last executing test programs: 1.544139055s ago: executing program 4 (id=132): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0xab, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x9, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) r0 = syz_io_uring_setup(0x70e4, &(0x7f0000000800)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=@newtaction={0x14, 0x30, 0x1, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4010) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer) io_uring_enter(r0, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 1.313940294s ago: executing program 1 (id=143): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) poll(0x0, 0x0, 0xf45) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r1, 0x0, 0x118) write$UHID_DESTROY(r1, &(0x7f0000000040), 0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x0) 1.310289554s ago: executing program 4 (id=145): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) setsockopt(r2, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) listen(r2, 0x8) accept4$inet(r2, &(0x7f0000000100), 0x0, 0x80800) 1.258109254s ago: executing program 4 (id=147): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r2, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}, 0x1, 0x0, 0x0, 0x880}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=@delchain={0x5c, 0x64, 0xf31, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r2, {0x9}, {0x10, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @mcast1}, @TCA_FLOWER_KEY_ENC_IPV6_DST_MASK={0x14, 0x22, [0xff, 0x0, 0xffffff00, 0xff000000]}]}}]}, 0x5c}}, 0x1000000) 1.183132684s ago: executing program 3 (id=151): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x4, 0x5, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x9c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x6c, 0x2, {{}, [@TCA_NETEM_LOSS={0x30, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x18}, @NETEM_LOSS_GI={0x18, 0x1, {0x10}}]}, @TCA_NETEM_RATE={0x14, 0xd}, @TCA_NETEM_CORRUPT={0xc, 0x2}]}}}]}, 0x9c}}, 0x0) 1.159793634s ago: executing program 0 (id=152): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000f00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r0}, 0x10) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x5d, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x800084}, 0xfffffffffffffea9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x20001400) ioctl$TUNSETOFFLOAD(r1, 0x40047451, 0x2000000c) 935.994093ms ago: executing program 3 (id=156): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_RAW={0x8, 0xc, 0x1}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) 898.837213ms ago: executing program 0 (id=157): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x8, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x200, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008004f0fffeffe809005300fff5dd000000100001000d0c10000000100000000000", 0x58}], 0x1) 894.818813ms ago: executing program 4 (id=159): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='leases_conflict\x00', r0}, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r1, 0x400, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='leases_conflict\x00', r2}, 0x18) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0, 0x0) 837.693513ms ago: executing program 4 (id=161): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000f7850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) fsync(0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_ADD(r4, 0x2, r3, 0x0) 788.178563ms ago: executing program 0 (id=162): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000001000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008180000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x1b, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0x8a, &(0x7f00000000c0)={[{@jqfmt_vfsold}, {@usrjquota, 0x22}, {@errors_continue}, {@journal_dev={'journal_dev', 0x3d, 0xb7f}}, {@data_err_ignore}, {@grpjquota, 0x22}, {@errors_continue}, {@errors_remount}, {@noblock_validity}]}, 0xfe, 0x44e, &(0x7f0000000900)="$eJzs3M1vG0UbAPDHdpw0bfMmbykfDS0ECiLiI2nSD3rgUgQSB5CQ4FDEKSRpFeo2qAkSrSIIHMIRVeKOOCLxF3ChXBBwQuIKd4QUoVwonIzW3k3dxE7ixIlL/ftJm8x4xpp5dnfs8azXAXSsoeRPLuJgRPwaEf3V7J0Vhqr/bq0sTP69sjCZi3L5jT9zlXp/rSxMZlWz5x2oZsrlDdpdejtiolSavprmR+cvvzc6d+36czOXJy5OX5y+Mn727KmTx7rPjJ9uSZx9SV8HP5w9euSVt268Nnn+xjs/fp3092BaXhtHqwxV925dT7a6sTbrq0nnutrYEZpSiIjkcBUr478/CtG7WtYfL3/S1s4Bu6pczpd7GhcvloF7WDJRBzpR9kaffP7Ntj2aetwVls/F6jrGrXSrlnRFPq1TTD8j7YahiDi/+M8XyRa7tA4BAFDr5rmIeLbe/C8fD9TU+196bWggIv4fEYci4r6IOBwR90dU6j4YEQ812f7aKyTr5z/l/m0FtkXJ/O+F9NrWnfO/bPYXA4U011eJv5i7MFOaPpHuk+Eo9iT5sQ3a+O6lXz5rVFY7/0u2pP1sLpj244+uNQt0UxPzEzuJudbyxxGDXfXiz63OeZP58ZGIGNxmGzNPf3W0Udnm8W+gBZPy8pcRT1WP/2KsiT+Ta3h9cuz5M+OnR/dFafrEaHZWrPfTz0uvN2p/R/G3wPLNcuyve/6vxj+Q2xcxd+36pcr12rnm21j67dOGn2m2e/53596spLvTxz6YmJ+/OhbRnXt1/ePjt5+b5bP6yfk/fLz++D8Ut/fEwxGRnMTHIuKRiHg07ftjEfF4RBzfIP4fXnzi3ebj32BVvoWS+Kc2O/5Re/ybTxQuff9N8/FnkuN/qpIaTh/ZyuvfVju4k30HAAAA/xX5ynfgc/mR1XQ+PzJS/Q7/4difL83OzT9zYfb9K1PV78oPRDGfrXT116yHjqVrw1l+fE3+ZLpu/Hmht5IfmZwtTbU7eOhwBxqM/8TvhXb3Dth17teCzmX8Q+cy/qFzGf/QuYx/6Fz1xv9HbegHsPc2ef/v3at+AHvP/B86l/EPncv4h47U8N74/I5u+ZdoU+Lb7p39VsPWE5G/S0K+ZxLFqFvUteUfs9hmoqduUbtfmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFrj3wAAAP//j57jFA==") 770.874433ms ago: executing program 4 (id=164): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000640)='console\x00', r2}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) 629.066242ms ago: executing program 0 (id=166): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@ipv6_newnexthop={0x30, 0x68, 0x1, 0x0, 0xfffffffe, {}, [@NHA_ENCAP_TYPE={0x6, 0x7, 0x3}, @NHA_ENCAP={0x8, 0x8, 0x0, 0x1, @MPLS_IPTUNNEL_DST={0x4}}, @NHA_OIF={0x8, 0x5, r1}]}, 0x30}}, 0x90) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@ipv6_newnexthop={0x20, 0x68, 0x1, 0x0, 0x0, {0x2}, [@NHA_OIF={0x8, 0x5, r4}]}, 0x20}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@ipv6_newrule={0x24, 0x18, 0x409, 0x0, 0x0, {}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}]}, 0x24}}, 0x0) 599.914582ms ago: executing program 0 (id=167): mkdir(&(0x7f0000000580)='./file0\x00', 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000003c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x5) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) setxattr$incfs_metadata(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x0, 0x0, 0x0) removexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='user.incfs.metadata\x00') 581.960262ms ago: executing program 0 (id=168): r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_io_uring_setup(0x6908, &(0x7f00000006c0)={0x0, 0x2, 0x10100, 0x2}, &(0x7f0000000200), &(0x7f0000000100)=0x0) syz_io_uring_setup(0x1868, &(0x7f00000003c0), &(0x7f0000000000)=0x0, &(0x7f0000000240)) syz_io_uring_submit(r3, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) io_uring_enter(r1, 0x184c, 0x0, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000040)={0x3, 0x40, 0x80000001, 0x80000001, 0x12, "39b495e5281a0d10868410cb3a72b382f6aac3"}) exit(0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x5412, &(0x7f00000006c0)=0xa) 490.390911ms ago: executing program 2 (id=171): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000000400000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_clone3(&(0x7f00000006c0)={0x102102180, 0x0, 0x0, 0x0, {0x40}, 0x0, 0x0, 0x0, &(0x7f0000000680)=[0x0], 0x1}, 0x58) mkdir(&(0x7f0000000100)='./file0\x00', 0x10) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) umount2(&(0x7f0000000000)='./file0\x00', 0x0) 462.608881ms ago: executing program 1 (id=172): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='kmem_cache_free\x00', r1, 0x0, 0x4000000068}, 0x3a) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r3 = socket$inet6(0xa, 0x3, 0x84) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000280)={{{@in=@private=0xa010101, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x2}, {0xf19}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x6c}, 0xa, @in=@empty, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfa9}}, 0xe8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) 448.564272ms ago: executing program 2 (id=173): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000100)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f00000000c0)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000040)=0x1, 0x12) 440.856272ms ago: executing program 1 (id=174): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000040)='sched_switch\x00', 0xffffffffffffffff, 0x0, 0x8000b14}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='mpol=interleave=s', @ANYRESOCT, @ANYBLOB="42d77ac9"]) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000580)="5c00000013006bcd9e3fe3dc4e48aa31086b87034100000040400000050000000400140019000a00100000009ee517d34460bc00de048a7d8f2c9f6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 419.265751ms ago: executing program 2 (id=175): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1c, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800", @ANYRES32, @ANYBLOB="0000000000000000b7080000000100007b8af8ff00000000bfa200000000000007020000f8ffffff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @void, @value}, 0x94) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x8) open$dir(&(0x7f00000000c0)='./file0\x00', 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r0}, 0x10) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x1, 0x0) vmsplice(r1, &(0x7f0000000180), 0x19, 0x2) 388.479431ms ago: executing program 2 (id=176): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0xd, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000111e6ca5b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000400699b000008001b"], 0x30}}, 0x0) 342.164101ms ago: executing program 1 (id=177): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001780)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) unshare(0x22020400) r2 = syz_io_uring_setup(0x117, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x3a6}, &(0x7f0000000000)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffc00, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000000c0)=@IORING_OP_SENDMSG={0x9, 0xc, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x18}, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x47f6, 0x80ffff, 0x0, 0x0, 0x0) 310.539221ms ago: executing program 1 (id=178): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000400)='locks_get_lock_context\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000780)={&(0x7f0000000400)='locks_get_lock_context\x00', r2}, 0x3d) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) fcntl$lock(r3, 0x26, &(0x7f0000000000)) 284.791251ms ago: executing program 1 (id=179): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1a3c82) syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x0) close(0xffffffffffffffff) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000003c0)='sched_switch\x00', r1}, 0x18) 255.707811ms ago: executing program 2 (id=180): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x0, 0x9}, 0x18) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000040)=0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x1}}) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000140)=""/144, 0x90}], 0x1) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f00000000c0)={0x0, 0x9, 0x0, 0x0, 0xf}) read(r0, &(0x7f00000002c0)=""/200, 0x39) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 91.314901ms ago: executing program 3 (id=181): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x2074, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x57, 0x1, 0x0, 0x0, 0x0, 0x210e, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x407fff, 0xaea}, 0x1a51d, 0x80000000005c6, 0x200, 0x4, 0x2, 0x8010000, 0x1, 0x0, 0x0, 0x0, 0x1000002009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) 58.19339ms ago: executing program 3 (id=182): r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x101842, 0x0) ioctl$PPPIOCSACTIVE(r0, 0x40047459, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r3}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000c80)=@mangle={'mangle\x00', 0x64, 0x6, 0x568, 0xe8, 0xe8, 0xe8, 0xe8, 0x1d0, 0x498, 0x498, 0x498, 0x498, 0x498, 0x6, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @multicast2}, [], [], 'dvmrp0\x00', 'veth1_virt_wifi\x00', {0xff}}, 0x0, 0xa8, 0xe8, 0x0, {0x7a00000000000000}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x9, {0x4}}}}, {{@ipv6={@mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'syzkaller1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@private0}}}, {{@ipv6={@rand_addr=' \x01\x00', @mcast2, [0xff], [], 'veth1_to_batadv\x00', 'vlan1\x00'}, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty}}}, {{@ipv6={@private0, @mcast2, [], [0x0, 0x0, 0x0, 0xff000000], 'veth1_to_team\x00', 'wg1\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@remote}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4=@local}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5c8) 29.23222ms ago: executing program 2 (id=183): syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000200)='./bus\x00', 0x1000000, &(0x7f00000005c0)=ANY=[], 0x1, 0x126f, &(0x7f0000001600)="$eJzs3U1rY1UcB+B/2vQtY5uq4+gMiAfdKEKcduHKTZEZEAtKtQMqCHdsqqFpU5pQiIhTV64EP4aoS3eC+AW6ceNaEES6cTkL8UqbjDNp0o522lSG59ncwznnd8+5veXCDedw9175cn1ttVlZzVoxUihEcXMsirdTpBiJ0ejYiRdu/PzL02+98+7rC4uL15ZSur7w9tzLKaWZZ35475Nvn/2xdeHGdzPfT8Tu7Pt7f8z/untp9/LeX99ErZlqzbTRaKUs3Ww0WtnNejWt1JprlZTerFezZjVNdse4275ab2xutlO2sTJd2tyqNpsp22intWo7tQqptdVO2YdZbSNVKpU0XQoexPLXt/M8j8jzsRiPPM/zqSjFhXgkpmMmyjEbj8Zj8XhcjCfiUjwZT8Xlg17nPW8AAAAAAAAAAAAAAAAAAAB4uNxn/3+hf///xHlPGQAAAAAAAAAAAAAAAAAAAB46h/f/FyN8/x8AAAAAAAAAAAAAAAAAAACG7D7f/z+0//9F+/8BAAAAAAAAAAAAAAAAAADgLEx2DkspTUasf769vL3cOXbqF1ajFvWoxtUox59xsPu/o1O+/tritavpwGy8tH6rm7+1vTzam58bK8dsYWB+rpNPvfmJKN2bn49yXBw8/vzA/GQ8/9x+/rNOvhLl+OmDaEQ9ViIK3as/yH86l9KrbyxO9eav7Pc70ugZ3xYAAAA4TZX0j/73951up4Htnabu+3nq9iwc8/vAoffzYlwpntdVc0ez/fFaVq9Xt05YGD/6POO9NVPdniceqxARWU98pvTb0v4pTzr5UyuMDnXQseP7PMA9jeL/4I95CoXfv7qnZjKGO/pI9x89q+8/P/9dKnby/EwnNj6oaeK41NHPjMIZP5MYnrs3/bxnAgAAAAAAAAAAwH8xcPXfVET0rQf8qK/mzvLw3nj/mY8e/YshXCEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA3O3AsAAAAACDM3zqNjg0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4KgAA//+E38bU") creat(&(0x7f0000000000)='./bus\x00', 0x26) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7ffff000) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) 17.85618ms ago: executing program 3 (id=184): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='\n'], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x18) r3 = open(&(0x7f0000000000)='./bus\x00', 0x40, 0x0) fgetxattr(r3, &(0x7f00000003c0)=@known='security.selinux\x00', 0x0, 0x0) 0s ago: executing program 3 (id=185): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) syz_clone(0x100000, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000540), 0x84) mmap$IORING_OFF_SQ_RING(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x9, 0x12, r1, 0x0) perf_event_open(&(0x7f0000000400)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x82, 0x2c81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf2ffffff, @perf_bp={&(0x7f0000000080)}, 0x0, 0xfffffffffffffffd, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x2) kernel console output (not intermixed with test programs): [ 18.548247][ T29] audit: type=1400 audit(1737576907.083:81): avc: denied { read } for pid=2980 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.0.88' (ED25519) to the list of known hosts. [ 21.429508][ T29] audit: type=1400 audit(1737576909.963:82): avc: denied { mounton } for pid=3267 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.442623][ T3267] cgroup: Unknown subsys name 'net' [ 21.452295][ T29] audit: type=1400 audit(1737576909.963:83): avc: denied { mount } for pid=3267 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.479750][ T29] audit: type=1400 audit(1737576909.993:84): avc: denied { unmount } for pid=3267 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.635895][ T3267] cgroup: Unknown subsys name 'cpuset' [ 21.641948][ T3267] cgroup: Unknown subsys name 'rlimit' [ 21.810345][ T29] audit: type=1400 audit(1737576910.343:85): avc: denied { setattr } for pid=3267 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.833608][ T29] audit: type=1400 audit(1737576910.343:86): avc: denied { create } for pid=3267 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.854089][ T29] audit: type=1400 audit(1737576910.343:87): avc: denied { write } for pid=3267 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.856558][ T3288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.874516][ T29] audit: type=1400 audit(1737576910.343:88): avc: denied { read } for pid=3267 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.903320][ T29] audit: type=1400 audit(1737576910.353:89): avc: denied { mounton } for pid=3267 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.928263][ T29] audit: type=1400 audit(1737576910.353:90): avc: denied { mount } for pid=3267 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.943205][ T3267] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.951532][ T29] audit: type=1400 audit(1737576910.413:91): avc: denied { relabelto } for pid=3288 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.990552][ T3295] chnl_net:caif_netlink_parms(): no params data found [ 23.068029][ T3294] chnl_net:caif_netlink_parms(): no params data found [ 23.141533][ T3295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.148696][ T3295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.155925][ T3295] bridge_slave_0: entered allmulticast mode [ 23.162315][ T3295] bridge_slave_0: entered promiscuous mode [ 23.168555][ T3297] chnl_net:caif_netlink_parms(): no params data found [ 23.177299][ T3295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.184333][ T3295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.191593][ T3295] bridge_slave_1: entered allmulticast mode [ 23.197966][ T3295] bridge_slave_1: entered promiscuous mode [ 23.210468][ T3302] chnl_net:caif_netlink_parms(): no params data found [ 23.249731][ T3295] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 23.259197][ T3294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.266312][ T3294] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.273465][ T3294] bridge_slave_0: entered allmulticast mode [ 23.279768][ T3294] bridge_slave_0: entered promiscuous mode [ 23.292964][ T3296] chnl_net:caif_netlink_parms(): no params data found [ 23.302514][ T3295] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 23.311734][ T3294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.318820][ T3294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.326000][ T3294] bridge_slave_1: entered allmulticast mode [ 23.332200][ T3294] bridge_slave_1: entered promiscuous mode [ 23.360837][ T3295] team0: Port device team_slave_0 added [ 23.368976][ T3295] team0: Port device team_slave_1 added [ 23.382335][ T3294] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 23.406119][ T3294] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 23.438807][ T3295] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 23.445784][ T3295] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 23.472030][ T3295] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 23.482759][ T3302] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.489861][ T3302] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.497116][ T3302] bridge_slave_0: entered allmulticast mode [ 23.503278][ T3302] bridge_slave_0: entered promiscuous mode [ 23.509970][ T3302] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.517049][ T3302] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.524288][ T3302] bridge_slave_1: entered allmulticast mode [ 23.531115][ T3302] bridge_slave_1: entered promiscuous mode [ 23.541700][ T3297] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.548807][ T3297] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.556142][ T3297] bridge_slave_0: entered allmulticast mode [ 23.562601][ T3297] bridge_slave_0: entered promiscuous mode [ 23.571122][ T3295] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 23.578184][ T3295] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 23.604288][ T3295] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 23.620115][ T3294] team0: Port device team_slave_0 added [ 23.625876][ T3297] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.632917][ T3297] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.641049][ T3297] bridge_slave_1: entered allmulticast mode [ 23.647415][ T3297] bridge_slave_1: entered promiscuous mode [ 23.668093][ T3294] team0: Port device team_slave_1 added [ 23.678456][ T3296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.685724][ T3296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.692799][ T3296] bridge_slave_0: entered allmulticast mode [ 23.699222][ T3296] bridge_slave_0: entered promiscuous mode [ 23.706028][ T3296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.713257][ T3296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.720470][ T3296] bridge_slave_1: entered allmulticast mode [ 23.726651][ T3296] bridge_slave_1: entered promiscuous mode [ 23.733417][ T3302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 23.756594][ T3302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 23.770892][ T3297] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 23.780359][ T3294] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 23.787331][ T3294] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 23.813387][ T3294] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 23.840948][ T3297] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 23.850278][ T3294] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 23.857244][ T3294] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 23.883189][ T3294] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 23.895734][ T3295] hsr_slave_0: entered promiscuous mode [ 23.901836][ T3295] hsr_slave_1: entered promiscuous mode [ 23.908985][ T3296] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 23.937747][ T3296] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 23.951729][ T3302] team0: Port device team_slave_0 added [ 23.958177][ T3297] team0: Port device team_slave_0 added [ 23.979046][ T3302] team0: Port device team_slave_1 added [ 23.985618][ T3297] team0: Port device team_slave_1 added [ 23.999844][ T3296] team0: Port device team_slave_0 added [ 24.025281][ T3294] hsr_slave_0: entered promiscuous mode [ 24.031170][ T3294] hsr_slave_1: entered promiscuous mode [ 24.037044][ T3294] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 24.044608][ T3294] Cannot create hsr debugfs directory [ 24.052395][ T3296] team0: Port device team_slave_1 added [ 24.058432][ T3302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.065704][ T3302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.091645][ T3302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.108072][ T3297] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.115091][ T3297] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.141072][ T3297] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.153878][ T3297] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.160880][ T3297] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.186819][ T3297] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.201599][ T3302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.208576][ T3302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.234538][ T3302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.272995][ T3296] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.280193][ T3296] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.306114][ T3296] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.325420][ T3302] hsr_slave_0: entered promiscuous mode [ 24.331221][ T3302] hsr_slave_1: entered promiscuous mode [ 24.337052][ T3302] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 24.344594][ T3302] Cannot create hsr debugfs directory [ 24.354756][ T3296] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.361789][ T3296] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.387705][ T3296] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.433288][ T3297] hsr_slave_0: entered promiscuous mode [ 24.439329][ T3297] hsr_slave_1: entered promiscuous mode [ 24.445046][ T3297] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 24.452703][ T3297] Cannot create hsr debugfs directory [ 24.469990][ T3296] hsr_slave_0: entered promiscuous mode [ 24.476007][ T3296] hsr_slave_1: entered promiscuous mode [ 24.481743][ T3296] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 24.489379][ T3296] Cannot create hsr debugfs directory [ 24.564599][ T3295] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 24.573029][ T3295] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 24.593829][ T3295] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 24.604703][ T3295] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 24.658430][ T3294] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 24.677855][ T3294] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 24.686792][ T3294] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 24.697388][ T3294] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 24.716982][ T3302] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 24.725553][ T3302] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 24.734380][ T3302] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 24.743543][ T3302] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 24.779350][ T3295] 8021q: adding VLAN 0 to HW filter on device bond0 [ 24.791708][ T3296] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 24.809901][ T3296] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 24.819684][ T3295] 8021q: adding VLAN 0 to HW filter on device team0 [ 24.832974][ T3296] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 24.841880][ T3296] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 24.854525][ T3297] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 24.863612][ T3297] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 24.874031][ T153] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.881093][ T153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.893640][ T3297] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 24.913133][ T28] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.920209][ T28] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.932399][ T3297] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 24.971441][ T3302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 24.980341][ T3294] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.001987][ T3302] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.019888][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.026990][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.044641][ T3297] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.060292][ T3296] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.079555][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.086673][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.095165][ T3296] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.104074][ T3294] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.119719][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.126837][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.135601][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.142660][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.158169][ T3297] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.168224][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.175351][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.189738][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.196800][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.205858][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.212931][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.224062][ T3295] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 25.249751][ T28] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.256884][ T28] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.280663][ T3296] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 25.291142][ T3296] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 25.325008][ T3297] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 25.348612][ T3294] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 25.374027][ T3302] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 25.424636][ T3296] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 25.437248][ T3297] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 25.458743][ T3294] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 25.544179][ T3302] veth0_vlan: entered promiscuous mode [ 25.554520][ T3295] veth0_vlan: entered promiscuous mode [ 25.578034][ T3295] veth1_vlan: entered promiscuous mode [ 25.601086][ T3297] veth0_vlan: entered promiscuous mode [ 25.611480][ T3302] veth1_vlan: entered promiscuous mode [ 25.619729][ T3296] veth0_vlan: entered promiscuous mode [ 25.626907][ T3297] veth1_vlan: entered promiscuous mode [ 25.635990][ T3294] veth0_vlan: entered promiscuous mode [ 25.654839][ T3297] veth0_macvtap: entered promiscuous mode [ 25.661559][ T3294] veth1_vlan: entered promiscuous mode [ 25.668244][ T3296] veth1_vlan: entered promiscuous mode [ 25.680953][ T3297] veth1_macvtap: entered promiscuous mode [ 25.691764][ T3295] veth0_macvtap: entered promiscuous mode [ 25.700743][ T3302] veth0_macvtap: entered promiscuous mode [ 25.708339][ T3295] veth1_macvtap: entered promiscuous mode [ 25.716120][ T3302] veth1_macvtap: entered promiscuous mode [ 25.727251][ T3297] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 25.742098][ T3296] veth0_macvtap: entered promiscuous mode [ 25.749784][ T3296] veth1_macvtap: entered promiscuous mode [ 25.758616][ T3297] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 25.771424][ T3295] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 25.781995][ T3295] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 25.792578][ T3295] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 25.801556][ T3297] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 25.810325][ T3297] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 25.819146][ T3297] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 25.827887][ T3297] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 25.838656][ T3294] veth0_macvtap: entered promiscuous mode [ 25.846963][ T3294] veth1_macvtap: entered promiscuous mode [ 25.856978][ T3295] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 25.867616][ T3295] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 25.878292][ T3295] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 25.889343][ T3302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 25.899983][ T3302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 25.910284][ T3302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 25.920774][ T3302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 25.931732][ T3302] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 25.939547][ T3296] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 25.950060][ T3296] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 25.959927][ T3296] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 25.970390][ T3296] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 25.980245][ T3296] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 25.990673][ T3296] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.001150][ T3296] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.009914][ T3295] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.018696][ T3295] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.027440][ T3295] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.036175][ T3295] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.052151][ T3302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.062770][ T3302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.072623][ T3302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.083124][ T3302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.094391][ T3302] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.104152][ T3296] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.114733][ T3296] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.124614][ T3296] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.135081][ T3296] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.144893][ T3296] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.155400][ T3296] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.166175][ T3296] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.173921][ T3294] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 26.174514][ T3297] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.184368][ T3294] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.184381][ T3294] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 26.219243][ T3294] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.229078][ T3294] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 26.239533][ T3294] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.249549][ T3294] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 26.259974][ T3294] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.270897][ T3294] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.282134][ T3296] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.290897][ T3296] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.299656][ T3296] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.308436][ T3296] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.320536][ T3294] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.331031][ T3294] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.340857][ T3294] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.351303][ T3294] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.361175][ T3294] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.371739][ T3294] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.381703][ T3294] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.392262][ T3294] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.402828][ T3294] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.411798][ T3302] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.420547][ T3302] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.429291][ T3302] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.438146][ T3302] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.453444][ T3294] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.462298][ T3294] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.471034][ T3294] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.479745][ T3294] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.557714][ T29] kauditd_printk_skb: 33 callbacks suppressed [ 26.557772][ T29] audit: type=1400 audit(1737576915.093:125): avc: denied { map_read map_write } for pid=3443 comm="syz.0.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 26.633021][ T29] audit: type=1400 audit(1737576915.093:126): avc: denied { perfmon } for pid=3443 comm="syz.0.7" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 26.636118][ T3451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.653773][ T29] audit: type=1400 audit(1737576915.093:127): avc: denied { prog_run } for pid=3443 comm="syz.0.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 26.653798][ T29] audit: type=1400 audit(1737576915.133:128): avc: denied { read } for pid=3442 comm="syz.4.5" name="ppp" dev="devtmpfs" ino=140 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 26.653857][ T29] audit: type=1400 audit(1737576915.133:129): avc: denied { open } for pid=3442 comm="syz.4.5" path="/dev/ppp" dev="devtmpfs" ino=140 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 26.703576][ T3451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.727906][ T29] audit: type=1400 audit(1737576915.133:130): avc: denied { ioctl } for pid=3442 comm="syz.4.5" path="/dev/ppp" dev="devtmpfs" ino=140 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 26.764511][ T29] audit: type=1400 audit(1737576915.163:131): avc: denied { read write } for pid=3450 comm="syz.3.4" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.787767][ T29] audit: type=1400 audit(1737576915.163:132): avc: denied { open } for pid=3450 comm="syz.3.4" path="/dev/raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.810875][ T29] audit: type=1400 audit(1737576915.163:133): avc: denied { ioctl } for pid=3450 comm="syz.3.4" path="/dev/raw-gadget" dev="devtmpfs" ino=142 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.844435][ T3455] netlink: 'syz.1.2': attribute type 4 has an invalid length. [ 26.862896][ T3455] netlink: 'syz.1.2': attribute type 4 has an invalid length. [ 26.870505][ T29] audit: type=1400 audit(1737576915.393:134): avc: denied { read } for pid=3456 comm="syz.4.9" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 26.921046][ T3455] syz.1.2 (3455) used greatest stack depth: 10640 bytes left [ 26.965603][ T3458] syz.0.10 (3458) used greatest stack depth: 10608 bytes left [ 27.084554][ T3476] netlink: 4 bytes leftover after parsing attributes in process `syz.0.18'. [ 27.094368][ T3476] netlink: 'syz.0.18': attribute type 7 has an invalid length. [ 27.157720][ T3485] netlink: 4 bytes leftover after parsing attributes in process `syz.4.21'. [ 27.193977][ T3485] netlink: 4 bytes leftover after parsing attributes in process `syz.4.21'. [ 27.405250][ T3502] hub 9-0:1.0: USB hub found [ 27.415248][ T3502] hub 9-0:1.0: 8 ports detected [ 27.502849][ T3507] loop2: detected capacity change from 0 to 1024 [ 27.534580][ T3507] ======================================================= [ 27.534580][ T3507] WARNING: The mand mount option has been deprecated and [ 27.534580][ T3507] and is ignored by this kernel. Remove the mand [ 27.534580][ T3507] option from the mount to silence this warning. [ 27.534580][ T3507] ======================================================= [ 27.578690][ T3507] EXT4-fs: Ignoring removed bh option [ 27.621751][ T3507] EXT4-fs: inline encryption not supported [ 27.635737][ T3507] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 27.659515][ T3507] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 27.674038][ T3522] loop4: detected capacity change from 0 to 164 [ 27.687666][ T3507] EXT4-fs error (device loop2): ext4_map_blocks:671: inode #3: block 2: comm syz.2.31: lblock 2 mapped to illegal pblock 2 (length 1) [ 27.717587][ T3507] EXT4-fs error (device loop2): ext4_map_blocks:671: inode #3: block 48: comm syz.2.31: lblock 0 mapped to illegal pblock 48 (length 1) [ 27.741573][ T3527] loop7: detected capacity change from 0 to 16384 [ 27.751633][ T3522] process 'syz.4.38' launched '/dev/fd/4' with NULL argv: empty string added [ 27.761601][ T3507] EXT4-fs error (device loop2): ext4_acquire_dquot:6938: comm syz.2.31: Failed to acquire dquot type 0 [ 27.773002][ T3507] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5838: Corrupt filesystem [ 27.786137][ T3507] EXT4-fs error (device loop2): ext4_evict_inode:256: inode #11: comm syz.2.31: mark_inode_dirty error [ 27.799810][ T3522] syz.4.38: attempt to access beyond end of device [ 27.799810][ T3522] loop4: rw=524288, sector=263328, nr_sectors = 4 limit=164 [ 27.813801][ T3522] syz.4.38: attempt to access beyond end of device [ 27.813801][ T3522] loop4: rw=0, sector=263328, nr_sectors = 4 limit=164 [ 27.824419][ T3527] I/O error, dev loop7, sector 9216 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 0 [ 27.837894][ T3527] I/O error, dev loop7, sector 9472 op 0x0:(READ) flags 0x80700 phys_seg 26 prio class 0 [ 27.838553][ T3507] EXT4-fs warning (device loop2): ext4_evict_inode:259: couldn't mark inode dirty (err -117) [ 27.848021][ T3527] I/O error, dev loop7, sector 9216 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 27.867647][ T3527] Buffer I/O error on dev loop7, logical block 1152, async page read [ 27.869212][ T3507] EXT4-fs (loop2): 1 orphan inode deleted [ 27.889973][ T3507] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 27.892522][ T40] EXT4-fs error (device loop2): ext4_map_blocks:671: inode #3: block 1: comm kworker/u8:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 27.932066][ T3536] syz.1.42[3536] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 27.932124][ T3536] syz.1.42[3536] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 27.939499][ T40] EXT4-fs error (device loop2): ext4_release_dquot:6961: comm kworker/u8:2: Failed to release dquot type 0 [ 27.963654][ T3536] syz.1.42[3536] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 27.991159][ T3526] I/O error, dev loop7, sector 0 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 28.012136][ T3526] Buffer I/O error on dev loop7, logical block 0, lost async page write [ 28.020542][ T3526] Buffer I/O error on dev loop7, logical block 1, lost async page write [ 28.028923][ T3526] Buffer I/O error on dev loop7, logical block 2, lost async page write [ 28.037362][ T3526] Buffer I/O error on dev loop7, logical block 3, lost async page write [ 28.045858][ T3526] Buffer I/O error on dev loop7, logical block 4, lost async page write [ 28.054207][ T3526] Buffer I/O error on dev loop7, logical block 5, lost async page write [ 28.062638][ T3526] Buffer I/O error on dev loop7, logical block 6, lost async page write [ 28.071251][ T3526] Buffer I/O error on dev loop7, logical block 7, lost async page write [ 28.079662][ T3526] Buffer I/O error on dev loop7, logical block 8, lost async page write [ 28.090933][ T3526] I/O error, dev loop7, sector 1024 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 28.103671][ T3526] I/O error, dev loop7, sector 2048 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 28.117679][ T3526] I/O error, dev loop7, sector 3072 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 28.130117][ T3526] I/O error, dev loop7, sector 4096 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 28.143495][ T3526] I/O error, dev loop7, sector 5120 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 28.158071][ T3526] I/O error, dev loop7, sector 6144 op 0x1:(WRITE) flags 0x4800 phys_seg 128 prio class 0 [ 28.225026][ T3549] syzkaller0: entered allmulticast mode [ 28.232557][ T3549] syzkaller0 (unregistering): left allmulticast mode [ 28.332184][ T3555] loop1: detected capacity change from 0 to 256 [ 28.350073][ T3555] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 28.372218][ T3559] mmap: syz.0.50 (3559) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 28.410075][ T3296] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 28.420528][ T3296] EXT4-fs error (device loop2): __ext4_get_inode_loc:4435: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 28.433944][ T3296] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5838: Corrupt filesystem [ 28.438888][ T3561] loop0: detected capacity change from 0 to 1024 [ 28.450632][ T3561] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 28.453686][ T3296] EXT4-fs error (device loop2): ext4_quota_off:7205: inode #3: comm syz-executor: mark_inode_dirty error [ 28.475178][ T3561] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 28.483175][ T3561] EXT4-fs (loop0): orphan cleanup on readonly fs [ 28.495286][ T3561] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5838: Corrupt filesystem [ 28.505379][ T3561] EXT4-fs (loop0): Remounting filesystem read-only [ 28.513344][ T3561] EXT4-fs (loop0): 1 orphan inode deleted [ 28.519828][ T3561] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 28.531967][ T3561] SELinux: (dev loop0, type ext4) getxattr errno 5 [ 28.539030][ T3561] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 28.556174][ T3564] lo speed is unknown, defaulting to 1000 [ 28.565440][ T3561] syz.0.51 (3561) used greatest stack depth: 9624 bytes left [ 28.573931][ T3564] lo speed is unknown, defaulting to 1000 [ 28.581837][ T3564] lo speed is unknown, defaulting to 1000 [ 28.588294][ T3564] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 28.596239][ T3564] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 28.619660][ T3564] lo speed is unknown, defaulting to 1000 [ 28.630217][ T3564] lo speed is unknown, defaulting to 1000 [ 28.641534][ T3564] lo speed is unknown, defaulting to 1000 [ 28.647818][ T3564] lo speed is unknown, defaulting to 1000 [ 28.668224][ T3564] lo speed is unknown, defaulting to 1000 [ 28.703774][ T3579] loop1: detected capacity change from 0 to 512 [ 28.727298][ T3579] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 28.740594][ T3579] ext4 filesystem being mounted at /12/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 28.747340][ T3586] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 28.783933][ T3294] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 28.858423][ T3596] netlink: 24 bytes leftover after parsing attributes in process `syz.0.66'. [ 28.934049][ T3605] netlink: 4 bytes leftover after parsing attributes in process `syz.1.70'. [ 28.943479][ T3605] netlink: 4 bytes leftover after parsing attributes in process `syz.1.70'. [ 28.968176][ T3607] syz.1.71[3607] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 28.968288][ T3607] syz.1.71[3607] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 28.981067][ T3607] syz.1.71[3607] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 29.005069][ T3607] lo speed is unknown, defaulting to 1000 [ 29.090683][ T3611] loop1: detected capacity change from 0 to 512 [ 29.107465][ T3611] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 29.126688][ T3611] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 29.154852][ T3294] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 29.494281][ T3623] loop2: detected capacity change from 0 to 1024 [ 29.502134][ T3623] EXT4-fs: Ignoring removed orlov option [ 29.529316][ T3623] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 29.896869][ T3296] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 29.932319][ C0] hrtimer: interrupt took 26448 ns [ 29.962960][ T3640] $H: renamed from bond0 (while UP) [ 29.977898][ T3640] $H: entered promiscuous mode [ 29.982964][ T3640] bond_slave_0: entered promiscuous mode [ 29.988889][ T3640] bond_slave_1: entered promiscuous mode [ 30.062449][ T3647] netlink: 8 bytes leftover after parsing attributes in process `syz.3.85'. [ 30.410718][ T3675] loop1: detected capacity change from 0 to 128 [ 30.420491][ T3675] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x61ff7272 (sector = 1) [ 30.436896][ T3675] FAT-fs (loop1): error, invalid access to FAT (entry 0x00000100) [ 30.444767][ T3675] FAT-fs (loop1): Filesystem has been set read-only [ 30.451739][ T3675] syz.1.93: attempt to access beyond end of device [ 30.451739][ T3675] loop1: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 30.466455][ T3675] FAT-fs (loop1): error, invalid access to FAT (entry 0x00000100) [ 30.474517][ T3675] FAT-fs (loop1): error, invalid access to FAT (entry 0x00000100) [ 30.482974][ T3675] syz.1.93: attempt to access beyond end of device [ 30.482974][ T3675] loop1: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 30.496375][ T3675] syz.1.93: attempt to access beyond end of device [ 30.496375][ T3675] loop1: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 30.530542][ T3675] syz.1.93: attempt to access beyond end of device [ 30.530542][ T3675] loop1: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 30.655265][ T3683] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 30.728788][ T3683] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 30.788395][ T3683] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 30.804063][ T3686] Illegal XDP return value 713711385 on prog (id 84) dev N/A, expect packet loss! [ 30.833453][ T3683] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 30.849337][ T3688] loop0: detected capacity change from 0 to 1024 [ 30.892965][ T3688] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 30.909172][ T3697] netlink: 'syz.2.100': attribute type 4 has an invalid length. [ 30.918749][ T3688] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2863: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 30.941903][ T3683] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.951880][ T3297] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 30.961355][ T3683] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.973306][ T3683] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.003981][ T3683] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.046061][ T3706] loop0: detected capacity change from 0 to 4096 [ 31.058280][ T3706] EXT4-fs: Ignoring removed orlov option [ 31.063957][ T3706] EXT4-fs: Ignoring removed nomblk_io_submit option [ 31.081930][ T3706] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.116376][ T3713] netlink: 596 bytes leftover after parsing attributes in process `syz.4.108'. [ 31.132513][ T3297] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.174390][ T3718] netlink: 'syz.0.109': attribute type 4 has an invalid length. [ 31.239437][ T3726] loop4: detected capacity change from 0 to 512 [ 31.250352][ T3726] EXT4-fs: Ignoring removed i_version option [ 31.269004][ T3726] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 31.283874][ T3726] ext4 filesystem being mounted at /20/w5T)`)YFnA@T<3ڂ$rcnHwC" -8 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.348049][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 31.495837][ T3740] netlink: 'syz.3.119': attribute type 7 has an invalid length. [ 31.503589][ T3740] netlink: 8 bytes leftover after parsing attributes in process `syz.3.119'. [ 31.590780][ T29] kauditd_printk_skb: 211 callbacks suppressed [ 31.590804][ T29] audit: type=1326 audit(1737576920.123:339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3751 comm="syz.2.125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb85c795d29 code=0x7ffc0000 [ 31.620324][ T29] audit: type=1326 audit(1737576920.123:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3751 comm="syz.2.125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb85c795d29 code=0x7ffc0000 [ 31.707020][ T29] audit: type=1326 audit(1737576920.123:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3751 comm="syz.2.125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7fb85c795d29 code=0x7ffc0000 [ 31.730308][ T29] audit: type=1326 audit(1737576920.123:342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3751 comm="syz.2.125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb85c795d29 code=0x7ffc0000 [ 31.753866][ T29] audit: type=1326 audit(1737576920.123:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3751 comm="syz.2.125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb85c795d29 code=0x7ffc0000 [ 31.777340][ T29] audit: type=1326 audit(1737576920.123:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3751 comm="syz.2.125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fb85c795d29 code=0x7ffc0000 [ 31.800685][ T29] audit: type=1326 audit(1737576920.123:345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3751 comm="syz.2.125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb85c795d29 code=0x7ffc0000 [ 31.824155][ T29] audit: type=1326 audit(1737576920.123:346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3751 comm="syz.2.125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb85c795d29 code=0x7ffc0000 [ 31.848179][ T29] audit: type=1326 audit(1737576920.123:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3751 comm="syz.2.125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fb85c795d29 code=0x7ffc0000 [ 31.871833][ T29] audit: type=1326 audit(1737576920.123:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3751 comm="syz.2.125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb85c795d29 code=0x7ffc0000 [ 32.286972][ T3801] xt_CT: You must specify a L4 protocol and not use inversions on it [ 32.293773][ T3803] netlink: 24 bytes leftover after parsing attributes in process `syz.4.147'. [ 32.313967][ T3805] netlink: 'syz.1.143': attribute type 13 has an invalid length. [ 32.329981][ T3808] capability: warning: `syz.2.149' uses deprecated v2 capabilities in a way that may be insecure [ 32.432929][ T3805] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.440399][ T3805] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.502385][ T3805] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 32.512849][ T3805] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 32.548286][ T3805] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.557304][ T3805] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.566340][ T3805] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.575364][ T3805] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.589554][ T1036] lo speed is unknown, defaulting to 1000 [ 32.595469][ T3813] netem: unknown loss type 0 [ 32.600079][ T3813] netem: change failed [ 32.614891][ T3823] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.155'. [ 32.688446][ T3832] netlink: 12 bytes leftover after parsing attributes in process `syz.3.156'. [ 32.697454][ T3832] netlink: 'syz.3.156': attribute type 12 has an invalid length. [ 32.723551][ T3832] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 32.732438][ T3832] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 32.741189][ T3832] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 32.749975][ T3832] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 32.770095][ T3832] vxlan0: entered promiscuous mode [ 32.774279][ T3840] loop2: detected capacity change from 0 to 128 [ 32.787397][ T3839] loop0: detected capacity change from 0 to 512 [ 32.795081][ T3839] EXT4-fs (loop0): external journal device major/minor numbers have changed [ 32.815221][ T3842] pim6reg1: entered promiscuous mode [ 32.820588][ T3842] pim6reg1: entered allmulticast mode [ 32.836833][ T3839] EXT4-fs (loop0): failed to open journal device unknown-block(11,127) -6 [ 32.841667][ T3840] syz.2.163: attempt to access beyond end of device [ 32.841667][ T3840] loop2: rw=2049, sector=145, nr_sectors = 896 limit=128 [ 32.872552][ T3840] syz.2.163: attempt to access beyond end of device [ 32.872552][ T3840] loop2: rw=524288, sector=657, nr_sectors = 256 limit=128 [ 32.886420][ T3840] syz.2.163: attempt to access beyond end of device [ 32.886420][ T3840] loop2: rw=0, sector=657, nr_sectors = 8 limit=128 [ 32.900219][ T3840] syz.2.163: attempt to access beyond end of device [ 32.900219][ T3840] loop2: rw=0, sector=657, nr_sectors = 8 limit=128 [ 32.937876][ T3848] netlink: 'syz.0.166': attribute type 1 has an invalid length. [ 33.119657][ T3866] tmpfs: Bad value for 'mpol' [ 33.126324][ T3866] netlink: 'syz.1.174': attribute type 10 has an invalid length. [ 33.134174][ T3866] netlink: 28 bytes leftover after parsing attributes in process `syz.1.174'. [ 33.156130][ T3866] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.165041][ T3866] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.173819][ T3866] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.182644][ T3866] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.193046][ T3866] team0: Port device geneve1 added [ 33.323621][ T3879] syz.1.179[3879] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 33.323934][ T3879] syz.1.179[3879] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 33.335862][ T3879] syz.1.179[3879] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 33.502053][ T3885] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 33.555741][ T3887] loop2: detected capacity change from 0 to 8192 [ 33.636853][ T3893] ================================================================== [ 33.645281][ T3893] BUG: KCSAN: data-race in filemap_splice_read / filemap_splice_read [ 33.653514][ T3893] [ 33.655852][ T3893] write to 0xffff88811db502f0 of 8 bytes by task 3887 on cpu 1: [ 33.664180][ T3893] filemap_splice_read+0x6c4/0x910 [ 33.669401][ T3893] splice_direct_to_actor+0x269/0x670 [ 33.674794][ T3893] do_splice_direct+0xd7/0x150 [ 33.679583][ T3893] do_sendfile+0x398/0x660 [ 33.684102][ T3893] __x64_sys_sendfile64+0x110/0x150 [ 33.689337][ T3893] x64_sys_call+0xfbd/0x2dc0 [ 33.693944][ T3893] do_syscall_64+0xc9/0x1c0 [ 33.698455][ T3893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 33.704345][ T3893] [ 33.706686][ T3893] write to 0xffff88811db502f0 of 8 bytes by task 3893 on cpu 0: [ 33.714306][ T3893] filemap_splice_read+0x6c4/0x910 [ 33.719412][ T3893] splice_direct_to_actor+0x269/0x670 [ 33.724805][ T3893] do_splice_direct+0xd7/0x150 [ 33.729588][ T3893] do_sendfile+0x398/0x660 [ 33.733992][ T3893] __x64_sys_sendfile64+0x110/0x150 [ 33.739176][ T3893] x64_sys_call+0xfbd/0x2dc0 [ 33.743757][ T3893] do_syscall_64+0xc9/0x1c0 [ 33.748354][ T3893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 33.754263][ T3893] [ 33.756573][ T3893] value changed: 0x00000000000000a2 -> 0x00000000000000a3 [ 33.763674][ T3893] [ 33.765990][ T3893] Reported by Kernel Concurrency Sanitizer on: [ 33.772138][ T3893] CPU: 0 UID: 0 PID: 3893 Comm: syz.2.183 Not tainted 6.13.0-syzkaller-04541-gdf60eac9efe8 #0 [ 33.782365][ T3893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 33.792493][ T3893] ==================================================================