last executing test programs: 2.504032931s ago: executing program 3 (id=245): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) write$cgroup_netprio_ifpriomap(r1, &(0x7f0000000ac0)=ANY=[@ANYBLOB="f6657468305f767c72745f0d29"], 0x12) 2.468370501s ago: executing program 3 (id=250): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) unshare(0x400) sendmmsg$inet6(r0, &(0x7f0000003a00)=[{{&(0x7f0000000580)={0xa, 0x20, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000200)="c5df6a3b", 0x34000}], 0x1}}, {{&(0x7f0000000b40)={0xa, 0x4e21, 0x900000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}, 0x1c, &(0x7f0000001600)=[{&(0x7f0000000e40)="af", 0x1}], 0x1}}], 0x2, 0xc0c0) ppoll(&(0x7f0000000240)=[{r0, 0x2}], 0x1, &(0x7f0000000300), 0x0, 0x0) 2.375983893s ago: executing program 3 (id=254): close(0xffffffffffffffff) perf_event_open(&(0x7f0000000800)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x2, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000800)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_clone(0x200c8000, 0x0, 0x0, 0x0, 0x0, 0x0) 2.296637654s ago: executing program 3 (id=256): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) munlock(&(0x7f00004f3000/0x3000)=nil, 0x3000) 1.744993232s ago: executing program 3 (id=271): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x200000010, &(0x7f0000000000)=0x7, 0x4) sendto$unix(r0, &(0x7f0000000240)="0014", 0x2, 0x4040081, 0x0, 0x0) recvfrom$unix(r1, 0x0, 0x0, 0x10102, 0x0, 0x0) 1.110165673s ago: executing program 0 (id=289): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x700, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000070000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="0c0001800800010003000100100001800c0004800800020000000000100001"], 0x44}}, 0x0) 1.010160874s ago: executing program 0 (id=291): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000001600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000040002850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00', r1}, 0x10) statx(0xffffffffffffffff, 0x0, 0x6000, 0x200, 0x0) 983.490514ms ago: executing program 0 (id=292): r0 = socket$packet(0x11, 0x2, 0x300) r1 = io_uring_setup(0x2c93, &(0x7f00000000c0)={0x0, 0xf0ce, 0x80, 0x3, 0x9f8}) recvmsg(r0, &(0x7f0000002780)={0x0, 0x0, 0x0}, 0x2) io_uring_enter(r1, 0x0, 0xcb, 0xf, &(0x7f0000000000), 0x18) 809.901727ms ago: executing program 3 (id=297): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='comm\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0x3, 0x1}]}) timer_create(0x2, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000040), 0x8) 463.194102ms ago: executing program 4 (id=306): pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) tee(r1, r0, 0x7fff, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 392.864204ms ago: executing program 4 (id=308): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000400000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sys_enter\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) fadvise64(r1, 0x9, 0x7, 0x2) 341.784074ms ago: executing program 4 (id=310): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregset(0x4205, r0, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c98e1f92b0f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c571a70e7ca7b0451a6cc55c", 0x98}) ptrace$setregset(0x4205, r0, 0x1, &(0x7f00000001c0)={&(0x7f0000000180)="e345b941eb6a3f6dedf122b293def8a4e2c7491ffa211f1508685636", 0x1c}) 341.516804ms ago: executing program 4 (id=312): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x37, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x4c58, 0x10000, 0x0, 0x1, 0x8, 0x20002, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000007c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100030010651fbe347b2c2b00000c00018008000100", @ANYRES16=r0], 0x20}}, 0x0) 297.390995ms ago: executing program 4 (id=315): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000001000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000100006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000a80)='kfree\x00', r0, 0x0, 0xfffffffffffffffd}, 0x18) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newtaction={0xf8, 0x30, 0xffff, 0x70bd2d, 0x0, {}, [{0xe4, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x10001, 0x5, 0x0, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x6}}}]]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2b9, 0xf, 0x4, 0xfffffff8, 0x2e3}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}, @m_bpf={0x2c, 0x3, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0xf8}}, 0x0) 297.063145ms ago: executing program 2 (id=317): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10) shutdown(r0, 0x1) 289.657655ms ago: executing program 4 (id=319): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sync() 237.755616ms ago: executing program 2 (id=322): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b7030000000000de850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x548, 0x0, 0xffffffff, 0xffffffff, 0x1c0, 0xffffffff, 0x478, 0xffffffff, 0xffffffff, 0x478, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x9, 0x0, 0x24, 0x0, 'syz1\x00'}}]}, @unspec=@TRACE={0x20}}, {{@ipv6={@remote, @private2, [0xffffff00, 0xffffffff, 0x0, 0xffffff00], [0xffffffff, 0xffffff00, 0xffffffff, 0xff000000], 'netpci0\x00', 'bridge_slave_1\x00', {}, {0xff}, 0x2b, 0x2, 0x5, 0x5}, 0x0, 0x298, 0x2b8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x1, 0x1, 'syz0\x00'}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x6, 0x4, 0x0, 'syz0\x00'}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5a8) 223.385076ms ago: executing program 1 (id=323): r0 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) epoll_create1(0x80000) shutdown(r0, 0x1) 196.759176ms ago: executing program 2 (id=324): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000006c59850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r0}, 0x18) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0800034000000004640000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000380003803400008028000180230001"], 0xf0}, 0x1, 0x0, 0x0, 0x80}, 0x0) 190.756456ms ago: executing program 1 (id=325): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) 150.047057ms ago: executing program 1 (id=326): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000001000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000100006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000a80)='kfree\x00', r0, 0x0, 0xfffffffffffffffd}, 0x18) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000020000000000000000000095"], &(0x7f0000000340)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x406, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000000c0)="a0", 0x0}, 0x31) 141.841967ms ago: executing program 2 (id=327): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0xfffffffffffffeb3, &(0x7f0000000080)={&(0x7f0000000680)=@newqdisc={0x48, 0x24, 0xf0b, 0x3, 0x25dfdbff, {0x60, 0x0, 0x0, r2, {0x0, 0xc}, {0xffff, 0xffff}, {0x2, 0x8}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x351df08f}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x1}]}}]}, 0x48}}, 0x44040) 121.803578ms ago: executing program 0 (id=328): r0 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r0, &(0x7f0000000080)={'#! ', './file0', [{0x20, '\x8b! '}, {0x20, 'M\xe5mC%N\xa6\xe2\xb7#laP\x94BM\xa9\xa8\x00\x91\xf2\xce\x97\xdc[\x98\x11\x8f\xddY\x1b\r\xe6\x99O\xc0La\xd5\xcfl\x1a\f\xd0\x94\x1a\x17V\xc3L\xff:\x18\xb3\xdb\x9a\x8f\x12g/D?&V0b\xe8\x8e\x03/rM\xcd\x89q\x8b?s\x9d\xc2\xf6\x8b\x11\xcc\xf1\xcb\xadP\x14\xe9\xdd\x10\tQ\x14\xa8\x01N5\xbf*\f\x86\x85\xf4\\\x8c4\xdc\x10\xc7\x80\x8a\xa6\x15\xf4\xed-\xb5\xee}\xb3\x03\xfe\xe8&\xcf\xe2\xb68&v\xf0~\x87\x15o\b\xbbxx\x93\xa5\x14\xd55\xf0\xb4O\xc3\xa1\xcf\xe6Z\x17o\xe8!e\x90\r\xec\xf9\xdd<\xe2QWj`\xf5\xab\xab\x87\xdd\xbc\xc8\x0e\n\x84>\x03X\xf0$\x860\'\xfbOM\xe5\xc3zz\x1a\xa1\x8f\x1bk\xe7(\x18T\xe2g\xed4n\xda\x99\xab\xf9c\td\x99\xcfh\x90a'}, {0x20, ')['}, {0x20, '\xc3-&\'--*!$6'}, {0x20, '#! '}, {0x20, '\\'}]}, 0x101) close(r0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 89.474888ms ago: executing program 2 (id=329): r0 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) setsockopt$sock_attach_bpf(r0, 0x1, 0xd, &(0x7f0000000080), 0x24) close(r0) 85.098738ms ago: executing program 0 (id=330): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000f7850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) writev(r1, &(0x7f00000025c0)=[{&(0x7f0000000240)='4', 0x1}], 0x1) 84.953908ms ago: executing program 1 (id=331): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010040bf080000000000027b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800200018210000", @ANYRES32=r1, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f00000001c0)='GPL\x00', 0x3, 0xff6, &(0x7f0000001e00)=""/4086, 0x41000, 0xa, '\x00', 0x0, 0x0, r0}, 0x94) 52.665108ms ago: executing program 2 (id=332): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0xffff}, 0x18) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="540000001000010471bc30b00000000100000000", @ANYRES32=0x0, @ANYBLOB="fff00000000000002c0012800e00010069703667726574617000000018000280140007002001001000000000000000000000000208000a00f0"], 0x54}}, 0x0) 25.552659ms ago: executing program 1 (id=333): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10) shutdown(r0, 0x1) 25.094579ms ago: executing program 0 (id=334): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000000540)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r0}, 0x10) r1 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r1, 0x7, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=335): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fdff00000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0xe, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.137' (ED25519) to the list of known hosts. [ 25.970786][ T29] audit: type=1400 audit(1752714631.839:62): avc: denied { mounton } for pid=3290 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.971962][ T3290] cgroup: Unknown subsys name 'net' [ 25.993636][ T29] audit: type=1400 audit(1752714631.839:63): avc: denied { mount } for pid=3290 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.020922][ T29] audit: type=1400 audit(1752714631.869:64): avc: denied { unmount } for pid=3290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.176568][ T3290] cgroup: Unknown subsys name 'cpuset' [ 26.182780][ T3290] cgroup: Unknown subsys name 'rlimit' [ 26.313658][ T29] audit: type=1400 audit(1752714632.179:65): avc: denied { setattr } for pid=3290 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.337191][ T29] audit: type=1400 audit(1752714632.179:66): avc: denied { create } for pid=3290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.357712][ T29] audit: type=1400 audit(1752714632.179:67): avc: denied { write } for pid=3290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.372523][ T3294] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.378126][ T29] audit: type=1400 audit(1752714632.179:68): avc: denied { read } for pid=3290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.406963][ T29] audit: type=1400 audit(1752714632.209:69): avc: denied { mounton } for pid=3290 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.431739][ T29] audit: type=1400 audit(1752714632.209:70): avc: denied { mount } for pid=3290 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.455190][ T29] audit: type=1400 audit(1752714632.259:71): avc: denied { relabelto } for pid=3294 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.465235][ T3290] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.193177][ T3304] chnl_net:caif_netlink_parms(): no params data found [ 28.300588][ T3305] chnl_net:caif_netlink_parms(): no params data found [ 28.309678][ T3304] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.316816][ T3304] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.324030][ T3304] bridge_slave_0: entered allmulticast mode [ 28.330523][ T3304] bridge_slave_0: entered promiscuous mode [ 28.339175][ T3304] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.346260][ T3304] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.353520][ T3304] bridge_slave_1: entered allmulticast mode [ 28.359947][ T3304] bridge_slave_1: entered promiscuous mode [ 28.373950][ T3308] chnl_net:caif_netlink_parms(): no params data found [ 28.384288][ T3302] chnl_net:caif_netlink_parms(): no params data found [ 28.402363][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 28.424014][ T3304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.436624][ T3304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.483418][ T3304] team0: Port device team_slave_0 added [ 28.505854][ T3304] team0: Port device team_slave_1 added [ 28.515567][ T3305] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.522668][ T3305] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.529825][ T3305] bridge_slave_0: entered allmulticast mode [ 28.536474][ T3305] bridge_slave_0: entered promiscuous mode [ 28.558421][ T3305] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.565504][ T3305] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.572650][ T3305] bridge_slave_1: entered allmulticast mode [ 28.579120][ T3305] bridge_slave_1: entered promiscuous mode [ 28.613926][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.620933][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.646938][ T3304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.662603][ T3308] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.669780][ T3308] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.677007][ T3308] bridge_slave_0: entered allmulticast mode [ 28.683449][ T3308] bridge_slave_0: entered promiscuous mode [ 28.690074][ T3308] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.697156][ T3308] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.704306][ T3308] bridge_slave_1: entered allmulticast mode [ 28.710937][ T3308] bridge_slave_1: entered promiscuous mode [ 28.723690][ T3305] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.732904][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.740042][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.747243][ T3307] bridge_slave_0: entered allmulticast mode [ 28.753727][ T3307] bridge_slave_0: entered promiscuous mode [ 28.760434][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.767438][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.793448][ T3304] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.804182][ T3302] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.811298][ T3302] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.818530][ T3302] bridge_slave_0: entered allmulticast mode [ 28.825067][ T3302] bridge_slave_0: entered promiscuous mode [ 28.842056][ T3305] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.851379][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.858536][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.865703][ T3307] bridge_slave_1: entered allmulticast mode [ 28.872235][ T3307] bridge_slave_1: entered promiscuous mode [ 28.881112][ T3302] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.888277][ T3302] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.895411][ T3302] bridge_slave_1: entered allmulticast mode [ 28.901825][ T3302] bridge_slave_1: entered promiscuous mode [ 28.908899][ T3308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.938714][ T3308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.959062][ T3302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.969080][ T3305] team0: Port device team_slave_0 added [ 28.992960][ T3302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.003656][ T3304] hsr_slave_0: entered promiscuous mode [ 29.009607][ T3304] hsr_slave_1: entered promiscuous mode [ 29.016303][ T3305] team0: Port device team_slave_1 added [ 29.022920][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.032695][ T3308] team0: Port device team_slave_0 added [ 29.053481][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.063178][ T3308] team0: Port device team_slave_1 added [ 29.078376][ T3302] team0: Port device team_slave_0 added [ 29.084495][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.091474][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.117443][ T3305] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.138055][ T3302] team0: Port device team_slave_1 added [ 29.144039][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.151057][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.177109][ T3308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.192880][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.199926][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.226003][ T3305] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.251035][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.258020][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.284005][ T3308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.305542][ T3307] team0: Port device team_slave_0 added [ 29.312070][ T3307] team0: Port device team_slave_1 added [ 29.324548][ T3302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.331516][ T3302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.357508][ T3302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.368855][ T3302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.375878][ T3302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.401831][ T3302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.429734][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.436753][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.462828][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.490022][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.497049][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.523076][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.537656][ T3305] hsr_slave_0: entered promiscuous mode [ 29.543567][ T3305] hsr_slave_1: entered promiscuous mode [ 29.549444][ T3305] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 29.557015][ T3305] Cannot create hsr debugfs directory [ 29.575850][ T3308] hsr_slave_0: entered promiscuous mode [ 29.581823][ T3308] hsr_slave_1: entered promiscuous mode [ 29.587817][ T3308] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 29.595433][ T3308] Cannot create hsr debugfs directory [ 29.609926][ T3302] hsr_slave_0: entered promiscuous mode [ 29.615865][ T3302] hsr_slave_1: entered promiscuous mode [ 29.621816][ T3302] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 29.629390][ T3302] Cannot create hsr debugfs directory [ 29.688418][ T3307] hsr_slave_0: entered promiscuous mode [ 29.694392][ T3307] hsr_slave_1: entered promiscuous mode [ 29.700367][ T3307] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 29.708052][ T3307] Cannot create hsr debugfs directory [ 29.816905][ T3304] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 29.835268][ T3304] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 29.845854][ T3304] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 29.859385][ T3304] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 29.893557][ T3308] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 29.903379][ T3308] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 29.912213][ T3308] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 29.924273][ T3308] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 29.953153][ T3302] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 29.971376][ T3302] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 29.980630][ T3302] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 29.994150][ T3302] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.017003][ T3304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.026229][ T3307] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 30.035122][ T3307] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 30.045329][ T3307] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 30.062449][ T3304] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.071789][ T3307] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 30.097643][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.104772][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.113723][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.120860][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.143748][ T3305] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.160661][ T3305] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.169521][ T3305] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.178239][ T3305] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.191589][ T3304] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.202093][ T3304] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.232930][ T3308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.263873][ T3308] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.276859][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.285793][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.292944][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.307482][ T3304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.328083][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.335170][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.360227][ T3308] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.370739][ T3308] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.399036][ T3302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.412021][ T3305] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.420313][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.441419][ T3305] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.463178][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.470334][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.480188][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.487392][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.499818][ T3302] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.510950][ T123] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.518080][ T123] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.527142][ T123] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.534266][ T123] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.550287][ T3308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.561388][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.568498][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.578658][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.585789][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.631563][ T3304] veth0_vlan: entered promiscuous mode [ 30.652542][ T3304] veth1_vlan: entered promiscuous mode [ 30.670047][ T3302] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.710347][ T3304] veth0_macvtap: entered promiscuous mode [ 30.731464][ T3304] veth1_macvtap: entered promiscuous mode [ 30.755654][ T3308] veth0_vlan: entered promiscuous mode [ 30.764937][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.775638][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.788485][ T3308] veth1_vlan: entered promiscuous mode [ 30.797195][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.817642][ T3304] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.826424][ T3304] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.835138][ T3304] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.843950][ T3304] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.856045][ T3302] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.898671][ T3305] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.913031][ T3308] veth0_macvtap: entered promiscuous mode [ 30.930087][ T3308] veth1_macvtap: entered promiscuous mode [ 30.939425][ T3304] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.943472][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.971604][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.983521][ T29] kauditd_printk_skb: 18 callbacks suppressed [ 30.983535][ T29] audit: type=1400 audit(1752714636.849:90): avc: denied { read write } for pid=3304 comm="syz-executor" name="loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 31.006963][ T3308] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.022429][ T3308] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.031249][ T3308] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.039989][ T3308] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.048821][ T29] audit: type=1400 audit(1752714636.849:91): avc: denied { open } for pid=3304 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 31.072835][ T29] audit: type=1400 audit(1752714636.849:92): avc: denied { ioctl } for pid=3304 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=104 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 31.088412][ T3307] veth0_vlan: entered promiscuous mode [ 31.100007][ T29] audit: type=1400 audit(1752714636.919:93): avc: denied { prog_load } for pid=3465 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 31.114172][ T3307] veth1_vlan: entered promiscuous mode [ 31.122290][ T29] audit: type=1400 audit(1752714636.919:94): avc: denied { bpf } for pid=3465 comm="syz.4.5" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 31.147923][ T29] audit: type=1400 audit(1752714636.919:95): avc: denied { perfmon } for pid=3465 comm="syz.4.5" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 31.153013][ T3307] veth0_macvtap: entered promiscuous mode [ 31.168386][ T29] audit: type=1400 audit(1752714636.919:96): avc: denied { prog_run } for pid=3465 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 31.207382][ T3307] veth1_macvtap: entered promiscuous mode [ 31.228619][ T29] audit: type=1400 audit(1752714637.099:97): avc: denied { create } for pid=3473 comm="syz.4.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 31.231123][ T3302] veth0_vlan: entered promiscuous mode [ 31.254753][ T3474] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6'. [ 31.273855][ T29] audit: type=1400 audit(1752714637.119:98): avc: denied { write } for pid=3473 comm="syz.4.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 31.289801][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.293566][ T29] audit: type=1400 audit(1752714637.119:99): avc: denied { nlmsg_write } for pid=3473 comm="syz.4.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 31.341316][ T3305] veth0_vlan: entered promiscuous mode [ 31.357163][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.365224][ T3302] veth1_vlan: entered promiscuous mode [ 31.379885][ T3307] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.388732][ T3307] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.397557][ T3307] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.406385][ T3307] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.430375][ T3305] veth1_vlan: entered promiscuous mode [ 31.487107][ T3305] veth0_macvtap: entered promiscuous mode [ 31.493964][ T3302] veth0_macvtap: entered promiscuous mode [ 31.513326][ T3302] veth1_macvtap: entered promiscuous mode [ 31.527315][ T3305] veth1_macvtap: entered promiscuous mode [ 31.554256][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.579261][ T3302] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.588982][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.599630][ T3302] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.609715][ T3305] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.618612][ T3305] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.627395][ T3305] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.636299][ T3305] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.655099][ T3302] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.663988][ T3302] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.672794][ T3302] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.681603][ T3302] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.682706][ T3503] SELinux: Context system_u:object_r:hwdata_t:s0 is not valid (left unmapped). [ 31.789228][ T3509] tun0: tun_chr_ioctl cmd 1074025677 [ 31.794639][ T3509] tun0: linktype set to 774 [ 31.801140][ T3511] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 31.819436][ T3517] loop3: detected capacity change from 0 to 512 [ 31.829314][ T3517] EXT4-fs: Ignoring removed nomblk_io_submit option [ 31.842089][ T3517] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 31.861717][ T3517] EXT4-fs (loop3): warning: checktime reached, running e2fsck is recommended [ 31.900716][ T3517] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a842c01c, mo2=0002] [ 31.916470][ T3517] System zones: 0-2, 18-18, 34-34 [ 31.927287][ T3517] EXT4-fs error (device loop3): ext4_orphan_get:1393: inode #15: comm syz.3.17: iget: bad i_size value: 360287970189639680 [ 31.960419][ T3517] EXT4-fs error (device loop3): ext4_orphan_get:1398: comm syz.3.17: couldn't read orphan inode 15 (err -117) [ 31.980211][ T3517] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.003755][ T3532] netlink: 256 bytes leftover after parsing attributes in process `syz.4.25'. [ 32.034588][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.278326][ T3559] random: crng reseeded on system resumption [ 32.293255][ T3560] loop0: detected capacity change from 0 to 512 [ 32.310146][ T3560] EXT4-fs warning (device loop0): ext4_enable_quotas:7168: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 32.340084][ T3560] EXT4-fs (loop0): mount failed [ 32.374348][ T3567] loop4: detected capacity change from 0 to 512 [ 32.427004][ T3567] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.501853][ T3567] EXT4-fs (loop4): shut down requested (1) [ 32.532567][ T3567] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 32.559001][ T3567] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 32.584314][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.602355][ T3587] loop3: detected capacity change from 0 to 512 [ 32.609541][ T3587] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 32.622742][ T3587] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 32.654620][ T3587] EXT4-fs (loop3): 1 truncate cleaned up [ 32.666574][ T3587] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.732194][ T3595] loop4: detected capacity change from 0 to 1764 [ 32.733259][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.882202][ T3606] loop4: detected capacity change from 0 to 2048 [ 32.930687][ T3545] loop4: p1 < > p4 [ 32.951036][ T3545] loop4: p4 size 8388608 extends beyond EOD, truncated [ 33.003979][ T3606] loop4: p1 < > p4 [ 33.039178][ T3295] udevd[3295]: failed to send result of seq 7469 to main daemon: Connection refused [ 33.039702][ T3606] loop4: p4 size 8388608 extends beyond EOD, truncated [ 33.049957][ T3538] udevd[3538]: failed to send result of seq 7470 to main daemon: Transport endpoint is not connected [ 33.069241][ T3545] udevd[3545]: failed to send result of seq 7460 to main daemon: Transport endpoint is not connected [ 33.132888][ T3629] loop3: detected capacity change from 0 to 512 [ 33.145984][ T3632] netlink: 16 bytes leftover after parsing attributes in process `syz.1.68'. [ 33.169154][ T3629] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 33.188408][ T3637] loop1: detected capacity change from 0 to 512 [ 33.212836][ T3637] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a846e02c, mo2=0002] [ 33.221995][ T3637] System zones: 1-12 [ 33.226963][ T3629] EXT4-fs error (device loop3): ext4_orphan_get:1393: inode #15: comm syz.3.66: iget: bad i_size value: -67835469387268086 [ 33.247588][ T3637] EXT4-fs error (device loop1): dx_probe:791: inode #2: comm syz.1.71: Directory hole found for htree index block 0 [ 33.262529][ T3629] EXT4-fs error (device loop3): ext4_orphan_get:1398: comm syz.3.66: couldn't read orphan inode 15 (err -117) [ 33.283485][ T3629] EXT4-fs (loop3): mounted filesystem f7ff0000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 33.297531][ T3637] EXT4-fs (loop1): Remounting filesystem read-only [ 33.304211][ T3637] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -117 [ 33.313433][ T3629] ext2 filesystem being mounted at /11/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.325523][ T3637] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -117 [ 33.334505][ T3637] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.349699][ T3629] EXT4-fs error (device loop3): ext4_add_entry:2417: inode #2: comm syz.3.66: Directory hole found for htree leaf block 0 [ 33.355875][ T3637] EXT4-fs (loop1): shut down requested (1) [ 33.411969][ T3302] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.427628][ T3307] EXT4-fs (loop3): unmounting filesystem f7ff0000-0000-0000-0000-000000000000. [ 33.742672][ T3673] loop3: detected capacity change from 0 to 256 [ 33.765028][ T3673] ======================================================= [ 33.765028][ T3673] WARNING: The mand mount option has been deprecated and [ 33.765028][ T3673] and is ignored by this kernel. Remove the mand [ 33.765028][ T3673] option from the mount to silence this warning. [ 33.765028][ T3673] ======================================================= [ 33.853686][ T3673] FAT-fs (loop3): Directory bread(block 64) failed [ 33.862519][ T3673] FAT-fs (loop3): Directory bread(block 65) failed [ 33.875971][ T3673] FAT-fs (loop3): Directory bread(block 66) failed [ 33.890602][ T3673] FAT-fs (loop3): Directory bread(block 67) failed [ 33.904463][ T3673] FAT-fs (loop3): Directory bread(block 68) failed [ 33.920160][ T3673] FAT-fs (loop3): Directory bread(block 69) failed [ 33.934683][ T3673] FAT-fs (loop3): Directory bread(block 70) failed [ 33.949239][ T3673] FAT-fs (loop3): Directory bread(block 71) failed [ 33.963793][ T3673] FAT-fs (loop3): Directory bread(block 72) failed [ 33.981286][ T3673] FAT-fs (loop3): Directory bread(block 73) failed [ 34.011964][ T3373] kernel write not supported for file /vcsa1 (pid: 3373 comm: kworker/0:2) [ 34.029560][ T3673] process 'syz.3.81' launched './file0' with NULL argv: empty string added [ 34.053404][ T3673] syz.3.81: attempt to access beyond end of device [ 34.053404][ T3673] loop3: rw=524288, sector=1736, nr_sectors = 32 limit=256 [ 34.068950][ T3673] syz.3.81: attempt to access beyond end of device [ 34.068950][ T3673] loop3: rw=0, sector=1736, nr_sectors = 8 limit=256 [ 34.158521][ T3692] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 34.164921][ T3692] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 34.253885][ T3709] netlink: 132 bytes leftover after parsing attributes in process `syz.2.98'. [ 34.274698][ T3712] Invalid ELF header magic: != ELF [ 34.334601][ T3373] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 34.342067][ T3373] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 34.349598][ T3373] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 34.362221][ T3373] hid-generic 0003:0004:0000.0001: hidraw0: USB HID v0.00 Device [syz0] on syz1 [ 34.433762][ T3740] netlink: 12 bytes leftover after parsing attributes in process `syz.4.112'. [ 34.523366][ T3752] netlink: 4 bytes leftover after parsing attributes in process `syz.1.116'. [ 34.532446][ T3752] netlink: 4 bytes leftover after parsing attributes in process `syz.1.116'. [ 34.550181][ T3749] loop0: detected capacity change from 0 to 512 [ 34.557957][ T3752] netlink: 4 bytes leftover after parsing attributes in process `syz.1.116'. [ 34.567327][ T3749] ext4: Unknown parameter 'measure' [ 34.584078][ T3756] Driver unsupported XDP return value 0 on prog (id 66) dev N/A, expect packet loss! [ 34.702416][ T3772] netlink: 'syz.3.128': attribute type 3 has an invalid length. [ 34.745185][ T3774] netlink: 'syz.2.130': attribute type 2 has an invalid length. [ 34.871058][ T3798] loop0: detected capacity change from 0 to 1024 [ 34.887003][ T3798] EXT4-fs: Ignoring removed nobh option [ 34.890317][ T3806] loop4: detected capacity change from 0 to 512 [ 34.892661][ T3798] EXT4-fs: Ignoring removed bh option [ 34.917447][ T3808] loop2: detected capacity change from 0 to 2048 [ 34.919590][ C0] hrtimer: interrupt took 38128 ns [ 34.930370][ T3798] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 34.945783][ T3806] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 34.958897][ T3806] ext4 filesystem being mounted at /34/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.992540][ T3808] loop2: p2 p3 p7 [ 35.006027][ T3798] EXT4-fs error (device loop0): mb_free_blocks:1948: group 0, inode 15: block 241:freeing already freed block (bit 15); block bitmap corrupt. [ 35.028611][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.066286][ T3826] loop3: detected capacity change from 0 to 1024 [ 35.080991][ T3308] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.108505][ T3826] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.159113][ T3826] EXT4-fs error (device loop3): mb_free_blocks:1948: group 0, inode 18: block 305:freeing already freed block (bit 19); block bitmap corrupt. [ 35.307413][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.366549][ T3871] program syz.2.170 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 35.422322][ T3879] loop3: detected capacity change from 0 to 1024 [ 35.448389][ T3879] EXT4-fs: Ignoring removed orlov option [ 35.467137][ T3879] EXT4-fs (loop3): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 35.488088][ T3889] loop4: detected capacity change from 0 to 512 [ 35.499732][ T3889] EXT4-fs error (device loop4): ext4_iget_extra_inode:5035: inode #15: comm syz.4.179: corrupted in-inode xattr: invalid ea_ino [ 35.500255][ T3879] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.531132][ T3889] EXT4-fs error (device loop4): ext4_orphan_get:1398: comm syz.4.179: couldn't read orphan inode 15 (err -117) [ 35.549538][ T3896] loop2: detected capacity change from 0 to 128 [ 35.553566][ T3889] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.577917][ T3896] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 35.585771][ T3896] FAT-fs (loop2): Filesystem has been set read-only [ 35.598360][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.608361][ T3896] syz.2.181: attempt to access beyond end of device [ 35.608361][ T3896] loop2: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 35.612227][ T3879] EXT4-fs error (device loop3): ext4_find_dest_de:2052: inode #12: block 7: comm syz.3.174: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 35.642037][ T3879] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2848: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 35.655138][ T3896] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 35.663491][ T3896] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 35.672091][ T3896] syz.2.181: attempt to access beyond end of device [ 35.672091][ T3896] loop2: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 35.685417][ T3896] syz.2.181: attempt to access beyond end of device [ 35.685417][ T3896] loop2: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 35.699066][ T3896] syz.2.181: attempt to access beyond end of device [ 35.699066][ T3896] loop2: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 35.712833][ T3899] syz.2.181: attempt to access beyond end of device [ 35.712833][ T3899] loop2: rw=0, sector=2065, nr_sectors = 1 limit=128 [ 35.726154][ T3899] Buffer I/O error on dev loop2, logical block 2065, async page read [ 35.734423][ T3899] syz.2.181: attempt to access beyond end of device [ 35.734423][ T3899] loop2: rw=0, sector=2066, nr_sectors = 1 limit=128 [ 35.747942][ T3899] Buffer I/O error on dev loop2, logical block 2066, async page read [ 35.756617][ T3899] syz.2.181: attempt to access beyond end of device [ 35.756617][ T3899] loop2: rw=0, sector=2067, nr_sectors = 1 limit=128 [ 35.757730][ T3879] EXT4-fs error (device loop3): ext4_find_dest_de:2052: inode #12: block 7: comm syz.3.174: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 35.769845][ T3899] Buffer I/O error on dev loop2, logical block 2067, async page read [ 35.769907][ T3899] syz.2.181: attempt to access beyond end of device [ 35.769907][ T3899] loop2: rw=0, sector=2068, nr_sectors = 1 limit=128 [ 35.810722][ T3899] Buffer I/O error on dev loop2, logical block 2068, async page read [ 35.825260][ T3899] Buffer I/O error on dev loop2, logical block 2069, async page read [ 35.841383][ T3899] Buffer I/O error on dev loop2, logical block 2070, async page read [ 35.858659][ T3899] Buffer I/O error on dev loop2, logical block 2071, async page read [ 35.868327][ T3899] Buffer I/O error on dev loop2, logical block 2072, async page read [ 35.876706][ T3896] Buffer I/O error on dev loop2, logical block 2065, async page read [ 35.887831][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.898771][ T3896] Buffer I/O error on dev loop2, logical block 2066, async page read [ 35.955976][ T3909] loop3: detected capacity change from 0 to 1024 [ 36.200117][ T29] kauditd_printk_skb: 184 callbacks suppressed [ 36.200131][ T29] audit: type=1400 audit(1752714641.959:283): avc: denied { read write } for pid=3917 comm="syz.1.190" name="virtual_nci" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 36.230200][ T29] audit: type=1400 audit(1752714641.959:284): avc: denied { open } for pid=3917 comm="syz.1.190" path="/dev/virtual_nci" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 36.258873][ T3922] capability: warning: `syz.1.190' uses 32-bit capabilities (legacy support in use) [ 36.281942][ T3909] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 36.338481][ T3909] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 49 with max blocks 1 with error 28 [ 36.350812][ T3909] EXT4-fs (loop3): This should not happen!! Data will be lost [ 36.350812][ T3909] [ 36.360485][ T3909] EXT4-fs (loop3): Total free blocks count 0 [ 36.366531][ T3909] EXT4-fs (loop3): Free/Dirty block details [ 36.372455][ T3909] EXT4-fs (loop3): free_blocks=0 [ 36.377759][ T3909] EXT4-fs (loop3): dirty_blocks=0 [ 36.382821][ T3909] EXT4-fs (loop3): Block reservation details [ 36.389076][ T3909] EXT4-fs (loop3): i_reserved_data_blocks=0 [ 36.430163][ T3909] syz.3.186 (3909) used greatest stack depth: 9744 bytes left [ 36.451268][ T29] audit: type=1400 audit(1752714642.319:285): avc: denied { create } for pid=3927 comm="syz.1.191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.456545][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.488349][ T29] audit: type=1400 audit(1752714642.359:286): avc: denied { bind } for pid=3927 comm="syz.1.191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.541957][ T29] audit: type=1400 audit(1752714642.389:287): avc: denied { setopt } for pid=3927 comm="syz.1.191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.561915][ T29] audit: type=1400 audit(1752714642.409:288): avc: denied { bind } for pid=3933 comm="syz.0.194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 36.581128][ T29] audit: type=1400 audit(1752714642.409:289): avc: denied { node_bind } for pid=3933 comm="syz.0.194" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 36.601053][ T29] audit: type=1400 audit(1752714642.409:290): avc: denied { connect } for pid=3933 comm="syz.0.194" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 36.642084][ T3940] loop4: detected capacity change from 0 to 164 [ 36.649782][ T29] audit: type=1400 audit(1752714642.519:291): avc: denied { unmount } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 36.671563][ T3940] ISOFS: unable to read i-node block [ 36.677032][ T3940] ISOFS: root inode is unusable. Disabling Rock Ridge and switching to Joliet. [ 36.688614][ T3940] isofs_fill_super: get root inode failed [ 36.723967][ T3949] netlink: 132 bytes leftover after parsing attributes in process `syz.0.201'. [ 36.764121][ T29] audit: type=1400 audit(1752714642.629:292): avc: denied { ioctl } for pid=3955 comm="syz.4.205" path="socket:[5720]" dev="sockfs" ino=5720 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 36.787160][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.795844][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.803906][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.811361][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.818784][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.826278][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.833691][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.841223][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.848691][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.856305][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.863909][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.871390][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.879193][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.886606][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.894039][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.901626][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.909130][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.916601][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.924023][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.931438][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.938990][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.942231][ T3969] loop4: detected capacity change from 0 to 512 [ 36.946493][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.946518][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.960949][ T3969] EXT4-fs (loop4): warning: mounting unchecked fs, running e2fsck is recommended [ 36.967660][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.967684][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.979426][ T3969] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a002e01c, mo2=0006] [ 36.984177][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 36.991716][ T3969] System zones: [ 36.999563][ T3373] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 37.006963][ T3969] 0-2, 18-18, 34-35 [ 37.023111][ T3969] EXT4-fs (loop4): mounted filesystem 00000000-0700-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.041417][ T3373] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz0] on syz1 [ 37.066339][ T3969] EXT4-fs error (device loop4): ext4_readdir:264: inode #2: block 3: comm syz.4.209: path /51/file0: bad entry in directory: rec_len is smaller than minimal - offset=44, inode=0, rec_len=0, size=2048 fake=0 [ 37.100337][ T3977] loop3: detected capacity change from 0 to 512 [ 37.107832][ T3977] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 37.119093][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0700-0000-0000-000000000000. [ 37.134058][ T3977] EXT4-fs (loop3): 1 truncate cleaned up [ 37.140210][ T3977] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.157339][ T3977] EXT4-fs (loop3): shut down requested (0) [ 37.185109][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.290649][ T4006] loop3: detected capacity change from 0 to 512 [ 37.307662][ T4006] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.320383][ T4006] ext4 filesystem being mounted at /45/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 37.360025][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.470759][ T4024] loop4: detected capacity change from 0 to 2048 [ 37.539047][ T4024] loop4: p2 p3 p7 [ 37.719830][ T4057] loop2: detected capacity change from 0 to 512 [ 37.738875][ T4057] EXT4-fs error (device loop2): ext4_get_branch:178: inode #13: block 1024: comm syz.2.248: invalid block [ 37.770534][ T4057] EXT4-fs (loop2): Remounting filesystem read-only [ 37.794016][ T4057] EXT4-fs (loop2): 1 truncate cleaned up [ 37.800210][ T4068] loop1: detected capacity change from 0 to 512 [ 37.808160][ T4057] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.842860][ T3305] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.863858][ T4068] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.919487][ T3302] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.737958][ T4131] loop0: detected capacity change from 0 to 1024 [ 38.797090][ T4131] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 38.868523][ T4131] ext4 filesystem being mounted at /58/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 38.904267][ T4144] netlink: 60 bytes leftover after parsing attributes in process `syz.2.286'. [ 38.913525][ T4144] unsupported nlmsg_type 40 [ 39.074330][ T3308] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.276928][ T4163] loop1: detected capacity change from 0 to 256 [ 39.301766][ T4163] FAT-fs (loop1): Directory bread(block 64) failed [ 39.315829][ T4163] FAT-fs (loop1): Directory bread(block 65) failed [ 39.335985][ T4163] FAT-fs (loop1): Directory bread(block 66) failed [ 39.347171][ T4163] FAT-fs (loop1): Directory bread(block 67) failed [ 39.354372][ T4163] FAT-fs (loop1): Directory bread(block 68) failed [ 39.361097][ T4163] FAT-fs (loop1): Directory bread(block 69) failed [ 39.375973][ T4163] FAT-fs (loop1): Directory bread(block 70) failed [ 39.383644][ T4163] FAT-fs (loop1): Directory bread(block 71) failed [ 39.390326][ T4163] FAT-fs (loop1): Directory bread(block 72) failed [ 39.399799][ T4163] FAT-fs (loop1): Directory bread(block 73) failed [ 39.411489][ T4173] loop4: detected capacity change from 0 to 512 [ 39.427450][ T4173] EXT4-fs error (device loop4): ext4_acquire_dquot:6933: comm syz.4.298: Failed to acquire dquot type 1 [ 39.439448][ T4173] EXT4-fs (loop4): 1 truncate cleaned up [ 39.445524][ T4173] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.458054][ T4173] ext4 filesystem being mounted at /76/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.480636][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.518579][ T123] bio_check_eod: 54372 callbacks suppressed [ 39.518655][ T123] kworker/u8:5: attempt to access beyond end of device [ 39.518655][ T123] loop1: rw=1, sector=1224, nr_sectors = 4 limit=256 [ 39.567803][ T4185] SELinux: ebitmap: map size 0 does not match my size 64 (high bit was 0) [ 39.576619][ T4185] SELinux: failed to load policy [ 39.770351][ T4196] netlink: 16 bytes leftover after parsing attributes in process `syz.1.307'. [ 39.779360][ T4196] netlink: 16 bytes leftover after parsing attributes in process `syz.1.307'. [ 39.997729][ T4233] netlink: 8 bytes leftover after parsing attributes in process `syz.2.324'. [ 40.006951][ T4233] netlink: 8 bytes leftover after parsing attributes in process `syz.2.324'. [ 40.185965][ T4222] ================================================================== [ 40.194101][ T4222] BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked [ 40.201496][ T4222] [ 40.203828][ T4222] read-write to 0xffff88810695ffd8 of 8 bytes by task 123 on cpu 1: [ 40.211823][ T4222] __xa_clear_mark+0xf5/0x1e0 [ 40.216526][ T4222] __folio_end_writeback+0x177/0x470 [ 40.221829][ T4222] folio_end_writeback+0x71/0x3d0 [ 40.226893][ T4222] ext4_finish_bio+0x459/0x8c0 [ 40.231720][ T4222] ext4_release_io_end+0x9f/0x1f0 [ 40.236777][ T4222] ext4_end_io_end+0x18d/0x240 [ 40.241569][ T4222] ext4_end_io_rsv_work+0x151/0x1e0 [ 40.246808][ T4222] process_scheduled_works+0x4cb/0x9d0 [ 40.252299][ T4222] worker_thread+0x582/0x770 [ 40.256921][ T4222] kthread+0x489/0x510 [ 40.260996][ T4222] ret_from_fork+0xda/0x150 [ 40.265510][ T4222] ret_from_fork_asm+0x1a/0x30 [ 40.270285][ T4222] [ 40.272620][ T4222] read to 0xffff88810695ffd8 of 8 bytes by task 4222 on cpu 0: [ 40.280172][ T4222] xas_find_marked+0x218/0x620 [ 40.284940][ T4222] find_get_entry+0x5d/0x380 [ 40.289539][ T4222] filemap_get_folios_tag+0x13b/0x210 [ 40.294919][ T4222] filemap_fdatawait_keep_errors+0x6c/0x180 [ 40.300820][ T4222] sync_inodes_sb+0x39c/0x440 [ 40.305506][ T4222] sync_inodes_one_sb+0x3d/0x50 [ 40.310366][ T4222] __iterate_supers+0x10d/0x1f0 [ 40.315226][ T4222] iterate_supers+0x1f/0x30 [ 40.319741][ T4222] ksys_sync+0x5c/0xe0 [ 40.323818][ T4222] __ia32_sys_sync+0xe/0x20 [ 40.328330][ T4222] x64_sys_call+0x2e53/0x2fb0 [ 40.333026][ T4222] do_syscall_64+0xd2/0x200 [ 40.337545][ T4222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 40.343443][ T4222] [ 40.345767][ T4222] value changed: 0xffff800000000000 -> 0xfe00000000000000 [ 40.352883][ T4222] [ 40.355206][ T4222] Reported by Kernel Concurrency Sanitizer on: [ 40.361382][ T4222] CPU: 0 UID: 0 PID: 4222 Comm: syz.4.319 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(voluntary) [ 40.373724][ T4222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 40.383796][ T4222] ==================================================================