last executing test programs: 35.995655211s ago: executing program 3 (id=139): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x37, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x488c, 0x10000, 0x0, 0x1, 0x8, 0x20002, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000500)=0x80c, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000080)='9p_client_res\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="022200d3", @ANYRES16=r3, @ANYBLOB="000427bd7000fddbdf25100000000800090005000000080008000000008008000800060000000800060007000000080009009700000008000900ff000000"], 0x44}, 0x1, 0x0, 0x0, 0x40080c5}, 0x40) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x4, 0x4, 0xc}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18040000000000000000000000400000850000000800000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r4}, &(0x7f0000000000), &(0x7f0000000200)=r5}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001300)={&(0x7f0000000180)='kfree\x00', r5}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmmsg(r6, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0xffffffffffffffa7}}], 0xf00, 0x4c42bb4f92, 0x0) shutdown(r6, 0x0) syz_io_uring_setup(0x10b, &(0x7f0000000580)={0x0, 0xd736, 0x8, 0x1, 0x248}, &(0x7f00000003c0)=0x0, &(0x7f0000000340)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f00000002c0)=0x9, 0x0, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x94, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r8, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x64, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x22, 0x1, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x100}, 0x40) 35.814134253s ago: executing program 3 (id=141): write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0x4e, 0x0, &(0x7f0000000400)="25a71b0e3e76550147712e7ffbc9a135339b1f1a0e408fc972821527fade4680b9fcbb49c5123203f39edb653a4d5237290d2001c8580cd85a0ded38ca5d5c7c03289a30d0c35cd4b47edb64d600", 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) recvmmsg(r1, &(0x7f00000006c0)=[{{0x0, 0x0, 0x0}, 0xa1}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000540)=""/174, 0xae}], 0x1}, 0x1ff}], 0x2, 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3000001, 0x31, 0xffffffffffffffff, 0x0) close(r0) r3 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0xfffffffffffffdc6, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0xa4, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r4, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x2}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x8, 0x4, 0x2, 0x0, 0x8, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10}]}}]}, 0xa4}}, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000a80)={r3, 0x58, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x15, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', r5, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000100)='host1x_cdma_push\x00', r7, 0x0, 0x6}, 0x18) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xc8, 0x0, 0x0, 0xb}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000007c0)=ANY=[@ANYBLOB="440000001000010828bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000042004001c002b80080003001900000008000100cbe2f0f40fa1b0234be928c1f8b057835d1f0eff96a8450fe5a7e0a6be91aca444c35ee3170694f15cfa62e4370c2c996fee2ffc837a27aa1690f7bcaa92ac5fefe2df88707337e8fdb08440bb3da623e35289518861ecdc1cb7196f1b7f1a03370c34185af0c54787ab1403942bbb5293bfbd7224979bc5c1d08aeefaefddc1565c9948ed", @ANYRES32, @ANYBLOB='\b\x00\b\x00', @ANYRES32=r8, @ANYBLOB="08001b0000000000"], 0x44}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xb, &(0x7f00000009c0)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x8, &(0x7f0000006680)) lsm_list_modules(0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(0x0, &(0x7f0000000300), &(0x7f0000000040)=ANY=[], 0xfe37, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) io_setup(0x7d, &(0x7f0000000600)=0x0) io_submit(r9, 0x1, &(0x7f0000001d00)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000)="96", 0x1, 0x2000}]) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000280)={r4, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) 34.956008086s ago: executing program 3 (id=151): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x400000000000004) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000200180000000000000000000850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x1000000, 0x4) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000180)="480000001400190d7ebdeb75fd0d9c562c84d8c033aae421962ea6ff3cd3c461ebe430a2ed7a80ffe0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6", 0x48}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c"], 0x48) gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) set_mempolicy(0x3, &(0x7f00000000c0)=0x5, 0xa) r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) r4 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000770000000e000000850000002a00000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000380)='page_pool_state_release\x00', r5}, 0x18) timer_create(0x2, 0x0, &(0x7f0000000480)=0x0) timer_delete(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r4, 0x0) write$selinux_load(r3, &(0x7f0000000000)=ANY=[], 0xffa8) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, &(0x7f0000000000), 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x5, 0x3, &(0x7f0000000500)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x3}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xf536, 0x400, 0x2, 0x8b6}, &(0x7f0000000000), &(0x7f0000000300)) kexec_load(0x0, 0x0, &(0x7f0000000180), 0x160000) r7 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x202, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0xfd, 0x0, 0x7ffc9ffb}]}) r8 = timerfd_create(0x9, 0x80000) timerfd_gettime(r8, &(0x7f00000007c0)) write$cgroup_int(r7, 0x0, 0x0) fcntl$setlease(r1, 0x400, 0x2) 34.566188782s ago: executing program 3 (id=160): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0900000004000000080000000c"], 0x50) futimesat(0xffffffffffffffff, 0x0, 0xfffffffffffffffd) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000004b704000000000000850000000300000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e985fe4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000180)='kfree\x00', r1}, 0x18) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xb, &(0x7f0000000980)=ANY=[@ANYBLOB="180000000000000000000000a9000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r2, 0x0, 0x800004}, 0x18) r3 = io_uring_setup(0xf08, &(0x7f0000000780)={0x0, 0x8064b5, 0x10, 0x1, 0x5}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000280)=[{0x0}], 0x1) syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46) io_uring_register$IORING_REGISTER_FILES(r3, 0x1e, &(0x7f0000000000)=[r3], 0x1) syz_mount_image$vfat(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x2bc3c1f, 0xffffffffffffffff, 0x7, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x6, &(0x7f00000008c0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000e868495fb58d00b6ad1f50ad32d6ad25dfd73a015e0ca6a0f68a7d007dc6751dfb265a0e3ccae669e173a64bc1cfd514600650a58f145ff1205fc9ddaa275e687d452d64e7cc957d77578f4c25235138d5521f9453559c35da860e8efbc64e57cbb7aee976f2b54421eed73d5661cfeecf9c66c54c3b3ffe1b4ce25d7c983cd44c05bd0a48dfe3e26e7a23129d6606ed28a69989d552af6d9a9df2c3af36e0360070011bbecc2f4a3799af2551ce935b0f327cb3f011a7d06602e2fd5234712596b696418f163d1a1a83109753f54b21cd027edd68149ee99eebc6f7d6dd4aed4af7588c8e1b44ccb19e810879b81a7000000e7ffffff00000000d7900a820b63278f4e9a217b98ef7042ad2a928903000000cbe43a1ed25268816b00000000000009d27d753a30a147b24a48435bd8a568669596e9e0867958e1dd7a0defb6670c06054002238260000000000040587c1ed797aa21a38e1e389f640a0b8b0000000000a835ad0f61ba739cd0c31b05c00fba8a4aee676d7caa2e53b91a68ff2e60da7b01a2e5785a238afa4aba70c08b0d71b6f72d6a8d87fb08533d97ad96d3943c4cc8306dac433a5cdf78b04963d679d5a5d07e618a1ef9057fec00f9e93021f5a8d30e716de8cde9c6000000000c3b64d10f0939b42b33ab2a8717096c58bb3bb1d457d8bb96870f5a7e2ba31fd69bb80235d957eaa9a40b764e5381ffa604aaafb76a980e72b408f686b185736693089213b4e140f8f38e5589663115093889deb646122a5dc5a9e5ba4d37749a36b880110e2bf524b79bc91105f1d3f7d0de694a9417d68694f17ba5e27ea1cec518b93fadcfe0de010ae9be3273ff73c34b5695080a35bfa5c69e3b533e1b939c81b3beda037b7191cb0000000000000000000010e5d683b8938db5c305cf7e6e62a6890ba9e1f4ee64f8202b59de5036569febfaa95f4633db108b2f786333ec7bacc927f4a1785165b5d2444b4c022bb5cff472e6a0c8ee9d6d8df83b704669147b732ac508c9b9f0ca0a1ce45319d43d4643eb285835daf2065b57bebd61ad6671296c27253a5f9688d57c91ccd40ffe2dbc5dd1613a2e6f5b363cc8d205ce6ef3c3c6ded7dd3dfdb39008d8997213f68cdc971c1d6fdacb7729a5560880a77525e9cfb94ef1735dfe74e6b948697f7e3580436b532a82e315d56b17a5dba98436cc24babaae409f0aab0b40af116001bc85492455956e853ead08b5793d4ecf72378a3dfd9cc837b1c66212d9a2be8fd6341c2f837c7fe09924a51ec42912856cce3d3b2d092c80813aad03e1e63a655f4138730f302df339f30a4fbd453c9a0fba381d071ad7cb80a52bec572e29b0b9b55c235806b97e166609f8083ce776075c"], &(0x7f0000000380)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r4}, 0x10) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00', 0x0}) bind$packet(r5, &(0x7f0000000280)={0x11, 0x11, r6, 0x1, 0x3, 0x6, @local}, 0x14) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x4004, &(0x7f0000000080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$packet(r5, &(0x7f0000000100)={0x11, 0x17, r6, 0x1, 0x8, 0x6, @remote}, 0x14) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) r7 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$TIOCSSOFTCAR(r7, 0x541a, &(0x7f0000000300)=0x7) open_tree(0xffffffffffffff9c, &(0x7f0000000500)='./file0/../file0\x00', 0x89901) 33.482816129s ago: executing program 3 (id=167): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'team_slave_0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0200001900010000ffea0010000000e0000001000000000000000000000000ac1414bb00000000000000000000000000000000ffff00000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000084010500ac1414aa000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000ac1414aa000000000000000000000000000000003c00000000000000fe80000000000000000000000000000000000000000000000008000000000000000000007f000001000000000000000000000000000000003200000000000000e00000010000000000000000000000000000800003030000000000000000000000000000ff0100000000000000000000000000010000000033"], 0x23c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="051b00000000000000024400000008000300", @ANYRES32=r7, @ANYBLOB="0a0018000303030303030000080026006c090000"], 0x30}}, 0x0) sendmsg$NL80211_CMD_DEL_MPATH(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x70, r4, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x1, 0x57}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x20000040) r8 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), r0) syz_mount_image$vfat(&(0x7f0000000440), &(0x7f0000000000)='./file1\x00', 0x844, &(0x7f0000000bc0)=ANY=[], 0x5, 0x267, &(0x7f0000000740)="$eJzs3b9rVFkUAOAzmcmvbSYsCwvLLjuwLGw1JIHtsyy7bNigYhgkIsGJmUjIhICBgBZJrAQrG0vLdBFBCzv9HwQbG7ERS9NZSJ4kL0xmzEQTMfMk833NPbx7znv33vDeyxRz5/LPiwuzS8tzW1uvY2AgF4Wxq9tJkouh6Il8pNYDADhN3iVJvE1SWY8FAOgM738A6D6Hvf//60nb3rQ5l8XYAICT8eWf/+9OPXlZrY39eYTUpL8Rvpg+/hgBgK9rcuri/9tPfx8cj0d3IhZvrVRWKmmb9v81F/NRj1oMRzHeRyQNafzv+MQ/w6UdgxGVxbW9+rWVSr61fiSKMRRx4czB+pFSqrW+N75rrh+NYvzQ/vqjbev74o/fmurLUYxnV2Ip6jG78y9JU/3qSKn099mJj+r7d/NiI5/p3wcAAAAAAAAAAAAAAAAAAAAAgNOpXGoYard/T7l8WH9af/T9gfb357m9W1+InwpxM9vZAwAAAAAAAAAAAAAAAAAAwLdh+fqNhWq9XrvWCGbOz3/feuRzQa5NV37v/Mc5T9cEOwtzgpf4NSJOehYPN2vPN6YvTWa/mB0M2q/qg8wHNvOJnJ6I2A1+vDdWfbz66s3BnFhvupcL6X1bradtX/PDotThhxMAAAAAAAAAAAAAAAAAAHSZ/a8BH5aRdHZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJCB/d//P3bQ1ziyOZierNH1y0Bzctp5v+W6ufUMJgsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQNf6EAAA//9rIKjm") r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r10}, 0x10) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)={0x60, r8, 0x1, 0x50bd29, 0x0, {0x1, 0x6c00000000000000}, [{{0x8, 0x1, r3}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x700}}, {0x8, 0x6, r1}}}]}}]}, 0x60}, 0x1, 0xf000, 0x0, 0x4008000}, 0x810) 32.806871569s ago: executing program 3 (id=171): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="d80000001c0081064e81f782db44b9040a1d08040000000000000aa1180002000607002603600e12080b0f0000810401a8001605200001400200000803604e0cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee422fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef5d2defd5ccae8d3fb7c27a1059ae31c60e2234d732", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) (fail_nth: 4) 32.806606709s ago: executing program 32 (id=171): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="d80000001c0081064e81f782db44b9040a1d08040000000000000aa1180002000607002603600e12080b0f0000810401a8001605200001400200000803604e0cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee422fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef5d2defd5ccae8d3fb7c27a1059ae31c60e2234d732", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) (fail_nth: 4) 32.10974181s ago: executing program 0 (id=181): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x3, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kfree\x00', r1}, 0x18) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @multicast2}, 0x1, 0x0, 0x9}}, 0x2e) 32.012997181s ago: executing program 0 (id=183): r0 = socket$unix(0x1, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r1}, &(0x7f0000000800), &(0x7f0000000840)=r2}, 0x20) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r4 = socket$can_bcm(0x1d, 0x2, 0x2) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000002c0)='mm_page_alloc\x00', r5}, 0x10) connect$can_bcm(r4, &(0x7f0000000200)={0x1d, r3}, 0x10) sendmsg$can_bcm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r3, @ANYRES64=r0, @ANYBLOB="3bf81bb9e9"], 0x20000600}}, 0x0) 31.989215122s ago: executing program 0 (id=184): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x37, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x488c, 0x10000, 0x0, 0x1, 0x8, 0x20002, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000500)=0x80c, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000080)='9p_client_res\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="022200d3", @ANYRES16=r3, @ANYBLOB="000427bd7000fddbdf25100000000800090005000000080008000000008008000800060000000800060007000000080009009700000008000900ff000000"], 0x44}, 0x1, 0x0, 0x0, 0x40080c5}, 0x40) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x4, 0x4, 0xc}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18040000000000000000000000400000850000000800000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r4}, &(0x7f0000000000), &(0x7f0000000200)=r5}, 0x20) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000180)=@IORING_OP_STATX={0x15, 0xa, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x80, 0x6000}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x94, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x64, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x22, 0x1, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x100}, 0x40) 31.917740773s ago: executing program 0 (id=185): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0900000004000000080000000c"], 0x50) futimesat(0xffffffffffffffff, 0x0, 0xfffffffffffffffd) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000004b704000000000000850000000300000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e985fe4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000180)='kfree\x00', r1}, 0x18) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xb, &(0x7f0000000980)=ANY=[@ANYBLOB="180000000000000000000000a9000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r2, 0x0, 0x800004}, 0x18) r3 = io_uring_setup(0xf08, &(0x7f0000000780)={0x0, 0x8064b5, 0x10, 0x1, 0x5}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000280)=[{0x0}], 0x1) syz_clone3(&(0x7f0000000000)={0x285002400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x46) io_uring_register$IORING_REGISTER_FILES(r3, 0x1e, &(0x7f0000000000)=[r3], 0x1) syz_mount_image$vfat(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x2bc3c1f, 0xffffffffffffffff, 0x7, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x6, &(0x7f00000008c0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000e868495fb58d00b6ad1f50ad32d6ad25dfd73a015e0ca6a0f68a7d007dc6751dfb265a0e3ccae669e173a64bc1cfd514600650a58f145ff1205fc9ddaa275e687d452d64e7cc957d77578f4c25235138d5521f9453559c35da860e8efbc64e57cbb7aee976f2b54421eed73d5661cfeecf9c66c54c3b3ffe1b4ce25d7c983cd44c05bd0a48dfe3e26e7a23129d6606ed28a69989d552af6d9a9df2c3af36e0360070011bbecc2f4a3799af2551ce935b0f327cb3f011a7d06602e2fd5234712596b696418f163d1a1a83109753f54b21cd027edd68149ee99eebc6f7d6dd4aed4af7588c8e1b44ccb19e810879b81a7000000e7ffffff00000000d7900a820b63278f4e9a217b98ef7042ad2a928903000000cbe43a1ed25268816b00000000000009d27d753a30a147b24a48435bd8a568669596e9e0867958e1dd7a0defb6670c06054002238260000000000040587c1ed797aa21a38e1e389f640a0b8b0000000000a835ad0f61ba739cd0c31b05c00fba8a4aee676d7caa2e53b91a68ff2e60da7b01a2e5785a238afa4aba70c08b0d71b6f72d6a8d87fb08533d97ad96d3943c4cc8306dac433a5cdf78b04963d679d5a5d07e618a1ef9057fec00f9e93021f5a8d30e716de8cde9c6000000000c3b64d10f0939b42b33ab2a8717096c58bb3bb1d457d8bb96870f5a7e2ba31fd69bb80235d957eaa9a40b764e5381ffa604aaafb76a980e72b408f686b185736693089213b4e140f8f38e5589663115093889deb646122a5dc5a9e5ba4d37749a36b880110e2bf524b79bc91105f1d3f7d0de694a9417d68694f17ba5e27ea1cec518b93fadcfe0de010ae9be3273ff73c34b5695080a35bfa5c69e3b533e1b939c81b3beda037b7191cb0000000000000000000010e5d683b8938db5c305cf7e6e62a6890ba9e1f4ee64f8202b59de5036569febfaa95f4633db108b2f786333ec7bacc927f4a1785165b5d2444b4c022bb5cff472e6a0c8ee9d6d8df83b704669147b732ac508c9b9f0ca0a1ce45319d43d4643eb285835daf2065b57bebd61ad6671296c27253a5f9688d57c91ccd40ffe2dbc5dd1613a2e6f5b363cc8d205ce6ef3c3c6ded7dd3dfdb39008d8997213f68cdc971c1d6fdacb7729a5560880a77525e9cfb94ef1735dfe74e6b948697f7e3580436b532a82e315d56b17a5dba98436cc24babaae409f0aab0b40af116001bc85492455956e853ead08b5793d4ecf72378a3dfd9cc837b1c66212d9a2be8fd6341c2f837c7fe09924a51ec42912856cce3d3b2d092c80813aad03e1e63a655f4138730f302df339f30a4fbd453c9a0fba381d071ad7cb80a52bec572e29b0b9b55c235806b97e166609f8083ce776075c"], &(0x7f0000000380)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r4}, 0x10) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth1_to_team\x00', 0x0}) bind$packet(r5, &(0x7f0000000280)={0x11, 0x11, r6, 0x1, 0x3, 0x6, @local}, 0x14) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x4004, &(0x7f0000000080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$packet(r5, &(0x7f0000000100)={0x11, 0x17, r6, 0x1, 0x8, 0x6, @remote}, 0x14) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) r7 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$TIOCSSOFTCAR(r7, 0x541a, &(0x7f0000000300)=0x7) open_tree(0xffffffffffffff9c, &(0x7f0000000500)='./file0/../file0\x00', 0x89901) 31.40303994s ago: executing program 0 (id=189): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='scsi_dispatch_cmd_start\x00', r1}, 0x10) r2 = socket$inet(0x2, 0x3, 0x1) setsockopt$sock_int(r2, 0x1, 0x5, &(0x7f0000000340)=0x6, 0x4) sendmsg$inet(r2, &(0x7f0000001040)={&(0x7f0000000040)={0x2, 0xffff, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0x20000004) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000012c0)='scsi_dispatch_cmd_start\x00', r3}, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 29.44487933s ago: executing program 0 (id=199): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x31) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="b40800000000000073119a00000000008510000002000000b7000000000000009500c200000000009500"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) r1 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) fcntl$lock(r1, 0x7, &(0x7f0000000400)={0x1, 0x1, 0x14, 0x3}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) futex(0x0, 0x3, 0x0, &(0x7f0000fd7ff0), 0x0, 0xfffffffd) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f0000"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r2}, &(0x7f0000000000), &(0x7f0000000040)=r3}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000001c0)='sched_switch\x00'}, 0x10) creat(&(0x7f0000000040)='./bus\x00', 0x8) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0) read$hiddev(r4, &(0x7f00000000c0)=""/4092, 0xffc) statfs(&(0x7f0000001380)='./bus\x00', &(0x7f00000013c0)=""/23) mount(&(0x7f0000000100), &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000300)='trans=rdma,') setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000c80)=@raw={'raw\x00', 0x3c1, 0x3, 0x4c0, 0x2e0, 0x940c, 0x3002, 0x2e0, 0x2c0, 0x3f0, 0x3d8, 0x3d8, 0x3f0, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0x298, 0x2e0, 0x4001, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x4001, 0x1, 0x3, 'syz0\x00'}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x2, 0x0, 'syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'virt_wifi0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x1, 0xbe, {0x565159d7}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x520) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000980)='mm_page_free\x00', r5}, 0x18) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMIWAIT(r6, 0x5453, 0x7cb7562f2d67) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x20000376, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000020b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 29.426703981s ago: executing program 33 (id=199): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x31) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="b40800000000000073119a00000000008510000002000000b7000000000000009500c200000000009500"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) r1 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) fcntl$lock(r1, 0x7, &(0x7f0000000400)={0x1, 0x1, 0x14, 0x3}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) futex(0x0, 0x3, 0x0, &(0x7f0000fd7ff0), 0x0, 0xfffffffd) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f0000"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r2}, &(0x7f0000000000), &(0x7f0000000040)=r3}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000001c0)='sched_switch\x00'}, 0x10) creat(&(0x7f0000000040)='./bus\x00', 0x8) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0) read$hiddev(r4, &(0x7f00000000c0)=""/4092, 0xffc) statfs(&(0x7f0000001380)='./bus\x00', &(0x7f00000013c0)=""/23) mount(&(0x7f0000000100), &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000300)='trans=rdma,') setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000c80)=@raw={'raw\x00', 0x3c1, 0x3, 0x4c0, 0x2e0, 0x940c, 0x3002, 0x2e0, 0x2c0, 0x3f0, 0x3d8, 0x3d8, 0x3f0, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0x298, 0x2e0, 0x4001, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x4001, 0x1, 0x3, 'syz0\x00'}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x2, 0x0, 'syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'virt_wifi0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x1, 0xbe, {0x565159d7}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x520) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000980)='mm_page_free\x00', r5}, 0x18) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMIWAIT(r6, 0x5453, 0x7cb7562f2d67) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x20000376, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000020b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 18.023352755s ago: executing program 6 (id=318): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x400000000000004) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000200180000000000000000000850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x1000000, 0x4) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000180)="480000001400190d7ebdeb75fd0d9c562c84d8c033aae421962ea6ff3cd3c461ebe430a2ed7a80ffe0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6", 0x48}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c"], 0x48) gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) set_mempolicy(0x3, &(0x7f00000000c0)=0x5, 0xa) r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) r4 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000770000000e000000850000002a00000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000380)='page_pool_state_release\x00', r5}, 0x18) timer_create(0x2, 0x0, &(0x7f0000000480)=0x0) timer_delete(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r4, 0x0) write$selinux_load(r3, &(0x7f0000000000)=ANY=[], 0xffa8) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, &(0x7f0000000000), 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x5, 0x3, &(0x7f0000000500)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x3}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xf536, 0x400, 0x2, 0x8b6}, &(0x7f0000000000)=0x0, &(0x7f0000000300)) kexec_load(0x0, 0x0, &(0x7f0000000180), 0x160000) r8 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x202, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0xfd, 0x0, 0x7ffc9ffb}]}) timerfd_create(0x9, 0x80000) write$cgroup_int(r8, 0x0, 0x0) fcntl$setlease(r1, 0x400, 0x2) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) 17.407193635s ago: executing program 6 (id=333): prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x2, 0x5}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000240)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x109}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000280)='kmem_cache_free\x00', r1}, 0x18) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x6a1c2, 0x50) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x5) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r5}, 0x18) close(r3) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000340)='wg2\x00', 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x2000008, &(0x7f00000003c0), 0xfc, 0x53e, &(0x7f0000000940)="$eJzs3UFvI1cdAPD/eO3d7G62SYEDVGoptGi3grWThrYRh1IkBKdKiMJ5CYkTRXHiKHbaTVRB9hMgIQRInODCBYkPgIRW4sKxQqoEZ5CKQIhuQYIDdJDtcRKcceKsnHjX+f2kybz3xjP/9xy/8YznaSaAC+vZiHgtIj5M0/SFiJjKygvZFHudqfW6Dx68vdiakkjTN/6eRJKVdbeVZPPr2WoTEfH1r0Z8Ozkat7Gzu7ZQqxW7+UpzfbPS2Nm9vbq+sFJdqW7Mzc2+PP/K/EvzM0Np542IePXLf/7h937+lVd//bm3/nTnr7e+06rWZLb8cDtOqXjcwk7TS1cmelbYeshgj6JWe0rdzNXB1rl3hvUBAKC/1jH+RyLi0xHxQkzFpeMPZwEAAIDHUPrFyfhPEpHmu9ynHAAAAHiMFNpjYJNCORsLMBmFQrncGcP7sbhWqNUbzc8u17c3ljpjZaejVFherVVnsrHC01FKWvnZdvog/2JPfi4inoyIH0xdbefLi/Xa0qh//AAAAIAL4nrP+f8/pzrn/wAAAMCYmT5+8dR51QMAAAA4Oyec/wMAAABjwPk/AAAAjLWvvf56a0q7z79eenNne63+5u2lamOtvL69WF6sb22WV+r1lfY9+9ZP2l6tXt/8fGxs3600q41mpbGze2e9vr3RvLMaE+fSIAAAAOCIJz95/w9JROx94Wp7ark86koB56K4n0qyeU7v/+MTnfl751Qp4FxcGuA1713JL3ecAI+3Ym9Bn74OjJ/SqCsAjFxywvKewTvX9lPvZPNPDb9OAADAcN38RP71/5OvC+wVzqF6wBnSieHi6vmeTz3rBy6O9vX/QQfyOFiAsVIaaAQgMM5Oef3/wDuDRkjTU1UIAAAYusn2lBTK2c97k1EolMsRN9qPBSgly6u16kxEPBERv58qXWnlZ9trJieeMwAAAAAAAAAAAAAAAAAAAAAAAAAAHWmaRAoAAACMtYjCX5LfdO7lf3Pq+cne3wcuJ/9uPxL4ckS89ZM3fnR3odncmm2Vv79f3vxxVv7iKH7BAAAAAHp1z9Pb83+NujYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjJsPHry92J0GePnVYcX925ciYjovfjEm2vOJKEXEtX8kUTy0XhIRl4YQf+9eRHw8L37SqtZ+yLz4w3gTTogf09m7kBf/+hDiw0V2v7X/eS2v/xXi2fY8v/8VI/4v/7D67/9if/93qU//vzFgjKfe/WWlb/x7EU8V8/c/3fhJn/jPDRj/W9/Y3e23LP1pxM3u9097j3c4wkGq0lzfrDR2dm+vri+sVFeqG3Nzsy/PvzL/0vxMZXm1Vs3+5sb4/tO/+vC49l/L/f5Lstr0b//zOdvL+07677t3H3y0m9k7Gv/Wcznxf/uz7BVH4xeyOJ/J0kn2XrXTe53387BnfvG7Z45r/9JB+0un+f/f6rfRXkc6ytODfnQAgDPQ2NldW6jVqltjm2idpT8C1bjoiW++/wh+2L471A2maZq2+lTOovsRMch2khhySwv59TlI9P2njHrPBAAADNvBQf+oawIAAAAAAAAAAAAAAAAAAAAX13ncZa035sEtkJNh3EIbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAo/hcAAP//A/7SsQ==") 17.089930879s ago: executing program 6 (id=327): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x8, 0x3, 0x220, 0xb8, 0x43, 0xa0, 0xb8, 0x98, 0x188, 0x178, 0x178, 0x188, 0x178, 0x49, 0x0, {[{{@ip={@empty=0x5107, @multicast2, 0xff000000, 0x0, 'caif0\x00', 'ip6erspan0\x00', {0xff}, {}, 0x9, 0x3}, 0x12a, 0x70, 0xb8, 0x0, {0x0, 0x7a010000}}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x0, 0xc, {0x7}}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0xe, 0x4, 0x1, 0x0, 0x3, 0x4], 0x0, 0x9}, {0x3, [0x0, 0x1, 0x5, 0x7], 0x4, 0x4}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x280) 16.974807701s ago: executing program 6 (id=329): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x50) unshare(0x20000600) r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0xa04710, &(0x7f0000000280)={[{@user_xattr}, {@i_version}, {@noblock_validity}, {@abort}, {@mblk_io_submit}, {@nogrpid}, {@jqfmt_vfsv0}, {@delalloc}, {@nolazytime}]}, 0x0, 0x448, &(0x7f0000000740)="$eJzs28tvG8UfAPDvrpP29+sroZRHS4FAQUQ8kiYt0AMXEEgcQEKCQzkGJ61K3QY1QaJVBAGhckSVuCOOSPwFnOCCgBMSV7ijShXk0sIpaNe7qePGbh4OTuPPR9p2xjv2zNez453d2QTQs4ayf5KIPRHxW0QM1LPLCwzV/7uxMFf9e2GumsTi4pt/Jnm56wtz1bJo+b7dRWY4jUg/TYpKlpu5eOnsRK02daHIj86ee2905uKlZ86cmzg9dXrq/PiJE8ePjT3/3Pizqw8mSVru2pu19dCH04cPvvr2lderJ6+889M3Wek9xf7GODYibUgPZYH/tZhrLvd4JyrbQvY2pJO+25dha6hERNZd/fn4H4hK3Oy8gXjlk642DthU2blpZ+vd84vANpZEt1sAdEd5os+uf8vtP5p6bAnXXqxfAF1P5qo3FupbfU/f0rV8/yZeuw5FxMn5f77MtujgfQgAgFa+y+Y/T680/0vj3oZy+4q1ocGIuCsi9kfE3RFxICLuicjL3hcR999SQ9q2/ualoVvnP+nVdQe3Ctn874VibWv5/G+p3YOVIrc3j78/OXWmNnW0+E6Go39nlh9rU8f3L//6eat9jfO/bMvqL+eCRTuu9jXdoJucmJ3IJ6UdcO3jiEN9K8WfLK0EJBFxMCIOre2j95WJM09+fbhVodvH30aLdaa1WPwq4ol6/89HU/ylpP365Oj/ojZ1dLQ8Km718y+X32hV/4bi74Cs/3ctP/6biwwmjeu1M2uv4/Lvn7W8plnv8b8jeSvvlx3Fax9MzM5eGIvYkbyW55e9Pn7zvWW+LJ/FP3xk5fG/v3hPVs8DEZEdxA9GxEMR8XDR9kci4tGIONIm/h9feuzd9ce/ubL4J1f8/Vs6/pv6f+2Jytkfvm1V/+r6/3ieGi5eyX//bmO1DdzIdwcAAAB3ijR/Bj5JR5bSaToyUn+G/0DsSmvTM7NPnZp+//xk/Vn5wehPyztdAw33Q8eS+eIT6/nx4l5xuf9Ycd/4i8r/8/xIdbo22eXYodftbjH+M39Uut06YNN1YB0NuEM1j//2j2wA24nzP/Qu4x96l/EPvWul8f9RU95aAGxPzv/Qu4x/6F3GP/Qu4x960kb+rl+ilxORbolmSGxSotu/TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ3xbwAAAP//Q+vspg==") fadvise64(r1, 0xf, 0x7, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bf"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r3, &(0x7f00000006c0)=[{{&(0x7f0000000000)={0xa, 0x40, 0x0, @private0={0xfc, 0x0, '\x00', 0xfe}}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000080)="18", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r3, 0x1) getsockopt$inet_sctp6_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = perf_event_open(&(0x7f00000004c0)={0x2, 0x80, 0x37, 0x1, 0x0, 0x0, 0x0, 0x7, 0x505b8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x586e, 0x2, @perf_config_ext={0x6, 0x400000008}, 0x4c58, 0x5, 0x0, 0x1, 0x2, 0x20005, 0x10, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000000, 0x13, r5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_clone(0x41980100, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$unix(r7, &(0x7f000009dec0)=[{{&(0x7f0000000600)=@file={0x0, './file1\x00'}, 0x6e, 0x0, 0x0, &(0x7f000009df00)=[@cred={{0x20, 0x1, 0x51}}], 0x20, 0x800}}], 0x1, 0x30004054) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='kmem_cache_free\x00', r6}, 0x10) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) bind$bt_hci(r8, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r9}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r0}, &(0x7f0000000380), &(0x7f0000000200)=r9}, 0x20) 16.151627714s ago: executing program 6 (id=336): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4080000400000006110540000000000a6000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x0, 0x10, &(0x7f0000000080), 0xffffffffffffffb2}, 0x48) r1 = socket(0x10, 0x803, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000400)=r0, 0x4) (async) unshare(0x22020400) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0xa) (async) sendmsg$nl_generic(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000520021000000000000000000020000000800010008"], 0x1c}}, 0x40014) 14.748417775s ago: executing program 6 (id=342): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x10000}, 0x28) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x9b1e, 0x2, 0x4, 0x42}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) io_uring_enter(r0, 0x66a4, 0x4000, 0xf, 0x0, 0x20000) 14.726260275s ago: executing program 34 (id=342): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x10000}, 0x28) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x9b1e, 0x2, 0x4, 0x42}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) io_uring_enter(r0, 0x66a4, 0x4000, 0xf, 0x0, 0x20000) 4.296628664s ago: executing program 7 (id=458): prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x2, 0x5}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000240)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x109}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000280)='kmem_cache_free\x00', r1}, 0x18) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x6a1c2, 0x50) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x5) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x18) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000340)='wg2\x00', 0x4) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x2000008, &(0x7f00000003c0), 0xfc, 0x53e, &(0x7f0000000940)="$eJzs3UFvI1cdAPD/eO3d7G62SYEDVGoptGi3grWThrYRh1IkBKdKiMJ5CYkTRXHiKHbaTVRB9hMgIQRInODCBYkPgIRW4sKxQqoEZ5CKQIhuQYIDdJDtcRKcceKsnHjX+f2kybz3xjP/9xy/8YznaSaAC+vZiHgtIj5M0/SFiJjKygvZFHudqfW6Dx68vdiakkjTN/6eRJKVdbeVZPPr2WoTEfH1r0Z8Ozkat7Gzu7ZQqxW7+UpzfbPS2Nm9vbq+sFJdqW7Mzc2+PP/K/EvzM0Np542IePXLf/7h937+lVd//bm3/nTnr7e+06rWZLb8cDtOqXjcwk7TS1cmelbYeshgj6JWe0rdzNXB1rl3hvUBAKC/1jH+RyLi0xHxQkzFpeMPZwEAAIDHUPrFyfhPEpHmu9ynHAAAAHiMFNpjYJNCORsLMBmFQrncGcP7sbhWqNUbzc8u17c3ljpjZaejVFherVVnsrHC01FKWvnZdvog/2JPfi4inoyIH0xdbefLi/Xa0qh//AAAAIAL4nrP+f8/pzrn/wAAAMCYmT5+8dR51QMAAAA4Oyec/wMAAABjwPk/AAAAjLWvvf56a0q7z79eenNne63+5u2lamOtvL69WF6sb22WV+r1lfY9+9ZP2l6tXt/8fGxs3600q41mpbGze2e9vr3RvLMaE+fSIAAAAOCIJz95/w9JROx94Wp7ark86koB56K4n0qyeU7v/+MTnfl751Qp4FxcGuA1713JL3ecAI+3Ym9Bn74OjJ/SqCsAjFxywvKewTvX9lPvZPNPDb9OAADAcN38RP71/5OvC+wVzqF6wBnSieHi6vmeTz3rBy6O9vX/QQfyOFiAsVIaaAQgMM5Oef3/wDuDRkjTU1UIAAAYusn2lBTK2c97k1EolMsRN9qPBSgly6u16kxEPBERv58qXWnlZ9trJieeMwAAAAAAAAAAAAAAAAAAAAAAAAAAHWmaRAoAAACMtYjCX5LfdO7lf3Pq+cne3wcuJ/9uPxL4ckS89ZM3fnR3odncmm2Vv79f3vxxVv7iKH7BAAAAAHp1z9Pb83+NujYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjJsPHry92J0GePnVYcX925ciYjovfjEm2vOJKEXEtX8kUTy0XhIRl4YQf+9eRHw8L37SqtZ+yLz4w3gTTogf09m7kBf/+hDiw0V2v7X/eS2v/xXi2fY8v/8VI/4v/7D67/9if/93qU//vzFgjKfe/WWlb/x7EU8V8/c/3fhJn/jPDRj/W9/Y3e23LP1pxM3u9097j3c4wkGq0lzfrDR2dm+vri+sVFeqG3Nzsy/PvzL/0vxMZXm1Vs3+5sb4/tO/+vC49l/L/f5Lstr0b//zOdvL+07677t3H3y0m9k7Gv/Wcznxf/uz7BVH4xeyOJ/J0kn2XrXTe53387BnfvG7Z45r/9JB+0un+f/f6rfRXkc6ytODfnQAgDPQ2NldW6jVqltjm2idpT8C1bjoiW++/wh+2L471A2maZq2+lTOovsRMch2khhySwv59TlI9P2njHrPBAAADNvBQf+oawIAAAAAAAAAAAAAAAAAAAAX13ncZa035sEtkJNh3EIbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAo/hcAAP//A/7SsQ==") 3.916285221s ago: executing program 7 (id=467): prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) rseq(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x2}, 0x20, 0x3fe, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000001140)='ext4\x00', &(0x7f00000007c0)='./file1\x00', 0x410c84, &(0x7f0000000340), 0x1, 0x775, &(0x7f0000001180)="$eJzs3c9rXNUeAPDvnSRNm/a95MGD9+oqIGigdGJqbBVcVFyIYKGga9thMg01k0zJTEoTAlpEcCOouBB007U/6s6tP7b6X7gQS9W0WHEhkTu5t502M2mSJpnqfD5wM+fceyfnfOf+OGfmHu4NoGeNpn8KEYcj4t0kYjibn0TEQDPVH3Fybb1bK8vldEpidfXlX5LmOjdXlsvR8p7UwSzz/4j45q2II4X15dYXl2ZK1WplPsuPN2YvjNcXl46eny1NV6Yrc8cnJiePnXjqxPGdi/W375cOXXvvhcc/P/nHm/+7+s63SZyMQ9my1jh2ymiMZp/JQPoR3uX5nS6sy5JuV4BtSQ/NvrWjPA7HcPQ1UwDAP9nrEbEKAPSYRPsPAD0m/x3g5spyOZ+6+4vE3rr+XETsX4s/v765tqQ/u2a3v3kddOhmcteVkSQiRnag/NGI+PjLVz9Np9il65AA7bxxOSLOjoyuP/8n68YsbNUTGyzbl72O3jPf+Q/2zldp/+fpdv2/wu3+T7Tp/wy2OXa3477H/4EdKGQDaf/v2Zaxbbda4s+M9GW5fzX7fAPJufPVSnpu+3dEjMXAYJqf2KCMsRt/3ui0rLX/9+v7r32Slp++3lmj8FP/4N3vmSo1Sg8Sc6vrlyMe6W8Xf3J7+ycd+r+nN1nGi8+8/VGnZWn8abz5tD7+yEYn7Y7VKxGPtd3+d0a0JRuOTxxv7g7j+U7Rxhc/fDjUqfzW7Z9Oafn5d4G9kG7/oY3jH0lax2vWt17Gd1eGv+607P7xt9//9yWvNNN5P+JSqdGYn4jYl7y0fv6xO+/N8/n6afxjj7Y//jfa/9PvhGc3GX//tZ8/2378uyuNf2pL23/riau3Zvo6lb+57T/ZTI1lczZz/ttsBR/kswMAAAAAAAAAAAAAAAAAAAAAAACAzSpExKFICsXb6UKhWFx7hvd/Y6hQrdUbR87VFuamovms7JEYKOS3uhxuuR/qRHY//Dx/7J78kxHxn4j4YPBAkt9HcarLsQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA7mCH5/+nfhzsdu0AgF2zv9sVAAD2nPYfAHqP9h8Aeo/2HwB6j/YfAHqP9h8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBddvrUqXRa/X1luZzmpy4uLszULh6dqtRnirML5WK5Nn+hOF2rTVcrxXJt9n7/r1qrXZiMuYVL441KvTFeX1w6M1tbmGucOT9bmq6cqQzsSVQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsDX1xaWZUrVamZfYRmL14ahG9xN92e70sNRnTxPJw1GNHU50+cQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8DfxVwAAAP//02Ii/w==") openat$snapshot(0xffffffffffffff9c, 0x0, 0x481, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$inet6(0xa, 0x80002, 0x88) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300001e880000850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000003c0)='mlxsw_sp_acl_tcam_vregion_rehash_rollback_failed\x00', r2}, 0x18) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @mcast2, 0x787}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030086dd601b8b97004d88c19edace00000000000000002100000002ff02000000000000000000000000000104004e20004d13"], 0x0) rseq(&(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x7, 0x4, 0x9, 0x8000000000000000}}, 0x20, 0x1, 0x0) mount_setattr(0xffffffffffffffff, 0x0, 0x1000, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000001800)=[{{&(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}}], 0x1, 0x12, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='tlb_flush\x00', r4}, 0x10) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3000003, 0x200000006c832, 0xffffffffffffffff, 0x2a613000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffdc0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='qi_submit\x00', r3, 0x0, 0x100000001}, 0x18) r5 = fsopen(&(0x7f0000000000)='cgroup\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000300)='name', &(0x7f00000000c0)='\x00\x1f\"\f\x00\x00\"\x00\x04\x00\x00', 0x0) readv(r5, &(0x7f0000000040)=[{&(0x7f0000002300)=""/4077, 0xfed}], 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$inet6(0xa, 0x3, 0x1) 3.194908051s ago: executing program 5 (id=479): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048041}, 0x40000000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x0, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x0) pipe(&(0x7f0000000300)) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x200000000000000) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000040000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x40000, 0x0, 0x0) recvfrom(r4, 0x0, 0x0, 0x800004c4, 0x0, 0x0) 3.061206364s ago: executing program 7 (id=480): clock_settime(0x1ed5d7403, &(0x7f0000000180)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={0x0}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) rt_sigaction(0x19, 0x0, 0x0, 0x8, &(0x7f0000000440)) memfd_create(0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bind$tipc(0xffffffffffffffff, 0x0, 0x0) symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000000)='./file0\x00') openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file0/..\x00', &(0x7f0000000240)={0x0, 0x0, 0x8}, 0x18) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = fsmount(0xffffffffffffffff, 0x0, 0x0) fchdir(r0) rt_sigsuspend(&(0x7f0000000100)={[0x8]}, 0x8) r1 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r1, 0x2007ffb) sendfile(r1, r1, 0x0, 0x1000000201005) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x88882, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file2\x00', 0x2004d95, &(0x7f00000000c0)={[{@barrier}]}, 0x1, 0x523, &(0x7f0000000a80)="$eJzs3c1vHGcZAPBnNrtJnDi1+ThAJUKhRU4F2bVr2locSpEQnCohyj0Ye21ZXnst77qNVxV1/gIkhACJE1y4IPEHIKFIXDgipEpwBqkIhCCFAwfooJ2d9Vd27W262XXs30+azPvO1/O8m8zszOybmQAurGci4tWIeD9N0+cjYiqSbHohH2KvM7SXe+/BW0vtIYk0ff0fSbZku97dVpKPr+erXY2Ib3494jvJw3Ebu631xVqtup3XK82NrUpjt3V7bWNxtbpa3Zyfn3tp4eWFFxdmh9LOGxHxylf/8sPv/fxrr/z6C2/++c7fbn23ndZkPv9wOz6g4kkzO00vZZ/F4RW2HzHYWVTMWpibGGyde48xHwAA+muf4380Ij4bEc/HVFw6+XQWAAAAeAKlX56M/yYRaW+X+0wHAAAAniCFrA9sUijnfQEmo1Aolzt9eD8e1wq1eqP5+ZX6zuZyp6/sdJQKK2u16mzWVzirJ+36XFY+qL9wrD5/pXO/4QdTE1m9vFSvLY/75gcAAABcENePXf//e6pz/Q8AAACcM9PjTgAAAAB47Fz/AwAAwPnn+h8AAADOtW+89tpERKTd918vv7G7s15/4/ZytbFe3thZKi/Vt7fKq/X6avbMvo3Ttler17e+GJs7dyvNaqNZaey27mzUdzabd9aOvAIbAAAAGKGPfPr+H5OI2PvSRDa0XR53UsBIFPdLST7usff/6anO+N0RJQWMxKUBlnn3yggSAUauOO4EgLEpjTsBYOySU+b37bzzu3z8meHmAwAADN/MJ/v//l84cc29k2cDZ56dGC6uY/t/2jauXIDRyn7/H7TDr5MFOFdKA/UABM6zD/37/6lcVwAAwLhNZkNSKOe39yajUCiXI25krwUoJStrtepsRDwVEX+YKl1p1+diwP84CAAAAAAAAAAAAAAAAAAAAAAAAABk0jTpvPQHAAAAOLciCn9NfpNk7/+amXpu8vj9gcvJf6Yif0Xomz95/Ud3F5vN7bn29H/uT2/+OJ/+wjjuYAAAAADHda/Tu9fxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBM7z14a6k7jDLu378SEdO94hfjaja+GqWIuPavJIqH1ksi4tIQ4u/di4hP9IqftNPaD9kr/sTjjx/T+afQK/71IcSHi+x++/jzaq/9rxDPZOPe+18x4kj9UR05/rVuHjn+do9/l/rs/zcGjPH0O7+s9I1/L+LpYu/jTzd+0if+swPG//a3Wq1+89KfRsz0/P5JjsSqNDe2Ko3d1u21jcXV6mp1c35+7qWFlxdeXJitrKzVqvmfPWN8/1O/ev+k9l/rE3/6lPY/N2D7//fO3Qcf6xRLB1Mn9uPferZH/N/+LF/u4fiF/Lvvc3m5PX+mW97rlA+7+Yvf3zyp/csH7S99kL//WwO2fyg7CgAwNI3d1vpirVbdfsIKb+f5n75w+zzrbOT8CIXkbKRxXgtvD3WDaZqm7X+TPWbdj4hBtpPEWfhYssJ4j0sAAMDwHZz0jzsTAAAAAAAAAAAAAAAAAAAAuLgefvpXmsaQH0J2PObefinxZGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Mz4fwAAAP//j6PX8g==") r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r5 = fspick(r4, &(0x7f0000000000)='.\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r5, 0x0, &(0x7f0000000080)='ro\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r5, 0x7, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x800, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000040)=@ethtool_coalesce={0xe, 0x9, 0xf, 0x1, 0xd5, 0x9, 0x101, 0xd, 0xb05, 0x0, 0x0, 0x100, 0xebfa, 0xc3e9, 0x1, 0x98, 0x5, 0xed, 0x2, 0xffffff7f, 0x6, 0x9, 0x2}}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20000040) sendfile(r3, r2, 0x0, 0x7ffff000) creat(&(0x7f0000000000)='./bus\x00', 0x8e) 2.340718005s ago: executing program 5 (id=488): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000440)='./file0\x00', 0x1810714, &(0x7f0000000300)={[{@journal_dev={'journal_dev', 0x3d, 0xcd29}}, {@noblock_validity}, {@init_itable_val={'init_itable', 0x3d, 0x1002}}, {@journal_dev={'journal_dev', 0x3d, 0x2}}, {@oldalloc}, {@jqfmt_vfsold}, {@usrjquota, 0x5}, {@min_batch_time}, {@inlinecrypt}]}, 0x1, 0x451, &(0x7f0000000d00)="$eJzs281vVFUbAPDn3pkCL7zSioiCoFU0Nn60tKCycKPRxIUmJrrAZW0LqQzU0JoIabQag0tD4t64NPEvcOXKqCsTt7o3JEQbE9CNY+7MvW1nmCn9mDKV+f2SgXPmnrnnPD333DlzzkwAPWsw+yeJ+H9E/BIR/fVsY4HB+n83Fucn/lqcn0iiWn3j96RW7vri/ERRtHjdnjwzlEaknyR5JY1mL146O16pTF3I8yNz594dmb146enpc+Nnps5MnR87efLE8dHnnh17piNxZvFdP/TBzOGDr7x15bWJU1fe/uHrrL0HjtSPr4yjUwazwP+o1jQfe6zTlXXZP9XlOJNyt1vDWpUiIuuuvtr4749SLHdef7z8cVcbB2yp7J69s/3hhSpwB0ui2y0AuqN4o88+/xaP2zT12BauvVD/AJTFfSN/1I+UI83L9G1h/YMRcWrh7y+yRzStQ1RbrBsAAGzWt9n856lW8780DqwotzffGxqIiLsjYl9E3BMR+yPi3oha2fsi4v511t+8NXTz/DO9uqHA1iib/z2f7201zv+K2V8MlPLcXbX4+5LT05WpY/nfZCj6dmb50VYnL07x0s+ftat/5fwve2T1F3PB/CRXy00LdJPjc+OdmpRe+yjiULlV/MnSTkASEQcj4tD6Tr23SEw/8dXhdoVuHf8qOrDPVP0y4vF6/y9EU/yFZPX9yZFdUZk6NlJcFTf78afLr7erf1Pxd0DW/7sbr/+mEv1/Jiv3a2fXX8flXz9t+5myvMHrf0fyZm1Pd0f+3Pvjc3MXRiN2JK/W8g3Pjy2/tsgX5bP4h462Hv/78tdk8T8QEdlFfCQiHoyIh/K+ezgiHomIo6vE//2Lj77T7th26P/Jlve/pet/oLH/158onf3um3b1r+3+d6KWGsqfqd3/bqF9c3blJTZ6NQMAAMB/T1r7bnySDi+l03R4uP4d/v2xO63MzM49eXrmvfOT9e/QD0RfWqx09a9YDx1NFvIz1vNj+Vpxcfx4vm78eel/tfzwxExlssuxQ6/b02b8Z34rdbt1wJbzey3oXc3jP+1SO4Dbz/s/9C7jH3qX8Q+9q9X4/7Apby8A7kze/6F3Gf/Qu4x/6F3GP/Skzfyuf6sS5VV+vS+xXRKRbotmSLRIlDswurt8YwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiQfwMAAP//EgHx+Q==") r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) quotactl_fd$Q_QUOTAOFF(r2, 0xffffffff80000302, 0x0, 0x0) 2.290890255s ago: executing program 4 (id=490): r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x70, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x62, 0x5, 0xe4}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x526}, @TCA_SAMPLE_TRUNC_SIZE={0x0, 0x4, 0xffff8000}]}, {0x4}, {0xc}, {0xc, 0x4, {0x0, 0x2}}}}]}]}, 0x70}}, 0x0) (fail_nth: 3) 2.186815187s ago: executing program 4 (id=491): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0xc, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, [@ringbuf_output={{0x18, 0x2, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xc}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x43}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000001640)='kfree\x00', r1}, 0x10) r2 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000100)='asymmetric\x00', 0x0, &(0x7f0000000140)="10", 0x1, r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0x21}, 0x50) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x20, &(0x7f0000000180)={&(0x7f0000000100)=""/65, 0x41, 0x0, &(0x7f0000000080)=""/43, 0x2b}}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000320001002abd7000fbdbcc8111"], 0x14}, 0x1, 0x0, 0x0, 0x4001000}, 0x90) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000180)={0x10000, 0x6, 0x2, 0x3, 0x7, 0xb, 0x800000000651, 0xfffffffffffffff9, 0x4008000009657, 0x1, 0x7fffffff, 0x0, 0x401, 0xb, 0x80000000000000, 0xcc0, 0x1, 0x1, 0x94d6, 0x0, 0x0, 0x809, 0x0, 0xfffffffffffffffa, 0x3, 0x2000000000004}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r5}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'xfrm0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x94}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x9, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newsa={0x164, 0x10, 0x713, 0x70bd29, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@dev={0xac, 0x14, 0x14, 0x1b}, 0x4e23, 0x1, 0x0, 0x3, 0x2, 0x0, 0x0, 0xbf, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in6=@private2, {0x0, 0x1, 0x9, 0x9, 0x2, 0x0, 0x20001, 0x3}, {0x0, 0x0, 0x2, 0xfffffffffffffffc}, {0x8000000c}, 0x70bd28, 0x0, 0xa, 0x4, 0x6, 0x2}, [@algo_aead={0x71, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x128, 0x80, "316f748a6d2d020d1c0dda27a9bca207141b9a451c00aa1271df019aeb512657849383b4be"}}]}, 0x164}, 0x1, 0x0, 0x0, 0xc0}, 0x200480d0) sendmsg$ETHTOOL_MSG_RINGS_SET(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010029bd7000ffdbdf251000000020000180140002006261746164765f736c6176655f31000008000100", @ANYRES32=r10], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x40400c0) 1.96997255s ago: executing program 5 (id=494): syz_mount_image$ext4(&(0x7f0000000c40)='ext4\x00', &(0x7f0000000580)='./file1\x00', 0x0, &(0x7f0000000100), 0x1, 0x57e, &(0x7f00000005c0)="$eJzs3U1oHGUfAPD/zGbffuV90xcUVHooKlQo3ST90OqpvYqFQg+CFw2bbSjZZEM20SbkkN6L2IOo9FJvevCoePAgXjx6ErwonoVig0LTg67MfqRpvtzUJlszvx/M7jzz7Oz/eXb2/+zMMMMGkFtHs4c04umIuJhEDKyq64t25dHW65aXFsr3lhbKSTQal35NIomIu0sL5c7rk/bzoYhYjIinIuKbYsTxdH3c+tz8+Ei1WplulwdnJqYG63PzJ65MjIxVxiqTp156+czZ02eGTw6vXu1eY3WpuL2+Xv/pxrvXv3v11o1PPzuyWH5/JIlz0d+uW92PR6n1mRTj3Jrlp3ciWA8lvW4AD6XQzvMslZ6MgSi0s34jjYFdbRqwwxr7IhpATiXyH3Kqsx+QHf92pt3c/7h9vnUAksVdbk+tmr7WuYnY3zw2Ofhb8sCRSXa8eXg3G8qetHgtIob6+tZ//5P29+/hDT2KBrKjvj7f2lDrt3+6Mv7EBuNPf+fc6T/UGf+W141/9+MXNhn/LnYZ4483fv5o0/jXIp7ZMH6yEj/ZIH4aEW91Gf/m61+e3ayu8XHEsdg4fkey9fnhwctXqpWh1uOGMb46duSVrfp/cJP4rXO2+5s/M2v6fyhr01SX/f/i28+fXdwi/gvPbb39N/r8D0TEe13G///dT17brO72teROthew3e2fLbvVZfwXzx39scuXAgAAAAAAAAAA25A2r2VL0tLKfJqWSq17eJ+Ig2m1Vp85frk2OznauubtcBTTzpVWA61ykpWH29fjdson15RPFdoBCwea5VK5Vh3tcd8BAAAAAAAAAAAAAAAAAADgcXFozf3/vxea9/+v/btqYK/a/C+/gb1O/kN+PZj/Sc/aAew+v/+QWw35D/kl/yG/5D/kl/yH/JL/kF/yH/JL/gMAAAAAAAAAAAAAAAAAAAAAAAAAwI64eOFCNjXuLS2Us/Jo39zseO3tE6OV+nhpYrZcKtemp0pjtdpYtVIq1yb+7v2SWm1qKCZnrw7OVOozg/W5+TcnarOTSXzfrK4Ud6FPAAAAAAAAAAAAAAAAAAAA8G/T35yStBQRaXM+TUuliP9GxOEoJpevVCtDEfG/iPihUNyXlYd73WgAAAAAAAAAAAAAAAAAAADYY+pz8+Mj1Wplek/O7I+IB5f0bWf1iFh8tA3L3nHbaxXb2+px+VTN5GGmxwMTAAAAAAAAAAAAAAAAAADk0P2bfrtd48+dbRAAAAAAAAAAAAAAAAAAAADkUvpLEhHZdGzg+f61tf9JlgvN54h45+alD66OzMxMD2fL76wsn/mwvfxkL9oPdKuTp508BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO6rz82Pj1SrlekdnOl1HwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAexl8BAAD//5aV1q4=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2, 0x11, r0, 0x0) read(r0, &(0x7f0000001400)=""/4096, 0x1000) r1 = io_uring_setup(0x60ad, &(0x7f0000000600)={0x0, 0xb1b2, 0x1000, 0x2, 0x3e0}) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000002700)={0x2, 0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000015c0)=""/4096, 0x1000}, {0x0}], 0x0}, 0x20) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) write$RDMA_USER_CM_CMD_SET_OPTION(r2, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f00000003c0)='mm_page_alloc\x00', r4, 0x0, 0xffffffffffffffff}, 0x18) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e0000006600816657bb97c9269de9aaec8488040f0000004cb9cca7480ef402000000e305000a00000200000000", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f00000003c0)=0x1, 0x4) getpgid(0x0) stat(&(0x7f0000000100)='./file1\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r8) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r5, {0x2}}, './file1\x00'}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) 1.532365647s ago: executing program 7 (id=497): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000009c0)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f3bbb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68000000000000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465a932b77a74e802a0dc6bf25d8a242bc6099ad2300000480006ef6c1ff0900ff0000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000026abfb0767192361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80af740b5b7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48bc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1f001b2cd3170400000085be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe760e717a04becff0f719197724f4fce1093b62d7e8c7123d890cec55bf404e4e1f74b7eed82571be54c72d978cf906df08f11f1c4042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f871b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9f0390a6f01e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5eaff07000000000000b99c9cc0ad1857216f000000009191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a798de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df98674152f94e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270b939b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf01cfaed9ef0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546bb2e51935ab9067ec3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f626602111b40e761fd21081920382f14d12ca3c471c7868e7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df902aeec50e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec743af930cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd6d89f80a4377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f000000000100000000d77480e0345effff6413258d1f6eb190aa28cbb4bafe3436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fb03b84f63e022fe755f4007a4a899eaf52c4f491f1e97c862e29e4570600000091c691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104d74dc07748f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c7167d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c2499ce3ffe2fef03f7cdd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426cfce471fef821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ada08f5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba3c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63e4581d5cc41cbde2ba66adc1168070c8c6e18a6a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c514b37c668554d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c3340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a39938613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b909006f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f1400010000ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1b0100448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae05025040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483d02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e918d685a7b099a4f8ed654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732ab916a781b9912160a3fd2a2e74dd690c57bdfdc1f069f949170ef8cb9c13c12138116bca7a8c59363799be7005c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2c74664d60a4b9423f3297bc8eb91b4ee1d73272abbef3e7a828a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece58e752b47e6f677eff7c5c568a89d6e36b165c39132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae1676384ff799783f55d7e5a1a0920300000000000000d98440c355927629f2bcf9dc405a18ca0264400abf38e90000000000000000008faf2cddffbfa69bf32eb718e88ec75603ed7c7a8825ce0f27a114bd7a4ab74d0c7b8d90ccc1c3ca6620def782e24d75aed70eb676437f62677a69e0994cd82d72e95493c830fe9515329f40b7025326dec33a527c5d999298eaa3690fd0d38a02fc6e0bc16dbe19f353027edc014411e1138087221492f5d5e5cc9d0a1acd3f581eda9a807aa0e609f935f626d96351e0ff116686cbeb8939feecd5dac8cf45101942cc7cec21b7f337df5431bcf7e504b7c427f70a10e1cb8993a661306a0576b638a0171e6800b5b35589d676eb30ed1a72e8f7b057eb281c4504195635b6b285ebaba019913a2520e43ed790231f047f7d3789c10ae7d724929f77aec1d33d9587580268ee14396f71e7ef588cb2560d6bd0795a9b97281229eb16de086553469fad7214ffc3e416f8b8e442dce1d37f9b1c88a5d8a8d9f2fe45bd8df213ecb4194c8554aea13cadcd502e51f6fec80418e772b5bd8d0228949058038b185909ee542848680f9ad43f4057d676d5e21ae3d7e0e4a28c04f112a94707f032b35915e42993ff148291b8babe026646ee41905992db217561b90811c4702a14f312fe5d2ae7257db6be1034cc1c346b76a853ce274bf0435e18f7e86c660c18c80f30505dd4cf2ae2a1893b83c62d61bfeadc1f913e4cab2b897e096dd3fe3525090410cb23bab36cdf200a36014032cf6e5121803c5a0c4a273a19f340163fc6265425d513a1294b8439276394945d94a589708e32a1cb30f1fa4b2f08e01dc5e8c6732e6dc59b5c8cb400000000000000592c9b68f09c8f5ddb20b4ae08b4d9df548e5ed6cd47b91a4bea8b6aa52edf64576aef1e43f2958437fdc20fbbd0d4e13d8cce1193b2f9b4f107e25af178d056e1b1e40bd75b013f7484fae0bc447b1ffaf34819fe3ad1a634c94345e26e1e68dec08723a37b05d1594a66a4718a51d4d67fc880c9d640f4eacc509873f1a103c87f69"], &(0x7f0000000100)='GPL\x00'}, 0x41) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x14) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x110}}, 0x0) 1.29020336s ago: executing program 4 (id=499): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000200)='kmem_cache_free\x00', r1, 0x0, 0x45}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='personality\x00') utimensat(r2, 0x0, &(0x7f0000000880)={{0x77359400}}, 0x0) 1.269607111s ago: executing program 5 (id=500): r0 = socket$unix(0x1, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r1}, &(0x7f0000000800), &(0x7f0000000840)=r2}, 0x20) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r4 = socket$can_bcm(0x1d, 0x2, 0x2) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000002c0)='mm_page_alloc\x00', r5}, 0x10) connect$can_bcm(r4, &(0x7f0000000200)={0x1d, r3}, 0x10) sendmsg$can_bcm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r3, @ANYRES64=r0, @ANYBLOB="3bf81bb9"], 0x20000600}}, 0x0) 1.185391002s ago: executing program 4 (id=501): prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0xf, 0x78, 0x0, 0x7ffc0002}]}) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x41, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1000, 0x5}, 0x1100, 0x5dd8, 0x0, 0x3, 0x0, 0xffffffd7, 0xfffb, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x602, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}, {&(0x7f0000000140)="139776ff010070", 0x7}], 0x2) 1.133223623s ago: executing program 1 (id=502): prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x2, 0x5}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000240)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x109}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000280)='kmem_cache_free\x00', r1}, 0x18) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x6a1c2, 0x50) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x5) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x18) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000340)='wg2\x00', 0x4) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x2000008, &(0x7f00000003c0), 0xfc, 0x53e, &(0x7f0000000940)="$eJzs3UFvI1cdAPD/eO3d7G62SYEDVGoptGi3grWThrYRh1IkBKdKiMJ5CYkTRXHiKHbaTVRB9hMgIQRInODCBYkPgIRW4sKxQqoEZ5CKQIhuQYIDdJDtcRKcceKsnHjX+f2kybz3xjP/9xy/8YznaSaAC+vZiHgtIj5M0/SFiJjKygvZFHudqfW6Dx68vdiakkjTN/6eRJKVdbeVZPPr2WoTEfH1r0Z8Ozkat7Gzu7ZQqxW7+UpzfbPS2Nm9vbq+sFJdqW7Mzc2+PP/K/EvzM0Np542IePXLf/7h937+lVd//bm3/nTnr7e+06rWZLb8cDtOqXjcwk7TS1cmelbYeshgj6JWe0rdzNXB1rl3hvUBAKC/1jH+RyLi0xHxQkzFpeMPZwEAAIDHUPrFyfhPEpHmu9ynHAAAAHiMFNpjYJNCORsLMBmFQrncGcP7sbhWqNUbzc8u17c3ljpjZaejVFherVVnsrHC01FKWvnZdvog/2JPfi4inoyIH0xdbefLi/Xa0qh//AAAAIAL4nrP+f8/pzrn/wAAAMCYmT5+8dR51QMAAAA4Oyec/wMAAABjwPk/AAAAjLWvvf56a0q7z79eenNne63+5u2lamOtvL69WF6sb22WV+r1lfY9+9ZP2l6tXt/8fGxs3600q41mpbGze2e9vr3RvLMaE+fSIAAAAOCIJz95/w9JROx94Wp7ark86koB56K4n0qyeU7v/+MTnfl751Qp4FxcGuA1713JL3ecAI+3Ym9Bn74OjJ/SqCsAjFxywvKewTvX9lPvZPNPDb9OAADAcN38RP71/5OvC+wVzqF6wBnSieHi6vmeTz3rBy6O9vX/QQfyOFiAsVIaaAQgMM5Oef3/wDuDRkjTU1UIAAAYusn2lBTK2c97k1EolMsRN9qPBSgly6u16kxEPBERv58qXWnlZ9trJieeMwAAAAAAAAAAAAAAAAAAAAAAAAAAHWmaRAoAAACMtYjCX5LfdO7lf3Pq+cne3wcuJ/9uPxL4ckS89ZM3fnR3odncmm2Vv79f3vxxVv7iKH7BAAAAAHp1z9Pb83+NujYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjJsPHry92J0GePnVYcX925ciYjovfjEm2vOJKEXEtX8kUTy0XhIRl4YQf+9eRHw8L37SqtZ+yLz4w3gTTogf09m7kBf/+hDiw0V2v7X/eS2v/xXi2fY8v/8VI/4v/7D67/9if/93qU//vzFgjKfe/WWlb/x7EU8V8/c/3fhJn/jPDRj/W9/Y3e23LP1pxM3u9097j3c4wkGq0lzfrDR2dm+vri+sVFeqG3Nzsy/PvzL/0vxMZXm1Vs3+5sb4/tO/+vC49l/L/f5Lstr0b//zOdvL+07677t3H3y0m9k7Gv/Wcznxf/uz7BVH4xeyOJ/J0kn2XrXTe53387BnfvG7Z45r/9JB+0un+f/f6rfRXkc6ytODfnQAgDPQ2NldW6jVqltjm2idpT8C1bjoiW++/wh+2L471A2maZq2+lTOovsRMch2khhySwv59TlI9P2njHrPBAAADNvBQf+oawIAAAAAAAAAAAAAAAAAAAAX13ncZa035sEtkJNh3EIbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAo/hcAAP//A/7SsQ==") 1.122422263s ago: executing program 7 (id=503): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000e00000850000001b000000b700000000fa000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000200)='kmem_cache_free\x00', r1, 0x0, 0x45}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) utimensat(0xffffffffffffffff, 0x0, 0x0, 0x0) (fail_nth: 3) 1.003573655s ago: executing program 5 (id=504): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='vm_unmapped_area\x00', r3}, 0x10) r4 = io_uring_setup(0x23ea, &(0x7f00000001c0)={0x0, 0x1292, 0x400, 0x2, 0x313}) r5 = socket$qrtr(0x2a, 0x2, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r6, 0x0, 0x33, &(0x7f0000000000)=0x80020000, 0x4) listen(r6, 0x2) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f0000000600)=[{&(0x7f0000000640)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd0000001000020004001000979bbeea1464507c0000", 0x58}], 0x1) connect$qrtr(r5, &(0x7f0000000080)={0x2a, 0x0, 0x1}, 0xc) read(r5, &(0x7f0000000180)=""/52, 0xfffffdef) ioctl$sock_qrtr_SIOCGIFADDR(r5, 0x8915, &(0x7f00000000c0)={'veth0_to_hsr\x00'}) close_range(r4, 0xffffffffffffffff, 0x0) io_setup(0x5, &(0x7f0000000600)) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r8}, 0x10) truncate(&(0x7f0000002080)='./file0\x00', 0x5ba76382) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'ip_vti0\x00'}) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000008b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000000)='kfree\x00', r9, 0x0, 0x80000000}, 0x18) r10 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r10, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@loopback, @dev}, 0x10) close_range(r2, r1, 0x2) r11 = socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCGETMIFCNT_IN6(0xffffffffffffffff, 0x89e0, &(0x7f00000000c0)) sendmsg$kcm(r11, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000040)="2e00000011008188040f80ec59acbc0413a1f8480b0000005e140602000000000e0027001000000002800000121f", 0x2e}], 0x1}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) 826.780927ms ago: executing program 7 (id=506): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="070000000400000008000000d9"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000020000000000000000085000000ae00000095"], &(0x7f0000001b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r3, 0x0, 0x1000}, 0x18) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) setsockopt$llc_int(r6, 0x10c, 0x3, &(0x7f0000000280)=0x5, 0x4) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000000000f6000000006debff00850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r8}, 0x10) mount_setattr(r7, &(0x7f0000000100)='.\x00', 0x9000, &(0x7f0000001dc0)={0x0, 0x85, 0x20000}, 0x20) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) sendto$inet6(r5, &(0x7f0000000180)="04", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0xfffffff6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x0, 0x4}, 0x8) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000540)={0x0, 0x0}) perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x8, 0xb, 0x0, 0x0, 0x0, 0x5, 0x40010, 0xc, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x7, 0x4, @perf_config_ext={0x7fff, 0x8000000000000001}, 0x5400, 0x0, 0x5, 0x7, 0x2, 0x4a4, 0xb4e, 0x0, 0x7, 0x0, 0x2}, r9, 0xffffffffffffffff, r4, 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000010bc0)='kfree\x00', r2}, 0x18) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000160a0103000000000000000002000000540003804000038014000100626f6e645f736c6176655f300000000014000100736974300000000000000000000000000400010073697430000000000000000000000000080002400000000008000140000000000900020073797a31000000000900010073797a30"], 0xa8}, 0x1, 0x0, 0x0, 0x8004}, 0x0) r10 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) read$ptp(r10, &(0x7f0000000140)=""/67, 0x43) 724.762429ms ago: executing program 1 (id=507): r0 = socket$unix(0x1, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r1}, 0x0, &(0x7f0000000840)=r2}, 0x20) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r4 = socket$can_bcm(0x1d, 0x2, 0x2) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000002c0)='mm_page_alloc\x00', r5}, 0x10) connect$can_bcm(r4, &(0x7f0000000200)={0x1d, r3}, 0x10) sendmsg$can_bcm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r3, @ANYRES64=r0, @ANYBLOB="3bf81bb9e9"], 0x20000600}}, 0x0) 678.21472ms ago: executing program 1 (id=508): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb85000000430000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r0, 0x0, 0xb}, 0x18) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r2 = fcntl$dupfd(r1, 0x0, r1) write$sndseq(r2, &(0x7f0000000180)=[{0xff, 0x0, 0x10, 0x0, @time={0x800, 0x400}, {0x6}, {}, @raw8={"72efbc660c83bfffecfe7f72"}}, {0x0, 0x0, 0xff, 0x43, @tick=0xf27, {0x1, 0x31}, {0xfc}, @raw32={[0x7, 0x4138cec9, 0x8]}}], 0x38) 634.357211ms ago: executing program 1 (id=509): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x37, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x488c, 0x10000, 0x0, 0x1, 0x8, 0x20002, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000500)=0x80c, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000080)='9p_client_res\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="022200d3", @ANYRES16=r3, @ANYBLOB="000427bd7000fddbdf25100000000800090005000000080008000000008008000800060000000800060007000000080009009700000008000900ff000000"], 0x44}, 0x1, 0x0, 0x0, 0x40080c5}, 0x40) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x4, 0x4, 0xc}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r4}, &(0x7f0000000000), &(0x7f0000000200)}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001300)={&(0x7f0000000180)='kfree\x00'}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmmsg(r5, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0xffffffffffffffa7}}], 0xf00, 0x4c42bb4f92, 0x0) shutdown(r5, 0x0) syz_io_uring_setup(0x10b, &(0x7f0000000580)={0x0, 0xd736, 0x8, 0x1, 0x248}, &(0x7f00000003c0)=0x0, &(0x7f0000000340)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f00000002c0)=0x9, 0x0, 0x4) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x94, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x64, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x22, 0x1, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x8, 0x2, 0x0, 0x1, [{0x4}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x100}, 0x40) 624.200171ms ago: executing program 2 (id=510): syz_mount_image$ext4(&(0x7f0000000c40)='ext4\x00', &(0x7f0000000580)='./file1\x00', 0x0, &(0x7f0000000100), 0x1, 0x57e, &(0x7f00000005c0)="$eJzs3U1oHGUfAPD/zGbffuV90xcUVHooKlQo3ST90OqpvYqFQg+CFw2bbSjZZEM20SbkkN6L2IOo9FJvevCoePAgXjx6ErwonoVig0LTg67MfqRpvtzUJlszvx/M7jzz7Oz/eXb2/+zMMMMGkFtHs4c04umIuJhEDKyq64t25dHW65aXFsr3lhbKSTQal35NIomIu0sL5c7rk/bzoYhYjIinIuKbYsTxdH3c+tz8+Ei1WplulwdnJqYG63PzJ65MjIxVxiqTp156+czZ02eGTw6vXu1eY3WpuL2+Xv/pxrvXv3v11o1PPzuyWH5/JIlz0d+uW92PR6n1mRTj3Jrlp3ciWA8lvW4AD6XQzvMslZ6MgSi0s34jjYFdbRqwwxr7IhpATiXyH3Kqsx+QHf92pt3c/7h9vnUAksVdbk+tmr7WuYnY3zw2Ofhb8sCRSXa8eXg3G8qetHgtIob6+tZ//5P29+/hDT2KBrKjvj7f2lDrt3+6Mv7EBuNPf+fc6T/UGf+W141/9+MXNhn/LnYZ4483fv5o0/jXIp7ZMH6yEj/ZIH4aEW91Gf/m61+e3ayu8XHEsdg4fkey9fnhwctXqpWh1uOGMb46duSVrfp/cJP4rXO2+5s/M2v6fyhr01SX/f/i28+fXdwi/gvPbb39N/r8D0TEe13G///dT17brO72teROthew3e2fLbvVZfwXzx39scuXAgAAAAAAAAAA25A2r2VL0tLKfJqWSq17eJ+Ig2m1Vp85frk2OznauubtcBTTzpVWA61ykpWH29fjdson15RPFdoBCwea5VK5Vh3tcd8BAAAAAAAAAAAAAAAAAADgcXFozf3/vxea9/+v/btqYK/a/C+/gb1O/kN+PZj/Sc/aAew+v/+QWw35D/kl/yG/5D/kl/yH/JL/kF/yH/JL/gMAAAAAAAAAAAAAAAAAAAAAAAAAwI64eOFCNjXuLS2Us/Jo39zseO3tE6OV+nhpYrZcKtemp0pjtdpYtVIq1yb+7v2SWm1qKCZnrw7OVOozg/W5+TcnarOTSXzfrK4Ud6FPAAAAAAAAAAAAAAAAAAAA8G/T35yStBQRaXM+TUuliP9GxOEoJpevVCtDEfG/iPihUNyXlYd73WgAAAAAAAAAAAAAAAAAAADYY+pz8+Mj1Wplek/O7I+IB5f0bWf1iFh8tA3L3nHbaxXb2+px+VTN5GGmxwMTAAAAAAAAAAAAAAAAAADk0P2bfrtd48+dbRAAAAAAAAAAAAAAAAAAAADkUvpLEhHZdGzg+f61tf9JlgvN54h45+alD66OzMxMD2fL76wsn/mwvfxkL9oPdKuTp508BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO6rz82Pj1SrlekdnOl1HwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAexl8BAAD//5aV1q4=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2, 0x11, r0, 0x0) read(r0, &(0x7f0000001400)=""/4096, 0x1000) r1 = io_uring_setup(0x60ad, &(0x7f0000000600)={0x0, 0xb1b2, 0x1000, 0x2, 0x3e0}) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000002700)={0x2, 0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000015c0)=""/4096, 0x1000}, {0x0}], 0x0}, 0x20) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) write$RDMA_USER_CM_CMD_SET_OPTION(r2, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f00000003c0)='mm_page_alloc\x00', r4, 0x0, 0xffffffffffffffff}, 0x18) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e0000006600816657bb97c9269de9aaec8488040f0000004cb9cca7480ef402000000e305000a00000200000000", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f00000003c0)=0x1, 0x4) getpgid(0x0) stat(&(0x7f0000000100)='./file1\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r7) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) 530.452532ms ago: executing program 5 (id=511): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000938500000071000000"], &(0x7f0000000200)='GPL\x00', 0x800000, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x4, &(0x7f0000000740)=ANY=[], &(0x7f0000000400)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000000}, 0x94) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000004c0)={0x5, 0x40000}, 0x10) sendmsg$nl_route(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0000001200375f3fbd7000fcffffff07"], 0x2c}, 0x1, 0x0, 0x0, 0x40010}, 0x8884) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffdfc}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='fscache_acquire\x00', r3}, 0x18) setreuid(0x0, 0xee00) request_key(&(0x7f0000000440)='rxrpc_s\x00', &(0x7f0000000480)={'syz', 0x3}, &(0x7f0000000500)='/dev/vcsu#\x00', 0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = eventfd2(0x0, 0x0) read$eventfd(r4, &(0x7f0000000040), 0x8) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$netlink(0x10, 0x3, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000de0000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r7}, 0x10) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000200), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r6) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001500)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100004000000000000014000000180001801400020073797a5f74756e000020000000000000080003000000000a"], 0x34}}, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x14, 0x4, 0x7, 0x6, 0x0, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002300000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) 529.504492ms ago: executing program 2 (id=512): prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x2, 0x5}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000240)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x109}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000280)='kmem_cache_free\x00', r1}, 0x18) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x6a1c2, 0x50) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x5) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x18) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000340)='wg2\x00', 0x4) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x2000008, &(0x7f00000003c0), 0xfc, 0x53e, &(0x7f0000000940)="$eJzs3UFvI1cdAPD/eO3d7G62SYEDVGoptGi3grWThrYRh1IkBKdKiMJ5CYkTRXHiKHbaTVRB9hMgIQRInODCBYkPgIRW4sKxQqoEZ5CKQIhuQYIDdJDtcRKcceKsnHjX+f2kybz3xjP/9xy/8YznaSaAC+vZiHgtIj5M0/SFiJjKygvZFHudqfW6Dx68vdiakkjTN/6eRJKVdbeVZPPr2WoTEfH1r0Z8Ozkat7Gzu7ZQqxW7+UpzfbPS2Nm9vbq+sFJdqW7Mzc2+PP/K/EvzM0Np542IePXLf/7h937+lVd//bm3/nTnr7e+06rWZLb8cDtOqXjcwk7TS1cmelbYeshgj6JWe0rdzNXB1rl3hvUBAKC/1jH+RyLi0xHxQkzFpeMPZwEAAIDHUPrFyfhPEpHmu9ynHAAAAHiMFNpjYJNCORsLMBmFQrncGcP7sbhWqNUbzc8u17c3ljpjZaejVFherVVnsrHC01FKWvnZdvog/2JPfi4inoyIH0xdbefLi/Xa0qh//AAAAIAL4nrP+f8/pzrn/wAAAMCYmT5+8dR51QMAAAA4Oyec/wMAAABjwPk/AAAAjLWvvf56a0q7z79eenNne63+5u2lamOtvL69WF6sb22WV+r1lfY9+9ZP2l6tXt/8fGxs3600q41mpbGze2e9vr3RvLMaE+fSIAAAAOCIJz95/w9JROx94Wp7ark86koB56K4n0qyeU7v/+MTnfl751Qp4FxcGuA1713JL3ecAI+3Ym9Bn74OjJ/SqCsAjFxywvKewTvX9lPvZPNPDb9OAADAcN38RP71/5OvC+wVzqF6wBnSieHi6vmeTz3rBy6O9vX/QQfyOFiAsVIaaAQgMM5Oef3/wDuDRkjTU1UIAAAYusn2lBTK2c97k1EolMsRN9qPBSgly6u16kxEPBERv58qXWnlZ9trJieeMwAAAAAAAAAAAAAAAAAAAAAAAAAAHWmaRAoAAACMtYjCX5LfdO7lf3Pq+cne3wcuJ/9uPxL4ckS89ZM3fnR3odncmm2Vv79f3vxxVv7iKH7BAAAAAHp1z9Pb83+NujYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjJsPHry92J0GePnVYcX925ciYjovfjEm2vOJKEXEtX8kUTy0XhIRl4YQf+9eRHw8L37SqtZ+yLz4w3gTTogf09m7kBf/+hDiw0V2v7X/eS2v/xXi2fY8v/8VI/4v/7D67/9if/93qU//vzFgjKfe/WWlb/x7EU8V8/c/3fhJn/jPDRj/W9/Y3e23LP1pxM3u9097j3c4wkGq0lzfrDR2dm+vri+sVFeqG3Nzsy/PvzL/0vxMZXm1Vs3+5sb4/tO/+vC49l/L/f5Lstr0b//zOdvL+07677t3H3y0m9k7Gv/Wcznxf/uz7BVH4xeyOJ/J0kn2XrXTe53387BnfvG7Z45r/9JB+0un+f/f6rfRXkc6ytODfnQAgDPQ2NldW6jVqltjm2idpT8C1bjoiW++/wh+2L471A2maZq2+lTOovsRMch2khhySwv59TlI9P2njHrPBAAADNvBQf+oawIAAAAAAAAAAAAAAAAAAAAX13ncZa035sEtkJNh3EIbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAo/hcAAP//A/7SsQ==") 418.801394ms ago: executing program 1 (id=513): perf_event_open(&(0x7f00000000c0)={0x4, 0x80, 0x3, 0xff, 0x5e, 0x8, 0x0, 0x3, 0x8b008, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x1, @perf_bp={0x0, 0x8}, 0x1a, 0x81, 0x800, 0x6, 0x8, 0x4002}, 0x0, 0x0, 0xffffffffffffffff, 0x1) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000000780)={0x0, {'syz1\x00', 'syz0\x00', 'syz1\x00', &(0x7f00000000c0)=""/43, 0x2b, 0x0, 0x0, 0x0, 0x800}}, 0x120) write$UHID_DESTROY(r0, &(0x7f0000000080), 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd98, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) 181.150457ms ago: executing program 2 (id=514): r0 = socket$unix(0x1, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r1}, &(0x7f0000000800), &(0x7f0000000840)=r2}, 0x20) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r4 = socket$can_bcm(0x1d, 0x2, 0x2) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000002c0)='mm_page_alloc\x00', r5}, 0x10) connect$can_bcm(r4, &(0x7f0000000200)={0x1d, r3}, 0x10) sendmsg$can_bcm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r3, @ANYRES64=r0, @ANYBLOB="3bf81bb9"], 0x20000600}}, 0x0) 85.303569ms ago: executing program 4 (id=515): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.numa_stat\x00', 0x275a, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x8004587d, &(0x7f00000003c0)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4}) ftruncate(r0, 0x3) 84.665259ms ago: executing program 2 (id=516): r0 = socket$kcm(0x29, 0x5, 0x0) sendmsg(r0, &(0x7f0000002ec0)={0x0, 0x0, &(0x7f0000002c40)=[{&(0x7f0000002b80)="b2", 0x1}], 0x1}, 0x4000) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r1}, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001c40)=@newtaction={0xf0, 0x30, 0x1, 0x0, 0x0, {}, [{0xdc, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x81000000, 0x800}}]]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x6c, 0x2, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x0, 0x0, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8}}}]]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xf0}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x10, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ff7fffb7020000080000028e775800", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000b600000095", @ANYRESDEC=r1], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24048854) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000100)='sys_enter\x00', r3}, 0x10) r4 = signalfd4(r0, &(0x7f0000000040)={[0x6]}, 0x8, 0x80800) ioctl$BTRFS_IOC_FS_INFO(r4, 0x8400941f, &(0x7f0000000980)) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r5, 0x28, 0x1, &(0x7f00000000c0)=0xf, 0x8) listen(r5, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000140)='kmem_cache_free\x00'}, 0x10) ioctl$sock_bt_hci(r6, 0x800448d2, 0x0) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) writev(r7, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x20000081}], 0x1) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000170000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000feffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000c80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000240)='kmem_cache_free\x00', r9}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x1, &(0x7f00000004c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) lsm_list_modules(&(0x7f0000000000)=[0x0, 0x0], &(0x7f0000000100)=0x10, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{}, &(0x7f0000000380), 0x0}, 0x20) r10 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r10, 0x29, 0x23, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 84.148869ms ago: executing program 1 (id=517): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0a0000000300000009000000d200000080010000", @ANYRES32, @ANYBLOB="01000000000000000000de07df104d0000ffffffffa5c5f2b54bef151ab114d773a1625cf651fa09e9069207449e0000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0400000001000000ffffffff000000000000000000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800182800000000000000000040000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000c0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000430000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000001640)='kfree\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r3, 0x0) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x20000009, 0x1, &(0x7f0000000240)={0x0, 0x0, 0xfffc, 0x360}, 0x8, 0x9, 0x80, 0x0, 0x0, 0x101, 0x0}) creat(&(0x7f00000002c0)='./file0\x00', 0xe0) r4 = inotify_init() inotify_add_watch(r4, &(0x7f00000000c0)='./file0\x00', 0x50000004) lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000440)='system.posix_acl_access\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="02"], 0x4, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 34.804519ms ago: executing program 4 (id=518): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000c80)='./file1\x00', 0x210008, &(0x7f00000007c0)={[{@jqfmt_vfsv1}, {}, {@barrier_val}, {@commit={'commit', 0x3d, 0x3}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@resuid}, {@nodiscard}, {@sysvgroups}, {@barrier_val={'barrier', 0x3d, 0x8}}]}, 0xfc, 0x572, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hvSuj6TKadKx14PbgXnyRIYg4EP8A330c/gP+FQMdDBlFH0So3PSmy9qkv5aZbPl84Lbn5N7bc78593t7Tm5CAhhYx7IfhYiXI+KbJOJQy7pi5CuPrW63/PD6VLYksbLy6Z9JJPljze2T/PeBvPJSRPz6VcTJwsZ2a4tLs+VKJZ3P62P1uStjtcWlU5fmyjPpTHp5YnLyzFuTE+++83bXYn39/N/ff3L3wzNfH1/+7uf7h28ncTYO5uta43gCN1orx8r/5qXhOLtuw/EuNNZPkl4fALsylOf5cGTXgEMxlGc98Pz7MiJWgAGVyH8YUM1xQHNu36V58DPjwQerE6BG7COt8RdXXxuJvY250f7l5LGZUTbfHe1C+1kbv/xx53a2xOavQ+zbog6wIzduRsTpYnHj9T/Jr3+7d7rx4vHm1rcxaP9/oJfuZuOfN9qN/wpr459oM/450CZ3d2Pr/C/c70IzHWXjv/fajn/XLl2jQ3nthcaYbzi5eKmSno6IFyPiRAzvyeqb3c85s3xvpdO61vFftmTtN8eC+XHcL+55fJ/pcr0cESNPEnfTg5sRrxTbxZ+s9X/Spv+z5+P8Nts4mt55tdO6reN/ulZ+initbf8/uqOVbH5/cqxxPow1z4qN/rp19LdO7fc6/qz/928e/2jSer+2tvM2ftz7T9pp3W7P/5Hks0a5mQTXyvX6/HjESPLxxscnHu3brDe3z+I/cXzz61+78z+bfH2+zfhvHbnVcdN+6P/pHfX/zgv3Pvrih07tb6//32yUTuSP5Ne/9vJzZbsH+KTPHwAAAAAAAPSTQkQcjKRQWisXCqXS6vs7jsT+QqVaq5+8WF24PB2Nz8qOxnCheaf7UMv7Icbz98M26xPr6pMRcTgivh3a16iXpqqV6V4HDwAAAAAAAAAAAAAAAAAAAH3iQIfP/2d+H+r10QFPXeOLDfb0+iiAXtjyK/+78U1PQF/aMv+B55b8h8El/2FwyX8YXPIfBpf8h8El/2FwyX8AAAAAAAAAAAAAAAAAAAAAAAAAAADoqvPnzmXLyvLD61NZffrq4sJs9eqp6bQ2W5pbmCpNVeevlGaq1ZlKWpqqzm319yrV6pXxiVi4NlZPa/Wx2uLShbnqwuX6hUtz5Zn0Qjr8v0QFAAAAAAAAAAAAAAAAAAAAz5ba4tJsuVJJ5xU6Ft6PvjiMpxngql3tXuyXKBQ6FG7m3buzvXp4UQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAdf4LAAD//++4Mnc=") r1 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x6c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x1c42}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_BR_PRIORITY={0x6, 0x6, 0xd}, @IFLA_BR_MULTI_BOOLOPT={0xc, 0x2e, {0x1}}, @IFLA_BR_PRIORITY={0x6, 0x6, 0xff}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6, 0x27, 0x802}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x6c}}, 0x4048010) pwritev2(r1, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x78c00}], 0x1, 0x1200, 0x30, 0x3) r5 = gettid() process_vm_writev(r5, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0x7ffff000}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) (async) process_vm_writev(r5, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0x7ffff000}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) capset(&(0x7f0000000400)={0x19980330, r5}, &(0x7f0000000440)={0x3, 0x101, 0x8, 0x8, 0x6, 0x2}) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x4362, 0x15c) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x4362, 0x15c) getsockopt$llc_int(r6, 0x10c, 0x9, &(0x7f0000000080), &(0x7f0000000140)=0x4) (async) getsockopt$llc_int(r6, 0x10c, 0x9, &(0x7f0000000080), &(0x7f0000000140)=0x4) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) (async) r8 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) r9 = getpid() syz_pidfd_open(r9, 0x0) (async) r10 = syz_pidfd_open(r9, 0x0) setns(r10, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) (async) umount2(&(0x7f0000000040)='.\x00', 0x2) close_range(r7, 0xffffffffffffffff, 0x0) 34.229559ms ago: executing program 2 (id=519): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb85000000430000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r0, 0x0, 0xb}, 0x18) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r2 = fcntl$dupfd(r1, 0x0, r1) write$sndseq(r2, &(0x7f0000000180)=[{0xff, 0x0, 0x10, 0x0, @time={0x800, 0x400}, {0x6}, {}, @raw8={"72efbc660c83bfffecfe7f72"}}, {0x0, 0x0, 0xff, 0x43, @tick=0xf27, {0x1, 0x31}, {0xfc}, @raw32={[0x7, 0x4138cec9, 0x8]}}], 0x38) 0s ago: executing program 2 (id=520): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000980)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000180)=@keyring) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000500)=@chain={'key_or_keyring:', r0}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000037c0)={0x0, 0x0, 0x0}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000006c0), 0x48200, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000a80)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1088d8b8588d72ec29c48f0af5f2d9f51c4b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465ad32b77a74e802a0dc6bf25cca242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000026abfb0767042361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae645ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1fb8f72cd317902f19e385be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa7956488bef241875f3b4b6ab7929a57affe760e797724f4fce1093b62d7e8c7123d890decacec55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f870b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f154772f514216bdf57d2a40d40b51ab67903ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1594e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270bb29b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214d00000000d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c471c784ae7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec30cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd63bed8d31c31c37a373d4efd89f0000377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f0059161c5e0000000000000000000057d77480e0345effff6413258d1f6eb190aa28cbb4bafe34124172e436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fa03b84f63e022fe755f4007a4a899eaf52c4f491d8e97c862e29e457060000007ac691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104ebc1581848f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c716357d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c24936615ee68538e8fddd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426ca85e82ccf821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ad6acf5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba1c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63c41cbde2ba66ad81168070c8c6e18a6e452a31bdc4a60d637545ed4c8a1c649c3ce54ad3e16304d06a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c5140200000054d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c7340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a3bc38613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b9e6626f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f14eafe4b28ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1bfeef448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae0040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483f02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e9180100000000000000654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732e74dd690c57bdfdc1f069f9491bca7a8c59363799be70018c25ece5ad7307dc7a95c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2cdfb7fea73ca18874664d60a4b9423f3297bc8eb91b4ee1d73272ab28a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece98c077b358e752b439132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae2676384ff799783f55d7e5a1a092a01b965dc99cb7a9d98440c355927629f2bcf9dc2396eb2f5d25829715b24327642ac48f1201014a95e0e65e12cdf27e19043e3c5d3e798375cead35b9a93190a52cdecaaccc854a1d41ef365303f0e9b4fc969c9dab6df5e8a795b140fcc09e8a7b694d12932917facd8ceaa4e2d0d16bb0b95387fcd5ff136d8abddf94daf442bbff744591931872a36cf921ad69f2127386e8b0f9afee4da8d3fbec809fbb3ca0fded2859cf25d4c6155d396c5b9bd1a928923123f63f4c40688eae69990a9419456247bbaeb7948de84d2ff875414883bb1e503d4bfebc01bc12a53ea06bf38e571157bd642dac25dbee7832c58378374a39483d6721eec96c28911db21c0c006b42afc90000000000000000000000700000000000000000008ce4ea442c1a207108b35511186c5e860278f6463f52f3990ce08b1bfccc3cff4b5ae27b610aa9ba11b47d4f94c439e055cdbb2b12c983885c93ea4ab4ca1e02d831ae162ee104"], &(0x7f0000000100)='GPL\x00'}, 0x41) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000100)=0x2) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCVHANGUP(r3, 0x5437, 0x200000000000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r5}, 0x18) stat(0x0, 0x0) r6 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES16=r6, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b800800090000000000080009000000000008000a000000000008000a000000000008000a000000000008000900000000000800097c86b722735035dc0067f6b13308000a000000000008000a000000000008000900975b9b5e04000b801c000b800800090000000900000009005e2a2d7a080009000000000024000b80080009e6ff0000000800090000000000080009000000000008"], 0x184}}, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000040), 0x208e24b) kernel console output (not intermixed with test programs): /0x10 [ 57.089703][ T4539] __sock_sendmsg+0x145/0x180 [ 57.089864][ T4539] ____sys_sendmsg+0x31e/0x4e0 [ 57.089915][ T4539] ___sys_sendmsg+0x17b/0x1d0 [ 57.089978][ T4539] __x64_sys_sendmsg+0xd4/0x160 [ 57.090074][ T4539] x64_sys_call+0x2999/0x2fb0 [ 57.090103][ T4539] do_syscall_64+0xd2/0x200 [ 57.090128][ T4539] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 57.090171][ T4539] ? clear_bhb_loop+0x40/0x90 [ 57.090222][ T4539] ? clear_bhb_loop+0x40/0x90 [ 57.090252][ T4539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.090282][ T4539] RIP: 0033:0x7f5112dbe929 [ 57.090301][ T4539] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 57.090326][ T4539] RSP: 002b:00007f5111427038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 57.090369][ T4539] RAX: ffffffffffffffda RBX: 00007f5112fe5fa0 RCX: 00007f5112dbe929 [ 57.090387][ T4539] RDX: 0000000000000000 RSI: 00002000000007c0 RDI: 0000000000000007 [ 57.090400][ T4539] RBP: 00007f5111427090 R08: 0000000000000000 R09: 0000000000000000 [ 57.090412][ T4539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 57.090439][ T4539] R13: 0000000000000000 R14: 00007f5112fe5fa0 R15: 00007fff81f82928 [ 57.090461][ T4539] [ 57.117454][ T4405] loop1: p146 size 8192 extends beyond EOD, [ 57.124437][ T4536] EXT4-fs (loop2): i_reserved_data_blocks=79 [ 57.134510][ T4405] truncated [ 57.404027][ T4405] loop1: p147 size 67108992 extends beyond EOD, truncated [ 57.411739][ T4405] loop1: p148 size 8192 extends beyond EOD, truncated [ 57.423741][ T4405] loop1: p149 size 67108992 extends beyond EOD, truncated [ 57.432342][ T4405] loop1: p150 size 8192 extends beyond EOD, truncated [ 57.439897][ T4405] loop1: p151 size 67108992 extends beyond EOD, truncated [ 57.447660][ T4405] loop1: p152 size 8192 extends beyond EOD, truncated [ 57.455176][ T4405] loop1: p153 size 67108992 extends beyond EOD, truncated [ 57.463972][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000900. [ 57.473577][ T4405] loop1: p154 size 8192 extends beyond EOD, truncated [ 57.481037][ T4405] loop1: p155 size 67108992 extends beyond EOD, truncated [ 57.488890][ T4405] loop1: p156 size 8192 extends beyond EOD, truncated [ 57.496421][ T4405] loop1: p157 size 67108992 extends beyond EOD, truncated [ 57.504671][ T4405] loop1: p158 size 8192 extends beyond EOD, truncated [ 57.512159][ T4405] loop1: p159 size 67108992 extends beyond EOD, truncated [ 57.527246][ T4405] loop1: p160 size 8192 extends beyond EOD, truncated [ 57.538293][ T4405] loop1: p161 size 67108992 extends beyond EOD, truncated [ 57.546679][ T4405] loop1: p162 size 8192 extends beyond EOD, truncated [ 57.554671][ T4405] loop1: p163 size 67108992 extends beyond EOD, truncated [ 57.586648][ T4405] loop1: p164 size 8192 extends beyond EOD, truncated [ 57.600008][ T4405] loop1: p165 size 67108992 extends beyond EOD, truncated [ 57.608081][ T4405] loop1: p166 size 8192 extends beyond EOD, truncated [ 57.618120][ T4405] loop1: p167 size 67108992 extends beyond EOD, truncated [ 57.627527][ T4405] loop1: p168 size 8192 extends beyond EOD, truncated [ 57.635703][ T4405] loop1: p169 size 67108992 extends beyond EOD, truncated [ 57.645308][ T4405] loop1: p170 size 8192 extends beyond EOD, truncated [ 57.653168][ T4405] loop1: p171 size 67108992 extends beyond EOD, truncated [ 57.660934][ T4405] loop1: p172 size 8192 extends beyond EOD, truncated [ 57.668659][ T4405] loop1: p173 size 67108992 extends beyond EOD, truncated [ 57.678151][ T4405] loop1: p174 size 8192 extends beyond EOD, truncated [ 57.700616][ T4550] ieee802154 phy0 wpan0: encryption failed: -22 [ 57.709566][ T29] audit: type=1400 audit(1751421126.465:969): avc: denied { create } for pid=4546 comm="syz.2.289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 57.729434][ T29] audit: type=1400 audit(1751421126.465:970): avc: denied { write } for pid=4546 comm="syz.2.289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 57.763847][ T4405] loop1: p175 size 67108992 extends beyond EOD, truncated [ 57.771755][ T4405] loop1: p176 size 8192 extends beyond EOD, truncated [ 57.779316][ T4405] loop1: p177 size 67108992 extends beyond EOD, truncated [ 57.786631][ T29] audit: type=1400 audit(1751421126.526:971): avc: denied { accept } for pid=4546 comm="syz.2.289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 57.806780][ T4405] loop1: p178 size 8192 extends beyond EOD, truncated [ 57.814351][ T4405] loop1: p179 size 67108992 extends beyond EOD, truncated [ 57.822209][ T4405] loop1: p180 size 8192 extends beyond EOD, truncated [ 57.829878][ T4405] loop1: p181 size 67108992 extends beyond EOD, truncated [ 57.837694][ T4405] loop1: p182 size 8192 extends beyond EOD, truncated [ 57.845326][ T4405] loop1: p183 size 67108992 extends beyond EOD, truncated [ 57.857444][ T4405] loop1: p184 size 8192 extends beyond EOD, truncated [ 57.867253][ T4558] loop4: detected capacity change from 0 to 8192 [ 57.872819][ T4405] loop1: p185 size 67108992 extends beyond EOD, truncated [ 57.882752][ T4405] loop1: p186 size 8192 extends beyond EOD, truncated [ 57.944818][ T4405] loop1: p187 size 67108992 extends beyond EOD, truncated [ 57.966479][ T4405] loop1: p188 size 8192 extends beyond EOD, truncated [ 57.973429][ T29] audit: type=1326 audit(1751421126.727:972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4555 comm="syz.4.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f4526e929 code=0x7ffc0000 [ 57.996770][ T29] audit: type=1326 audit(1751421126.727:973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4555 comm="syz.4.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f4526e929 code=0x7ffc0000 [ 58.020108][ T29] audit: type=1326 audit(1751421126.727:974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4555 comm="syz.4.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3f4526e929 code=0x7ffc0000 [ 58.027795][ T4568] can0: slcan on ttyS3. [ 58.043454][ T29] audit: type=1326 audit(1751421126.727:975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4555 comm="syz.4.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f4526e929 code=0x7ffc0000 [ 58.070803][ T29] audit: type=1326 audit(1751421126.727:976): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4555 comm="syz.4.292" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f4526e929 code=0x7ffc0000 [ 58.096935][ T4405] loop1: p189 size 67108992 extends beyond EOD, truncated [ 58.104874][ T4405] loop1: p190 size 8192 extends beyond EOD, truncated [ 58.112505][ T4405] loop1: p191 size 67108992 extends beyond EOD, truncated [ 58.120131][ T4405] loop1: p192 size 8192 extends beyond EOD, truncated [ 58.127510][ T4405] loop1: p193 size 67108992 extends beyond EOD, truncated [ 58.135572][ T4405] loop1: p194 size 8192 extends beyond EOD, truncated [ 58.146268][ T4405] loop1: p195 size 67108992 extends beyond EOD, truncated [ 58.162912][ T4405] loop1: p196 size 8192 extends beyond EOD, truncated [ 58.179395][ T4405] loop1: p197 size 67108992 extends beyond EOD, truncated [ 58.217559][ T4405] loop1: p198 size 8192 extends beyond EOD, truncated [ 58.233730][ T4405] loop1: p199 size 67108992 extends beyond EOD, truncated [ 58.250983][ T4405] loop1: p200 size 8192 extends beyond EOD, truncated [ 58.267480][ T4405] loop1: p201 size 67108992 extends beyond EOD, truncated [ 58.284668][ T4405] loop1: p202 size 8192 extends beyond EOD, truncated [ 58.307811][ T4405] loop1: p203 size 67108992 extends beyond EOD, truncated [ 58.322270][ T4405] loop1: p204 size 8192 extends beyond EOD, truncated [ 58.322557][ T4595] netlink: 'syz.4.295': attribute type 21 has an invalid length. [ 58.337057][ T4595] IPv6: NLM_F_CREATE should be specified when creating new route [ 58.343266][ T4405] loop1: p205 size 67108992 extends beyond EOD, truncated [ 58.379491][ T4405] loop1: p206 size 8192 extends beyond EOD, truncated [ 58.405755][ T4405] loop1: p207 size 67108992 extends beyond EOD, truncated [ 58.448489][ T4405] loop1: p208 size 8192 extends beyond EOD, truncated [ 58.469975][ T4606] loop4: detected capacity change from 0 to 1024 [ 58.470588][ T4405] loop1: p209 size 67108992 extends beyond EOD, truncated [ 58.485074][ T4405] loop1: p210 size 8192 extends beyond EOD, truncated [ 58.500300][ T4606] EXT4-fs: Ignoring removed i_version option [ 58.509726][ T4609] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 58.523843][ T4405] loop1: p211 size 67108992 extends beyond EOD, truncated [ 58.536742][ T4405] loop1: p212 size 8192 extends beyond EOD, truncated [ 58.550437][ T4606] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 58.562948][ T4405] loop1: p213 size 67108992 extends beyond EOD, truncated [ 58.570234][ T4617] loop2: detected capacity change from 0 to 256 [ 58.579031][ T4405] loop1: p214 size 8192 extends beyond EOD, truncated [ 58.586540][ T4405] loop1: p215 size 67108992 extends beyond EOD, truncated [ 58.621368][ T4405] loop1: p216 size 8192 extends beyond EOD, truncated [ 58.647013][ T4405] loop1: p217 size 67108992 extends beyond EOD, truncated [ 58.659942][ T4609] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 58.682688][ T4405] loop1: p218 size 8192 extends beyond EOD, truncated [ 58.705734][ T4556] can0 (unregistered): slcan off ttyS3. [ 58.711588][ T4405] loop1: p219 size 67108992 extends beyond EOD, truncated [ 58.763035][ T4405] loop1: p220 size 8192 extends beyond EOD, truncated [ 58.775135][ T4609] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 58.843942][ T4405] loop1: p221 size 67108992 extends beyond EOD, truncated [ 58.875060][ T4405] loop1: p222 size 8192 extends beyond EOD, truncated [ 58.882229][ T3304] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz-executor: bg 0: block 88: padding at end of block bitmap is not set [ 58.891872][ T4676] netlink: 4 bytes leftover after parsing attributes in process `syz.6.298'. [ 58.904796][ T4617] FAT-fs (loop2): Directory bread(block 64) failed [ 58.913002][ T4405] loop1: p223 size 67108992 extends beyond EOD, truncated [ 58.921031][ T4405] loop1: p224 size 8192 extends beyond EOD, truncated [ 58.932723][ T4617] FAT-fs (loop2): Directory bread(block 65) failed [ 58.948096][ T4405] loop1: p225 size 67108992 extends beyond EOD, truncated [ 58.955628][ T3304] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6548: Corrupt filesystem [ 58.968078][ T4617] FAT-fs (loop2): Directory bread(block 66) failed [ 58.976817][ T4676] netlink: 4 bytes leftover after parsing attributes in process `syz.6.298'. [ 58.980489][ T4405] loop1: p226 size 8192 extends beyond EOD, truncated [ 59.000723][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.002357][ T4617] FAT-fs (loop2): Directory bread(block 67) failed [ 59.018903][ T4405] loop1: p227 size 67108992 extends beyond EOD, truncated [ 59.029699][ T4617] FAT-fs (loop2): Directory bread(block 68) failed [ 59.037077][ T4405] loop1: p228 size 8192 extends beyond EOD, truncated [ 59.049646][ T4617] FAT-fs (loop2): Directory bread(block 69) failed [ 59.058185][ T4405] loop1: p229 size 67108992 extends beyond EOD, truncated [ 59.071106][ T4617] FAT-fs (loop2): Directory bread(block 70) failed [ 59.088198][ T4405] loop1: p230 size 8192 extends beyond EOD, truncated [ 59.095161][ T4617] FAT-fs (loop2): Directory bread(block 71) failed [ 59.107394][ T4617] FAT-fs (loop2): Directory bread(block 72) failed [ 59.114967][ T4696] netlink: 36 bytes leftover after parsing attributes in process `syz.5.300'. [ 59.124266][ T4617] FAT-fs (loop2): Directory bread(block 73) failed [ 59.150516][ T4405] loop1: p231 size 67108992 extends beyond EOD, truncated [ 59.158371][ T4405] loop1: p232 size 8192 extends beyond EOD, truncated [ 59.177773][ T4405] loop1: p233 size 67108992 extends beyond EOD, truncated [ 59.197737][ T4405] loop1: p234 size 8192 extends beyond EOD, truncated [ 59.199068][ T4696] SELinux: ebitmap: truncated map [ 59.205701][ T4405] loop1: p235 size 67108992 extends beyond EOD, truncated [ 59.217691][ T4405] loop1: p236 size 8192 extends beyond EOD, truncated [ 59.224122][ T4696] SELinux: failed to load policy [ 59.230823][ T4405] loop1: p237 size 67108992 extends beyond EOD, truncated [ 59.238370][ T4617] syz.2.297: attempt to access beyond end of device [ 59.238370][ T4617] loop2: rw=524288, sector=1768, nr_sectors = 4 limit=256 [ 59.240376][ T4405] loop1: p238 size 8192 extends beyond EOD, truncated [ 59.259742][ T4405] loop1: p239 size 67108992 extends beyond EOD, truncated [ 59.261547][ T4609] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.267480][ T4405] loop1: p240 size 8192 extends beyond EOD, truncated [ 59.284762][ T4405] loop1: p241 size 67108992 extends beyond EOD, truncated [ 59.293205][ T4405] loop1: p242 size 8192 extends beyond EOD, truncated [ 59.301379][ T4405] loop1: p243 size 67108992 extends beyond EOD, truncated [ 59.310788][ T4617] syz.2.297: attempt to access beyond end of device [ 59.310788][ T4617] loop2: rw=0, sector=1768, nr_sectors = 4 limit=256 [ 59.327141][ T4405] loop1: p244 size 8192 extends beyond EOD, truncated [ 59.337592][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.339625][ T4405] loop1: p245 size 67108992 extends beyond EOD, [ 59.345035][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.345043][ T4405] truncated [ 59.345061][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.352861][ T4405] loop1: p246 size 8192 extends beyond EOD, truncated [ 59.376481][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.383980][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.385309][ T4405] loop1: p247 size 67108992 extends beyond EOD, [ 59.391388][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.391414][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.391434][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.391453][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.397786][ T4405] truncated [ 59.398825][ T4405] loop1: p248 size 8192 extends beyond EOD, [ 59.405165][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.412540][ T4405] truncated [ 59.419921][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.444697][ T4405] loop1: p249 size 67108992 extends beyond EOD, [ 59.447583][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.454949][ T4405] truncated [ 59.455752][ T4405] loop1: p250 size 8192 extends beyond EOD, [ 59.462238][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.469831][ T4405] truncated [ 59.472930][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.487613][ T4405] loop1: p251 size 67108992 extends beyond EOD, truncated [ 59.500769][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.511578][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.514555][ T4405] loop1: p252 size 8192 extends beyond EOD, [ 59.519005][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.525024][ T4405] truncated [ 59.532380][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.538777][ T4405] loop1: p253 size 67108992 extends beyond EOD, [ 59.542863][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.542922][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.549266][ T4405] truncated [ 59.556621][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.556723][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.566537][ T4405] loop1: p254 size 8192 extends beyond EOD, [ 59.567110][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.567131][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.567184][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.574526][ T4405] truncated [ 59.581903][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.581925][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.581950][ T993] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 59.614920][ T4405] loop1: p255 size 67108992 extends beyond EOD, truncated [ 59.665634][ T993] hid-generic 0000:0000:0000.000B: hidraw0: HID v8.00 Device [syz1] on syz0 [ 59.712213][ T4609] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.723143][ T4708] netlink: 80 bytes leftover after parsing attributes in process `syz.4.303'. [ 59.740753][ T4708] loop4: detected capacity change from 0 to 256 [ 59.748169][ T4609] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.783753][ T4609] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.799331][ T4722] 9pnet_fd: Insufficient options for proto=fd [ 59.807803][ T4723] capability: warning: `syz.5.306' uses deprecated v2 capabilities in a way that may be insecure [ 59.819873][ T4609] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.986135][ T2995] loop1: p1 p2 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 p217 p218 p219 p220 p221 p222 p223 p224 p225 [ 59.986844][ T2995] loop1: p1 size 67108992 extends beyond EOD, [ 59.991263][ T4737] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 59.991263][ T4737] program syz.4.309 not setting count and/or reply_len properly [ 60.077944][ T2995] truncated [ 60.143753][ T2995] loop1: p3 size 560128 extends beyond EOD, truncated [ 60.164651][ T2995] loop1: p4 size 8192 extends beyond EOD, truncated [ 60.178181][ T4740] netlink: 268 bytes leftover after parsing attributes in process `syz.2.310'. [ 60.187322][ T4740] unsupported nla_type 65024 [ 60.191282][ T2995] loop1: p5 size 67108992 extends beyond EOD, truncated [ 60.213479][ T2995] loop1: p6 size 8192 extends beyond EOD, truncated [ 60.230941][ T2995] loop1: p7 size 67108992 extends beyond EOD, truncated [ 60.238718][ T2995] loop1: p8 size 8192 extends beyond EOD, truncated [ 60.246617][ T2995] loop1: p9 size 67108992 extends beyond EOD, truncated [ 60.255934][ T2995] loop1: p10 size 8192 extends beyond EOD, truncated [ 60.264780][ T2995] loop1: p11 size 67108992 extends beyond EOD, truncated [ 60.274365][ T2995] loop1: p12 size 8192 extends beyond EOD, truncated [ 60.281233][ T4750] netlink: 52 bytes leftover after parsing attributes in process `syz.6.312'. [ 60.296283][ T2995] loop1: p13 size 67108992 extends beyond EOD, truncated [ 60.300459][ T4747] loop4: detected capacity change from 0 to 2048 [ 60.314088][ T2995] loop1: p14 size 8192 extends beyond EOD, truncated [ 60.324111][ T4747] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 60.326223][ T2995] loop1: p15 size 67108992 extends beyond EOD, truncated [ 60.343851][ T2995] loop1: p16 size 8192 extends beyond EOD, truncated [ 60.352121][ T2995] loop1: p17 size 67108992 extends beyond EOD, truncated [ 60.369824][ T4747] ALSA: seq fatal error: cannot create timer (-19) [ 60.370007][ T2995] loop1: p18 size 8192 extends beyond EOD, truncated [ 60.377191][ T4747] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 60.383990][ T2995] loop1: p19 size 67108992 extends beyond EOD, truncated [ 60.405512][ T2995] loop1: p20 size 8192 extends beyond EOD, truncated [ 60.412616][ T2995] loop1: p21 size 67108992 extends beyond EOD, truncated [ 60.420247][ T2995] loop1: p22 size 8192 extends beyond EOD, truncated [ 60.427793][ T2995] loop1: p23 size 67108992 extends beyond EOD, truncated [ 60.435837][ T2995] loop1: p24 size 8192 extends beyond EOD, truncated [ 60.443266][ T2995] loop1: p25 size 67108992 extends beyond EOD, truncated [ 60.450941][ T2995] loop1: p26 size 8192 extends beyond EOD, truncated [ 60.458168][ T2995] loop1: p27 size 67108992 extends beyond EOD, truncated [ 60.465829][ T2995] loop1: p28 size 8192 extends beyond EOD, truncated [ 60.473046][ T2995] loop1: p29 size 67108992 extends beyond EOD, truncated [ 60.480741][ T2995] loop1: p30 size 8192 extends beyond EOD, truncated [ 60.488307][ T2995] loop1: p31 size 67108992 extends beyond EOD, truncated [ 60.496696][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 60.506392][ T2995] loop1: p32 size 8192 extends beyond EOD, truncated [ 60.513743][ T2995] loop1: p33 size 67108992 extends beyond EOD, truncated [ 60.522059][ T2995] loop1: p34 size 8192 extends beyond EOD, truncated [ 60.537168][ T2995] loop1: p35 size 67108992 extends beyond EOD, truncated [ 60.544867][ T2995] loop1: p36 size 8192 extends beyond EOD, truncated [ 60.553861][ T2995] loop1: p37 size 67108992 extends beyond EOD, truncated [ 60.562573][ T2995] loop1: p38 size 8192 extends beyond EOD, truncated [ 60.564259][ T4762] netlink: 4 bytes leftover after parsing attributes in process `syz.4.314'. [ 60.569960][ T2995] loop1: p39 size 67108992 extends beyond EOD, truncated [ 60.585839][ T2995] loop1: p40 size 8192 extends beyond EOD, truncated [ 60.596959][ T2995] loop1: p41 size 67108992 extends beyond EOD, truncated [ 60.607363][ T2995] loop1: p42 size 8192 extends beyond EOD, truncated [ 60.609050][ T4762] netlink: 4 bytes leftover after parsing attributes in process `syz.4.314'. [ 60.614816][ T2995] loop1: p43 size 67108992 extends beyond EOD, truncated [ 60.630706][ T4765] netlink: 4 bytes leftover after parsing attributes in process `syz.5.316'. [ 60.650994][ T2995] loop1: p44 size 8192 extends beyond EOD, truncated [ 60.667807][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.675265][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.682713][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.691012][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.691218][ T2995] loop1: p45 size 67108992 extends beyond EOD, truncated [ 60.698432][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.712991][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.720400][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.728884][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.736314][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.737783][ T2995] loop1: p46 size 8192 extends beyond EOD, truncated [ 60.744563][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.757925][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.760208][ T2995] loop1: p47 size 67108992 extends beyond EOD, [ 60.765312][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.765337][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.765357][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.766438][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.771686][ T2995] truncated [ 60.779049][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.779080][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.793154][ T4770] netlink: 4 bytes leftover after parsing attributes in process `syz.5.316'. [ 60.793879][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.793902][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.824438][ T2995] loop1: p48 size 8192 extends beyond EOD, [ 60.828093][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.835481][ T2995] truncated [ 60.842873][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.866947][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.874356][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.881795][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.889345][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.896822][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.904325][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.911755][ T993] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 60.925419][ T2995] loop1: p49 size 67108992 extends beyond EOD, truncated [ 60.932942][ T993] hid-generic 0000:0000:0000.000C: hidraw0: HID v8.00 Device [syz1] on syz0 [ 60.944801][ T2995] loop1: p50 size 8192 extends beyond EOD, truncated [ 60.954439][ T2995] loop1: p51 size 67108992 extends beyond EOD, truncated [ 60.963698][ T2995] loop1: p52 size 8192 extends beyond EOD, truncated [ 60.971250][ T2995] loop1: p53 size 67108992 extends beyond EOD, truncated [ 60.980383][ T2995] loop1: p54 size 8192 extends beyond EOD, truncated [ 61.006851][ T2995] loop1: p55 size 67108992 extends beyond EOD, truncated [ 61.015227][ T2995] loop1: p56 size 8192 extends beyond EOD, truncated [ 61.022698][ T2995] loop1: p57 size 67108992 extends beyond EOD, truncated [ 61.034214][ T2995] loop1: p58 size 8192 extends beyond EOD, truncated [ 61.041473][ T2995] loop1: p59 size 67108992 extends beyond EOD, truncated [ 61.050909][ T2995] loop1: p60 size 8192 extends beyond EOD, truncated [ 61.058487][ T2995] loop1: p61 size 67108992 extends beyond EOD, truncated [ 61.070493][ T2995] loop1: p62 size 8192 extends beyond EOD, truncated [ 61.077969][ T2995] loop1: p63 size 67108992 extends beyond EOD, truncated [ 61.087255][ T2995] loop1: p64 size 8192 extends beyond EOD, truncated [ 61.094927][ T2995] loop1: p65 size 67108992 extends beyond EOD, truncated [ 61.102446][ T2995] loop1: p66 size 8192 extends beyond EOD, truncated [ 61.111577][ T2995] loop1: p67 size 67108992 extends beyond EOD, truncated [ 61.119416][ T2995] loop1: p68 size 8192 extends beyond EOD, truncated [ 61.126963][ T2995] loop1: p69 size 67108992 extends beyond EOD, truncated [ 61.134717][ T2995] loop1: p70 size 8192 extends beyond EOD, truncated [ 61.150656][ T2995] loop1: p71 size 67108992 extends beyond EOD, truncated [ 61.158651][ T2995] loop1: p72 size 8192 extends beyond EOD, truncated [ 61.168245][ T2995] loop1: p73 size 67108992 extends beyond EOD, truncated [ 61.184376][ T2995] loop1: p74 size 8192 extends beyond EOD, truncated [ 61.194296][ T2995] loop1: p75 size 67108992 extends beyond EOD, truncated [ 61.212118][ T2995] loop1: p76 size 8192 extends beyond EOD, truncated [ 61.223326][ T2995] loop1: p77 size 67108992 extends beyond EOD, truncated [ 61.240623][ T4779] RDS: rds_bind could not find a transport for ::ffff:172.30.1.5, load rds_tcp or rds_rdma? [ 61.244890][ T2995] loop1: p78 size 8192 extends beyond EOD, truncated [ 61.265467][ T2995] loop1: p79 size 67108992 extends beyond EOD, truncated [ 61.278556][ T2995] loop1: p80 size 8192 extends beyond EOD, truncated [ 61.279147][ T4776] SELinux: failed to load policy [ 61.290946][ T2995] loop1: p81 size 67108992 extends beyond EOD, truncated [ 61.311112][ T2995] loop1: p82 size 8192 extends beyond EOD, truncated [ 61.315087][ T4782] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 61.315087][ T4782] program syz.5.321 not setting count and/or reply_len properly [ 61.351347][ T2995] loop1: p83 size 67108992 extends beyond EOD, truncated [ 61.359102][ T2995] loop1: p84 size 8192 extends beyond EOD, truncated [ 61.368129][ T2995] loop1: p85 size 67108992 extends beyond EOD, truncated [ 61.387232][ T2995] loop1: p86 size 8192 extends beyond EOD, truncated [ 61.404880][ T2995] loop1: p87 size 67108992 extends beyond EOD, truncated [ 61.425519][ T2995] loop1: p88 size 8192 extends beyond EOD, truncated [ 61.445048][ T2995] loop1: p89 size 67108992 extends beyond EOD, truncated [ 61.472383][ T2995] loop1: p90 size 8192 extends beyond EOD, truncated [ 61.481630][ T4784] loop5: detected capacity change from 0 to 128 [ 61.491940][ T2995] loop1: p91 size 67108992 extends beyond EOD, truncated [ 61.508612][ T2995] loop1: p92 size 8192 extends beyond EOD, truncated [ 61.516769][ T4784] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 61.530370][ T2995] loop1: p93 size 67108992 extends beyond EOD, truncated [ 61.537726][ T4784] ext4 filesystem being mounted at /24/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 61.557495][ T2995] loop1: p94 size 8192 extends beyond EOD, truncated [ 61.592895][ T2995] loop1: p95 size 67108992 extends beyond EOD, truncated [ 61.600471][ T2995] loop1: p96 size 8192 extends beyond EOD, truncated [ 61.607673][ T2995] loop1: p97 size 67108992 extends beyond EOD, truncated [ 61.617963][ T2995] loop1: p98 size 8192 extends beyond EOD, truncated [ 61.618425][ T4038] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 61.635963][ T2995] loop1: p99 size 67108992 extends beyond EOD, truncated [ 61.654313][ T2995] loop1: p100 size 8192 extends beyond EOD, truncated [ 61.661503][ T4787] loop6: detected capacity change from 0 to 512 [ 61.669706][ T2995] loop1: p101 size 67108992 extends beyond EOD, truncated [ 61.696865][ T4787] EXT4-fs error (device loop6): ext4_acquire_dquot:6933: comm +}[@: Failed to acquire dquot type 1 [ 61.708544][ T2995] loop1: p102 size 8192 extends beyond EOD, truncated [ 61.724592][ T4787] EXT4-fs (loop6): 1 truncate cleaned up [ 61.742136][ T4787] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 61.754877][ T2995] loop1: p103 size 67108992 extends beyond EOD, truncated [ 61.771754][ T2995] loop1: p104 size 8192 extends beyond EOD, truncated [ 61.784547][ T4787] ext4 filesystem being mounted at /25/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 61.795223][ T2995] loop1: p105 size 67108992 extends beyond EOD, truncated [ 61.807873][ T4787] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 61.829694][ T2995] loop1: p106 size 8192 extends beyond EOD, truncated [ 61.842655][ T4796] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 61.853145][ T2995] loop1: p107 size 67108992 extends beyond EOD, truncated [ 61.861423][ T4796] vhci_hcd: invalid port number 96 [ 61.866580][ T4796] vhci_hcd: default hub control req: 0000 vfffc i0060 l0 [ 61.876002][ T2995] loop1: p108 size 8192 extends beyond EOD, truncated [ 61.890730][ T2995] loop1: p109 size 67108992 extends beyond EOD, truncated [ 61.908758][ T2995] loop1: p110 size 8192 extends beyond EOD, truncated [ 61.924190][ T4798] loop5: detected capacity change from 0 to 512 [ 61.929088][ T2995] loop1: p111 size 67108992 extends beyond EOD, truncated [ 61.938404][ T2995] loop1: p112 size 8192 extends beyond EOD, truncated [ 61.945952][ T2995] loop1: p113 size 67108992 extends beyond EOD, truncated [ 61.948491][ T4800] Cannot find del_set index 3 as target [ 61.959415][ T2995] loop1: p114 size 8192 extends beyond EOD, truncated [ 61.969522][ T4798] __quota_error: 277 callbacks suppressed [ 61.969603][ T4798] Quota error (device loop5): do_check_range: Getting dqdh_prev_free 1536 out of range 0-5 [ 61.977284][ T2995] loop1: p115 size 67108992 extends beyond EOD, truncated [ 61.985480][ T4798] Quota error (device loop5): qtree_write_dquot: Error -117 occurred while creating quota [ 62.003780][ T4798] EXT4-fs error (device loop5): ext4_acquire_dquot:6933: comm +}[@: Failed to acquire dquot type 1 [ 62.009162][ T2995] loop1: p116 size 8192 extends beyond EOD, truncated [ 62.038562][ T2995] loop1: p117 size 67108992 extends beyond EOD, truncated [ 62.052688][ T4798] EXT4-fs (loop5): 1 truncate cleaned up [ 62.056688][ T2995] loop1: p118 size 8192 extends beyond EOD, truncated [ 62.065998][ T2995] loop1: p119 size 67108992 extends beyond EOD, truncated [ 62.068733][ T4798] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 62.074119][ T2995] loop1: p120 size 8192 extends beyond EOD, truncated [ 62.093578][ T2995] loop1: p121 size 67108992 extends beyond EOD, truncated [ 62.097091][ T4805] loop6: detected capacity change from 0 to 512 [ 62.101416][ T2995] loop1: p122 size 8192 extends beyond EOD, truncated [ 62.114796][ T2995] loop1: p123 size 67108992 extends beyond EOD, truncated [ 62.122868][ T2995] loop1: p124 size 8192 extends beyond EOD, truncated [ 62.130448][ T2995] loop1: p125 size 67108992 extends beyond EOD, truncated [ 62.138447][ T2995] loop1: p126 size 8192 extends beyond EOD, truncated [ 62.138518][ T4805] EXT4-fs: Ignoring removed i_version option [ 62.145898][ T2995] loop1: p127 size 67108992 extends beyond EOD, [ 62.151349][ T4805] EXT4-fs: Ignoring removed mblk_io_submit option [ 62.164163][ T2995] truncated [ 62.168259][ T2995] loop1: p128 size 8192 extends beyond EOD, truncated [ 62.169340][ T4798] ext4 filesystem being mounted at /26/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 62.175661][ T2995] loop1: p129 size 67108992 extends beyond EOD, truncated [ 62.193457][ T2995] loop1: p130 size 8192 extends beyond EOD, truncated [ 62.201171][ T2995] loop1: p131 size 67108992 extends beyond EOD, truncated [ 62.208940][ T4805] EXT4-fs error (device loop6): ext4_orphan_get:1393: comm syz.6.329: inode #13: comm syz.6.329: iget: illegal inode # [ 62.209073][ T2995] loop1: p132 size 8192 extends beyond EOD, truncated [ 62.222707][ T4805] EXT4-fs error (device loop6): ext4_orphan_get:1398: comm syz.6.329: couldn't read orphan inode 13 (err -117) [ 62.228958][ T2995] loop1: p133 size 67108992 extends beyond EOD, truncated [ 62.248001][ T2995] loop1: p134 size 8192 extends beyond EOD, truncated [ 62.255300][ T2995] loop1: p135 size 67108992 extends beyond EOD, truncated [ 62.263285][ T2995] loop1: p136 size 8192 extends beyond EOD, truncated [ 62.263289][ T4798] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 62.270824][ T2995] loop1: p137 size 67108992 extends beyond EOD, truncated [ 62.287095][ T2995] loop1: p138 size 8192 extends beyond EOD, truncated [ 62.294647][ T2995] loop1: p139 size 67108992 extends beyond EOD, truncated [ 62.302595][ T2995] loop1: p140 size 8192 extends beyond EOD, truncated [ 62.309970][ T2995] loop1: p141 size 67108992 extends beyond EOD, truncated [ 62.317736][ T2995] loop1: p142 size 8192 extends beyond EOD, truncated [ 62.322733][ T4805] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 62.325085][ T2995] loop1: p143 size 67108992 extends beyond EOD, truncated [ 62.344657][ T2995] loop1: p144 size 8192 extends beyond EOD, truncated [ 62.352214][ T2995] loop1: p145 size 67108992 extends beyond EOD, truncated [ 62.360073][ T2995] loop1: p146 size 8192 extends beyond EOD, truncated [ 62.367668][ T2995] loop1: p147 size 67108992 extends beyond EOD, truncated [ 62.375464][ T2995] loop1: p148 size 8192 extends beyond EOD, truncated [ 62.383506][ T29] audit: type=1400 audit(1751421131.190:1252): avc: denied { name_connect } for pid=4804 comm="syz.6.329" dest=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 62.396754][ T2995] loop1: p149 size 67108992 extends beyond EOD, truncated [ 62.414277][ T4811] loop2: detected capacity change from 0 to 1024 [ 62.420776][ T4805] sctp: [Deprecated]: syz.6.329 (pid 4805) Use of int in maxseg socket option. [ 62.420776][ T4805] Use struct sctp_assoc_value instead [ 62.421290][ T2995] loop1: p150 size 8192 extends beyond EOD, truncated [ 62.485675][ T2995] loop1: p151 size 67108992 extends beyond EOD, truncated [ 62.487231][ T29] audit: type=1400 audit(1751421131.271:1253): avc: denied { read } for pid=4804 comm="syz.6.329" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 62.503463][ T2995] loop1: p152 size 8192 extends beyond EOD, truncated [ 62.535574][ T4811] EXT4-fs (loop2): mounted filesystem 00000000-0500-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 62.538191][ T4816] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 62.538191][ T4816] program syz.5.332 not setting count and/or reply_len properly [ 62.557210][ T4811] FAULT_INJECTION: forcing a failure. [ 62.557210][ T4811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 62.577619][ T4811] CPU: 0 UID: 0 PID: 4811 Comm: syz.2.330 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 62.577799][ T4811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 62.577811][ T4811] Call Trace: [ 62.577818][ T4811] [ 62.577827][ T4811] __dump_stack+0x1d/0x30 [ 62.577853][ T4811] dump_stack_lvl+0xe8/0x140 [ 62.577937][ T4811] dump_stack+0x15/0x1b [ 62.577953][ T4811] should_fail_ex+0x265/0x280 [ 62.578030][ T4811] should_fail+0xb/0x20 [ 62.578061][ T4811] should_fail_usercopy+0x1a/0x20 [ 62.578163][ T4811] _copy_from_user+0x1c/0xb0 [ 62.578184][ T4811] ___sys_sendmsg+0xc1/0x1d0 [ 62.578299][ T4811] __x64_sys_sendmsg+0xd4/0x160 [ 62.578345][ T4811] x64_sys_call+0x2999/0x2fb0 [ 62.578367][ T4811] do_syscall_64+0xd2/0x200 [ 62.578385][ T4811] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 62.578419][ T4811] ? clear_bhb_loop+0x40/0x90 [ 62.578456][ T4811] ? clear_bhb_loop+0x40/0x90 [ 62.578484][ T4811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.578511][ T4811] RIP: 0033:0x7f708660e929 [ 62.578525][ T4811] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 62.578554][ T4811] RSP: 002b:00007f7084c56038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 62.578586][ T4811] RAX: ffffffffffffffda RBX: 00007f7086836080 RCX: 00007f708660e929 [ 62.578606][ T4811] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000007 [ 62.578620][ T4811] RBP: 00007f7084c56090 R08: 0000000000000000 R09: 0000000000000000 [ 62.578634][ T4811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 62.578645][ T4811] R13: 0000000000000000 R14: 00007f7086836080 R15: 00007ffccbc284c8 [ 62.578666][ T4811] [ 62.579655][ T29] audit: type=1400 audit(1751421131.381:1254): avc: denied { getopt } for pid=4809 comm="syz.2.330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 62.598750][ T2995] loop1: p153 size 67108992 extends beyond EOD, [ 62.602102][ T29] audit: type=1400 audit(1751421131.381:1255): avc: denied { setopt } for pid=4809 comm="syz.2.330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 62.605403][ T2995] truncated [ 62.818056][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0500-0000-0000-000000000000. [ 62.828183][ T4825] loop4: detected capacity change from 0 to 1024 [ 62.846839][ T4821] SELinux: failed to load policy [ 62.852621][ T4158] EXT4-fs error (device loop6): htree_dirblock_to_tree:1080: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=76, inode=0, rec_len=0, size=1024 fake=0 [ 62.924867][ T4825] EXT4-fs (loop4): mounted filesystem 00000000-0500-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 62.942747][ T4158] EXT4-fs error (device loop6): ext4_free_branches:1023: inode #11: comm syz-executor: invalid indirect mapped block 131072 (level 2) [ 62.942988][ T2995] loop1: p154 size 8192 extends beyond EOD, truncated [ 63.001153][ T4158] EXT4-fs error (device loop6): ext4_lookup:1791: inode #2: comm syz-executor: deleted inode referenced: 15 [ 63.016158][ T2995] loop1: p155 size 67108992 extends beyond EOD, truncated [ 63.043656][ T2995] loop1: p156 size 8192 extends beyond EOD, truncated [ 63.081513][ T2995] loop1: p157 size 67108992 extends beyond EOD, truncated [ 63.112623][ T4158] EXT4-fs error (device loop6): ext4_lookup:1791: inode #2: comm syz-executor: deleted inode referenced: 15 [ 63.125392][ T2995] loop1: p158 size 8192 extends beyond EOD, truncated [ 63.146904][ T2995] loop1: p159 size 67108992 extends beyond EOD, truncated [ 63.569319][ T2995] loop1: p160 size 8192 extends beyond EOD, truncated [ 63.576719][ T2995] loop1: p161 size 67108992 extends beyond EOD, truncated [ 63.586453][ T2995] loop1: p162 size 8192 extends beyond EOD, truncated [ 63.594110][ T2995] loop1: p163 size 67108992 extends beyond EOD, truncated [ 63.602866][ T2995] loop1: p164 size 8192 extends beyond EOD, truncated [ 63.610083][ T2995] loop1: p165 size 67108992 extends beyond EOD, truncated [ 63.617757][ T2995] loop1: p166 size 8192 extends beyond EOD, truncated [ 63.626412][ T2995] loop1: p167 size 67108992 extends beyond EOD, truncated [ 63.634016][ T2995] loop1: p168 size 8192 extends beyond EOD, truncated [ 63.644675][ T2995] loop1: p169 size 67108992 extends beyond EOD, truncated [ 63.660048][ T2995] loop1: p170 size 8192 extends beyond EOD, truncated [ 63.672517][ T2995] loop1: p171 size 67108992 extends beyond EOD, truncated [ 63.708664][ T2995] loop1: p172 size 8192 extends beyond EOD, truncated [ 63.718537][ T2995] loop1: p173 size 67108992 extends beyond EOD, truncated [ 63.731431][ T2995] loop1: p174 size 8192 extends beyond EOD, truncated [ 63.739327][ T2995] loop1: p175 size 67108992 extends beyond EOD, truncated [ 63.755122][ T2995] loop1: p176 size 8192 extends beyond EOD, truncated [ 63.783619][ T2995] loop1: p177 size 67108992 extends beyond EOD, truncated [ 63.794357][ T2995] loop1: p178 size 8192 extends beyond EOD, truncated [ 63.802218][ T2995] loop1: p179 size 67108992 extends beyond EOD, truncated [ 63.811429][ T2995] loop1: p180 size 8192 extends beyond EOD, truncated [ 63.820067][ T2995] loop1: p181 size 67108992 extends beyond EOD, truncated [ 63.832683][ T2995] loop1: p182 size 8192 extends beyond EOD, truncated [ 63.840580][ T2995] loop1: p183 size 67108992 extends beyond EOD, truncated [ 63.849974][ T2995] loop1: p184 size 8192 extends beyond EOD, truncated [ 63.857378][ T2995] loop1: p185 size 67108992 extends beyond EOD, truncated [ 63.865163][ T2995] loop1: p186 size 8192 extends beyond EOD, truncated [ 63.874145][ T2995] loop1: p187 size 67108992 extends beyond EOD, truncated [ 63.892153][ T2995] loop1: p188 size 8192 extends beyond EOD, truncated [ 63.901562][ T2995] loop1: p189 size 67108992 extends beyond EOD, truncated [ 63.910396][ T2995] loop1: p190 size 8192 extends beyond EOD, truncated [ 63.921045][ T4839] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 63.928552][ T4839] vhci_hcd: invalid port number 96 [ 63.933671][ T4839] vhci_hcd: default hub control req: 0000 vfffc i0060 l0 [ 63.942918][ T2995] loop1: p191 size 67108992 extends beyond EOD, truncated [ 63.950541][ T2995] loop1: p192 size 8192 extends beyond EOD, truncated [ 64.002215][ T2995] loop1: p193 size 67108992 extends beyond EOD, truncated [ 64.022576][ T2995] loop1: p194 size 8192 extends beyond EOD, truncated [ 64.034813][ T51] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.046979][ T2995] loop1: p195 size 67108992 extends beyond EOD, truncated [ 64.064885][ T2995] loop1: p196 size 8192 extends beyond EOD, truncated [ 64.085361][ T2995] loop1: p197 size 67108992 extends beyond EOD, truncated [ 64.093572][ T2995] loop1: p198 size 8192 extends beyond EOD, truncated [ 64.111339][ T2995] loop1: p199 size 67108992 extends beyond EOD, truncated [ 64.111712][ T51] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.130438][ T2995] loop1: p200 size 8192 extends beyond EOD, truncated [ 64.147125][ T2995] loop1: p201 size 67108992 extends beyond EOD, truncated [ 64.156877][ T4841] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 64.156877][ T4841] program syz.5.339 not setting count and/or reply_len properly [ 64.177605][ T2995] loop1: p202 size 8192 extends beyond EOD, truncated [ 64.178792][ T4824] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 64.194221][ T2995] loop1: p203 size 67108992 extends beyond EOD, truncated [ 64.206872][ T2995] loop1: p204 size 8192 extends beyond EOD, truncated [ 64.215292][ T2995] loop1: p205 size 67108992 extends beyond EOD, truncated [ 64.223082][ T2995] loop1: p206 size 8192 extends beyond EOD, truncated [ 64.231298][ T2995] loop1: p207 size 67108992 extends beyond EOD, truncated [ 64.239595][ T51] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.262010][ T4846] loop5: detected capacity change from 0 to 128 [ 64.265299][ T2995] loop1: p208 size 8192 extends beyond EOD, truncated [ 64.285063][ T2995] loop1: p209 size 67108992 extends beyond EOD, truncated [ 64.292714][ T2995] loop1: p210 size 8192 extends beyond EOD, truncated [ 64.305172][ T2995] loop1: p211 size 67108992 extends beyond EOD, truncated [ 64.322792][ T2995] loop1: p212 size 8192 extends beyond EOD, truncated [ 64.332594][ T2995] loop1: p213 size 67108992 extends beyond EOD, truncated [ 64.332603][ T51] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.358024][ T2995] loop1: p214 size 8192 extends beyond EOD, truncated [ 64.366166][ T2995] loop1: p215 size 67108992 extends beyond EOD, truncated [ 64.373883][ T2995] loop1: p216 size 8192 extends beyond EOD, truncated [ 64.383641][ T4851] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 64.383641][ T4851] program syz.2.344 not setting count and/or reply_len properly [ 64.401523][ T2995] loop1: p217 size 67108992 extends beyond EOD, truncated [ 64.415876][ T2995] loop1: p218 size 8192 extends beyond EOD, truncated [ 64.427015][ T51] bridge_slave_1: left allmulticast mode [ 64.432904][ T51] bridge_slave_1: left promiscuous mode [ 64.433590][ T2995] loop1: p219 size 67108992 extends beyond EOD, truncated [ 64.438572][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.459248][ T2995] loop1: p220 size 8192 extends beyond EOD, truncated [ 64.466375][ T51] bridge_slave_0: left allmulticast mode [ 64.472158][ T51] bridge_slave_0: left promiscuous mode [ 64.475557][ T2995] loop1: p221 size 67108992 extends beyond EOD, truncated [ 64.478017][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.508969][ T2995] loop1: p222 size 8192 extends beyond EOD, truncated [ 64.516298][ T2995] loop1: p223 size 67108992 extends beyond EOD, truncated [ 64.525609][ T2995] loop1: p224 size 8192 extends beyond EOD, truncated [ 64.532912][ T2995] loop1: p225 size 67108992 extends beyond EOD, truncated [ 64.546496][ T2995] loop1: p226 size 8192 extends beyond EOD, truncated [ 64.554575][ T2995] loop1: p227 size 67108992 extends beyond EOD, truncated [ 64.564852][ T2995] loop1: p228 size 8192 extends beyond EOD, truncated [ 64.572825][ T2995] loop1: p229 size 67108992 extends beyond EOD, truncated [ 64.580820][ T2995] loop1: p230 size 8192 extends beyond EOD, truncated [ 64.589949][ T2995] loop1: p231 size 67108992 extends beyond EOD, truncated [ 64.597797][ T2995] loop1: p232 size 8192 extends beyond EOD, truncated [ 64.605129][ T2995] loop1: p233 size 67108992 extends beyond EOD, truncated [ 64.612684][ T2995] loop1: p234 size 8192 extends beyond EOD, truncated [ 64.620120][ T2995] loop1: p235 size 67108992 extends beyond EOD, truncated [ 64.627707][ T51] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 64.627779][ T2995] loop1: p236 size 8192 extends beyond EOD, truncated [ 64.643502][ T2995] loop1: p237 size 67108992 extends beyond EOD, truncated [ 64.650932][ T51] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 64.651225][ T2995] loop1: p238 size 8192 extends beyond EOD, truncated [ 64.666884][ T2995] loop1: p239 size 67108992 extends beyond EOD, truncated [ 64.667579][ T51] bond0 (unregistering): Released all slaves [ 64.674544][ T2995] loop1: p240 size 8192 extends beyond EOD, truncated [ 64.688262][ T2995] loop1: p241 size 67108992 extends beyond EOD, truncated [ 64.698539][ T2995] loop1: p242 size 8192 extends beyond EOD, truncated [ 64.706036][ T2995] loop1: p243 size 67108992 extends beyond EOD, truncated [ 64.713705][ T2995] loop1: p244 size 8192 extends beyond EOD, truncated [ 64.721119][ T2995] loop1: p245 size 67108992 extends beyond EOD, truncated [ 64.731202][ T2995] loop1: p246 size 8192 extends beyond EOD, truncated [ 64.738778][ T2995] loop1: p247 size 67108992 extends beyond EOD, truncated [ 64.746500][ T2995] loop1: p248 size 8192 extends beyond EOD, truncated [ 64.753988][ T2995] loop1: p249 size 67108992 extends beyond EOD, truncated [ 64.761699][ T2995] loop1: p250 size 8192 extends beyond EOD, truncated [ 64.769391][ T2995] loop1: p251 size 67108992 extends beyond EOD, truncated [ 64.777327][ T2995] loop1: p252 size 8192 extends beyond EOD, truncated [ 64.785130][ T2995] loop1: p253 size 67108992 extends beyond EOD, truncated [ 64.793317][ T2995] loop1: p254 size 8192 extends beyond EOD, truncated [ 64.800841][ T2995] loop1: p255 size 67108992 extends beyond EOD, truncated [ 64.840758][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0500-0000-0000-000000000000. [ 64.864795][ T4870] vhci_hcd: invalid port number 96 [ 64.869944][ T4870] vhci_hcd: default hub control req: 0000 vfffc i0060 l0 [ 64.879908][ T51] hsr_slave_0: left promiscuous mode [ 64.887025][ T51] hsr_slave_1: left promiscuous mode [ 64.896894][ T51] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 64.904354][ T51] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 64.919004][ T51] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 64.926453][ T51] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 64.958519][ T51] veth1_macvtap: left promiscuous mode [ 64.964520][ T51] veth0_macvtap: left promiscuous mode [ 65.053649][ T51] team0 (unregistering): Port device team_slave_1 removed [ 65.068339][ T51] team0 (unregistering): Port device team_slave_0 removed [ 65.129186][ T4290] kworker/u8:8: attempt to access beyond end of device [ 65.129186][ T4290] loop5: rw=1, sector=153, nr_sectors = 8 limit=128 [ 65.145750][ T4290] kworker/u8:8: attempt to access beyond end of device [ 65.145750][ T4290] loop5: rw=1, sector=169, nr_sectors = 8 limit=128 [ 65.161628][ T4290] kworker/u8:8: attempt to access beyond end of device [ 65.161628][ T4290] loop5: rw=1, sector=185, nr_sectors = 8 limit=128 [ 65.176440][ T4290] kworker/u8:8: attempt to access beyond end of device [ 65.176440][ T4290] loop5: rw=1, sector=201, nr_sectors = 8 limit=128 [ 65.190078][ T4290] kworker/u8:8: attempt to access beyond end of device [ 65.190078][ T4290] loop5: rw=1, sector=217, nr_sectors = 8 limit=128 [ 65.203703][ T4290] kworker/u8:8: attempt to access beyond end of device [ 65.203703][ T4290] loop5: rw=1, sector=233, nr_sectors = 8 limit=128 [ 65.228015][ T4290] kworker/u8:8: attempt to access beyond end of device [ 65.228015][ T4290] loop5: rw=1, sector=249, nr_sectors = 8 limit=128 [ 65.252100][ T4290] kworker/u8:8: attempt to access beyond end of device [ 65.252100][ T4290] loop5: rw=1, sector=265, nr_sectors = 8 limit=128 [ 65.265606][ T4290] kworker/u8:8: attempt to access beyond end of device [ 65.265606][ T4290] loop5: rw=1, sector=281, nr_sectors = 8 limit=128 [ 65.293530][ T4290] kworker/u8:8: attempt to access beyond end of device [ 65.293530][ T4290] loop5: rw=1, sector=297, nr_sectors = 8 limit=128 [ 65.298211][ T4879] __nla_validate_parse: 1 callbacks suppressed [ 65.298228][ T4879] netlink: 12 bytes leftover after parsing attributes in process `syz.2.353'. [ 65.324894][ T4877] loop4: detected capacity change from 0 to 1024 [ 65.356776][ T3295] udevd[3295]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 65.368077][ T3297] udevd[3297]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 65.379187][ T3533] udevd[3533]: inotify_add_watch(7, /dev/loop1p2, 10) failed: No such file or directory [ 65.387155][ T4885] udevd[4885]: inotify_add_watch(7, /dev/loop1p5, 10) failed: No such file or directory [ 65.390324][ T3534] udevd[3534]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 65.424237][ T4892] udevd[4892]: inotify_add_watch(7, /dev/loop1p11, 10) failed: No such file or directory [ 65.437837][ T4879] loop2: detected capacity change from 0 to 512 [ 65.450763][ T4879] EXT4-fs: Ignoring removed i_version option [ 65.460601][ T4886] udevd[4886]: inotify_add_watch(7, /dev/loop1p6, 10) failed: No such file or directory [ 65.469638][ T4887] udevd[4887]: inotify_add_watch(7, /dev/loop1p7, 10) failed: No such file or directory [ 65.471163][ T4879] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=e000c018, mo2=0002] [ 65.481304][ T4888] udevd[4888]: inotify_add_watch(7, /dev/loop1p8, 10) failed: No such file or directory [ 65.491845][ T4879] System zones: 0-2, 18-18, 34-35 [ 65.500435][ T4890] udevd[4890]: inotify_add_watch(7, /dev/loop1p10, 10) failed: No such file or directory [ 65.518335][ T4877] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 65.537293][ T4879] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 65.560882][ T4879] ext4 filesystem being mounted at /85/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 65.641851][ T4848] chnl_net:caif_netlink_parms(): no params data found [ 65.650944][ T4900] netlink: 12 bytes leftover after parsing attributes in process `syz.5.354'. [ 65.672288][ T29] audit: type=1326 audit(1751421134.489:1256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4878 comm="gtp" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f708660e929 code=0x0 [ 65.710786][ T4900] loop5: detected capacity change from 0 to 512 [ 65.717927][ T4900] EXT4-fs: Ignoring removed i_version option [ 65.728581][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 65.774992][ T4900] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=e000c018, mo2=0002] [ 65.786336][ T4900] System zones: 0-2, 18-18, 34-35 [ 65.794159][ T4900] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 65.808151][ T4900] ext4 filesystem being mounted at /34/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 65.820048][ T4848] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.827203][ T4848] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.834516][ T4848] bridge_slave_0: entered allmulticast mode [ 65.835115][ T29] audit: type=1326 audit(1751421134.650:1257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4899 comm="gtp" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3ca9a5e929 code=0x0 [ 65.841190][ T4848] bridge_slave_0: entered promiscuous mode [ 65.869239][ T4911] FAULT_INJECTION: forcing a failure. [ 65.869239][ T4911] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 65.882584][ T4911] CPU: 1 UID: 0 PID: 4911 Comm: syz.4.355 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 65.882684][ T4911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 65.882700][ T4911] Call Trace: [ 65.882708][ T4911] [ 65.882717][ T4911] __dump_stack+0x1d/0x30 [ 65.882743][ T4911] dump_stack_lvl+0xe8/0x140 [ 65.882768][ T4911] dump_stack+0x15/0x1b [ 65.882825][ T4911] should_fail_ex+0x265/0x280 [ 65.882863][ T4911] should_fail_alloc_page+0xf2/0x100 [ 65.882888][ T4911] __alloc_frozen_pages_noprof+0xff/0x360 [ 65.882973][ T4911] alloc_pages_mpol+0xb3/0x250 [ 65.883014][ T4911] alloc_pages_noprof+0x90/0x130 [ 65.883051][ T4911] alloc_skb_with_frags+0x193/0x470 [ 65.883152][ T4911] sock_alloc_send_pskb+0x43a/0x4f0 [ 65.883187][ T4911] ? terminate_walk+0x27f/0x2a0 [ 65.883264][ T4911] tun_get_user+0x8d3/0x2500 [ 65.883294][ T4911] ? avc_has_perm+0xd3/0x150 [ 65.883330][ T4911] ? ref_tracker_alloc+0x1f2/0x2f0 [ 65.883381][ T4911] ? selinux_file_permission+0x2f0/0x320 [ 65.883415][ T4911] tun_chr_write_iter+0x15e/0x210 [ 65.883497][ T4911] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 65.883553][ T4911] vfs_write+0x4a0/0x8e0 [ 65.883600][ T4911] ksys_write+0xda/0x1a0 [ 65.883678][ T4911] __x64_sys_write+0x40/0x50 [ 65.883712][ T4911] x64_sys_call+0x2cdd/0x2fb0 [ 65.883773][ T4911] do_syscall_64+0xd2/0x200 [ 65.883797][ T4911] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 65.883830][ T4911] ? clear_bhb_loop+0x40/0x90 [ 65.883851][ T4911] ? clear_bhb_loop+0x40/0x90 [ 65.883874][ T4911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 65.884010][ T4911] RIP: 0033:0x7f3f4526d3df [ 65.884024][ T4911] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 65.884049][ T4911] RSP: 002b:00007f3f438b6000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 65.884074][ T4911] RAX: ffffffffffffffda RBX: 00007f3f45496080 RCX: 00007f3f4526d3df [ 65.884090][ T4911] RDX: 000000000000fdef RSI: 0000200000000a40 RDI: 00000000000000c8 [ 65.884107][ T4911] RBP: 00007f3f438b6090 R08: 0000000000000000 R09: 0000000000000000 [ 65.884132][ T4911] R10: 000000000000fdef R11: 0000000000000293 R12: 0000000000000001 [ 65.884148][ T4911] R13: 0000000000000001 R14: 00007f3f45496080 R15: 00007ffff68259e8 [ 65.884174][ T4911] [ 66.161212][ T4848] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.168325][ T4848] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.184844][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 66.203887][ T4848] bridge_slave_1: entered allmulticast mode [ 66.231346][ T29] audit: type=1326 audit(1751421135.052:1258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4913 comm="syz.4.357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f4526e929 code=0x7ffc0000 [ 66.254709][ T29] audit: type=1326 audit(1751421135.052:1259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4913 comm="syz.4.357" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f3f4526e929 code=0x7ffc0000 [ 66.278642][ T4915] loop4: detected capacity change from 0 to 2048 [ 66.289287][ T4848] bridge_slave_1: entered promiscuous mode [ 66.358904][ T4920] netlink: 'syz.1.358': attribute type 6 has an invalid length. [ 66.388624][ T4915] EXT4-fs (loop4): failed to initialize system zone (-117) [ 66.396720][ T4915] EXT4-fs (loop4): mount failed [ 66.427188][ T4917] veth0: entered promiscuous mode [ 66.458315][ T4916] veth0: left promiscuous mode [ 66.490277][ T4038] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 66.516189][ T4848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.537925][ T4848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.566520][ T4848] team0: Port device team_slave_0 added [ 66.583086][ T4848] team0: Port device team_slave_1 added [ 66.603605][ T4848] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.610599][ T4848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.636586][ T4848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.675066][ T4848] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.682097][ T4848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.708181][ T4848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.765903][ T4934] loop1: detected capacity change from 0 to 512 [ 66.780212][ T4934] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 66.904196][ T4938] loop5: detected capacity change from 0 to 512 [ 66.973099][ T4936] SELinux: failed to load policy [ 67.088586][ T4848] hsr_slave_0: entered promiscuous mode [ 67.099752][ T4848] hsr_slave_1: entered promiscuous mode [ 67.116837][ T4848] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.145540][ T4848] Cannot create hsr debugfs directory [ 67.346650][ T4944] netlink: 12 bytes leftover after parsing attributes in process `syz.4.365'. [ 67.375502][ T4848] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 67.434834][ T4944] loop4: detected capacity change from 0 to 512 [ 67.449773][ T4848] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 67.475876][ T4944] EXT4-fs: Ignoring removed i_version option [ 67.494428][ T4934] EXT4-fs (loop1): 1 truncate cleaned up [ 67.501244][ T4934] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 67.526169][ T4938] EXT4-fs (loop5): orphan cleanup on readonly fs [ 67.555440][ T4848] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 67.568705][ T4938] __quota_error: 49 callbacks suppressed [ 67.568717][ T4938] Quota error (device loop5): find_tree_dqentry: Cycle in quota tree detected: block 2 index 0 [ 67.584984][ T4938] Quota error (device loop5): qtree_read_dquot: Can't read quota structure for id 0 [ 67.594443][ T4938] EXT4-fs error (device loop5): ext4_acquire_dquot:6933: comm syz.5.363: Failed to acquire dquot type 1 [ 67.674714][ T4944] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=e000c018, mo2=0002] [ 67.685002][ T4848] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 67.685061][ T4938] EXT4-fs (loop5): 1 truncate cleaned up [ 67.692160][ T4944] System zones: 0-2, 18-18, 34-35 [ 67.705270][ T4944] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 67.726965][ T4956] fido_id[4956]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 67.740643][ T4944] ext4 filesystem being mounted at /60/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 67.759778][ T4938] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 67.893849][ T29] audit: type=1326 audit(1751421136.719:1309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4943 comm="syz.4.365" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3f4526e929 code=0x0 [ 68.382689][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.396462][ T4848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.397076][ T4038] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.412176][ T4848] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.423013][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.430129][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.448243][ T4972] loop1: detected capacity change from 0 to 1024 [ 68.479373][ T4972] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 68.498874][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.501085][ T4972] ext4 filesystem being mounted at /62/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 68.506050][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.527261][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.529407][ T29] audit: type=1400 audit(1751421137.362:1310): avc: denied { map } for pid=4971 comm="syz.1.369" path="/62/file1/file1" dev="loop1" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 68.582186][ T4848] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 68.592577][ T4848] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 68.637048][ T4978] fido_id[4978]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 68.691312][ T29] audit: type=1400 audit(1751421137.523:1311): avc: denied { setopt } for pid=4971 comm="syz.1.369" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 68.741859][ T4986] FAULT_INJECTION: forcing a failure. [ 68.741859][ T4986] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 68.755006][ T4986] CPU: 0 UID: 0 PID: 4986 Comm: syz.5.374 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 68.755038][ T4986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 68.755059][ T4986] Call Trace: [ 68.755066][ T4986] [ 68.755074][ T4986] __dump_stack+0x1d/0x30 [ 68.755141][ T4986] dump_stack_lvl+0xe8/0x140 [ 68.755159][ T4986] dump_stack+0x15/0x1b [ 68.755173][ T4986] should_fail_ex+0x265/0x280 [ 68.755255][ T4986] should_fail+0xb/0x20 [ 68.755290][ T4986] should_fail_usercopy+0x1a/0x20 [ 68.755327][ T4986] _copy_from_user+0x1c/0xb0 [ 68.755427][ T4986] ___sys_sendmsg+0xc1/0x1d0 [ 68.755489][ T4986] __x64_sys_sendmsg+0xd4/0x160 [ 68.755530][ T4986] x64_sys_call+0x2999/0x2fb0 [ 68.755558][ T4986] do_syscall_64+0xd2/0x200 [ 68.755575][ T4986] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 68.755648][ T4986] ? clear_bhb_loop+0x40/0x90 [ 68.755677][ T4986] ? clear_bhb_loop+0x40/0x90 [ 68.755704][ T4986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.755787][ T4986] RIP: 0033:0x7f3ca9a5e929 [ 68.755804][ T4986] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 68.755822][ T4986] RSP: 002b:00007f3ca80c7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 68.755839][ T4986] RAX: ffffffffffffffda RBX: 00007f3ca9c85fa0 RCX: 00007f3ca9a5e929 [ 68.755850][ T4986] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 000000000000000c [ 68.755861][ T4986] RBP: 00007f3ca80c7090 R08: 0000000000000000 R09: 0000000000000000 [ 68.755939][ T4986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 68.755955][ T4986] R13: 0000000000000000 R14: 00007f3ca9c85fa0 R15: 00007ffea8803c68 [ 68.755980][ T4986] [ 68.993448][ T4985] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 69.058423][ T4290] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 69.140059][ T4290] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 69.152428][ T4290] EXT4-fs (loop1): This should not happen!! Data will be lost [ 69.152428][ T4290] [ 69.162378][ T4290] EXT4-fs (loop1): Total free blocks count 0 [ 69.168383][ T4290] EXT4-fs (loop1): Free/Dirty block details [ 69.174337][ T4290] EXT4-fs (loop1): free_blocks=4293918720 [ 69.180089][ T4290] EXT4-fs (loop1): dirty_blocks=16 [ 69.185251][ T4290] EXT4-fs (loop1): Block reservation details [ 69.191397][ T4290] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 69.259425][ T4848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.339175][ T5003] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 69.339175][ T5003] program syz.2.378 not setting count and/or reply_len properly [ 69.478958][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 69.519943][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.527393][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.534878][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.585066][ T5020] netlink: 4 bytes leftover after parsing attributes in process `syz.1.376'. [ 69.608624][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.616135][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.623635][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.631120][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.638535][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.645964][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.653417][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.660924][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.668320][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.675809][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.683224][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.725039][ T5020] netlink: 4 bytes leftover after parsing attributes in process `syz.1.376'. [ 69.872336][ T5033] loop4: detected capacity change from 0 to 512 [ 69.887268][ T5036] loop1: detected capacity change from 0 to 128 [ 69.901477][ T5033] EXT4-fs: Ignoring removed i_version option [ 69.935637][ T4848] veth0_vlan: entered promiscuous mode [ 69.968656][ T5033] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=e000c018, mo2=0002] [ 69.976871][ T5033] System zones: 0-2, 18-18, 34-35 [ 69.991159][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 69.992582][ T4848] veth1_vlan: entered promiscuous mode [ 69.998850][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.011816][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.019255][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.026659][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.034133][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.041579][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.048988][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.056408][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.063865][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.071366][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.078801][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.086191][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.087944][ T29] audit: type=1326 audit(1751421138.919:1312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5044 comm="syz.5.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ca9a5e929 code=0x7ffc0000 [ 70.093597][ T9] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 70.121550][ T5036] bio_check_eod: 107 callbacks suppressed [ 70.121569][ T5036] syz.1.381: attempt to access beyond end of device [ 70.121569][ T5036] loop1: rw=524288, sector=145, nr_sectors = 16 limit=128 [ 70.125587][ T5033] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 70.133173][ T4848] veth0_macvtap: entered promiscuous mode [ 70.161984][ T5033] ext4 filesystem being mounted at /62/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 70.174956][ T5036] syz.1.381: attempt to access beyond end of device [ 70.174956][ T5036] loop1: rw=524288, sector=169, nr_sectors = 8 limit=128 [ 70.203959][ T9] hid-generic 0000:0000:0000.000D: hidraw0: HID v8.00 Device [syz1] on syz0 [ 70.229031][ T5036] syz.1.381: attempt to access beyond end of device [ 70.229031][ T5036] loop1: rw=524288, sector=185, nr_sectors = 8 limit=128 [ 70.235583][ T29] audit: type=1326 audit(1751421139.029:1313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5044 comm="syz.5.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ca9a5e929 code=0x7ffc0000 [ 70.251607][ T4848] veth1_macvtap: entered promiscuous mode [ 70.265895][ T29] audit: type=1326 audit(1751421139.029:1314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5044 comm="syz.5.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7f3ca9a5e929 code=0x7ffc0000 [ 70.265923][ T29] audit: type=1326 audit(1751421139.029:1315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5044 comm="syz.5.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ca9a5e929 code=0x7ffc0000 [ 70.318200][ T29] audit: type=1326 audit(1751421139.029:1316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5044 comm="syz.5.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ca9a5e929 code=0x7ffc0000 [ 70.482341][ T4848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.498853][ T4848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.511530][ T4848] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.520389][ T4848] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.529147][ T4848] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.538072][ T4848] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.584674][ T5073] loop2: detected capacity change from 0 to 1024 [ 70.620949][ T5074] SELinux: failed to load policy [ 70.634720][ T5080] Unsupported ieee802154 address type: 0 [ 70.662710][ T5073] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 70.687918][ T5082] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 70.698798][ T5082] vhci_hcd: invalid port number 96 [ 70.704004][ T5082] vhci_hcd: default hub control req: 0000 vfffc i0060 l0 [ 70.712185][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 70.810634][ T5073] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:4113: comm syz.2.388: Allocating blocks 449-513 which overlap fs metadata [ 70.849598][ T5100] netlink: 4 bytes leftover after parsing attributes in process `syz.5.392'. [ 70.867941][ T5073] FAULT_INJECTION: forcing a failure. [ 70.867941][ T5073] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 70.881266][ T5073] CPU: 0 UID: 0 PID: 5073 Comm: syz.2.388 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 70.881334][ T5073] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 70.881346][ T5073] Call Trace: [ 70.881351][ T5073] [ 70.881357][ T5073] __dump_stack+0x1d/0x30 [ 70.881375][ T5073] dump_stack_lvl+0xe8/0x140 [ 70.881391][ T5073] dump_stack+0x15/0x1b [ 70.881407][ T5073] should_fail_ex+0x265/0x280 [ 70.881439][ T5073] should_fail_alloc_page+0xf2/0x100 [ 70.881566][ T5073] __alloc_frozen_pages_noprof+0xff/0x360 [ 70.881636][ T5073] alloc_pages_mpol+0xb3/0x250 [ 70.881670][ T5073] alloc_pages_noprof+0x90/0x130 [ 70.881783][ T5073] get_zeroed_page_noprof+0x1a/0x40 [ 70.881888][ T5073] simple_transaction_get+0x4c/0x130 [ 70.881923][ T5073] selinux_transaction_write+0x9d/0x110 [ 70.881953][ T5073] ? __pfx_selinux_transaction_write+0x10/0x10 [ 70.882032][ T5073] vfs_write+0x266/0x8e0 [ 70.882063][ T5073] ? __rcu_read_unlock+0x4f/0x70 [ 70.882082][ T5073] ? __fget_files+0x184/0x1c0 [ 70.882101][ T5073] ksys_write+0xda/0x1a0 [ 70.882252][ T5073] __x64_sys_write+0x40/0x50 [ 70.882289][ T5073] x64_sys_call+0x2cdd/0x2fb0 [ 70.882333][ T5073] do_syscall_64+0xd2/0x200 [ 70.882351][ T5073] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 70.882374][ T5073] ? clear_bhb_loop+0x40/0x90 [ 70.882402][ T5073] ? clear_bhb_loop+0x40/0x90 [ 70.882424][ T5073] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.882446][ T5073] RIP: 0033:0x7f708660e929 [ 70.882542][ T5073] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 70.882564][ T5073] RSP: 002b:00007f7084c77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 70.882580][ T5073] RAX: ffffffffffffffda RBX: 00007f7086835fa0 RCX: 00007f708660e929 [ 70.882590][ T5073] RDX: 0000000000000027 RSI: 0000200000000040 RDI: 0000000000000007 [ 70.882600][ T5073] RBP: 00007f7084c77090 R08: 0000000000000000 R09: 0000000000000000 [ 70.882612][ T5073] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 70.882625][ T5073] R13: 0000000000000000 R14: 00007f7086835fa0 R15: 00007ffccbc284c8 [ 70.882645][ T5073] [ 70.892372][ T5100] netlink: 4 bytes leftover after parsing attributes in process `syz.5.392'. [ 70.979063][ T5072] EXT4-fs (loop2): pa ffff8881066d10e0: logic 48, phys. 177, len 21 [ 71.120241][ T5072] EXT4-fs error (device loop2): ext4_mb_release_inode_pa:5364: group 0, free 0, pa_free 4 [ 71.165892][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 71.218796][ T5131] loop7: detected capacity change from 0 to 512 [ 71.246436][ T5131] EXT4-fs (loop7): mounting ext3 file system using the ext4 subsystem [ 71.279156][ T5131] EXT4-fs (loop7): invalid journal inode [ 71.291064][ T5131] EXT4-fs (loop7): can't get journal size [ 71.314170][ T5131] EXT4-fs (loop7): 1 truncate cleaned up [ 71.320267][ T5131] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 71.442013][ T5154] loop5: detected capacity change from 0 to 512 [ 71.454673][ T5154] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 71.494308][ T5154] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 71.517565][ T5154] ext4 filesystem being mounted at /47/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 71.539896][ T5154] EXT4-fs error (device loop5): ext4_xattr_block_get:593: inode #15: comm syz.5.399: corrupted xattr block 19: overlapping e_value [ 71.563163][ T5154] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop5 ino=15 [ 71.572427][ T5154] EXT4-fs error (device loop5): ext4_xattr_block_get:593: inode #15: comm syz.5.399: corrupted xattr block 19: overlapping e_value [ 71.586690][ T5154] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop5 ino=15 [ 71.597311][ T5154] EXT4-fs error (device loop5): ext4_xattr_block_get:593: inode #15: comm syz.5.399: corrupted xattr block 19: overlapping e_value [ 71.614661][ T5168] EXT4-fs error (device loop5): ext4_xattr_block_get:593: inode #15: comm syz.5.399: corrupted xattr block 19: overlapping e_value [ 71.636111][ T5139] SELinux: failed to load policy [ 71.696006][ T5168] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop5 ino=15 [ 71.719614][ T5168] EXT4-fs error (device loop5): ext4_xattr_block_get:593: inode #15: comm syz.5.399: corrupted xattr block 19: overlapping e_value [ 71.760516][ T5168] EXT4-fs error (device loop5): ext4_xattr_block_get:593: inode #15: comm syz.5.399: corrupted xattr block 19: overlapping e_value [ 71.783246][ T5168] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop5 ino=15 [ 71.823623][ T5185] netlink: 4 bytes leftover after parsing attributes in process `syz.1.405'. [ 71.840821][ T5185] netlink: 4 bytes leftover after parsing attributes in process `syz.1.405'. [ 71.854983][ T5192] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 71.862743][ T5192] vhci_hcd: invalid port number 96 [ 71.867893][ T5192] vhci_hcd: default hub control req: 0000 vfffc i0060 l0 [ 71.977235][ T5210] loop1: detected capacity change from 0 to 1024 [ 72.004952][ T4848] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.005761][ T5210] EXT4-fs: Ignoring removed i_version option [ 72.112886][ T5210] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 72.149297][ T4038] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.167876][ T5228] loop7: detected capacity change from 0 to 1024 [ 72.196228][ T5228] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 72.246279][ T5234] loop2: detected capacity change from 0 to 1024 [ 72.302165][ T3303] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz-executor: bg 0: block 88: padding at end of block bitmap is not set [ 72.359220][ T3303] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6548: Corrupt filesystem [ 72.362470][ T5234] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 72.389501][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.408604][ T5252] FAULT_INJECTION: forcing a failure. [ 72.408604][ T5252] name failslab, interval 1, probability 0, space 0, times 0 [ 72.421325][ T5252] CPU: 0 UID: 0 PID: 5252 Comm: syz.4.416 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 72.421433][ T5252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 72.421446][ T5252] Call Trace: [ 72.421452][ T5252] [ 72.421459][ T5252] __dump_stack+0x1d/0x30 [ 72.421545][ T5252] dump_stack_lvl+0xe8/0x140 [ 72.421578][ T5252] dump_stack+0x15/0x1b [ 72.421596][ T5252] should_fail_ex+0x265/0x280 [ 72.421639][ T5252] should_failslab+0x8c/0xb0 [ 72.421664][ T5252] __kvmalloc_node_noprof+0x123/0x4e0 [ 72.421698][ T5252] ? simple_xattr_alloc+0x43/0x90 [ 72.421722][ T5252] simple_xattr_alloc+0x43/0x90 [ 72.421744][ T5252] shmem_initxattrs+0x18c/0x350 [ 72.421807][ T5252] security_inode_init_security+0x25c/0x330 [ 72.421837][ T5252] ? __pfx_shmem_initxattrs+0x10/0x10 [ 72.421860][ T5252] shmem_mknod+0xad/0x180 [ 72.421880][ T5252] shmem_create+0x34/0x50 [ 72.421921][ T5252] ? __pfx_shmem_create+0x10/0x10 [ 72.421944][ T5252] path_openat+0x1102/0x2170 [ 72.421980][ T5252] do_filp_open+0x109/0x230 [ 72.422049][ T5252] do_sys_openat2+0xa6/0x110 [ 72.422123][ T5252] __x64_sys_openat+0xf2/0x120 [ 72.422150][ T5252] x64_sys_call+0x1af/0x2fb0 [ 72.422169][ T5252] do_syscall_64+0xd2/0x200 [ 72.422186][ T5252] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 72.422288][ T5252] ? clear_bhb_loop+0x40/0x90 [ 72.422308][ T5252] ? clear_bhb_loop+0x40/0x90 [ 72.422328][ T5252] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.422360][ T5252] RIP: 0033:0x7f3f4526e929 [ 72.422374][ T5252] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 72.422402][ T5252] RSP: 002b:00007f3f438d7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 72.422419][ T5252] RAX: ffffffffffffffda RBX: 00007f3f45495fa0 RCX: 00007f3f4526e929 [ 72.422433][ T5252] RDX: 0000000000002040 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 72.422446][ T5252] RBP: 00007f3f438d7090 R08: 0000000000000000 R09: 0000000000000000 [ 72.422459][ T5252] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 72.422472][ T5252] R13: 0000000000000000 R14: 00007f3f45495fa0 R15: 00007ffff68259e8 [ 72.422492][ T5252] [ 72.660158][ T5234] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:4113: comm syz.2.414: Allocating blocks 449-513 which overlap fs metadata [ 72.662899][ T5232] SELinux: failed to load policy [ 72.703614][ T5257] bridge0: entered allmulticast mode [ 72.714994][ T5260] loop4: detected capacity change from 0 to 1024 [ 72.730047][ T5260] netlink: 76 bytes leftover after parsing attributes in process `syz.4.417'. [ 72.732982][ T5260] futex_wake_op: syz.4.417 tries to shift op by -1; fix this program [ 72.791796][ T5268] FAULT_INJECTION: forcing a failure. [ 72.791796][ T5268] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 72.791820][ T5268] CPU: 0 UID: 0 PID: 5268 Comm: syz.1.419 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 72.791848][ T5268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 72.791862][ T5268] Call Trace: [ 72.791868][ T5268] [ 72.791874][ T5268] __dump_stack+0x1d/0x30 [ 72.791892][ T5268] dump_stack_lvl+0xe8/0x140 [ 72.791915][ T5268] dump_stack+0x15/0x1b [ 72.792010][ T5268] should_fail_ex+0x265/0x280 [ 72.792043][ T5268] should_fail+0xb/0x20 [ 72.792126][ T5268] should_fail_usercopy+0x1a/0x20 [ 72.792161][ T5268] _copy_from_user+0x1c/0xb0 [ 72.792209][ T5268] __sys_bpf+0x178/0x790 [ 72.792250][ T5268] __x64_sys_bpf+0x41/0x50 [ 72.792276][ T5268] x64_sys_call+0x2478/0x2fb0 [ 72.792327][ T5268] do_syscall_64+0xd2/0x200 [ 72.792343][ T5268] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 72.792367][ T5268] ? clear_bhb_loop+0x40/0x90 [ 72.792386][ T5268] ? clear_bhb_loop+0x40/0x90 [ 72.792461][ T5268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.792491][ T5268] RIP: 0033:0x7f06c572e929 [ 72.792553][ T5268] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 72.792569][ T5268] RSP: 002b:00007f06c3d97038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 72.792586][ T5268] RAX: ffffffffffffffda RBX: 00007f06c5955fa0 RCX: 00007f06c572e929 [ 72.792597][ T5268] RDX: 0000000000000048 RSI: 00002000000002c0 RDI: 0000000000000000 [ 72.792679][ T5268] RBP: 00007f06c3d97090 R08: 0000000000000000 R09: 0000000000000000 [ 72.792690][ T5268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 72.792701][ T5268] R13: 0000000000000000 R14: 00007f06c5955fa0 R15: 00007ffd5998a608 [ 72.792718][ T5268] [ 72.872131][ T29] kauditd_printk_skb: 32 callbacks suppressed [ 72.872168][ T29] audit: type=1400 audit(1751421141.718:1349): avc: denied { listen } for pid=5270 comm="syz.4.422" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 72.872304][ T29] audit: type=1400 audit(1751421141.718:1350): avc: denied { ioctl } for pid=5270 comm="syz.4.422" path="socket:[11315]" dev="sockfs" ino=11315 ioctlcmd=0x9420 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 72.876699][ T5271] loop4: detected capacity change from 0 to 1024 [ 72.876965][ T5271] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 72.883704][ T5271] loop4: detected capacity change from 0 to 512 [ 72.883968][ T5271] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 72.940998][ T5291] netlink: 52 bytes leftover after parsing attributes in process `syz.4.426'. [ 73.062271][ T5293] netlink: 120 bytes leftover after parsing attributes in process `syz.1.427'. [ 73.203873][ T5233] EXT4-fs (loop2): pa ffff8881007bd690: logic 48, phys. 177, len 21 [ 73.211933][ T5233] EXT4-fs error (device loop2): ext4_mb_release_inode_pa:5364: group 0, free 0, pa_free 4 [ 73.230900][ T4848] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.238569][ T5301] loop1: detected capacity change from 0 to 1024 [ 73.249937][ T29] audit: type=1400 audit(1751421142.100:1351): avc: denied { cpu } for pid=5302 comm="syz.5.430" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 73.300879][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.342680][ T29] audit: type=1400 audit(1751421142.180:1352): avc: denied { execmod } for pid=5306 comm="syz.7.429" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=10418 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 73.348161][ T5308] SELinux: failed to load policy [ 73.369390][ T29] audit: type=1400 audit(1751421142.180:1353): avc: denied { execute } for pid=5306 comm="syz.7.429" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=10418 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 73.401751][ T5301] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 73.426264][ T5301] ext4 filesystem being mounted at /77/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 73.512329][ T5319] netlink: 28 bytes leftover after parsing attributes in process `syz.7.435'. [ 73.537153][ T5323] netlink: 4 bytes leftover after parsing attributes in process `syz.2.431'. [ 73.546783][ T5319] netem: change failed [ 73.558486][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.592097][ T5328] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 73.592097][ T5328] program syz.4.440 not setting count and/or reply_len properly [ 73.608762][ T5323] netlink: 4 bytes leftover after parsing attributes in process `syz.2.431'. [ 73.619038][ T5329] FAULT_INJECTION: forcing a failure. [ 73.619038][ T5329] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 73.632256][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.7.439 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 73.632288][ T5329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 73.632302][ T5329] Call Trace: [ 73.632308][ T5329] [ 73.632315][ T5329] __dump_stack+0x1d/0x30 [ 73.632334][ T5329] dump_stack_lvl+0xe8/0x140 [ 73.632424][ T5329] dump_stack+0x15/0x1b [ 73.632442][ T5329] should_fail_ex+0x265/0x280 [ 73.632477][ T5329] should_fail+0xb/0x20 [ 73.632603][ T5329] should_fail_usercopy+0x1a/0x20 [ 73.632634][ T5329] _copy_from_user+0x1c/0xb0 [ 73.632728][ T5329] kstrtouint_from_user+0x69/0xf0 [ 73.632755][ T5329] ? 0xffffffff81000000 [ 73.632832][ T5329] ? selinux_file_permission+0x1e4/0x320 [ 73.632861][ T5329] proc_fail_nth_write+0x50/0x160 [ 73.632894][ T5329] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 73.632994][ T5329] vfs_write+0x266/0x8e0 [ 73.633029][ T5329] ? vfs_read+0x47f/0x6f0 [ 73.633086][ T5329] ? __rcu_read_unlock+0x4f/0x70 [ 73.633107][ T5329] ? __fget_files+0x184/0x1c0 [ 73.633155][ T5329] ksys_write+0xda/0x1a0 [ 73.633196][ T5329] __x64_sys_write+0x40/0x50 [ 73.633261][ T5329] x64_sys_call+0x2cdd/0x2fb0 [ 73.633283][ T5329] do_syscall_64+0xd2/0x200 [ 73.633301][ T5329] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 73.633333][ T5329] ? clear_bhb_loop+0x40/0x90 [ 73.633389][ T5329] ? clear_bhb_loop+0x40/0x90 [ 73.633419][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.633444][ T5329] RIP: 0033:0x7f44c439d3df [ 73.633491][ T5329] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 73.633514][ T5329] RSP: 002b:00007f44c2a07030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 73.633538][ T5329] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f44c439d3df [ 73.633554][ T5329] RDX: 0000000000000001 RSI: 00007f44c2a070a0 RDI: 0000000000000006 [ 73.633577][ T5329] RBP: 00007f44c2a07090 R08: 0000000000000000 R09: 0000000000000000 [ 73.633593][ T5329] R10: 0000200000001cc0 R11: 0000000000000293 R12: 0000000000000001 [ 73.633610][ T5329] R13: 0000000000000000 R14: 00007f44c45c5fa0 R15: 00007ffea32d4758 [ 73.633629][ T5329] [ 73.938563][ T5341] loop4: detected capacity change from 0 to 512 [ 73.961772][ T5347] vhci_hcd: invalid port number 65 [ 73.966341][ T29] audit: type=1400 audit(1751421142.870:1354): avc: denied { getopt } for pid=5345 comm="syz.1.447" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 73.966957][ T5347] vhci_hcd: SetHubDepth req not supported for USB 2.0 roothub [ 73.996210][ T5346] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 74.003683][ T5346] vhci_hcd: invalid port number 96 [ 74.008962][ T5346] vhci_hcd: default hub control req: 0000 vfffc i0060 l0 [ 74.050667][ T5354] FAULT_INJECTION: forcing a failure. [ 74.050667][ T5354] name failslab, interval 1, probability 0, space 0, times 0 [ 74.063388][ T5354] CPU: 0 UID: 0 PID: 5354 Comm: syz.2.449 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 74.063486][ T5354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 74.063506][ T5354] Call Trace: [ 74.063513][ T5354] [ 74.063522][ T5354] __dump_stack+0x1d/0x30 [ 74.063549][ T5354] dump_stack_lvl+0xe8/0x140 [ 74.063575][ T5354] dump_stack+0x15/0x1b [ 74.063599][ T5354] should_fail_ex+0x265/0x280 [ 74.063659][ T5354] should_failslab+0x8c/0xb0 [ 74.063691][ T5354] kmem_cache_alloc_noprof+0x50/0x310 [ 74.063807][ T5354] ? security_inode_alloc+0x37/0x100 [ 74.063849][ T5354] security_inode_alloc+0x37/0x100 [ 74.063895][ T5354] inode_init_always_gfp+0x4b7/0x500 [ 74.063943][ T5354] ? __pfx_sock_alloc_inode+0x10/0x10 [ 74.063977][ T5354] alloc_inode+0x58/0x170 [ 74.064161][ T5354] __sock_create+0x122/0x5b0 [ 74.064198][ T5354] sock_create_kern+0x38/0x50 [ 74.064310][ T5354] udp_sock_create4+0x66/0x2a0 [ 74.064351][ T5354] rxrpc_lookup_local+0x824/0xc70 [ 74.064427][ T5354] rxrpc_sendmsg+0x2f3/0x590 [ 74.064462][ T5354] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 74.064496][ T5354] __sock_sendmsg+0x145/0x180 [ 74.064528][ T5354] ____sys_sendmsg+0x31e/0x4e0 [ 74.064566][ T5354] ___sys_sendmsg+0x17b/0x1d0 [ 74.064609][ T5354] __x64_sys_sendmsg+0xd4/0x160 [ 74.064706][ T5354] x64_sys_call+0x2999/0x2fb0 [ 74.064778][ T5354] do_syscall_64+0xd2/0x200 [ 74.064795][ T5354] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 74.064826][ T5354] ? clear_bhb_loop+0x40/0x90 [ 74.064850][ T5354] ? clear_bhb_loop+0x40/0x90 [ 74.064919][ T5354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.064942][ T5354] RIP: 0033:0x7f708660e929 [ 74.064955][ T5354] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 74.064974][ T5354] RSP: 002b:00007f7084c77038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 74.064994][ T5354] RAX: ffffffffffffffda RBX: 00007f7086835fa0 RCX: 00007f708660e929 [ 74.065130][ T5354] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 74.065144][ T5354] RBP: 00007f7084c77090 R08: 0000000000000000 R09: 0000000000000000 [ 74.065157][ T5354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 74.065204][ T5354] R13: 0000000000000000 R14: 00007f7086835fa0 R15: 00007ffccbc284c8 [ 74.065226][ T5354] [ 74.066728][ T5357] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 74.066728][ T5357] program syz.1.448 not setting count and/or reply_len properly [ 74.077648][ T5354] socket: no more sockets [ 74.115410][ T5359] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=5359 comm=syz.1.450 [ 74.156965][ T5341] Quota error (device loop4): do_check_range: Getting dqdh_prev_free 1536 out of range 0-5 [ 74.161717][ T5359] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=5359 comm=syz.1.450 [ 74.166860][ T5341] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 74.367943][ T5341] EXT4-fs error (device loop4): ext4_acquire_dquot:6933: comm +}[@: Failed to acquire dquot type 1 [ 74.382230][ T5366] xt_hashlimit: size too large, truncated to 1048576 [ 74.382235][ T5341] EXT4-fs (loop4): 1 truncate cleaned up [ 74.382726][ T5341] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 74.424444][ T5365] SELinux: failed to load policy [ 74.433685][ T5341] ext4 filesystem being mounted at /77/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 74.466659][ T5341] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 74.509830][ T5368] loop2: detected capacity change from 0 to 2048 [ 74.553415][ T5368] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 74.614354][ T5368] EXT4-fs (loop2): shut down requested (0) [ 74.618593][ T29] audit: type=1400 audit(1751421143.520:1355): avc: denied { ioctl } for pid=5364 comm="syz.2.452" path="/104/file1/memory.numa_stat" dev="loop2" ino=18 ioctlcmd=0x587d scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 74.675238][ T29] audit: type=1326 audit(1751421143.580:1356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5364 comm="syz.2.452" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f708660e929 code=0x7ffc0000 [ 74.681544][ T5366] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 74.727848][ T5366] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 74.743901][ T5385] loop7: detected capacity change from 0 to 512 [ 74.758561][ T5385] EXT4-fs error (device loop7): ext4_acquire_dquot:6933: comm +}[@: Failed to acquire dquot type 1 [ 74.770561][ T5366] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 74.777263][ T5385] EXT4-fs (loop7): 1 truncate cleaned up [ 74.789590][ T5366] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 74.798471][ T5366] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 74.807530][ T5366] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 74.816485][ T5366] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 74.827249][ T5385] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 74.847024][ T5385] ext4 filesystem being mounted at /12/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 74.852058][ T5392] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 74.852058][ T5392] program syz.5.460 not setting count and/or reply_len properly [ 74.885310][ T5390] SELinux: policydb magic number 0x33dbea00 does not match expected magic number 0xf97cff8c [ 74.901717][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 74.914048][ T5390] SELinux: failed to load policy [ 74.919958][ T5385] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 74.924499][ T5396] loop5: detected capacity change from 0 to 1024 [ 74.936313][ T5396] EXT4-fs: inline encryption not supported [ 74.943868][ T5396] EXT4-fs: Ignoring removed bh option [ 74.988198][ T5402] loop4: detected capacity change from 0 to 512 [ 75.004771][ T5396] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 75.022279][ T5405] loop2: detected capacity change from 0 to 128 [ 75.037295][ T5402] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 75.058386][ T5402] ext4 filesystem being mounted at /82/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 75.093657][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 75.122176][ T5411] loop7: detected capacity change from 0 to 2048 [ 75.185017][ T5411] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 75.211044][ T4038] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 75.230480][ T5398] SELinux: failed to load policy [ 75.287794][ T5421] FAULT_INJECTION: forcing a failure. [ 75.287794][ T5421] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 75.300963][ T5421] CPU: 0 UID: 0 PID: 5421 Comm: syz.5.468 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 75.300990][ T5421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 75.301051][ T5421] Call Trace: [ 75.301058][ T5421] [ 75.301066][ T5421] __dump_stack+0x1d/0x30 [ 75.301088][ T5421] dump_stack_lvl+0xe8/0x140 [ 75.301188][ T5421] dump_stack+0x15/0x1b [ 75.301205][ T5421] should_fail_ex+0x265/0x280 [ 75.301238][ T5421] should_fail+0xb/0x20 [ 75.301270][ T5421] should_fail_usercopy+0x1a/0x20 [ 75.301312][ T5421] strncpy_from_user+0x25/0x230 [ 75.301380][ T5421] keyctl_restrict_keyring+0x80/0x1b0 [ 75.301456][ T5421] __se_sys_keyctl+0x1ed/0xb80 [ 75.301503][ T5421] ? __rcu_read_unlock+0x4f/0x70 [ 75.301527][ T5421] ? __fget_files+0x184/0x1c0 [ 75.301550][ T5421] ? fput+0x8f/0xc0 [ 75.301596][ T5421] __x64_sys_keyctl+0x67/0x80 [ 75.301626][ T5421] x64_sys_call+0x2e7f/0x2fb0 [ 75.301650][ T5421] do_syscall_64+0xd2/0x200 [ 75.301669][ T5421] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 75.301697][ T5421] ? clear_bhb_loop+0x40/0x90 [ 75.301753][ T5421] ? clear_bhb_loop+0x40/0x90 [ 75.301916][ T5421] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.301940][ T5421] RIP: 0033:0x7f3ca9a5e929 [ 75.301956][ T5421] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.301976][ T5421] RSP: 002b:00007f3ca80c7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 75.302039][ T5421] RAX: ffffffffffffffda RBX: 00007f3ca9c85fa0 RCX: 00007f3ca9a5e929 [ 75.302054][ T5421] RDX: 0000200000000240 RSI: 000000003d71baad RDI: 000000000000001d [ 75.302068][ T5421] RBP: 00007f3ca80c7090 R08: 0000000000000000 R09: 0000000000000000 [ 75.302081][ T5421] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000001 [ 75.302095][ T5421] R13: 0000000000000000 R14: 00007f3ca9c85fa0 R15: 00007ffea8803c68 [ 75.302118][ T5421] [ 75.612914][ T5433] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 75.612914][ T5433] program syz.5.474 not setting count and/or reply_len properly [ 75.705902][ T5442] FAULT_INJECTION: forcing a failure. [ 75.705902][ T5442] name failslab, interval 1, probability 0, space 0, times 0 [ 75.718707][ T5442] CPU: 1 UID: 0 PID: 5442 Comm: syz.5.478 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 75.718802][ T5442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 75.718817][ T5442] Call Trace: [ 75.718856][ T5442] [ 75.718865][ T5442] __dump_stack+0x1d/0x30 [ 75.718960][ T5442] dump_stack_lvl+0xe8/0x140 [ 75.718990][ T5442] dump_stack+0x15/0x1b [ 75.719015][ T5442] should_fail_ex+0x265/0x280 [ 75.719065][ T5442] should_failslab+0x8c/0xb0 [ 75.719164][ T5442] kmem_cache_alloc_node_noprof+0x57/0x320 [ 75.719285][ T5442] ? __alloc_skb+0x101/0x320 [ 75.719457][ T5442] __alloc_skb+0x101/0x320 [ 75.719585][ T5442] netlink_alloc_large_skb+0xba/0xf0 [ 75.719672][ T5442] netlink_sendmsg+0x3cf/0x6b0 [ 75.719711][ T5442] ? __pfx_netlink_sendmsg+0x10/0x10 [ 75.719815][ T5442] __sock_sendmsg+0x145/0x180 [ 75.719852][ T5442] ____sys_sendmsg+0x31e/0x4e0 [ 75.719906][ T5442] ___sys_sendmsg+0x17b/0x1d0 [ 75.720034][ T5442] __x64_sys_sendmsg+0xd4/0x160 [ 75.720080][ T5442] x64_sys_call+0x2999/0x2fb0 [ 75.720142][ T5442] do_syscall_64+0xd2/0x200 [ 75.720165][ T5442] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 75.720200][ T5442] ? clear_bhb_loop+0x40/0x90 [ 75.720228][ T5442] ? clear_bhb_loop+0x40/0x90 [ 75.720277][ T5442] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.720298][ T5442] RIP: 0033:0x7f3ca9a5e929 [ 75.720315][ T5442] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.720340][ T5442] RSP: 002b:00007f3ca80c7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 75.720364][ T5442] RAX: ffffffffffffffda RBX: 00007f3ca9c85fa0 RCX: 00007f3ca9a5e929 [ 75.720380][ T5442] RDX: 0000000000000000 RSI: 00002000000007c0 RDI: 0000000000000006 [ 75.720458][ T5442] RBP: 00007f3ca80c7090 R08: 0000000000000000 R09: 0000000000000000 [ 75.720472][ T5442] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 75.720485][ T5442] R13: 0000000000000000 R14: 00007f3ca9c85fa0 R15: 00007ffea8803c68 [ 75.720507][ T5442] [ 75.724044][ T5440] can0: slcan on ttyS3. [ 75.935971][ T5463] netlink: 'syz.1.477': attribute type 4 has an invalid length. [ 75.967256][ T4848] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 76.048039][ T5439] can0 (unregistered): slcan off ttyS3. [ 76.109910][ T5484] can0: slcan on ttyS3. [ 76.159641][ T5484] FAULT_INJECTION: forcing a failure. [ 76.159641][ T5484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 76.172814][ T5484] CPU: 1 UID: 0 PID: 5484 Comm: syz.1.482 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 76.172846][ T5484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 76.172862][ T5484] Call Trace: [ 76.172920][ T5484] [ 76.172929][ T5484] __dump_stack+0x1d/0x30 [ 76.172953][ T5484] dump_stack_lvl+0xe8/0x140 [ 76.172976][ T5484] dump_stack+0x15/0x1b [ 76.172996][ T5484] should_fail_ex+0x265/0x280 [ 76.173059][ T5484] should_fail+0xb/0x20 [ 76.173122][ T5484] should_fail_usercopy+0x1a/0x20 [ 76.173181][ T5484] _copy_from_iter+0xcf/0xe40 [ 76.173222][ T5484] ? __build_skb_around+0x1a0/0x200 [ 76.173260][ T5484] ? __alloc_skb+0x223/0x320 [ 76.173325][ T5484] netlink_sendmsg+0x471/0x6b0 [ 76.173351][ T5484] ? __pfx_netlink_sendmsg+0x10/0x10 [ 76.173375][ T5484] __sock_sendmsg+0x145/0x180 [ 76.173406][ T5484] sock_write_iter+0x165/0x1b0 [ 76.173503][ T5484] do_iter_readv_writev+0x421/0x4c0 [ 76.173528][ T5484] vfs_writev+0x2df/0x8b0 [ 76.173570][ T5484] do_writev+0xe7/0x210 [ 76.173672][ T5484] __x64_sys_writev+0x45/0x50 [ 76.173700][ T5484] x64_sys_call+0x2006/0x2fb0 [ 76.173779][ T5484] do_syscall_64+0xd2/0x200 [ 76.173798][ T5484] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 76.173824][ T5484] ? clear_bhb_loop+0x40/0x90 [ 76.173923][ T5484] ? clear_bhb_loop+0x40/0x90 [ 76.173952][ T5484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.173979][ T5484] RIP: 0033:0x7f06c572e929 [ 76.173999][ T5484] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 76.174022][ T5484] RSP: 002b:00007f06c3d97038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 76.174105][ T5484] RAX: ffffffffffffffda RBX: 00007f06c5955fa0 RCX: 00007f06c572e929 [ 76.174118][ T5484] RDX: 0000000000000001 RSI: 00002000000003c0 RDI: 0000000000000008 [ 76.174130][ T5484] RBP: 00007f06c3d97090 R08: 0000000000000000 R09: 0000000000000000 [ 76.174142][ T5484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 76.174154][ T5484] R13: 0000000000000000 R14: 00007f06c5955fa0 R15: 00007ffd5998a608 [ 76.174189][ T5484] [ 76.174579][ T37] kworker/u8:2: attempt to access beyond end of device [ 76.174579][ T37] loop2: rw=1, sector=153, nr_sectors = 8 limit=128 [ 76.203548][ T5492] loop7: detected capacity change from 0 to 512 [ 76.206424][ T37] kworker/u8:2: attempt to access beyond end of device [ 76.206424][ T37] loop2: rw=1, sector=169, nr_sectors = 8 limit=128 [ 76.376165][ T5492] EXT4-fs (loop7): orphan cleanup on readonly fs [ 76.435454][ T37] kworker/u8:2: attempt to access beyond end of device [ 76.435454][ T37] loop2: rw=1, sector=185, nr_sectors = 8 limit=128 [ 76.448920][ T37] kworker/u8:2: attempt to access beyond end of device [ 76.448920][ T37] loop2: rw=1, sector=201, nr_sectors = 8 limit=128 [ 76.476306][ T5483] can0 (unregistered): slcan off ttyS3. [ 76.487461][ T5492] EXT4-fs error (device loop7): ext4_acquire_dquot:6933: comm syz.7.480: Failed to acquire dquot type 1 [ 76.536193][ T37] kworker/u8:2: attempt to access beyond end of device [ 76.536193][ T37] loop2: rw=1, sector=217, nr_sectors = 8 limit=128 [ 76.575625][ T5492] EXT4-fs (loop7): 1 truncate cleaned up [ 76.584375][ T37] kworker/u8:2: attempt to access beyond end of device [ 76.584375][ T37] loop2: rw=1, sector=233, nr_sectors = 8 limit=128 [ 76.608932][ T5492] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 76.612546][ T5514] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 76.612546][ T5514] program syz.4.486 not setting count and/or reply_len properly [ 76.624826][ T37] kworker/u8:2: attempt to access beyond end of device [ 76.624826][ T37] loop2: rw=1, sector=249, nr_sectors = 8 limit=128 [ 76.700549][ T37] kworker/u8:2: attempt to access beyond end of device [ 76.700549][ T37] loop2: rw=1, sector=265, nr_sectors = 8 limit=128 [ 76.716550][ T5519] __nla_validate_parse: 4 callbacks suppressed [ 76.716567][ T5519] netlink: 4 bytes leftover after parsing attributes in process `syz.1.489'. [ 76.758256][ T5524] loop5: detected capacity change from 0 to 512 [ 76.764893][ T37] kworker/u8:2: attempt to access beyond end of device [ 76.764893][ T37] loop2: rw=1, sector=281, nr_sectors = 8 limit=128 [ 76.779316][ T5524] EXT4-fs: Ignoring removed oldalloc option [ 76.785279][ T5492] EXT4-fs (loop7): re-mounted 00000000-0000-0000-0000-000000000000. [ 76.803682][ T37] kworker/u8:2: attempt to access beyond end of device [ 76.803682][ T37] loop2: rw=1, sector=297, nr_sectors = 8 limit=128 [ 76.822314][ T5519] netlink: 4 bytes leftover after parsing attributes in process `syz.1.489'. [ 76.845722][ T5524] EXT4-fs: inline encryption not supported [ 76.866029][ T5524] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -2 [ 76.876468][ T5524] EXT4-fs (loop5): 1 truncate cleaned up [ 76.882714][ T5524] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 77.036089][ T5559] FAULT_INJECTION: forcing a failure. [ 77.036089][ T5559] name failslab, interval 1, probability 0, space 0, times 0 [ 77.048787][ T5559] CPU: 1 UID: 0 PID: 5559 Comm: syz.1.493 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 77.048819][ T5559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 77.048832][ T5559] Call Trace: [ 77.048837][ T5559] [ 77.048850][ T5559] __dump_stack+0x1d/0x30 [ 77.048941][ T5559] dump_stack_lvl+0xe8/0x140 [ 77.048963][ T5559] dump_stack+0x15/0x1b [ 77.048983][ T5559] should_fail_ex+0x265/0x280 [ 77.049034][ T5559] should_failslab+0x8c/0xb0 [ 77.049059][ T5559] kmem_cache_alloc_noprof+0x50/0x310 [ 77.049161][ T5559] ? dst_alloc+0xbd/0x100 [ 77.049198][ T5559] ? unwind_get_return_address+0x16/0x40 [ 77.049233][ T5559] dst_alloc+0xbd/0x100 [ 77.049303][ T5559] ip_route_output_key_hash_rcu+0xf16/0x1440 [ 77.049369][ T5559] ip_route_output_flow+0x7b/0x130 [ 77.049399][ T5559] udp_sendmsg+0x1197/0x13b0 [ 77.049430][ T5559] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 77.049460][ T5559] ? avc_has_perm+0xd3/0x150 [ 77.049520][ T5559] ? __pfx_udp_sendmsg+0x10/0x10 [ 77.049540][ T5559] inet_sendmsg+0xac/0xd0 [ 77.049558][ T5559] __sock_sendmsg+0x102/0x180 [ 77.049611][ T5559] ____sys_sendmsg+0x345/0x4e0 [ 77.049692][ T5559] ___sys_sendmsg+0x17b/0x1d0 [ 77.049812][ T5559] __sys_sendmmsg+0x178/0x300 [ 77.049841][ T5559] __x64_sys_sendmmsg+0x57/0x70 [ 77.049925][ T5559] x64_sys_call+0x2f2f/0x2fb0 [ 77.049946][ T5559] do_syscall_64+0xd2/0x200 [ 77.050019][ T5559] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 77.050060][ T5559] ? clear_bhb_loop+0x40/0x90 [ 77.050086][ T5559] ? clear_bhb_loop+0x40/0x90 [ 77.050124][ T5559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.050252][ T5559] RIP: 0033:0x7f06c572e929 [ 77.050267][ T5559] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 77.050286][ T5559] RSP: 002b:00007f06c3d97038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 77.050306][ T5559] RAX: ffffffffffffffda RBX: 00007f06c5955fa0 RCX: 00007f06c572e929 [ 77.050322][ T5559] RDX: 0000000000000003 RSI: 0000200000004540 RDI: 0000000000000005 [ 77.050348][ T5559] RBP: 00007f06c3d97090 R08: 0000000000000000 R09: 0000000000000000 [ 77.050363][ T5559] R10: 00000000240080e4 R11: 0000000000000246 R12: 0000000000000001 [ 77.050432][ T5559] R13: 0000000000000000 R14: 00007f06c5955fa0 R15: 00007ffd5998a608 [ 77.050454][ T5559] [ 77.068456][ T4038] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.379051][ T5568] loop5: detected capacity change from 0 to 1024 [ 77.401186][ T5547] SELinux: failed to load policy [ 77.427502][ T5568] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 77.434037][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.447433][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.454995][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.479674][ T5568] ext4 filesystem being mounted at /68/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 77.490532][ T4848] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.510794][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.518455][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.525975][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.533380][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.540816][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.548450][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.555927][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.563340][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.570836][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.578278][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.585822][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.593460][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.600947][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.608405][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.615847][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.623252][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.630704][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.638150][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.645785][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.653220][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.656155][ T5575] netlink: 4 bytes leftover after parsing attributes in process `syz.2.498'. [ 77.660633][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.677396][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.684793][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.692293][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.699785][ T10] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 77.711081][ T5575] netlink: 4 bytes leftover after parsing attributes in process `syz.2.498'. [ 77.738928][ T4290] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 77.754282][ T4290] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 77.766531][ T4290] EXT4-fs (loop5): This should not happen!! Data will be lost [ 77.766531][ T4290] [ 77.776281][ T4290] EXT4-fs (loop5): Total free blocks count 0 [ 77.782279][ T4290] EXT4-fs (loop5): Free/Dirty block details [ 77.788314][ T4290] EXT4-fs (loop5): free_blocks=4293918720 [ 77.794100][ T4290] EXT4-fs (loop5): dirty_blocks=16 [ 77.799298][ T4290] EXT4-fs (loop5): Block reservation details [ 77.805377][ T4290] EXT4-fs (loop5): i_reserved_data_blocks=1 [ 77.828137][ T10] hid-generic 0000:0000:0000.000E: hidraw0: HID v8.00 Device [syz1] on syz0 [ 77.839523][ T4038] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.871004][ T5582] fido_id[5582]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 77.915874][ T29] kauditd_printk_skb: 135 callbacks suppressed [ 77.915923][ T29] audit: type=1326 audit(1751421146.830:1488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5588 comm="syz.7.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44c439e929 code=0x7ffc0000 [ 77.916189][ T5589] audit: audit_lost=3 audit_rate_limit=0 audit_backlog_limit=64 [ 77.923424][ T29] audit: type=1326 audit(1751421146.830:1489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5588 comm="syz.7.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f44c439d290 code=0x7ffc0000 [ 77.946272][ T5589] audit: out of memory in audit_log_start [ 77.953227][ T29] audit: type=1326 audit(1751421146.830:1490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5588 comm="syz.7.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f44c439d3df code=0x7ffc0000 [ 78.005737][ T5587] loop1: detected capacity change from 0 to 512 [ 78.016923][ T29] audit: type=1326 audit(1751421146.890:1491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5588 comm="syz.7.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7f44c439d33c code=0x7ffc0000 [ 78.040195][ T29] audit: type=1326 audit(1751421146.890:1492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5588 comm="syz.7.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f44c439d3df code=0x7ffc0000 [ 78.063604][ T29] audit: type=1326 audit(1751421146.890:1493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5588 comm="syz.7.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f44c439d58a code=0x7ffc0000 [ 78.087016][ T29] audit: type=1326 audit(1751421146.890:1494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5588 comm="syz.7.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44c439e929 code=0x7ffc0000 [ 78.110477][ T29] audit: type=1326 audit(1751421146.890:1495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5588 comm="syz.7.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44c439e929 code=0x7ffc0000 [ 78.111193][ T5587] EXT4-fs error (device loop1): ext4_acquire_dquot:6933: comm +}[@: Failed to acquire dquot type 1 [ 78.155968][ T5587] EXT4-fs (loop1): 1 truncate cleaned up [ 78.179903][ T5587] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 78.217316][ T5587] ext4 filesystem being mounted at /99/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 78.228888][ T5587] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.314597][ T5606] lo: entered allmulticast mode [ 78.319997][ T5606] netlink: 'syz.5.504': attribute type 39 has an invalid length. [ 78.360945][ T5611] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 78.360945][ T5611] program syz.1.508 not setting count and/or reply_len properly [ 78.416615][ T5615] loop2: detected capacity change from 0 to 1024 [ 78.427775][ T5615] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 78.440023][ T5615] ext4 filesystem being mounted at /109/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 78.484155][ T5621] netlink: 12 bytes leftover after parsing attributes in process `syz.5.511'. [ 78.493965][ T31] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 78.510338][ T31] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 78.522609][ T31] EXT4-fs (loop2): This should not happen!! Data will be lost [ 78.522609][ T31] [ 78.532338][ T31] EXT4-fs (loop2): Total free blocks count 0 [ 78.538390][ T31] EXT4-fs (loop2): Free/Dirty block details [ 78.544288][ T31] EXT4-fs (loop2): free_blocks=4293918720 [ 78.550061][ T31] EXT4-fs (loop2): dirty_blocks=16 [ 78.555231][ T31] EXT4-fs (loop2): Block reservation details [ 78.561314][ T31] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 78.568381][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.602635][ T5624] loop2: detected capacity change from 0 to 512 [ 78.616215][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.623648][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.631186][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.634917][ T5624] EXT4-fs error (device loop2): ext4_acquire_dquot:6933: comm +}[@: Failed to acquire dquot type 1 [ 78.649419][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.649443][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.649462][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.659692][ T5624] EXT4-fs (loop2): 1 truncate cleaned up [ 78.664405][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.664429][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.673112][ T5624] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 78.677493][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.712452][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.712452][ T5624] ext4 filesystem being mounted at /110/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 78.718008][ T5624] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.719930][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.746872][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.754292][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.761796][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.769307][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.776740][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.784153][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.791596][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.799030][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.806678][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.814173][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.821672][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.829172][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.836592][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.843991][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.851451][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.858965][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.866390][ T3541] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 78.876874][ T3541] hid-generic 0000:0000:0000.000F: hidraw0: HID v8.00 Device [syz1] on syz0 [ 78.963274][ T5642] sg_write: data in/out 2012/14 bytes for SCSI command 0x0-- guessing data in; [ 78.963274][ T5642] program syz.2.519 not setting count and/or reply_len properly [ 78.973068][ T5644] loop4: detected capacity change from 0 to 1024 [ 78.989952][ T5644] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 79.000960][ T5640] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 79.010397][ T5640] vhci_hcd: invalid port number 96 [ 79.015564][ T5640] vhci_hcd: default hub control req: 0000 vfffc i0060 l0 [ 79.050601][ T5647] ================================================================== [ 79.058720][ T5647] BUG: KCSAN: data-race in _copy_from_iter / _copy_from_iter [ 79.066316][ T5647] [ 79.068750][ T5647] write to 0xffff8881353dd000 of 4096 bytes by task 5644 on cpu 1: [ 79.076646][ T5647] _copy_from_iter+0x130/0xe40 [ 79.081438][ T5647] copy_page_from_iter+0x178/0x2a0 [ 79.086555][ T5647] process_vm_rw+0x659/0x950 [ 79.091157][ T5647] __x64_sys_process_vm_writev+0x78/0x90 [ 79.096818][ T5647] x64_sys_call+0xe80/0x2fb0 [ 79.101424][ T5647] do_syscall_64+0xd2/0x200 [ 79.105933][ T5647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.111836][ T5647] [ 79.114167][ T5647] write to 0xffff8881353dd000 of 4096 bytes by task 5647 on cpu 0: [ 79.122072][ T5647] _copy_from_iter+0x130/0xe40 [ 79.126861][ T5647] copy_page_from_iter+0x178/0x2a0 [ 79.131978][ T5647] process_vm_rw+0x659/0x950 [ 79.136581][ T5647] __x64_sys_process_vm_writev+0x78/0x90 [ 79.142227][ T5647] x64_sys_call+0xe80/0x2fb0 [ 79.146822][ T5647] do_syscall_64+0xd2/0x200 [ 79.151327][ T5647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.157225][ T5647] [ 79.159554][ T5647] Reported by Kernel Concurrency Sanitizer on: [ 79.165707][ T5647] CPU: 0 UID: 0 PID: 5647 Comm: syz.4.518 Not tainted 6.16.0-rc4-syzkaller-00013-g66701750d556 #0 PREEMPT(voluntary) [ 79.178040][ T5647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 79.188106][ T5647] ==================================================================