last executing test programs: 4.466843637s ago: executing program 1 (id=244): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x15, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="7daa000000000000711014000000000089a3d4ff0000000095"], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) setfsgid(0xee00) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$kcm(0x2, 0x1000000000000002, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) getsockopt$sock_timeval(r1, 0x1, 0x42, 0x0, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r4, 0x107, 0xa, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8982, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r3, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r5], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r3, {0xfff2}, {0xb}, {0xa, 0x1}}, [@TCA_RATE={0x6, 0x5, {0x3, 0x1}}]}, 0x2c}, 0x1, 0xf0ffffffffffff, 0x0, 0x4004140}, 0x0) 3.823098681s ago: executing program 2 (id=248): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000000085000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r4, 0x0, 0x9}, 0x18) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000840)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x97a3}, 0x18) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0x3) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) mprotect(&(0x7f00005eb000/0x3000)=nil, 0x3000, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="58000000020605000000000000000000000000000900020073797a3100000000050005000a000000050001000600000013000300686173683a6e65742c696661636500000c0007800800124005000000050004"], 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x800) 3.440835669s ago: executing program 1 (id=249): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x1ffffffffffffdf4, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00'}, 0x10) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000100)=0xffff0080) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="180100000100a7d9000000000020b200850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb904}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3}, 0x10) openat$snapshot(0xffffffffffffff9c, &(0x7f0000005c40), 0x403f, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000309000000000000004000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x40088c0}, 0x40) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) write$cgroup_int(r2, 0x0, 0xfffffffffffffe33) mmap$IORING_OFF_SQ_RING(&(0x7f00002b4000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000580), r2) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000640)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x24, r6, 0x6654280d7f8e55f3, 0x70bd2a, 0x25dfdbfc, {{}, {}, {0x8, 0x2, 0x1}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000980)='mm_page_free\x00', r1}, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 2.982680005s ago: executing program 0 (id=251): bpf$MAP_CREATE(0x0, 0x0, 0x48) openat$tun(0xffffffffffffff9c, 0x0, 0x7cc2958f3f13c549, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x3, 0x4, 0x4, 0x98, 0x0, 0x1}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x12, 0x5c, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa100000000000007010000b8ffffffb702000000000000b703000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, 0x94) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r0}, 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000400000000000000000000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000200008385000000710000001801000002696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000300)='kmem_cache_free\x00', r3}, 0x18) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={0xffffffffffffffff, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) sendmsg$inet(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000140)="9f", 0x1}], 0x1}, 0x3e8) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7020000111e6ca5b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940), 0x100000, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r5}, 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000000)='kmem_cache_free\x00', r6}, 0x18) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r4, 0xc0189374, &(0x7f0000001980)={{0x1, 0x1, 0x1018, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port1\x00', 0x62, 0x20c1b, 0x0, 0x8000007, 0x3, 0xfffffffe, 0x0, 0x0, 0x7cce8c743ee810dd}) 2.967844856s ago: executing program 2 (id=253): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r2, 0x0, 0x0) connect$inet(r2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x2, 0x0, 0x3, 0xfffffffffffffffd, 0x3, 0x8, 0x0, 0xe}, 0x0, &(0x7f0000000300)={0x3ff, 0x7e7, 0x0, 0x9, 0x4, 0x0, 0x7fffffff, 0x3f8}, 0x0, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x80000000, @loopback}, 0x1c) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f00000000c0)="e9", 0x1, 0x20008045, &(0x7f00000001c0)={0xa, 0x2, 0x1000, @empty}, 0x1c) shutdown(r0, 0x2) 2.895317743s ago: executing program 0 (id=255): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) syz_mount_image$iso9660(&(0x7f0000000500), &(0x7f0000000540)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="63727566742c6d61703d6e6f726d616c2c73657373696f6e3d3078303030303030303030303030303031362c636865636b3d72656c617865642c636865636b3d72656c617865642c004ebe02d83839c183098ea4c343c253a3817a1be99fce11d4eb199c8293a8e4edde99717f074b2f8657ce6ba6ad43223cc53c7956558e58c034cc0480ac8c6aa3dc369cd820bf5e83cbc56c0a80d15de24e02d679ed41f8c6c857ae056f277f0cf61fd89cdbf69e958ecb1fb37260f1579c4aa969bbd1f441590c9176efa1e5b98583b0ed66fdc6f1c3311d3033b260303cc6556bd6ce3d5e3c85b1d4cf3d35b7dbce8b8545f832c1346e6a0dd95ed6144444fba9592efe8559", @ANYRES8, @ANYRES32=0x0, @ANYRES64], 0x1, 0x53b, &(0x7f0000000ac0)="$eJzs3d9r2+YawPFHaUJSF8rhnEMpIWnfpudACqmPbLcpppwLTX7tvK0sGUkuyVUJjVNCnW40Gyy5Gb3pNtj+iN7ujxj7h8pud5chyW6dX1ZIUzuE78e072vpsd5HstGDYksSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAglluz7ZIlnvHbq+pkbi0MmkPm95d370AzZFwRK/knMzNyM5t089+fZt9I/luQuezZnMwkzYzsXbvxj8f/mpzov35IQiOxs7v3ar3b7bwZdyJj0tC+iQLTdBpamShQ1asislKPVN14OlqLYt1UbqidOAjVontPlarVitLFtaDtN2qOp/sTH90v2/ayelJsaSeMAv9/T4qRu2I8z/iNNCaZncQ8Sj6IT02sYu00ldrc6nYqeUkmQaXTBJXzgsp2uVwqlcul5YfVh49se/LIBPsQORIx/g8txuuc9+DA2U306r94YsSXtqyKOvbhSk1CCaR5wvyefv3/7/TwcQfrf7/K3/w0e1bS+n8re3brpPp/Qi6je+zIruzJK1mXrnSlI2/GntFoHw3R4ouRSAIx0hQnnaJ6U5RUZVmWxZbnsiJ1iURJXYx4oiWSNYkkFp1+olwJRYsjsQQSipJFceWeKCnJ/nRVKqJES1HWJJC2+NKQmjjpUjZlK93ulSE5fgwqnSaoPCSI+o/Pd+77cOCs9vv1HwAAAAAAXFpW+tf35Ph/SuZFpiypG0/b404LAAAAAACco/Sb/7mkmUp682Jx/A8AAAAAwGVjpefYWSJSkNtZr38mFH8EAAAAAADgkki//7+VNIWkd1ssjv8BAAAAALhsfupffXfi0DV2/0inWpZErWnr9z8lDKest63V/1jbTjLD2b6Sve7K4SXG9Vnrem8habM82Xvm6jmrd/XLjxfB/NBrNvOu9W+dQwLyi9zJYu5sZO1Gf042SqFuPF10A+9xSRzn+kSsV+PvXm99L+nq/+w3r1uyudXtFF983d1Ic3mbLOXtdu8Cikeuozgkl29lPouZP36Np9ITMXrjFrJx7cH1n+i/cacf850sZDELhawtHFz/mWTMUvFxfz0OrX2WxfSMyGet+Tu5m8XcXbybNcdkUS6e9B70tkV5cPufaVucIotKXhaVvCyu/X9oFgAwLps5Vcg6WvjPsK8dTXV/J4tZzOJsumOdnD1mj27n7dHtz6zrvx25B9LxNbaUjvtrMu4PstXtlNJx3ycveH/iuJFXtkQmRfa3v5EbO7t797e21192XnZel8uVZfuBbT8sy9Tm1mTHTppux6b2AACOkX+PndwI60HOUfU/P/6koCgvRP7a39+QpfRsg/QXB8cutTDwM4SlnKPWwsAdXpZyjuoKAzd6OX1sZQTvBAAAo7OQU4dPU/+Xco67D9by4UfHg7UcAAB8GTr8YBXiH60wNK3npWq15MQrWoWB+1SFptbQyvixDt0Vx29o1QqDOHADL+k8MzUdqajdagVhrOpBqFpBZFbTO7+r3q3fI910/Ni4UcvTTqSVG/ix48aqZiJXtdpfeSZa0WH64qilXVM3rhObwFdR0A5dXVQq0nog0NS0H5u6Sbq+aoWm6YRr6lngtZta1XTkhqYVB9kC+2MZvx6EzXSxxXFvbAAALoid3b1X691u580X7Ix7HQEAwEFUaQAAAAAAAAAAAAAAAAAAAAAALr78E/iujuQcwYvVmb4YaYy7M3Ex0sg6M4Mf2wuQz7l1LLkQaRzujG+fBGA0/g4AAP//CXJN1A==") r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1}, &(0x7f0000000240), &(0x7f0000000280)=r2}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001c00)=@base={0xb, 0x5, 0x7, 0x9, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000980)='mm_page_free\x00', r4}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000f00)={0xffffffffffffffff, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xa}, 0x50) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) r5 = eventfd2(0x0, 0x0) io_setup(0x81, &(0x7f0000000400)=0x0) sched_setscheduler(0x0, 0x5, &(0x7f0000000200)) io_submit(r6, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x3f, 0x1, 0x1fb, r5, 0x0, 0x0, 0x0, 0x0, 0x1, r5}]) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="0100"/13, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe, 0xd}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0, 0x0}, &(0x7f00000004c0)=0xc) setregid(r7, r8) 2.894764743s ago: executing program 2 (id=256): bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRES32=0x0], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r3], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='kfree\x00', r4, 0x0, 0x10000001}, 0x18) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x34, r5, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x0) sendmsg$SMC_PNETID_DEL(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r5, 0xe27, 0x70bd28, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000}, 0x4000) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000024000000080000000b"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r7}, &(0x7f0000000340), &(0x7f0000000380)=r0}, 0x20) recvmsg$unix(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000200)=""/122, 0x7a}], 0x1, 0x0, 0x7a}, 0x0) sendmmsg$unix(r1, &(0x7f0000001dc0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}}], 0x1, 0x24048080) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x589b}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x40042, 0x84) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r8 = gettid() timer_create(0x0, &(0x7f0000000180)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)) futex(&(0x7f000000cffc)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r9, &(0x7f0000000000), 0x208e24b) 2.553551557s ago: executing program 4 (id=258): socket$netlink(0x10, 0x3, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x281442, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f00000000c0)=ANY=[@ANYBLOB="23000300"], 0x8) r1 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x8800, 0x0) ioctl$TCSETSW2(r1, 0x5453, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000a00)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], &(0x7f0000000240)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2, 0x0, 0xffffffffffff8001}, 0x18) syz_mount_image$ext4(&(0x7f0000000b80)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x1a00404, &(0x7f0000000080)={[{@grpquota}, {@nomblk_io_submit}]}, 0x1, 0xbac, &(0x7f00000017c0)="$eJzs3M1rXOUaAPDnnEy+c5v0crn3tggGpCqK07QpFbpqXYsKunDZmExKyPTDJIIJXaR1ry5EXBSkf4Lg3m5cCS7qQutfUMQiRTdtFyNnPtKxk5nGdGaOSX8/eHPe97wn8zxPTmfOe2BOA3hqTWc/0ohDEXE2iZis708jYqjaG4nYrB13/+7l+awlUam8/VsSSUTcu3t5vvFaSX07Xh+MRMTN15L490etcVfXN5bnyuXSSn18dO38paOr6xuvLJ2fO1c6V7pwYvbVE7MnZ2e7WOvtS+998cwPbzx/9frHM29+fuC7JE7HRH2uuY5umY7prb9Js0JEzHU7WE4G6vU015kUckwIAICO0qY13H9jMgbi4eJtMr79MdfkAAAAgK6oDERUAAAAgH0ucf8PAAAA+1zjewD37l6eb7R8v5HQX3fORMRUrf7G8821mUJsVrcjMRgRY78n0fxYa1L7tSc2nUX6+vtS1qJHzyF3snklIv6/3flPqvVPVZ/ibq0/jYiZLsSffmS8l+o/3YX4edcPwNPpxpnahaz1+pdurX9im+tfYZtr127kff1rrP/ut6z/HtY/0Gb999YOYxx+8NLNdnPN6793P/l5IYufbZ+oqL/hzpWIw4Xt6k+26k/a1H92hzHG529fazeX1Z/V22j9rr9yPeJIdTXXWn9D0un/Jzq6uFQuzdR+bvP66yc7x28+/1nL4jfuBfohO/9jsbvzf2mHMab+9+uhdnOPrz/9ZSh5p9obqu/5cG5tbeVYxFDyeuv+451zaRzTeI2s/hef6/z+367+7DNhs/53yP71XKlvs/HVR2KOHzn+1e7r762s/oVdnv9Pdxjjy2+uvd9uLu/6AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANgb0oiYiCQtbvXTtFiMGI+I/8RYWr64uvby4sUPLixkcxFTMZguLpVLMxExWRsn2fhYtf9wfPyR8WxEHIyIzyZHq+Pi/MXyQt7FAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsGU8IiYiSYsRkUbEH5NpWizmnRUAAADQdVN5JwAAAAD0nPt/AAAA2P9a7v8LfxmN9DMXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9qWDz964lUTE5qnRassM1ecGc80M6LV0Z4eN9ToPoP8G8k4AyE2hqV+pVCo5pgL0mXt8IHnM/EjbmeGu5wIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAP9cLh27cSiJi89RotWWG6nODuWYG9FqadwJAbgY6TSaP3QHsYYW8EwBy4x4fqK3sH1RqWudH2v7m8BNHBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGDvmKi2JC1GRFrtp2mxGPGviJiKwWRxqVyaiYgDEfHT5OBwNj6Wd9IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB03er6xvJcuVxa0dHR6WJnNPoWa7T+Zm5zzHD7qQ6dnD+YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADIxer6xvJcuVxaWc07EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACBvq+sby3Plcmmlh528awQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID9/BgAA///GyAmy") r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x42, 0x0) pwrite64(r3, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) lseek(r3, 0x5, 0x4) r4 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x24, 0x1, 0x0, 0x0, 0x0, 0x7, 0x1f0519, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x3}, 0x6025, 0x4005, 0xb, 0x3, 0x2, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$perf(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x4000011, r5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x26, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, @perf_config_ext={0x8, 0x6}, 0x120, 0x10000, 0x33f8, 0x1, 0x8, 0x20007, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, r5, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x13, &(0x7f0000000080)=ANY=[], 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x800400, &(0x7f00000009c0)={[{@quota}]}, 0x1, 0x4f3, &(0x7f0000000a00)="$eJzs3c9rXFsdAPDvnSRt0uY5eeri+cD3iq+SFu1M0tg2uCgVxF1BrfsYkkkImWRCZtI2oZQU/wBBRBeuXLkR/AME6cZ9EQq6FxGl2FYXLtSRO3PHxnQmGV4nM+3k84HTe+6P3O/3dDq399x7yAng1LoQEbciYiQiLkdEPtuey0rsN0t63MsXD5bSkkS9fudvSSTZtta5kmx5Pvux8Yj4bnJgxwHV3b31xXK5tJ2tF2sbW8Xq7t6VtY3F1dJqaXNubvb6/I35a/MzPWvrzW/++Sc//MW3bv7mq/f+uPDXSw/TtCazfQfb0UvNpo81/i5aRiNi+ySCDcBI1p6xLo8/e8L5AABwtPQe/7MR8aXG/X8+Rhp3cwAAAMAwqScR/0oi6gAAAMDQyjXGwCa5QjYWYDJyuUKhOYb383EuV65Ua19ZqexsLjfHyk7FWG5lrVyaycYKT8VYkq7PNuqv1q8eWp+LiPcj4sf5iWTlbJQKS5Xy8qAffgAAAMApcf5Q//8f+Wb/HwAAABgyU4NOAAAAADhx+v8AAAAw/Dr2/xOTAQAAAMAQ+Pbt22mpt+a/Xr67u7NeuXtluVRdL2zsLBWWKttbhdVKZbVcKixVNo47X7lS2fpabO7cL9ZK1Vqxuru3sFHZ2awtNOb1Xih1O080AAAA0Dvvf/z4D0lE7H99olFSZ7J9+uow3HLHHzJxoJ6cZC5Af40MOgFgYD7dAF/DgmEYHNfHf16v9ykTYFCO69iPd9rxpPe5AAAAJ2P6C53f/wPDrYv3/23c6nkeQP95/w+nlzf5cHoZ4w+82ft/g4QAAOBdMNkoSa6QvQucjFyuUIh4rzEtwFiyslYuzUTEZyLi9/mxs+n67KCTBgAAAAAAAAAAAAAAAAAAAAAAAIB3TL2eRP2wM69vAgAAAN5dEbm/JNn8X9P5i5OHnw+cSf6Zbywj4t7P7vz0/mKttj2bbn+efzVrWLb9at8fXwAAAACp3/7/aquf3urHAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAP1ZPmcunliwdL/Qz87BsRMRWRxm2V5p7RGG8sx2MsIs79PYnRAz+X5jvSg/j7jyLig3bxkzStmMqyOBw/FxETA45/vgfx4TR7nF5/brX7/uXiQmPZ/vs3mpU39exCp+tf7n/Xv5EO17/3uozx4dNfFTvGfxTx4Wj7608rftIh/iddxv/+9/b2Ou2r/zxiOtrHPxirWNvYKlZ3966sbSyullZLm3Nzs9fnb8xfm58prqyVS9mfbWP86Iu//s9R7T/XIf7UMe2/2GX7//30/ovPvbb14dVW/EuftP/8Pzgifvpv4svZ/wPp/ulWfb9ZP+ijX/7uo6Pav9yh/cd9/pe6bP/l7/zgT10eCgD0QXV3b32xXC5tH1l5Escf079K6z7kbcknvRdKKzf7F7T16KGXZ/44Pd+JJj8Rb8XnpdJNZYAXJQAA4ES8uukfdCYAAAAAAAAAAAAAAAAAAABwevXj14kNuo0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN34bwAAAP//tfDGOw==") sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="58000000100000000000000000000000050000030500010007"], 0x58}, 0x1, 0x0, 0x0, 0x8040}, 0x4004010) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000200)) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xfd13ad03441c30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.552667627s ago: executing program 1 (id=269): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x1ffffffffffffdf4, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00'}, 0x10) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000100)=0xffff0080) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="180100000100a7d9000000000020b200850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb904}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3}, 0x10) openat$snapshot(0xffffffffffffff9c, &(0x7f0000005c40), 0x403f, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000309000000000000004000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x40088c0}, 0x40) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) write$cgroup_int(r2, 0x0, 0xfffffffffffffe33) mmap$IORING_OFF_SQ_RING(&(0x7f00002b4000/0x4000)=nil, 0x4000, 0x3, 0x10, r2, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000580), r2) sendmsg$TIPC_CMD_SET_NETID(r3, &(0x7f0000000640)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x24, r6, 0x6654280d7f8e55f3, 0x70bd2a, 0x25dfdbfc, {{}, {}, {0x8, 0x2, 0x1}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000980)='mm_page_free\x00', r1}, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 2.265981246s ago: executing program 0 (id=262): ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0xfffffffe, 0xc5, &(0x7f0000000000)={0x5, 0x14, 0x2008, 0x1, 0x200}, 0x8, 0x7, 0x200, 0x0, 0x7987, 0x0, 0x0}) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x0) keyctl$clear(0x11, 0xfffffffffffffffd) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r2}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7b13000000000000280012800900010076657468"], 0x48}}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = open(0x0, 0x145142, 0x0) ftruncate(r4, 0x2007ffc) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) bpf$PROG_LOAD(0x5, &(0x7f0000019200)={0x11, 0xd, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$setregs(0xd, r5, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r5, 0x2, &(0x7f0000000380)={0x0}) keyctl$set_reqkey_keyring(0xe, 0x3) 2.128579259s ago: executing program 1 (id=263): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x5}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb0e, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x5, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x400, 0x2, 0x1, {0x22, 0x8}}, {{{0x9, 0x5, 0x81, 0x3, 0x20}}}}}]}}]}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000007c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x4, [@fwd={0x2}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x2}}]}, {0x0, [0x61, 0x61]}}, 0x0, 0x50}, 0x28) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r3, r1}, 0x14) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, &(0x7f0000000000), &(0x7f0000000040)=r3}, 0x20) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000740)='scsi_dispatch_cmd_start\x00', r6}, 0x10) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000003c0)=0x11) ioctl$TIOCVHANGUP(r4, 0x5437, 0x2) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r7 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r7, 0x0, 0x18, &(0x7f0000000080)=0x200, 0x4) bind$inet6(r7, &(0x7f00000000c0)={0xa, 0x0, 0x2, @empty, 0x9}, 0x19) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_QUANTUM={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48801}, 0x0) ioctl$sock_inet6_SIOCADDRT(r7, 0x890b, &(0x7f0000000100)={@mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4, 0x3, 0x2, 0x100, 0x8, 0x4900000, r9}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) 2.108799761s ago: executing program 0 (id=264): socket$igmp(0x2, 0x3, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000011c0), 0x2401, 0x0) write$P9_RWALK(r2, 0x0, 0x30) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc0ffb}]}) brk(0x1) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000001180)=ANY=[@ANYBLOB="10236d3f00000001"], 0x8) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x1ffa, 0x0) acct(&(0x7f0000000140)='./file0\x00') r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'macsec0\x00'}) r5 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r5, 0x0, 0x10, &(0x7f0000001500)={{{@in6=@private1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={""/10, ""/2, @dev}}, 0x0, @in6=@private2}}, &(0x7f0000004580)=0xe8) quotactl_fd$Q_GETNEXTQUOTA(r5, 0xffffffff80000901, r6, &(0x7f0000001600)) ioprio_set$uid(0x0, r6, 0x4007) 2.060229346s ago: executing program 4 (id=265): r0 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000280)="ca", &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, 0x0, &(0x7f0000000000)=""/6, 0x2}, 0x20) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x48000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="54000000020605000000000000000000000000000900020073797a3200000000050084000100000005000100060000000c0007800800134000000000050005000a000000100003810000"], 0x54}}, 0x0) add_key$fscrypt_v1(&(0x7f0000001000), &(0x7f0000001040)={'fscrypt:', @auto=[0x3a, 0x66, 0x63, 0x35, 0x66, 0x39, 0x62, 0x36, 0x31, 0x31, 0x61, 0x30, 0x62, 0x39, 0x32, 0x32]}, &(0x7f0000001080)={0x0, "ddbccf094c5457df7a3f7457a4e81d59f6bffca5bf7c026c91255969954a3cec19ae878c0ca3fce72e29df4e4dbd001eb127ffbed6cc47890c19c3edc50daa56", 0x26}, 0x48, 0xfffffffffffffffe) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x2, 0x80, 0x2, 0x4, 0x2, 0x5, 0x0, 0x6, 0x2400, 0x13, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_config_ext={0x10000, 0xab}, 0x0, 0x3, 0x3, 0x2, 0x5, 0x6, 0x1, 0x0, 0x284c, 0x0, 0x2}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xe3, 0x7, 0x7, 0x10, 0x0, 0x7, 0x1002, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0xf, 0x1, @perf_config_ext={0x9, 0x8000}, 0x1000d, 0x0, 0xd5, 0x6, 0x8000, 0x6473, 0x8000, 0x0, 0xffffffc0}, 0x0, 0x80000000000002, r4, 0xa) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x3, {{0xa, 0x0, 0x0, @mcast2, 0x7}}, {{0xa, 0x0, 0x6df, @empty, 0x5}}}, 0x108) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="300000001000010800000000fcff000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004004400000008001b00"], 0x30}}, 0x0) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCSETSW(r6, 0x5403, &(0x7f0000000080)={0x8132, 0x800005, 0xfffffffe, 0x2e69a, 0x7, "001221d608f5000004b5450080c90a808000"}) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000000)=0x6) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r8}, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000700)={0x0, @rand_addr, @empty}, &(0x7f0000000740)=0xc) 2.034709308s ago: executing program 2 (id=266): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x1c, &(0x7f00000002c0)=[@in6={0xa, 0x4e24, 0x9, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7177}]}, &(0x7f0000000180)=0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x25, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0, 0x4}, 0x100b28, 0x6, 0x80000007, 0x1, 0x8, 0x20005, 0x1b, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0xf1a, 0x4) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4f25, 0x1, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b70300000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002abd7000fcdbdf2501000000000000000b000000000600147379"], 0x28}, 0x1, 0x0, 0x0, 0x890}, 0x800) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r4 = io_uring_setup(0x1962, &(0x7f0000000100)={0x0, 0x0, 0x100, 0x0, 0x214}) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000", @ANYRES16=r6, @ANYBLOB='ya\x00\x00\x00\x00\x00\x00\x00\x00~'], 0x14}}, 0x4000054) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001300)={&(0x7f00000012c0)='jbd2_shrink_scan_exit\x00', 0xffffffffffffffff, 0x0, 0x2}, 0x18) clock_nanosleep(0x9, 0x0, &(0x7f0000000080)={0x0, 0x3938700}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getpeername(r7, &(0x7f0000000180)=@can, &(0x7f0000000200)=0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000), &(0x7f0000000080)=0x4) 1.958191386s ago: executing program 3 (id=267): bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x8, 0x0, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$smc(0x0, 0xffffffffffffffff) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) mkdir(&(0x7f0000000580)='./file0\x00', 0x92) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f00000000c0)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000000)='system_u:object_r:restorecond_exec_t:s0\x00', 0x28, 0x3) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) getdents64(0xffffffffffffffff, &(0x7f0000000f80)=""/4096, 0x1000) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b00000000000000000000000080000000", @ANYRES32, @ANYBLOB='\x00'/19, @ANYRES32=0x0, @ANYBLOB='\x00'/16], 0x50) socket$inet(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)=ANY=[], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000000)={'bridge0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001f80)=@newtaction={0x4a0, 0x30, 0xffff, 0x70bd27, 0x0, {}, [{0x48c, 0x1, [@m_police={0x440, 0x1, 0x0, 0x0, {{0xb}, {0x414, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0xb32b, 0x2, 0x6, 0x0, 0x7, 0x81, 0x6, 0x9, 0x6, 0x7, 0x3, 0x0, 0x100, 0x10000, 0x7, 0x4, 0x8001, 0x80000000, 0x9, 0xe813, 0x6, 0x1, 0xeb6, 0xe2f, 0x7, 0x8, 0x32c6, 0x9, 0x3, 0x3, 0x7, 0x9, 0x4, 0x5, 0x0, 0x1ff, 0x3, 0x7f, 0x4001ff, 0xfb7, 0x8, 0x9, 0x7fff, 0x8, 0x6, 0x200, 0x4, 0x2, 0xe6a7, 0x3, 0x5, 0x5, 0x2, 0x9, 0x8, 0x4, 0xfffffffe, 0x8, 0x2, 0x4, 0x6, 0xffff, 0x71, 0x0, 0x72, 0x0, 0xfffffe00, 0x1ff, 0x5f5, 0xfa, 0x80, 0xc64f, 0xd0, 0x0, 0x9, 0x1000, 0x8, 0x42, 0x4, 0x5, 0x9, 0x1, 0x0, 0x3cba, 0x3, 0x9, 0xffff, 0x5, 0x8, 0x0, 0x592e62ea, 0xfffffffb, 0x3, 0x7f, 0x0, 0x5, 0x7, 0x0, 0x26f4, 0x1000, 0x3000000, 0x4, 0x3, 0x7, 0x1d, 0x9, 0x2, 0x5, 0x4, 0x1, 0x1064, 0x9, 0x1, 0x3, 0x4, 0x6, 0xb, 0x401, 0x9, 0x9, 0x40, 0x5, 0x8, 0xe427, 0x0, 0x0, 0x7, 0x0, 0xfffffff7, 0x80, 0x8000, 0xfffffff5, 0x10001, 0x0, 0xb069, 0xfffffff4, 0x1, 0xed10, 0x5, 0x8, 0xb6f2, 0x4, 0xf, 0x9, 0x8, 0x3bcb7c2d, 0x7, 0x12db, 0x7, 0x6, 0x4, 0x0, 0x9, 0x0, 0x40, 0x3, 0x400009, 0x80000000, 0x9, 0x6, 0x1, 0xffffffff, 0x8, 0x410, 0x6f, 0x2, 0x9, 0x4, 0x3, 0x7, 0xe4a, 0xffffff69, 0x10, 0xfffffffa, 0xb, 0xffff, 0x0, 0x8, 0x4, 0x5, 0x6e, 0x0, 0x0, 0x1a63aaaf, 0x1, 0x2, 0x40, 0xff, 0x2, 0x7, 0x7, 0x5e4, 0x5, 0x100, 0x8, 0x8, 0x1, 0xffff4471, 0xf, 0x8, 0x9, 0x2b46, 0x6b0d, 0x9, 0xfffffff8, 0x6, 0xa, 0x4, 0x80, 0x9, 0x8484, 0xa7, 0xa, 0x1, 0x7, 0x0, 0x40, 0x7969, 0x9, 0x6, 0xc, 0x8000, 0x5, 0x6, 0x1ff, 0xc58, 0x9, 0xdd2f, 0x86bb, 0x1, 0x7fffffff, 0x603, 0x0, 0x58f, 0x3, 0x81, 0x80, 0x0, 0x8, 0x4, 0x401, 0xe, 0xc13, 0x10000, 0xeefc, 0x80, 0x1, 0xa, 0xc, 0xf648, 0x10, 0x5, 0x5, 0x7, 0x7, 0x1]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}]]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x1, 0x0, 0x7ff}}]}, {0x4}, {0xc, 0x3}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x4a0}}, 0x4) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001b40)=@newtfilter={0x54, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x28, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4}]}}]}}]}, 0x54}}, 0x24040084) 1.777645034s ago: executing program 4 (id=268): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x4, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1b, 0xc, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180)="0b03feff4f00021202004788aa96a13bb1000011000088ca1a00", 0x1fffc, 0x0, &(0x7f0000000140)={0x11, 0x0, r6}, 0x14) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000440)={r0, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x18, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x5}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xe093}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xf20}}]}, &(0x7f0000000100)='syzkaller\x00', 0x1, 0x7d, &(0x7f0000000340)=""/125, 0x0, 0x47, '\x00', r6, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000002c0)={0x7, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000640)=[r0, r0, r7, r0, r0, r0, r0, r8], &(0x7f0000000680)=[{0x1, 0x2, 0xb, 0x4}], 0x10, 0x1}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r9}, 0x61) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x34, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.692102612s ago: executing program 3 (id=270): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0xc8df, 0xc000, 0xa, 0x20002f7}) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000002000000000000000100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000085000000b700000000000000950000000000000078c8f5adbf3afa1823fe3fa4307b78204ba9c1788b7d3827bfc7062f72d6d7f4ab161e02014ceefdcadcc5dfe181c3f26135206070d2f94a19ad2168ba60d7a425d04d43f12691a634f91a1889bcf47570f1e16dd77c6b25fa900000000000000000"], &(0x7f0000000080)='GPL\x00', 0x6, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x10c) preadv2(r3, &(0x7f0000000080), 0x0, 0x8, 0x7, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={0x0}, 0x18) r4 = syz_clone(0x0, 0x0, 0x9, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x40000000, 0x0) ptrace(0x10, r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r6, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0xfffc, 0x2fd, 0x1, 0x101}}) r7 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf32(r7, &(0x7f00000008c0)={{0x7f, 0x45, 0x4c, 0x46, 0x4, 0x7, 0x0, 0x3, 0x7, 0x2, 0x3, 0x3, 0x309, 0x38, 0xfffffffc, 0xe, 0x0, 0x20, 0x1, 0x5}, [{0x3, 0x8, 0xf3, 0x7f, 0x4, 0x200004, 0xc, 0x400}]}, 0x58) close(r7) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) getsockopt$inet_mreqsrc(r3, 0x0, 0x28, 0x0, &(0x7f0000000340)) r8 = getgid() fremovexattr(r5, &(0x7f0000000080)=@random={'user.', 'quota'}) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x21c91c, &(0x7f0000000440)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x800000}}, {@noblock_validity}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x200000}}, {@jqfmt_vfsold}, {@noinit_itable}, {@quota}, {@noauto_da_alloc}, {@sysvgroups}, {@resgid={'resgid', 0x3d, r8}, 0x32}]}, 0x1, 0x4e0, &(0x7f0000001a40)="$eJzs3d9rW9cdAPDvla0sP5zZYXvIAsvCkmGHLZIdL4nZQ7bB2J4C27L3zLNlYyxbxpKT2ITNYX/AYIy10Kc+9aXQP6BQ8ieUQqB9L21pKW3SPhTaRkVXUuI4UuwQWUqtzweOdO7Rvfqeo4uO7rn3cBVA3zoVEacj4kG1Wj0bEcON8kwjxWY91da7f+/WTC0lUa1e/SyJSOpltdXGtrznkcZmByPir3+K+EfyZNzy+sbidLFYWG0s5ytLK/ny+sa5haXp+cJ8YXlycuLi1KWpC1PjHWnnUERc/sNH///Pa3+8/Navbrx/7ZOxfyaN8ohH7ei0etOz6WfRNBgRq3sRrEcG0xYCAPB90DzO/3lEnI3hGEiP5gAAAID9pPrbofgmiagCAAAA+1YmnQObZHKNeQBDkcnkcvU5vD+Ow5liqVz55VxpbXm2Pld2JLKZuYViYbwxV3gksklteSLNP1o+v215MiKORcT/hg+ly7mZUnG21yc/AAAAoE8c2Tb+/3K4Pv7f4uueVQ4AAADonJFeVwAAAADYc8b/AAAAsP8Z/wMAAMC+9ucrV2qp2vz/69nr62uLpevnZgvlxdzS2kxuprS6kpsvlebTe/Yt7fR+xVJp5dexvHYzXymUK/ny+sa1pdLacuXawmN/gQ0AAAB00bGf3XkviYjN3xxKU82BXlcK6IrBZ1n5w72rB9B9A72uANAzz/T7D+wr2V5XAOi5ZIfX207eebvzdQEAAPbG6E9aX/8f2PHcwGamS1UE9ojzf9C/XP+H/uX6P/SvbAyEgTz0t51uAfr81/+r1WeqEAAA0HFDaUoyuYj0PMBQZDK5XMTRdEyQTeYWioXxiPhhRLw7nP1BbXki3TLZcc4wAAAAAAAAAAAAAAAAAAAAAAAAAFBXrSZRBQAAAPa1iMzHSXo3/4jR4TND288PHEi+Gk6fI+LGK1dfujldqaxO1Mo/f1heeblRfr4XZzAAAACA7Zrj9OY4HgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA66f69WzPN1M24n/4+IkZaxR+Mg+nzwchGxOEvkhjcsl0SEQMdiL95OyKOt4qf1KoVI41atIp/qMfxj3QgPvSzO7X+53etvn+ZOJU+t/7+XUx7qOfXvv/LPOz/BlrEr5Ud3WWME3ffyLeNfzvixGDr/qcZP2nT/5zeZfy//21jo91r1VcjRlv+/iSPxcpXllby5fWNcwtL0/OF+cLy5OTExalLUxemxvNzC8VC47FljP/+9M0HT2v/4TbxR3Zo/5ldtv/buzfv/aiezT7cPHkUf+x06/1/vE38TGP//6KRr70+2sxv1vNbnXz9nZNPa/9sm/bvtP/Hdtn+s3/59we7XBUA6ILy+sbidLFYWO3rzHN9GrXDoheiFS9mpva5vgDVaJn51x68c+3IvNft6kSmp90SAACwB54cAwMAAAAAAAAAAAAAAAAAAADd1o3biWW3xdxMHztx93wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgM75LgAA///6fNJN") sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000900)=ANY=[@ANYBLOB="2c0000003f00070dfeffffff00000000017c0000040077000c0003"], 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0x4044000) 1.480975213s ago: executing program 4 (id=271): getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, 0x0, 0x0) r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e1d, 0x1, @mcast1={0xff, 0x5}, 0x8}, 0x7a) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r4}, 0x18) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='\v\x00\x00\x00\a\x00\x00\x00\b\x00\x00\x00'], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000001000000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r7, 0x0, 0x10007ffffffff}, 0x18) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[], 0x98}, 0x1, 0x7}, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f00000002c0), &(0x7f00000004c0)={[&(0x7f0000000300)='\'\x00', &(0x7f0000000340)='GPL\x00']}) getrusage(0x0, &(0x7f0000000040)) r9 = socket$inet(0x2, 0x2, 0x0) ioctl$F2FS_IOC_RESIZE_FS(r5, 0x4008f510, &(0x7f0000000500)=0x3) setsockopt$inet_mreqn(r9, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) setsockopt$inet_msfilter(r9, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e00000027f0000010000000003"], 0x1c) r10 = socket$netlink(0x10, 0x3, 0x0) writev(r10, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 1.430992058s ago: executing program 1 (id=272): ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0xfffffffe, 0xc5, &(0x7f0000000000)={0x5, 0x14, 0x2008, 0x1, 0x200}, 0x8, 0x7, 0x200, 0x0, 0x7987, 0x0, 0x0}) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x0) keyctl$clear(0x11, 0xfffffffffffffffd) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r2}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7b13000000000000280012800900010076657468"], 0x48}}, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = open(0x0, 0x145142, 0x0) ftruncate(r4, 0x2007ffc) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) bpf$PROG_LOAD(0x5, &(0x7f0000019200)={0x11, 0xd, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$getregset(0x4205, r5, 0x2, &(0x7f0000000380)={0x0}) keyctl$set_reqkey_keyring(0xe, 0x3) request_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)=')\x00', 0x0) 1.269365184s ago: executing program 1 (id=273): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r2 = gettid() bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) readv(r3, &(0x7f0000001340)=[{&(0x7f0000000580)=""/148, 0x94}], 0x1) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0) ioctl$sock_bt_hci(r5, 0x800448d3, &(0x7f0000000040)) readv(r3, &(0x7f0000000100)=[{&(0x7f00000002c0)=""/215, 0xd7}], 0x1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}}, 0x0) 1.268297624s ago: executing program 4 (id=274): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYRES64], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0xc, &(0x7f0000000280)=ANY=[], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000180)='kfree\x00', r2, 0x0, 0x2}, 0x18) syz_clone(0xe50c1700, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x103302) ioctl$SG_IO(r3, 0x2285, &(0x7f00000005c0)={0x53, 0x20, 0x6, 0x0, @scatter={0x1, 0x3, &(0x7f00000006c0)=[{&(0x7f0000000380)=""/204, 0xcc}]}, &(0x7f0000000240)="008d7acda0b2", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000680)=ANY=[@ANYBLOB="140100002900010000000000fcdbdf250401f2800c0018000bac0f00000000001400010000000000000000000000ffff7f00000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1600006cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a608004500ac1414bb0000000048957c6743291d737e2af9837ff66ca81695770bcd5a141b3a42a7f61ea289854ab248636c7fb1f98ee5556249b6de1fb2ed365cf48d6941cf0c1d3c4afe01d88f70f5ff181f7ed024f140efd56a389e1654b32cec7e74f1f99a0d755c7d8f9f0f5e98b9f32fbf85a19d90e9ba8955a02f87489e1774ceaa00fd8dfe80b8d742080f190e33560f42618227ca"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000380)={[{@min_batch_time={'min_batch_time', 0x3d, 0x9}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@data_err_ignore}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x1}}, {@data_err_ignore}, {@noblock_validity}, {@delalloc}, {@nomblk_io_submit}, {@orlov}, {@user_xattr}, {@nodioread_nolock}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x1, 0x572, &(0x7f0000000980)="$eJzs3c9rHOUbAPBnNkl/f79NoRQVkUAPVmo3TeKPCh7qUbRY0Htdkmko2XRLdlObWGh7sBcvUgSRFsS73j0W/wH/ioIWipSgBy+R2cwmabObbNNNdut+PjDhfXdm95lnZ95338k7ywbQt0ayP4WIlyPimyTicEQk+brByFeOrGy39Pj6ZLYksbz86Z9Jfbus3nitxvMO5pWXIuLXryJOFjbGrS4szpTK5XQur4/WZq+MVhcWT12aLU2n0+nl8YmJM29PjL/37jsdy/WN839//8n9D898fXzpu58fHrmTxNk4lK9bn8dzuLm+MhIj+XsyFGef2nCsA8F6SdLtHWBbBvJ2PhRZH3A4BvJWD/z33YiIZaBPJdo/9KnGOKBxbd+h6+AXxqMPVi6ANuY/uPK/kdhXvzY6sJQ8cWWUXe8OdyB+FuOXP+7dyZbo3P8hALZ081ZEnB4c3Nj/JXn/t32n29jm6Rj6P9g997Pxz5vNxj+F1fFPNBn/HGzSdrdj6/ZfeNiBMC1l47/3m45/Vyethgfy2v/qY76h5OKlcpr1bf+PiBMxtDerbzafc2bpwXKrdevHf9mSxW+MBfP9eDi498nnTJVqpefJeb1HtyJeaTr+TVaPf9Lk+Gfvx/k2YxxL773Wat3W+e+s5R8jXm96/NdmtJLN5ydH6+fDaOOs2Oiv28d+axW/2/lnx//A5vkPJ+vna6vPHuOHff+krdY9kX+s5j+wtkXz839P8lm9vCd/7FqpVpsbi9iTfLzx8fG15zbqje2z/E8c37z/a3b+74+Iz9vM//bRn15tK/8uHf+pZzr+z1548NGXd1vFb6//e6teOpE/0k7/1+4OPs97BwAAAAAAAL2mEBGHIikUV8uFQrG4cn/H0ThQKFeqtZMXK/OXp6L+XdnhGCo0ZroPr7sfYiy/H7ZRH3+qPhERRyLi24H99XpxslKe6nbyAAAAAAAAAAAAAAAAAAAA0CMOtvj+f+b3gW7vHbDj/OQ39K8t238nfukJ6Ek+/6F/af/Qv7R/6F9btv8bu7MfwO7z+Q/9S/uH/tVm+/9ip/cD2H0+/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCjzp87ly3LS4+vT2b1qasL8zOVq6em0upMcXZ+sjhZmbtSnK5UpstpcbIyu9XrlSuVK2PjMX9ttJZWa6PVhcULs5X5y7ULl2ZL0+mFdGhXsgIAAAAAAAAAAAAAAAAAAIAXS3VhcaZULqdzCgrbKgx28gXv7l85LXsgr14u3NqFWN3umQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgzb8BAAD//3XgNVw=") poll(&(0x7f0000b2c000)=[{}], 0x2c, 0xffffffffffbffff8) dup2(0xffffffffffffffff, 0xffffffffffffffff) r4 = syz_open_procfs(0x0, &(0x7f0000002140)='sched\x00') ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'veth1_to_bridge\x00', 0x200}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x6, 0x1c, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000200000000000000fdffff", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000036c3d58818120000", @ANYRES8, @ANYBLOB="000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000400000085000000060000001800000003c6d50f00000000050000008510000000000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0xca, &(0x7f0000000840)=""/202, 0x40f00, 0x0, '\x00', r6, 0x25, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000500)=[{0x2, 0x3, 0x1, 0xc}, {0x3, 0x3, 0xa, 0x7}, {0x0, 0x2, 0x0, 0x6}, {0x1, 0x5, 0x5, 0x7}, {0x5, 0x3, 0x9, 0x4}, {0x1, 0x2, 0x0, 0x2}, {0x5, 0x5, 0xa, 0xd}], 0x10, 0x101}, 0x94) preadv(r4, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/163, 0xa3}], 0x1, 0x0, 0x5) 1.235911668s ago: executing program 3 (id=275): socket$caif_stream(0x25, 0x1, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000100)=ANY=[], 0x18) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, 0x0, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a00000005000000020000000400000000000000", @ANYRES32, @ANYRES32, @ANYBLOB], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000300)='tlb_flush\x00', 0xffffffffffffffff, 0x0, 0x9}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x4, 0x0, &(0x7f0000000c40)='GPL\x00', 0x403, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf51c}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001811000000000000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000fcffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x21}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000130000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r3}, &(0x7f0000000280), &(0x7f00000002c0)=r4}, 0x20) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000540)='fib6_table_lookup\x00', r5}, 0x10) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7}, 0x4, 0x0, 0x0, 0x0, 0x3, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x89f1, &(0x7f0000000080)) 1.204480541s ago: executing program 0 (id=276): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=ANY=[@ANYBLOB="0500000004000000080000000b"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000080000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000480)='kfree\x00', r1, 0x0, 0x7fffffffffffffff}, 0x18) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet6(0xa, 0x80003, 0xff) write(0xffffffffffffffff, &(0x7f0000000040)="0600", 0x2) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0xffff) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000000000000b70000000000027400000000000000949b3a880900397b89460dde68cd5d7cc211759c85a0"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r4}, 0x18) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f000002eff0)={0x135, &(0x7f0000000000)=[{}]}, 0x10) setsockopt$inet6_int(r3, 0x29, 0x16, &(0x7f0000fcb000), 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x1a}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r6], 0x0}, 0x94) epoll_create(0x2) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r7}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) recvmsg$unix(r9, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0x33fe0}], 0x1}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 1.184627083s ago: executing program 3 (id=277): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000040000000000000000850000002300000095", @ANYRES64], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000380)='kfree\x00', r0}, 0x18) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc), 0x80, 0x0, 0x0, 0x0, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) write$cgroup_int(r1, &(0x7f0000000040)=0xfe8e, 0x12) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0xc369d000) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r4, 0x400, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) 967.948104ms ago: executing program 2 (id=278): syz_open_procfs(0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000300)={@dev={0xfe, 0x80, '\x00', 0xa}, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3, 0x0, 0x0, 0x280, 0x8, 0x4d2005e}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="746e69c008e2000008001b000000000008000d0001"], 0x30}}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x80, 0x0) close(r2) socket$nl_generic(0x10, 0x3, 0x10) shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ffa000/0x4000)=nil) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) readv(r0, &(0x7f0000001840)=[{&(0x7f0000000200)=""/24, 0x18}], 0x1) syz_mount_image$vfat(&(0x7f00000005c0), &(0x7f0000000180)='./file1\x00', 0x804800, &(0x7f0000000000)=ANY=[@ANYRES8=0x0, @ANYBLOB="6092034e5823f645654f6e8edfc3b8e1a948efb0d4b9a9d4c30f5dacb3c1a7ea2587d59165777f070017c2921e793ec5a1384e143b57bb832f14bb43afdef6cb4ed4960b6c732be46a927cdd8c57f93ee6c15401df91ebcbe4f9989843313ea9f243d4dc3d276b966b898100a620b69b543033b9b7bcd9069b9248fbdff46c4a49f094a61938776ce1a1d0f0c84cb7a84bf0b1e2ce5f38f95e11d5b1977ead80625337f66dc391089ab8573d008a4bd03f6f9f01406db632558ed25be4beecd844ac00e52f95c5dc96a1e4a25c80d56aebf6cb33914d6bc72a40bf2fc94efed2f941cf3e"], 0xf9, 0x1213, &(0x7f0000000600)="$eJzs3E9rXFUYB+A3Y2rS1PxRa7Vd6AtuxMWlycKVIEFSkAwotRFaQbg1Ex0yzpTcITAiVldu/Ryu3Ql+g2z8DO6y6bIL8UrvNG1SU4vQZMQ+z2Luyz3nxzkHhoEz3HP33/3xq+2tqtgqh9GamorWrYi8m5HRigOvr4+v12+sr7bba1czr6xeW34nMxfe+PXTb2Yi4twnPy/8MhN7S5/t31n5fe/C3sX9P6992a2yW2V/MMwybw4Gw/JmbyE3u9V2kflRr1NWnez2q87OofZObr0dEaMs+5vzc7d2OlWVZX+U251RDgc53Bll+UXZ7WdRFDk/FzzWmSd32fjpbl3XEXV9Jp6Puq7rszEX5+KFmI+F+C4iXoyX4uU4H6/EhXg1XouLTa/TmD4AAAAAAAAAAAAAAAAAAAA8O/7p/P9iLDn/DwAAAAAAAAAAAAAAAAAAAKfg4+s31lfb7bWrmbMRvR92N3Y3xtdx+9K9j1504nIsxh/RnP4fG9dXPmivXc7GUnzfu30/f3t347kmv3qQX25eJ3A/P920HeSXx/k8mp+JuXv5reg2+ZVYjPPHj79ybH423nrzUL6Ixfjt8xhELzabsR/mv13OfP/D9iP5S00/AAAA+D8o8oFj9+9F8bj2cf7B/vrJ/w88sr+ejkvTk107EdXo6+2y1evsNEXvoJj9252TK+IUx3q6RcSduilmjja1TmjQVkx8yYeKqf/GNBRPpzgbR+9M+peJ0/DwazDpmQAAAAAAAAAAAPBvnPBzhdNxzJNl701mqQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPzFDhwLAAAAAAjzt06jYwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCoAAP//qH3FUA==") sched_setscheduler(0x0, 0x5, &(0x7f0000000280)=0x800) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x90) getdents64(r3, &(0x7f0000000f80)=""/4096, 0x1000) fallocate(0xffffffffffffffff, 0x10, 0x800, 0x8000) r4 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0xffffffffffffff4d) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000200)={'veth1_vlan\x00', @broadcast}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x40000) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r5}, 0x10) syz_read_part_table(0x593, &(0x7f00000005c0)="$eJzs0r1LK2kUB+A3A5c0e4lcLli4hWCwigqx0CIpRGJIY0RcsbAWLLQQLCwkEq39+AcUv0BsxD6lGEEUYiUpxXpBsUmVZdfZxmplUdnleZrhPefMHF5+E/hPi8Lv7XY7EUJoJ9//9m+nhbFS98TI5FQIiTAbQij8+stfnUQ88fdXz+NzOT6XktnG/vXo82nHTc9dPX0Yxf1aFMJaCGHh4Sj1b+/G/99Z/jK1vrFU3FzJz98XVx8H5/oKXVuFxZ2hg1xlujM3E/9Ytehz9qcbw8e37fLT7vf+b/VGK3sVz2USH7Ofr/U2/72f1Wa1Nd57sjyQ+dG8qGzHub/IHwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+GBn+cvU+sZScXMlP39fXH0cnOsrdG0VFneGDnKV6c7cTPQ6V4s+Z3+6MXx82y4/7X7v/1ZvtLJX8Vwm8TH7+Vpv89/7WW1WW+O9J8sDmR/Ni8p2nPuL/AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAf6gwVuqeGJmcCiERZkMIo1HH0Z/1dvK1n4jnzuNnOa6XktnG/vXo82nHTc9dPX04EddrUQhrIYSFh6PUp1+Gd/sjAAD///tch0s=") 314.618919ms ago: executing program 3 (id=279): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0xe501, 0x3, 0x208, 0xb8, 0xa, 0x1000000, 0xb8, 0x0, 0x170, 0x230, 0x230, 0x170, 0x223, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3b9, 'syz0\x00'}}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3c0, 'syz0\x00', {0xffffffffffffffff}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x268) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(0xffffffffffffffff, 0x40a85321, &(0x7f00000004c0)={{0x80}, 'port0\x00', 0x8, 0x100c75, 0xffefffff, 0x4, 0x1ff, 0x0, 0x0, 0x0, 0x6}) fcntl$getownex(r0, 0x10, &(0x7f0000000280)={0x0, 0x0}) process_vm_readv(r1, &(0x7f0000000c00)=[{&(0x7f0000000580)=""/106, 0x6a}, {&(0x7f0000000740)=""/151, 0x97}, {&(0x7f0000000a40)=""/165, 0xa5}, {&(0x7f0000000b00)=""/86, 0x56}, {&(0x7f0000000b80)=""/91, 0x5b}], 0x5, &(0x7f0000001040)=[{&(0x7f0000000c80)=""/162, 0xa2}, {&(0x7f00000008c0)=""/63, 0x3f}, {&(0x7f0000000d40)=""/226, 0xe2}, {&(0x7f0000000e40)}, {&(0x7f0000000f40)=""/70, 0x46}, {&(0x7f0000000fc0)=""/74, 0x4a}], 0x6, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xd, 0xb, &(0x7f0000000180)=ANY=[@ANYRESHEX=r0], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x4008800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0a00000004000000080000000600000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000054cd3bf87b2d54366370f7319826171e6f23a553ef2a994fbf6eff41bcff90da273a184f070c4fd8610ad25d3d5ad0a702ef483e444e39e3036fdebceea26f2fe5bc2c5a80a3cbdd80e624f15d5a02336e2662e25bbdec26acbcff84c16ad0f11ec95852c4e210adf9072ccf3c096ca89bc1650ef6fc8a88cbff5fd5d83e85e5c34efa38c4ab40e0ddc2b462a28d8859ea733bffe71b6739769c9b32568b78142bca930d79a3dbc33bf8e360909b9808abb95bfa80b1f8aa7b9ddacdc584edb3779debc374432515e0"], 0x48) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x3, 0xc, &(0x7f0000000940)=ANY=[@ANYBLOB="180200000200000000000000000000008500000017000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007050000f8ffffffb702000008000000b70300000000000085000000d00000009500000000000000a7412b6a16697ad1a29ac164c59979defaeb6983596dcf934f8e3fd0cb9711551f1b20da7ef6ab8a8852bec84cc2731fabb50d585c0a33ed0bcfbb90818dc4dc101f471e9b26f903f36db32c9022a07e31bcb6d06cc97b9b27eaacc2fb59a832b6007a3bf953979c5591cbc1"], &(0x7f0000000040)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000700)="e0cdc1ed484aae0736d6b9547ed3", 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0xfe, 0x1, 0x7ffc0002}]}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0xb, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000080850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='kmem_cache_free\x00', r5}, 0x10) io_cancel(0x0, 0x0, 0x0) writev(r4, &(0x7f00000025c0)=[{&(0x7f0000000240)='4', 0x1}], 0x1) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000200)='./cgroup.cpu/cgroup.procs\x00', 0x2) lsetxattr$security_selinux(&(0x7f0000000900)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000000), &(0x7f0000000040)='system_u:object_r:netutils_exec_t:s0\x00', 0x25, 0x0) 304.6345ms ago: executing program 0 (id=289): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYRES64], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0xc, &(0x7f0000000280)=ANY=[], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000180)='kfree\x00', r2, 0x0, 0x2}, 0x18) syz_clone(0xe50c1700, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x103302) ioctl$SG_IO(r3, 0x2285, &(0x7f00000005c0)={0x53, 0x20, 0x6, 0x0, @scatter={0x1, 0x3, &(0x7f00000006c0)=[{&(0x7f0000000380)=""/204, 0xcc}]}, &(0x7f0000000240)="008d7acda0b2", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000680)=ANY=[@ANYBLOB="140100002900010000000000fcdbdf250401f2800c0018000bac0f00000000001400010000000000000000000000ffff7f00000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1600006cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a608004500ac1414bb0000000048957c6743291d737e2af9837ff66ca81695770bcd5a141b3a42a7f61ea289854ab248636c7fb1f98ee5556249b6de1fb2ed365cf48d6941cf0c1d3c4afe01d88f70f5ff181f7ed024f140efd56a389e1654b32cec7e74f1f99a0d755c7d8f9f0f5e98b9f32fbf85a19d90e9ba8955a02f87489e1774ceaa00fd8dfe80b8d742080f190e33560f42618227ca"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000000)='./file1\x00', 0x446, &(0x7f0000000380)={[{@min_batch_time={'min_batch_time', 0x3d, 0x9}}, {@journal_dev={'journal_dev', 0x3d, 0x1045}}, {@data_err_ignore}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x1}}, {@data_err_ignore}, {@noblock_validity}, {@delalloc}, {@nomblk_io_submit}, {@orlov}, {@user_xattr}, {@nodioread_nolock}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x1, 0x572, &(0x7f0000000980)="$eJzs3c9rHOUbAPBnNkl/f79NoRQVkUAPVmo3TeKPCh7qUbRY0Htdkmko2XRLdlObWGh7sBcvUgSRFsS73j0W/wH/ioIWipSgBy+R2cwmabObbNNNdut+PjDhfXdm95lnZ95338k7ywbQt0ayP4WIlyPimyTicEQk+brByFeOrGy39Pj6ZLYksbz86Z9Jfbus3nitxvMO5pWXIuLXryJOFjbGrS4szpTK5XQur4/WZq+MVhcWT12aLU2n0+nl8YmJM29PjL/37jsdy/WN839//8n9D898fXzpu58fHrmTxNk4lK9bn8dzuLm+MhIj+XsyFGef2nCsA8F6SdLtHWBbBvJ2PhRZH3A4BvJWD/z33YiIZaBPJdo/9KnGOKBxbd+h6+AXxqMPVi6ANuY/uPK/kdhXvzY6sJQ8cWWUXe8OdyB+FuOXP+7dyZbo3P8hALZ081ZEnB4c3Nj/JXn/t32n29jm6Rj6P9g997Pxz5vNxj+F1fFPNBn/HGzSdrdj6/ZfeNiBMC1l47/3m45/Vyethgfy2v/qY76h5OKlcpr1bf+PiBMxtDerbzafc2bpwXKrdevHf9mSxW+MBfP9eDi498nnTJVqpefJeb1HtyJeaTr+TVaPf9Lk+Gfvx/k2YxxL773Wat3W+e+s5R8jXm96/NdmtJLN5ydH6+fDaOOs2Oiv28d+axW/2/lnx//A5vkPJ+vna6vPHuOHff+krdY9kX+s5j+wtkXz839P8lm9vCd/7FqpVpsbi9iTfLzx8fG15zbqje2z/E8c37z/a3b+74+Iz9vM//bRn15tK/8uHf+pZzr+z1548NGXd1vFb6//e6teOpE/0k7/1+4OPs97BwAAAAAAAL2mEBGHIikUV8uFQrG4cn/H0ThQKFeqtZMXK/OXp6L+XdnhGCo0ZroPr7sfYiy/H7ZRH3+qPhERRyLi24H99XpxslKe6nbyAAAAAAAAAAAAAAAAAAAA0CMOtvj+f+b3gW7vHbDj/OQ39K8t238nfukJ6Ek+/6F/af/Qv7R/6F9btv8bu7MfwO7z+Q/9S/uH/tVm+/9ip/cD2H0+/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCjzp87ly3LS4+vT2b1qasL8zOVq6em0upMcXZ+sjhZmbtSnK5UpstpcbIyu9XrlSuVK2PjMX9ttJZWa6PVhcULs5X5y7ULl2ZL0+mFdGhXsgIAAAAAAAAAAAAAAAAAAIAXS3VhcaZULqdzCgrbKgx28gXv7l85LXsgr14u3NqFWN3umQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgzb8BAAD//3XgNVw=") poll(&(0x7f0000b2c000)=[{}], 0x2c, 0xffffffffffbffff8) dup2(0xffffffffffffffff, 0xffffffffffffffff) r4 = syz_open_procfs(0x0, &(0x7f0000002140)='sched\x00') ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'veth1_to_bridge\x00', 0x200}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x6, 0x1c, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000200000000000000fdffffff1811", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000036c3d58818120000", @ANYRES8, @ANYBLOB="000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000400000085000000060000001800000003c6d50f00000000050000008510000000000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0xca, &(0x7f0000000840)=""/202, 0x40f00, 0x0, '\x00', r6, 0x25, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000500)=[{0x2, 0x3, 0x1, 0xc}, {0x3, 0x3, 0xa, 0x7}, {0x0, 0x2, 0x0, 0x6}, {0x1, 0x5, 0x5, 0x7}, {0x5, 0x3, 0x9, 0x4}, {0x1, 0x2, 0x0, 0x2}, {0x5, 0x5, 0xa, 0xd}], 0x10, 0x101}, 0x94) preadv(r4, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/163, 0xa3}], 0x1, 0x0, 0x5) 303.96434ms ago: executing program 2 (id=280): r0 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000280)="ca", &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, 0x0, &(0x7f0000000000)=""/6, 0x2}, 0x20) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x48000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="54000000020605000000000000000000000000000900020073797a3200000000050084000100000005000100060000000c0007800800134000000000050005000a000000100003810000"], 0x54}}, 0x0) add_key$fscrypt_v1(&(0x7f0000001000), &(0x7f0000001040)={'fscrypt:', @auto=[0x3a, 0x66, 0x63, 0x35, 0x66, 0x39, 0x62, 0x36, 0x31, 0x31, 0x61, 0x30, 0x62, 0x39, 0x32, 0x32]}, &(0x7f0000001080)={0x0, "ddbccf094c5457df7a3f7457a4e81d59f6bffca5bf7c026c91255969954a3cec19ae878c0ca3fce72e29df4e4dbd001eb127ffbed6cc47890c19c3edc50daa56", 0x26}, 0x48, 0xfffffffffffffffe) r4 = perf_event_open$cgroup(&(0x7f0000000200)={0x2, 0x80, 0x2, 0x4, 0x2, 0x5, 0x0, 0x6, 0x2400, 0x13, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_config_ext={0x10000, 0xab}, 0x0, 0x3, 0x3, 0x2, 0x5, 0x6, 0x1, 0x0, 0x284c, 0x0, 0x2}, 0xffffffffffffffff, 0xf, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xe3, 0x7, 0x7, 0x10, 0x0, 0x7, 0x1002, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0xf, 0x1, @perf_config_ext={0x9, 0x8000}, 0x1000d, 0x0, 0xd5, 0x6, 0x8000, 0x6473, 0x8000, 0x0, 0xffffffc0}, 0x0, 0x80000000000002, r4, 0xa) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x3, {{0xa, 0x0, 0x0, @mcast2, 0x7}}, {{0xa, 0x0, 0x6df, @empty, 0x5}}}, 0x108) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="300000001000010800000000fcff000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004004400000008001b00"], 0x30}}, 0x0) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCSETSW(r6, 0x5403, &(0x7f0000000080)={0x8132, 0x800005, 0xfffffffe, 0x2e69a, 0x7, "001221d608f5000004b5450080c90a808000"}) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000000)=0x6) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r8}, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000700)={0x0, @rand_addr, @empty}, &(0x7f0000000740)=0xc) 303.50318ms ago: executing program 4 (id=281): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="03000000000000000000000000000000000000000000000009000000eea58c"], 0x50) ioctl$sock_ifreq(r0, 0x8937, &(0x7f0000000240)={'macvtap0\x00', @ifru_ivalue=0x8}) r1 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x5) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r3) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020025647a31000000000900010073797a3000000000080005400000001c"], 0xe8}, 0x1, 0x0, 0x0, 0x80845}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r5, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) connect$unix(r6, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) ioctl$TUNSETCARRIER(r2, 0x400454e2, &(0x7f0000000180)) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x35, &(0x7f0000000000)=ANY=[@ANYBLOB="120100003215124099043e10184e01020301090223000100000000090400000800000000082403010000000009", @ANYRES16], 0x0) 0s ago: executing program 3 (id=282): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a40), r0) unshare(0x22020600) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000240)='./file2\x00', 0x2000410, &(0x7f0000000000)={[{@bsdgroups}, {@jqfmt_vfsv1}]}, 0xc1, 0x7e9, &(0x7f00000017c0)="$eJzs3c1rHG8dAPDvbF42SauJIGh7CggaKN2YGlsFDxEPIlgo6Nk2bLahZpMt2U1pQqDpQfAiqHgQ9NKzL/UgePXlqv+EeJAW0TRYT7oys7t53d0kbXa3/fXzgck8M/PMPPPN88yzz+4MuwF8sKbTP7mIKxHxwyRisrk+iYiRLDUcsdDI93p3u5hOSdTr3/pnkuX57aWDYyXN+aXmwqcj4o/fi7iWO17qeHNeLq03U7O11Yez1c2t6w9WF5dLy6W1m3Pz8zduffHWzZN7val//2Xr8ssfff1zv14Yjk89/8GfkliIy81te7vbxbc8/AnTMd38n4yk/8IjvnbRhQ1YMugT4I2kl+ZQ4yqPKzEZQ1mqg7e9AAGAd8KTiKgDAB+Y5LTX/yFDBAD4aGl9DrC3u11sTYP9RKK//vHViBhrxN+6v9nYMty8ZzeW3Qed2EuO3BlJImLqAsqfjoif/+47v0yn6NF9SIB2dp425nu7+WP9f5L2f6OnHyHfccvnu+1Wb+w3fWy1/g/65/fp+OdLJ8d/V/cf6BnL/h4b/4zl21y7b+L06z/3osOuZ+ibTpeO/75y6Nm2g/Hf/kNrU0PNpY9lY76R5P6Dcint2z4eETMxkk+X57Ks7Z+Cmnn131edyj88/vvXj7/7i7T8dH6QI/diOB/1xnN5/8vG60uLtcWLiD2L/2nE1eF28Sf749/kSP0v7Ed6p+NRj1bNN778/Z91ypnGn8bbmk7G31v1ZxGfbVv/B3WZdH0+cTZrDrOtRtHGb/7204lO5R/Ufz6bp+W33gv0Q1r/E93jn0pT1c2tlcVyubRePX8Zf342+YdO2w63//bxZ+3/iLT9jybfztKtlvZ4sVZbn4sYTb55cv2Ng31by638afwzn2l//bdv/42+IH1PeG9/qbvhl6O/ah6qbfyZnU7x91Ya/9K56r9Lot7c59im569XhjqVf7b6n89SM801Z+n/TjnTt2jNAAAAAAAAAAAAAAAAAAAAAAAAAHB+uYi4HEmusJ/O5QqFxm94fzImcuVKtXbtfmVjbSmy38qeipFc66suJw99H+pc8/vwW8s3ji1/ISI+ERE/yY9ny4Vipbw06OABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoOnS0d//f5LOCoXGtr/nB312AEDPjA36BACAvvP6DwAfnvO9/o/37DwAgP459/v/etKbEwEA+ubMr//3enseAED/uP8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAj925fTud6v/Z3S6my0uPNjdWKo+uL5WqK4XVjWKhWFl/WFiuVJbLpUKxstrxQDuNWblSeTgfaxuPZ2ulam22url1d7WysVa7+2B1cbl0tzTSt8gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Oyqm1sri+VyaV2iS2K8NN45TxIRAz/D0xJpXV/kAYff0ZB3/jqSteuumWPqvWn8o13yJBdZ1vjxNYd7ifFBdE0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA74X/BwAA///YTBJy") r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x42) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r1, 0x8004587d, &(0x7f0000000080)={@id={0x2, 0x0, @auto="4cf2a36adc4bc2ebb4b811ea6fc55952"}}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000100)={0xffa1, 0x2007bb}) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) vmsplice(r5, &(0x7f0000000040)=[{&(0x7f0000000000)="e3", 0x1}], 0x1, 0x1) fcntl$setpipe(r4, 0x407, 0x176) vmsplice(r5, &(0x7f0000000480)=[{&(0x7f00000000c0)='{', 0x1}], 0x1, 0xd) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000003000010850000008600000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x23, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r7}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b0000008000000001000000ffff000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0xca, r8}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000005c0)={r8, &(0x7f0000000080), &(0x7f0000000140)=""/241}, 0x20) kernel console output (not intermixed with test programs): he problem. [ 29.742787][ T3319] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.760554][ T3316] hsr_slave_0: entered promiscuous mode [ 29.766640][ T3316] hsr_slave_1: entered promiscuous mode [ 29.772644][ T3316] debugfs: 'hsr0' already exists in 'hsr' [ 29.778379][ T3316] Cannot create hsr debugfs directory [ 29.797038][ T3322] hsr_slave_0: entered promiscuous mode [ 29.803012][ T3322] hsr_slave_1: entered promiscuous mode [ 29.808708][ T3322] debugfs: 'hsr0' already exists in 'hsr' [ 29.814461][ T3322] Cannot create hsr debugfs directory [ 29.834014][ T3324] hsr_slave_0: entered promiscuous mode [ 29.840097][ T3324] hsr_slave_1: entered promiscuous mode [ 29.845866][ T3324] debugfs: 'hsr0' already exists in 'hsr' [ 29.851694][ T3324] Cannot create hsr debugfs directory [ 29.879920][ T3319] hsr_slave_0: entered promiscuous mode [ 29.885960][ T3319] hsr_slave_1: entered promiscuous mode [ 29.891859][ T3319] debugfs: 'hsr0' already exists in 'hsr' [ 29.897566][ T3319] Cannot create hsr debugfs directory [ 30.074810][ T3316] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.083600][ T3316] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.094592][ T3316] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.103161][ T3316] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.124617][ T3315] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.133653][ T3315] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.142449][ T3315] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.154461][ T3315] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.188286][ T3322] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 30.198287][ T3322] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 30.206755][ T3322] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 30.216249][ T3322] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 30.250700][ T3315] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.269816][ T3324] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 30.279064][ T3324] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 30.300620][ T3315] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.308037][ T3324] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 30.319105][ T3316] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.328723][ T3324] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 30.345697][ T3319] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.355814][ T1709] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.362995][ T1709] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.372714][ T3319] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.381659][ T3319] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.396679][ T3316] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.403797][ T3319] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.423648][ T2248] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.430730][ T2248] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.439299][ T2248] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.446444][ T2248] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.478429][ T3322] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.487258][ T1709] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.494381][ T1709] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.508846][ T3322] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.553941][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.561010][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.577392][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.584471][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.618900][ T3324] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.634948][ T3315] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.646718][ T3324] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.657470][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.664607][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.678875][ T3319] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.690809][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.697986][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.726764][ T3319] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.740237][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.747340][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.763398][ T1709] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.770476][ T1709] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.781708][ T3322] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.791874][ T3316] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.829865][ T3315] veth0_vlan: entered promiscuous mode [ 30.847590][ T3319] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.873751][ T3315] veth1_vlan: entered promiscuous mode [ 30.919560][ T3324] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.939102][ T3315] veth0_macvtap: entered promiscuous mode [ 30.960100][ T3316] veth0_vlan: entered promiscuous mode [ 30.976766][ T3315] veth1_macvtap: entered promiscuous mode [ 30.997828][ T3316] veth1_vlan: entered promiscuous mode [ 31.012390][ T3319] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.023357][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.032061][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.040056][ T3322] veth0_vlan: entered promiscuous mode [ 31.058127][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.073527][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.082581][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.091599][ T3322] veth1_vlan: entered promiscuous mode [ 31.097412][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.110621][ T3316] veth0_macvtap: entered promiscuous mode [ 31.124443][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 31.124456][ T29] audit: type=1400 audit(1763312840.587:81): avc: denied { mounton } for pid=3315 comm="syz-executor" path="/root/syzkaller.KJAU44/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 31.125982][ T3316] veth1_macvtap: entered promiscuous mode [ 31.144854][ T29] audit: type=1400 audit(1763312840.587:82): avc: denied { mount } for pid=3315 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 31.175835][ T3322] veth0_macvtap: entered promiscuous mode [ 31.182296][ T29] audit: type=1400 audit(1763312840.607:83): avc: denied { mounton } for pid=3315 comm="syz-executor" path="/root/syzkaller.KJAU44/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 31.190406][ T3322] veth1_macvtap: entered promiscuous mode [ 31.213350][ T29] audit: type=1400 audit(1763312840.607:84): avc: denied { mount } for pid=3315 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 31.227940][ T3324] veth0_vlan: entered promiscuous mode [ 31.240615][ T29] audit: type=1400 audit(1763312840.607:85): avc: denied { mounton } for pid=3315 comm="syz-executor" path="/root/syzkaller.KJAU44/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 31.256770][ T3322] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.272849][ T29] audit: type=1400 audit(1763312840.607:86): avc: denied { mounton } for pid=3315 comm="syz-executor" path="/root/syzkaller.KJAU44/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3877 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 31.287221][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.307367][ T29] audit: type=1400 audit(1763312840.607:87): avc: denied { unmount } for pid=3315 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 31.337184][ T3322] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.351620][ T42] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.353182][ T29] audit: type=1400 audit(1763312840.807:88): avc: denied { mounton } for pid=3315 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 31.360526][ T42] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.383274][ T29] audit: type=1400 audit(1763312840.807:89): avc: denied { mount } for pid=3315 comm="syz-executor" name="/" dev="gadgetfs" ino=3879 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 31.416281][ T42] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.427294][ T3315] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.442901][ T3324] veth1_vlan: entered promiscuous mode [ 31.448828][ T42] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.458920][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.476766][ T3319] veth0_vlan: entered promiscuous mode [ 31.484937][ T29] audit: type=1400 audit(1763312840.947:90): avc: denied { read write } for pid=3315 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 31.524096][ T3324] veth0_macvtap: entered promiscuous mode [ 31.537420][ T31] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.548506][ T3324] veth1_macvtap: entered promiscuous mode [ 31.569202][ T3319] veth1_vlan: entered promiscuous mode [ 31.579691][ T3324] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.591195][ T31] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.613696][ T3324] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.628788][ T31] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.667672][ T31] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.697153][ T31] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.716284][ T3319] veth0_macvtap: entered promiscuous mode [ 31.742080][ T3493] loop4: detected capacity change from 0 to 128 [ 31.754884][ T31] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.760293][ T3493] syz.4.6: attempt to access beyond end of device [ 31.760293][ T3493] loop4: rw=2049, sector=138, nr_sectors = 8 limit=128 [ 31.764937][ T3319] veth1_macvtap: entered promiscuous mode [ 31.784401][ T3493] syz.4.6: attempt to access beyond end of device [ 31.784401][ T3493] loop4: rw=2049, sector=146, nr_sectors = 8 limit=128 [ 31.809799][ T31] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.814964][ T3493] syz.4.6: attempt to access beyond end of device [ 31.814964][ T3493] loop4: rw=2049, sector=152, nr_sectors = 2 limit=128 [ 31.830438][ T3319] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.831919][ T3493] Buffer I/O error on dev loop4, logical block 76, lost async page write [ 31.848352][ T31] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.886357][ T3499] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6'. [ 31.900588][ T3319] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.910520][ T3493] syz.4.6: attempt to access beyond end of device [ 31.910520][ T3493] loop4: rw=2049, sector=170, nr_sectors = 8 limit=128 [ 31.938699][ T3503] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6'. [ 31.952400][ T31] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.954662][ T3493] syz.4.6: attempt to access beyond end of device [ 31.954662][ T3493] loop4: rw=2049, sector=176, nr_sectors = 2 limit=128 [ 31.964652][ T31] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.974450][ T3493] Buffer I/O error on dev loop4, logical block 88, lost async page write [ 32.010825][ T3499] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6'. [ 32.022997][ T3493] syz.4.6: attempt to access beyond end of device [ 32.022997][ T3493] loop4: rw=2049, sector=178, nr_sectors = 8 limit=128 [ 32.031077][ C0] hrtimer: interrupt took 27762 ns [ 32.036579][ T3493] syz.4.6: attempt to access beyond end of device [ 32.036579][ T3493] loop4: rw=2049, sector=184, nr_sectors = 2 limit=128 [ 32.054453][ T3493] Buffer I/O error on dev loop4, logical block 92, lost async page write [ 32.054937][ T3498] atomic_op ffff88811a3d8d28 conn xmit_atomic 0000000000000000 [ 32.065980][ T3493] syz.4.6: attempt to access beyond end of device [ 32.065980][ T3493] loop4: rw=2049, sector=202, nr_sectors = 8 limit=128 [ 32.085425][ T3493] syz.4.6: attempt to access beyond end of device [ 32.085425][ T3493] loop4: rw=2049, sector=208, nr_sectors = 2 limit=128 [ 32.098629][ T3493] Buffer I/O error on dev loop4, logical block 104, lost async page write [ 32.146154][ T31] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.159077][ T3499] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6'. [ 32.179202][ T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.184122][ T3493] syz.4.6: attempt to access beyond end of device [ 32.184122][ T3493] loop4: rw=2049, sector=210, nr_sectors = 8 limit=128 [ 32.202214][ T3493] Buffer I/O error on dev loop4, logical block 108, lost async page write [ 32.212161][ T3493] Buffer I/O error on dev loop4, logical block 120, lost async page write [ 32.228253][ T3509] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 32.228254][ T3503] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6'. [ 32.263695][ T3493] Buffer I/O error on dev loop4, logical block 80, lost async page write [ 32.274054][ T3493] Buffer I/O error on dev loop4, logical block 84, lost async page write [ 32.284093][ T3493] Buffer I/O error on dev loop4, logical block 112, lost async page write [ 32.293343][ T3493] Buffer I/O error on dev loop4, logical block 116, lost async page write [ 32.340907][ T3503] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6'. [ 32.368855][ T3509] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 32.407043][ T3517] lo speed is unknown, defaulting to 1000 [ 32.417621][ T3517] lo speed is unknown, defaulting to 1000 [ 32.438335][ T3517] lo speed is unknown, defaulting to 1000 [ 32.454027][ T3520] loop2: detected capacity change from 0 to 764 [ 32.455344][ T3517] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 32.481881][ T3523] loop1: detected capacity change from 0 to 512 [ 32.511725][ T3517] infiniband s{z2: RDMA CMA: cma_listen_on_dev, error -98 [ 32.526635][ T3526] SELinux: Context system_u:object_r:netutils_exec_t:s0 is not valid (left unmapped). [ 32.539244][ T3520] rock: corrupted directory entry. extent=32, offset=2044, size=237 [ 32.584878][ T3517] lo speed is unknown, defaulting to 1000 [ 32.599872][ T3523] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.621661][ T3517] lo speed is unknown, defaulting to 1000 [ 32.628172][ T3517] lo speed is unknown, defaulting to 1000 [ 32.640951][ T3517] lo speed is unknown, defaulting to 1000 [ 32.654913][ T3535] loop3: detected capacity change from 0 to 1024 [ 32.661610][ T3517] lo speed is unknown, defaulting to 1000 [ 32.674457][ T3537] loop4: detected capacity change from 0 to 1024 [ 32.681658][ T3537] EXT4-fs: Ignoring removed nomblk_io_submit option [ 32.689168][ T3535] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 32.700112][ T3535] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 32.710786][ T3535] JBD2: no valid journal superblock found [ 32.716542][ T3535] EXT4-fs (loop3): Could not load journal inode [ 32.739043][ T3537] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.793922][ T3517] lo speed is unknown, defaulting to 1000 [ 32.806166][ T3517] lo speed is unknown, defaulting to 1000 [ 33.495424][ T3315] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.525197][ T3544] netlink: 12 bytes leftover after parsing attributes in process `syz.2.16'. [ 33.547405][ T3535] SELinux: security_context_str_to_sid (Ð-šXܘ7.H\¹ÿ %ºu@) failed with errno=-22 [ 33.760109][ T3535] IPv6: Can't replace route, no match found [ 33.854907][ T3550] loop1: detected capacity change from 0 to 512 [ 33.861679][ T3554] loop2: detected capacity change from 0 to 164 [ 33.867353][ T3552] ip6_vti0 speed is unknown, defaulting to 1000 [ 33.886789][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.911958][ T3552] ip6_vti0 speed is unknown, defaulting to 1000 [ 33.929577][ T3552] ip6_vti0 speed is unknown, defaulting to 1000 [ 33.957680][ T3550] ip6t_srh: unknown srh match flags 4000 [ 34.010917][ T3552] infiniband syz2: set active [ 34.015711][ T3552] infiniband syz2: added ip6_vti0 [ 34.020979][ T23] ip6_vti0 speed is unknown, defaulting to 1000 [ 34.025576][ T3557] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.052432][ T3552] RDS/IB: syz2: added [ 34.052521][ T3552] smc: adding ib device syz2 with port count 1 [ 34.063188][ T3552] smc: ib device syz2 port 1 has no pnetid [ 34.069459][ T23] ip6_vti0 speed is unknown, defaulting to 1000 [ 34.069755][ T3552] ip6_vti0 speed is unknown, defaulting to 1000 [ 34.082704][ T3557] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.091044][ T3558] serio: Serial port ptm0 [ 34.120364][ T3550] loop1: detected capacity change from 0 to 8192 [ 34.160324][ T3552] ip6_vti0 speed is unknown, defaulting to 1000 [ 34.192057][ T3550] loop1: p1 p2 p3 p4 [ 34.196245][ T3550] loop1: p1 size 196608 extends beyond EOD, truncated [ 34.215231][ T3552] ip6_vti0 speed is unknown, defaulting to 1000 [ 34.224061][ T3550] loop1: p2 start 164919041 is beyond EOD, truncated [ 34.230791][ T3550] loop1: p3 size 66846464 extends beyond EOD, truncated [ 34.241998][ T3550] loop1: p4 size 37048832 extends beyond EOD, truncated [ 34.255202][ T3552] ip6_vti0 speed is unknown, defaulting to 1000 [ 34.317618][ T3569] netlink: 4 bytes leftover after parsing attributes in process `syz.4.22'. [ 34.343229][ T3554] netlink: 'syz.2.19': attribute type 13 has an invalid length. [ 34.384030][ T3304] udevd[3304]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 34.394552][ T3309] udevd[3309]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 34.406626][ T3552] ip6_vti0 speed is unknown, defaulting to 1000 [ 34.425131][ T3554] gretap0: refused to change device tx_queue_len [ 34.425909][ T3554] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 34.791839][ T3577] mmap: syz.2.24 (3577) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 34.928547][ T3581] pimreg: entered allmulticast mode [ 34.944315][ T3581] pimreg: left allmulticast mode [ 35.085519][ T3552] syz.0.18 (3552) used greatest stack depth: 10432 bytes left [ 35.119889][ T3589] loop0: detected capacity change from 0 to 512 [ 35.131921][ T3589] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 35.172991][ T3589] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.28: couldn't read orphan inode 26 (err -116) [ 35.185201][ T3589] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.197931][ T3589] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 35.230551][ T3589] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #13: comm syz.0.28: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 35.268566][ T3319] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.300312][ T3569] syz.4.22 (3569) used greatest stack depth: 10016 bytes left [ 35.378578][ T3602] loop0: detected capacity change from 0 to 1024 [ 35.406749][ T3603] rdma_rxe: rxe_newlink: failed to add bond0 [ 35.428542][ T3602] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 35.439463][ T3602] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 35.473113][ T3606] loop1: detected capacity change from 0 to 512 [ 35.479859][ T3606] EXT4-fs: Ignoring removed oldalloc option [ 35.488367][ T3607] netlink: 8 bytes leftover after parsing attributes in process `syz.2.32'. [ 35.501201][ T3606] EXT4-fs: Mount option(s) incompatible with ext2 [ 35.578732][ T3602] JBD2: no valid journal superblock found [ 35.584635][ T3602] EXT4-fs (loop0): Could not load journal inode [ 35.661190][ T3609] SELinux: Context @ is not valid (left unmapped). [ 35.744689][ T3610] bridge0: port 3(erspan0) entered blocking state [ 35.751259][ T3610] bridge0: port 3(erspan0) entered disabled state [ 36.042267][ T3610] erspan0: entered allmulticast mode [ 36.093713][ T3610] erspan0: entered promiscuous mode [ 36.099434][ T3610] bridge0: port 3(erspan0) entered blocking state [ 36.105910][ T3610] bridge0: port 3(erspan0) entered forwarding state [ 36.116230][ T3630] netlink: 4 bytes leftover after parsing attributes in process `syz.3.36'. [ 36.129098][ T3615] bridge0: entered promiscuous mode [ 36.169195][ T3630] team0: Port device team_slave_1 removed [ 36.239168][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 36.276288][ T3635] tipc: Started in network mode [ 36.281791][ T3635] tipc: Node identity e0000001, cluster identity 4711 [ 36.289313][ T3635] tipc: Enabling of bearer rejected, failed to enable media [ 36.301423][ T29] kauditd_printk_skb: 545 callbacks suppressed [ 36.301438][ T29] audit: type=1400 audit(1763312845.767:636): avc: denied { map } for pid=3634 comm="syz.0.38" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4946 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 36.331501][ T29] audit: type=1400 audit(1763312845.767:637): avc: denied { read } for pid=3634 comm="syz.0.38" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4946 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 36.404008][ T3638] Zero length message leads to an empty skb [ 36.489085][ T29] audit: type=1400 audit(1763313101.938:638): avc: denied { create } for pid=3631 comm="syz.4.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 36.508321][ T29] audit: type=1400 audit(1763313101.938:639): avc: denied { ioctl } for pid=3631 comm="syz.4.37" path="socket:[5286]" dev="sockfs" ino=5286 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 36.527164][ T3643] loop0: detected capacity change from 0 to 512 [ 36.532877][ T29] audit: type=1400 audit(1763313101.938:640): avc: denied { bind } for pid=3631 comm="syz.4.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 36.631249][ T29] audit: type=1400 audit(1763313102.068:641): avc: denied { unlink } for pid=3316 comm="syz-executor" name="file0" dev="tmpfs" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 36.671945][ T3646] loop2: detected capacity change from 0 to 2048 [ 36.707196][ T3647] loop1: detected capacity change from 0 to 128 [ 36.867713][ T29] audit: type=1400 audit(1763313102.298:642): avc: denied { mount } for pid=3637 comm="syz.1.39" name="/" dev="loop1" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 37.049564][ T3643] EXT4-fs error (device loop0): ext4_get_branch:178: inode #13: block 1024: comm syz.0.38: invalid block [ 37.068096][ T29] audit: type=1400 audit(1763313102.358:643): avc: denied { write } for pid=3645 comm="syz.2.40" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4959 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 37.172364][ T3643] EXT4-fs (loop0): Remounting filesystem read-only [ 37.434388][ T3643] EXT4-fs (loop0): 1 truncate cleaned up [ 37.461948][ T3643] EXT4-fs (loop0): mounted filesystem 0000b300-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.596906][ T3653] Driver unsupported XDP return value 0 on prog (id 41) dev N/A, expect packet loss! [ 37.636482][ T3653] loop3: detected capacity change from 0 to 512 [ 37.646416][ T3646] loop2: p1 < > p4 [ 37.676227][ T3653] EXT4-fs: Ignoring removed bh option [ 37.700518][ T3646] loop2: p4 size 8388608 extends beyond EOD, truncated [ 37.712726][ T3653] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.761141][ T3653] ext4 filesystem being mounted at /9/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 37.771270][ T29] audit: type=1400 audit(1763313103.228:644): avc: denied { write } for pid=3645 comm="syz.2.40" lport=56 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 37.792966][ T3653] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #18: comm syz.3.41: corrupted inode contents [ 37.837851][ T3653] EXT4-fs error (device loop3): ext4_dirty_inode:6517: inode #18: comm syz.3.41: mark_inode_dirty error [ 37.849860][ T3653] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #18: comm syz.3.41: corrupted inode contents [ 37.861809][ T3653] EXT4-fs error (device loop3): ext4_xattr_delete_inode:2996: inode #18: comm syz.3.41: mark_inode_dirty error [ 37.911675][ T3653] EXT4-fs error (device loop3): ext4_xattr_delete_inode:2999: inode #18: comm syz.3.41: mark inode dirty (error -117) [ 37.950041][ T3657] netlink: 60 bytes leftover after parsing attributes in process `syz.3.41'. [ 37.984911][ T3657] IPVS: Unknown mcast interface: [ 38.006874][ T3653] EXT4-fs warning (device loop3): ext4_evict_inode:274: xattr delete (err -117) [ 38.054290][ T3304] udevd[3304]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 38.065347][ T3309] udevd[3309]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 38.180622][ T3659] /dev/nullb0: Can't lookup blockdev [ 38.191807][ T3324] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.203438][ T29] audit: type=1400 audit(1763313103.238:645): avc: denied { add_name } for pid=3652 comm="syz.3.41" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 38.233410][ T3659] loop2: detected capacity change from 0 to 1024 [ 38.252236][ T3319] EXT4-fs (loop0): unmounting filesystem 0000b300-0000-0000-0000-000000000000. [ 38.268296][ T3665] netlink: 20 bytes leftover after parsing attributes in process `syz.3.43'. [ 38.270946][ T3659] ======================================================= [ 38.270946][ T3659] WARNING: The mand mount option has been deprecated and [ 38.270946][ T3659] and is ignored by this kernel. Remove the mand [ 38.270946][ T3659] option from the mount to silence this warning. [ 38.270946][ T3659] ======================================================= [ 38.281150][ T3633] Bluetooth: hci0: command 0x1003 tx timeout [ 38.316939][ T3524] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 38.323102][ T3665] netlink: 'syz.3.43': attribute type 30 has an invalid length. [ 38.339619][ T3659] EXT4-fs: Ignoring removed oldalloc option [ 38.345667][ T3659] EXT4-fs: Ignoring removed bh option [ 38.351332][ T3664] loop1: detected capacity change from 0 to 512 [ 38.439798][ T3664] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=8856c01c, mo2=0002] [ 38.448235][ T3664] EXT4-fs (loop1): orphan cleanup on readonly fs [ 38.456315][ T3664] EXT4-fs error (device loop1): ext4_ext_check_inode:523: inode #13: comm syz.1.44: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 38.476327][ T3659] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.477891][ T3664] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.44: couldn't read orphan inode 13 (err -117) [ 38.502146][ T3664] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 38.544525][ T3664] EXT4-fs (loop1): warning: mounting fs with errors, running e2fsck is recommended [ 38.555033][ T3664] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=8856c01c, mo2=0002] [ 38.559482][ T3659] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:4193: comm syz.2.42: Allocating blocks 497-513 which overlap fs metadata [ 38.583074][ T3664] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 38.591608][ T3664] ext4 filesystem being remounted at /7/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 38.613077][ T3316] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.644928][ T3664] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.44: bg 0: block 248: padding at end of block bitmap is not set [ 38.664205][ T3664] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.44: Failed to acquire dquot type 1 [ 38.675637][ T3679] xt_connbytes: Forcing CT accounting to be enabled [ 38.685200][ T3679] Cannot find set identified by id 0 to match [ 38.711608][ T3664] syz.1.44 (3664) used greatest stack depth: 9472 bytes left [ 38.805361][ T3315] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.817028][ T3687] lo speed is unknown, defaulting to 1000 [ 38.836862][ T3687] ip6_vti0 speed is unknown, defaulting to 1000 [ 38.903490][ T3679] loop2: detected capacity change from 0 to 1024 [ 38.918076][ T3679] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 38.926610][ T3679] EXT4-fs (loop2): bad geometry: first data block is 0 with a 1k block and cluster size [ 38.948683][ T3691] netlink: 12 bytes leftover after parsing attributes in process `syz.1.48'. [ 39.380095][ T3697] netlink: 'syz.4.50': attribute type 10 has an invalid length. [ 39.383290][ T3695] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 39.388856][ T3697] bridge0: port 3(erspan0) entered disabled state [ 39.403834][ T3697] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.411005][ T3697] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.421953][ T3697] bridge0: port 3(erspan0) entered blocking state [ 39.428462][ T3697] bridge0: port 3(erspan0) entered forwarding state [ 39.430454][ T3698] netlink: 4 bytes leftover after parsing attributes in process `syz.4.50'. [ 39.435336][ T3697] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.451069][ T3697] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.458442][ T3697] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.465580][ T3697] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.474985][ T3697] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 39.484237][ T3698] erspan0: left allmulticast mode [ 39.489274][ T3698] erspan0: left promiscuous mode [ 39.494562][ T3698] bridge0: port 3(erspan0) entered disabled state [ 39.535739][ T3698] bridge_slave_1: left allmulticast mode [ 39.541457][ T3698] bridge_slave_1: left promiscuous mode [ 39.547244][ T3698] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.555008][ T3698] bridge_slave_0: left allmulticast mode [ 39.560647][ T3698] bridge_slave_0: left promiscuous mode [ 39.566572][ T3698] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.576688][ T3698] bond0: (slave bridge0): Releasing backup interface [ 39.590101][ T3704] loop2: detected capacity change from 0 to 512 [ 39.597478][ T3704] EXT4-fs: Ignoring removed oldalloc option [ 39.613735][ T3704] EXT4-fs error (device loop2): ext4_xattr_inode_iget:437: comm syz.2.51: Parent and EA inode have the same ino 15 [ 39.630372][ T3704] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2853: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 39.632038][ T3703] netlink: 16 bytes leftover after parsing attributes in process `syz.3.52'. [ 39.652704][ T3704] EXT4-fs error (device loop2): ext4_xattr_inode_iget:437: comm syz.2.51: Parent and EA inode have the same ino 15 [ 39.665344][ T3704] EXT4-fs (loop2): 1 orphan inode deleted [ 39.681444][ T3705] lo speed is unknown, defaulting to 1000 [ 39.687753][ T3704] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 39.700904][ T3704] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.710778][ T3705] ip6_vti0 speed is unknown, defaulting to 1000 [ 39.740100][ T3703] No such timeout policy "syz1" [ 39.770444][ T3714] netlink: 28 bytes leftover after parsing attributes in process `syz.1.53'. [ 39.779877][ T3714] netem: change failed [ 39.802058][ T3714] netlink: 'syz.1.53': attribute type 10 has an invalid length. [ 39.814441][ T3714] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 39.851673][ T3731] netlink: 12 bytes leftover after parsing attributes in process `syz.4.54'. [ 39.860483][ T3731] netlink: 28 bytes leftover after parsing attributes in process `syz.4.54'. [ 39.869298][ T3731] netlink: 12 bytes leftover after parsing attributes in process `syz.4.54'. [ 39.882696][ T3714] loop1: detected capacity change from 0 to 1024 [ 39.912723][ T3714] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 39.914548][ T3731] netlink: 28 bytes leftover after parsing attributes in process `syz.4.54'. [ 39.933855][ T3731] netlink: 'syz.4.54': attribute type 6 has an invalid length. [ 39.941525][ T3740] loop2: detected capacity change from 0 to 512 [ 39.951619][ T3740] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 39.998361][ T3740] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 214 vs 220 free clusters [ 40.022602][ T3740] EXT4-fs (loop2): 1 truncate cleaned up [ 40.039506][ T3740] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.103506][ T3315] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.294536][ T3760] netlink: 'syz.1.57': attribute type 3 has an invalid length. [ 40.304199][ T3760] netlink: 'syz.1.57': attribute type 3 has an invalid length. [ 40.395300][ T3772] netlink: 'syz.0.59': attribute type 39 has an invalid length. [ 40.445215][ T3774] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1018 sclass=netlink_route_socket pid=3774 comm=syz.1.60 [ 40.501904][ T3779] loop4: detected capacity change from 0 to 512 [ 40.512923][ T3779] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.61: bg 0: block 248: padding at end of block bitmap is not set [ 40.527413][ T3779] EXT4-fs error (device loop4): ext4_acquire_dquot:6945: comm syz.4.61: Failed to acquire dquot type 1 [ 40.539062][ T3779] EXT4-fs (loop4): 1 truncate cleaned up [ 40.545131][ T3779] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.557735][ T3779] ext4 filesystem being mounted at /12/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 40.579467][ T3779] syz.4.61 (3779) used greatest stack depth: 9120 bytes left [ 40.588329][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.686447][ T3316] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.721292][ T3788] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.782136][ T3789] tipc: Started in network mode [ 40.787003][ T3789] tipc: Node identity e20a2e18b677, cluster identity 4711 [ 40.794303][ T3789] tipc: Enabled bearer , priority 0 [ 40.805178][ T3788] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.815728][ T3786] loop4: detected capacity change from 0 to 32768 [ 40.823777][ T3789] tipc: Disabling bearer [ 40.866552][ T3309] loop4: p1 p2 p3 < > p4 < p5 p6 > [ 40.872814][ T3309] loop4: p1 start 460800 is beyond EOD, truncated [ 40.879280][ T3309] loop4: p2 size 83886080 extends beyond EOD, truncated [ 40.888899][ T3788] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.901002][ T3309] loop4: p5 start 460800 is beyond EOD, truncated [ 40.907478][ T3309] loop4: p6 size 83886080 extends beyond EOD, truncated [ 40.918129][ T3786] loop4: p1 p2 p3 < > p4 < p5 p6 > [ 40.924470][ T3786] loop4: p1 start 460800 is beyond EOD, truncated [ 40.930934][ T3786] loop4: p2 size 83886080 extends beyond EOD, truncated [ 40.939339][ T3786] loop4: p5 start 460800 is beyond EOD, truncated [ 40.945891][ T3786] loop4: p6 size 83886080 extends beyond EOD, truncated [ 40.974491][ T3788] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.031466][ T3309] udevd[3309]: inotify_add_watch(7, /dev/loop4p2, 10) failed: No such file or directory [ 41.031516][ T3304] udevd[3304]: inotify_add_watch(7, /dev/loop4p3, 10) failed: No such file or directory [ 41.052670][ T3572] udevd[3572]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 41.052793][ T3528] udevd[3528]: inotify_add_watch(7, /dev/loop4p6, 10) failed: No such file or directory [ 41.077516][ T3528] udevd[3528]: inotify_add_watch(7, /dev/loop4p6, 10) failed: No such file or directory [ 41.078631][ T3304] udevd[3304]: inotify_add_watch(7, /dev/loop4p3, 10) failed: No such file or directory [ 41.094201][ T12] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.097177][ T3572] udevd[3572]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 41.106599][ T3309] udevd[3309]: inotify_add_watch(7, /dev/loop4p2, 10) failed: No such file or directory [ 41.131204][ T12] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.146710][ T12] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.155032][ T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.245039][ T3801] netlink: zone id is out of range [ 41.250194][ T3801] netlink: zone id is out of range [ 41.255816][ T3801] netlink: zone id is out of range [ 41.293850][ T3801] netlink: zone id is out of range [ 41.299018][ T3801] netlink: zone id is out of range [ 41.304268][ T3801] netlink: zone id is out of range [ 41.334551][ T3805] loop4: detected capacity change from 0 to 512 [ 41.342071][ T3801] netlink: zone id is out of range [ 41.347479][ T3801] netlink: zone id is out of range [ 41.400024][ T3807] xt_TPROXY: Can be used only with -p tcp or -p udp [ 41.499024][ T3801] netlink: set zone limit has 8 unknown bytes [ 41.507220][ T3805] EXT4-fs: Ignoring removed orlov option [ 41.517253][ T29] kauditd_printk_skb: 1325 callbacks suppressed [ 41.517266][ T29] audit: type=1326 audit(1763313106.978:1967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3804 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fada202f6c9 code=0x7ffc0000 [ 41.590115][ T3806] loop0: detected capacity change from 0 to 1024 [ 41.603183][ T3808] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 41.614717][ T3808] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 41.637767][ T3808] loop2: detected capacity change from 0 to 1024 [ 41.645140][ T3808] EXT4-fs: Ignoring removed bh option [ 41.725149][ T3808] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-001000000000 r/w without journal. Quota mode: writeback. [ 41.755329][ T3806] EXT4-fs: Ignoring removed orlov option [ 41.840519][ T29] audit: type=1326 audit(1763313107.018:1968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3804 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fada202f6c9 code=0x7ffc0000 [ 41.863855][ T29] audit: type=1326 audit(1763313107.018:1969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3804 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fada202f6c9 code=0x7ffc0000 [ 41.887487][ T29] audit: type=1326 audit(1763313107.018:1970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3804 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fada202f6c9 code=0x7ffc0000 [ 41.910744][ T29] audit: type=1326 audit(1763313107.018:1971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3804 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fada202f6c9 code=0x7ffc0000 [ 41.934105][ T29] audit: type=1326 audit(1763313107.018:1972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3804 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=48 compat=0 ip=0x7fada202f6c9 code=0x7ffc0000 [ 41.957375][ T29] audit: type=1326 audit(1763313107.018:1973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3804 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fada202f6c9 code=0x7ffc0000 [ 41.980649][ T29] audit: type=1326 audit(1763313107.018:1974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3804 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fada202f6c9 code=0x7ffc0000 [ 42.004076][ T29] audit: type=1326 audit(1763313107.018:1975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3804 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7fada202f6c9 code=0x7ffc0000 [ 42.027301][ T29] audit: type=1326 audit(1763313107.018:1976): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3804 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fada202f703 code=0x7ffc0000 [ 42.046108][ T3812] loop1: detected capacity change from 0 to 4096 [ 42.106862][ T3812] EXT4-fs: Ignoring removed nomblk_io_submit option [ 42.124081][ T3806] ext4: Unknown parameter 'obj_type' [ 42.138264][ T3805] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 42.150914][ T3812] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.198219][ T3806] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.205507][ T3806] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.216727][ T3805] EXT4-fs error (device loop4): ext4_iget_extra_inode:5075: inode #15: comm syz.4.65: corrupted in-inode xattr: e_value size too large [ 42.267570][ T3805] EXT4-fs error (device loop4): ext4_orphan_get:1397: comm syz.4.65: couldn't read orphan inode 15 (err -117) [ 42.333232][ T3806] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 42.342053][ T3805] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.366375][ T3806] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 42.432873][ T1035] lo speed is unknown, defaulting to 1000 [ 42.432888][ T3404] ip6_vti0 speed is unknown, defaulting to 1000 [ 42.432913][ T3404] syz2: Port: 1 Link DOWN [ 42.432941][ T3404] ip6_vti0 speed is unknown, defaulting to 1000 [ 42.455973][ T1035] s{z2: Port: 1 Link DOWN [ 42.460636][ T1709] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.471385][ T1709] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.491187][ T1709] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.500260][ T1709] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.527400][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.566497][ T3315] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.595467][ T3825] bond0: (slave bond_slave_0): Releasing backup interface [ 42.625235][ T3825] bond0: (slave bond_slave_1): Releasing backup interface [ 42.638987][ T3828] loop1: detected capacity change from 0 to 736 [ 42.655609][ T3829] netlink: 'syz.4.71': attribute type 10 has an invalid length. [ 42.683643][ T3828] rock: directory entry would overflow storage [ 42.689842][ T3828] rock: sig=0x3b10, size=4, remaining=3 [ 42.696859][ T3825] team0: Port device team_slave_0 removed [ 42.714823][ T3825] team0: Port device team_slave_1 removed [ 42.722038][ T3825] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 42.729440][ T3825] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 42.772379][ T3825] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 42.779817][ T3825] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 42.813836][ T3825] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 42.835838][ T3830] sch_fq: defrate 4294967295 ignored. [ 42.957608][ T3839] __nla_validate_parse: 5 callbacks suppressed [ 42.957637][ T3839] netlink: 24 bytes leftover after parsing attributes in process `syz.1.73'. [ 42.981266][ T3840] netlink: 'syz.3.75': attribute type 6 has an invalid length. [ 43.023229][ T3843] loop1: detected capacity change from 0 to 128 [ 43.048059][ T3843] bio_check_eod: 16 callbacks suppressed [ 43.048130][ T3843] syz.1.76: attempt to access beyond end of device [ 43.048130][ T3843] loop1: rw=2049, sector=145, nr_sectors = 16 limit=128 [ 43.081465][ T3843] syz.1.76: attempt to access beyond end of device [ 43.081465][ T3843] loop1: rw=2049, sector=169, nr_sectors = 32 limit=128 [ 43.095778][ T3843] syz.1.76: attempt to access beyond end of device [ 43.095778][ T3843] loop1: rw=2049, sector=209, nr_sectors = 8 limit=128 [ 43.117195][ T3843] syz.1.76: attempt to access beyond end of device [ 43.117195][ T3843] loop1: rw=2049, sector=225, nr_sectors = 8 limit=128 [ 43.145410][ T3843] syz.1.76: attempt to access beyond end of device [ 43.145410][ T3843] loop1: rw=2049, sector=241, nr_sectors = 8 limit=128 [ 43.168664][ T3843] syz.1.76: attempt to access beyond end of device [ 43.168664][ T3843] loop1: rw=2049, sector=257, nr_sectors = 8 limit=128 [ 43.185301][ T3845] loop4: detected capacity change from 0 to 512 [ 43.196501][ T3845] EXT4-fs (loop4): orphan cleanup on readonly fs [ 43.203509][ T3845] EXT4-fs error (device loop4): ext4_ext_check_inode:523: inode #13: comm syz.4.77: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 43.222289][ T3843] syz.1.76: attempt to access beyond end of device [ 43.222289][ T3843] loop1: rw=2049, sector=273, nr_sectors = 9 limit=128 [ 43.235814][ T3845] EXT4-fs error (device loop4): ext4_orphan_get:1397: comm syz.4.77: couldn't read orphan inode 13 (err -117) [ 43.248300][ T3845] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 43.261139][ T3846] syz.1.76: attempt to access beyond end of device [ 43.261139][ T3846] loop1: rw=2049, sector=289, nr_sectors = 80 limit=128 [ 43.277597][ T3845] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 43.287510][ T3846] syz.1.76: attempt to access beyond end of device [ 43.287510][ T3846] loop1: rw=2049, sector=377, nr_sectors = 8 limit=128 [ 43.301683][ T3846] syz.1.76: attempt to access beyond end of device [ 43.301683][ T3846] loop1: rw=2049, sector=393, nr_sectors = 8 limit=128 [ 43.315450][ T3845] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 43.324283][ T3845] ext4 filesystem being remounted at /18/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 43.427489][ T3854] loop0: detected capacity change from 0 to 512 [ 43.446744][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.470702][ T3852] process 'syz.1.78' launched '/dev/fd/10' with NULL argv: empty string added [ 43.484040][ T3854] vlan2: entered allmulticast mode [ 43.489180][ T3854] hsr0: entered allmulticast mode [ 43.494433][ T3854] hsr_slave_0: entered allmulticast mode [ 43.500127][ T3854] hsr_slave_1: entered allmulticast mode [ 43.575131][ T53] Bluetooth: hci0: Frame reassembly failed (-84) [ 43.586459][ T3862] xt_hashlimit: size too large, truncated to 1048576 [ 43.716590][ T3865] loop0: detected capacity change from 0 to 512 [ 43.794564][ T3859] loop1: detected capacity change from 0 to 8192 [ 43.821958][ T3865] ------------[ cut here ]------------ [ 43.827435][ T3865] EA inode 11 i_nlink=2 [ 43.827814][ T3865] WARNING: CPU: 1 PID: 3865 at fs/ext4/xattr.c:1058 ext4_xattr_inode_update_ref+0x36a/0x380 [ 43.842258][ T3865] Modules linked in: [ 43.846166][ T3865] CPU: 1 UID: 0 PID: 3865 Comm: syz.0.82 Not tainted syzkaller #0 PREEMPT(voluntary) [ 43.855963][ T3865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 43.866190][ T3865] RIP: 0010:ext4_xattr_inode_update_ref+0x36a/0x380 [ 43.872809][ T3865] Code: 90 49 8d 7e 40 e8 e6 f9 b8 ff 4d 8b 6e 40 4c 89 e7 e8 fa f4 b8 ff 41 8b 56 48 48 c7 c7 66 d4 55 86 4c 89 ee e8 a7 f5 67 ff 90 <0f> 0b 90 90 e9 ff fe ff ff e8 28 f4 b5 03 0f 1f 84 00 00 00 00 00 [ 43.892553][ T3865] RSP: 0018:ffffc9001a5e75a0 EFLAGS: 00010246 [ 43.898617][ T3865] RAX: 4d4dd05acc007e00 RBX: ffff888119c0ceb0 RCX: 0000000000080000 [ 43.906609][ T3865] RDX: ffffc9000617f000 RSI: 0000000000004235 RDI: 0000000000004236 [ 43.914598][ T3865] RBP: 0000000000000002 R08: 0001c9001a5e7427 R09: 0000000000000000 [ 43.922588][ T3865] R10: 00000000ffffffff R11: 0000000000000002 R12: ffff888119c0ce60 [ 43.930631][ T3865] R13: 000000000000000b R14: ffff888119c0ce18 R15: 0000000000000001 [ 43.938699][ T3865] FS: 00007fada0a6e6c0(0000) GS:ffff8882aef11000(0000) knlGS:0000000000000000 [ 43.947671][ T3865] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.954328][ T3865] CR2: 00007f965494c000 CR3: 000000011e500000 CR4: 00000000003506f0 [ 43.962451][ T3865] Call Trace: [ 43.965816][ T3865] [ 43.968743][ T3865] ext4_xattr_set_entry+0x77f/0x1020 [ 43.974066][ T3865] ext4_xattr_ibody_set+0x184/0x3c0 [ 43.979313][ T3865] ext4_expand_extra_isize_ea+0xcbb/0x11f0 [ 43.985292][ T3865] __ext4_expand_extra_isize+0x246/0x280 [ 43.990933][ T3865] __ext4_mark_inode_dirty+0x29d/0x3f0 [ 43.996556][ T3865] ext4_evict_inode+0x80e/0xd90 [ 44.001457][ T3865] ? __pfx_ext4_evict_inode+0x10/0x10 [ 44.006915][ T3865] evict+0x2e3/0x550 [ 44.007438][ T3859] msdos: Unknown parameter 'ù‡U©À¶Ö¾7Þg¡ [ 44.007438][ T3859] À†9JòWÃØAmFU½•`^sd”?¶VÐ/Dè“Ýd‹œWÞÄÕ›¥ ÕÒÞNß{¢¬î­>¼ßqõ÷¶äby&ýÿºf>`ê% J^PeUUXuºt _ÃøOëdŽ9g_Þê3é}‡éX' [ 44.010840][ T3865] ? __dquot_initialize+0x146/0x7c0 [ 44.035329][ T3865] iput+0x4ed/0x650 [ 44.039244][ T3865] ext4_process_orphan+0x1a9/0x1c0 [ 44.044456][ T3865] ext4_orphan_cleanup+0x6a8/0xa00 [ 44.049724][ T3865] ext4_fill_super+0x3483/0x3810 [ 44.052521][ T3859] netlink: 'syz.1.81': attribute type 21 has an invalid length. [ 44.054758][ T3865] ? snprintf+0x86/0xb0 [ 44.066460][ T3865] ? set_blocksize+0x1a8/0x310 [ 44.071364][ T3865] ? sb_set_blocksize+0xe3/0x100 [ 44.076323][ T3865] ? setup_bdev_super+0x30e/0x370 [ 44.076357][ T3865] ? __pfx_ext4_fill_super+0x10/0x10 [ 44.076378][ T3865] get_tree_bdev_flags+0x291/0x300 [ 44.091954][ T3865] ? __pfx_ext4_fill_super+0x10/0x10 [ 44.097311][ T3865] get_tree_bdev+0x1f/0x30 [ 44.101803][ T3865] ext4_get_tree+0x1c/0x30 [ 44.106223][ T3865] vfs_get_tree+0x57/0x1d0 [ 44.110669][ T3865] do_new_mount+0x24d/0x660 [ 44.115216][ T3865] path_mount+0x4a5/0xb70 [ 44.119645][ T3865] ? user_path_at+0x109/0x130 [ 44.124520][ T3865] __se_sys_mount+0x28c/0x2e0 [ 44.129216][ T3865] ? do_mkdirat+0x3ac/0x3f0 [ 44.133771][ T3865] __x64_sys_mount+0x67/0x80 [ 44.138696][ T3865] x64_sys_call+0x2b51/0x3000 [ 44.143489][ T3865] do_syscall_64+0xd2/0x200 [ 44.148131][ T3865] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 44.148220][ T3865] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 44.148271][ T3865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.148294][ T3865] RIP: 0033:0x7fada2030e6a [ 44.148308][ T3865] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 44.148377][ T3865] RSP: 002b:00007fada0a6de68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 44.148398][ T3865] RAX: ffffffffffffffda RBX: 00007fada0a6def0 RCX: 00007fada2030e6a [ 44.148410][ T3865] RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007fada0a6deb0 [ 44.148422][ T3865] RBP: 0000200000000180 R08: 00007fada0a6def0 R09: 0000000000800700 [ 44.148435][ T3865] R10: 0000000000800700 R11: 0000000000000246 R12: 00002000000001c0 [ 44.148472][ T3865] R13: 00007fada0a6deb0 R14: 000000000000046f R15: 000000000000002c [ 44.148489][ T3865] [ 44.148496][ T3865] ---[ end trace 0000000000000000 ]--- [ 44.181224][ T3865] EXT4-fs error (device loop0): ext4_xattr_inode_iget:441: inode #18: comm syz.0.82: iget: bad extra_isize 90 (inode size 256) [ 44.181444][ T3865] EXT4-fs (loop0): Remounting filesystem read-only [ 44.181540][ T3865] EXT4-fs warning (device loop0): ext4_evict_inode:274: xattr delete (err -30) [ 44.181564][ T3865] EXT4-fs (loop0): 1 orphan inode deleted [ 44.182077][ T3865] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.443076][ T3316] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-001000000000. [ 44.457102][ T3874] random: crng reseeded on system resumption [ 44.464780][ T3319] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.469487][ T3874] netlink: 8 bytes leftover after parsing attributes in process `syz.3.84'. [ 44.516964][ T3880] loop1: detected capacity change from 0 to 512 [ 44.526479][ T3874] netlink: 8 bytes leftover after parsing attributes in process `syz.3.84'. [ 44.536675][ T3881] netlink: 24 bytes leftover after parsing attributes in process `syz.2.85'. [ 44.573412][ T3882] loop0: detected capacity change from 0 to 2048 [ 44.601802][ T3886] netlink: 4 bytes leftover after parsing attributes in process `syz.1.87'. [ 44.612087][ T3882] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 44.626386][ T3881] veth3: entered promiscuous mode [ 44.631827][ T3881] veth3: entered allmulticast mode [ 44.670979][ T3319] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.673443][ T3892] netlink: 12 bytes leftover after parsing attributes in process `syz.3.88'. [ 44.708568][ T3892] hsr_slave_0: left promiscuous mode [ 44.714452][ T3892] hsr_slave_1: left promiscuous mode [ 44.724620][ T3894] netlink: 'syz.0.90': attribute type 7 has an invalid length. [ 44.732241][ T3894] netlink: 8 bytes leftover after parsing attributes in process `syz.0.90'. [ 44.749537][ T3894] netlink: 24 bytes leftover after parsing attributes in process `syz.0.90'. [ 44.763823][ T3894] loop0: detected capacity change from 0 to 1024 [ 44.770644][ T3894] EXT4-fs: Ignoring removed bh option [ 44.776698][ T3894] EXT4-fs: inline encryption not supported [ 44.777582][ T3891] loop2: detected capacity change from 0 to 512 [ 44.795745][ T3891] EXT4-fs error (device loop2): ext4_xattr_inode_iget:441: inode #18: comm syz.2.89: iget: bad extra_isize 90 (inode size 256) [ 44.813485][ T3891] EXT4-fs (loop2): Remounting filesystem read-only [ 44.813487][ T3894] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 44.831524][ T3891] EXT4-fs warning (device loop2): ext4_evict_inode:274: xattr delete (err -30) [ 44.840824][ T3891] EXT4-fs (loop2): 1 orphan inode deleted [ 44.846738][ T3894] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 44.858280][ T3894] EXT4-fs error (device loop0): ext4_map_blocks:778: inode #3: block 2: comm syz.0.90: lblock 2 mapped to illegal pblock 2 (length 1) [ 44.861420][ T3891] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.885428][ T3894] EXT4-fs error (device loop0): ext4_map_blocks:778: inode #3: block 48: comm syz.0.90: lblock 0 mapped to illegal pblock 48 (length 1) [ 44.904347][ T3894] EXT4-fs error (device loop0): ext4_acquire_dquot:6945: comm syz.0.90: Failed to acquire dquot type 0 [ 44.915648][ T3894] EXT4-fs error (device loop0) in ext4_reserve_inode_write:6313: Corrupt filesystem [ 44.925182][ T3894] EXT4-fs error (device loop0): ext4_evict_inode:254: inode #11: comm syz.0.90: mark_inode_dirty error [ 44.936523][ T3894] EXT4-fs warning (device loop0): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 44.947129][ T3894] EXT4-fs (loop0): 1 orphan inode deleted [ 44.953560][ T3894] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 44.970859][ T3902] netlink: 'syz.2.89': attribute type 1 has an invalid length. [ 44.971199][ T52] EXT4-fs error (device loop0): ext4_map_blocks:778: inode #3: block 1: comm kworker/u8:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 44.983553][ T3901] netlink: 20 bytes leftover after parsing attributes in process `syz.3.92'. [ 44.996813][ T52] EXT4-fs error (device loop0): ext4_release_dquot:6981: comm kworker/u8:3: Failed to release dquot type 0 [ 45.013559][ T3894] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 45.027030][ T3901] loop3: detected capacity change from 0 to 512 [ 45.038986][ T3319] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.051733][ T3901] EXT4-fs error (device loop3): ext4_acquire_dquot:6945: comm syz.3.92: Failed to acquire dquot type 1 [ 45.063802][ T3901] EXT4-fs (loop3): 1 truncate cleaned up [ 45.074349][ T3901] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.087980][ T3901] ext4 filesystem being mounted at /21/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 45.099396][ T3901] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.114764][ T3316] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.149983][ T3914] loop2: detected capacity change from 0 to 1024 [ 45.158044][ T3915] syz.0.93 uses obsolete (PF_INET,SOCK_PACKET) [ 45.182145][ T3914] EXT4-fs (loop2): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 45.194644][ T3914] ext4 filesystem being mounted at /18/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 45.213716][ T3914] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 45.225585][ T3914] EXT4-fs error (device loop2): ext4_map_blocks:814: inode #15: block 3: comm syz.2.94: lblock 3 mapped to illegal pblock 3 (length 1) [ 45.239807][ T3914] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 117 [ 45.252188][ T3914] EXT4-fs (loop2): This should not happen!! Data will be lost [ 45.252188][ T3914] [ 45.271481][ T3914] EXT4-fs error (device loop2): ext4_map_blocks:814: inode #15: block 4: comm syz.2.94: lblock 4 mapped to illegal pblock 4 (length 2) [ 45.285668][ T3913] loop3: detected capacity change from 0 to 2048 [ 45.292235][ T3914] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 4 with max blocks 2 with error 117 [ 45.304633][ T3914] EXT4-fs (loop2): This should not happen!! Data will be lost [ 45.304633][ T3914] [ 45.323330][ T2375] EXT4-fs error (device loop2): ext4_map_blocks:814: inode #15: block 8: comm kworker/u8:9: lblock 8 mapped to illegal pblock 8 (length 8) [ 45.337865][ T2375] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 45.341660][ T3309] Alternate GPT is invalid, using primary GPT. [ 45.350193][ T2375] EXT4-fs (loop2): This should not happen!! Data will be lost [ 45.350193][ T2375] [ 45.356492][ T3309] loop3: p1 p2 p3 [ 45.368513][ T3316] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 45.391704][ T3922] loop2: detected capacity change from 0 to 512 [ 45.398489][ T3913] Alternate GPT is invalid, using primary GPT. [ 45.403847][ T3922] EXT4-fs: Ignoring removed nomblk_io_submit option [ 45.405043][ T3913] loop3: p1 p2 p3 [ 45.411534][ T3922] EXT4-fs: Ignoring removed bh option [ 45.440555][ T3922] EXT4-fs error (device loop2): mb_free_blocks:2017: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 45.472155][ T3922] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #11: comm syz.2.96: corrupted inode contents [ 45.488293][ T3922] EXT4-fs error (device loop2): ext4_dirty_inode:6517: inode #11: comm syz.2.96: mark_inode_dirty error [ 45.503171][ T3922] EXT4-fs error (device loop2): ext4_free_branches:1023: inode #11: comm syz.2.96: invalid indirect mapped block 1 (level 1) [ 45.516885][ T3922] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #11: comm syz.2.96: corrupted inode contents [ 45.529069][ T3922] EXT4-fs error (device loop2) in ext4_orphan_del:301: Corrupt filesystem [ 45.537821][ T3922] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #11: comm syz.2.96: corrupted inode contents [ 45.550076][ T3922] EXT4-fs error (device loop2): ext4_truncate:4637: inode #11: comm syz.2.96: mark_inode_dirty error [ 45.561307][ T3922] EXT4-fs error (device loop2) in ext4_process_orphan:343: Corrupt filesystem [ 45.570352][ T3922] EXT4-fs (loop2): 1 truncate cleaned up [ 45.576910][ T3922] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 45.596678][ T3922] EXT4-fs error (device loop2): ext4_readdir:264: inode #2: block 13: comm syz.2.96: path /19/file0: bad entry in directory: directory entry too close to block end - offset=76, inode=16, rec_len=940, size=1024 fake=0 [ 45.641279][ T3633] Bluetooth: hci0: command 0x1003 tx timeout [ 45.641586][ T3524] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 45.690889][ T3922] netlink: 'syz.2.96': attribute type 3 has an invalid length. [ 45.698848][ T3922] netlink: 'syz.2.96': attribute type 3 has an invalid length. [ 45.891186][ T3933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.905466][ T3933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.914646][ T3933] syz.4.98 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 46.069876][ T3941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.078968][ T3941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.265795][ T3316] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.351513][ T3945] netlink: 172 bytes leftover after parsing attributes in process `syz.1.101'. [ 46.399625][ T3945] siw: device registration error -23 [ 46.507025][ T3947] netlink: 'syz.2.102': attribute type 1 has an invalid length. [ 46.524576][ T29] kauditd_printk_skb: 531 callbacks suppressed [ 46.524624][ T29] audit: type=1326 audit(1763313111.988:2503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3950 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f946575f6c9 code=0x7ffc0000 [ 46.554569][ T29] audit: type=1326 audit(1763313111.988:2504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3950 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f946575f6c9 code=0x7ffc0000 [ 46.575968][ T3949] ip6_vti0 speed is unknown, defaulting to 1000 [ 46.577881][ T29] audit: type=1400 audit(1763313111.988:2505): avc: denied { create } for pid=3948 comm="syz.4.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 46.603842][ T29] audit: type=1400 audit(1763313111.998:2506): avc: denied { sys_admin } for pid=3948 comm="syz.4.103" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 46.622325][ T3955] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 46.624926][ T29] audit: type=1326 audit(1763313112.008:2507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3950 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f946575f6c9 code=0x7ffc0000 [ 46.632066][ T3955] IPv6: NLM_F_CREATE should be set when creating new route [ 46.632078][ T3955] IPv6: NLM_F_CREATE should be set when creating new route [ 46.632571][ T3955] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 46.656401][ T29] audit: type=1326 audit(1763313112.008:2508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3950 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f946575f6c9 code=0x7ffc0000 [ 46.701637][ T29] audit: type=1326 audit(1763313112.008:2509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3950 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f946575f6c9 code=0x7ffc0000 [ 46.725058][ T29] audit: type=1326 audit(1763313112.008:2510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3950 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f946575f6c9 code=0x7ffc0000 [ 46.748385][ T29] audit: type=1326 audit(1763313112.008:2511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3950 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f946575f6c9 code=0x7ffc0000 [ 46.772117][ T29] audit: type=1326 audit(1763313112.008:2512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3950 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f946575df10 code=0x7ffc0000 [ 46.943995][ T3963] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 46.966751][ T3963] SELinux: Context system_u:object_r:systemd_systemctl_exec_t:s0 is not valid (left unmapped). [ 46.984252][ T3963] 9pnet_fd: Insufficient options for proto=fd [ 47.076895][ T3964] loop1: detected capacity change from 0 to 128 [ 47.259920][ T3975] ip6_vti0 speed is unknown, defaulting to 1000 [ 47.583356][ T3984] Cannot find add_set index 65532 as target [ 47.613041][ T3984] ip6_vti0 speed is unknown, defaulting to 1000 [ 48.169760][ T2375] Bluetooth: hci0: Frame reassembly failed (-84) [ 48.227812][ T3990] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 48.234404][ T3990] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 48.241888][ T3990] vhci_hcd vhci_hcd.0: Device attached [ 48.261285][ T3989] ip6_vti0 speed is unknown, defaulting to 1000 [ 48.294833][ T3990] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(11) [ 48.301464][ T3990] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 48.308983][ T3990] vhci_hcd vhci_hcd.0: Device attached [ 48.315315][ T4003] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 48.416739][ T4004] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 48.525962][ T3411] vhci_hcd: vhci_device speed not set [ 48.543955][ T3990] vhci_hcd vhci_hcd.0: pdev(1) rhport(4) sockfd(18) [ 48.550578][ T3990] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 48.552866][ T3987] Set syz1 is full, maxelem 65536 reached [ 48.558357][ T3990] vhci_hcd vhci_hcd.0: Device attached [ 48.591108][ T3411] usb 3-1: new full-speed USB device number 2 using vhci_hcd [ 48.598587][ T4003] vhci_hcd vhci_hcd.0: pdev(1) rhport(5) sockfd(17) [ 48.605303][ T4003] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 48.612967][ T4003] vhci_hcd vhci_hcd.0: Device attached [ 48.642903][ T3994] random: crng reseeded on system resumption [ 48.670933][ T3994] __nla_validate_parse: 2 callbacks suppressed [ 48.670949][ T3994] netlink: 8 bytes leftover after parsing attributes in process `syz.2.114'. [ 48.723061][ T4000] vhci_hcd: connection closed [ 48.723223][ T4007] vhci_hcd: connection closed [ 48.727983][ T4010] vhci_hcd: connection closed [ 48.735424][ T52] vhci_hcd: stop threads [ 48.735520][ T3998] vhci_hcd: connection reset by peer [ 48.740138][ T52] vhci_hcd: release socket [ 48.754230][ T52] vhci_hcd: disconnect device [ 48.754329][ T3994] netlink: 8 bytes leftover after parsing attributes in process `syz.2.114'. [ 48.900809][ T52] vhci_hcd: stop threads [ 48.905312][ T52] vhci_hcd: release socket [ 48.909740][ T52] vhci_hcd: disconnect device [ 48.951276][ T52] vhci_hcd: stop threads [ 48.955552][ T52] vhci_hcd: release socket [ 48.959975][ T52] vhci_hcd: disconnect device [ 49.014910][ T52] vhci_hcd: stop threads [ 49.019186][ T52] vhci_hcd: release socket [ 49.023659][ T52] vhci_hcd: disconnect device [ 49.183829][ T4024] loop2: detected capacity change from 0 to 1024 [ 49.193599][ T4024] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 49.204907][ T4024] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 49.215023][ T4024] JBD2: no valid journal superblock found [ 49.220805][ T4024] EXT4-fs (loop2): Could not load journal inode [ 49.400405][ T4027] netlink: 83992 bytes leftover after parsing attributes in process `syz.1.119'. [ 49.417335][ T4027] netlink: zone id is out of range [ 49.422520][ T4027] netlink: zone id is out of range [ 49.428079][ T4027] netlink: zone id is out of range [ 49.433628][ T4027] netlink: zone id is out of range [ 49.438774][ T4027] netlink: zone id is out of range [ 49.443898][ T4027] netlink: zone id is out of range [ 49.449121][ T4027] netlink: zone id is out of range [ 49.454675][ T4027] netlink: zone id is out of range [ 49.464953][ T4031] loop1: detected capacity change from 0 to 512 [ 49.479347][ T4027] netlink: set zone limit has 8 unknown bytes [ 49.501085][ T4031] EXT4-fs: Ignoring removed orlov option [ 49.507309][ T4031] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 49.517309][ T4031] EXT4-fs error (device loop1): ext4_iget_extra_inode:5075: inode #15: comm syz.1.119: corrupted in-inode xattr: e_value size too large [ 49.532203][ T4031] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.119: couldn't read orphan inode 15 (err -117) [ 49.548000][ T4031] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 49.683011][ T4035] loop4: detected capacity change from 0 to 128 [ 49.814358][ T3315] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.898940][ T4037] loop3: detected capacity change from 0 to 128 [ 49.933218][ T4037] bio_check_eod: 109 callbacks suppressed [ 49.933232][ T4037] syz.3.123: attempt to access beyond end of device [ 49.933232][ T4037] loop3: rw=2049, sector=138, nr_sectors = 8 limit=128 [ 49.970026][ T4037] syz.3.123: attempt to access beyond end of device [ 49.970026][ T4037] loop3: rw=2049, sector=146, nr_sectors = 8 limit=128 [ 49.985402][ T4037] syz.3.123: attempt to access beyond end of device [ 49.985402][ T4037] loop3: rw=2049, sector=152, nr_sectors = 2 limit=128 [ 49.998862][ T4037] buffer_io_error: 2 callbacks suppressed [ 49.998880][ T4037] Buffer I/O error on dev loop3, logical block 76, lost async page write [ 50.014621][ T4037] syz.3.123: attempt to access beyond end of device [ 50.014621][ T4037] loop3: rw=2049, sector=170, nr_sectors = 8 limit=128 [ 50.028933][ T4037] syz.3.123: attempt to access beyond end of device [ 50.028933][ T4037] loop3: rw=2049, sector=176, nr_sectors = 2 limit=128 [ 50.042340][ T4037] Buffer I/O error on dev loop3, logical block 88, lost async page write [ 50.109616][ T4040] netlink: 48 bytes leftover after parsing attributes in process `syz.2.124'. [ 50.120230][ T4041] netlink: 12 bytes leftover after parsing attributes in process `syz.3.123'. [ 50.140173][ T4037] syz.3.123: attempt to access beyond end of device [ 50.140173][ T4037] loop3: rw=2049, sector=178, nr_sectors = 8 limit=128 [ 50.177318][ T4040] ip6_vti0 speed is unknown, defaulting to 1000 [ 50.194929][ T4042] netlink: 12 bytes leftover after parsing attributes in process `syz.3.123'. [ 50.204131][ T3524] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 50.248786][ T4037] syz.3.123: attempt to access beyond end of device [ 50.248786][ T4037] loop3: rw=2049, sector=184, nr_sectors = 2 limit=128 [ 50.262258][ T4037] Buffer I/O error on dev loop3, logical block 92, lost async page write [ 50.491252][ T4041] netlink: 12 bytes leftover after parsing attributes in process `syz.3.123'. [ 50.511278][ T4042] netlink: 12 bytes leftover after parsing attributes in process `syz.3.123'. [ 50.541354][ T4037] syz.3.123: attempt to access beyond end of device [ 50.541354][ T4037] loop3: rw=2049, sector=202, nr_sectors = 8 limit=128 [ 50.607703][ T4037] syz.3.123: attempt to access beyond end of device [ 50.607703][ T4037] loop3: rw=2049, sector=208, nr_sectors = 2 limit=128 [ 50.621068][ T4037] Buffer I/O error on dev loop3, logical block 104, lost async page write [ 50.651130][ T4041] netlink: 12 bytes leftover after parsing attributes in process `syz.3.123'. [ 50.661383][ T4037] syz.3.123: attempt to access beyond end of device [ 50.661383][ T4037] loop3: rw=2049, sector=210, nr_sectors = 8 limit=128 [ 50.663994][ T4042] netlink: 12 bytes leftover after parsing attributes in process `syz.3.123'. [ 50.675529][ T4037] Buffer I/O error on dev loop3, logical block 108, lost async page write [ 50.782970][ T4037] Buffer I/O error on dev loop3, logical block 120, lost async page write [ 50.794281][ T4037] Buffer I/O error on dev loop3, logical block 80, lost async page write [ 50.852472][ T4062] siw: device registration error -23 [ 50.872932][ T4037] Buffer I/O error on dev loop3, logical block 84, lost async page write [ 50.955861][ T4037] Buffer I/O error on dev loop3, logical block 112, lost async page write [ 50.971538][ T4066] netlink: 'syz.2.128': attribute type 30 has an invalid length. [ 51.084433][ T4075] loop4: detected capacity change from 0 to 512 [ 51.103315][ T4075] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 51.273022][ T4072] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.282057][ T4072] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.531985][ T29] kauditd_printk_skb: 412 callbacks suppressed [ 51.532000][ T29] audit: type=1326 audit(1763313116.998:2925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4082 comm="syz.3.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f7cbad8b789 code=0x7ffc0000 [ 51.571968][ T4087] loop3: detected capacity change from 0 to 128 [ 51.713680][ T29] audit: type=1326 audit(1763313117.028:2926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4082 comm="syz.3.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 51.737187][ T29] audit: type=1326 audit(1763313117.028:2927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4082 comm="syz.3.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 51.760524][ T29] audit: type=1326 audit(1763313117.028:2928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4084 comm="syz.3.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=60 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 51.784108][ T29] audit: type=1326 audit(1763313117.108:2929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4082 comm="syz.3.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f7cbade6567 code=0x7ffc0000 [ 51.789011][ T4085] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.807367][ T29] audit: type=1326 audit(1763313117.108:2930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4082 comm="syz.3.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f7cbad8b789 code=0x7ffc0000 [ 51.807442][ T29] audit: type=1326 audit(1763313117.108:2931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4082 comm="syz.3.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 51.807464][ T29] audit: type=1326 audit(1763313117.158:2932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4082 comm="syz.3.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f7cbade6567 code=0x7ffc0000 [ 51.885592][ T29] audit: type=1326 audit(1763313117.158:2933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4082 comm="syz.3.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f7cbad8b789 code=0x7ffc0000 [ 51.908819][ T29] audit: type=1326 audit(1763313117.158:2934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4082 comm="syz.3.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 51.971165][ T4085] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 52.006469][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.104919][ T4101] netlink: 'syz.4.137': attribute type 39 has an invalid length. [ 52.644181][ T4119] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 52.646278][ T4117] IPVS: Unknown mcast interface: [ 52.687958][ T4119] 9pnet_fd: Insufficient options for proto=fd [ 52.691678][ T4121] ip6_vti0 speed is unknown, defaulting to 1000 [ 52.740089][ T4126] netlink: 'syz.2.146': attribute type 1 has an invalid length. [ 52.935825][ T4124] loop3: detected capacity change from 0 to 32768 [ 52.989446][ T4133] random: crng reseeded on system resumption [ 52.996075][ T3925] loop3: p1 p2 p3 < > p4 < p5 p6 > [ 53.002219][ T3925] loop3: p1 start 460800 is beyond EOD, truncated [ 53.008998][ T3925] loop3: p2 size 83886080 extends beyond EOD, truncated [ 53.018827][ T3925] loop3: p5 start 460800 is beyond EOD, truncated [ 53.025329][ T3925] loop3: p6 size 83886080 extends beyond EOD, truncated [ 53.036381][ T4124] loop3: p1 p2 p3 < > p4 < p5 p6 > [ 53.041782][ T4124] loop3: p1 start 460800 is beyond EOD, truncated [ 53.048265][ T4124] loop3: p2 size 83886080 extends beyond EOD, truncated [ 53.058337][ T4124] loop3: p5 start 460800 is beyond EOD, truncated [ 53.064810][ T4124] loop3: p6 size 83886080 extends beyond EOD, truncated [ 53.097503][ T4137] loop4: detected capacity change from 0 to 128 [ 53.186386][ T4137] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 53.210068][ T4137] ext4 filesystem being mounted at /30/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 53.253056][ T3322] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 53.642172][ T3411] usb 3-1: enqueue for inactive port 0 [ 53.682106][ T3411] usb 3-1: enqueue for inactive port 0 [ 53.720645][ T4147] loop4: detected capacity change from 0 to 512 [ 53.734607][ T4147] EXT4-fs: Ignoring removed nomblk_io_submit option [ 53.741342][ T4147] EXT4-fs: Ignoring removed bh option [ 53.748710][ T4149] netlink: 'syz.2.153': attribute type 10 has an invalid length. [ 53.751241][ T3411] vhci_hcd: vhci_device speed not set [ 53.757355][ T4149] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.769166][ T4149] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.777883][ T4150] Cannot find add_set index 65532 as target [ 53.789561][ T4147] EXT4-fs error (device loop4): mb_free_blocks:2017: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 53.794303][ T4149] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.811616][ T4149] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.817201][ T4147] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #11: comm syz.4.151: corrupted inode contents [ 53.818966][ T4149] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.837639][ T4149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.847169][ T4149] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 53.847223][ T4156] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 53.848635][ T4155] __nla_validate_parse: 8 callbacks suppressed [ 53.848649][ T4155] netlink: 4 bytes leftover after parsing attributes in process `syz.2.153'. [ 53.857381][ T4147] EXT4-fs error (device loop4): ext4_dirty_inode:6517: inode #11: comm syz.4.151: mark_inode_dirty error [ 53.871683][ T4150] ip6_vti0 speed is unknown, defaulting to 1000 [ 53.878738][ T4147] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.151: invalid indirect mapped block 1 (level 1) [ 53.890403][ T4155] bridge_slave_1: left allmulticast mode [ 53.913693][ T4155] bridge_slave_1: left promiscuous mode [ 53.919422][ T4155] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.925672][ T4147] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #11: comm syz.4.151: corrupted inode contents [ 53.927991][ T4152] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.957961][ T4152] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.990068][ T4155] bridge_slave_0: left allmulticast mode [ 53.995766][ T4155] bridge_slave_0: left promiscuous mode [ 54.001469][ T4155] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.014722][ T4147] EXT4-fs error (device loop4) in ext4_orphan_del:301: Corrupt filesystem [ 54.024187][ T4147] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #11: comm syz.4.151: corrupted inode contents [ 54.037403][ T4147] EXT4-fs error (device loop4): ext4_truncate:4637: inode #11: comm syz.4.151: mark_inode_dirty error [ 54.037421][ T4155] bond0: (slave bridge0): Releasing backup interface [ 54.049322][ T4147] EXT4-fs error (device loop4) in ext4_process_orphan:343: Corrupt filesystem [ 54.066916][ T4147] EXT4-fs (loop4): 1 truncate cleaned up [ 54.073532][ T4147] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 54.113631][ T4147] EXT4-fs error (device loop4): ext4_readdir:264: inode #2: block 13: comm syz.4.151: path /32/file0: bad entry in directory: directory entry too close to block end - offset=76, inode=16, rec_len=940, size=1024 fake=0 [ 54.210035][ T4165] netlink: 'syz.2.157': attribute type 6 has an invalid length. [ 54.214424][ T4147] netlink: 'syz.4.151': attribute type 3 has an invalid length. [ 54.225423][ T4147] netlink: 'syz.4.151': attribute type 3 has an invalid length. [ 54.406844][ T4173] ip6_vti0 speed is unknown, defaulting to 1000 [ 54.595067][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 54.671727][ T4178] netlink: 'syz.1.162': attribute type 39 has an invalid length. [ 54.844204][ T4182] sit0: entered promiscuous mode [ 54.862370][ T4182] netlink: 'syz.4.161': attribute type 1 has an invalid length. [ 54.870052][ T4182] netlink: 1 bytes leftover after parsing attributes in process `syz.4.161'. [ 54.972952][ T4190] SELinux: Context system_u:object_r:apt_exec_t:s0 is not valid (left unmapped). [ 55.405291][ T4199] netlink: 'syz.4.167': attribute type 10 has an invalid length. [ 55.419326][ T4198] loop1: detected capacity change from 0 to 128 [ 55.488082][ T4195] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 55.515307][ T4200] netlink: 4 bytes leftover after parsing attributes in process `syz.4.167'. [ 55.521295][ T4198] bio_check_eod: 121 callbacks suppressed [ 55.521311][ T4198] syz.1.168: attempt to access beyond end of device [ 55.521311][ T4198] loop1: rw=2049, sector=138, nr_sectors = 8 limit=128 [ 55.526168][ T4199] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.550544][ T4198] syz.1.168: attempt to access beyond end of device [ 55.550544][ T4198] loop1: rw=2049, sector=146, nr_sectors = 8 limit=128 [ 55.551800][ T4199] team0: Port device bond0 added [ 55.584872][ T4198] syz.1.168: attempt to access beyond end of device [ 55.584872][ T4198] loop1: rw=2049, sector=152, nr_sectors = 2 limit=128 [ 55.598246][ T4198] Buffer I/O error on dev loop1, logical block 76, lost async page write [ 55.643472][ T4202] netlink: 12 bytes leftover after parsing attributes in process `syz.1.168'. [ 55.693367][ T4198] syz.1.168: attempt to access beyond end of device [ 55.693367][ T4198] loop1: rw=2049, sector=170, nr_sectors = 8 limit=128 [ 55.709697][ T4200] team0 (unregistering): Port device bond0 removed [ 55.731803][ T4202] netlink: 12 bytes leftover after parsing attributes in process `syz.1.168'. [ 55.749520][ T4204] netlink: 12 bytes leftover after parsing attributes in process `syz.1.168'. [ 55.767444][ T4198] syz.1.168: attempt to access beyond end of device [ 55.767444][ T4198] loop1: rw=2049, sector=176, nr_sectors = 2 limit=128 [ 55.780882][ T4198] Buffer I/O error on dev loop1, logical block 88, lost async page write [ 55.806754][ T4204] netlink: 12 bytes leftover after parsing attributes in process `syz.1.168'. [ 55.857695][ T4209] loop3: detected capacity change from 0 to 164 [ 55.858352][ T4198] syz.1.168: attempt to access beyond end of device [ 55.858352][ T4198] loop1: rw=2049, sector=178, nr_sectors = 8 limit=128 [ 55.897863][ T4202] netlink: 12 bytes leftover after parsing attributes in process `syz.1.168'. [ 55.927694][ T4198] syz.1.168: attempt to access beyond end of device [ 55.927694][ T4198] loop1: rw=2049, sector=184, nr_sectors = 2 limit=128 [ 55.941348][ T4198] Buffer I/O error on dev loop1, logical block 92, lost async page write [ 56.051389][ T4204] netlink: 12 bytes leftover after parsing attributes in process `syz.1.168'. [ 56.111360][ T4198] syz.1.168: attempt to access beyond end of device [ 56.111360][ T4198] loop1: rw=2049, sector=202, nr_sectors = 8 limit=128 [ 56.165696][ T4198] syz.1.168: attempt to access beyond end of device [ 56.165696][ T4198] loop1: rw=2049, sector=208, nr_sectors = 2 limit=128 [ 56.179166][ T4198] Buffer I/O error on dev loop1, logical block 104, lost async page write [ 56.274617][ T4198] syz.1.168: attempt to access beyond end of device [ 56.274617][ T4198] loop1: rw=2049, sector=210, nr_sectors = 8 limit=128 [ 56.439679][ T4214] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.461020][ T4215] tipc: Started in network mode [ 56.465966][ T4215] tipc: Node identity a2f1c691974c, cluster identity 4711 [ 56.473219][ T4215] tipc: Enabled bearer , priority 0 [ 56.483596][ T4209] netlink: 'syz.3.169': attribute type 13 has an invalid length. [ 56.497076][ T4215] tipc: Disabling bearer [ 56.544624][ T29] kauditd_printk_skb: 469 callbacks suppressed [ 56.544641][ T29] audit: type=1400 audit(1763313121.998:3404): avc: denied { read } for pid=4218 comm="syz.0.172" name="qrtr-tun" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 56.554487][ T4214] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.600464][ T29] audit: type=1400 audit(1763313122.008:3405): avc: denied { open } for pid=4218 comm="syz.0.172" path="/dev/qrtr-tun" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 56.623639][ T29] audit: type=1400 audit(1763313122.058:3406): avc: denied { create } for pid=4218 comm="syz.0.172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 56.648496][ T4209] gretap0: refused to change device tx_queue_len [ 56.659506][ T4209] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 56.704172][ T4214] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.708602][ T29] audit: type=1400 audit(1763313122.068:3407): avc: denied { setopt } for pid=4218 comm="syz.0.172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 56.733854][ T29] audit: type=1400 audit(1763313122.148:3408): avc: denied { write } for pid=4218 comm="syz.0.172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 56.753245][ T29] audit: type=1400 audit(1763313122.148:3409): avc: denied { sys_module } for pid=4213 comm="syz.4.170" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 56.814248][ T4214] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.837516][ T4281] netlink: 24 bytes leftover after parsing attributes in process `syz.0.183'. [ 56.852859][ T4282] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 56.866414][ T29] audit: type=1400 audit(1763313122.318:3410): avc: denied { create } for pid=4280 comm="syz.2.173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 56.886593][ T29] audit: type=1400 audit(1763313122.318:3411): avc: denied { write } for pid=4280 comm="syz.2.173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 56.912627][ T29] audit: type=1400 audit(1763313122.338:3412): avc: denied { unmount } for pid=3324 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:iso9660_t tclass=filesystem permissive=1 [ 56.915638][ T4281] veth3: entered promiscuous mode [ 56.938107][ T4281] veth3: entered allmulticast mode [ 56.938525][ T4282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.998187][ T4282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.007532][ T4287] netlink: 'syz.3.174': attribute type 39 has an invalid length. [ 57.021609][ T29] audit: type=1400 audit(1763313122.398:3413): avc: denied { write } for pid=4280 comm="syz.2.173" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 57.048774][ T42] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.066144][ T4288] sit0: entered promiscuous mode [ 57.071328][ T4288] netlink: 'syz.0.175': attribute type 1 has an invalid length. [ 57.128497][ T4274] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.164672][ T4274] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.174857][ T4274] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.190236][ T4297] veth3: entered promiscuous mode [ 57.195439][ T4297] veth3: entered allmulticast mode [ 57.202478][ T4295] netlink: 'syz.0.177': attribute type 1 has an invalid length. [ 57.217309][ T4295] bond1: entered promiscuous mode [ 57.230621][ T4295] 8021q: adding VLAN 0 to HW filter on device bond1 [ 57.268008][ T4302] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 57.338768][ T4302] 9pnet_fd: Insufficient options for proto=fd [ 57.357247][ T4303] 8021q: adding VLAN 0 to HW filter on device bond1 [ 57.365618][ T4295] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 57.372946][ T4295] IPv6: NLM_F_CREATE should be set when creating new route [ 57.380202][ T4295] IPv6: NLM_F_CREATE should be set when creating new route [ 57.402432][ T4303] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 57.413041][ T4303] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 57.466946][ T4303] bond1: (slave wireguard0): making interface the new active one [ 57.474782][ T4303] wireguard0: entered promiscuous mode [ 57.478711][ T4307] netlink: 'syz.3.180': attribute type 1 has an invalid length. [ 57.483900][ T4303] bond1: (slave wireguard0): Enslaving as an active interface with an up link [ 57.515374][ T4307] bond1: entered promiscuous mode [ 57.520713][ T4307] 8021q: adding VLAN 0 to HW filter on device bond1 [ 57.564648][ T4310] bridge_slave_0: left allmulticast mode [ 57.570340][ T4310] bridge_slave_0: left promiscuous mode [ 57.576303][ T4310] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.595127][ T4310] bridge_slave_1: left allmulticast mode [ 57.600807][ T4310] bridge_slave_1: left promiscuous mode [ 57.606668][ T4310] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.615325][ T4310] bond0: (slave bond_slave_0): Releasing backup interface [ 57.623357][ T4310] bond0: (slave bond_slave_1): Releasing backup interface [ 57.631152][ T4315] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 57.638404][ T4315] IPv6: NLM_F_CREATE should be set when creating new route [ 57.645646][ T4315] IPv6: NLM_F_CREATE should be set when creating new route [ 57.654023][ T4315] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 57.658588][ T4310] team0: Port device team_slave_0 removed [ 57.667571][ T4317] netlink: 'syz.0.181': attribute type 10 has an invalid length. [ 57.676275][ T4310] team0: Port device team_slave_1 removed [ 57.682938][ T4310] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 57.690382][ T4310] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 57.697926][ T4310] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 57.716546][ T4307] 8021q: adding VLAN 0 to HW filter on device bond1 [ 57.723858][ T4307] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 57.734561][ T4307] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 57.750907][ T4307] bond1: (slave wireguard0): making interface the new active one [ 57.758788][ T4307] wireguard0: entered promiscuous mode [ 57.766028][ T4307] bond1: (slave wireguard0): Enslaving as an active interface with an up link [ 57.779938][ T4315] bond1: (slave wireguard1): The slave device specified does not support setting the MAC address [ 57.794520][ T4315] bond1: (slave wireguard1): Enslaving as a backup interface with an up link [ 57.803802][ T4317] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.811878][ T4317] team0: Port device bond0 added [ 57.836448][ T4310] team0 (unregistering): Port device bond0 removed [ 57.911794][ T4325] ip6_vti0 speed is unknown, defaulting to 1000 [ 58.031756][ T4334] netlink: 'syz.4.186': attribute type 6 has an invalid length. [ 58.091976][ T4332] ip6_vti0 speed is unknown, defaulting to 1000 [ 58.207692][ T4338] ip6_vti0 speed is unknown, defaulting to 1000 [ 58.686155][ T4347] sit0: entered promiscuous mode [ 58.718858][ T4347] netlink: 'syz.1.189': attribute type 1 has an invalid length. [ 58.731757][ T4350] tipc: Enabled bearer , priority 0 [ 58.753075][ T4350] tipc: Disabling bearer [ 58.759102][ T4354] loop1: detected capacity change from 0 to 512 [ 58.767809][ T4354] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 58.788466][ T4356] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 58.790758][ T4357] netlink: 'syz.4.191': attribute type 6 has an invalid length. [ 58.812577][ T4354] EXT4-fs (loop1): orphan cleanup on readonly fs [ 58.820033][ T4354] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.192: bg 0: block 248: padding at end of block bitmap is not set [ 58.851881][ T4354] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.192: Failed to acquire dquot type 1 [ 58.913153][ T4354] EXT4-fs (loop1): 1 truncate cleaned up [ 58.919418][ T4354] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 58.944459][ T4356] 9pnet_fd: Insufficient options for proto=fd [ 58.973678][ T4354] Set syz1 is full, maxelem 65536 reached [ 58.997413][ T3315] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.019382][ T4374] __nla_validate_parse: 5 callbacks suppressed [ 59.019396][ T4374] netlink: 48 bytes leftover after parsing attributes in process `syz.1.198'. [ 59.061961][ T4377] Cannot find add_set index 65532 as target [ 59.112816][ T4378] loop3: detected capacity change from 0 to 512 [ 59.137268][ T4377] ip6_vti0 speed is unknown, defaulting to 1000 [ 59.245435][ T4381] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.407468][ T4374] ip6_vti0 speed is unknown, defaulting to 1000 [ 59.409213][ T4381] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.451435][ T4378] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 59.459575][ T4378] EXT4-fs (loop3): orphan cleanup on readonly fs [ 59.467874][ T4378] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #16: comm +}[@: corrupted inode contents [ 59.479374][ T4378] EXT4-fs (loop3): Remounting filesystem read-only [ 59.486098][ T4378] EXT4-fs (loop3): 1 truncate cleaned up [ 59.491838][ T53] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 59.502411][ T53] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 59.521135][ T53] EXT4-fs (loop3): Quota write (off=8, len=24) cancelled because transaction is not started [ 59.541761][ T4378] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 59.554673][ T4378] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.596914][ T4370] ip6_vti0 speed is unknown, defaulting to 1000 [ 59.644126][ T4378] netlink: '+}[@': attribute type 13 has an invalid length. [ 59.662771][ T4378] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 59.876241][ T4390] netlink: 24 bytes leftover after parsing attributes in process `syz.0.211'. [ 59.959834][ T4390] veth5: entered promiscuous mode [ 59.965476][ T4390] veth5: entered allmulticast mode [ 60.028368][ T4410] infiniband : RDMA CMA: cma_listen_on_dev, error -98 [ 60.058645][ T4410] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 60.063488][ T4418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.078824][ T4416] netlink: 32 bytes leftover after parsing attributes in process `syz.0.209'. [ 60.082728][ T4418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.183012][ T4423] loop1: detected capacity change from 0 to 128 [ 60.197482][ T4423] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 60.236473][ T4423] ext4 filesystem being mounted at /43/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 60.286085][ T4423] netlink: 16 bytes leftover after parsing attributes in process `syz.1.213'. [ 60.347522][ T4428] bond2: entered promiscuous mode [ 60.353135][ T4428] 8021q: adding VLAN 0 to HW filter on device bond2 [ 60.361404][ T3315] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 60.383374][ T4428] 8021q: adding VLAN 0 to HW filter on device bond2 [ 60.413336][ T4430] RDS: rds_bind could not find a transport for fe80::bb, load rds_tcp or rds_rdma? [ 60.444259][ T4428] bond2: (slave wireguard1): The slave device specified does not support setting the MAC address [ 60.454880][ T4428] bond2: (slave wireguard1): Setting fail_over_mac to active for active-backup mode [ 60.479917][ T4440] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 60.499623][ T4440] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 60.527066][ T4428] bond2: (slave wireguard1): making interface the new active one [ 60.534880][ T4428] wireguard1: entered promiscuous mode [ 60.544869][ T4428] bond2: (slave wireguard1): Enslaving as an active interface with an up link [ 60.562943][ T4440] bond2: (slave wireguard2): The slave device specified does not support setting the MAC address [ 60.575563][ T4440] bond2: (slave wireguard2): Enslaving as a backup interface with an up link [ 60.576705][ T4444] netlink: 24 bytes leftover after parsing attributes in process `syz.1.220'. [ 60.654957][ T4444] veth3: entered promiscuous mode [ 60.660298][ T4444] veth3: entered allmulticast mode [ 60.695688][ T4459] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.729264][ T4459] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.780591][ T4469] netlink: 4 bytes leftover after parsing attributes in process `syz.0.224'. [ 60.806985][ T4466] loop1: detected capacity change from 0 to 512 [ 60.814184][ T4466] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 60.823012][ T4466] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 60.834557][ T4471] loop4: detected capacity change from 0 to 128 [ 60.854589][ T4466] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4193: comm syz.1.225: Allocating blocks 41-42 which overlap fs metadata [ 60.868760][ T4466] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4193: comm syz.1.225: Allocating blocks 41-42 which overlap fs metadata [ 60.883360][ T4466] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.225: Failed to acquire dquot type 1 [ 60.894977][ T4466] EXT4-fs error (device loop1): mb_free_blocks:2017: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 60.955816][ T4466] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #12: comm syz.1.225: corrupted inode contents [ 60.972651][ T4465] syz.4.226: attempt to access beyond end of device [ 60.972651][ T4465] loop4: rw=1, sector=145, nr_sectors = 16 limit=128 [ 60.992130][ T4466] EXT4-fs error (device loop1): ext4_dirty_inode:6517: inode #12: comm syz.1.225: mark_inode_dirty error [ 61.010374][ T4465] syz.4.226: attempt to access beyond end of device [ 61.010374][ T4465] loop4: rw=1, sector=169, nr_sectors = 8 limit=128 [ 61.023858][ T4465] syz.4.226: attempt to access beyond end of device [ 61.023858][ T4465] loop4: rw=1, sector=185, nr_sectors = 8 limit=128 [ 61.037021][ T4466] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #12: comm syz.1.225: corrupted inode contents [ 61.049221][ T4465] syz.4.226: attempt to access beyond end of device [ 61.049221][ T4465] loop4: rw=1, sector=201, nr_sectors = 8 limit=128 [ 61.062564][ T4466] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #12: comm syz.1.225: mark_inode_dirty error [ 61.071171][ T4465] syz.4.226: attempt to access beyond end of device [ 61.071171][ T4465] loop4: rw=1, sector=217, nr_sectors = 8 limit=128 [ 61.089869][ T4466] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #12: comm syz.1.225: corrupted inode contents [ 61.102042][ T4466] EXT4-fs error (device loop1) in ext4_orphan_del:301: Corrupt filesystem [ 61.109885][ T4465] syz.4.226: attempt to access beyond end of device [ 61.109885][ T4465] loop4: rw=1, sector=233, nr_sectors = 8 limit=128 [ 61.112149][ T4466] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #12: comm syz.1.225: corrupted inode contents [ 61.138400][ T4465] syz.4.226: attempt to access beyond end of device [ 61.138400][ T4465] loop4: rw=1, sector=249, nr_sectors = 8 limit=128 [ 61.151726][ T4466] EXT4-fs error (device loop1): ext4_truncate:4637: inode #12: comm syz.1.225: mark_inode_dirty error [ 61.163465][ T4466] EXT4-fs error (device loop1) in ext4_process_orphan:343: Corrupt filesystem [ 61.172463][ T4465] syz.4.226: attempt to access beyond end of device [ 61.172463][ T4465] loop4: rw=1, sector=265, nr_sectors = 8 limit=128 [ 61.186011][ T4466] EXT4-fs (loop1): 1 truncate cleaned up [ 61.192079][ T4466] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 61.205227][ T4465] syz.4.226: attempt to access beyond end of device [ 61.205227][ T4465] loop4: rw=1, sector=281, nr_sectors = 8 limit=128 [ 61.218671][ T4465] syz.4.226: attempt to access beyond end of device [ 61.218671][ T4465] loop4: rw=1, sector=297, nr_sectors = 8 limit=128 [ 61.232528][ T4466] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 61.266469][ T4466] netlink: 8 bytes leftover after parsing attributes in process `syz.1.225'. [ 61.327009][ T4478] loop1: detected capacity change from 0 to 512 [ 61.371847][ T4481] netlink: 12 bytes leftover after parsing attributes in process `syz.2.227'. [ 61.400526][ T4478] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 61.423363][ T4478] EXT4-fs (loop1): 1 truncate cleaned up [ 61.428299][ T4484] loop3: detected capacity change from 0 to 4096 [ 61.429349][ T4478] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 61.441241][ T4481] netlink: 12 bytes leftover after parsing attributes in process `syz.2.227'. [ 61.457284][ T4484] EXT4-fs: Ignoring removed nomblk_io_submit option [ 61.470122][ T4484] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 61.512123][ T4488] netlink: 12 bytes leftover after parsing attributes in process `syz.2.227'. [ 61.592682][ T4480] random: crng reseeded on system resumption [ 61.623905][ T29] kauditd_printk_skb: 657 callbacks suppressed [ 61.623919][ T29] audit: type=1400 audit(1763313135.093:4059): avc: denied { remove_name } for pid=4476 comm="syz.1.238" name="file0" dev="loop1" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 61.661375][ T29] audit: type=1400 audit(1763313135.093:4060): avc: denied { rename } for pid=4476 comm="syz.1.238" name="file0" dev="loop1" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 61.810805][ T29] audit: type=1400 audit(1763313135.153:4061): avc: denied { read } for pid=4482 comm="syz.3.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 61.830744][ T29] audit: type=1400 audit(1763313135.293:4062): avc: denied { map } for pid=4479 comm="syz.4.229" path="/proc/sys/net/ipv4/vs/drop_entry" dev="proc" ino=8716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_net_t tclass=file permissive=1 [ 61.887931][ T3315] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 62.347184][ T4512] validate_nla: 1 callbacks suppressed [ 62.347199][ T4512] netlink: 'syz.1.236': attribute type 1 has an invalid length. [ 62.366317][ T4510] veth5: entered promiscuous mode [ 62.371862][ T4510] veth5: entered allmulticast mode [ 62.379821][ T29] audit: type=1326 audit(1763313135.843:4063): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4509 comm="syz.4.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdeeea4f6c9 code=0x7ffc0000 [ 62.409425][ T3324] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 62.432268][ T4512] bond1: entered promiscuous mode [ 62.435255][ T29] audit: type=1326 audit(1763313135.893:4064): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4509 comm="syz.4.237" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdeeea4f6c9 code=0x7ffc0000 [ 62.437626][ T4512] 8021q: adding VLAN 0 to HW filter on device bond1 [ 62.490578][ T4516] 8021q: adding VLAN 0 to HW filter on device bond1 [ 62.502768][ T4516] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 62.513479][ T4516] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 62.518798][ T4512] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 62.530252][ T4512] IPv6: NLM_F_CREATE should be set when creating new route [ 62.537458][ T4512] IPv6: NLM_F_CREATE should be set when creating new route [ 62.545740][ T4512] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 62.556733][ T4516] bond1: (slave wireguard0): making interface the new active one [ 62.564551][ T4516] wireguard0: entered promiscuous mode [ 62.580205][ T29] audit: type=1326 audit(1763313136.043:4065): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4528 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f961c6cf6c9 code=0x7ffc0000 [ 62.603724][ T29] audit: type=1326 audit(1763313136.043:4066): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4528 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f961c6cf6c9 code=0x7ffc0000 [ 62.611024][ T4516] bond1: (slave wireguard0): Enslaving as an active interface with an up link [ 62.627122][ T29] audit: type=1326 audit(1763313136.043:4067): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4528 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f961c6cf6c9 code=0x7ffc0000 [ 62.647172][ T4512] bond1: (slave wireguard1): The slave device specified does not support setting the MAC address [ 62.660038][ T29] audit: type=1326 audit(1763313136.043:4068): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4528 comm="syz.2.243" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f961c6cf6c9 code=0x7ffc0000 [ 62.697068][ T4537] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 62.716749][ T4512] bond1: (slave wireguard1): Enslaving as a backup interface with an up link [ 63.022818][ T4546] veth7: entered promiscuous mode [ 63.028307][ T4546] veth7: entered allmulticast mode [ 63.347192][ T4558] bond0 (unregistering): Released all slaves [ 63.358984][ T4542] ip6_vti0 speed is unknown, defaulting to 1000 [ 63.843042][ T4567] netlink: 'syz.0.260': attribute type 39 has an invalid length. [ 64.193636][ T4569] random: crng reseeded on system resumption [ 64.204963][ T4569] __nla_validate_parse: 18 callbacks suppressed [ 64.204979][ T4569] netlink: 8 bytes leftover after parsing attributes in process `syz.1.249'. [ 64.295995][ T4578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.252'. [ 64.353978][ T4569] netlink: 8 bytes leftover after parsing attributes in process `syz.1.249'. [ 64.362995][ T4582] smc: net device bond0 applied user defined pnetid SYZ0 [ 64.370399][ T4582] smc: net device bond0 erased user defined pnetid SYZ0 [ 64.714163][ T4596] loop4: detected capacity change from 0 to 4096 [ 64.722724][ T4596] EXT4-fs: Ignoring removed nomblk_io_submit option [ 64.723560][ T4594] netlink: 24 bytes leftover after parsing attributes in process `syz.3.259'. [ 64.743146][ T4596] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 64.762755][ T4584] netlink: 'syz.0.255': attribute type 13 has an invalid length. [ 64.789569][ T4584] gretap0: refused to change device tx_queue_len [ 64.796296][ T4584] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 64.856462][ T4594] veth3: entered promiscuous mode [ 64.862172][ T4594] veth3: entered allmulticast mode [ 64.872655][ T4597] random: crng reseeded on system resumption [ 64.883888][ T4597] netlink: 8 bytes leftover after parsing attributes in process `syz.1.269'. [ 64.894024][ T4597] netlink: 8 bytes leftover after parsing attributes in process `syz.1.269'. [ 64.906971][ T4605] loop3: detected capacity change from 0 to 512 [ 64.941667][ T4605] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 64.971641][ T4605] EXT4-fs (loop3): 1 truncate cleaned up [ 64.987046][ T4608] netlink: 24 bytes leftover after parsing attributes in process `syz.0.262'. [ 64.997209][ T4605] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 65.077184][ T4608] veth9: entered promiscuous mode [ 65.082728][ T4608] veth9: entered allmulticast mode [ 65.115409][ T4612] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 65.135159][ T4612] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 65.160302][ T4612] can0: slcan on ttyS3. [ 65.189303][ T3322] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 65.201315][ T4612] can0 (unregistered): slcan off ttyS3. [ 65.219013][ T4620] capability: warning: `syz.1.263' uses deprecated v2 capabilities in a way that may be insecure [ 65.278643][ T3324] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 65.293833][ T4623] netlink: 'syz.4.265': attribute type 39 has an invalid length. [ 65.365333][ T4635] SELinux: Context system_u:object_r:restorecond_exec_t:s0 is not valid (left unmapped). [ 65.432211][ T4635] netlink: 'syz.3.267': attribute type 3 has an invalid length. [ 65.466452][ T4647] netlink: 'syz.4.268': attribute type 27 has an invalid length. [ 65.479546][ T4647] sit0: left promiscuous mode [ 65.563805][ T4647] veth3: left promiscuous mode [ 65.568649][ T4647] veth3: left allmulticast mode [ 65.575899][ T4647] veth5: left promiscuous mode [ 65.580740][ T4647] veth5: left allmulticast mode [ 65.590178][ T4651] loop3: detected capacity change from 0 to 512 [ 65.600298][ T4651] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 65.609134][ T4651] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 65.638453][ T4654] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.647380][ T4654] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 65.648453][ T4651] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:4193: comm syz.3.270: Allocating blocks 41-42 which overlap fs metadata [ 65.663208][ T4267] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.678233][ T4651] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:4193: comm syz.3.270: Allocating blocks 41-42 which overlap fs metadata [ 65.685066][ T4267] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.707326][ T4267] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.707972][ T4651] EXT4-fs error (device loop3): ext4_acquire_dquot:6945: comm syz.3.270: Failed to acquire dquot type 1 [ 65.715793][ T4267] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.737679][ T4651] EXT4-fs error (device loop3): mb_free_blocks:2017: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 65.752440][ T4651] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #12: comm syz.3.270: corrupted inode contents [ 65.767090][ T4651] EXT4-fs error (device loop3): ext4_dirty_inode:6517: inode #12: comm syz.3.270: mark_inode_dirty error [ 65.778808][ T4651] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #12: comm syz.3.270: corrupted inode contents [ 65.791153][ T4651] EXT4-fs error (device loop3): __ext4_ext_dirty:206: inode #12: comm syz.3.270: mark_inode_dirty error [ 65.801581][ T4673] netlink: 'syz.4.271': attribute type 4 has an invalid length. [ 65.803121][ T4651] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #12: comm syz.3.270: corrupted inode contents [ 65.822292][ T4651] EXT4-fs error (device loop3) in ext4_orphan_del:301: Corrupt filesystem [ 65.831236][ T4651] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #12: comm syz.3.270: corrupted inode contents [ 65.843789][ T4651] EXT4-fs error (device loop3): ext4_truncate:4637: inode #12: comm syz.3.270: mark_inode_dirty error [ 65.853973][ T4675] netlink: 24 bytes leftover after parsing attributes in process `syz.1.272'. [ 65.866117][ T4651] EXT4-fs error (device loop3) in ext4_process_orphan:343: Corrupt filesystem [ 65.885827][ T4651] EXT4-fs (loop3): 1 truncate cleaned up [ 65.892320][ T4651] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 65.906392][ T4651] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 65.935530][ T4675] veth5: entered promiscuous mode [ 65.941109][ T4675] veth5: entered allmulticast mode [ 65.941349][ T4651] netlink: 8 bytes leftover after parsing attributes in process `syz.3.270'. [ 65.987367][ T4679] ip6_vti0 speed is unknown, defaulting to 1000 [ 66.032939][ T4684] netlink: 'syz.4.274': attribute type 1 has an invalid length. [ 66.040621][ T4684] netlink: 224 bytes leftover after parsing attributes in process `syz.4.274'. [ 66.050020][ T4267] Bluetooth: hci0: Frame reassembly failed (-84) [ 66.063804][ T4684] loop4: detected capacity change from 0 to 1024 [ 66.081394][ T4684] EXT4-fs: Ignoring removed nomblk_io_submit option [ 66.088047][ T4684] EXT4-fs: Ignoring removed orlov option [ 66.094074][ T4684] ext2: Bad value for 'mb_optimize_scan' [ 66.151695][ T4693] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 66.233256][ T4695] lo: entered allmulticast mode [ 66.239422][ T4695] tunl0: entered allmulticast mode [ 66.246095][ T4695] gre0: entered allmulticast mode [ 66.252426][ T4695] gretap0: entered allmulticast mode [ 66.259235][ T4695] erspan0: entered allmulticast mode [ 66.267542][ T4695] ip_vti0: entered allmulticast mode [ 66.274782][ T4695] ip6_vti0: entered allmulticast mode [ 66.281930][ T4695] sit0: entered allmulticast mode [ 66.288033][ T4695] ip6tnl0: entered allmulticast mode [ 66.294432][ T4695] ip6gre0: entered allmulticast mode [ 66.301527][ T4695] syz_tun: entered allmulticast mode [ 66.307689][ T4695] ip6gretap0: entered allmulticast mode [ 66.314537][ T4695] vcan0: entered allmulticast mode [ 66.320608][ T4695] bond0: entered allmulticast mode [ 66.325779][ T4695] bond_slave_0: entered allmulticast mode [ 66.331533][ T4695] bond_slave_1: entered allmulticast mode [ 66.338932][ T4695] team0: entered allmulticast mode [ 66.344200][ T4695] team_slave_0: entered allmulticast mode [ 66.349965][ T4695] team_slave_1: entered allmulticast mode [ 66.357320][ T4695] dummy0: entered allmulticast mode [ 66.362782][ T4695] nlmon0: entered allmulticast mode [ 66.368997][ T4695] caif0: entered allmulticast mode [ 66.374594][ T4695] batadv0: entered allmulticast mode [ 66.381262][ T4695] vxcan0: entered allmulticast mode [ 66.387666][ T4695] vxcan1: entered allmulticast mode [ 66.395599][ T4695] veth0: entered allmulticast mode [ 66.402294][ T4695] veth1: entered allmulticast mode [ 66.408513][ T4695] wg0: entered allmulticast mode [ 66.414703][ T4695] wg1: entered allmulticast mode [ 66.426520][ T4695] wg2: entered allmulticast mode [ 66.432304][ T4695] veth0_to_bridge: entered allmulticast mode [ 66.439649][ T4695] bridge_slave_0: entered allmulticast mode [ 66.449227][ T4695] veth1_to_bridge: entered allmulticast mode [ 66.456654][ T4695] bridge_slave_1: entered allmulticast mode [ 66.464058][ T4695] veth0_to_bond: entered allmulticast mode [ 66.472305][ T4695] veth1_to_bond: entered allmulticast mode [ 66.480376][ T4695] veth0_to_team: entered allmulticast mode [ 66.489260][ T4695] veth1_to_team: entered allmulticast mode [ 66.498664][ T4695] veth0_to_batadv: entered allmulticast mode [ 66.506180][ T4695] batadv_slave_0: entered allmulticast mode [ 66.513943][ T4695] veth1_to_batadv: entered allmulticast mode [ 66.521459][ T4695] batadv_slave_1: entered allmulticast mode [ 66.528802][ T4695] xfrm0: entered allmulticast mode [ 66.536697][ T4695] veth0_to_hsr: entered allmulticast mode [ 66.544013][ T4695] hsr_slave_0: entered allmulticast mode [ 66.550994][ T4695] veth1_to_hsr: entered allmulticast mode [ 66.558505][ T4695] hsr_slave_1: entered allmulticast mode [ 66.565640][ T4695] hsr0: entered allmulticast mode [ 66.571851][ T4695] veth1_virt_wifi: entered allmulticast mode [ 66.578934][ T4695] veth0_virt_wifi: entered allmulticast mode [ 66.586731][ T4695] veth1_vlan: entered allmulticast mode [ 66.593559][ T4695] veth0_vlan: entered allmulticast mode [ 66.600790][ T4695] vlan0: entered allmulticast mode [ 66.607224][ T4695] vlan1: entered allmulticast mode [ 66.613507][ T4695] macvlan0: entered allmulticast mode [ 66.619661][ T4695] macvlan1: entered allmulticast mode [ 66.626545][ T4695] ipvlan0: entered allmulticast mode [ 66.632289][ T4695] ipvlan1: entered allmulticast mode [ 66.637769][ T4695] veth1_macvtap: entered allmulticast mode [ 66.645050][ T4695] veth0_macvtap: entered allmulticast mode [ 66.652245][ T4695] macvtap0: entered allmulticast mode [ 66.658710][ T4695] macsec0: entered allmulticast mode [ 66.665123][ T4695] geneve0: entered allmulticast mode [ 66.671707][ T4695] geneve1: entered allmulticast mode [ 66.677885][ T4695] syztnl1: entered allmulticast mode [ 66.683848][ T4695] netdevsim netdevsim2 eth0: entered allmulticast mode [ 66.691095][ T4695] netdevsim netdevsim2 eth1: entered allmulticast mode [ 66.698742][ T4695] netdevsim netdevsim2 eth2: entered allmulticast mode [ 66.706296][ T4695] netdevsim netdevsim2 eth3: entered allmulticast mode [ 66.713604][ T4695] veth2: entered allmulticast mode [ 66.720093][ T4695] ip6_vti1: entered allmulticast mode [ 66.726034][ T4695] syzkaller0: entered allmulticast mode [ 66.732159][ T4699] syzkaller0: entered promiscuous mode [ 66.929372][ T4708] netlink: 'syz.2.280': attribute type 39 has an invalid length. [ 66.933583][ T29] kauditd_printk_skb: 486 callbacks suppressed [ 66.933598][ T29] audit: type=1400 audit(1763313140.403:4551): avc: denied { ioctl } for pid=4707 comm="syz.4.281" path="socket:[8003]" dev="sockfs" ino=8003 ioctlcmd=0x8937 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 66.970701][ T29] audit: type=1326 audit(1763313140.413:4552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4703 comm="syz.3.279" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 66.994316][ T29] audit: type=1326 audit(1763313140.413:4553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4703 comm="syz.3.279" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 67.017558][ T29] audit: type=1326 audit(1763313140.413:4554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4703 comm="syz.3.279" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 67.018101][ T4713] netlink: 'syz.0.289': attribute type 1 has an invalid length. [ 67.040892][ T29] audit: type=1326 audit(1763313140.413:4555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4703 comm="syz.3.279" exe="/root/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 67.071860][ T29] audit: type=1326 audit(1763313140.413:4556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4703 comm="syz.3.279" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 67.095274][ T29] audit: type=1326 audit(1763313140.413:4557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4703 comm="syz.3.279" exe="/root/syz-executor" sig=0 arch=c000003e syscall=310 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 67.095305][ T29] audit: type=1326 audit(1763313140.413:4558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4703 comm="syz.3.279" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 67.095330][ T29] audit: type=1326 audit(1763313140.413:4559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4703 comm="syz.3.279" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 67.095369][ T29] audit: type=1326 audit(1763313140.413:4560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4703 comm="syz.3.279" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7cbadef6c9 code=0x7ffc0000 [ 67.109489][ T4710] ip6_vti0 speed is unknown, defaulting to 1000 [ 67.124237][ T4709] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.225360][ T4709] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.257675][ T4720] loop3: detected capacity change from 0 to 2048 [ 67.264824][ T4720] ================================================================== [ 67.272910][ T4720] BUG: KCSAN: data-race in fsnotify_detach_mark / fsnotify_handle_inode_event [ 67.281780][ T4720] [ 67.284190][ T4720] write to 0xffff888131ca5404 of 4 bytes by task 3925 on cpu 0: [ 67.291809][ T4720] fsnotify_detach_mark+0xba/0x160 [ 67.296921][ T4720] fsnotify_destroy_mark+0x70/0x150 [ 67.302114][ T4720] __se_sys_inotify_rm_watch+0xe8/0x170 [ 67.307661][ T4720] __x64_sys_inotify_rm_watch+0x31/0x40 [ 67.313216][ T4720] x64_sys_call+0x2e95/0x3000 [ 67.317889][ T4720] do_syscall_64+0xd2/0x200 [ 67.322384][ T4720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.328264][ T4720] [ 67.330568][ T4720] read to 0xffff888131ca5404 of 4 bytes by task 4720 on cpu 1: [ 67.338090][ T4720] fsnotify_handle_inode_event+0x125/0x220 [ 67.343888][ T4720] fsnotify+0x13cf/0x14b0 [ 67.348203][ T4720] __fsnotify_parent+0x2ed/0x330 [ 67.353124][ T4720] __fput+0x1de/0x650 [ 67.357091][ T4720] fput_close_sync+0x6e/0x120 [ 67.361751][ T4720] __x64_sys_close+0x56/0xf0 [ 67.366325][ T4720] x64_sys_call+0x273c/0x3000 [ 67.370994][ T4720] do_syscall_64+0xd2/0x200 [ 67.375484][ T4720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.381380][ T4720] [ 67.383687][ T4720] value changed: 0x00000003 -> 0x00000000 [ 67.389387][ T4720] [ 67.391711][ T4720] Reported by Kernel Concurrency Sanitizer on: [ 67.397935][ T4720] CPU: 1 UID: 0 PID: 4720 Comm: syz.3.282 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 67.409125][ T4720] Tainted: [W]=WARN [ 67.412910][ T4720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 67.422962][ T4720] ================================================================== [ 67.466865][ T4720] EXT4-fs (loop3): shut down requested (2) [ 68.088365][ T4720] EXT4-fs unmount: 1 callbacks suppressed [ 68.088381][ T4720] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000900. [ 68.131135][ T3633] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 68.131338][ T3524] Bluetooth: hci0: command 0x1003 tx timeout