last executing test programs: 7.270831285s ago: executing program 4 (id=40): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[], 0x48}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x41, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x10, 0x20000}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) 7.019687017s ago: executing program 4 (id=46): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x84}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0xa7f10723c5e5444d}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_generate\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000400)='signal_generate\x00', r2}, 0x18) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) 6.94154214s ago: executing program 4 (id=48): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000000c0)={@map, r0, 0x5}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) syz_usb_connect(0x2, 0xfffffffffffffe86, 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) 4.349861231s ago: executing program 4 (id=130): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x1000, 0x0) mount$bind(&(0x7f0000000440)='./file0\x00', &(0x7f0000000000)='./file0/file0\x00', 0x0, 0x10a5840, 0x0) move_mount(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', r0, 0x0, 0x272) 4.311847343s ago: executing program 4 (id=131): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f000000850000002300000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7f, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000980)='mm_page_free\x00', r0, 0x0, 0x3}, 0x18) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x9, 0x2) 4.099050982s ago: executing program 4 (id=138): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_clone(0x40042700, 0x0, 0x0, 0x0, 0x0, 0x0) ftruncate(r0, 0xc17a) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000080)=0x9, 0x8, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) 4.074028914s ago: executing program 32 (id=138): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_clone(0x40042700, 0x0, 0x0, 0x0, 0x0, 0x0) ftruncate(r0, 0xc17a) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000080)=0x9, 0x8, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) 1.394752689s ago: executing program 2 (id=200): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x200000a, 0x13, r1, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0xfffff000) 1.351791121s ago: executing program 2 (id=202): bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x18, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x445bd}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000100)='io_uring_register\x00', r0}, 0x10) r1 = io_uring_setup(0x2a6a, &(0x7f0000000000)={0x0, 0xb91f, 0x80, 0x1, 0x28b}) syz_io_uring_setup(0x17dc, &(0x7f0000000100)={0x0, 0x59c4, 0x8, 0x1000, 0x5cd}, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r1, 0xd, &(0x7f0000000140)={0x7, 0x0, 0x0, 0x0}, 0x20) 1.270901765s ago: executing program 2 (id=206): r0 = socket(0x1e, 0x805, 0x0) connect$tipc(r0, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{}, 0x2}}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000006"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) connect$tipc(r0, &(0x7f0000000600)=@id={0x1e, 0x3, 0x4ca383e542dc3e9a, {0x2}}, 0x10) close(r0) 1.187372818s ago: executing program 2 (id=209): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r0}, &(0x7f0000000800), &(0x7f0000000840)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r3, 0x0, 0x0}, 0x20) 1.15168245s ago: executing program 0 (id=210): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000006"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000007000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='kfree\x00', r1, 0x0, 0x3}, 0x18) creat(&(0x7f00000000c0)='./file0\x00', 0x48) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000240)=@v3={0x3000000, [{0xffff4a0c, 0x7}, {0x2}], 0xee01}, 0x18, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) 1.117547171s ago: executing program 2 (id=211): unshare(0x6a040000) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSMRU1(r1, 0x40047452, &(0x7f0000000300)=0x5) 1.115420351s ago: executing program 0 (id=212): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x18, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r1, 0x0, 0x4}, 0x18) r2 = socket$netlink(0x10, 0x3, 0xb) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2fffffffd}, 0xc) close(r2) 1.057598354s ago: executing program 0 (id=214): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x204000, &(0x7f0000000000), 0x106, 0x2}}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000001c0), 0x13f, 0x8}}, 0x20) close(r0) 980.374517ms ago: executing program 0 (id=215): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0, 0x0, 0x97}, 0x18) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x101201, 0x0) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f0000000600)=0x14) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f00000000c0)=0xffffffffffffffff) close(r1) 876.197812ms ago: executing program 0 (id=220): bpf$PROG_LOAD(0x5, &(0x7f0000001c80)={0x1d, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x15, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x2041, 0x0) write$binfmt_aout(r0, &(0x7f0000000180)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0xfe, "0062ba7d82000000160000000000f738096304"}) r1 = syz_open_pts(r0, 0x80) r2 = dup3(r1, r0, 0x80000) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000000)) 741.829927ms ago: executing program 2 (id=221): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x420000008b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000001c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="24000000390009002cbd70000000000004000000040000000c000180060006"], 0x24}}, 0x0) 679.18848ms ago: executing program 5 (id=226): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x7, 0x8604, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x8, 0x6}, 0x0, 0x10000, 0x0, 0x8, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_io_uring_setup(0xa4d, &(0x7f0000000480)={0x0, 0x0, 0x80, 0x1, 0x24f}, &(0x7f00000000c0)=0x0, &(0x7f0000000340)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2c, 0x0, 0x0, 0x7}]}, 0xffffffc8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x42, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, {0x2}}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) 524.521847ms ago: executing program 3 (id=230): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) close(0x3) 509.453187ms ago: executing program 5 (id=231): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000006c0)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) setsockopt$inet6_int(r0, 0x29, 0x38, &(0x7f0000000200)=0x8, 0x4) recvmmsg(r0, &(0x7f0000003100)=[{{0x0, 0x0, 0x0}, 0xe5}], 0x1, 0x40000000, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20040000, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 505.935918ms ago: executing program 3 (id=232): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x441, 0x0) write$binfmt_aout(r0, &(0x7f00000002c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0xe64, 0x5, 0x50, "0062ba7d82000000000000000000f7ffffff00"}) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000000)={0x2f, 0x3, 0xfffd, 0xfff, 0x10, "0b12e36e7e3ad386"}) dup3(r1, r0, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000001100)=0x12) 432.34111ms ago: executing program 1 (id=233): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x12, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r2}, 0x10) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e20, 0x0, @loopback, 0x4}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000e00)=[{{&(0x7f0000000680)={0xa, 0x4e22, 0x7, @private2, 0xfff}, 0x1c, &(0x7f0000000b80)=[{&(0x7f0000000800)="02df00f275", 0x5}], 0x1}}], 0x1, 0x885) 405.821232ms ago: executing program 5 (id=234): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='kfree\x00', r0}, 0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000003040)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000003100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002bbd7000fbdbdf25020000000a000900aaaaaaaaaa44000008000300", @ANYRES32=r4, @ANYBLOB='\b\x00\v'], 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x20040084) 378.958243ms ago: executing program 1 (id=235): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x80, 0x4, 0x28}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000f00)='kfree\x00', r1}, 0x18) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$smc(&(0x7f00000033c0), 0xffffffffffffffff) sendmsg$SMC_PNETID_ADD(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x34, r3, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'hsr0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x24040000}, 0x800) sendmsg$SMC_PNETID_FLUSH(r2, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001a40)={&(0x7f00000019c0)={0x14, r3, 0x1, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x800) 338.055095ms ago: executing program 5 (id=236): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x12}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x8081) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800019f000000000000000002000000000000000800010001000000040004"], 0x24}, 0x1, 0x0, 0x0, 0x4005}, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) 324.726325ms ago: executing program 1 (id=237): sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x2a, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=@newtfilter={0x88, 0x2c, 0xd27, 0x3, 0x0, {0x0, 0x0, 0x0, r2, {0xfffa, 0x5}, {}, {0x1c, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x1, 0x7, 0xfc, 0x3}, 0xb}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x88}}, 0x4000000) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 298.717947ms ago: executing program 1 (id=238): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) connect$inet(r0, &(0x7f0000000280)={0x2, 0x4, @multicast1}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000280)='kmem_cache_free\x00', r2, 0x0, 0x200000000000006}, 0x18) sendmmsg$inet(r0, &(0x7f0000004540)=[{{&(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x7e1f, 0x0}, 0xee0000b0}, {{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001100)="15b26f226e2966667482d50903b0a8d92ccd9e69d5cc4cb3d467a670b237a9225fb56c0f7ea725dee27c4bb43bb50c6748c83b71d59f0537405dfab648c096607340fac939a2efd31cbe2f8ca29c409e87ea0974b7bceff9afef5d07d691575f5115f2f961ad488e3386036913e98181a6034febaab853a3e928b9035b0e3a8e1cb393c70f6d0448970e0af2476f8b923ee09c19deca55d58f70e8eeff55dda6381cb96afe97196c0af0a8fd450a1447a1a521e2c211fb84cbcf4aebd31298972ec6bea1764fbde5500fa30c5f2459cff4d7f123ab94cfd5762d586ec7a28abc2f8c9e608f8f964b96ecb0883d60d444f317834a3d734cb304051a60d1a084a84da8f9a23a1b9d4951c0a81985c63ae193f40e9deb358b2f08553324fd6086be9e70e5061568abefebcda50e70f4dab2e4dc0cf6d85aced044d7005326922886194895267165f7f592036ebe11dcf1cad98f5cda766eaea90fb4cb5e793525126c7594f8599055192d63a81d3cd26aadd50983f1c3f1d4655c1b5f59e80f733e3abc4792b760729fd26298ef15141cf76cc4", 0xc3}, {&(0x7f0000000d80)="7d68e6de85f9b0cbc9d710267f321ec64eab043ecad9af7e01e9463218ec45924a99867163e468d36a682fadd749caa325e685d75559a87139e02fae7271be8f55671cfd32a09896278d1941370174720838039d0989bc3394b8a4c4f4a30f0496be313d6d60fe47966c634a3ee1f659e8ef310647725bda0130d5de5028220a4cf5fc808a75694738ee26cb21302b4bba4265b845a5d5dce706d9820c6936b122f9658446d74a9016b94424971dd443a6907eb5c73b6b200e92b23f2c36a214729b0bc231511e4c", 0xc8}, {&(0x7f0000000380)="73fd71361e8d6c80ae1bc9953e2a4aeac7a314273066fc7f65a51969b46df1774bb0be94ccd4824f2d57ad2cd37242b1258402395481f9f07e067652e52aa8ccefcd0962ba0c48757b68d493f3ad702e65d4daa7dfc1605a173185472ae12470eea64c70ef4e64793b8a830447de0f423bef3964934eef4243cac42939ba6fa68d821b9373b5f3e2c26e7ca75ed8fb3203aef3a6637cecdd0251532b99537e02f604058f50e66c8a657d59beeed127695475f082d3d2b9790181fc987ad000ac00887d1506be89f388ecb405660b4ea196ee8f5a92b12ec43bbf49567db613d478ebe2358364f7600bf4f80ef4b2756fb13416c4fa22880cc96a03f07888575aedb001d5a74bb2f906797912b5ac080a0a3d361425f1a92ab03bbe65d5dcb235f43b5ad1162a16ebdc647baac013bf076945126cdd5a080853976a97ad55184601102fbb8df86b21aa8162858d74465c5fb7dc766602a3567f6eaf441f85ec50ca7fb3a4fdb450d1420531da25d01a412958a5e3895c59542238cf8e188e7fb5641eb24a5f1819bf8d2e9dd6c1d0e93564d723e311db9cd268bb1e477036e822b135cdbaf40f812aa7db01d22c829ab01ae24997dae96ddeed49e62d285701d5419e3f94a8b95790cf5a296ed15bffae1f71470c6a6eda872528844a2df42590d898630263cab5cccec57b7cea365ad8c91bfbe7cb419635ce6bf340a56115c0ad922b6fade9538e543bc5def2a85d35ab16d20c219c4733837be2c14ba4d3d32c3a6882ce6857626f55109b4cdcb634425d710bf3108f9b31b4af0cc17a58e49e871a56126dd8bed08e038ba64008587237b3442d28032e52fc9fae1a5784ba59d0edfa03d38352724903ed6f6970b3f4dfa6e40bf933b6765c6ee648174765f1e8ec71b80cac86abd065a3005b40a43a665707cc590997c5048183006a9dd8026d39def05950183b3d4f12f4e1644ef78cddac7c5569985c2c232bb350f28857675339e53f63a868704d2e0b38993dc57a02d3e297fc9a5b9384622841018c303a05bac25d509df5a2d0e3232927283fcc3ec67e4fa7b71d22f115cf693851dcceab4bce38cbfbb32829e211cdcb6a359e14fe416663541050d340aef2555dbd292bd9cbab8fcf20378149cc994569c2bc95fb33fd2d9321b8ac8e5160b02e202492f470eb719a8f2ac3a4be37ea0918b54b14789b7aa228d47f7b13fd9af608740c5a8fe02109a7cc0e555b22628ef790e513ecadfd338d30aed8ca219e64ee4fb0bd0e21e5101bf2072ffa071eb1aa0454caccc015ff1e166813f819a142b56a22e4ff387bb319288a0ef747c6fc8fdee3a0e193b0d086eb816e97e0322fcdaa30da61cd26ac9d8d0748fccd911ce0fd4adc953e9486e137fe66bc8aedfd5b78c562ebfc578ac9f96a453311766564541e16955e30b95914e9411a0b4cd95e0d8732d5ff7a4f921ef41d986a195334266585353b16b9449955523913a30c087532bcb899f733af3abea59baea174cf04359547a633b5f8a582ae3ef12a1d0125bef8c6e8c9fb589d3597c5ab3879491b0c5e3607203f06836a6805d3f7979c4325f9fecb2aceddedb272237132460cda812ef7d613a585898d59f92ef68ec95f12b47b440f6d899ecbfab48055e0c1605ba4cd9dbc17c4cbfec8a953ebbd38c45a6737a57ee58e21a20e530171137968ae4f0d0366cdb0b9d6a4667b011fcd7cd9e77364e5221989d8f0d80793260e748e3bd394849c090c744f6044328304cd6f02e941c5405647daffc1fd2f2864b37f92bbf4931c8e4a7c6bafd0ea79d39d330e70e6776bf6a926de227e5a43653bba04883e98d67bb64aa86e8bf271ba87604bc598e47f2992c7618ad25068860a481554b53352c7339de7e79c3bd1aed5bef8f398432858c888a5d8651969ea40eb3d486e9fe61d49b20500fdfd1548f567da970103d36730657c35d03d2c36b142665f62203b1fb12d616478cfef6f38b34cda87a634dd06d359f33e98b94a5e5b46b2a8d73126352d1d5b65af75055455cc903e384c41876fbdff935d047284d9d203b147a6ba0e9cb50beef7798886c33d2f2f0c0d9abe0e32c7c809f8b0b28fc59471987353c862a311776b8275bf319d5cb9a59f8f103b6e567ef5dd8859973cc3fe41e356bf5bd3186240e49286977eca36a8ad44185973b276cd7958b73e14a221b7fd567818bebf54ad27ee95161bd2aeeb356482ff467500a7d36f0464f58a591ec6b728f984ec78d0abe14c6d3411ac3ffc4c3179d1f95d029f26cceb545723519d3d4209a2b1243e78767273c13dc2bd320512674b6f1a50313bae7b9d16aebb476dbc829e8fd8dd46a1696efaff5795cf75de57c90f05ed9ef4a5cdfbf20d3d9ed95fb4114b1d5c9ade0856212e7ba330ce5bccf2c993dff89112b28bd3b17d3fcfacef7590f62bf948977dd79e2d8025946c80bf263e34035409b5ba1443d4929727180761bd56d258c3670a0aa4de21111fc3172367582de2d164ff3a18d0696b8dd8e5c1423b2ea1e2c0cfe141e4cf04f8cdaed48976b94c40d6a581300458661bbdbfeeb4969af6319eb1798843d0872f68f0c6537bbc9c7dd1e9b0564bf442d8d25f8aa884aba1df074d374f99750d9227bb821ba0355f60de2829a5c8cd47c89d29a2e3d7d53d59db5c3ace8f484664202c210c68a3b33076fb00d59938e84fbad6d6618c0bb89cf94035fa2de4da351e0d71df416450ea7ec3af33aa5c0313c63e654bd79c73b39dc1933636956761058d76648746daca469f8fce62c17a8160cdefc6a927eef9ec4a8dd684e46f35282546ce2362ab8afedd39bf699fd7c2cde538f52ea43c08558f42ba77b2986b800c45fa76a130b30919b3e1d504573e3c1e7dd2dc5d81379df53d736511f1da4ad8791e46adb27bb5c38129e89edda0aed99dcc03fe400f7d05d48e3e9e17744e8487f8ac464c86f7332211fb9799e9d27a6832d5f17ccd1a2da255f6da047e4728dd80860c04391bca4b7833f0346866401ec20033bcf6dfa85fd1520de5a03b4f9f6f5d2f8d7b6e7d7df1cbe5c05e23e080cf335639c94c48aaeb0bfebbe79530d67d35fb101c91839954c0e50dd4b90a86428b22b0be1e906fee30f68d7ce4bf9c68eafe695f07f5e4e4d473d77104b7b1b5dcfeb84e8c83624c0068d4e1cccfe740f8e5d5699603f8481ef2a1f2d4b8fd2314c5cb1985fe34cf8ede7d2e8bddea269422490903489c7f5951114d7ccb29a19455a987d538955712a460243105b25ccb6e6f34c370a6bbb234bee150dbcea5188e45305253f1014f7c0b5d60d517d2d05707f5ca9249a921d6c5307caf41deca0509b49102d801320db65c00f6e1c05fb8c2e1cc554673bf6168dd64086b19af28eec508fd0c304837e802173ac9947c4d73929c61d9632ab929a25f2a04350954612c2de705c1c25215284fe933fc8ccfd30ab3fc9ff5e04dd68d4720d95a29d6da176ac9d332c9ce77358f3c262777ea828fe6473638bc77be2aa586a3733e275744bc42c3742c1ad8f89d25c31958902f2f498c58fc85e9b78fb7a331734cb081cfa9ccfd262df927c0ff46983f8765af4add3532de2b91f2436df028", 0x9fd}], 0x3}}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)="a6", 0x1}], 0x300}}], 0x3, 0x0) 272.126728ms ago: executing program 5 (id=239): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000400000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2e, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r0}, &(0x7f0000000080), &(0x7f00000006c0)='%-010d \x00'}, 0x20) r2 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$inet(r2, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000080)="da", 0x1}], 0x1, &(0x7f0000000040)=ANY=[], 0xd0}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="b8", 0x1}], 0x1}}], 0x2, 0x0) close(r2) 257.634239ms ago: executing program 1 (id=240): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f02, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000edff0000000000000000850000000f00000018010000646c012500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x17, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000711205000000000095"], 0x0, 0x5}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000740)='scsi_dispatch_cmd_start\x00', r1}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000740)='scsi_dispatch_cmd_start\x00', r0}, 0x18) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 225.81618ms ago: executing program 5 (id=241): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000600)='./file0\x00', 0xc8d0, &(0x7f0000000140)=ANY=[@ANYRES8=0x0], 0x1, 0x30e, &(0x7f0000000f00)="$eJzs3E1rE10UwPGTNEnTlHayeHhEQXrRjW6GNu7FIC2IAUttxBcQp81EQ8akZEIlIrZduXEhfggXpcvuCtov0I07V27cdSO4sAtxJDOTl7aJrWnSWPv/QZlD7j0z9+Y24dyBzPbdN0/zWVvPGmUJRpUERER2ROISlJqAfwy6cUSaLcvl4W+fzt++d/9mMpWanFFqKjl7JaGUGh17/+zFkN9tY1C24g+3vya+bP2/dXb75+yTnK1ytioUy8pQc8XPZWPOMlUmZ+d1paYt07BNlSvYZslrd5ZELFNlreLCQkUZhcxIbKFk2rYyChWVNyuqXFTlUkUZj41cQem6rkZigoOkV2dmjGSHyfNdHgx6pFRKGgMiMrSvJb3alwEBAIC+8uv/erUfrJb0ndT/oZb1/9qFzfLwnfVRv/7fiFTrf5Gm+v9R41ymygTr9X9URBr1f9HbH3S7/t9fEZ1sr3cvjjhOPYy06n+k+h8nRLX+j/mfX9fKg7VxN6D+BwAAAAAAAAAAAAAAAAAAAADgJNhxHM1xHM07DvivOtqgiETdX5B47X0eJnpk9/o3/lj/06Hx4I7QqIj1ajG9mPaOfodNEbHElHHR5If7/+CrxpFl5XZSVXH5YC35+UuLae+7JJmVnJs/IZrE9+Y7ztSN1OSE8uzOD0usOT8hmvzXOj+xNz9cPUbk0sWmfF00+TgvRbEk4/8yrpb/ckKp67dSe64/5PYDAAAAAOBfoKu6+v59sLld39/u7Y+9dm9/HZLW9we8/fV4y/19SM6F+jVrAAAAAABOF7vyPG9YllnqUbAiIj2+RJugNsPDZtUekNumT0AC7Zq6ENQu3ll6dWxdG0/4UO9YsKOhjkX+cFFaBrXbRu36yHQnZ3Y0kaO+h2fevvv++z7enTGRw5zw6nr0gJl2GkQOmmn42L6AAAAAABybRtFfe+VafwcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMApdByP4uv3HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC/xa8AAAD//46ZAFE=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r1, &(0x7f0000000a00)="c7885a8f24f458bed72116", 0xb) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7ffff000) syz_clone(0x4000, &(0x7f00000001c0)="b0c4dc345846be585bf5b5590398bdef9afdcc0aea", 0x15, &(0x7f0000000200), &(0x7f0000000280), &(0x7f0000000640)="309b418c2ff6ecdc2325525eb0f919ed1e740654d86989c6c6078bc1da5e22f1aba91544f7a3d49c85c63c4ecbc0126032a428edf3f02782f9be1f36d8f276bf565a2ae3422f772cb62ad7b776582306ae5c8544501f942375553298fbdf44ff5954bdb9599b50228be204d9fa3a366c83a7") 221.80426ms ago: executing program 1 (id=242): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000440)={0x7f, [0xfffffffd, 0x81], 0x8}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) 148.382313ms ago: executing program 3 (id=243): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='block_bio_remap\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='block_bio_remap\x00', r2}, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 118.720075ms ago: executing program 3 (id=244): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=@newqdisc={0x24, 0x24, 0xd31, 0x0, 0x4, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}}, 0x24}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYRES32=r2, @ANYBLOB="1000018004000480080001"], 0x28}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 89.537795ms ago: executing program 3 (id=245): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x3}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newtfilter={0x6c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x4, 0xe}, {}, {0x8, 0x8}}, [@filter_kind_options=@f_flow={{0x9}, {0x3c, 0x2, [@TCA_FLOW_EMATCHES={0x38, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x9, 0x1, 0x0, 0x0, {{0x4, 0x1, 0x6}, {0x1, 0x7, 0x10, 0x6, 0xe, 0x1}}}, @TCF_EM_NBYTE={0x10, 0x2, 0x0, 0x0, {{0x24}, {0x6d, 0x0, 0x2}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8040}, 0x0) 4.43299ms ago: executing program 0 (id=246): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) r1 = epoll_create1(0x80000) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/wakeup_count', 0x0, 0x10) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0xe000001a}) finit_module(r2, 0x0, 0x3) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000000000)) 0s ago: executing program 3 (id=247): signalfd(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x8, 0x0, 0x0, 0x0, 0x4, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x0, 0x7, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c000000031a000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x557a, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, &(0x7f0000000140), &(0x7f0000000000)=""/48}, 0x20) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.148' (ED25519) to the list of known hosts. [ 32.599364][ T29] audit: type=1400 audit(1764035107.582:62): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 32.622412][ T29] audit: type=1400 audit(1764035107.602:63): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 32.623390][ T3304] cgroup: Unknown subsys name 'net' [ 32.650550][ T29] audit: type=1400 audit(1764035107.632:64): avc: denied { unmount } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 32.749785][ T3304] cgroup: Unknown subsys name 'cpuset' [ 32.756303][ T3304] cgroup: Unknown subsys name 'rlimit' [ 32.887926][ T29] audit: type=1400 audit(1764035107.862:65): avc: denied { setattr } for pid=3304 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 32.911393][ T29] audit: type=1400 audit(1764035107.862:66): avc: denied { create } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 32.932003][ T29] audit: type=1400 audit(1764035107.862:67): avc: denied { write } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 32.949249][ T3307] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 32.952460][ T29] audit: type=1400 audit(1764035107.862:68): avc: denied { read } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 32.981350][ T29] audit: type=1400 audit(1764035107.892:69): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 33.006167][ T29] audit: type=1400 audit(1764035107.892:70): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 33.013135][ T3304] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 33.029569][ T29] audit: type=1400 audit(1764035107.942:71): avc: denied { relabelto } for pid=3307 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.143310][ T3316] chnl_net:caif_netlink_parms(): no params data found [ 34.230157][ T3316] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.237303][ T3316] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.244520][ T3316] bridge_slave_0: entered allmulticast mode [ 34.250977][ T3316] bridge_slave_0: entered promiscuous mode [ 34.268740][ T3316] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.275899][ T3316] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.283131][ T3316] bridge_slave_1: entered allmulticast mode [ 34.289799][ T3316] bridge_slave_1: entered promiscuous mode [ 34.326209][ T3316] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.358695][ T3320] chnl_net:caif_netlink_parms(): no params data found [ 34.368511][ T3316] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.428102][ T3316] team0: Port device team_slave_0 added [ 34.437826][ T3314] chnl_net:caif_netlink_parms(): no params data found [ 34.449160][ T3315] chnl_net:caif_netlink_parms(): no params data found [ 34.460793][ T3316] team0: Port device team_slave_1 added [ 34.487861][ T3321] chnl_net:caif_netlink_parms(): no params data found [ 34.528230][ T3320] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.535363][ T3320] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.542581][ T3320] bridge_slave_0: entered allmulticast mode [ 34.548970][ T3320] bridge_slave_0: entered promiscuous mode [ 34.555663][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 34.562755][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.589048][ T3316] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 34.611368][ T3320] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.618599][ T3320] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.625908][ T3320] bridge_slave_1: entered allmulticast mode [ 34.632322][ T3320] bridge_slave_1: entered promiscuous mode [ 34.639328][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 34.646286][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.672533][ T3316] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.711694][ T3314] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.718796][ T3314] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.726004][ T3314] bridge_slave_0: entered allmulticast mode [ 34.732539][ T3314] bridge_slave_0: entered promiscuous mode [ 34.739330][ T3314] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.746426][ T3314] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.753602][ T3314] bridge_slave_1: entered allmulticast mode [ 34.760040][ T3314] bridge_slave_1: entered promiscuous mode [ 34.772866][ T3320] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.800151][ T3315] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.807255][ T3315] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.814579][ T3315] bridge_slave_0: entered allmulticast mode [ 34.821045][ T3315] bridge_slave_0: entered promiscuous mode [ 34.828565][ T3320] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.837825][ T3315] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.844894][ T3315] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.852117][ T3315] bridge_slave_1: entered allmulticast mode [ 34.858696][ T3315] bridge_slave_1: entered promiscuous mode [ 34.866052][ T3314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.897445][ T3314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.935636][ T3321] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.942881][ T3321] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.950130][ T3321] bridge_slave_0: entered allmulticast mode [ 34.956487][ T3321] bridge_slave_0: entered promiscuous mode [ 34.963210][ T3321] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.970295][ T3321] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.977625][ T3321] bridge_slave_1: entered allmulticast mode [ 34.984131][ T3321] bridge_slave_1: entered promiscuous mode [ 34.992480][ T3316] hsr_slave_0: entered promiscuous mode [ 34.998499][ T3316] hsr_slave_1: entered promiscuous mode [ 35.005314][ T3320] team0: Port device team_slave_0 added [ 35.012457][ T3315] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.022235][ T3320] team0: Port device team_slave_1 added [ 35.028537][ T3314] team0: Port device team_slave_0 added [ 35.050709][ T3315] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.060612][ T3314] team0: Port device team_slave_1 added [ 35.078035][ T3321] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.108118][ T3315] team0: Port device team_slave_0 added [ 35.114767][ T3321] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.124439][ T3320] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.131466][ T3320] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.157504][ T3320] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.168906][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.175887][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.201961][ T3314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.213417][ T3315] team0: Port device team_slave_1 added [ 35.235746][ T3320] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.242758][ T3320] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.268739][ T3320] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.279852][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.286805][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.312879][ T3314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.349359][ T3315] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.356348][ T3315] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.382419][ T3315] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.393878][ T3321] team0: Port device team_slave_0 added [ 35.400806][ T3321] team0: Port device team_slave_1 added [ 35.418236][ T3321] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.425244][ T3321] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.451174][ T3321] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.464833][ T3315] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.471910][ T3315] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.498134][ T3315] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.515991][ T3321] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.523009][ T3321] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.549015][ T3321] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.582032][ T3320] hsr_slave_0: entered promiscuous mode [ 35.588047][ T3320] hsr_slave_1: entered promiscuous mode [ 35.594091][ T3320] debugfs: 'hsr0' already exists in 'hsr' [ 35.599860][ T3320] Cannot create hsr debugfs directory [ 35.628072][ T3314] hsr_slave_0: entered promiscuous mode [ 35.634205][ T3314] hsr_slave_1: entered promiscuous mode [ 35.640246][ T3314] debugfs: 'hsr0' already exists in 'hsr' [ 35.646006][ T3314] Cannot create hsr debugfs directory [ 35.677871][ T3321] hsr_slave_0: entered promiscuous mode [ 35.684156][ T3321] hsr_slave_1: entered promiscuous mode [ 35.690075][ T3321] debugfs: 'hsr0' already exists in 'hsr' [ 35.695800][ T3321] Cannot create hsr debugfs directory [ 35.713987][ T3315] hsr_slave_0: entered promiscuous mode [ 35.720237][ T3315] hsr_slave_1: entered promiscuous mode [ 35.726070][ T3315] debugfs: 'hsr0' already exists in 'hsr' [ 35.731949][ T3315] Cannot create hsr debugfs directory [ 35.855607][ T3316] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 35.880948][ T3316] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 35.889931][ T3316] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 35.900892][ T3316] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 35.951944][ T3315] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 35.963010][ T3315] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 35.971942][ T3315] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 35.981019][ T3315] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 36.014597][ T3320] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 36.024936][ T3320] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 36.034172][ T3320] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 36.048886][ T3320] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 36.095047][ T3314] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 36.105622][ T3316] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.116499][ T3314] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 36.125726][ T3314] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 36.134650][ T3314] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 36.161649][ T3316] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.178554][ T3315] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.191112][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.198237][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.214053][ T3315] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.223627][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.230757][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.244249][ T3321] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 36.253092][ T3321] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 36.262560][ T3321] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 36.280928][ T3321] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 36.291913][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.299013][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.314947][ T1458] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.322160][ T1458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.343404][ T3320] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.358339][ T3316] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 36.394817][ T3320] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.405802][ T3315] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 36.416383][ T3315] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 36.436378][ T3314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.462647][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.469794][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.491716][ T3314] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.504159][ T3321] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.515227][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.522409][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.542036][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.549319][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.557941][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.565015][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.586554][ T3316] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.606931][ T3321] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.623343][ T3315] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.634475][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.641667][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.671052][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.678184][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.765920][ T3314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.813504][ T3320] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.829220][ T3316] veth0_vlan: entered promiscuous mode [ 36.843436][ T3321] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.869714][ T3316] veth1_vlan: entered promiscuous mode [ 36.896861][ T3316] veth0_macvtap: entered promiscuous mode [ 36.910751][ T3315] veth0_vlan: entered promiscuous mode [ 36.917688][ T3316] veth1_macvtap: entered promiscuous mode [ 36.930992][ T3315] veth1_vlan: entered promiscuous mode [ 36.983374][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.993367][ T3315] veth0_macvtap: entered promiscuous mode [ 37.005853][ T3320] veth0_vlan: entered promiscuous mode [ 37.013642][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 37.032355][ T3321] veth0_vlan: entered promiscuous mode [ 37.038509][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.047549][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.058847][ T3321] veth1_vlan: entered promiscuous mode [ 37.069670][ T3320] veth1_vlan: entered promiscuous mode [ 37.077092][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.094041][ T3315] veth1_macvtap: entered promiscuous mode [ 37.103068][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.123468][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 37.142424][ T3314] veth0_vlan: entered promiscuous mode [ 37.150553][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 37.163711][ T3314] veth1_vlan: entered promiscuous mode [ 37.184361][ T1458] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.197948][ T1458] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.211203][ T1458] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.228548][ T3314] veth0_macvtap: entered promiscuous mode [ 37.229575][ T3316] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 37.238880][ T3321] veth0_macvtap: entered promiscuous mode [ 37.256904][ T1458] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.270235][ T3321] veth1_macvtap: entered promiscuous mode [ 37.277561][ T3314] veth1_macvtap: entered promiscuous mode [ 37.294714][ T3320] veth0_macvtap: entered promiscuous mode [ 37.310985][ T3321] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 37.331391][ T3320] veth1_macvtap: entered promiscuous mode [ 37.340386][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 37.350451][ T3321] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 37.363222][ T3320] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 37.372516][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 37.388785][ T57] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.409345][ T57] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.420625][ T3486] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2'. [ 37.430886][ T3320] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 37.469141][ T57] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.507132][ T57] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.542969][ T3489] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6'. [ 37.562676][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.600055][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.625922][ T29] kauditd_printk_skb: 31 callbacks suppressed [ 37.625941][ T29] audit: type=1400 audit(1764035112.602:103): avc: denied { append } for pid=3492 comm="syz.4.5" name="001" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 37.667315][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.703807][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.742570][ T3507] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 37.747598][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.766927][ T3506] smc: net device bond0 applied user defined pnetid SYZ0 [ 37.782897][ T29] audit: type=1400 audit(1764035112.662:104): avc: denied { create } for pid=3493 comm="syz.2.3" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 37.802108][ T29] audit: type=1400 audit(1764035112.662:105): avc: denied { write } for pid=3493 comm="syz.2.3" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 37.821123][ T29] audit: type=1400 audit(1764035112.662:106): avc: denied { create } for pid=3499 comm="syz.1.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 37.840268][ T29] audit: type=1400 audit(1764035112.662:107): avc: denied { bind } for pid=3499 comm="syz.1.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 37.844036][ T3507] Zero length message leads to an empty skb [ 37.859271][ T29] audit: type=1400 audit(1764035112.662:108): avc: denied { write } for pid=3499 comm="syz.1.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 37.884356][ T29] audit: type=1400 audit(1764035112.692:109): avc: denied { create } for pid=3501 comm="syz.3.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 37.903520][ T29] audit: type=1400 audit(1764035112.692:110): avc: denied { connect } for pid=3501 comm="syz.3.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 37.922778][ T29] audit: type=1400 audit(1764035112.692:111): avc: denied { write } for pid=3501 comm="syz.3.8" path="socket:[4068]" dev="sockfs" ino=4068 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 37.945571][ T29] audit: type=1400 audit(1764035112.712:112): avc: denied { create } for pid=3505 comm="syz.0.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 37.967516][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.976745][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.978956][ T3506] smc: net device bond0 erased user defined pnetid SYZ0 [ 37.985542][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.111204][ T3522] syzkaller1: entered promiscuous mode [ 38.116773][ T3522] syzkaller1: entered allmulticast mode [ 38.140020][ T3524] ALSA: seq fatal error: cannot create timer (-19) [ 38.207549][ T3532] loop0: detected capacity change from 0 to 512 [ 38.236507][ T3532] ======================================================= [ 38.236507][ T3532] WARNING: The mand mount option has been deprecated and [ 38.236507][ T3532] and is ignored by this kernel. Remove the mand [ 38.236507][ T3532] option from the mount to silence this warning. [ 38.236507][ T3532] ======================================================= [ 38.304627][ T3532] EXT4-fs: Ignoring removed nobh option [ 38.310871][ T3532] EXT4-fs: test_dummy_encryption option not supported [ 38.367211][ T3538] netlink: 4 bytes leftover after parsing attributes in process `syz.4.25'. [ 38.387218][ T3538] netlink: 4 bytes leftover after parsing attributes in process `syz.4.25'. [ 38.414675][ T3540] syz.0.26 (3540) used greatest stack depth: 9984 bytes left [ 38.491636][ T3547] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3547 comm=syz.3.29 [ 38.612733][ T3556] loop3: detected capacity change from 0 to 4096 [ 38.623046][ T3556] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.666456][ T3316] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.680017][ T3563] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 38.794163][ T3571] loop3: detected capacity change from 0 to 512 [ 38.809555][ T3571] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 38.845266][ T3571] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.884215][ T3571] ext4 filesystem being mounted at /8/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.002461][ T3316] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.146007][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 39.181562][ T3600] loop2: detected capacity change from 0 to 1024 [ 39.190066][ T3600] EXT4-fs (loop2): filesystem is read-only [ 39.196186][ T3600] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869) [ 39.206347][ T3600] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 39.217094][ T3600] EXT4-fs error (device loop2): ext4_get_journal_inode:5808: comm syz.2.49: inode #1: comm syz.2.49: iget: illegal inode # [ 39.231317][ T3600] EXT4-fs (loop2): no journal found [ 39.236570][ T3600] EXT4-fs (loop2): can't get journal size [ 39.266311][ T3600] EXT4-fs (loop2): failed to initialize system zone (-22) [ 39.279849][ T3600] EXT4-fs (loop2): mount failed [ 39.446702][ T3613] SELinux: ebitmap: truncated map [ 39.460259][ T3613] SELinux: failed to load policy [ 39.485758][ T3619] syz.3.58 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 39.638319][ T3637] netlink: 12 bytes leftover after parsing attributes in process `syz.2.67'. [ 39.647281][ T3637] netlink: 12 bytes leftover after parsing attributes in process `syz.2.67'. [ 39.785709][ T3654] mmap: syz.2.75 (3654) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 39.883880][ T3663] netlink: 'syz.1.80': attribute type 29 has an invalid length. [ 39.903611][ T3663] netlink: 'syz.1.80': attribute type 29 has an invalid length. [ 39.915937][ T3663] netlink: 500 bytes leftover after parsing attributes in process `syz.1.80'. [ 40.140126][ T3689] syz.3.91 uses obsolete (PF_INET,SOCK_PACKET) [ 40.172630][ T12] Bluetooth: hci1: Frame reassembly failed (-84) [ 40.285163][ T3695] loop3: detected capacity change from 0 to 128 [ 40.359170][ T3697] syz.3.93: attempt to access beyond end of device [ 40.359170][ T3697] loop3: rw=3, sector=161, nr_sectors = 7 limit=128 [ 40.372433][ T3697] syz.3.93: attempt to access beyond end of device [ 40.372433][ T3697] loop3: rw=2051, sector=168, nr_sectors = 1 limit=128 [ 40.423425][ T1458] kworker/u8:6: attempt to access beyond end of device [ 40.423425][ T1458] loop3: rw=1, sector=145, nr_sectors = 16 limit=128 [ 40.437341][ T1458] kworker/u8:6: attempt to access beyond end of device [ 40.437341][ T1458] loop3: rw=1, sector=169, nr_sectors = 8 limit=128 [ 40.450941][ T1458] kworker/u8:6: attempt to access beyond end of device [ 40.450941][ T1458] loop3: rw=1, sector=185, nr_sectors = 8 limit=128 [ 40.466118][ T1458] kworker/u8:6: attempt to access beyond end of device [ 40.466118][ T1458] loop3: rw=1, sector=201, nr_sectors = 8 limit=128 [ 40.480597][ T1458] kworker/u8:6: attempt to access beyond end of device [ 40.480597][ T1458] loop3: rw=1, sector=217, nr_sectors = 8 limit=128 [ 40.494155][ T1458] kworker/u8:6: attempt to access beyond end of device [ 40.494155][ T1458] loop3: rw=1, sector=233, nr_sectors = 8 limit=128 [ 40.509630][ T1458] kworker/u8:6: attempt to access beyond end of device [ 40.509630][ T1458] loop3: rw=1, sector=249, nr_sectors = 8 limit=128 [ 40.523619][ T1458] kworker/u8:6: attempt to access beyond end of device [ 40.523619][ T1458] loop3: rw=1, sector=265, nr_sectors = 8 limit=128 [ 40.570801][ T3702] netlink: 4 bytes leftover after parsing attributes in process `syz.3.95'. [ 40.583513][ T2120] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 40.583586][ T3702] netlink: 4 bytes leftover after parsing attributes in process `syz.3.95'. [ 40.592641][ T2120] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 40.610859][ T2120] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 40.619776][ T2120] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 40.799560][ T3711] infiniband syz2: set active [ 40.804334][ T3711] infiniband syz2: added batadv_slave_0 [ 40.830215][ T3711] RDS/IB: syz2: added [ 40.850289][ T3711] smc: adding ib device syz2 with port count 1 [ 40.862559][ T3711] smc: ib device syz2 port 1 has no pnetid [ 41.090951][ T3733] netlink: 8 bytes leftover after parsing attributes in process `syz.1.109'. [ 41.124198][ T3735] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=3735 comm=syz.3.110 [ 41.136706][ T3735] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=3735 comm=syz.3.110 [ 41.161846][ T3596] Bluetooth: hci0: command 0x1003 tx timeout [ 41.168004][ T44] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 41.743981][ T3783] pim6reg1: entered promiscuous mode [ 41.749417][ T3783] pim6reg1: entered allmulticast mode [ 41.785228][ T3787] loop3: detected capacity change from 0 to 128 [ 41.795261][ T3787] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 41.808031][ T3787] ext4 filesystem being mounted at /47/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 41.840705][ T3787] EXT4-fs (loop3): shut down requested (0) [ 41.860661][ T3316] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 41.942185][ T296] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.023849][ T296] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.114171][ T296] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.178907][ T296] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.199087][ T44] Bluetooth: hci1: command 0x1003 tx timeout [ 42.210923][ T3597] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 42.293905][ T296] bridge_slave_1: left allmulticast mode [ 42.299631][ T296] bridge_slave_1: left promiscuous mode [ 42.305384][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.319625][ T296] bridge_slave_0: left allmulticast mode [ 42.325400][ T296] bridge_slave_0: left promiscuous mode [ 42.331269][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.357733][ T3831] siw: device registration error -23 [ 42.475989][ T296] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 42.486140][ T296] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 42.495951][ T296] bond0 (unregistering): Released all slaves [ 42.504628][ T3826] bridge: RTM_NEWNEIGH with invalid ether address [ 42.602946][ T3840] netlink: 'syz.1.154': attribute type 6 has an invalid length. [ 42.610711][ T3840] __nla_validate_parse: 8 callbacks suppressed [ 42.610778][ T3840] netlink: 12 bytes leftover after parsing attributes in process `syz.1.154'. [ 42.642843][ T29] kauditd_printk_skb: 201 callbacks suppressed [ 42.642857][ T29] audit: type=1400 audit(1764035117.622:314): avc: denied { bind } for pid=3846 comm="syz.3.157" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 42.684878][ T29] audit: type=1400 audit(1764035117.662:315): avc: denied { listen } for pid=3846 comm="syz.3.157" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 42.704421][ T29] audit: type=1400 audit(1764035117.662:316): avc: denied { accept } for pid=3846 comm="syz.3.157" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 42.724126][ T29] audit: type=1400 audit(1764035117.662:317): avc: denied { read } for pid=3846 comm="syz.3.157" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 42.744459][ T3840] bond1 (unregistering): Released all slaves [ 42.809851][ T296] hsr_slave_0: left promiscuous mode [ 42.825720][ T29] audit: type=1400 audit(1764035117.762:318): avc: denied { mount } for pid=3849 comm="syz.0.158" name="/" dev="ramfs" ino=6263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 42.859300][ T296] hsr_slave_1: left promiscuous mode [ 42.870484][ T296] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 42.877901][ T296] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 42.913970][ T296] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 42.921767][ T296] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 42.948757][ T29] audit: type=1400 audit(1764035117.922:319): avc: denied { name_bind } for pid=3861 comm="syz.2.163" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 42.981017][ T296] veth1_macvtap: left promiscuous mode [ 42.986791][ T296] veth0_macvtap: left promiscuous mode [ 42.998738][ T296] veth1_vlan: left promiscuous mode [ 43.004145][ T296] veth0_vlan: left promiscuous mode [ 43.145768][ T296] team0 (unregistering): Port device team_slave_1 removed [ 43.148095][ T3871] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.153750][ T29] audit: type=1400 audit(1764035118.122:320): avc: denied { write } for pid=3869 comm="syz.1.166" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 43.161949][ T3871] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.184435][ T29] audit: type=1400 audit(1764035118.122:321): avc: denied { ioctl } for pid=3869 comm="syz.1.166" path="/dev/raw-gadget" dev="devtmpfs" ino=142 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 43.229101][ T296] team0 (unregistering): Port device team_slave_0 removed [ 43.381787][ T3804] chnl_net:caif_netlink_parms(): no params data found [ 43.463229][ T3804] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.470423][ T3804] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.498971][ T3804] bridge_slave_0: entered allmulticast mode [ 43.505642][ T3804] bridge_slave_0: entered promiscuous mode [ 43.512864][ T3804] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.520515][ T3804] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.527817][ T3804] bridge_slave_1: entered allmulticast mode [ 43.534585][ T3804] bridge_slave_1: entered promiscuous mode [ 43.547494][ T3891] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 43.548911][ T29] audit: type=1400 audit(1764035118.522:322): avc: denied { load_policy } for pid=3887 comm="syz.0.172" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 43.555891][ T3891] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 43.590101][ T3888] SELinux: failed to load policy [ 43.597420][ T3804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 43.608704][ T3804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 43.638882][ T3804] team0: Port device team_slave_0 added [ 43.649771][ T3804] team0: Port device team_slave_1 added [ 43.674354][ T3804] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 43.681461][ T3804] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 43.707538][ T3804] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 43.712140][ T29] audit: type=1400 audit(1764035118.692:323): avc: denied { setopt } for pid=3896 comm="syz.2.176" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 43.721699][ T3804] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 43.744496][ T3804] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 43.770514][ T3804] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 43.793744][ T3902] raw_sendmsg: syz.2.176 forgot to set AF_INET. Fix it! [ 43.801340][ C0] IPv4: Oversized IP packet from 127.0.0.1 [ 43.891769][ T3804] hsr_slave_0: entered promiscuous mode [ 43.899329][ T3804] hsr_slave_1: entered promiscuous mode [ 43.911827][ T3804] debugfs: 'hsr0' already exists in 'hsr' [ 43.917606][ T3804] Cannot create hsr debugfs directory [ 43.945444][ C1] hrtimer: interrupt took 28960 ns [ 44.003101][ T3913] loop2: detected capacity change from 0 to 512 [ 44.018191][ T3913] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 44.031324][ T3913] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 44.056782][ T3913] EXT4-fs (loop2): 1 orphan inode deleted [ 44.062682][ T3913] EXT4-fs (loop2): 1 truncate cleaned up [ 44.076591][ T3913] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 44.135982][ T3804] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 44.146627][ T3320] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.159273][ T3804] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 44.185624][ T3804] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 44.204248][ T3804] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 44.222757][ T3923] capability: warning: `syz.2.183' uses deprecated v2 capabilities in a way that may be insecure [ 44.252880][ T3931] process 'syz.0.186' launched '/dev/fd/7' with NULL argv: empty string added [ 44.254270][ T3804] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.269025][ T3804] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.276329][ T3804] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.283452][ T3804] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.317708][ T3804] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.330715][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.348832][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.387484][ T3804] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.424612][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.431747][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.470679][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.477768][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.620740][ T3954] SELinux: failed to load policy [ 44.638292][ T3958] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=3958 comm=syz.1.198 [ 44.650746][ T3958] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=3958 comm=syz.1.198 [ 44.693861][ T3804] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 45.016753][ T3804] veth0_vlan: entered promiscuous mode [ 45.021986][ T4004] unsupported nla_type 52263 [ 45.025446][ T3804] veth1_vlan: entered promiscuous mode [ 45.044631][ T3804] veth0_macvtap: entered promiscuous mode [ 45.053053][ T3804] veth1_macvtap: entered promiscuous mode [ 45.064551][ T3804] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 45.090190][ T3804] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 45.136104][ T296] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.196934][ T296] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.220655][ T57] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.236596][ T57] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.399782][ T4047] openvswitch: netlink: EtherType 0 is less than min 600 [ 45.506936][ T4056] netlink: 24 bytes leftover after parsing attributes in process `syz.3.229'. [ 45.516344][ T4052] loop1: detected capacity change from 0 to 8192 [ 45.561012][ T4052] loop1: p1 p2 p4 < > [ 45.565156][ T4052] loop1: partition table partially beyond EOD, truncated [ 45.574231][ T4052] loop1: p1 start 16777216 is beyond EOD, truncated [ 45.581039][ T4052] loop1: p2 size 515840 extends beyond EOD, truncated [ 45.590515][ T4052] loop1: p4 start 16777216 is beyond EOD, truncated [ 45.663343][ T3308] udevd[3308]: inotify_add_watch(7, /dev/loop1p2, 10) failed: No such file or directory [ 45.690152][ T4071] smc: net device hsr0 applied user defined pnetid SYZ2 [ 45.697678][ T4071] smc: net device hsr0 erased user defined pnetid SYZ2 [ 45.846091][ T296] Bluetooth: hci0: Frame reassembly failed (-84) [ 45.857230][ T4086] loop5: detected capacity change from 0 to 128 [ 46.013825][ T4093] bio_check_eod: 103 callbacks suppressed [ 46.013839][ T4093] syz.5.241: attempt to access beyond end of device [ 46.013839][ T4093] loop5: rw=2049, sector=129, nr_sectors = 8 limit=128 [ 46.106836][ T4089] ================================================================== [ 46.114993][ T4089] BUG: KCSAN: data-race in __mark_inode_dirty / __mark_inode_dirty [ 46.122946][ T4089] [ 46.125293][ T4089] write to 0xffff888119878728 of 4 bytes by task 4086 on cpu 1: [ 46.132944][ T4089] __mark_inode_dirty+0x248/0x750 [ 46.138023][ T4089] mark_buffer_dirty+0x133/0x210 [ 46.143009][ T4089] block_write_end+0x12d/0x210 [ 46.147813][ T4089] generic_write_end+0x56/0x150 [ 46.152712][ T4089] fat_write_end+0x4f/0x160 [ 46.153128][ T4086] syz.5.241: attempt to access beyond end of device [ 46.153128][ T4086] loop5: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 46.157246][ T4089] generic_perform_write+0x312/0x490 [ 46.170615][ T4086] Buffer I/O error on dev loop5, logical block 128, lost async page write [ 46.175831][ T4089] __generic_file_write_iter+0x9e/0x120 [ 46.189995][ T4089] generic_file_write_iter+0x8d/0x2f0 [ 46.195381][ T4089] iter_file_splice_write+0x666/0xa60 [ 46.200768][ T4089] direct_splice_actor+0x156/0x2a0 [ 46.205904][ T4089] splice_direct_to_actor+0x312/0x680 [ 46.211291][ T4089] do_splice_direct+0xda/0x150 [ 46.216058][ T4089] do_sendfile+0x380/0x650 [ 46.220486][ T4089] __x64_sys_sendfile64+0x105/0x150 [ 46.225712][ T4089] x64_sys_call+0x2bb4/0x3000 [ 46.230410][ T4089] do_syscall_64+0xd2/0x200 [ 46.234917][ T4089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 46.240812][ T4089] [ 46.243187][ T4089] read to 0xffff888119878728 of 4 bytes by task 4089 on cpu 0: [ 46.250729][ T4089] __mark_inode_dirty+0x55/0x750 [ 46.255683][ T4089] fat_update_time+0x1ec/0x200 [ 46.260458][ T4089] touch_atime+0x148/0x340 [ 46.264899][ T4089] filemap_splice_read+0x6ba/0x740 [ 46.270032][ T4089] splice_direct_to_actor+0x26f/0x680 [ 46.275416][ T4089] do_splice_direct+0xda/0x150 [ 46.280189][ T4089] do_sendfile+0x380/0x650 [ 46.284637][ T4089] __x64_sys_sendfile64+0x105/0x150 [ 46.289915][ T4089] x64_sys_call+0x2bb4/0x3000 [ 46.294631][ T4089] do_syscall_64+0xd2/0x200 [ 46.299158][ T4089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 46.305101][ T4089] [ 46.307442][ T4089] value changed: 0x00000010 -> 0x00000070 [ 46.313157][ T4089] [ 46.315480][ T4089] Reported by Kernel Concurrency Sanitizer on: [ 46.321647][ T4089] CPU: 0 UID: 0 PID: 4089 Comm: syz.5.241 Not tainted syzkaller #0 PREEMPT(voluntary) [ 46.331408][ T4089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 46.341511][ T4089] ================================================================== SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 46.353689][ T4089] syz.5.241: attempt to access beyond end of device [ 46.353689][ T4089] loop5: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 46.367100][ T4089] Buffer I/O error on dev loop5, logical block 128, lost async page write [ 46.688272][ T52] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.771213][ T52] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.821464][ T52] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.881946][ T52] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.947115][ T52] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.981945][ T52] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.041413][ T52] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.091509][ T52] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.155424][ T52] bridge_slave_1: left allmulticast mode [ 47.161230][ T52] bridge_slave_1: left promiscuous mode [ 47.167089][ T52] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.175674][ T52] bridge_slave_0: left allmulticast mode [ 47.181451][ T52] bridge_slave_0: left promiscuous mode [ 47.187113][ T52] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.195589][ T52] bridge_slave_1: left allmulticast mode [ 47.201366][ T52] bridge_slave_1: left promiscuous mode [ 47.207059][ T52] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.215024][ T52] bridge_slave_0: left allmulticast mode [ 47.220732][ T52] bridge_slave_0: left promiscuous mode [ 47.226522][ T52] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.332628][ T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 47.342984][ T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 47.352670][ T52] bond0 (unregistering): Released all slaves [ 47.421261][ T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 47.430994][ T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 47.440474][ T52] bond0 (unregistering): Released all slaves [ 47.563039][ T52] hsr_slave_0: left promiscuous mode [ 47.569801][ T52] hsr_slave_1: left promiscuous mode [ 47.575404][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 47.582979][ T52] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 47.590615][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 47.598072][ T52] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 47.607306][ T52] hsr_slave_0: left promiscuous mode [ 47.613009][ T52] hsr_slave_1: left promiscuous mode [ 47.618573][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 47.626084][ T52] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 47.633941][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 47.641597][ T52] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 47.654466][ T52] veth1_macvtap: left promiscuous mode [ 47.660033][ T52] veth0_macvtap: left promiscuous mode [ 47.665523][ T52] veth1_vlan: left promiscuous mode [ 47.670801][ T52] veth0_vlan: left promiscuous mode [ 47.676803][ T52] veth1_macvtap: left promiscuous mode [ 47.682348][ T52] veth0_macvtap: left promiscuous mode [ 47.687891][ T52] veth1_vlan: left promiscuous mode [ 47.693162][ T52] veth0_vlan: left promiscuous mode [ 47.789741][ T52] team0 (unregistering): Port device team_slave_1 removed [ 47.800304][ T52] team0 (unregistering): Port device team_slave_0 removed [ 47.852807][ T37] smc: removing ib device syz2 [ 47.857866][ T52] team0 (unregistering): Port device team_slave_1 removed [ 47.867467][ T52] team0 (unregistering): Port device team_slave_0 removed [ 47.888700][ T44] Bluetooth: hci0: command 0x1003 tx timeout [ 47.888727][ T3597] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 47.904053][ T3395] syz2: Port: 1 Link DOWN [ 48.463789][ T52] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.541465][ T52] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.611442][ T52] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.661482][ T52] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.757831][ T52] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.811343][ T52] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.851733][ T52] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.911121][ T52] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.988097][ T52] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 48.998405][ T52] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.061415][ T52] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 49.071774][ T52] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.151508][ T52] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 49.161977][ T52] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.191382][ T52] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 49.201725][ T52] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.246318][ T52] bridge_slave_1: left allmulticast mode [ 49.252036][ T52] bridge_slave_1: left promiscuous mode [ 49.257712][ T52] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.265645][ T52] bridge_slave_0: left allmulticast mode [ 49.271369][ T52] bridge_slave_0: left promiscuous mode [ 49.277016][ T52] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.285538][ T52] bridge_slave_1: left allmulticast mode [ 49.291235][ T52] bridge_slave_1: left promiscuous mode [ 49.296988][ T52] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.304804][ T52] bridge_slave_0: left allmulticast mode [ 49.310526][ T52] bridge_slave_0: left promiscuous mode [ 49.316239][ T52] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.324649][ T52] bridge_slave_1: left allmulticast mode [ 49.330348][ T52] bridge_slave_1: left promiscuous mode [ 49.335967][ T52] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.343948][ T52] bridge_slave_0: left allmulticast mode [ 49.349676][ T52] bridge_slave_0: left promiscuous mode [ 49.355304][ T52] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.501040][ T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 49.510967][ T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 49.520488][ T52] bond0 (unregistering): Released all slaves [ 49.600997][ T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 49.610884][ T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 49.620417][ T52] bond0 (unregistering): Released all slaves [ 49.691597][ T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 49.701403][ T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 49.711068][ T52] bond0 (unregistering): Released all slaves [ 49.755820][ T52] hsr_slave_0: left promiscuous mode [ 49.761674][ T52] hsr_slave_1: left promiscuous mode [ 49.767274][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 49.774699][ T52] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 49.782180][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 49.789598][ T52] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 49.801015][ T52] hsr_slave_0: left promiscuous mode [ 49.806797][ T52] hsr_slave_1: left promiscuous mode [ 49.812492][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 49.819933][ T52] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 49.827584][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 49.835052][ T52] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 49.844133][ T52] hsr_slave_0: left promiscuous mode [ 49.849810][ T52] hsr_slave_1: left promiscuous mode [ 49.855456][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 49.862866][ T52] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 49.870459][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 49.877831][ T52] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 49.892411][ T52] veth1_macvtap: left promiscuous mode [ 49.898016][ T52] veth0_macvtap: left promiscuous mode [ 49.903555][ T52] veth1_vlan: left promiscuous mode [ 49.908847][ T52] veth0_vlan: left promiscuous mode [ 49.914443][ T52] veth1_macvtap: left promiscuous mode [ 49.920146][ T52] veth0_macvtap: left promiscuous mode [ 49.925741][ T52] veth1_vlan: left promiscuous mode [ 49.931223][ T52] veth0_vlan: left promiscuous mode [ 49.937075][ T52] veth1_macvtap: left promiscuous mode [ 49.942587][ T52] veth0_macvtap: left promiscuous mode [ 49.948127][ T52] veth1_vlan: left promiscuous mode [ 49.953388][ T52] veth0_vlan: left promiscuous mode [ 50.077774][ T52] team0 (unregistering): Port device team_slave_1 removed [ 50.087252][ T52] team0 (unregistering): Port device team_slave_0 removed [ 50.139497][ T52] team0 (unregistering): Port device team_slave_1 removed [ 50.149304][ T52] team0 (unregistering): Port device team_slave_0 removed [ 50.202245][ T52] team0 (unregistering): Port device team_slave_1 removed [ 50.212521][ T52] team0 (unregistering): Port device team_slave_0 removed