXq+O6lXz9faFn9+C97ZPVXY8GyAVc6Gy7QjQxNDK3WRrj6ccT+zmbxJzdmArIjYF9E7F/eW++qEqcf//rAQoVuHf8iVmGeafariMeK/T8VDfFXksXnJ/u3RG30SH91VMz30y+XXl+o/tuKfxVk+3/bzcd/Q4nuf5JivrYrarXR8+PLr+PS758teE6z0uN/U/JmPmf98zvFax8MTUycH4jYlLya56tzuvz1wbl1q3xVPov/8KHm/X93uU4W//0RkR3EByPigYh4sGz7QxHxcEQcWiT+H1585N1F4k8iiZbu/5Gmn383jv+epH6+fgWJjjPff7vQjPnS9v+xmMo/awv5598tLLWBt7n5AAAA4I6QRsSOSNK+It27I9K0r6/4H/49sS2tjY1PPHFy7P1zI8U9Aj3RlVZXurrrrocOJFPlOxb5wfJacbX8aHnd+IuOrXm+b3isNtLi2KHdbb+5/0fV/zN/drS6dcCac78WtK/G/p+2qB3A+lvK979zAdiYmvT/ra1oB7D+nP9D+2rW/z9qyBv/w8Y0v///0eQn64CNyPgf2pf+D+1L/4e2dDv39a88Ud0ssPL32bLkO/zbJVH94sVa1rU15l6JtOUht1Ei6zHrW+ncb6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADcyf4LAAD///ss5ts=") mkdir(&(0x7f0000000100)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, 0x0, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000497ffffff3693c4d743ad5fc3d60200000a"], 0x28}, 0x1, 0x0, 0x0, 0x50}, 0x4) syz_mount_image$fuse(0x0, &(0x7f0000001040)='./file2\x00', 0x2000, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c250000000000202020"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, @void, @value}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_INPUT(r4, 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0) nanosleep(&(0x7f0000000000)={0x77359400}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) 1.381957788s ago: executing program 0 (id=1): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xb) fcntl$lock(r0, 0x25, &(0x7f0000000000)={0x1}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r2, 0x26, &(0x7f0000000380)={0x0, 0x1, 0x0, 0x1}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001480), 0x42002, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x20000023896) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) r5 = socket(0x10, 0x3, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f00000003c0)={{0x8, @remote, 0x4e23, 0x4, 'lblc\x00', 0x8, 0x2, 0x18}, {@loopback, 0x4e22, 0x7, 0x1, 0x2, 0x2}}, 0x44) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r7) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r8, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newtfilter={0x74, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x44, 0x2, [@TCA_BASIC_EMATCHES={0x40, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x34, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x20, 0x2, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{}, {0x5}}}, @TCA_EM_META_LVALUE={0x8, 0x2, [@TCF_META_TYPE_INT=0x5]}]}}]}]}]}}]}, 0x74}}, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r9, 0x7, &(0x7f0000000140)={0x1, 0x2, 0x78, 0x10}) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) r10 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/locks\x00', 0x0, 0x0) pread64(r10, &(0x7f0000000180)=""/73, 0x49, 0x0) 1.368569719s ago: executing program 1 (id=2): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x5) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000001700)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file2\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x16, 0x0, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f0000000280)=@framed={{}, [@printk={@llx, {}, {0x7, 0x1, 0xb, 0x1, 0xa, 0x0, 0x14}, {}, {}, {}, {0x85, 0x0, 0x0, 0x2d}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc0ed000e, &(0x7f00000007c0)={[{@jqfmt_vfsold}, {@data_err_abort}, {@nobarrier}, {@noload}, {@mblk_io_submit}, {@commit={'commit', 0x3d, 0x3}}, {@minixdf}, {@debug}]}, 0xfe, 0x46d, &(0x7f0000000f00)="$eJzs3M1vFOUfAPDvTF94+/FrRXwBQapoJL60tLzIwYtGEw6amOgB46m2hVQKNbQmQohWD3g0JN6N/4XxpBejXjTxqndDQgwXUC9rZmemLMtu2aXbLnQ/n2S6zzPzdJ/nOzPP7jPz7G4APWsk+5NE/C8ifo+IoTx7a4GR/OHGtYtTf1+7OJVEpfLWX0m13PVrF6fKouX/bcszlUqR39Sg3kvvRkzOzc2cK/Jji2c+GFs4f+GF2TOTp2ZOzZydOHbs8KG9g0cnjnQkziyu67s/nt+z6/g7l9+YOnH5vZ+S/sjjjro4OmUk37sNPd3pyrpse026umOX7fvlZrrRmUA39UVEdrgGqv1/KPpiy/K2oXjts642DlhTlUqlssKr8lIF2MCS6HYLgO4o3+iz699yWaehxz3h6sv5BVAW941iybf0R5on9g3UXd920khEnFj656tsiTW6DwEAUOu7bPzzfKPxXxoP54nB7M//izmU4Yh4ICJ2RMSDEbEzIh6KqJZ9JCIebbP++hmS28c/6ZW7Dq4F2fjvpWJu69bxX1oWGe4rctur8Q8kJ2fnZg4W++RADGw6OZvMjK9Qx/ev/vZFs221479syeovx4JFO670192gm55cnFxNzLWufhqxu79R/EmU0zhJROyKiN13Wcfss/1Nt905/hU0f9qWVb6OeCY//ktRF38paTo/Of7i0YkjY5tjbubgWHlW3O7nXy+92az+VcXfAdnx39rw/F+OfzjZHLFw/sLp6nztQvt1XPrj86bXNG2e/8e3F+f/YPJ2dcVgseGjycXFc+MRg8nrt6+fuPlsZb4sn8V/YH/j/r8jbu6JxyJiT0TsjYjHs4vCou1PRMSTEbF/hfh/fOWp99uPf33mSrP4p+90/KP2+Lef6Dv9w7d3jn9zRDQ7/oerqQPFmlZe/1pt4Gr2HQAAANwv0upn4JN0dDmdpqOj+Wf4d8bWdG5+YfG5k/Mfnp3OPys/HANpeadrqOZ+6Hhxb7jMT9TlDxX3jb/s21LNj07Nz013O3jocdua9P/Mn33dbh2w5jowjwbcp/R/6F36P/SmRP+Hnqb/Q+9q1P8/aVp69Js1bQywrrz/Q+9qof8v5Q/NRwXA/cn7P/Qu/R96UtPvxqer+sr/uif+LX7P8F5pz8ZPRHpPNGPjJ/pb/jGLNhKVobz/Z2s2NSzT7VcmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAzvgvAAD//w3J5b0=") setrlimit(0x5, &(0x7f0000000040)={0xf7, 0xd4}) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000000180)={0x3, 0x400, 0x84b}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00'}, 0x10) request_key(&(0x7f0000000540)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0) syz_read_part_table(0x635, &(0x7f0000000000)="$eJzs3D9oXeUbB/DvSe899yaFtr8fTl1SncViZ28NSHqpdKp061IVJFQc4lSx5Ea6mCGDg7NLEbLUumjo4KAt4iROoYNacRWkqNQiPXLuOfdPBEFsOwifz5Dzvs953vd5n5yTMSf8py2kmxTjYS+dJMdf/kvGZiYJ6df5Sapue+/czuqp01VVVUWdcz7dPPn5oetJOu2S/nSbqqo2ppOTufrB0o13i1F353Zd9ObWgTq82BzjSPL0wbI/3mZuh1TVvoP1HuXvgX/n2uBWUVwp29lTvzxYST76efXs7pmt966/2IY3ki+T+vm/U78Xk+y3cvHYhc54WD/lN+f3/bW5lLPI7HEvprPvDKMr68PtlcHa3iRwdLjz6WvP/X7sRqoT+arsLExuFLP9ymT08O3X/R+u3/7tS4O1veHlxemNJ97//xdZbid3qypH6pL/y/hPZ/kRVAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4HG4NriVZDTcTtb2hr02unp298xWmeSFV/tt6Pj8qgPt9WIu3KmvG1lPfvgk3fmkov4xjiyku9LEvl+unhkPOpP6vcVmcGmwtje8v5TcefbB0WGzKjc/OzErtzHdeTfPt6N7VWM82fy7JtsS1eEm7+v78/0XnWR9uD2uf/nHotM0/HExmh5zIcnrvbzSNFPdK9u1f8zaAAAAAAAAAAAAAAAAAAAAgIeyeur0G3fb8fl+kp/eXqjHVa/5L/diqdiX/20vWTyZXO2nGK0kuf3Sb+U3h7a+az8dMEovoyQHP9w81y4p920w/URAkap8nJ3xT/wZAAD//8Wbezo=") ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) r6 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000680)='cgroup.procs\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r6, &(0x7f00000006c0)={0x10}) 1.363680158s ago: executing program 3 (id=4): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f000000d379)={&(0x7f0000000380)=ANY=[@ANYBLOB="18000000140009060000000000bf00"/24], 0x18}}, 0x8040) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000280), 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x41, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0xff2e) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0xfffffffd, 0x90, 0xc, "00bf46f8bbde7047bcd4a280000400"}) r6 = syz_open_pts(r5, 0x0) r7 = dup3(r6, r5, 0x0) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000000)=0x17) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r8}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16=r10, @ANYBLOB="796100000000090000007e000000d1dfbf3f19b3045f8fa207f99e382228fc372441ef61b8002bb9"], 0x14}}, 0x4000054) 0s ago: executing program 4 (id=7): prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffe000/0x1000)=nil) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000240)=[{0xf793, 0xf, 0x2f, 0x7}, {0x4, 0x4, 0x99, 0xf}]}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'tunl0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x6, &(0x7f0000000080)=0xfc2) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4a21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x83, 0x0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0xc) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000080)={0x7, 0x3, 0x8, 0x5, 0xfffffffe}) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES16=r6, @ANYRESHEX=r6], &(0x7f0000000140)='syzkaller\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x74, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r7, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r8}, 0x10) r9 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x2c41, 0x20) flock(r9, 0x5) r10 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) flock(r10, 0x1) flock(r10, 0x2) dup3(r10, r9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1d, 0xb, &(0x7f00000004c0)=ANY=[@ANYRES32=0x0, @ANYRES16=r0, @ANYRES16=r1, @ANYRES64, @ANYRES32=r1, @ANYRES32=r2, @ANYRES16=0x0], &(0x7f0000000200)='GPL\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x800000, @void, @value}, 0x94) socket$inet(0x2, 0x4000000000000001, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.19' (ED25519) to the list of known hosts. [ 20.160305][ T24] audit: type=1400 audit(1750463424.240:64): avc: denied { mounton } for pid=267 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.161394][ T267] cgroup: Unknown subsys name 'net' [ 20.185283][ T24] audit: type=1400 audit(1750463424.240:65): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.214736][ T24] audit: type=1400 audit(1750463424.280:66): avc: denied { unmount } for pid=267 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.214936][ T267] cgroup: Unknown subsys name 'devices' [ 20.362554][ T267] cgroup: Unknown subsys name 'hugetlb' [ 20.368608][ T267] cgroup: Unknown subsys name 'rlimit' [ 20.506144][ T24] audit: type=1400 audit(1750463424.590:67): avc: denied { setattr } for pid=267 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.519662][ T269] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 20.529920][ T24] audit: type=1400 audit(1750463424.590:68): avc: denied { mounton } for pid=267 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.564452][ T24] audit: type=1400 audit(1750463424.590:69): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 20.589520][ T24] audit: type=1400 audit(1750463424.630:70): avc: denied { relabelto } for pid=269 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.589551][ T267] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 20.615144][ T24] audit: type=1400 audit(1750463424.630:71): avc: denied { write } for pid=269 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.650573][ T24] audit: type=1400 audit(1750463424.660:72): avc: denied { read } for pid=267 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.676740][ T24] audit: type=1400 audit(1750463424.660:73): avc: denied { open } for pid=267 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.632331][ T276] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.639625][ T276] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.647679][ T276] device bridge_slave_0 entered promiscuous mode [ 21.657121][ T276] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.664448][ T276] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.673611][ T276] device bridge_slave_1 entered promiscuous mode [ 21.682485][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.690429][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.698713][ T279] device bridge_slave_0 entered promiscuous mode [ 21.709772][ T275] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.717331][ T275] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.725033][ T275] device bridge_slave_0 entered promiscuous mode [ 21.734513][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.741841][ T275] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.749645][ T275] device bridge_slave_1 entered promiscuous mode [ 21.757521][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.765200][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.773256][ T279] device bridge_slave_1 entered promiscuous mode [ 21.813417][ T278] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.821276][ T278] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.828770][ T278] device bridge_slave_0 entered promiscuous mode [ 21.838563][ T278] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.845868][ T278] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.853524][ T278] device bridge_slave_1 entered promiscuous mode [ 21.921244][ T277] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.928409][ T277] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.935869][ T277] device bridge_slave_0 entered promiscuous mode [ 21.945307][ T277] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.953081][ T277] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.960646][ T277] device bridge_slave_1 entered promiscuous mode [ 22.003688][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.010776][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.018587][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.025968][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.051570][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.058896][ T275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.066663][ T275] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.074158][ T275] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.133285][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.142577][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.150413][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.159243][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.167344][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.175102][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.201804][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.210542][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.219648][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.229355][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.237917][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.245005][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.270530][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.278741][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.291904][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.300537][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.307781][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.321361][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.328984][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.337434][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.344680][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.358841][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.367270][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.376254][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.383532][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.391351][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.399768][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.406929][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.414914][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.424034][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.452279][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.461735][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.471424][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.479005][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.487476][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.496048][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.503464][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.511291][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.519582][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.526675][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.534378][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.542718][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.551252][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.559472][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.567879][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.588683][ T279] device veth0_vlan entered promiscuous mode [ 22.595588][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.603961][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.612475][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.620242][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.629063][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.643700][ T275] device veth0_vlan entered promiscuous mode [ 22.650991][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.659416][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.668582][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.677406][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.686577][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.696416][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.706372][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.714284][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.730293][ T277] device veth0_vlan entered promiscuous mode [ 22.740356][ T279] device veth1_macvtap entered promiscuous mode [ 22.749631][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.758478][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.768139][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.776478][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.786256][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.794679][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.802859][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.811405][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.819491][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.833954][ T276] device veth0_vlan entered promiscuous mode [ 22.848079][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.856669][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.866113][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.874896][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.883778][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.892620][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.901467][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.909884][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.918706][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.928026][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.937941][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.945744][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.955218][ T275] device veth1_macvtap entered promiscuous mode [ 22.963437][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.972416][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.981182][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.995216][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.003711][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.022214][ T279] request_module fs-gadgetfs succeeded, but still no fs? [ 23.024712][ T277] device veth1_macvtap entered promiscuous mode [ 23.039175][ T279] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 23.046817][ T278] device veth0_vlan entered promiscuous mode [ 23.057220][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.071922][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.091067][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.099680][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.109095][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.121242][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.140982][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.149728][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.157955][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.166266][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.174306][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.183362][ T276] device veth1_macvtap entered promiscuous mode [ 23.202590][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.221127][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.229500][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.254775][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.270228][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.279696][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.301154][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.309687][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.318360][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.331115][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.339704][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.354715][ T278] device veth1_macvtap entered promiscuous mode [ 23.365286][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.375028][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.384502][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.406164][ T305] EXT4-fs error (device loop4): ext4_orphan_get:1395: inode #15: comm syz.4.6: casefold flag without casefold feature [ 23.445948][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.461418][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.474205][ T305] EXT4-fs error (device loop4): ext4_orphan_get:1400: comm syz.4.6: couldn't read orphan inode 15 (err -117) [ 23.486879][ T305] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 23.507730][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.517345][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.682747][ T321] EXT4-fs (loop1): Ignoring removed mblk_io_submit option [ 24.690204][ T321] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 24.700309][ T321] EXT4-fs (loop1): can't mount with commit=3, fs mounted w/o journal [ 25.151521][ T331] Leaked POSIX lock on dev=0x0:0x21 ino=0x12 fl_owner=ffff88811d85d040 fl_flags=0x81 fl_type=0x1 fl_pid=309 [ 25.430725][ C1] sched: RT throttling activated [ 25.432788][ T332] ================================================================== [ 25.446386][ T332] BUG: KASAN: use-after-free in lock_get_status+0x206/0x960 [ 25.454012][ T332] Read of size 8 at addr ffff88810cb02020 by task syz.0.1/332 [ 25.462185][ T332] [ 25.464525][ T332] CPU: 0 PID: 332 Comm: syz.0.1 Not tainted 5.10.238-syzkaller-00282-gd76d4cd0623a #0 [ 25.475102][ T332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 25.486480][ T332] Call Trace: [ 25.490292][ T332] __dump_stack+0x21/0x24 [ 25.495020][ T332] dump_stack_lvl+0x169/0x1d8 [ 25.500134][ T332] ? show_regs_print_info+0x18/0x18 [ 25.505905][ T332] ? thaw_kernel_threads+0x220/0x220 [ 25.512463][ T332] ? rcu_sync_func+0x115/0x240 [ 25.518540][ T332] print_address_description+0x7f/0x2c0 [ 25.524876][ T332] ? lock_get_status+0x206/0x960 [ 25.530233][ T332] kasan_report+0xe2/0x130 [ 25.534937][ T332] ? lock_get_status+0x206/0x960 [ 25.540150][ T332] __asan_report_load8_noabort+0x14/0x20 [ 25.546104][ T332] lock_get_status+0x206/0x960 [ 25.551717][ T332] locks_show+0x1f1/0x2f0 [ 25.556194][ T332] seq_read_iter+0x490/0xd30 [ 25.562081][ T332] proc_reg_read_iter+0x1be/0x290 [ 25.567670][ T332] vfs_read+0x874/0xa10 [ 25.572730][ T332] ? kernel_read+0x70/0x70 [ 25.577530][ T332] ? finish_task_switch+0x12e/0x5a0 [ 25.584161][ T332] ? __fget_files+0x2c4/0x320 [ 25.589366][ T332] ? __fdget+0x1a1/0x230 [ 25.594152][ T332] ? __x64_sys_pread64+0xec/0x220 [ 25.600122][ T332] __x64_sys_pread64+0x191/0x220 [ 25.605084][ T332] ? asm_sysvec_reschedule_ipi+0x12/0x20 [ 25.611036][ T332] ? ksys_pread64+0x1b0/0x1b0 [ 25.615888][ T332] do_syscall_64+0x31/0x40 [ 25.620990][ T332] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.626997][ T332] RIP: 0033:0x7f34bc642929 [ 25.631824][ T332] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 25.652321][ T332] RSP: 002b:00007f34ba000038 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 25.660756][ T332] RAX: ffffffffffffffda RBX: 00007f34bc86a400 RCX: 00007f34bc642929 [ 25.669122][ T332] RDX: 0000000000000049 RSI: 0000200000000180 RDI: 000000000000000c [ 25.677741][ T332] RBP: 00007f34bc6c4b39 R08: 0000000000000000 R09: 0000000000000000 [ 25.685896][ T332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.694171][ T332] R13: 0000000000000000 R14: 00007f34bc86a400 R15: 00007fffdd2cda48 [ 25.702822][ T332] [ 25.705468][ T332] Allocated by task 331: [ 25.710069][ T332] __kasan_slab_alloc+0xbd/0xf0 [ 25.716758][ T332] slab_post_alloc_hook+0x5d/0x2f0 [ 25.722216][ T332] kmem_cache_alloc+0x165/0x2e0 [ 25.727761][ T332] __alloc_file+0x28/0x320 [ 25.732361][ T332] alloc_empty_file+0x97/0x180 [ 25.737258][ T332] path_openat+0xf2/0x3160 [ 25.741909][ T332] do_filp_open+0x1b3/0x3e0 [ 25.747235][ T332] do_sys_openat2+0x14c/0x6d0 [ 25.752018][ T332] __x64_sys_openat+0x136/0x160 [ 25.757269][ T332] do_syscall_64+0x31/0x40 [ 25.761889][ T332] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.768142][ T332] [ 25.770921][ T332] Freed by task 0: [ 25.774670][ T332] kasan_set_track+0x4a/0x70 [ 25.779384][ T332] kasan_set_free_info+0x23/0x40 [ 25.784754][ T332] ____kasan_slab_free+0x125/0x160 [ 25.790740][ T332] __kasan_slab_free+0x11/0x20 [ 25.795976][ T332] slab_free_freelist_hook+0xc5/0x190 [ 25.801351][ T332] kmem_cache_free+0x100/0x2d0 [ 25.807076][ T332] file_free_rcu+0x93/0xa0 [ 25.811520][ T332] rcu_do_batch+0x4df/0xa80 [ 25.816107][ T332] rcu_core+0x55f/0xd60 [ 25.820761][ T332] rcu_core_si+0x9/0x10 [ 25.825281][ T332] __do_softirq+0x255/0x563 [ 25.830154][ T332] [ 25.832501][ T332] Last potentially related work creation: [ 25.838797][ T332] kasan_save_stack+0x3a/0x60 [ 25.843492][ T332] __kasan_record_aux_stack+0xd2/0x100 [ 25.850618][ T332] kasan_record_aux_stack_noalloc+0xb/0x10 [ 25.857333][ T332] call_rcu+0x105/0x1040 [ 25.861791][ T332] __fput+0x5ad/0x770 [ 25.866316][ T332] ____fput+0x15/0x20 [ 25.870497][ T332] task_work_run+0x127/0x190 [ 25.875176][ T332] exit_to_user_mode_loop+0xcb/0xe0 [ 25.880497][ T332] syscall_exit_to_user_mode+0x68/0x90 [ 25.885982][ T332] do_syscall_64+0x3d/0x40 [ 25.890793][ T332] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.897390][ T332] [ 25.899722][ T332] Second to last potentially related work creation: [ 25.906319][ T332] kasan_save_stack+0x3a/0x60 [ 25.911433][ T332] __kasan_record_aux_stack+0xd2/0x100 [ 25.917226][ T332] kasan_record_aux_stack+0xe/0x10 [ 25.922612][ T332] task_work_add+0x27/0x1e0 [ 25.927120][ T332] fput_many+0xe7/0x1a0 [ 25.931354][ T332] fput+0x1a/0x20 [ 25.935018][ T332] __se_sys_fcntl+0x107/0x1b0 [ 25.940265][ T332] __x64_sys_fcntl+0x7b/0x90 [ 25.944976][ T332] do_syscall_64+0x31/0x40 [ 25.949512][ T332] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.955602][ T332] [ 25.958124][ T332] The buggy address belongs to the object at ffff88810cb02000 [ 25.958124][ T332] which belongs to the cache filp of size 296 [ 25.973005][ T332] The buggy address is located 32 bytes inside of [ 25.973005][ T332] 296-byte region [ffff88810cb02000, ffff88810cb02128) [ 25.988029][ T332] The buggy address belongs to the page: [ 25.993899][ T332] page:ffffea000432c080 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10cb02 [ 26.004209][ T332] head:ffffea000432c080 order:1 compound_mapcount:0 [ 26.011117][ T332] flags: 0x4000000000010200(slab|head) [ 26.016799][ T332] raw: 4000000000010200 ffffea000432c000 0000000500000005 ffff88810018b800 [ 26.025987][ T332] raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 [ 26.034565][ T332] page dumped because: kasan: bad access detected [ 26.041949][ T332] page_owner tracks the page as allocated [ 26.047881][ T332] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 67, ts 5172081135, free_ts 5163783132 [ 26.068025][ T332] prep_new_page+0x179/0x180 [ 26.073435][ T332] get_page_from_freelist+0x2235/0x23d0 [ 26.079775][ T332] __alloc_pages_nodemask+0x268/0x5f0 [ 26.085345][ T332] new_slab+0x84/0x3f0 [ 26.089415][ T332] ___slab_alloc+0x2a6/0x450 [ 26.094200][ T332] __slab_alloc+0x63/0xa0 [ 26.098617][ T332] kmem_cache_alloc+0x1af/0x2e0 [ 26.103722][ T332] __alloc_file+0x28/0x320 [ 26.108214][ T332] alloc_empty_file+0x97/0x180 [ 26.112962][ T332] path_openat+0xf2/0x3160 [ 26.117591][ T332] do_filp_open+0x1b3/0x3e0 [ 26.122345][ T332] do_sys_openat2+0x14c/0x6d0 [ 26.127208][ T332] __x64_sys_openat+0x136/0x160 [ 26.132065][ T332] do_syscall_64+0x31/0x40 [ 26.136615][ T332] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.142713][ T332] page last free stack trace: [ 26.147502][ T332] __free_pages_ok+0x7fc/0x820 [ 26.152857][ T332] __free_pages+0xdd/0x380 [ 26.157375][ T332] free_pages+0x82/0x90 [ 26.162093][ T332] __stack_depot_save+0x48b/0x4c0 [ 26.167543][ T332] kasan_set_track+0x5b/0x70 [ 26.172446][ T332] kasan_set_free_info+0x23/0x40 [ 26.178369][ T332] ____kasan_slab_free+0x125/0x160 [ 26.184423][ T332] __kasan_slab_free+0x11/0x20 [ 26.189212][ T332] slab_free_freelist_hook+0xc5/0x190 [ 26.194853][ T332] kfree+0xc0/0x270 [ 26.199195][ T332] security_inode_init_security+0x270/0x370 [ 26.205880][ T332] shmem_mknod+0xbb/0x1c0 [ 26.210262][ T332] shmem_create+0x2b/0x40 [ 26.214800][ T332] path_openat+0x16e3/0x3160 [ 26.219922][ T332] do_filp_open+0x1b3/0x3e0 [ 26.224585][ T332] do_sys_openat2+0x14c/0x6d0 [ 26.229432][ T332] [ 26.231761][ T332] Memory state around the buggy address: [ 26.238047][ T332] ffff88810cb01f00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 26.246810][ T332] ffff88810cb01f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.255384][ T332] >ffff88810cb02000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.264496][ T332] ^ [ 26.270424][ T332] ffff88810cb02080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.279965][ T332] ffff88810cb02100: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 26.288707][ T332] ================================================================== [ 26.297250][ T332] Disabling lock debugging due to kernel taint [ 26.418344][ T24] kauditd_printk_skb: 37 callbacks suppressed [ 26.418354][ T24] audit: type=1400 audit(1750463430.500:111): avc: denied { read } for pid=77 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 26.448984][ T326] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1'. [ 26.457688][ T24] audit: type=1400 audit(1750463430.500:112): avc: denied { search } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.480243][ T24] audit: type=1400 audit(1750463430.500:113): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.501514][ T317] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1'. [ 26.511179][ T24] audit: type=1400 audit(1750463430.500:114): avc: denied { add_name } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.540440][ T277] Leaked locks on dev=0x0:0x21 ino=0x12: [ 26.558545][ T277] POSIX: fl_owner=ffff88811d85d040 fl_flags=0x81 fl_type=0x1 fl_pid=309 [ 26.572073][ T24] audit: type=1400 audit(1750463430.500:115): avc: denied { create } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 26.594049][ T24] audit: type=1400 audit(1750463430.500:116): avc: denied { append open } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 26.619547][ T24] audit: type=1400 audit(1750463430.500:117): avc: denied { getattr } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 26.642563][ T24] audit: type=1400 audit(1750463430.710:118): avc: denied { create } for pid=334 comm="syz.4.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 26.664116][ T24] audit: type=1400 audit(1750463430.710:119): avc: denied { setopt } for pid=334 comm="syz.4.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 26.685584][ T24] audit: type=1400 audit(1750463430.710:120): avc: denied { ioctl } for pid=334 comm="syz.4.7" path="socket:[14816]" dev="sockfs" ino=14816 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1