last executing test programs: 1.49051653s ago: executing program 4 (id=5): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/vmstat\x00', 0x0, 0x0) r2 = syz_io_uring_setup(0x49d, &(0x7f00000003c0)={0x0, 0x79ae, 0x400, 0x2, 0x32c, 0x0, r1}, &(0x7f0000000680)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x2007, @fd=r1, 0x6, &(0x7f0000000580)=""/207, 0xcf, 0x2, 0x1}) io_uring_enter(r2, 0xfd0, 0x4c1, 0x43, 0x0, 0x0) r5 = epoll_create1(0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/slabinfo\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, r6, &(0x7f0000000080)={0x20000011}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000840), 0x81, r7}, 0x38) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b70400000000000085"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000140)='kfree\x00', r8, 0x0, 0x2000000000}, 0x18) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x328000, 0x800, 0x11c, 0x1}, 0x20) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="440000001000010400000000fdffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000400002400128009000100626f6e64000000001400028004001f"], 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x4004090) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r11 = fcntl$dupfd(r10, 0x0, r10) ioctl$SG_IO(r11, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffd, 0x0, 0x0, @buffer={0x0, 0x0, 0x0}, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) vmsplice(0xffffffffffffffff, &(0x7f0000001280)=[{&(0x7f0000001180)="83", 0x1}], 0x1, 0x0) 1.371714322s ago: executing program 3 (id=4): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x5, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x4, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x80000, {0x0, 0x0, 0x0, r7, {}, {0x2, 0xb}, {0x9, 0x4}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x2000c0e9}, 0x4008000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000000)={0x0, 0x5}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r8, 0x84, 0x6, &(0x7f0000000100)={r9, @in6={{0xa, 0x4e20, 0x4, @private2, 0x50}}}, 0x84) r10 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) bpf$TOKEN_CREATE(0x24, &(0x7f00000002c0)={0x0, r10}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x8, 0xb, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002e824ac6e40ed9fb66adc835a0ebc1582020702500000000002020207b1af8ff00000000bfa10000000000000e010000f8ffffffb702000000000000b7", @ANYRES32=r10], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYRES32=r5], 0x48) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r12}, 0x10) write$selinux_load(0xffffffffffffffff, 0x0, 0xffa8) r13 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf32(r13, &(0x7f0000000000)=ANY=[@ANYBLOB="7f454c4604070003070000000000000002000300030000000903000038000000fcffffff0e000000000020000100050000010000000000000300000008000000f30000007f00000004"], 0x58) close(r13) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) 1.269553004s ago: executing program 1 (id=2): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x7, 0x0, 0x103, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x100262, 0x0, 0x9, 0xb95b5ec032cc8e84, 0x0, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xc, 0x0, 0x0, 0xdd36, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8f}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) prctl$PR_SET_THP_DISABLE(0x29, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000000380)=0x1000000, 0x4) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f00000000c0)=0x10089, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x1c, 0x19, &(0x7f0000000900)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xba, 0x0, 0x0, 0x0, 0x3}, {}, {}, [@ldst={0x3, 0x1, 0x1, 0x8, 0x1, 0x18, 0xffffffffffffffff}, @map_fd, @tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @map_val={0x18, 0x7, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000500)='syzkaller\x00', 0x2, 0x26, &(0x7f0000000600)=""/38, 0x41100, 0x2, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x8, &(0x7f0000000680)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000780)={0xd, 0x9, 0x0, 0x1}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000e40)=[0xffffffffffffffff, 0xffffffffffffffff, r2, r2, r2, 0xffffffffffffffff, r2, r2], 0x0, 0x10, 0x7}, 0x94) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a30000000002c000000030a01010000000000000000020000000900010073797a30000000000900030073797a32000000003a000000030a03000000000000000000020000000900010073797a30000000000900030073797a32"], 0xa0}}, 0x8040) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="58000000020605000000000000000000000000000900020073797a3100000000050005000a000000050001000600000013000300686173683a6e65742c696661636500000c0007800800124005000000050004"], 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x800) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0185879, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYRESHEX=r5, @ANYRESDEC=0x0, @ANYRESOCT, @ANYRES8=r1, @ANYRES32], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x15, 0x10, &(0x7f0000000480)=ANY=[@ANYRESDEC=r3, @ANYRESOCT=r1, @ANYRES16, @ANYBLOB="a45dac52600dcdbbe16b05", @ANYRES8, @ANYRESHEX=0x0, @ANYRES16, @ANYRES8=r0], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r8}, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r0) setsockopt$inet_opts(r9, 0x0, 0x4, 0x0, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYRES64], 0x64}}, 0x0) 1.223335175s ago: executing program 2 (id=3): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB='\v\x00\x00\x00\b\x00\x00\x00\f'], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x1, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1, 0x0, 0x2}, 0x18) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) bind$bt_hci(r3, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) 1.138298227s ago: executing program 0 (id=1): syz_mount_image$ext4(&(0x7f00000007c0)='ext4\x00', &(0x7f00000006c0)='./file1\x00', 0x40, &(0x7f00000000c0)={[{@user_xattr}, {@nodioread_nolock}]}, 0x1, 0x576, &(0x7f0000000140)="$eJzs3T1sG2UfAPD/neO3X3nf9JXeVwLUoQKkIlV1kn5AYWpXRKVKHZBYIHLcqIoTV7EDTZQh3StEBwSoS9lgYAQxMCAWRlYWEDNSRSOQmg5g5K80TZzglDouud9POvuee87+P8+d/499pzs5gMw62nhII56OiItJxMi6uqFoVx5trbe6slS8v7JUTKJev/RLEklE3FtZKnbWT9rPhyJiOSKeiohv8hHH081xqwuL0xPlcmmuXR6tzVwdrS4snrgyMzFVmirNnnrp5TNnT58ZPzm+/mX36+tL+Z319caPN9+98d2rt29++tmR5eL7E0mci+F23fp+PE6tbZKPcxuWn+5HsAFKBt0AHkmuneeNVPp/jESunfXd1Ed2tWlAn9X3RdSBjErkP2RU53dA4/i3M+3m748751sHII24q+2pVTPUOjcR+5vHJgd/TR46Mmkcbx7ezYayJy1fj4ixoaHNn/+k/fl7dGOPo4H01dfnWztq8/5P18af6DL+DHfOnf5NnfFvddP49yB+bovx72KPMX5/46ePtox/PeKZrvGTtfhJl/hpRLzVY/xbr395dqu6+scRx6J7/I5k+/PDo5evlEtjrceuMb46duSV7fp/cIv4rXO2+5tfM922f5fT2l198e3nzy5vE/+F57bf/922/4GIeK/H+P+998lrW9XduZ7cbfwK2On+TyIft3uM/+K5oz/0uCoAAAAAAAAAALADafNatiQtrM2naaHQuof3f3EwLVeqteOXK/Ozk61r3g5HPu1caTXSKieN8nj7etxO+eSG8qlcO2DuQLNcKFbKkwPuOwAAAAAAAAAAAAAAAAAAADwpDm24//+3XPP+/41/Vw3sVVv/5Tew18l/yK6H8z8ZWDuA3ef7HzKrLv8hu+Q/ZJf8h+yS/5Bd8h+yS/5Ddsl/AAAAAAAAAAAAAAAAAAAAAAAAAADoi4sXLjSm+v2VpWKjPDm0MD9defvEZKk6XZiZLxaKlbmrhalKZapcKhQrM3/1fkmlcnUsZuevjdZK1dpodWHxzZnK/GznP0VL+b73CAAAAAAAAAAAAAAAAAAAAP55hptTkhYiIm3Op2mhEPHviDicRHL5Srk0FhH/iYjvc/l9jfL4oBsNAAAAAAAAAAAAAAAAAAAAe0x1YXF6olwuzWVkZmgnK0fE8uNtRuMdd/yqfHtfPSnb0EwWZgY8MAEAAAAAAAAAAAAAAAAAQAY9uOm311f80d8GAQAAAAAAAAAAAAAAAAAAQCalPycR0ZiOjTw/vLH2X8lqrvkcEe/cuvTBtYlabW68sfzu2vLah+3lJwfRfqBXnTzt5DEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwQHVhcXqiXC7N9XFm0H0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeBR/BgAA///eANcP") syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e20, @private=0xa010100}]}, &(0x7f00000002c0)=0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3, 0x0, 0xffffffffffffffff}, 0x18) r4 = getpgrp(0x0) r5 = syz_pidfd_open(r4, 0x0) fsetxattr$trusted_overlay_nlink(r5, &(0x7f00000018c0), 0x0, 0x0, 0x3) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000800)={r6, 0x83c, 0x8}, &(0x7f0000000840)=0x8) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r7 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) r8 = openat$cgroup_subtree(r7, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f0000000040)=ANY=[@ANYBLOB='+cpu '], 0xb) pwrite64(r0, &(0x7f00000005c0)='\"', 0x1, 0x4fed0) renameat2(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file3\x00', 0x4) 1.109027848s ago: executing program 4 (id=6): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000800018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r2}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) connect$phonet_pipe(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000300240248ff050005001200", 0x2e}], 0x1}, 0x0) 1.071163428s ago: executing program 2 (id=7): recvmsg$kcm(0xffffffffffffffff, 0x0, 0x140) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000005c0)={{}, &(0x7f0000000540), 0x0}, 0x20) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0xc2f00, 0x4d, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000980)='mm_page_free\x00', r0}, 0x18) r1 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r1, 0x0) ftruncate(r1, 0x3) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r3}, 0x10) r4 = getpid() sched_setscheduler(r4, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) syz_clone(0x44208400, 0x0, 0x0, 0x0, 0x0, 0x0) 970.33765ms ago: executing program 3 (id=8): creat(&(0x7f00000000c0)='./file0\x00', 0x48) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff018004000800395032303030"], 0x15) r1 = dup(r0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0d00000002000000040000000000000005", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\b\x00'/21], 0x50) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000"], 0x0, 0x101, 0x0, 0x0, 0x41100, 0x59}, 0x94) write$binfmt_elf64(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c4600073f034b0b00000000000003003e00ffffffe935"], 0x7c8) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = eventfd2(0x0, 0x0) io_setup(0x81, &(0x7f0000000400)=0x0) read$eventfd(r5, &(0x7f0000000000), 0x8) io_submit(r6, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r5, 0x0, 0x0, 0x0, 0x0, 0x1, r5}]) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX, @ANYBLOB="2c6163636573733dbf7a252a149c0530a3973138932141c203cd8fa919bcba4151c3a548fa5d94", @ANYRESDEC=0x0, @ANYBLOB=',']) rmdir(&(0x7f0000000040)='./file0/file0\x00') tee(r2, r3, 0x1, 0x1) 786.494014ms ago: executing program 3 (id=9): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x7, 0x0, 0x103, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x100262, 0x0, 0x9, 0xb95b5ec032cc8e84, 0x0, 0x7, 0x0, 0x0, 0x5}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0xdd36, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8f}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) prctl$PR_SET_THP_DISABLE(0x29, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000000380)=0x1000000, 0x4) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f00000000c0)=0x10089, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x1c, 0x19, &(0x7f0000000900)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xba, 0x0, 0x0, 0x0, 0x3}, {}, {}, [@ldst={0x3, 0x1, 0x1, 0x8, 0x1, 0x18, 0xffffffffffffffff}, @map_fd, @tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @map_val={0x18, 0x7, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000500)='syzkaller\x00', 0x2, 0x26, &(0x7f0000000600)=""/38, 0x41100, 0x2, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x8, &(0x7f0000000680)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000780)={0xd, 0x9, 0x0, 0x1}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000e40)=[0xffffffffffffffff, 0xffffffffffffffff, r2, r2, r2, 0xffffffffffffffff, r2, r2], 0x0, 0x10, 0x7}, 0x94) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a30000000002c000000030a01010000000000000000020000000900010073797a30000000000900030073797a32000000003a000000030a03000000000000000000020000000900010073797a30000000000900030073797a32"], 0xa0}}, 0x8040) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="58000000020605000000000000000000000000000900020073797a3100000000050005000a000000050001000600000013000300686173683a6e65742c696661636500000c0007800800124005000000050004"], 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x800) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0185879, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYRESHEX=r5, @ANYRESDEC=0x0, @ANYRESOCT, @ANYRES8=r1, @ANYRES32], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x15, 0x10, &(0x7f0000000480)=ANY=[@ANYRESDEC=r3, @ANYRESOCT=r1, @ANYRES16, @ANYBLOB="a45dac52600dcdbbe16b05", @ANYRES8, @ANYRESHEX=0x0, @ANYRES16, @ANYRES8=r0], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r8}, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r0) setsockopt$inet_opts(r9, 0x0, 0x4, 0x0, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYRES64], 0x64}}, 0x0) 239.131585ms ago: executing program 0 (id=10): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a9"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockname$packet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000240)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000280)) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'vxcan0\x00'}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000300)={'ip6gre0\x00', &(0x7f0000000380)={'ip6_vti0\x00', 0x0, 0x2f, 0x80, 0xe, 0x0, 0x0, @mcast2, @empty, 0x8000, 0x20, 0x7b, 0x4}}) r0 = socket$pptp(0x18, 0x1, 0x2) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e2e"], 0x0, 0x35, 0x0, 0x1}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0600000004000000040000040b0000000000000059a793ece4eeaaecbcaae6a6d70c99ec1aaaa756c884293824d749083cc9fa996f4e9cb88e331d9cce90a90347373a6b9fc028910a13a2054326c0b5f9b64837e62186e1bc1e2240ead3c7a4cca0096acfbf0aec117bd38423b188ef672c2f5470aa5fde75f13c8bfd2126640bdbb670ee29d5b24936e56357473f68aca2f30df4614f23291f28e822b5ef22599ca8f45a7ee56aff9ee24249d248c3aae0267ff9e2ca6bf76fa368dadf4c53cd9c087d3f45611d", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="000000000100"/25], 0x50) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_DISALLOCATE(r2, 0x5608) r3 = dup(r2) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f00000007c0)={0x2, {0x2, 0x101, 0x0, 0x101}}) io_uring_setup(0x1de0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f0000001880)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000020000085000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r4, 0x0, 0x7}, 0x18) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2a0471a, &(0x7f00000000c0)={[{@quota}, {@bsdgroups}, {@nouid32}, {@errors_remount}, {@jqfmt_vfsv1}, {@oldalloc}, {@stripe={'stripe', 0x3d, 0x5}}]}, 0x2, 0x46b, &(0x7f0000000580)="$eJzs3M1vFOUfAPDvzLbw+/HWivgColaJsfGlpQWVgxeNJh4wmugB9VTbQgiFGloTIUSqMXgxMSR6Vo8m/gXevBj1ZGLiSe+GhCgX0FPNzM5Ad9ltt3TZrd3PJxl4nn2e7TzfPvPMPDPPbgPoWUPZP0nEtoj4LSIGqtnaCkPV/65dOTf595Vzk0ksLr72Z5LXu3rl3GRZtXzf1iIznEakHyXFTmrNnTl7YmJmZvp0kR+dP/nO6NyZs08ePzlxbPrY9KnxQ4cOHhh75unxp9oSZxbX1T3vz+7d/dIbF1+ePHLx7R+/ydq7rShfGsct2XTzS0NZ4H8t5urLHon/r2l36832Jemkr4sNYVUqEZF1V38+/geiEjc6byBe/LCrjQNuq+zatLl58cIisIEl0e0WAN1RXuiz+99y69DUY124/Fz1BiiL+1qxVUv6Ii3q9Nfd37bTUEQcWfjni2yLdjyHAABYwSeTnx+OJxrN/9K4e0m9HcUaymBE3BEROyPizojYFRF3ReR174mIe1e5//qloZvnP+mlWwqsRdn879libat2/lfO/mKwUuS25/H3J0ePz0zvL34nw9G/OcuPLbOP71745dNmZUvnf9mW7b+cCxbtuNRX94BuamJ+Ip+UtsHlDyL29DWKP7m+EpBExO6I2LO6H72jTBx/7Ou9zSqtHP8y2rDOtPhVxKPV/l+IuvhLyfLrk6P/i5np/aPlUXGzn36+8Gqz/a8p/jbI+n9L7fFflHx5pkgMvrV0vXYuVr1yeeH3j5ve09zq8b8peT0/H5XLru9NzM+fHovYlBzO8zWvj994b5kv62fxD+9rPP53Fu/J+v++iMgO4vsj4oGIeLBo+0MR8XBE7Fsm/h+eb162Hvp/quH57/rxP5jU9P/qE5UT33/bbP+t9f/BPDVcvJKf/1bQagPX8rsDAACA/4o0/wx8ko5cT6fpyEj1M/y7Yks6Mzs3//jR2XdPTVU/Kz8Y/Wn5pGtgyfPQsWSh+InV/HjxrLgsP1A8N/6sEnl+ZHJ2ZqrLsUOv29pk/Gf+qHS7dcBt12gdbbzBF9qAjad+/Ke12fOvdLIxQEf5vjb0rhXGf9qpdgCd5/oPvavR+D9fl7cWABuT6z/0LuMfepfxD72rbvxX4tdutQTooLV8r1+ilxORrotmtJRo/e9B3O7Em+ujGS0kun1mAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaI9/AwAA//9sbvBf") r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r5, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000000c0)={0x0, 0x2a, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0x3, 0x2) 0s ago: executing program 2 (id=11): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r1}, 0x18) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0, r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.215' (ED25519) to the list of known hosts. [ 28.284441][ T29] audit: type=1400 audit(1758431406.209:62): avc: denied { mounton } for pid=3293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.285526][ T3293] cgroup: Unknown subsys name 'net' [ 28.307177][ T29] audit: type=1400 audit(1758431406.209:63): avc: denied { mount } for pid=3293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.334525][ T29] audit: type=1400 audit(1758431406.249:64): avc: denied { unmount } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.512279][ T3293] cgroup: Unknown subsys name 'cpuset' [ 28.518515][ T3293] cgroup: Unknown subsys name 'rlimit' [ 28.649945][ T29] audit: type=1400 audit(1758431406.569:65): avc: denied { setattr } for pid=3293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.673231][ T29] audit: type=1400 audit(1758431406.569:66): avc: denied { create } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.693740][ T29] audit: type=1400 audit(1758431406.569:67): avc: denied { write } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.709514][ T3297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.714083][ T29] audit: type=1400 audit(1758431406.569:68): avc: denied { read } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 28.742878][ T29] audit: type=1400 audit(1758431406.589:69): avc: denied { mounton } for pid=3293 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.767644][ T29] audit: type=1400 audit(1758431406.589:70): avc: denied { mount } for pid=3293 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 28.788709][ T3293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.790928][ T29] audit: type=1400 audit(1758431406.659:71): avc: denied { relabelto } for pid=3297 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.660949][ T3303] chnl_net:caif_netlink_parms(): no params data found [ 30.681819][ T3304] chnl_net:caif_netlink_parms(): no params data found [ 30.699572][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 30.725191][ T3312] chnl_net:caif_netlink_parms(): no params data found [ 30.838490][ T3312] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.845636][ T3312] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.852781][ T3312] bridge_slave_0: entered allmulticast mode [ 30.859308][ T3312] bridge_slave_0: entered promiscuous mode [ 30.865799][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.873050][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.880126][ T3307] bridge_slave_0: entered allmulticast mode [ 30.886509][ T3307] bridge_slave_0: entered promiscuous mode [ 30.892938][ T3308] chnl_net:caif_netlink_parms(): no params data found [ 30.901467][ T3304] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.908565][ T3304] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.915773][ T3304] bridge_slave_0: entered allmulticast mode [ 30.922193][ T3304] bridge_slave_0: entered promiscuous mode [ 30.928501][ T3303] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.935607][ T3303] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.942731][ T3303] bridge_slave_0: entered allmulticast mode [ 30.949039][ T3303] bridge_slave_0: entered promiscuous mode [ 30.955664][ T3312] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.962740][ T3312] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.969889][ T3312] bridge_slave_1: entered allmulticast mode [ 30.976303][ T3312] bridge_slave_1: entered promiscuous mode [ 30.982514][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.989585][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.996910][ T3307] bridge_slave_1: entered allmulticast mode [ 31.003415][ T3307] bridge_slave_1: entered promiscuous mode [ 31.014753][ T3304] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.021869][ T3304] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.029139][ T3304] bridge_slave_1: entered allmulticast mode [ 31.035559][ T3304] bridge_slave_1: entered promiscuous mode [ 31.046266][ T3303] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.053363][ T3303] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.060523][ T3303] bridge_slave_1: entered allmulticast mode [ 31.066867][ T3303] bridge_slave_1: entered promiscuous mode [ 31.099977][ T3304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 31.110094][ T3304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 31.141269][ T3303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 31.156203][ T3312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 31.165990][ T3304] team0: Port device team_slave_0 added [ 31.172962][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 31.183064][ T3312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 31.200052][ T3303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 31.209688][ T3304] team0: Port device team_slave_1 added [ 31.216364][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 31.259178][ T3312] team0: Port device team_slave_0 added [ 31.273702][ T3307] team0: Port device team_slave_0 added [ 31.279860][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.286892][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 31.312928][ T3304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 31.323743][ T3308] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.330802][ T3308] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.338222][ T3308] bridge_slave_0: entered allmulticast mode [ 31.344716][ T3308] bridge_slave_0: entered promiscuous mode [ 31.352069][ T3312] team0: Port device team_slave_1 added [ 31.358402][ T3303] team0: Port device team_slave_0 added [ 31.364985][ T3303] team0: Port device team_slave_1 added [ 31.371258][ T3307] team0: Port device team_slave_1 added [ 31.377365][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.384336][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 31.410277][ T3304] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.423449][ T3308] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.430538][ T3308] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.437813][ T3308] bridge_slave_1: entered allmulticast mode [ 31.444314][ T3308] bridge_slave_1: entered promiscuous mode [ 31.470163][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.477187][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 31.503081][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 31.514369][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.521503][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 31.547411][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.578237][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.585257][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 31.611182][ T3303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 31.625209][ T3308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 31.634563][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.641495][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 31.667511][ T3312] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 31.688336][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.695286][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 31.721302][ T3303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.741965][ T3308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 31.751456][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.758434][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 31.784375][ T3312] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.803445][ T3304] hsr_slave_0: entered promiscuous mode [ 31.809370][ T3304] hsr_slave_1: entered promiscuous mode [ 31.839407][ T3307] hsr_slave_0: entered promiscuous mode [ 31.845640][ T3307] hsr_slave_1: entered promiscuous mode [ 31.851523][ T3307] debugfs: 'hsr0' already exists in 'hsr' [ 31.857319][ T3307] Cannot create hsr debugfs directory [ 31.869930][ T3308] team0: Port device team_slave_0 added [ 31.904242][ T3312] hsr_slave_0: entered promiscuous mode [ 31.910282][ T3312] hsr_slave_1: entered promiscuous mode [ 31.916131][ T3312] debugfs: 'hsr0' already exists in 'hsr' [ 31.921912][ T3312] Cannot create hsr debugfs directory [ 31.928011][ T3308] team0: Port device team_slave_1 added [ 31.940465][ T3303] hsr_slave_0: entered promiscuous mode [ 31.946375][ T3303] hsr_slave_1: entered promiscuous mode [ 31.952183][ T3303] debugfs: 'hsr0' already exists in 'hsr' [ 31.957896][ T3303] Cannot create hsr debugfs directory [ 31.989536][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.996533][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.022481][ T3308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.052232][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 32.059200][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.085252][ T3308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 32.165710][ T3308] hsr_slave_0: entered promiscuous mode [ 32.172756][ T3308] hsr_slave_1: entered promiscuous mode [ 32.178429][ T3308] debugfs: 'hsr0' already exists in 'hsr' [ 32.184168][ T3308] Cannot create hsr debugfs directory [ 32.271122][ T3307] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 32.286896][ T3307] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 32.300296][ T3307] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 32.311016][ T3307] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 32.337349][ T3304] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 32.347551][ T3304] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 32.356535][ T3304] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 32.373299][ T3304] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 32.389997][ T3303] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 32.399895][ T3303] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 32.408760][ T3303] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 32.417526][ T3303] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 32.471338][ T3312] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 32.481263][ T3312] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 32.492845][ T3312] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 32.509235][ T3312] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 32.525532][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.557304][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.567016][ T3303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.574660][ T3308] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 32.588579][ T3304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.597159][ T3308] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 32.606571][ T3308] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 32.615254][ T3308] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 32.627470][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.634570][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.652756][ T135] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.659802][ T135] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.668889][ T3303] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.689424][ T3304] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.702692][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.709778][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.724443][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.731489][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.756045][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.763150][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.779379][ T2678] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.786549][ T2678] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.807307][ T3312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.840611][ T3304] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 32.851216][ T3304] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 32.884097][ T3312] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.896704][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.903796][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.922650][ T3308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.935350][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.942454][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.958756][ T3308] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.970281][ T3304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.990941][ T3312] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 33.001321][ T3312] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 33.015285][ T383] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.022418][ T383] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.032280][ T383] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.039329][ T383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.057831][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.068612][ T3303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.085345][ T3308] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 33.211451][ T3308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.244722][ T3312] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.279452][ T3307] veth0_vlan: entered promiscuous mode [ 33.302037][ T3307] veth1_vlan: entered promiscuous mode [ 33.308819][ T3304] veth0_vlan: entered promiscuous mode [ 33.320193][ T3303] veth0_vlan: entered promiscuous mode [ 33.335526][ T3307] veth0_macvtap: entered promiscuous mode [ 33.347772][ T3304] veth1_vlan: entered promiscuous mode [ 33.359285][ T3307] veth1_macvtap: entered promiscuous mode [ 33.382516][ T3303] veth1_vlan: entered promiscuous mode [ 33.390006][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.400742][ T3304] veth0_macvtap: entered promiscuous mode [ 33.415139][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.424960][ T3304] veth1_macvtap: entered promiscuous mode [ 33.446893][ T2678] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.456739][ T3303] veth0_macvtap: entered promiscuous mode [ 33.464991][ T2678] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.476467][ T3308] veth0_vlan: entered promiscuous mode [ 33.484149][ T3303] veth1_macvtap: entered promiscuous mode [ 33.498059][ T3312] veth0_vlan: entered promiscuous mode [ 33.504154][ T3308] veth1_vlan: entered promiscuous mode [ 33.510141][ T2678] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.519818][ T2678] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.534275][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.555383][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 33.555394][ T29] audit: type=1400 audit(1758431411.479:81): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/root/syzkaller.FJQfmL/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 33.560948][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.564060][ T29] audit: type=1400 audit(1758431411.479:82): avc: denied { mount } for pid=3307 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 33.591715][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.592865][ T29] audit: type=1400 audit(1758431411.479:83): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/root/syzkaller.FJQfmL/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 33.647109][ T29] audit: type=1400 audit(1758431411.479:84): avc: denied { mount } for pid=3307 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 33.668834][ T29] audit: type=1400 audit(1758431411.479:85): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/root/syzkaller.FJQfmL/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 33.695380][ T29] audit: type=1400 audit(1758431411.479:86): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/root/syzkaller.FJQfmL/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4681 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 33.722739][ T29] audit: type=1400 audit(1758431411.479:87): avc: denied { unmount } for pid=3307 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.744627][ T29] audit: type=1400 audit(1758431411.519:88): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 33.767346][ T29] audit: type=1400 audit(1758431411.519:89): avc: denied { mount } for pid=3307 comm="syz-executor" name="/" dev="gadgetfs" ino=4682 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 33.791237][ T3307] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 33.803853][ T3312] veth1_vlan: entered promiscuous mode [ 33.812469][ T3308] veth0_macvtap: entered promiscuous mode [ 33.819712][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.832504][ T1009] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.841234][ T1009] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.861474][ T3312] veth0_macvtap: entered promiscuous mode [ 33.872249][ T3308] veth1_macvtap: entered promiscuous mode [ 33.880180][ T2678] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.886053][ T29] audit: type=1400 audit(1758431411.789:90): avc: denied { read write } for pid=3307 comm="syz-executor" name="loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 33.895140][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.939265][ T3312] veth1_macvtap: entered promiscuous mode [ 33.947238][ T2678] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.975452][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.994517][ T2678] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.016730][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.025452][ T2678] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.035227][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.057262][ T2678] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.074824][ T2678] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.087555][ T3477] tipc: Started in network mode [ 34.092625][ T3477] tipc: Node identity 4ace31101cd4, cluster identity 4711 [ 34.099933][ T3477] tipc: Enabled bearer , priority 0 [ 34.109163][ T2678] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.140236][ T2678] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.149552][ T3481] syzkaller0: entered promiscuous mode [ 34.155057][ T3481] syzkaller0: entered allmulticast mode [ 34.169852][ T2678] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.181253][ T2678] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.193165][ T3477] tipc: Resetting bearer [ 34.199035][ T2678] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.211151][ T1009] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.233188][ T3477] process 'syz.3.4' launched './file0' with NULL argv: empty string added [ 34.243660][ T3475] tipc: Resetting bearer [ 34.268263][ T3475] tipc: Disabling bearer [ 34.268510][ T3488] loop0: detected capacity change from 0 to 1024 [ 34.302638][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.331921][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.342510][ T3492] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2'. [ 34.351277][ T3488] ======================================================= [ 34.351277][ T3488] WARNING: The mand mount option has been deprecated and [ 34.351277][ T3488] and is ignored by this kernel. Remove the mand [ 34.351277][ T3488] option from the mount to silence this warning. [ 34.351277][ T3488] ======================================================= [ 34.392308][ T3494] $Hÿ: renamed from bond0 (while UP) [ 34.401424][ T3494] $Hÿ: entered promiscuous mode [ 34.406600][ T3494] bond_slave_0: entered promiscuous mode [ 34.412359][ T3494] bond_slave_1: entered promiscuous mode [ 34.442552][ T3488] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 34.477814][ T3495] 9pnet_fd: Insufficient options for proto=fd [ 34.493754][ T3488] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.607143][ T3503] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 34.623301][ T3503] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 319 with max blocks 1 with error 28 [ 34.635813][ T3503] EXT4-fs (loop0): This should not happen!! Data will be lost [ 34.635813][ T3503] [ 34.645590][ T3503] EXT4-fs (loop0): Total free blocks count 0 [ 34.651639][ T3503] EXT4-fs (loop0): Free/Dirty block details [ 34.657605][ T3503] EXT4-fs (loop0): free_blocks=4293918720 [ 34.663371][ T3503] EXT4-fs (loop0): dirty_blocks=16 [ 34.668499][ T3503] EXT4-fs (loop0): Block reservation details [ 34.674569][ T3503] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 34.686335][ T3506] netlink: 14 bytes leftover after parsing attributes in process `syz.3.9'. [ 35.111076][ T3503] syz.0.1 (3503) used greatest stack depth: 9896 bytes left [ 35.120357][ T3308] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.330426][ T3513] ================================================================== [ 35.338643][ T3513] BUG: KCSAN: data-race in bdev_statx / queue_limits_commit_update [ 35.346553][ T3513] [ 35.348875][ T3513] read to 0xffff88810245c0b8 of 4 bytes by task 3296 on cpu 0: [ 35.356446][ T3513] bdev_statx+0x295/0x2d0 [ 35.360797][ T3513] vfs_getattr_nosec+0x1b6/0x1e0 [ 35.365762][ T3513] vfs_statx+0x113/0x390 [ 35.370022][ T3513] vfs_fstatat+0x115/0x170 [ 35.374494][ T3513] __se_sys_newfstatat+0x55/0x260 [ 35.379546][ T3513] __x64_sys_newfstatat+0x55/0x70 [ 35.384598][ T3513] x64_sys_call+0x135a/0x2ff0 [ 35.389281][ T3513] do_syscall_64+0xd2/0x200 [ 35.393796][ T3513] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 35.399784][ T3513] [ 35.402106][ T3513] write to 0xffff88810245c078 of 192 bytes by task 3513 on cpu 1: [ 35.409945][ T3513] queue_limits_commit_update+0x4b/0x160 [ 35.415619][ T3513] loop_configure+0x789/0x9c0 [ 35.420301][ T3513] lo_ioctl+0x1e1/0x12b0 [ 35.424541][ T3513] blkdev_ioctl+0x34f/0x440 [ 35.429060][ T3513] __se_sys_ioctl+0xce/0x140 [ 35.433650][ T3513] __x64_sys_ioctl+0x43/0x50 [ 35.438281][ T3513] x64_sys_call+0x1816/0x2ff0 [ 35.442975][ T3513] do_syscall_64+0xd2/0x200 [ 35.447526][ T3513] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 35.453420][ T3513] [ 35.455744][ T3513] Reported by Kernel Concurrency Sanitizer on: [ 35.461922][ T3513] CPU: 1 UID: 0 PID: 3513 Comm: syz.0.10 Not tainted syzkaller #0 PREEMPT(voluntary) [ 35.471467][ T3513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 35.481521][ T3513] ================================================================== [ 35.528594][ T3513] loop0: detected capacity change from 0 to 512 [ 35.565076][ T3513] EXT4-fs: Ignoring removed oldalloc option [ 35.613515][ T3513] EXT4-fs (loop0): 1 truncate cleaned up [ 35.627421][ T3513] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.655284][ T3513] syz.0.10 uses obsolete (PF_INET,SOCK_PACKET) [ 35.825587][ T3496] syz.1.2 (3496) used greatest stack depth: 7512 bytes left [ 36.902905][ T3308] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.