last executing test programs: 1.976443075s ago: executing program 2 (id=83): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008fd8850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r0}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r1) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)={0x24, r2, 0x1, 0x0, 0x2000000, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) 1.922989126s ago: executing program 2 (id=86): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xe099, 0x0, 0x1, 0xb5}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r1, 0x47f6, 0x0, 0x2, 0x0, 0x0) write$evdev(r0, &(0x7f0000000040)=[{{}, 0x0, 0x2}], 0x37) 1.790133899s ago: executing program 2 (id=94): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x12) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='debugfs\x00', 0x0, 0x0) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f00000000c0)='./file0\x00', 0x60004ce) ioctl$AUTOFS_IOC_FAIL(r0, 0x4c80, 0xffffffffffffffb6) 1.629603941s ago: executing program 2 (id=98): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) lsm_set_self_attr(0x67, 0x0, 0xb4, 0x0) 1.596378612s ago: executing program 2 (id=99): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$binfmt_aout(r0, &(0x7f0000000340)=ANY=[], 0xff2e) r1 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) ioctl$TCXONC(r0, 0x540a, 0x3) 1.416605295s ago: executing program 4 (id=104): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000010a850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ac0)={&(0x7f0000000b00)='kmem_cache_free\x00', r0, 0x0, 0x1034}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) rt_sigaction(0x19, &(0x7f0000000000)={0xfffffffffffffffc, 0x44000006, 0x0}, 0x0, 0x8, &(0x7f0000000440)) r1 = memfd_create(&(0x7f00000006c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\xf2\xed\x04\x00\x00\x00\xd4N\x12\x9b\x1f\t\xd1Z+\x86T\x16\xf8\x01\x00\x00\x00\x9f+\x8d!\x0fG\xab\xc2\xdc\xa3\xb3\xae8\x9f9?\xefo\xa4k\x01\xb2>\xa1\x9c\x86xm\xe6\x9bZ4\x91\x1a\xdb\xdd\x89\xb9\xc0LF;\xd6\x84\x195\x06\x00\x00\x00~\xf3S\x12\"p^\xc1jP\x8a\xc6[\xbd\xe7q]\xdd\r\x1aZS\x01*\x1b\xfd\xbcMA\xdcq\xa1\x00\xb3\xf9\x91r\x7f\xdc\xf1\xc3G,\xdb\xccS\x15\x95b\x17\xab\xe4?\x96\x95\xa4kP\x99YO\xb8V\xd5p\x90X\xaaf', 0x0) fallocate(r1, 0x0, 0x400000000000000, 0x2) 1.336218637s ago: executing program 4 (id=105): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x12) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='debugfs\x00', 0x0, 0x0) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f00000000c0)='./file0\x00', 0x60004ce) ioctl$AUTOFS_IOC_FAIL(r0, 0x4c80, 0xffffffffffffffb6) 1.318229207s ago: executing program 0 (id=106): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='sys_enter\x00', r1}, 0x10) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) 1.262040458s ago: executing program 4 (id=108): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, '\x00', 0x1c}, 0x3f}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200000008000300ac1414aa0800060001"], 0x38}, 0x1, 0x0, 0x0, 0x4000011}, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="010028bd7000fcdbdf2504"], 0x14}}, 0x0) 1.221348979s ago: executing program 0 (id=110): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x40, 0x9, 0x7ffc0002}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000700)={&(0x7f00000006c0)='kmem_cache_free\x00', r1}, 0x10) syz_mount_image$ext4(&(0x7f0000000440)='ext4\x00', &(0x7f00000011c0)='./file0\x00', 0xa00008, &(0x7f0000000900)={[{@journal_async_commit}, {@block_validity}, {@mb_optimize_scan}, {@noinit_itable}]}, 0x1, 0x7c1, &(0x7f00000019c0)="$eJzs3c9rHFEdAPDvbDY/mtYmgqD1FBA0ULoxMbYKghUPIlgo6LntstmGmk22ZDelCYG2iODFg+JBsJeerdZbr/646sW/wYO0VE2rFQ8Smd3ZZpPdTdM2u1vJ5wOTvPdmNu995828edkZdgM4sWbSH7mIcxGjaXIqK08iK4h8xOXmdq93tkvpksTu7nf/njS2ebWzXYq216ROZ5nPRMTvfxhxPtdZb21za6VYqZTXs/xcffX2XG1z68Kt1eJyebm8dnF+cXHh0pcvXUzXPjl7HLH+609bZ57/5Ftf+PXl//zg009+/IckLseZbF17HMdlJmayfTKa7sJ9vnnclQ1ZMuwG8F7SU3OkeZbHuZiKkUN68usDbRkA0C/3ImIXADhhEtd/ADhhWu8DvNrZLrWWaN7PuT/UNyYG5MU3ImKiGX/r/mZzTb55z+7PE437oJOvksY9kpYkIqaPof6ZiHj49NrjdIk+3YcE6Ob+g4i4MT1zcPxPR7iDzyy8qy8eYZuZA3njHwzOb9P5z1c6538Ruez8n2j8PDj/Ge9y7r6Pt5//uWf7sqPHUGmbdP73tbZn2163xZ+ZHslyn2jM+UaTm7cq5XRsOxsRszE6nubnD6lj9uV/X/Za1z7/+8dPv//LtP70994WuWf58f2vWSrWix8Sc7sXDyI+m+8Wf/Km/5Me89+rR6zj21/90S96rUvjT+NtLZ3x99fuo4jPd+3/veegkkOfT5xrHA5zrYOii9/85eeTvepv7/+HT9Oatkut/wUGIe3/ycPjn07an9esvXsdf3w09bte6/bHf+1xWv/++Lsf/2PJ9xrpsazsbrFeX5+PGEu+01m+sPfau8V6Phb2tk/jn/1c9/P/sOM/HYZuZOndtzz8mH/+t1+9f/z9lca/lPZ/kgXx1v5/98ST1ysjvervjL+Z39si7f/FRmo2K+kc//Idf/eoDfygnQcAAAAAAAAAAAAAAAAAAAAAAAAAR5SLiDOR5Apv0rlcodD8Du9PxWSuUq3Vz9+sbqwtReO7sqdjNNf6qMupts9Dnc8+D7+VXziQ/1JEfDIifjZ+qpEvlKqVpWEHDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZ0z2+/z/11/Fhtw4A6JuJYTcAABg4138AOHl6XP/Huhef6mtbAIDBaFz/k/ywmwEADJD3/wHg5HH9BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoM+uXrmSLrv/3tkupfmlO5sbK9U7F5bKtZXC6kapUKqu3y4sV6vLlXKhVF3t+YfuN39VqtXbi7G2cXeuXq7V52qbW9dXqxtr9eu3VovL5evl0YFFBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABHV9vcWmmlV4qVSnk9LZHoSNz7KJrxIOuqYe+NIST++XE046NKjEdEv6poHyVODXxcAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPh/8b8AAAD//6EaG+0=") newfstatat(0xffffffffffffff9c, &(0x7f0000002580)='./file0\x00', &(0x7f0000001140), 0x100) 1.12225363s ago: executing program 3 (id=111): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000004c0)='kmem_cache_free\x00', r1}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000003c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r2 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) fsync(r2) 1.079362581s ago: executing program 3 (id=113): r0 = syz_io_uring_setup(0xbc3, &(0x7f0000001480)={0x0, 0xe8ea, 0x400, 0x4, 0x1ab}, &(0x7f0000000280)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000300)=@IORING_OP_SYMLINKAT={0x26, 0x4, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x0, 0x1}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000001000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r0, 0x47f8, 0x0, 0x0, 0x0, 0x0) 1.063890111s ago: executing program 0 (id=114): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x1, 0x80, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x3f, 0x14, 0x67, 0x0, 0x0, 0x0, 0x0, @multicast1, @empty}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000a00)={'ip_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0xffffffff, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @empty}}}}) syz_mount_image$ext4(&(0x7f0000000440)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f0000000000)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x100000}}, {@resuid}, {@jqfmt_vfsv1}, {@errors_remount}, {@nobh}, {@usrjquota, 0x2e}], [], 0x2e}, 0x1, 0x46f, &(0x7f0000000580)="$eJzs289vFFUcAPDvbLvlt62IP/ihVtHY+KOlBZWDF40mXExM9IDHWgpBCjW0JkKIVGPwaPgL1KOJf4EnvRj1pPGqiRcTY0IMF9GDGTO7M7C0u+v+ahfczycZeG/mTd/7zszbfTNvJ4CBNZ79k0Rsj4ifRiJGq9mbC4xX/7t29cLcX1cvzCWRpq/+kVTK/Xn1wlxRtNhvW56ZKEWUPkhib516l86dPzW7sDB/Ns9PLZ9+a2rp3PmnTp6ePTF/Yv7MzOHDhw5OP/vMzNM9iXNH1tY97y7u233k9csvzx29/Ma3n2frt+fba+OoGuu6zvEYv/lY1ng04tc0Tbuu41axoyadDPexIbRlKCKy01XO+n+MxlDcOHmj8dL7fW0csK7SNE03rVk7VCRWUuB/LIl+twDoj+KLPrv/LZYNHH703ZXnqzdAWdzX8qW6ZThKeZnyqvvbXhqPiKMrf3+cLVH3OQQAQG99mY1/nqw3/ivFPTXl7ojq3NBYRNwZETsj4q6I2BURd0dUyt4bEfe1Wf/4qvza8c8PWzoKrEXZ+O+5fG7r5vFfMfqLsaE8t6MSfzk5fnJh/kB+TCaivCnLTzep46sXf/yo0bba8V+2ZPUXY8G8Hb8Pr3pAd2x2ebabmGtdeS9iz3C9+JPrMwFJROyOiD0d/P3smJ18/LN9jbb/d/xN9GCeKf004rHq+V+JVfEXkubzk1ObY2H+wFRxVaz13feXXmlUf1fx90B2/rfWvf6vxz+W1M7XLrVfx6WfP2x4T9Pp9T+SvFZJj+Tr3pldXj47HTGSrKxdP3Nj3yJflM/in9hfv//vjPjnk3y/vRGRXcT3R8QDEfFg3vaHIuLhiNjfJP5vXnjkzc7jX19Z/MfaOv/tJ4ZOff1Fo/pbO/+HKqmJfE0rn3+tNrCbYwcAAAC3i1LlN/BJafJ6ulSanKz+hn9XbC0tLC4tP3F88e0zx6q/lR+Lcql40jVa8zx0On82XORnVuUPVp4bp2mabqnkJ+cWF9ZrTh1ozbYG/T/z21C/Wwesu7bm0Rq90QbclryvCYNL/4fB1Wr/L69zO4CN5/sfBle9/n8x4lofmgJsMN//MLj0fxhc+j8MLv0fBlI37/U3S+w80vHuaVe1b84D63D3X9blaDRLDG1gXb1MRKnupnJE3CItbJIo3RrNqCY2RUSrhS92emG3nejzBxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAECP/BsAAP//cGjokQ==") 947.115403ms ago: executing program 3 (id=117): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x3f, 0x1, 0x0, 0x0, 0x0, 0x7, 0x590, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext={0x7, 0xa5d4}, 0x4c58, 0x5, 0x0, 0x1, 0x8, 0x20002, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = io_uring_setup(0x7883, &(0x7f0000000a40)={0x0, 0x0, 0x2, 0x1, 0x3bd}) r1 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r1, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r1, 0x4) close_range(r0, r1, 0x0) 927.458183ms ago: executing program 1 (id=118): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x10, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000003c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x0, 0x1c, &(0x7f0000000040)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007b88f8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b705000008000000a5000000bf"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) ptrace$getregset(0x4205, r0, 0x1, &(0x7f0000000080)={&(0x7f00000000c0)=""/120, 0x78}) 891.059234ms ago: executing program 3 (id=119): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x12) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='debugfs\x00', 0x0, 0x0) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f00000000c0)='./file0\x00', 0x60004ce) ioctl$AUTOFS_IOC_FAIL(r0, 0x4c80, 0xffffffffffffffb6) 890.210234ms ago: executing program 0 (id=129): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000980)='mm_page_free\x00', r1}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 867.757035ms ago: executing program 3 (id=120): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6}]}, 0x10) getsockopt$sock_buf(r2, 0x1, 0x1a, &(0x7f0000001340)=""/4096, &(0x7f0000000340)=0x1000) 847.615395ms ago: executing program 1 (id=121): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='sys_enter\x00', r1}, 0x10) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) 787.934976ms ago: executing program 1 (id=122): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000004000)={&(0x7f0000000a40)=@newtaction={0x488, 0x30, 0x101, 0x0, 0x0, {0x0, 0x0, 0x1100}, [{0x474, 0x1, [@m_police={0x470, 0x1, 0x0, 0x0, {{0xb}, {0x444, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x7, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffffc, 0x0, 0x4, 0x0, 0x80, 0x0, 0x0, 0x0, 0xfffffc01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {0x1, 0x0, 0x0, 0x0, 0x5, 0x4}, {0x0, 0x0, 0x9, 0x0, 0x2}}}]]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x488}}, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000280)={0x1, 0x66c, 0x0, 'queue1\x00'}) poll(&(0x7f0000000100)=[{r0}], 0x1, 0x9d) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32={[0x2600]}}], 0xffc8) 674.822638ms ago: executing program 2 (id=123): syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f00000002c0)='./bus\x00', 0x404, &(0x7f00000005c0)={[{@discard}, {@bh}, {@nomblk_io_submit}]}, 0x1, 0x5d8, &(0x7f0000000c00)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7ffff000) 643.408618ms ago: executing program 0 (id=124): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x10, &(0x7f0000000840)=@framed={{}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r2}, 0x10) write$selinux_load(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x2000) 586.628399ms ago: executing program 1 (id=125): r0 = socket$netlink(0x10, 0x3, 0xb) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2fffffffd}, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0x21, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000001850000001b000000b70000000000070095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kfree\x00', r2}, 0x18) close(r0) 474.030381ms ago: executing program 1 (id=126): open(0x0, 0x80140, 0x0) syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./file2\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x6, 0x360, &(0x7f0000000b00)="$eJzs3c1rO0UYwPEnaZImKW1yEEVBOtiLXpY2ehaDtCAELG0jtoKwbTcasiYlG6oRse3Jq3j3JHgovVnwUND+A71404sI3noRPFhBXdm3ZPPWl5g0/trvB0omM/PszmQn5dm0m718+/MPKiVLK+kNiSaVRERErkSyEpVAxH+MuuWEhB3KSzO///j8+mYx6VWolfzGyzml1Nz8dx9+kvK7nU3LRfbdy99yv148ffHs5T8b75ctVbZUtdZQutqu/dzQt01D7ZatiqbUqmnolqHKVcuoe+3f+Nsxa3t7TaVXd2fTe3XDspRebaqK0VSNmmrUm0p/Ty9XlaZpajYtuEnxeG1Nzw8ZvDPiwWBM6vW8PiUiqZ6W4vFEBgQAACaqO/+POin9MPn/lswVCstryunczv9PXjhvzLx1Oufn/2eJfvn/Kz952+rI/53TiXb+X/POD0o35/9fyh3y/96M6HEZOv/PjmEwGM58oqcq0vHMyf/T/vvXdfTOyaJbIP8HAAAAAAAAAAAAAAAAAAAAAOBJcGXbGdu2M8Fj8NO+hMB/jgdp0PGfFpGkc/Rtjv9Dtr65JUn3wj3nGJuf7Rf3i96j3+FcREwx/ra7OWsjuPJIObLyvXngxx/sF6fclnxJyk68LElGsu56CsXb9sobheUl5fHjW5cppcPxOcnIU+H4b93V6cTnOuP9/SfkxYVQvCYZ+WFHamLKrhvZ3v+nS0q9/mahKz7l9hORX+79oAAAAAAAMGKaaul7/q5pg9q9bxnJl9yPiQxZlIz81f/8frHv+Xks81xs0rMHAAAAAOBxsJofV3SJGnW3YJr9CikZ2DSCQqyjJi4ifTsnumri1215KjTD244nId4dTP7rvL4KXtW7RAX/SOEMvNXk31FFhhtPMH+3JhJrNf1513lFDsVdAIfhpqjcIjzWPfh5p0L17bwwcDtH/kRaNcHHRokBr7Os9m4nes1KiPfU2JHhFsAzX3z9x+jeIK+e+ivgo5s7H5mGfSC3OShdBWcXvU3xsf/iAQAAAHDv2kl/UPNauDl8I5HwzXL4yz0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAACM0lq/06ypMeo4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA/8W/AQAA//9/d/Qh") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x105042, 0x40) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a000020095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff52, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000200)='kmem_cache_free\x00', r1}, 0x10) write$cgroup_subtree(r0, &(0x7f0000000880)=ANY=[], 0x32600) 392.085663ms ago: executing program 4 (id=127): prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020700000000000002030207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000100850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='sched_switch\x00', r0}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c00038008000140000000000800024000000000180003801400010076657468305f746f5f687372000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003"], 0xfc}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000d40000000000000000000000000a20000000000a03000000000000000000010000000900010073797a3000000000bc000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000009000038008000240000000007c00030f14000100626f6e64300000000000000000000000140001006970766c616e31000000000000000000140001006970766c616e300000000000000000001400010073697430000000000000fbffffffffffffff0100776c616e300000000000000000000000140001006772653000000000000000000000040008000140000000005c000000180a01010000000000000000010000000900020073797a30000000000900010073797a3000"], 0x4b0}}, 0x0) 347.640444ms ago: executing program 0 (id=128): r0 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) ftruncate(r0, 0x2007ffc) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000030000000000000000000400b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000600)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000001c0)='mm_page_free\x00', r2}, 0x18) sendfile(r0, r0, 0x0, 0x800000009) 214.589306ms ago: executing program 1 (id=130): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000280)='kmem_cache_free\x00', r1, 0x0, 0x200000000000006}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc9ffc}]}) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xc000, 0x0) faccessat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2) 198.579606ms ago: executing program 4 (id=131): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0900000004000000563c000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf79d}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1, 0x0, 0x1000000100}, 0x18) pipe(&(0x7f0000005880)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_selinux(r2, &(0x7f00000000c0), &(0x7f0000000040)='system_u:object_r:dhcp_state_t:s0\x00', 0x1e, 0x0) 52.096839ms ago: executing program 4 (id=132): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000400000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) socket$key(0xf, 0x3, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000001040)=ANY=[@ANYBLOB="38010000100013070000080000000000ffffffff000000000002000000000000fe8000000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000200040000000000000048000200656362286369706865725f6e756c6c29"], 0x138}, 0x1, 0xe}, 0x0) 0s ago: executing program 3 (id=133): r0 = syz_io_uring_setup(0x24fc, &(0x7f0000000180)={0x0, 0x6386, 0x10580, 0x3}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='1q'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x50, 0x6, r3, 0x0, 0x0, 0x0, 0x40002061, 0x0, {0x203}}) io_uring_enter(r0, 0x2d3e, 0x0, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.207' (ED25519) to the list of known hosts. [ 24.620829][ T29] audit: type=1400 audit(1749058922.394:62): avc: denied { mounton } for pid=3305 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.621513][ T3305] cgroup: Unknown subsys name 'net' [ 24.643538][ T29] audit: type=1400 audit(1749058922.394:63): avc: denied { mount } for pid=3305 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.670946][ T29] audit: type=1400 audit(1749058922.424:64): avc: denied { unmount } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.890754][ T3305] cgroup: Unknown subsys name 'cpuset' [ 24.896803][ T3305] cgroup: Unknown subsys name 'rlimit' [ 25.084912][ T29] audit: type=1400 audit(1749058922.854:65): avc: denied { setattr } for pid=3305 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.110084][ T29] audit: type=1400 audit(1749058922.854:66): avc: denied { create } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.130605][ T29] audit: type=1400 audit(1749058922.854:67): avc: denied { write } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.142053][ T3308] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.151033][ T29] audit: type=1400 audit(1749058922.854:68): avc: denied { read } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.179959][ T29] audit: type=1400 audit(1749058922.864:69): avc: denied { mounton } for pid=3305 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.185570][ T3305] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.205006][ T29] audit: type=1400 audit(1749058922.864:70): avc: denied { mount } for pid=3305 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 25.236971][ T29] audit: type=1400 audit(1749058922.934:71): avc: denied { relabelto } for pid=3308 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.974526][ T3321] chnl_net:caif_netlink_parms(): no params data found [ 27.025275][ T3320] chnl_net:caif_netlink_parms(): no params data found [ 27.050824][ T3316] chnl_net:caif_netlink_parms(): no params data found [ 27.089414][ T3315] chnl_net:caif_netlink_parms(): no params data found [ 27.106716][ T3321] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.113860][ T3321] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.121029][ T3321] bridge_slave_0: entered allmulticast mode [ 27.127423][ T3321] bridge_slave_0: entered promiscuous mode [ 27.134356][ T3321] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.141490][ T3321] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.148671][ T3321] bridge_slave_1: entered allmulticast mode [ 27.154998][ T3321] bridge_slave_1: entered promiscuous mode [ 27.182217][ T3317] chnl_net:caif_netlink_parms(): no params data found [ 27.195529][ T3321] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.216058][ T3321] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.231609][ T3320] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.238779][ T3320] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.245968][ T3320] bridge_slave_0: entered allmulticast mode [ 27.252450][ T3320] bridge_slave_0: entered promiscuous mode [ 27.278245][ T3320] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.285418][ T3320] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.292616][ T3320] bridge_slave_1: entered allmulticast mode [ 27.298956][ T3320] bridge_slave_1: entered promiscuous mode [ 27.307423][ T3321] team0: Port device team_slave_0 added [ 27.327492][ T3321] team0: Port device team_slave_1 added [ 27.337260][ T3316] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.344449][ T3316] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.351614][ T3316] bridge_slave_0: entered allmulticast mode [ 27.357934][ T3316] bridge_slave_0: entered promiscuous mode [ 27.378333][ T3315] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.385419][ T3315] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.392739][ T3315] bridge_slave_0: entered allmulticast mode [ 27.399031][ T3315] bridge_slave_0: entered promiscuous mode [ 27.405428][ T3316] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.412619][ T3316] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.419910][ T3316] bridge_slave_1: entered allmulticast mode [ 27.426415][ T3316] bridge_slave_1: entered promiscuous mode [ 27.438426][ T3320] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.448886][ T3320] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.466688][ T3315] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.473797][ T3315] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.481182][ T3315] bridge_slave_1: entered allmulticast mode [ 27.487466][ T3315] bridge_slave_1: entered promiscuous mode [ 27.507021][ T3317] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.514100][ T3317] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.521443][ T3317] bridge_slave_0: entered allmulticast mode [ 27.527809][ T3317] bridge_slave_0: entered promiscuous mode [ 27.534455][ T3321] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.541463][ T3321] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.567392][ T3321] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.578645][ T3321] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.585792][ T3321] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.612000][ T3321] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.627704][ T3316] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.641355][ T3317] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.648611][ T3317] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.655948][ T3317] bridge_slave_1: entered allmulticast mode [ 27.662277][ T3317] bridge_slave_1: entered promiscuous mode [ 27.672209][ T3315] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.682489][ T3315] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.692495][ T3316] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.706796][ T3320] team0: Port device team_slave_0 added [ 27.730327][ T3320] team0: Port device team_slave_1 added [ 27.753650][ T3316] team0: Port device team_slave_0 added [ 27.764689][ T3317] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.775574][ T3321] hsr_slave_0: entered promiscuous mode [ 27.781581][ T3321] hsr_slave_1: entered promiscuous mode [ 27.788058][ T3315] team0: Port device team_slave_0 added [ 27.794324][ T3316] team0: Port device team_slave_1 added [ 27.800664][ T3315] team0: Port device team_slave_1 added [ 27.806695][ T3320] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.813668][ T3320] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.839689][ T3320] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.851292][ T3317] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.885628][ T3320] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.892612][ T3320] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.918695][ T3320] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.938095][ T3315] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.945106][ T3315] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.971071][ T3315] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.982171][ T3315] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.989121][ T3315] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.015312][ T3315] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.026539][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.033498][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.059444][ T3316] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.078992][ T3317] team0: Port device team_slave_0 added [ 28.094142][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.101223][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.127313][ T3316] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.142844][ T3317] team0: Port device team_slave_1 added [ 28.174985][ T3317] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.181992][ T3317] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.208124][ T3317] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.226012][ T3320] hsr_slave_0: entered promiscuous mode [ 28.232301][ T3320] hsr_slave_1: entered promiscuous mode [ 28.238205][ T3320] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.245809][ T3320] Cannot create hsr debugfs directory [ 28.258803][ T3317] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.265994][ T3317] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.291911][ T3317] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.308969][ T3315] hsr_slave_0: entered promiscuous mode [ 28.315000][ T3315] hsr_slave_1: entered promiscuous mode [ 28.320842][ T3315] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.328388][ T3315] Cannot create hsr debugfs directory [ 28.362092][ T3316] hsr_slave_0: entered promiscuous mode [ 28.368202][ T3316] hsr_slave_1: entered promiscuous mode [ 28.374122][ T3316] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.381762][ T3316] Cannot create hsr debugfs directory [ 28.422080][ T3317] hsr_slave_0: entered promiscuous mode [ 28.428153][ T3317] hsr_slave_1: entered promiscuous mode [ 28.434348][ T3317] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.442005][ T3317] Cannot create hsr debugfs directory [ 28.512520][ T3321] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 28.533185][ T3321] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 28.543455][ T3321] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 28.560887][ T3321] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 28.620755][ T3315] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 28.635711][ T3315] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 28.646205][ T3315] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 28.656175][ T3315] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 28.675560][ T3320] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 28.688053][ T3320] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 28.696657][ T3320] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 28.705536][ T3320] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 28.723427][ T3321] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.750536][ T3321] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.762733][ T3317] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 28.775057][ T3317] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 28.783604][ T3317] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 28.793968][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.801118][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.821516][ T3317] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 28.839043][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.846235][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.863461][ T3315] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.874619][ T3316] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 28.884590][ T3316] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 28.903387][ T3316] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 28.916062][ T3316] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 28.928763][ T3320] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.943699][ T3315] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.956218][ T3320] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.994503][ T311] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.001622][ T311] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.012375][ T311] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.019640][ T311] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.029106][ T311] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.036168][ T311] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.044848][ T311] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.051928][ T311] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.075662][ T3321] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.104700][ T3315] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 29.115142][ T3315] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 29.152972][ T3317] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.179324][ T3317] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.201502][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.208614][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.225989][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.233114][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.247882][ T3316] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.256621][ T3320] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.276114][ T3315] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.298982][ T3316] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.331516][ T1661] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.338602][ T1661] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.351086][ T1661] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.358173][ T1661] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.368325][ T3321] veth0_vlan: entered promiscuous mode [ 29.391725][ T3321] veth1_vlan: entered promiscuous mode [ 29.438274][ T3321] veth0_macvtap: entered promiscuous mode [ 29.452349][ T3321] veth1_macvtap: entered promiscuous mode [ 29.461215][ T3317] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.494118][ T3321] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.544569][ T3321] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.558844][ T3320] veth0_vlan: entered promiscuous mode [ 29.568021][ T3321] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.577012][ T3321] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.585982][ T3321] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.594687][ T3321] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.612032][ T3316] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.620585][ T3320] veth1_vlan: entered promiscuous mode [ 29.648057][ T3315] veth0_vlan: entered promiscuous mode [ 29.661378][ T3317] veth0_vlan: entered promiscuous mode [ 29.679737][ T3315] veth1_vlan: entered promiscuous mode [ 29.686462][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 29.686485][ T29] audit: type=1400 audit(1749058927.464:81): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/root/syzkaller.vo74yo/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 29.693135][ T3317] veth1_vlan: entered promiscuous mode [ 29.720697][ T29] audit: type=1400 audit(1749058927.464:82): avc: denied { mount } for pid=3321 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 29.740644][ T3315] veth0_macvtap: entered promiscuous mode [ 29.744788][ T29] audit: type=1400 audit(1749058927.464:83): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/root/syzkaller.vo74yo/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 29.758991][ T3320] veth0_macvtap: entered promiscuous mode [ 29.775692][ T29] audit: type=1400 audit(1749058927.464:84): avc: denied { mount } for pid=3321 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 29.789159][ T3315] veth1_macvtap: entered promiscuous mode [ 29.803235][ T29] audit: type=1400 audit(1749058927.464:85): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/root/syzkaller.vo74yo/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 29.812947][ T3320] veth1_macvtap: entered promiscuous mode [ 29.835485][ T29] audit: type=1400 audit(1749058927.464:86): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/root/syzkaller.vo74yo/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4472 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 29.852088][ T3317] veth0_macvtap: entered promiscuous mode [ 29.868538][ T29] audit: type=1400 audit(1749058927.464:87): avc: denied { unmount } for pid=3321 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 29.880666][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.923375][ T3320] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.923441][ T3321] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 29.935026][ T3316] veth0_vlan: entered promiscuous mode [ 29.953591][ T3316] veth1_vlan: entered promiscuous mode [ 29.959860][ T3317] veth1_macvtap: entered promiscuous mode [ 29.960439][ T29] audit: type=1400 audit(1749058927.564:88): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 29.967861][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.988462][ T29] audit: type=1400 audit(1749058927.564:89): avc: denied { mount } for pid=3321 comm="syz-executor" name="/" dev="gadgetfs" ino=4500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 30.002683][ T3317] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.033238][ T3320] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.045135][ T3315] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.050109][ T29] audit: type=1400 audit(1749058927.814:90): avc: denied { read write } for pid=3321 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 30.053954][ T3315] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.086729][ T3315] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.095482][ T3315] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.113029][ T3320] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.121836][ T3320] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.130668][ T3320] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.139384][ T3320] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.154432][ T3317] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.165130][ T3317] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.174038][ T3317] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.182948][ T3317] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.191727][ T3317] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.266014][ T3316] veth0_macvtap: entered promiscuous mode [ 30.285474][ T3316] veth1_macvtap: entered promiscuous mode [ 30.299399][ T3462] Zero length message leads to an empty skb [ 30.324787][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.363607][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.382665][ T3470] capability: warning: `syz.4.8' uses deprecated v2 capabilities in a way that may be insecure [ 30.412151][ T3316] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.421929][ T3316] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.430737][ T3316] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.439684][ T3316] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.496157][ T3475] syzkaller1: entered promiscuous mode [ 30.501766][ T3475] syzkaller1: entered allmulticast mode [ 30.519017][ T3473] process 'syz.1.9' launched './file0' with NULL argv: empty string added [ 30.646648][ T3490] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.16'. [ 30.680101][ C1] hrtimer: interrupt took 45401 ns [ 30.773682][ T3503] loop0: detected capacity change from 0 to 512 [ 30.804748][ T3503] EXT4-fs: Ignoring removed nobh option [ 30.848453][ T3508] loop3: detected capacity change from 0 to 1024 [ 30.856676][ T3503] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -13 [ 30.877498][ T3508] EXT4-fs: Ignoring removed bh option [ 30.883060][ T3508] EXT4-fs: Ignoring removed nomblk_io_submit option [ 30.922963][ T3508] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 30.923866][ T3503] EXT4-fs error (device loop0): ext4_clear_blocks:876: inode #13: comm syz.0.22: attempt to clear invalid blocks 2 len 1 [ 31.019015][ T3503] EXT4-fs (loop0): Remounting filesystem read-only [ 31.063128][ T3521] loop4: detected capacity change from 0 to 1024 [ 31.086991][ T3503] EXT4-fs (loop0): 1 truncate cleaned up [ 31.090636][ T3521] ======================================================= [ 31.090636][ T3521] WARNING: The mand mount option has been deprecated and [ 31.090636][ T3521] and is ignored by this kernel. Remove the mand [ 31.090636][ T3521] option from the mount to silence this warning. [ 31.090636][ T3521] ======================================================= [ 31.097108][ T3503] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.168494][ T3521] EXT4-fs: Ignoring removed mblk_io_submit option [ 31.211705][ T3521] EXT4-fs: Ignoring removed nobh option [ 31.217428][ T3521] EXT4-fs: Ignoring removed bh option [ 31.244815][ T3521] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.267962][ T3317] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.407175][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.652383][ T3558] bond_slave_0: entered promiscuous mode [ 31.658163][ T3558] bond_slave_1: entered promiscuous mode [ 31.711982][ T3558] macvlan2: entered allmulticast mode [ 31.717488][ T3558] bond0: entered allmulticast mode [ 31.722705][ T3558] bond_slave_0: entered allmulticast mode [ 31.728512][ T3558] bond_slave_1: entered allmulticast mode [ 31.786010][ T3558] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 31.814589][ T3558] bridge0: port 3(macvlan2) entered blocking state [ 31.821444][ T3558] bridge0: port 3(macvlan2) entered disabled state [ 31.834957][ T3558] macvlan2: entered promiscuous mode [ 31.840401][ T3558] bond0: entered promiscuous mode [ 31.852680][ T3568] loop1: detected capacity change from 0 to 512 [ 31.884278][ T3558] bridge0: port 3(macvlan2) entered blocking state [ 31.890958][ T3558] bridge0: port 3(macvlan2) entered forwarding state [ 31.912934][ T3568] EXT4-fs: Ignoring removed nobh option [ 31.951340][ T3568] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -13 [ 31.994107][ T3568] EXT4-fs error (device loop1): ext4_clear_blocks:876: inode #13: comm syz.1.39: attempt to clear invalid blocks 2 len 1 [ 32.016597][ T3316] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.027876][ T3568] EXT4-fs (loop1): Remounting filesystem read-only [ 32.047170][ T3575] loop2: detected capacity change from 0 to 1024 [ 32.048651][ T3568] EXT4-fs (loop1): 1 truncate cleaned up [ 32.059904][ T3568] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.120877][ T3575] EXT4-fs: Ignoring removed mblk_io_submit option [ 32.127569][ T3575] EXT4-fs: Ignoring removed nobh option [ 32.133229][ T3575] EXT4-fs: Ignoring removed bh option [ 32.159286][ T3321] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.204945][ T3575] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.287848][ T3315] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.309499][ T3599] loop0: detected capacity change from 0 to 1024 [ 32.348257][ T3599] EXT4-fs: Ignoring removed bh option [ 32.353813][ T3599] EXT4-fs: Ignoring removed nomblk_io_submit option [ 32.382129][ T3599] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.469018][ T3614] loop2: detected capacity change from 0 to 512 [ 32.487155][ T3614] EXT4-fs: Ignoring removed nobh option [ 32.506943][ T3614] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -13 [ 32.530785][ T3614] EXT4-fs error (device loop2): ext4_clear_blocks:876: inode #13: comm syz.2.58: attempt to clear invalid blocks 2 len 1 [ 32.561010][ T3614] EXT4-fs (loop2): Remounting filesystem read-only [ 32.580948][ T3614] EXT4-fs (loop2): 1 truncate cleaned up [ 32.586977][ T3614] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.618401][ T3621] geneve0: entered allmulticast mode [ 32.739431][ T3315] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.869342][ T3635] netlink: 28 bytes leftover after parsing attributes in process `syz.2.68'. [ 32.878231][ T3635] netlink: 8 bytes leftover after parsing attributes in process `syz.2.68'. [ 33.260549][ T3654] 9pnet_fd: Insufficient options for proto=fd [ 33.317879][ T3317] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.338309][ T3656] loop4: detected capacity change from 0 to 512 [ 33.359191][ T3656] EXT4-fs: Ignoring removed nobh option [ 33.396231][ T3656] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -13 [ 33.405665][ T3656] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #13: comm syz.4.77: attempt to clear invalid blocks 2 len 1 [ 33.432434][ T3656] EXT4-fs (loop4): Remounting filesystem read-only [ 33.439162][ T3656] EXT4-fs (loop4): 1 truncate cleaned up [ 33.447067][ T3664] loop1: detected capacity change from 0 to 1024 [ 33.458299][ T3664] EXT4-fs: Ignoring removed bh option [ 33.463963][ T3664] EXT4-fs: Ignoring removed nomblk_io_submit option [ 33.471663][ T3656] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.498089][ T3664] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.541520][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.632278][ T3669] syz.0.80 (3669) used greatest stack depth: 10784 bytes left [ 33.736334][ T3687] mmap: syz.4.91 (3687) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 33.995379][ T3714] loop3: detected capacity change from 0 to 512 [ 34.008816][ T3714] EXT4-fs: Ignoring removed nobh option [ 34.016039][ T3714] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -13 [ 34.028151][ T3714] EXT4-fs error (device loop3): ext4_clear_blocks:876: inode #13: comm syz.3.95: attempt to clear invalid blocks 2 len 1 [ 34.044276][ T3714] EXT4-fs (loop3): Remounting filesystem read-only [ 34.051649][ T3714] EXT4-fs (loop3): 1 truncate cleaned up [ 34.070517][ T3714] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 34.163015][ T3316] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.379508][ T3740] loop0: detected capacity change from 0 to 2048 [ 34.400696][ T3740] EXT4-fs (loop0): can't mount with journal_async_commit, fs mounted w/o journal [ 34.463062][ T3321] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.536717][ T3751] loop0: detected capacity change from 0 to 512 [ 34.560798][ T3751] EXT4-fs: Ignoring removed nobh option [ 34.581512][ T3751] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -13 [ 34.601492][ T3751] EXT4-fs error (device loop0): ext4_clear_blocks:876: inode #13: comm syz.0.114: attempt to clear invalid blocks 2 len 1 [ 34.630968][ T3751] EXT4-fs (loop0): Remounting filesystem read-only [ 34.637852][ T3751] EXT4-fs (loop0): 1 truncate cleaned up [ 34.644805][ T3751] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 34.671499][ T3317] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.733982][ T29] kauditd_printk_skb: 253 callbacks suppressed [ 34.734053][ T29] audit: type=1400 audit(1749058932.504:344): avc: denied { execmem } for pid=3768 comm="syz.0.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 34.920660][ T3778] loop2: detected capacity change from 0 to 1024 [ 34.930732][ T3778] EXT4-fs: Ignoring removed bh option [ 34.936264][ T3778] EXT4-fs: Ignoring removed nomblk_io_submit option [ 34.956569][ T3780] SELinux: policydb version 0 does not match my version range 15-34 [ 34.959539][ T29] audit: type=1400 audit(1749058932.724:345): avc: denied { load_policy } for pid=3779 comm="syz.0.124" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 34.999322][ T3778] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.005781][ T29] audit: type=1400 audit(1749058932.744:346): avc: denied { create } for pid=3781 comm="syz.1.125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 35.032870][ T29] audit: type=1400 audit(1749058932.744:347): avc: denied { bind } for pid=3781 comm="syz.1.125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 35.033505][ T3780] SELinux: failed to load policy [ 35.156483][ T3787] loop1: detected capacity change from 0 to 128 [ 35.198648][ T29] audit: type=1400 audit(1749058932.964:348): avc: denied { create } for pid=3788 comm="syz.4.127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 35.249911][ T29] audit: type=1400 audit(1749058933.004:349): avc: denied { mount } for pid=3786 comm="syz.1.126" name="/" dev="loop1" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 35.255207][ T3789] netlink: 48 bytes leftover after parsing attributes in process `syz.4.127'. [ 35.288265][ T3789] netlink: 44 bytes leftover after parsing attributes in process `syz.4.127'. [ 35.301463][ T3787] syz.1.126: attempt to access beyond end of device [ 35.301463][ T3787] loop1: rw=0, sector=2068, nr_sectors = 1 limit=128 [ 35.315297][ T29] audit: type=1400 audit(1749058933.014:350): avc: denied { write } for pid=3788 comm="syz.4.127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 35.378580][ T29] audit: type=1400 audit(1749058933.124:351): avc: denied { unmount } for pid=3321 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 35.496679][ T29] audit: type=1400 audit(1749058933.234:352): avc: denied { relabelfrom } for pid=3792 comm="syz.4.131" name="" dev="pipefs" ino=5239 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 35.588976][ T29] audit: type=1400 audit(1749058933.354:353): avc: denied { create } for pid=3794 comm="syz.4.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 35.683438][ T1661] ================================================================== [ 35.691588][ T1661] BUG: KCSAN: data-race in copy_folio_from_iter_atomic / copy_folio_from_iter_atomic [ 35.701072][ T1661] [ 35.703409][ T1661] write to 0xffff88810800299e of 2 bytes by task 3778 on cpu 1: [ 35.711052][ T1661] copy_folio_from_iter_atomic+0x7fc/0x1170 [ 35.716970][ T1661] generic_perform_write+0x2c2/0x490 [ 35.722273][ T1661] ext4_buffered_write_iter+0x1ee/0x3c0 [ 35.727851][ T1661] ext4_file_write_iter+0x383/0xf00 [ 35.733151][ T1661] iter_file_splice_write+0x5f2/0x970 [ 35.738536][ T1661] direct_splice_actor+0x156/0x2a0 [ 35.743671][ T1661] splice_direct_to_actor+0x312/0x680 [ 35.749060][ T1661] do_splice_direct+0xda/0x150 [ 35.753842][ T1661] do_sendfile+0x380/0x650 [ 35.758532][ T1661] __x64_sys_sendfile64+0x105/0x150 [ 35.763746][ T1661] x64_sys_call+0xb39/0x2fb0 [ 35.768441][ T1661] do_syscall_64+0xd2/0x200 [ 35.772956][ T1661] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 35.778853][ T1661] [ 35.781179][ T1661] read to 0xffff888108002800 of 1024 bytes by task 1661 on cpu 0: [ 35.788987][ T1661] copy_folio_from_iter_atomic+0x7fc/0x1170 [ 35.794986][ T1661] generic_perform_write+0x2c2/0x490 [ 35.800277][ T1661] shmem_file_write_iter+0xc5/0xf0 [ 35.805399][ T1661] lo_rw_aio+0x5fa/0x7c0 [ 35.809642][ T1661] loop_process_work+0x52d/0xa60 [ 35.814583][ T1661] loop_workfn+0x31/0x40 [ 35.818911][ T1661] process_scheduled_works+0x4cb/0x9d0 [ 35.824382][ T1661] worker_thread+0x582/0x770 [ 35.828982][ T1661] kthread+0x486/0x510 [ 35.833054][ T1661] ret_from_fork+0xda/0x150 [ 35.837566][ T1661] ret_from_fork_asm+0x1a/0x30 [ 35.842338][ T1661] [ 35.844659][ T1661] Reported by Kernel Concurrency Sanitizer on: [ 35.850807][ T1661] CPU: 0 UID: 0 PID: 1661 Comm: kworker/u8:7 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(voluntary) [ 35.863052][ T1661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 35.873112][ T1661] Workqueue: loop2 loop_workfn [ 35.877888][ T1661] ================================================================== [ 36.019047][ T3809] syz.1.135 (3809) used greatest stack depth: 10104 bytes left [ 36.089120][ T3315] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.