last executing test programs: 1.556629646s ago: executing program 4 (id=51): syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x10, &(0x7f0000000600), 0x1, 0x582, &(0x7f0000009ec0)="$eJzs3U9rHGUcB/DfM9mkf9KaVAStPRgo2IKaNGlFEcEW682DfwqeBGOSltJtG5oItlZsob4DfQGCNy/isYgU9eLVm+ALkGKRNhdvkdnMpNt2N82fTadmPh/YZJ55MjzPZPnuM/vszGwAtTWS/8gi9kbEbIoYaqtrRFE5svR3d25fnlq4fXkqxeLi+/+kSMW68u9T8Xuw2Hh7RPz+c4on+x5sd+7ipTOTzebMhaI8Nn92dmzu4qWXTp+dPDVzaubcxPgr4y8fOTxx5FBP9nN3RPw6erxx7eSb+76f+nbPFz9+dz3F0dhV1LfvR6+MxMjy/6Rd/n99tdeNVaSv2J/2pzg1KuwQa1I+f/0R8XQMRV/cffKG4st3K+0csKkWU8QiUFNJ/qGmyuOA/P1v+aj2iAR4VG4dW5oAuJOW5vYWlvPfWJobjO2tuYGdCynap3VSRPRiZi5vY/b5NJQ/YpPm4YDOrlyNiGc6jf+plc3h1ix+nv/snvxnEfFO8Ttf/9462x+5ryz/8OhsJP8fteX/43W2L/8AAAAAAADQOzeORcSLnT7/y5bP/4kO5/8MRsTRHrT/8M//sps9aAbo4NaxiNcjojz3b6Et/4XhvqK0u3U+QH86ebo5cyginoiIg9G/LS+Pr9DGyL7f+rvWtZ3/lz/y9stzAYt+3Gxsu3eb6cn5yY3sM7Dk1tWIZxud8p+Wx//UYfzPXw9mV9nG4vE3fulW9/D8A5tl8ZuIAx3H/7t3rkgr359jrHU8MFYeFTzosw+v/9CtffmH6uTj/86V8z+c2u/XM7f2Nj7/+88N5L/z8f9AOtG65cxAse7Tyfn5C+MRA+ntB9dPrL3PsBWVeSjzkuf/4P7O7/9XOv7fERFXVtnmiZ/eutatzvgP1cnzP72m8X/tC/s/+Prfbu2vbvw/0hrTDxZrzP/BylYb0Kr7CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/R1lE7IqUjS4vZ9noaMRgRDwVO7Pm+bn5F06e/+TcdF7X+v7/rPym36Glciq//3+4rTxxX/lwROyJiK/6drTKo1Pnm9NV7zwAAAAAAAAAAAAAAAAAAAA8Jga7XP+f+6uv6t4Bm65RdQeAysg/1Jf8Q33JP9SX/EN9yT/Ul/xDfck/1Jf8Q33JPwAAAAAAbCl7nrvxR4qIK6/taD1yA0Vdf6U9AzabW3xAfck/1JdTf6C+UtUdACr3sNeB7eveEgAAAAAAAAAAAADolQN7Xf8PdZVV3QGgMt2v/3dnANjqXP8P9eU9PuD6fwAAAAAAAAAAAAB4/M1dvHRmstmcubDehW0b29yChfosROpB4h7RQtWvTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQOm/AAAA//8zR/Y3") truncate(&(0x7f0000000000)='./file1\x00', 0x1) 1.34497604s ago: executing program 4 (id=56): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\a\x00\x00'], 0x50) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000000)) 1.291052112s ago: executing program 4 (id=57): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) preadv2(r0, &(0x7f0000000340)=[{&(0x7f0000000200)=""/261, 0x105}], 0x1, 0x182, 0xfffffffd, 0x3b) 1.274113792s ago: executing program 4 (id=58): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000048000/0x1000)=nil, 0x1000, 0xb, 0x31, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000000080), 0x2) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) 1.141116305s ago: executing program 0 (id=61): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x20085e, &(0x7f0000000100)={[{@grpjquota}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0xa32}}, {@abort}]}, 0x1, 0x550, &(0x7f0000001040)="$eJzs3c9vI1cdAPDvOLGT3U2bbekBELRLW1jQap2Nt11VPUA5IYQqIXoEaRsSb7RaO45ipzRhJdIzVyQqcYIjfwDnnrhzQXDjUg5I/IhADRKHQTOeZJ3ETtJuHEf256OMZt4be77vKZr3Zp7teQFMrBsRsRMRlYh4NyLmi/ykWOKt7pK97pPdx8t7u4+Xk0jTd/6Z5PuzvOh5T+ZacczZiPjBdyJ+nByP297afrTUaNQ3ivRCp7m+0N7avv2wubRaX62v1Wr3Fu/deePu67VPUZvZE/e+1KwUW1/++A873/hpVqy5Iqe3HuepW/XyQZzMdER8bxjBRmCqqE9l1AXhMylFxPMR8XJ+/s/HVP7fBADGWZrORzrfmwYAxl13DCwpVYuxgLkolarV7hjeC3G11Gi1O7cetDbXVrpjZdejXHrwsFG/U4wVXo9ykqUX8+0n6dqR9N2IeC4ifjETebq63GqsjPLCBwAm2LUj/f9/Zrr9PwAw5k7+2gwAMI70/wAweT5L/18aQjkAgIvj/h8AJk+3/7/yad+WpunPhlEcAOAC5P1/n4d0AQDjy/g/AEyU77/9drake8Xzr1fe29p81Hrv9kq9/aja3FyuLrc21qurrdZq/sye5mnHa7Ra64uvxeb717+53u4stLe27zdbm2ud+/lzve/Xy/mrdi6gZgDAIM+99NGfk6xHfvNKvkTPXA7lkZYMGDY/44HJNXU8y6cBMCG6s33l3/1x3sOEeXKPP+j0Hzizo+EBGBOnfft3pt8PhNI0TYdXJGDIbn7B+D9MqmL8f9r9P0yePuP/h+RzA/uQEMbS9KgLAIxMmiZnnfM/zvpCAOByO2GM//pFXocAozPg8//ni/Vviw8HfrRy9BUfDrNUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcLntz/9bLab5nYtSqVqNeCafAKicPHjYqN+JiGcj4k8z5ZksvTjiMgMAT6v0t6SY/+vm/Ktzh3a9eO1gsxIRP/nVO798f6nT2fhjRCX518x+fufDIr92arDZYdQAADjZfj+drUs9+Z/sPl7eXy6yPH//dveqIIu7t1uJvYP40zGdr2ejHBFX/50U6a6kZ+ziaex8EBGf71f/JObyMZDuJcvR+FnsZ84p/tSZ4pcOxS8VEzRn6+wq7XPnUBaYNB9l7c9b/c6/UtzI1/3P/9m8hXp6RfuXHWp5L28Dn8Tfb/+mBrR/N44fbqZvjNd+/93u1pXj+z6I+OJ0xH7svZ72Z3+O+GRA/FfPWMe/fOnFlwftS38dcTP6x++NtdBpri+0t7ZvP2wurdZX62u12r3Fe3feuPt6bSEfo14Y3Bv8481bzx7JKvfW/+qA+N3//GwMqv9XB/VBR+5yf/O/d3/4lQFly+J//ZV+8Uvxwgnxswp8bWCND1u6+ruB991Z/JXj9U+yv+lT6n/rjPE//uv2sWnDAYDRaW9tP1pqNOobNsZ0o3I5inE+G1Fcel6W8vRufOuiYlWi/66fv9I9p4/sStMTD1iJvu9qDGoxzmPUDbgMDk76iPjvqAsDAAAAAAAAAAAAAAD0dRG/WBp1HQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABhf/w8AAP//CwbVyQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000003c0)={0x80d8, 0x0, 0x0, 0x0, 0x101}) 1.110987676s ago: executing program 2 (id=65): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000006040)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x608d850) 1.051098837s ago: executing program 0 (id=67): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xa, 0x61}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x4, 0xa}, {}, {0xfff2, 0xffff}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x1}, @TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) 938.4843ms ago: executing program 0 (id=70): r0 = socket(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000013c0)={{0x14, 0x453, 0x1f, 0x0, 0x0, {0x5}}, [], {0x14, 0x3f2, 0x1, 0x0, 0x0, {0x7}}}, 0x28}, 0x1, 0x0, 0x0, 0x64841}, 0x0) 911.28946ms ago: executing program 0 (id=71): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f0000003280)={0x0, 0x0, 0x0}, 0x0) sendmsg$tipc(r1, &(0x7f0000000e40)={0x0, 0x0, 0x0}, 0x0) sendmsg$inet(r1, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000042c0)="86", 0x1}], 0x1}, 0x0) sendmsg$tipc(r1, &(0x7f0000002700)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0c1}, 0x1) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000380)=""/208, 0xd0}], 0x1}, 0x40012101) 440.87279ms ago: executing program 3 (id=93): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0xf0, 0x0, 0x7fffff7f}]}) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000001a80), r0) 415.000901ms ago: executing program 3 (id=94): unshare(0x64000600) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) 329.081943ms ago: executing program 4 (id=95): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3800000054002b3d29bd7000fdffffff07000000", @ANYRES32, @ANYBLOB="20000100", @ANYRES32], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 328.479143ms ago: executing program 4 (id=96): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x3216, 0x40100) syz_usb_disconnect(r0) syz_usb_connect$cdc_ecm(0x2, 0x4d, &(0x7f0000000080)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x4, 0x40, 0x2, "", [{{0x9, 0x4, 0x0, 0xfa, 0x0, 0x2, 0x6, 0x0, 0x7, {{0x5}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x2, 0x6e9, 0x9}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x7df, 0x5, 0x4f, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x1, 0x1, 0x6}}}}}]}}]}}, 0x0) ioctl$EVIOCRMFF(r0, 0x83c0550b, 0x0) 327.908543ms ago: executing program 3 (id=97): syz_mount_image$ext4(&(0x7f0000000700)='ext4\x00', &(0x7f00000007c0)='./file1\x00', 0x2, &(0x7f0000000740), 0x7, 0x4f5, &(0x7f0000000800)="$eJzs3E9sFFUcAODfbLe0hSIVEaWiFtHYaGyhoHAwMRhNPGhixIMem7YQZKGmrYkQAkti8GhIvBrj0asHr2q8GE4mXvFoYkiI4QJ4WjO7s+12O136Z9tK+33Jsu/NvJn33r55s2/eYxvAljWQ/pNE9EbEzYjYFRGF5gQDtbd7dy6N3b9zaSzKlcrJf5L0sLibxjNJ9r4jiwwWIgpfJHM7GkxfuHh2tFSamMriwzPnPh2evnDxlTPnRk9PnJ44P3L8+NEjh4+9NvLq8iuVk19ar7v9lyf373vn4+vvjRXr27uz98Z6tMtADOQVpeqFdme2wXY2hJNiq5RvrH1hWLL0+k+bq7Pa/3dFR7RsPGATqVQqla4s3Llwd7nS7OqCLcBDK4mNLgGwMepf9Onzb/2VN07YtnZDkA11+0TtASit973sFfFsdWN9HqSz6fm2nQaiGB+V//02faXx4hrMQwAANPr5RH0k2DT+64vY25DukWwNpS8iHo2I3RHxWETsiYjHo5b2iYh4sun8HRFRaZH/QFN84fizcGt1NWwtHf+9nq1tzY3/onEVrK8ji+2MqA+YJw5ln8lgdHadOlOaONwij1/e+uOrxfal9a+P/9JXmn99LJiV41axa/4x46MzoyuucJPbVyP6i831T4oRyexKQBIR+yKi/9dvlnzevobwmZe+3z8baZpkfHD9qyq562htWKqofBfxYq39yzGv/edyTFqvTw53R2ni0HB6FRzKzePG79fez9ueLKX+P/7VfNjbx346mfWs1Uvbf3vD9R/19du5+vclEcnseu30Iie6snge1/78ctFnmpVe/9uSD3ui4bn089GZmanDEduSd2PB9pHZZd56vPoe5Vr9Bw/m9//d2THpJ/FURKQX8dMR8UzUnhAHonLlQEQ8FxEHF69+/Pbm85+svP5rK63/eO79b177z63Xp4F069S8LaOlpFxLPbdlNtBx9sDN+/35+S+t/Y9WQ4PZlvz7XzLvFrGwFPmBVX58AAAA8FAoRERvw1xSbxQKQ0O1OaA9sb1QmpyeeTmZ/Oz8eO03An0NaWvzwZ1Jff6zryE+0hQ/ks0bf93RU40PjU2WxjeozkDNjmqfTwpDs/eCWv9P/d2eKWbg/8xPfmDrelD/33t9nQoCrDvf/7BVTV1uiJQXSVT2P2Vgc1rK97+5QNic8vp/i//P7YEBNomK7gxb2nL6//y0N3a1vTDAuirGB7PhwoaWBFhvxv+wJS3pR/IrDlS68nd1x8LE0d36hB2xsmL05OS1IYF0ZLXK89RbbXlH9eTuKrY+qv7XFBZNE4XlFb5r7k9GJKtp01Orb4vTe9t98XdWsvWxdl82P6xJP31g454dLbW+b4z0tv1WBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsCb+CwAA//+0FNMg") r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000000080)=""/237, 0xed) 269.620964ms ago: executing program 2 (id=98): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() syz_io_uring_setup(0x21a3, &(0x7f0000000100)={0x0, 0x8b0b, 0x800, 0x3, 0x1c}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0, &(0x7f0000000180)) syz_io_uring_complete(r0, r1) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r2, &(0x7f0000000340), 0x8) 252.205195ms ago: executing program 1 (id=99): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f0000000000)={0x2, {{0x2, 0x4e20, @multicast2}}, {{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2f}}}}, 0x108) close(0x3) 205.123965ms ago: executing program 2 (id=100): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b400000000009000100", @ANYRES16], 0xc4}}, 0x0) 204.879505ms ago: executing program 2 (id=101): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x40, 0x6, 0x3, 0x8, 0x6, 0xffffff26, 0x2, 0x80, 0x8, 0x7, 0x15, 0x9d, 0x4, 0x5, 0x7, 0xc5f7}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x200400dc}, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r7, {0xf000, 0xffff}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, 0x0, 0x240480d4) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r10) sendmsg$TIPC_CMD_ENABLE_BEARER(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r12) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r12, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 204.785325ms ago: executing program 1 (id=102): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000180)={0xcf43, 0x4c9, 0xa3d4, 0xffff, 0x12, "3d52e3ff00"}) write$binfmt_aout(r0, &(0x7f00000002c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x40, 0x3, 0x100007, 0x16, "b0bf2ebb48c8040018bfef400000000500"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000001c0)=0xa) 204.639875ms ago: executing program 3 (id=103): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELRULE={0x34, 0x8, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x7c}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) 154.387697ms ago: executing program 3 (id=104): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000100)={0x2b, 0x22, 0x0, 0x2, 0x8, 0xa9, 0x5, 0x2, 0x1}) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x21081e, &(0x7f0000000480)={[{@grpquota}, {@discard}, {@quota}]}, 0x1, 0x506, &(0x7f0000001d00)="$eJzs3c9vI1cdAPCvnThxsmmTlh4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHFZDkj8iEAbJA5TzXiS9WbtTbRJ7Cj+fKTRzJvnne97a817mW9ivwBG1s2I2I+IiYj4MCJm8/OFfIv3Olv6ukcHD1YODx6sFCJJPvhXIatPz0XXv0ndyK9ZjogffS/ip4Wn47Z29zaW6/Xadl6ebze25lu7e3fWG8trtbXaZrW6tLi08M7dt6sX1tfXGhP50Vcf/nH/Wz9PmzWTn+nux0XqdL10HCc1HhE/uIxgQzCW92di2A3huRQj4uWIeD27/2djLHs3AYDrLElmI5ntLgMA110xy4EVipU8FzATxWKl0snhvRLTxXqz1b59v7mzudrJlc1FqXh/vV5byHOFc1EqpOXF7PhxuXqifDciXoqIX05OZeXKSrO+OswffABghN04Mf//d7Iz/wMA11x52A0AAAbO/A8Ao8f8DwCjx/wPAKOnM/9PDbsZAMAAef4HgNFj/geAkfLD999Pt+Qw//7r1Y92dzaaH91ZrbU2Ko2dlcpKc3urstZsrmXf2dM47Xr1ZnNr8a3Y+Xju21ut9nxrd+9eo7mz2b6Xfa/3vVope9X+AHoGAPTz0muf/aWQzsjvTmVbdK3lUBpqy4DLVhx2A4ChGRt2A4ChsdoXjK5zPONLD8A10WOJ3ieUe31AKEmS5PKaBFyyW1+S/4dR1ZX/91fAMGLk/2F0yf/D6EqSwlnX/I+zvhAAuNrk+IE+v/9/Od//Lv/lwE9WT77i09Ov7TMGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXFdH6/9W8nU6ZqJYrFQiXoiIuSgV7q/XawsR8WJE/HmyNJmWF4fcZgDgvIp/L+Trf92afXPmiapXbxwfTkTEz379wa8+Xm63t/8UMVH49+TR+fan+fnq4FsPAJzuaJ7O9l0P8o8OHqwcbYNszz++GxHlTvzDg4k4PI4/HuPZvhyliJj+TyEvdxS6chfnsf9JRHyxV/8LMZPlQDorn56Mn8Z+YaDxi0/EL2Z1nX36f/GFC2gLjJrP0vHnvV73XzFuZvve9385G6HOLx//0kutHGZj4OP4R+PfWJ/x7+ZZY7z1h+93jqaervsk4svjEUexD7vGn6P4hT7x3zxj/L9+5dXX+9Ulv4m4Fb3jd8eabze25lu7e3fWG8trtbXaZrW6tLi08M7dt6vzWY56vjMbJD0mhX++e/vFfvHT/k/3iV8+pf9fP2P/f/v/D3/8tWfE/+YbveIX45VnxE+fzL9xxvjL078v96tL46/26f9p7//tM8RO56eHf9t7atlwAGB4Wrt7G8v1em37Gh+kP6tcgWY4OP9BXOG38juDijURvat+8Ubnnj5RlSTPFavfiHERWTfgKji+6SPif8NuDAAAAAAAAAAAAAAA0NMgPrE07D4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwfX0eAAD//yjlzow=") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) socket$key(0xf, 0x3, 0x2) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x6}, @in6=@private2={0xfc, 0x2, '\x00', 0xfe}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x9, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x8, 0xfffffffe}}, 0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000300, &(0x7f0000000c80)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, 0x0) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) readv(r3, &(0x7f0000000140)=[{&(0x7f0000000040)=""/195, 0xc3}], 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 81.002308ms ago: executing program 1 (id=105): syz_open_procfs$namespace(0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r1 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0x70bd27, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{}, 0x93, 0xfc}, [{0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0xfffffffc}, {0x1, 0x0, 0x0, 0x4000000, 0x7, 0x80000}, {0x8, 0x5, 0x0, 0xfffffffc, 0x5}, {0x0, 0x0, 0x3d, 0x0, 0x20000}, {0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0xc3}, {0x0, 0x5}, {0x5}, {0x5, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x10}, {0x0, 0x404, 0x0, 0x8000000}, {0x0, 0xffffffff, 0x0, 0x0, 0xfffffffd}, {0x42, 0x0, 0x400000, 0x0, 0x6}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x8000000}, {}, {0x0, 0x0, 0x0, 0x0, 0x20, 0xfffffffc}, {0xfffffffd}, {}, {0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0x2000}, {}, {0x0, 0x7, 0x0, 0x1, 0xffffffff}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, {0x0, 0xffffffff, 0x0, 0x0, 0x5, 0xfffffffd}, {0xffffffff, 0x10000000}, {}, {0x0, 0x0, 0xc, 0x7, 0x0, 0x6}, {0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x52a}, {0xffffffff, 0x0, 0x0, 0x0, 0x5}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x0, 0x29, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x0, 0x1, 0x3}, {0x80, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {0x0, 0x28e, 0x0, 0x5}, {0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x9}, {0x100000, 0x0, 0x0, 0x0, 0x3}, {}, {0x0, 0x6, 0x3}, {0x0, 0x15, 0x0, 0x48510}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xcb}, {0x0, 0x0, 0x0, 0x0, 0x10000, 0x4000}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xd, 0xffffffff}, {0x0, 0xfffffffe}, {}, {0x0, 0xfffefffd}, {0x0, 0x0, 0x0, 0x1, 0xfffffffd}, {0x0, 0x2, 0x0, 0x88}, {0x5}, {}, {0x0, 0xfffffffc, 0x0, 0x3ff, 0x40000000}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x400000}, {0x4, 0x0, 0x200, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0xffffffff}, {0x5}, {}, {0x0, 0x0, 0x0, 0x4000, 0x0, 0x4e}, {0x0, 0x54e4}, {0x0, 0x101, 0x0, 0x4, 0x0, 0xffffffff}, {}, {0x2f, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x4, 0x9}, {0xfffffffe, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x2}, {}, {0x0, 0x2, 0xfffffffd, 0x80000, 0x3}, {}, {0x800000, 0x9, 0x0, 0x0, 0x0, 0x56}, {0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffefffff}, {0x0, 0xfffffffe}, {0x0, 0x0, 0x6, 0x0, 0x4}, {0x0, 0x80}, {}, {0x0, 0xfffffffd}, {0x6, 0x0, 0x0, 0x0, 0x8}, {0x7f, 0x0, 0xfffffffe, 0xfffffffe}, {}, {}, {0xffffffff, 0x2, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x2, 0x8, 0x20000000}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x292}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x2000000}, {0x0, 0x80000000, 0x0, 0x7619, 0x0, 0x101}, {0x5, 0x5, 0x0, 0x0, 0x1}, {0x0, 0x5}, {0x0, 0x0, 0x200, 0x0, 0x80}, {0x10000000, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x2e9c, 0x0, 0x0, 0x7, 0x7f53}, {0x0, 0x0, 0x0, 0x0, 0x2}, {0x3}, {0x0, 0x0, 0x0, 0x0, 0x4, 0x7fffffff}, {}, {0x1, 0x0, 0x0, 0x8}, {}, {0x0, 0x1}, {}, {0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {0x0, 0x8000}, {0x0, 0x0, 0x10000, 0x0, 0xfffffffc, 0x2}, {0x0, 0x80000000, 0x0, 0x7dff800}, {0x3, 0x0, 0x0, 0x0, 0xffffffff}], [{0x3}, {}, {}, {}, {}, {0x3}, {}, {0x3, 0x1}, {0x2, 0x1}, {}, {}, {0x1}, {0x4, 0x1}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {0x4}, {0x2}, {}, {}, {}, {}, {}, {0x749eb9ae44d9651f}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {0x1, 0x1}, {}, {}, {}, {0x0, 0x1}, {}, {0x4}, {0x3}, {}, {0x1}, {}, {}, {}, {0x2}, {0x0, 0x1}, {}, {0x8, 0x1}, {}, {0x1}, {0x4}, {}, {0x0, 0x1}, {}, {}, {0x3}, {0x0, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {0x5}, {}, {}, {0x7}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {}, {}, {0x0, 0x1}, {0x1}, {}, {0x5}, {}, {0x3}, {}, {}, {}, {}, {0x6}, {0x2, 0x1}, {}, {}, {}, {0x3, 0x1}, {0x0, 0x1}, {}, {}, {0x2}, {0x2}, {}, {}, {0x4}, {0x3}, {}, {}, {0x0, 0x1}, {0x2}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, &(0x7f0000002b40)=""/135, 0x87}, 0x40002101) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000680)={r1, 0x58, &(0x7f0000000600)}, 0x10) 53.694539ms ago: executing program 1 (id=106): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) recvmsg(r0, &(0x7f000000c1c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)=""/17, 0x11}, {&(0x7f00000001c0)=""/116, 0x74}, {&(0x7f0000000380)=""/86, 0x56}, {&(0x7f0000000500)=""/145, 0x91}, {&(0x7f00000005c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/10, 0xa}, {&(0x7f0000000440)=""/77, 0x4d}], 0x7}, 0x40010000) 53.425899ms ago: executing program 2 (id=107): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xd4ad1185e214d3bd}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x54, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x14, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}}], {0x14}}, 0xb0}}, 0x0) 52.958799ms ago: executing program 3 (id=108): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x68, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x4, 0x5}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x34, 0x2, [@TCA_MATCHALL_ACT={0x30, 0x2, [@m_ife={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20048091}, 0x0) 1.1065ms ago: executing program 0 (id=109): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = fcntl$dupfd(r0, 0x406, r1) write$selinux_context(r2, 0x0, 0x0) 957.26µs ago: executing program 1 (id=110): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000240)=0x9, 0x4) setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f00000002c0)=0x10401, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0xe22, 0x1905bb88}, 0x1c) 817.08µs ago: executing program 2 (id=111): pivot_root(0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80a, &(0x7f0000000400)={[{@quota}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x5}}, {@errors_remount}, {@sysvgroups}]}, 0x3, 0x79b, &(0x7f0000001200)="$eJzs3c1rXFUbAPDnTpImTfu+zQsv2LppVloonbQ1tgqCERciWCjo2jZMpiFmkimZSWlCFhYRBBG0uBB049qPunMruvZvcCMiLVXTYsWFjNz5SKb5mHw0k2mb3w9ucs6dc+ecZ+7cc8/MPcwNYM8aTP9kIo5ExIdJxKH6+iQieqqp7oiRWrl7iwu5dEmiUnn996Ra5u7iQi6atkkdqGcOR8T370Ycz6yutzQ3PzlaKORn6vmh8tTlodLc/ImJqdHx/Hh++syp4eHTZ589e2bnYv3zx/mDtz565emvR/5+54kbH/yQxEgcrD/WHMdOGYzB+mvSk76E93l5pyvrsKTTDWBb0kOzq3aUx5E4FF3VFADwOEvP/xUAYI9JnP8BYI9pfA9wd3Eh11g6+43E7rr9UkT01eJvXN+sPdJdv2bXV70O2n83ie76FdHYwetdgxHx2bdvfpku0abrkABreftaRFwcGFzd/yer5ixs1clNlBlckdf/we75Lh3/PLfW+C+zNP6JpfHPst41jt3tGIzY15xfffxnbq654Ys7UHl9/PdCbW5bGmjT+G9p0tpAVz33nzRzNCImCvm0b/tvRByLnt5LE4X8qRZ1HLvzz531Hmse//1x/a0v0vrT/8slMje7e+/fZmy0PPogMTe7fS3iye7luX33VvX/fdWx7sr9n6473+qJjy4nX33+vU/XK5bGn8bbWFbH316VzyOeirXjb0hazk8cSnf/ydrftev45udP+terv3n/p0taf+OzwG5I939/6/gHkub5mqWdrX/j+Nd+/+9L3qimG53H1dFyeeZUxL7ktdXrTy9v28g3yqfx1yJdGX+m5fs//SR4cZMxdt/67avtx7+kLVMs0/jHtrT/t564cW+ya/vxp/t/uJo6Vl+zmf5vsw18kNcOAAAAAAAAAAAAAAAAAAAAAAAAADYrExEHI8lkl9KZTDZbu4f3/6M/UyiWyscvFWenx6J6r+yB6Mk0furyUC2fNH7/dKApf3pF/pmI+F9EfNy7v5rP5oqFsU4HDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1B9a5/3/q195Otw4AaJu+DUvcyd+XrVQqlTa2BwBov43P/wDA46bF+X//brYDANg9Pv8DwN7j/A8Ae4/zPwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG12/ty5dKn8tbiQS/NjV+ZmJ4tXTozlS5PZqdlcNlecuZwdLxbHC/lsrji10fMVisXLwzE9e3WonC+Vh0pz8xemirPT5QsTU6Pj+Qv5nl2JCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2pjQ3PzlaKORnHovE+xHxEDSjHYkkHopmdCTxy4mfDrcqc32Dt/HIQxHFI5bodM8EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj4NwAA//8PbSWm") r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r0, 0xc020662a, &(0x7f0000000140)={0xd, 0x4, 0x6, 0x7}) 683.72µs ago: executing program 1 (id=112): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x5}}]}}]}, 0x48}}, 0x20040084) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x300, r6, {0xfff5, 0x4}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x7e, 0xffffffffffffffff, 0xfffffffc, 0x8}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) 0s ago: executing program 0 (id=113): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x48}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a38000000030a03000000000000000000020000000900010073797a30000000000900030000000000000003000c000240000000000000000114000000110001"], 0x60}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.181' (ED25519) to the list of known hosts. [ 22.890423][ T30] audit: type=1400 audit(1784664784.475:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.891483][ T277] cgroup: Unknown subsys name 'net' [ 22.913105][ T30] audit: type=1400 audit(1784664784.475:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.940569][ T30] audit: type=1400 audit(1784664784.505:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.940735][ T277] cgroup: Unknown subsys name 'devices' [ 23.050611][ T277] cgroup: Unknown subsys name 'hugetlb' [ 23.056277][ T277] cgroup: Unknown subsys name 'rlimit' [ 23.192400][ T30] audit: type=1400 audit(1784664784.775:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.215666][ T30] audit: type=1400 audit(1784664784.775:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.240397][ T30] audit: type=1400 audit(1784664784.775:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.267767][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.276826][ T30] audit: type=1400 audit(1784664784.855:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.302351][ T30] audit: type=1400 audit(1784664784.855:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.334807][ T30] audit: type=1400 audit(1784664784.915:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.335280][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.360442][ T30] audit: type=1400 audit(1784664784.915:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.901410][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.908578][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.915978][ T285] device bridge_slave_0 entered promiscuous mode [ 23.924037][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.931094][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.938353][ T285] device bridge_slave_1 entered promiscuous mode [ 24.024142][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.031354][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.038903][ T287] device bridge_slave_0 entered promiscuous mode [ 24.047200][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.054384][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.061755][ T287] device bridge_slave_1 entered promiscuous mode [ 24.123937][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.131028][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.138443][ T286] device bridge_slave_0 entered promiscuous mode [ 24.156693][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.163794][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.171260][ T286] device bridge_slave_1 entered promiscuous mode [ 24.177753][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.184907][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.192280][ T289] device bridge_slave_0 entered promiscuous mode [ 24.200826][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.207876][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.215338][ T289] device bridge_slave_1 entered promiscuous mode [ 24.243452][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.250596][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.258053][ T288] device bridge_slave_0 entered promiscuous mode [ 24.289232][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.296307][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.303827][ T288] device bridge_slave_1 entered promiscuous mode [ 24.380650][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.387710][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.395010][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.402052][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.409940][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.416989][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.424282][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.431342][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.474210][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.481311][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.488618][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.495650][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.521925][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.529007][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.536271][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.543321][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.560608][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.567715][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.575001][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.582063][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.605352][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.612603][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.619930][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.627584][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.635086][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.642482][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.649747][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.656874][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.664082][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.671354][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.678587][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.702482][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.709969][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.717304][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.725651][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.732695][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.740273][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.748382][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.755462][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.762955][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.771254][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.778274][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.785718][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.793842][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.800883][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.811596][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.823673][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.839744][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.861793][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.869715][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.879056][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.886424][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.894792][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.903176][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.910266][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.932996][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.941435][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.949847][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.956875][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.964395][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.973019][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.981153][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.989562][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.997427][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.005679][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.014203][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.022776][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.031123][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.038155][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.045632][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.053938][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.072392][ T285] device veth0_vlan entered promiscuous mode [ 25.078861][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.087213][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.095471][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.102606][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.110082][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.118325][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.126696][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.133733][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.141237][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.149549][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.157621][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.164786][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.172402][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.180498][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.188378][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.196373][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.204395][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.212605][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.220622][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.228434][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.236645][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.244148][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.251802][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.259240][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.266738][ T287] device veth0_vlan entered promiscuous mode [ 25.288104][ T289] device veth0_vlan entered promiscuous mode [ 25.294539][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.302712][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.310823][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.319297][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.327625][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.335572][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.343585][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.351053][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.365778][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.373919][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.381956][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.390433][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.401029][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.413361][ T287] device veth1_macvtap entered promiscuous mode [ 25.420803][ T285] device veth1_macvtap entered promiscuous mode [ 25.428774][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.436514][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.444922][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.453185][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.462483][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.470718][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.485152][ T288] device veth0_vlan entered promiscuous mode [ 25.496738][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.504985][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.512579][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.520651][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.528978][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.537219][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.545588][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.554022][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.562471][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.576509][ T289] device veth1_macvtap entered promiscuous mode [ 25.584930][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.592602][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.605673][ T286] device veth0_vlan entered promiscuous mode [ 25.615829][ T288] device veth1_macvtap entered promiscuous mode [ 25.624447][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.632961][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.641457][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.649710][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.657932][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.665902][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.685595][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 25.693607][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.701405][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.709173][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.717440][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.725902][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.734439][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.742885][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.751109][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.759686][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.767810][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.786608][ T286] device veth1_macvtap entered promiscuous mode [ 25.799681][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.811634][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.819804][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.849999][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.888700][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.897716][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.906802][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.942305][ T314] loop1: detected capacity change from 0 to 256 [ 25.979170][ T314] ======================================================= [ 25.979170][ T314] WARNING: The mand mount option has been deprecated and [ 25.979170][ T314] and is ignored by this kernel. Remove the mand [ 25.979170][ T314] option from the mount to silence this warning. [ 25.979170][ T314] ======================================================= [ 26.102355][ T314] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 26.156152][ T314] cgroup2: Unknown parameter 'memory_hugetlb_accounting' [ 26.349460][ T323] loop4: detected capacity change from 0 to 256 [ 27.009449][ T326] FAT-fs (loop4): error, invalid access to FAT (entry 0x00000001) [ 27.742388][ T337] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.749659][ T337] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.764734][ T337] input: syz0 as /devices/virtual/input/input4 [ 27.779238][ T337] device bridge_slave_1 left promiscuous mode [ 27.785540][ T337] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.794373][ T337] device bridge_slave_0 left promiscuous mode [ 27.801674][ T337] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.950150][ T339] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.957437][ T339] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.011016][ T30] kauditd_printk_skb: 48 callbacks suppressed [ 28.011033][ T30] audit: type=1400 audit(1784664789.595:122): avc: denied { create } for pid=334 comm="syz.4.8" dev="anon_inodefs" ino=15875 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.104443][ T30] audit: type=1400 audit(1784664789.645:123): avc: denied { read write } for pid=343 comm="syz.1.10" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.145258][ T30] audit: type=1400 audit(1784664789.645:124): avc: denied { open } for pid=343 comm="syz.1.10" path="/dev/raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.203552][ T30] audit: type=1400 audit(1784664789.645:125): avc: denied { ioctl } for pid=343 comm="syz.1.10" path="/dev/raw-gadget" dev="devtmpfs" ino=254 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.253302][ T30] audit: type=1400 audit(1784664789.645:126): avc: denied { create } for pid=345 comm="syz.2.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 28.297238][ T30] audit: type=1400 audit(1784664789.655:127): avc: denied { create } for pid=345 comm="syz.2.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.338499][ T63] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 28.346074][ T30] audit: type=1400 audit(1784664789.655:128): avc: denied { write } for pid=345 comm="syz.2.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.372458][ T312] loop0: detected capacity change from 0 to 131072 [ 28.379233][ T30] audit: type=1400 audit(1784664789.655:129): avc: denied { nlmsg_write } for pid=345 comm="syz.2.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.399808][ T30] audit: type=1400 audit(1784664789.655:130): avc: denied { setopt } for pid=345 comm="syz.2.9" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 28.428998][ T30] audit: type=1400 audit(1784664789.655:131): avc: denied { getopt } for pid=345 comm="syz.2.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 28.471133][ T312] F2FS-fs (loop0): Segment count (31) mismatch with total segments from devices (0) [ 28.480931][ T312] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 28.493689][ T312] F2FS-fs (loop0): invalid crc value [ 28.511703][ T312] F2FS-fs (loop0): Found nat_bits in checkpoint [ 28.557826][ T312] F2FS-fs (loop0): recover fsync data on readonly fs [ 28.565748][ T312] F2FS-fs (loop0): Try to recover 1th superblock, ret: -30 [ 28.573717][ T312] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 28.611337][ T6] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 28.628578][ T63] usb 2-1: device descriptor read/64, error -71 [ 28.677907][ T356] loop3: detected capacity change from 0 to 512 [ 28.733036][ T346] loop2: detected capacity change from 0 to 131072 [ 28.780589][ T346] F2FS-fs (loop2): Test dummy encryption mode enabled [ 28.789055][ T356] FAT-fs (loop3): bread failed, FSINFO block (sector = 256) [ 28.798191][ T346] F2FS-fs (loop2): invalid crc value [ 28.805694][ T346] F2FS-fs (loop2): Invalid segment type: 8, segno: 0 [ 28.812976][ T346] F2FS-fs (loop2): Failed to initialize F2FS segment manager (-117) [ 28.888509][ T6] usb 5-1: Using ep0 maxpacket: 16 [ 28.896994][ T369] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 29.019660][ T20] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 29.024043][ T63] usb 2-1: device descriptor read/64, error -71 [ 29.048512][ T382] loop3: detected capacity change from 0 to 512 [ 29.067718][ T388] loop2: detected capacity change from 0 to 128 [ 29.068649][ T6] usb 5-1: unable to get BOS descriptor or descriptor too short [ 29.074668][ T382] EXT4-fs (loop3): Ignoring removed nomblk_io_submit option [ 29.095585][ T382] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 29.114774][ T382] EXT4-fs (loop3): 1 truncate cleaned up [ 29.121002][ T382] EXT4-fs (loop3): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000007,bsddf,nomblk_io_submit,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 29.127820][ T392] loop2: detected capacity change from 0 to 256 [ 29.155534][ T382] EXT4-fs warning (device loop3): verify_group_input:147: Cannot add at group 20661 (only 1 groups) [ 29.239473][ T396] device syzkaller0 entered promiscuous mode [ 29.283916][ T404] loop2: detected capacity change from 0 to 128 [ 29.308569][ T63] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 29.328598][ T20] usb 1-1: device descriptor read/64, error -71 [ 29.378640][ T6] usb 5-1: New USB device found, idVendor=046d, idProduct=08f0, bcdDevice= 0.40 [ 29.391467][ T6] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.401797][ T6] usb 5-1: Product: syz [ 29.406435][ T6] usb 5-1: Manufacturer: syz [ 29.411698][ T6] usb 5-1: SerialNumber: syz [ 29.440772][ T425] netlink: 4 bytes leftover after parsing attributes in process `syz.3.40'. [ 29.464575][ T427] loop2: detected capacity change from 0 to 4096 [ 29.515514][ T427] EXT4-fs (loop2): Ignoring removed mblk_io_submit option [ 29.524093][ T427] EXT4-fs (loop2): Ignoring removed bh option [ 29.535319][ T427] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 29.558422][ T427] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0002] [ 29.568357][ T427] System zones: 0-5 [ 29.573454][ T427] EXT4-fs (loop2): mounted filesystem without journal. Opts: debug,journal_dev=0x00000000000007ff,inlinecrypt,mblk_io_submit,grpjquota=,bh,nodiscard,jqfmt=vfsv0,,errors=continue. Quota mode: writeback. [ 29.593787][ T63] usb 2-1: device descriptor read/64, error -71 [ 29.738517][ T20] usb 1-1: device descriptor read/64, error -71 [ 29.768604][ T6] usb 5-1: unit 2 not found! [ 29.824068][ T6] usb 5-1: USB disconnect, device number 2 [ 29.988570][ T63] usb 2-1: device descriptor read/64, error -71 [ 30.039230][ T364] udevd[364]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 30.108615][ T63] usb usb2-port1: attempt power cycle [ 30.180109][ T448] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option [ 30.203358][ T448] EXT4-fs (loop2): mounted filesystem without journal. Opts: nombcache,norecovery,delalloc,resuid=0x000000000000ee01,noblock_validity,dioread_lock,grpid,quota,nomblk_io_submit,,errors=continue. Quota mode: writeback. [ 30.246432][ T450] EXT4-fs error (device loop4): ext4_acquire_dquot:6227: comm syz.4.51: Failed to acquire dquot type 0 [ 30.284566][ T457] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 30.304812][ T450] EXT4-fs (loop4): 1 truncate cleaned up [ 30.312430][ T450] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 30.355721][ T450] EXT4-fs error (device loop4): ext4_acquire_dquot:6227: comm syz.4.51: Failed to acquire dquot type 0 [ 30.369191][ T457] EXT4-fs error (device loop0): ext4_orphan_get:1406: inode #17: comm syz.0.53: inode has both inline data and extents flags [ 30.382847][ T457] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.53: couldn't read orphan inode 17 (err -117) [ 30.395239][ T457] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 30.420380][ T457] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm syz.0.53: bg 0: block 65: padding at end of block bitmap is not set [ 30.435069][ T457] EXT4-fs error (device loop0): ext4_acquire_dquot:6227: comm syz.0.53: Failed to acquire dquot type 0 [ 30.487503][ T464] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.494793][ T464] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.503338][ T457] syz.0.53 (457) used greatest stack depth: 22504 bytes left [ 30.518568][ T63] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 30.625633][ T483] netlink: 8 bytes leftover after parsing attributes in process `syz.3.64'. [ 30.629905][ T464] syz.2.55 (464) used greatest stack depth: 20064 bytes left [ 30.663954][ T477] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpjquota=,max_dir_size_kb=0x0000000000000a32,abort,,errors=continue. Quota mode: writeback. [ 30.680027][ T477] ext4 filesystem being mounted at /7/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 30.688615][ T63] usb 2-1: device descriptor read/8, error -71 [ 30.737549][ T494] netlink: 12 bytes leftover after parsing attributes in process `syz.3.68'. [ 30.884962][ T502] netlink: 20 bytes leftover after parsing attributes in process `syz.3.72'. [ 30.894318][ T502] netlink: 44 bytes leftover after parsing attributes in process `syz.3.72'. [ 30.958651][ T63] usb 2-1: device descriptor read/8, error -71 [ 31.403665][ T549] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 31.437380][ T555] set_capacity_and_notify: 5 callbacks suppressed [ 31.437396][ T555] loop3: detected capacity change from 0 to 512 [ 31.465424][ T555] EXT4-fs error (device loop3): ext4_iget_extra_inode:4604: inode #15: comm syz.3.97: corrupted in-inode xattr [ 31.478177][ T555] EXT4-fs error (device loop3): ext4_orphan_get:1411: comm syz.3.97: couldn't read orphan inode 15 (err -117) [ 31.494941][ T555] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 31.559005][ T564] device syzkaller0 entered promiscuous mode [ 31.567375][ T564] tipc: Started in network mode [ 31.577683][ T564] tipc: Node identity d659968dfbe3, cluster identity 4711 [ 31.585131][ T564] tipc: Enabled bearer , priority 0 [ 31.593386][ T564] tipc: Resetting bearer [ 31.604214][ T563] tipc: Resetting bearer [ 31.610800][ T563] tipc: Disabling bearer [ 31.618097][ T571] loop3: detected capacity change from 0 to 512 [ 31.647207][ T571] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpquota,discard,quota,,errors=continue. Quota mode: writeback. [ 31.660688][ T571] ext4 filesystem being mounted at /54/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.769520][ T586] loop2: detected capacity change from 0 to 2048 [ 31.771615][ T591] ================================================================== [ 31.783995][ T591] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3200 [ 31.792253][ T591] Read of size 8 at addr ffff888112718bc0 by task syz.1.112/591 [ 31.799899][ T591] [ 31.802215][ T591] CPU: 0 PID: 591 Comm: syz.1.112 Not tainted syzkaller #0 [ 31.809401][ T591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 31.819443][ T591] Call Trace: [ 31.822716][ T591] [ 31.825635][ T591] __dump_stack+0x21/0x30 [ 31.829957][ T591] dump_stack_lvl+0x110/0x170 [ 31.834647][ T591] ? show_regs_print_info+0x20/0x20 [ 31.839847][ T591] ? load_image+0x3f0/0x3f0 [ 31.844343][ T591] print_address_description+0x7f/0x2c0 [ 31.849879][ T591] ? tc_setup_flow_action+0x88e/0x3200 [ 31.855765][ T591] kasan_report+0x10f/0x150 [ 31.860342][ T591] ? tc_setup_flow_action+0x88e/0x3200 [ 31.865801][ T591] __asan_report_load8_noabort+0x14/0x20 [ 31.871422][ T591] tc_setup_flow_action+0x88e/0x3200 [ 31.876730][ T591] mall_replace_hw_filter+0x2db/0x8d0 [ 31.882098][ T591] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 31.888192][ T591] ? mall_set_parms+0x520/0x520 [ 31.893060][ T591] ? tcf_exts_destroy+0xb0/0xb0 [ 31.897908][ T591] ? pcpu_alloc+0x1118/0x16f0 [ 31.902601][ T591] ? mall_set_parms+0x1e4/0x520 [ 31.907472][ T591] mall_change+0x544/0x760 [ 31.911878][ T591] ? __kasan_check_write+0x14/0x20 [ 31.917434][ T591] ? mall_get+0xa0/0xa0 [ 31.921588][ T591] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 31.927484][ T591] ? mall_get+0xa0/0xa0 [ 31.931643][ T591] tc_new_tfilter+0x13df/0x1990 [ 31.936494][ T591] ? tcf_gate_entry_destructor+0x20/0x20 [ 31.942147][ T591] ? security_capable+0x87/0xb0 [ 31.947471][ T591] ? ns_capable+0x8c/0xf0 [ 31.951798][ T591] ? netlink_net_capable+0x125/0x160 [ 31.957093][ T591] ? tcf_gate_entry_destructor+0x20/0x20 [ 31.962715][ T591] rtnetlink_rcv_msg+0x83c/0xcb0 [ 31.967660][ T591] ? rtnetlink_bind+0x80/0x80 [ 31.972326][ T591] ? avc_has_perm_noaudit+0x390/0x490 [ 31.977846][ T591] ? memcpy+0x56/0x70 [ 31.981863][ T591] ? avc_has_perm_noaudit+0x30a/0x490 [ 31.987256][ T591] ? arch_stack_walk+0xee/0x140 [ 31.992105][ T591] ? avc_denied+0x1b0/0x1b0 [ 31.996603][ T591] ? stack_trace_save+0xa6/0xf0 [ 32.001449][ T591] ? avc_has_perm+0x163/0x250 [ 32.006121][ T591] ? avc_has_perm_noaudit+0x490/0x490 [ 32.011485][ T591] ? x64_sys_call+0x4b/0x9a0 [ 32.016344][ T591] ? selinux_nlmsg_lookup+0x39d/0x440 [ 32.021706][ T591] netlink_rcv_skb+0x1e9/0x430 [ 32.026459][ T591] ? rtnetlink_bind+0x80/0x80 [ 32.031125][ T591] ? netlink_ack+0xb10/0xb10 [ 32.035706][ T591] ? _copy_from_iter+0x4a4/0x10a0 [ 32.040727][ T591] ? __netlink_lookup+0x387/0x3b0 [ 32.045743][ T591] rtnetlink_rcv+0x1c/0x20 [ 32.050150][ T591] netlink_unicast+0x86c/0xa30 [ 32.054903][ T591] netlink_sendmsg+0x879/0xb80 [ 32.059658][ T591] ? netlink_getsockopt+0x530/0x530 [ 32.064846][ T591] ? security_socket_sendmsg+0x82/0xa0 [ 32.070304][ T591] ? netlink_getsockopt+0x530/0x530 [ 32.075513][ T591] ____sys_sendmsg+0x5be/0x8f0 [ 32.080270][ T591] ? __sys_sendmsg_sock+0x40/0x40 [ 32.085284][ T591] ? import_iovec+0x7c/0xb0 [ 32.089779][ T591] ___sys_sendmsg+0x236/0x2e0 [ 32.094465][ T591] ? __sys_sendmsg+0x280/0x280 [ 32.099221][ T591] ? sock_show_fdinfo+0xa0/0xa0 [ 32.104061][ T591] ? __fdget+0x1a1/0x230 [ 32.108298][ T591] __x64_sys_sendmsg+0x201/0x2d0 [ 32.113224][ T591] ? ___sys_sendmsg+0x2e0/0x2e0 [ 32.118064][ T591] ? __kasan_check_write+0x14/0x20 [ 32.123182][ T591] ? switch_fpu_return+0x15d/0x2c0 [ 32.128284][ T591] x64_sys_call+0x4b/0x9a0 [ 32.132691][ T591] do_syscall_64+0x4c/0xa0 [ 32.137102][ T591] ? clear_bhb_loop+0x50/0xa0 [ 32.141778][ T591] ? clear_bhb_loop+0x50/0xa0 [ 32.146445][ T591] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 32.152341][ T591] RIP: 0033:0x7f841a60ae99 [ 32.156764][ T591] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.176362][ T591] RSP: 002b:00007f8419064028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 32.184804][ T591] RAX: ffffffffffffffda RBX: 00007f841a892fa0 RCX: 00007f841a60ae99 [ 32.192779][ T591] RDX: 0000000020000000 RSI: 0000200000000580 RDI: 0000000000000006 [ 32.200750][ T591] RBP: 00007f841a6a0eaf R08: 0000000000000000 R09: 0000000000000000 [ 32.208717][ T591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.216688][ T591] R13: 00007f841a893038 R14: 00007f841a892fa0 R15: 00007fffd398bc08 [ 32.224664][ T591] [ 32.227683][ T591] [ 32.230001][ T591] Allocated by task 591: [ 32.234236][ T591] __kasan_kmalloc+0xd4/0x100 [ 32.238922][ T591] __kmalloc+0x13d/0x2c0 [ 32.243164][ T591] tcf_idr_create+0x5f/0x790 [ 32.247752][ T591] tcf_idr_create_from_flags+0x61/0x70 [ 32.253208][ T591] tcf_gact_init+0x342/0x570 [ 32.257799][ T591] tcf_action_init_1+0x3fd/0x6b0 [ 32.262742][ T591] tcf_action_init+0x233/0x7a0 [ 32.267526][ T591] tcf_exts_validate+0x24a/0x580 [ 32.272513][ T591] mall_set_parms+0x48/0x520 [ 32.277194][ T591] mall_change+0x478/0x760 [ 32.281606][ T591] tc_new_tfilter+0x13df/0x1990 [ 32.286455][ T591] rtnetlink_rcv_msg+0x83c/0xcb0 [ 32.291399][ T591] netlink_rcv_skb+0x1e9/0x430 [ 32.296159][ T591] rtnetlink_rcv+0x1c/0x20 [ 32.300572][ T591] netlink_unicast+0x86c/0xa30 [ 32.305340][ T591] netlink_sendmsg+0x879/0xb80 [ 32.310101][ T591] ____sys_sendmsg+0x5be/0x8f0 [ 32.314860][ T591] ___sys_sendmsg+0x236/0x2e0 [ 32.319596][ T591] __x64_sys_sendmsg+0x201/0x2d0 [ 32.324539][ T591] x64_sys_call+0x4b/0x9a0 [ 32.328953][ T591] do_syscall_64+0x4c/0xa0 [ 32.333385][ T591] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 32.339298][ T591] [ 32.341621][ T591] The buggy address belongs to the object at ffff888112718b00 [ 32.341621][ T591] which belongs to the cache kmalloc-192 of size 192 [ 32.355670][ T591] The buggy address is located 0 bytes to the right of [ 32.355670][ T591] 192-byte region [ffff888112718b00, ffff888112718bc0) [ 32.369294][ T591] The buggy address belongs to the page: [ 32.374917][ T591] page:ffffea000449c600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112718 [ 32.385156][ T591] flags: 0x4000000000000200(slab|zone=1) [ 32.390791][ T591] raw: 4000000000000200 0000000000000000 0000001000000001 ffff888100042c00 [ 32.399457][ T591] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 32.408027][ T591] page dumped because: kasan: bad access detected [ 32.414431][ T591] page_owner tracks the page as allocated [ 32.420135][ T591] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 112, ts 4821907860, free_ts 0 [ 32.435149][ T591] post_alloc_hook+0x192/0x1b0 [ 32.439913][ T591] prep_new_page+0x1c/0x110 [ 32.444412][ T591] get_page_from_freelist+0x2c3a/0x2cd0 [ 32.449952][ T591] __alloc_pages+0x1a2/0x460 [ 32.454543][ T591] new_slab+0xa0/0x4d0 [ 32.458641][ T591] ___slab_alloc+0x3ac/0x840 [ 32.463236][ T591] __slab_alloc+0x49/0x90 [ 32.467562][ T591] kmem_cache_alloc_trace+0x146/0x270 [ 32.472930][ T591] kernfs_fop_open+0x375/0xbb0 [ 32.477703][ T591] do_dentry_open+0x82a/0x1010 [ 32.482487][ T591] vfs_open+0x73/0x80 [ 32.486482][ T591] path_openat+0x26e6/0x2f80 [ 32.491244][ T591] do_filp_open+0x1df/0x400 [ 32.495745][ T591] do_sys_openat2+0x15e/0x7f0 [ 32.500418][ T591] __x64_sys_openat+0x136/0x160 [ 32.505262][ T591] x64_sys_call+0x219/0x9a0 [ 32.509765][ T591] page_owner free stack trace missing [ 32.515124][ T591] [ 32.517440][ T591] Memory state around the buggy address: [ 32.523072][ T591] ffff888112718a80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.531132][ T591] ffff888112718b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.539311][ T591] >ffff888112718b80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 32.547367][ T591] ^ [ 32.553509][ T591] ffff888112718c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.561574][ T591] ffff888112718c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.569630][ T591] ================================================================== [ 32.577790][ T591] Disabling lock debugging due to kernel taint [ 32.589603][ T595] netlink: 12 bytes leftover after parsing attributes in process `syz.0.114'. [ 32.600997][ T596] netlink: 24 bytes leftover after parsing attributes in process `syz.0.114'. [ 32.624332][ T597] netlink: 12 bytes leftover after parsing attributes in process `syz.0.114'. [ 32.635155][ T586] EXT4-fs (loop2): mounted filesystem without journal. Opts: quota,auto_da_alloc=0x0000000000000005,errors=remount-ro,sysvgroups,. Quota mode: writeback. [ 32.650829][ T20] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 32.654754][ T586] EXT4-fs error (device loop2): ext4_find_extent:929: inode #2: comm syz.2.111: pblk 1 bad header/extent: invalid magic - magic 2, entries 0, max 3(0), depth 0(4) [ 32.675024][ T586] EXT4-fs (loop2): Remounting filesystem read-only [ 32.684580][ T586] EXT4-fs error (device loop2): ext4_ext_precache:608: inode #2: comm syz.2.111: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 5(5) [ 32.702527][ T586] EXT4-fs (loop2): Remounting filesystem read-only [ 33.018594][ T20] usb 5-1: unable to get BOS descriptor or descriptor too short [ 33.138542][ T20] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 33.146222][ T20] usb 5-1: can't read configurations, error -71