last executing test programs: 1m9.796989593s ago: executing program 4 (id=4742): syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0xf3a, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x7ff, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='sched_switch\x00', r2}, 0x10) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1e, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x8, 0x1, 0x29}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x7b53a000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e24}, 0x6e) socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="796100000000fcdbdf257e"], 0x1c}}, 0x4000054) 1m6.688798209s ago: executing program 4 (id=4777): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b00000008000000070000000900000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000540)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000ff0f00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r1}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_io_uring_setup(0x1714, &(0x7f0000002040)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x2c, 0x2, r2, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0}}) syz_mount_image$ext4(&(0x7f00000008c0)='ext4\x00', &(0x7f0000000300)='./file1\x00', 0x800080, &(0x7f00000000c0)={[{@dioread_nolock}, {@noinit_itable}, {@grpquota}]}, 0x3, 0x45d, &(0x7f0000000900)="$eJzs28tvG0UYAPBv7Th9E1PKow8gUBAVj6RpC/TAARBIHIqEBAc4RklalboNaoLUVhW0CJUTQkjcEUf+BU5wQYgTEle4o0oV6qUtJ6P17jaOa7tJascB/37SJjO7szvzeXfs2R07gKE1nv5JIrZHxB8RMZZllxcYz/7dvH5x5tb1izNJ1Ovv/p00yt24fnGmKFrst61p99LnSextU+/C+Qunpmu1ubN5fnLx9EeTC+cvvHDy9PSJuRNzZw4dPXrk8NTLLx16sSdxpm26seeT+X273/rg67ePfZmuGy3ib4mjR8a7bXy6Xu9xdYO1oymdjAywIaxKOSLS01Vp9P+xKMfSyRuLNz8baOOAvqrX6/VtnTdfqgP/Y1ub3glSujwMi+KDPr3/LZbWQcCr/Rl6bAjXXstugNK4b+ZLtmUkSnmZSsv9bS+NR8T7l/75Nl2iP88hAACW+TEd/zzfbvxXioeayt2Xzw1VI+L+iNgZEQ9ExK6IeDCiUfbhiHhklfW3TpLcOf4pXV1TYCuUjv9eyee2lo//itFfVMt5bkcj/kpy/GRt7mD+mhyIyqY0P9Wljp/e+P2rTtuax3/pktZfjAXzdlwd2bR8n9npxel7ibnZtcsRe0baxZ/cnglIImJ3ROxZYx0nn/1+X6dtd4+/ix7MM9W/i3gmO/+XoiX+QtJ9fnJyc9TmDk4WV8Wdfv3tyjud6r+n+HsgPf9b217/t+OvJs3ztQurr+PKn190vKdZ4fVfbd4nvf5Hk/ca6dF83bnpxcWzUxGjybGs0c3rDy3tW+SL8mn8B/a37/87Y+mV2BsR6UX8aEQ8FhGP521/IiKejIj9XeL/5fWnPlx7/P2Vxj+7qvO/lBiN1jXtE+VTP/+wrNLqHfHf6n7+jzRSB/I1K3n/W0m71nY1AwAAwH9PKSK2R1KauJ0ulSYmsu/L74oo1eYXFp87Pv/xmdnsNwLVqJSKJ11jTc9Dp/Lb+ix/OSKyrxYU2w/nz42/KW9p5Cdm5muzgw4ehty2Dv0/9Vd50K0D+s7vtWB46f8wvPR/GF7t+/+WdW8HsP7a9H+dH4ZEu8//TwfQDmD9tfR/034wRDz/g+Gl/8Pw0v9hKC1sibv/SL5rojjSGnfvlhg5lx2690deh0RUNkQzssTm3h85ShsgLom+JQb4pgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANBD/wYAAP//hmXXag==") r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c40)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000020000380100000800c00018006000100d10300000c00008008000340000000022c0000000e0a010200000000000000000a0000000900010073797a31000000000900020073797a310000000014000000110001"], 0xdc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002f40)=ANY=[@ANYBLOB="40000000210a010800000000000000000a0000010900020073797a31000000000900010073797a310000000014000380"], 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='block_plug\x00'}, 0x18) mkdir(0x0, 0x40) mount$tmpfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[]) syz_open_dev$evdev(0x0, 0x2, 0x842) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="8b332abd7000000000001500000008000300", @ANYRES32=0x0], 0x2c}}, 0x40084) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MPATH(r8, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="28002c007000e38c3c35464d5078fbdbdf25", @ANYRES32=r11, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x1000) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1m6.68121965s ago: executing program 4 (id=4778): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, &(0x7f0000000580)=[{{0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}, {{0x0, 0x0, 0x1, 0x1}, {0x4, 0x1, 0x1}}, {{0x3, 0x0, 0x1}, {0x1, 0x1, 0x0, 0x1}}, {{0x0, 0x1}, {0x3, 0x1}}], 0x20) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, &(0x7f0000000100)=[{{0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}], 0x8) 1m6.662067322s ago: executing program 4 (id=4779): r0 = syz_open_dev$tty1(0xc, 0x4, 0x2) r1 = dup(r0) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0xa00, 0x0, 0x101, 0x100}}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0xb, &(0x7f0000000380)=ANY=[@ANYRES16=0x0], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r2}, 0x18) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x2, &(0x7f0000000600)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}, {0x7, 0x7, 0x4, 0x6}]}) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r4}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000010000000a00000008"], 0x48) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000003c0), 0x800, 0x0) ioctl$BTRFS_IOC_DEFRAG(r6, 0x50009402, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000002000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r7}, 0x10) r8 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r8, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r9 = socket$tipc(0x1e, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) chroot(&(0x7f00000000c0)='./file0/file0\x00') r10 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x228940, 0x27) mkdirat(r10, &(0x7f0000000140)='./file0/../file0\x00', 0x0) setsockopt$TIPC_GROUP_JOIN(r9, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r8, &(0x7f0000000280)={&(0x7f0000000040), 0x10, 0x0}, 0x0) open(&(0x7f0000000080)='./file1\x00', 0x22a42, 0x0) utimes(&(0x7f0000000000)='./file1\x00', 0x0) ioctl$VT_DISALLOCATE(r3, 0x5608) 1m6.637430045s ago: executing program 4 (id=4780): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x10, &(0x7f0000000d40)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_io_uring_setup(0x237, &(0x7f0000000480)={0x0, 0x8901, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x24, 0x2007, @fd, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) io_uring_enter(r0, 0x47ba, 0x0, 0x0, 0x0, 0x0) 1m6.324586376s ago: executing program 4 (id=4789): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b00000008000000070000000900000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000540)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000ff0f00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r1}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_io_uring_setup(0x1714, &(0x7f0000002040)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x2c, 0x2, r2, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0}}) syz_mount_image$ext4(&(0x7f00000008c0)='ext4\x00', &(0x7f0000000300)='./file1\x00', 0x800080, &(0x7f00000000c0)={[{@dioread_nolock}, {@noinit_itable}, {@grpquota}]}, 0x3, 0x45d, &(0x7f0000000900)="$eJzs28tvG0UYAPBv7Th9E1PKow8gUBAVj6RpC/TAARBIHIqEBAc4RklalboNaoLUVhW0CJUTQkjcEUf+BU5wQYgTEle4o0oV6qUtJ6P17jaOa7tJascB/37SJjO7szvzeXfs2R07gKE1nv5JIrZHxB8RMZZllxcYz/7dvH5x5tb1izNJ1Ovv/p00yt24fnGmKFrst61p99LnSextU+/C+Qunpmu1ubN5fnLx9EeTC+cvvHDy9PSJuRNzZw4dPXrk8NTLLx16sSdxpm26seeT+X273/rg67ePfZmuGy3ib4mjR8a7bXy6Xu9xdYO1oymdjAywIaxKOSLS01Vp9P+xKMfSyRuLNz8baOOAvqrX6/VtnTdfqgP/Y1ub3glSujwMi+KDPr3/LZbWQcCr/Rl6bAjXXstugNK4b+ZLtmUkSnmZSsv9bS+NR8T7l/75Nl2iP88hAACW+TEd/zzfbvxXioeayt2Xzw1VI+L+iNgZEQ9ExK6IeDCiUfbhiHhklfW3TpLcOf4pXV1TYCuUjv9eyee2lo//itFfVMt5bkcj/kpy/GRt7mD+mhyIyqY0P9Wljp/e+P2rTtuax3/pktZfjAXzdlwd2bR8n9npxel7ibnZtcsRe0baxZ/cnglIImJ3ROxZYx0nn/1+X6dtd4+/ix7MM9W/i3gmO/+XoiX+QtJ9fnJyc9TmDk4WV8Wdfv3tyjud6r+n+HsgPf9b217/t+OvJs3ztQurr+PKn190vKdZ4fVfbd4nvf5Hk/ca6dF83bnpxcWzUxGjybGs0c3rDy3tW+SL8mn8B/a37/87Y+mV2BsR6UX8aEQ8FhGP521/IiKejIj9XeL/5fWnPlx7/P2Vxj+7qvO/lBiN1jXtE+VTP/+wrNLqHfHf6n7+jzRSB/I1K3n/W0m71nY1AwAAwH9PKSK2R1KauJ0ulSYmsu/L74oo1eYXFp87Pv/xmdnsNwLVqJSKJ11jTc9Dp/Lb+ix/OSKyrxYU2w/nz42/KW9p5Cdm5muzgw4ehty2Dv0/9Vd50K0D+s7vtWB46f8wvPR/GF7t+/+WdW8HsP7a9H+dH4ZEu8//TwfQDmD9tfR/034wRDz/g+Gl/8Pw0v9hKC1sibv/SL5rojjSGnfvlhg5lx2690deh0RUNkQzssTm3h85ShsgLom+JQb4pgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANBD/wYAAP//hmXXag==") r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c40)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000020000380100000800c00018006000100d10300000c00008008000340000000022c0000000e0a010200000000000000000a0000000900010073797a31000000000900020073797a310000000014000000110001"], 0xdc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002f40)=ANY=[@ANYBLOB="40000000210a010800000000000000000a0000010900020073797a31000000000900010073797a310000000014000380"], 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='block_plug\x00'}, 0x18) mkdir(0x0, 0x40) mount$tmpfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[]) syz_open_dev$evdev(0x0, 0x2, 0x842) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="8b332abd7000000000001500000008000300", @ANYRES32=0x0], 0x2c}}, 0x40084) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MPATH(r8, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="28002c007000e38c3c35464d5078fbdbdf25", @ANYRES32=r11, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x1000) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1m6.324310346s ago: executing program 32 (id=4789): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b00000008000000070000000900000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000540)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000ff0f00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r1}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_io_uring_setup(0x1714, &(0x7f0000002040)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x2c, 0x2, r2, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0}}) syz_mount_image$ext4(&(0x7f00000008c0)='ext4\x00', &(0x7f0000000300)='./file1\x00', 0x800080, &(0x7f00000000c0)={[{@dioread_nolock}, {@noinit_itable}, {@grpquota}]}, 0x3, 0x45d, &(0x7f0000000900)="$eJzs28tvG0UYAPBv7Th9E1PKow8gUBAVj6RpC/TAARBIHIqEBAc4RklalboNaoLUVhW0CJUTQkjcEUf+BU5wQYgTEle4o0oV6qUtJ6P17jaOa7tJascB/37SJjO7szvzeXfs2R07gKE1nv5JIrZHxB8RMZZllxcYz/7dvH5x5tb1izNJ1Ovv/p00yt24fnGmKFrst61p99LnSextU+/C+Qunpmu1ubN5fnLx9EeTC+cvvHDy9PSJuRNzZw4dPXrk8NTLLx16sSdxpm26seeT+X273/rg67ePfZmuGy3ib4mjR8a7bXy6Xu9xdYO1oymdjAywIaxKOSLS01Vp9P+xKMfSyRuLNz8baOOAvqrX6/VtnTdfqgP/Y1ub3glSujwMi+KDPr3/LZbWQcCr/Rl6bAjXXstugNK4b+ZLtmUkSnmZSsv9bS+NR8T7l/75Nl2iP88hAACW+TEd/zzfbvxXioeayt2Xzw1VI+L+iNgZEQ9ExK6IeDCiUfbhiHhklfW3TpLcOf4pXV1TYCuUjv9eyee2lo//itFfVMt5bkcj/kpy/GRt7mD+mhyIyqY0P9Wljp/e+P2rTtuax3/pktZfjAXzdlwd2bR8n9npxel7ibnZtcsRe0baxZ/cnglIImJ3ROxZYx0nn/1+X6dtd4+/ix7MM9W/i3gmO/+XoiX+QtJ9fnJyc9TmDk4WV8Wdfv3tyjud6r+n+HsgPf9b217/t+OvJs3ztQurr+PKn190vKdZ4fVfbd4nvf5Hk/ca6dF83bnpxcWzUxGjybGs0c3rDy3tW+SL8mn8B/a37/87Y+mV2BsR6UX8aEQ8FhGP521/IiKejIj9XeL/5fWnPlx7/P2Vxj+7qvO/lBiN1jXtE+VTP/+wrNLqHfHf6n7+jzRSB/I1K3n/W0m71nY1AwAAwH9PKSK2R1KauJ0ulSYmsu/L74oo1eYXFp87Pv/xmdnsNwLVqJSKJ11jTc9Dp/Lb+ix/OSKyrxYU2w/nz42/KW9p5Cdm5muzgw4ehty2Dv0/9Vd50K0D+s7vtWB46f8wvPR/GF7t+/+WdW8HsP7a9H+dH4ZEu8//TwfQDmD9tfR/034wRDz/g+Gl/8Pw0v9hKC1sibv/SL5rojjSGnfvlhg5lx2690deh0RUNkQzssTm3h85ShsgLom+JQb4pgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANBD/wYAAP//hmXXag==") r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c40)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000020000380100000800c00018006000100d10300000c00008008000340000000022c0000000e0a010200000000000000000a0000000900010073797a31000000000900020073797a310000000014000000110001"], 0xdc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002f40)=ANY=[@ANYBLOB="40000000210a010800000000000000000a0000010900020073797a31000000000900010073797a310000000014000380"], 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='block_plug\x00'}, 0x18) mkdir(0x0, 0x40) mount$tmpfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[]) syz_open_dev$evdev(0x0, 0x2, 0x842) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="8b332abd7000000000001500000008000300", @ANYRES32=0x0], 0x2c}}, 0x40084) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MPATH(r8, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="28002c007000e38c3c35464d5078fbdbdf25", @ANYRES32=r11, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x1000) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1m3.750417189s ago: executing program 5 (id=4798): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_NAME(0xf, &(0x7f0000000980)='\xff\x00\x00\x00\x00\x00\x000`\x14\x99\x06\xc0\x7fs\x00\t\x14\x17\xc3\xf5\xc9\v\x85\xe7\x00\x00\x18\x88\x06\x94\x98\xa9\xe7\x1c\x8a\x89\xdc\xcc\xf7L\xbd%\xc3!\x0e\x91S\xb2~8\"\xe2\xed\xbf\x12\x1a\\6p\'p\xef\x1a\n\x99\x12\xe8\'\x1c\x97M\xa5N\xd9\xbeV&\x1c2K?\x95\xd9\"\xbe\x050+\xca\xea\'\xe9)\xfe\xeb\x9c\xb5\xa0F`\xe4D\x10F\x831\xec\\v\xf0\xab_M\b\x03\xc3\n\x89\x01E`\xd35Q2\xecZz\xdc\x065p\x1c\x8f\x9b\x99IGXO\x00\x00\v\xed\xb0\xc5\xd4\xc7,\x1a\xb3}CMOO\x8a\xa8kh\x7f\x05c\xfc\xebb\xc8\xa2\xa9\xbf\xb3\x9b\xafE\xbd\xc5\xdc\xde\xbe_') r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007d000000180100002020732600000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000a40)='kfree\x00', r0, 0x0, 0x2}, 0x18) syz_open_dev$vcsn(0x0, 0x1, 0x1) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x103341) r1 = socket(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x4}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x78, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x78}}, 0x0) 1m3.680400065s ago: executing program 5 (id=4829): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) 1m3.641019889s ago: executing program 5 (id=4830): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00"/11], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000002c0000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x62, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000240)='kfree\x00', r1, 0x0, 0x2}, 0x18) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001a0000000c00018008000100", @ANYRES32=r5], 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) 1m1.645336673s ago: executing program 5 (id=4868): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x10, &(0x7f0000000d40)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_io_uring_setup(0x237, &(0x7f0000000480)={0x0, 0x8901, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r4, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x24, 0x2007, @fd, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) io_uring_enter(r1, 0x47ba, 0x0, 0x0, 0x0, 0x0) 1m1.608655507s ago: executing program 33 (id=4868): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x10, &(0x7f0000000d40)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_io_uring_setup(0x237, &(0x7f0000000480)={0x0, 0x8901, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r4, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x24, 0x2007, @fd, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) io_uring_enter(r1, 0x47ba, 0x0, 0x0, 0x0, 0x0) 6.074413531s ago: executing program 0 (id=6168): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000080)={0x2, &(0x7f00000000c0)=[{0x48, 0x8, 0xfe, 0xff7ffeff}, {0x6, 0xa, 0xfe, 0x8001}]}) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000180)="1a06848abe2704548ab878a293b32a0e0000000000000ab16b757e8811716bdef1a91bd5f485a7ffa232c4f5fca2c7", 0x2f}, {&(0x7f0000000340)="11e256dcf6f85d2e27c8c635fb37377aa336aa8f7e790a6a9d57accf04c2f91d3fe742d1de46d06d5c82d4ff28b39242f43770376d81e513d02670dedcdb1e177d0071a7a2e10312af375e26185db40b901b34aaade3aa38dfbe60b2f9d1e4177103cd08d1f42de94f18fea5a1cfa48bd0e80cd5a594719250416a2b6c", 0x7d}, {&(0x7f0000000040)="51e216b524fba92e0b3bb9cb9f764879555ab853c6981e5d376d46ad2d2be813b52bc43e5ff840a6d8", 0x29}, {&(0x7f00000004c0)="04227b53b2acecdee16aceb155f070909ba3e84227c93e2e536371e1a63fa34a97b92e03e1e1355fb92d67e23c51f4638a7e627ab1efaf6420e4ed63f1ee28388a898042185a9b0bdce47d17f1853860889ef5fe1c6b8adc953ab13336fb9df3f76817f3ce034a41d2ac8a8a08533a2c109febde8b66e6ebbccbb808de68c01907dc945aad2e608138422e38906e45d0a0419357d518e59299f1abb9d9771ce7586527e3ee6012f509f3afc991fbd2b71e91710af1e678ab8ec63561228694b664ebe6a3f6557aa10740205948c51af598525e9f4f97b047e48903a067d2c2b934b21d65d807964a2da526fd944dd8c2095d84", 0xf3}], 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1, 0xffffffff}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000003200)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r4}, &(0x7f0000000340), &(0x7f0000000380)=r5}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r5, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r6}, 0x18) syz_open_dev$tty20(0xc, 0x4, 0x1) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x510, 0x3a8, 0x210, 0x210, 0x0, 0x138, 0x478, 0x478, 0x478, 0x478, 0x478, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x11000000, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x570) 4.877251483s ago: executing program 0 (id=6191): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xae, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7ffd}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x41, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) r1 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$selinux_access(r1, &(0x7f0000001a80)=ANY=[@ANYBLOB], 0x56) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x10, 0x0, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) socket(0x10, 0x3, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, 0x0}) pipe2$9p(0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1b000000000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001812"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x23, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x42, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2000000020008107090f9becdb4cb96b02000020fd000001006400000000", 0x1e}], 0x1, 0x0, 0x0, 0x81000000}, 0x0) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000100)={[{@grpquota}, {@delalloc}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@nomblk_io_submit}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='setgroups\x00') writev(r5, &(0x7f0000000580)=[{0x0, 0x2}, {&(0x7f0000000440)="8e", 0x1}], 0x2) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x40041}, 0x4040850) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a48000000030a0fdb00000000000000000a0020050900030073797a30000000000900010073797a310000000014000480080002403cb140bb08000140000000030800054000000000140000001100010000000000000800000100000a"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c00000010000100"/20, @ANYRES32=0x0, @ANYBLOB="5d5b0000000000001c001a8018000a8000"/36], 0x3c}}, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="380000000314010026bd7000ffdbdf250900020073797a190000000008004100736977001400330076657468305f746f5f6272696467650032b60fb7c3f8e33992a4f907f6990509be1c6a8c18c2fc0a0de8aeabc8515331d72ca72b72732e8941b9b26437e4218c78aa9e3b1875e904e52b"], 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x20004010) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) 4.761948515s ago: executing program 0 (id=6192): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0900000004000000dd0000000a00000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000009bf3850100", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa10000000000000701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200009b1aecb60000000000000000850000007500000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r1}, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f0000000b00)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.current\x00', 0x275a, 0x0) fcntl$lock(r3, 0x24, &(0x7f0000000000)={0x1, 0x0, 0xffffffffffffffff, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYBLOB="17e2ee7b0474b5010499150a3f60c1280689b20e950d0f958fd06f80da1cf2a9606e3ef6df263b9a9a4f2bbede4a383d26de399f6dc649e9891987117b7023872d4db976d35094c97b0180592547aedb640ebe2f0ca83f55ae7b9bd86226646ea1151dbcbde681d9362d07c42866bc1effd2dfed29016d89776c449d6a53343477a95578f84a57fd2299ac5f58bee2edc457495355c8865dd0ffe1bc094dd292dc1475d35f9fb8de7baae9e0e2830b19a4b6f8dfeea429f2c7c7fb7627ea7363a6155c926109e0a0f0816af4daac12", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x30044f1, &(0x7f0000000640)=ANY=[@ANYRES8, @ANYRES64, @ANYRES64, @ANYRES64, @ANYRES8=0x0, @ANYBLOB="9a91a5a3a592bafb94ffece9d27c1c575d6c718de75e6815e3362fad71091ef0b4d831be0f31d33cfd5786a337da031adcc6aabcf77d403c9704c4024b72ff31e30211aeab913360da7d845e34350b569a0487e4f670be55ed44400835754aeddfc79546890cab813647b69c8ce61d428fcdad9face3c716afb3ffb974efa9736f21d7195ec28d"], 0x0, 0x23e, &(0x7f0000000bc0)="$eJzs3c9qE1EUB+AzSdqmukgWrkRwQBeuStsnSJEKYldKFupCi21BklCwEGgVQ1c+gU/ic7jxDXwAoTtdFEYmSZsWUm0wf0r9vk0uzP3NOTe5Iau5eX2n1dja3ds5/PA9yuUkCrWoJUcR1ShEbiEAgOvmV5bFUdYzWrJUmFRPAMBkXfL3f3GKLQEAE/bs+Ysnaxsb60/TtBzR+tSuJ9F77V1f24m30YztWI5KHEdkp3rjR4831qOU5qpxv9Vp1/Nk69XX/v3XfkR08ytRierw/Eracybfadfn4ka/fi3Pr0Ylbg3Prw7JR30+Htw70/9SVOLbm9iNZmxFnh3kP66k6cPs88/3L/OO83zSadcXuvMGsuLUPxwAAAAAAAAAAAAAAAAAAAAAAK6tpTRN0yz7kmVZ1jl3/k7xuHt9KT1RPX8+Ty9/0flAnTPn6yznJZLe/EG+FLdLUZrl2gEAAAAAAAAAAAAAAAAAAOCq2Ns/aGw2m9vvxjo4eax//Hf+10EU+601k4gr0E93sJj3M51ad2PEWrURS0Rh/6Bxsrsam0n8JVWe0CbJhmy/4oWp+TFVn7853lUkETF3+mb+aXIh5sb8TQEAAAAAAAAAAAAAAAAAAKZs8NDvkIuHM2gIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGZg8P//Iww6/fAlUzNeIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP+B3wEAAP//bkR7Lg==") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3e8, 0x0, 0x0, 0x130, 0x300, 0x300, 0x300, 0x7fffffe, 0x0, {[{{@arp={@local, @empty=0xffffff7f, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f67b23ffdfa27f907a03732da3acbc6518e62a77ca06f258762e88c0d9f9d2f413b94a105f4bdf01425ce81c5d000000000000000500ffffffff00"}}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) 4.641029498s ago: executing program 0 (id=6193): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$bind(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$tmpfs(0x0, 0x0, 0x0, 0x200044, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = signalfd(r2, &(0x7f0000000080)={[0x100000000000000]}, 0x8) r5 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) pwrite64(r4, &(0x7f0000000240)="ab620081927830b86f66764aead5020b402e1997d4269ebbc4a5e17bab28fe42ae510fd136667da1de80e35a020c7029f460f155b17efaf10c3949c0bd410297c989df8be6df85fc09f03fa1429936b490e8f6cb35547d46275e0f1e180a526b", 0x60, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x181097, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_procs(r6, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r7, &(0x7f0000000c40), 0x12) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e21, 0x9, @loopback, 0x8}, 0x1c) sendfile(r2, r5, 0x0, 0x401) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r1}, 0x10) 4.544910627s ago: executing program 0 (id=6197): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000a0db000000000000000000850000000e000000d50000002a00c50095"], &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='scsi_dispatch_cmd_start\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000740)='scsi_dispatch_cmd_start\x00', r2}, 0x10) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='kfree\x00', r4}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r3}, &(0x7f0000000000), &(0x7f00000005c0)=r4}, 0x20) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000780)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000006280)={0x0, 0x600, &(0x7f0000000340)={&(0x7f0000000280)=@newtaction={0x98, 0x30, 0x1, 0x70bd29, 0x0, {0x0, 0x0, 0x6a00}, [{0x84, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x3, 0xfbb, 0x10000000, 0x0, 0x8}, 0x3, r6}}]}, {0x4, 0xa}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_mpls={0x30, 0x2, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}}, 0x800) 4.344976588s ago: executing program 0 (id=6203): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = syz_io_uring_setup(0x499, &(0x7f0000000f40)={0x0, 0xd144, 0x0, 0x40000000, 0x37f}, &(0x7f00000001c0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB], 0x30}}) io_uring_enter(r1, 0x3516, 0xddd6, 0x4, 0x0, 0xa4) 4.143288868s ago: executing program 34 (id=6203): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = syz_io_uring_setup(0x499, &(0x7f0000000f40)={0x0, 0xd144, 0x0, 0x40000000, 0x37f}, &(0x7f00000001c0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB], 0x30}}) io_uring_enter(r1, 0x3516, 0xddd6, 0x4, 0x0, 0xa4) 3.171576367s ago: executing program 1 (id=6222): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0a00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0x20, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000100)=""/26, 0x1a}}, 0x10) r2 = syz_open_dev$vcsn(&(0x7f0000000300), 0x5, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000580)='kmem_cache_free\x00', r4}, 0x18) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) process_mrelease(0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000b80)={0x0, r5}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0xc, &(0x7f0000000a80)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32=r3, @ANYBLOB="0000000000008da4b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b804000000000000850000002400000095b3ca2fef3cb56512dcbc25a467e96746bb3326791148a883097817aab548896c3ccdd675d2a6d880ac7623736bf71a2c6122d07a9243d5969c7c1eda94b42cd3bf91aa6dd4781c48be2985f7d916d23bd0db5dfbfc6ef8b31c02ff2101c810b32e36e7a33d8f6634c7d372621d7258bb04b669a3e2bd47ddf347332769a3f7597ef8525b07499c988e2849f86b07e007aadcac75649e2cf247e07555"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbc}, 0x94) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000200)={@loopback, @rand_addr, 0x0}, &(0x7f00000002c0)=0xc) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000006c0)={0x0, 0x2}, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x9, &(0x7f0000000180)=@raw=[@exit, @map_val={0x18, 0x5, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @exit, @jmp={0x5, 0x1, 0xc, 0x8, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6}], &(0x7f0000000080)='GPL\x00', 0x8001, 0x62, &(0x7f00000003c0)=""/98, 0x41100, 0x22, '\x00', r6, 0x25, r2, 0x8, &(0x7f0000000540)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000680)={0x5, 0x7, 0x3, 0x5}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000700), &(0x7f0000000740)=[{0x4, 0x5, 0x1}, {0x0, 0x5, 0x4, 0x1}], 0x10, 0x401}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYRESOCT=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000900)='ext4_update_sb\x00', r8, 0x0, 0x6}, 0x18) r9 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r9, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r9, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r9, 0x10e, 0x4, &(0x7f0000000640)=0x1802, 0x4) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000d40)={0x240, 0x0, 0x500, 0x70bd2b, 0x25dfdbfe, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0xfff}, {0x6, 0x16, 0x9}, {0x5, 0x12, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x10}, {0x6, 0x16, 0x89}, {0x5, 0x12, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x81}, {0x6}, {0x5}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x3}, {0x6}, {0x5, 0x12, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xfffff952}, {0x6, 0x16, 0x1}, {0x5}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0xfff}, {0x6, 0x16, 0x4}, {0x5, 0x12, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x2}, {0x6, 0x16, 0x1}, {0x5}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xffffffff}, {0x6, 0x16, 0x8}, {0x5, 0x12, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x7}, {0x6, 0x16, 0x7}, {0x5}}]}, 0x240}, 0x1, 0x0, 0x0, 0x8810}, 0x1) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x238, 0x238, 0x238, 0x98, 0x98, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x0, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@dev={0xfe, 0x80, '\x00', 0x18}, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x4, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) r11 = syz_io_uring_setup(0x760a, &(0x7f00000007c0)={0x0, 0x1f36, 0x400, 0x3, 0x220}, &(0x7f0000010080), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_BUFFERS(r11, 0x0, &(0x7f0000000140)=[{0x0}, {0x0}], 0x2) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000a40)={{r7}, &(0x7f0000000980), &(0x7f0000000a00)='%pS \x00'}, 0x20) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r11, 0x10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340), 0xa002a0}], &(0x7f00000005c0), 0x2}, 0x20) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0xfd, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x4008084) 2.361875799s ago: executing program 1 (id=6232): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0a00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0x20, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000100)=""/26, 0x1a}}, 0x10) r2 = syz_open_dev$vcsn(&(0x7f0000000300), 0x5, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000580)='kmem_cache_free\x00', r4}, 0x18) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) process_mrelease(0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000b80)={0x0, r5}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0xc, &(0x7f0000000a80)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32=r3, @ANYBLOB="0000000000008da4b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b804000000000000850000002400000095b3ca2fef3cb56512dcbc25a467e96746bb3326791148a883097817aab548896c3ccdd675d2a6d880ac7623736bf71a2c6122d07a9243d5969c7c1eda94b42cd3bf91aa6dd4781c48be2985f7d916d23bd0db5dfbfc6ef8b31c02ff2101c810b32e36e7a33d8f6634c7d372621d7258bb04b669a3e2bd47ddf347332769a3f7597ef8525b07499c988e2849f86b07e007aadcac75649e2cf247e07555"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbc}, 0x94) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000200)={@loopback, @rand_addr, 0x0}, &(0x7f00000002c0)=0xc) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000006c0)={0x0, 0x2}, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x9, &(0x7f0000000180)=@raw=[@exit, @map_val={0x18, 0x5, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @exit, @jmp={0x5, 0x1, 0xc, 0x8, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6}], &(0x7f0000000080)='GPL\x00', 0x8001, 0x62, &(0x7f00000003c0)=""/98, 0x41100, 0x22, '\x00', r6, 0x25, r2, 0x8, &(0x7f0000000540)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000680)={0x5, 0x7, 0x3, 0x5}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000700), &(0x7f0000000740)=[{0x4, 0x5, 0x1}, {0x0, 0x5, 0x4, 0x1}], 0x10, 0x401}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYRESOCT=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000900)='ext4_update_sb\x00', r8, 0x0, 0x6}, 0x18) r9 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r9, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r9, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r9, 0x10e, 0x4, &(0x7f0000000640)=0x1802, 0x4) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000d40)={0x240, 0x0, 0x500, 0x70bd2b, 0x25dfdbfe, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0xfff}, {0x6, 0x16, 0x9}, {0x5, 0x12, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x10}, {0x6, 0x16, 0x89}, {0x5, 0x12, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x81}, {0x6}, {0x5}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x3}, {0x6}, {0x5, 0x12, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xfffff952}, {0x6, 0x16, 0x1}, {0x5}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0xfff}, {0x6, 0x16, 0x4}, {0x5, 0x12, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x2}, {0x6, 0x16, 0x1}, {0x5}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xffffffff}, {0x6, 0x16, 0x8}, {0x5, 0x12, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x7}, {0x6, 0x16, 0x7}, {0x5}}]}, 0x240}, 0x1, 0x0, 0x0, 0x8810}, 0x1) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x238, 0x238, 0x238, 0x98, 0x98, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x0, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@dev={0xfe, 0x80, '\x00', 0x18}, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x4, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) r11 = syz_io_uring_setup(0x760a, &(0x7f00000007c0)={0x0, 0x1f36, 0x400, 0x3, 0x220}, &(0x7f0000010080), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_BUFFERS(r11, 0x0, &(0x7f0000000140)=[{0x0}, {0x0}], 0x2) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000a40)={{r7}, &(0x7f0000000980), &(0x7f0000000a00)='%pS \x00'}, 0x20) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r11, 0x10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340), 0xa002a0}], &(0x7f00000005c0), 0x2}, 0x20) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0xfd, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x4008084) 1.999883006s ago: executing program 2 (id=6241): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0a00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0x20, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000100)=""/26, 0x1a}}, 0x10) r2 = syz_open_dev$vcsn(&(0x7f0000000300), 0x5, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000580)='kmem_cache_free\x00', r4}, 0x18) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) process_mrelease(0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000b80)={0x0, r5}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0xc, &(0x7f0000000a80)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32=r3, @ANYBLOB="0000000000008da4b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b804000000000000850000002400000095b3ca2fef3cb56512dcbc25a467e96746bb3326791148a883097817aab548896c3ccdd675d2a6d880ac7623736bf71a2c6122d07a9243d5969c7c1eda94b42cd3bf91aa6dd4781c48be2985f7d916d23bd0db5dfbfc6ef8b31c02ff2101c810b32e36e7a33d8f6634c7d372621d7258bb04b669a3e2bd47ddf347332769a3f7597ef8525b07499c988e2849f86b07e007aadcac75649e2cf247e07555"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbc}, 0x94) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000200)={@loopback, @rand_addr, 0x0}, &(0x7f00000002c0)=0xc) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000006c0)={0x0, 0x2}, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x9, &(0x7f0000000180)=@raw=[@exit, @map_val={0x18, 0x5, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @exit, @jmp={0x5, 0x1, 0xc, 0x8, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6}], &(0x7f0000000080)='GPL\x00', 0x8001, 0x62, &(0x7f00000003c0)=""/98, 0x41100, 0x22, '\x00', r6, 0x25, r2, 0x8, &(0x7f0000000540)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000680)={0x5, 0x7, 0x3, 0x5}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000700), &(0x7f0000000740)=[{0x4, 0x5, 0x1}, {0x0, 0x5, 0x4, 0x1}], 0x10, 0x401}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYRESOCT=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000900)='ext4_update_sb\x00', r8, 0x0, 0x6}, 0x18) r9 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r9, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r9, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r9, 0x10e, 0x4, &(0x7f0000000640)=0x1802, 0x4) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000d40)={0x240, 0x0, 0x500, 0x70bd2b, 0x25dfdbfe, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0xfff}, {0x6, 0x16, 0x9}, {0x5, 0x12, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x10}, {0x6, 0x16, 0x89}, {0x5, 0x12, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x81}, {0x6}, {0x5}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x3}, {0x6}, {0x5, 0x12, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xfffff952}, {0x6, 0x16, 0x1}, {0x5}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0xfff}, {0x6, 0x16, 0x4}, {0x5, 0x12, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x2}, {0x6, 0x16, 0x1}, {0x5}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xffffffff}, {0x6, 0x16, 0x8}, {0x5, 0x12, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x7}, {0x6, 0x16, 0x7}, {0x5}}]}, 0x240}, 0x1, 0x0, 0x0, 0x8810}, 0x1) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x238, 0x238, 0x238, 0x98, 0x98, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x0, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@dev={0xfe, 0x80, '\x00', 0x18}, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x4, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) r11 = syz_io_uring_setup(0x760a, &(0x7f00000007c0)={0x0, 0x1f36, 0x400, 0x3, 0x220}, &(0x7f0000010080), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_BUFFERS(r11, 0x0, &(0x7f0000000140)=[{0x0}, {0x0}], 0x2) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000a40)={{r7}, &(0x7f0000000980), &(0x7f0000000a00)='%pS \x00'}, 0x20) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r11, 0x10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340), 0xa002a0}], &(0x7f00000005c0), 0x2}, 0x20) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0xfd, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x4008084) 1.927462534s ago: executing program 1 (id=6243): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ec0)=ANY=[@ANYBLOB="18000000000080000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000a3850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='kmem_cache_free\x00', r0}, 0x18) io_setup(0x3, &(0x7f0000000080)=0x0) io_destroy(r1) r2 = syz_pidfd_open(0x0, 0x0) setns(r2, 0x24020000) 1.844900702s ago: executing program 6 (id=6246): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000ac0)=ANY=[], 0x64}}, 0x0) 1.823947334s ago: executing program 1 (id=6247): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_NAME(0xf, &(0x7f0000000980)='\xff\x00\x00\x00\x00\x00\x000`\x14\x99\x06\xc0\x7fs\x00\t\x14\x17\xc3\xf5\xc9\v\x85\xe7\x00\x00\x18\x88\x06\x94\x98\xa9\xe7\x1c\x8a\x89\xdc\xcc\xf7L\xbd%\xc3!\x0e\x91S\xb2~8\"\xe2\xed\xbf\x12\x1a\\6p\'p\xef\x1a\n\x99\x12\xe8\'\x1c\x97M\xa5N\xd9\xbeV&\x1c2K?\x95\xd9\"\xbe\x050+\xca\xea\'\xe9)\xfe\xeb\x9c\xb5\xa0F`\xe4D\x10F\x831\xec\\v\xf0\xab_M\b\x03\xc3\n\x89\x01E`\xd35Q2\xecZz\xdc\x065p\x1c\x8f\x9b\x99IGXO\x00\x00\v\xed\xb0\xc5\xd4\xc7,\x1a\xb3}CMOO\x8a\xa8kh\x7f\x05c\xfc\xebb\xc8\xa2\xa9\xbf\xb3\x9b\xafE\xbd\xc5\xdc\xde\xbe_') bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007d000000180100002020732600000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r2, @ANYBLOB], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x2000, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x4}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x78, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x78}}, 0x0) 1.823453194s ago: executing program 3 (id=6248): bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000bc0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x7fff}, 0x18) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'ip6gre0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000001240)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x4000000, {0x0, 0x0, 0x0, r2, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x7}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x572c6de, 0x0, 0x9fc, 0x0, 0xfffffc80, 0x8000, 0x6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x20, 0x0, 0xfffffffa, 0xa, 0x0, 0x0, 0x5, 0x0, 0x1, 0x0, 0x0, 0x10001, 0x0, 0x2, 0x3f, 0x7, 0x0, 0x2, 0xffffffff, 0x2, 0x810, 0x20000000, 0x0, 0x0, 0x1ff, 0x6, 0x0, 0xe2f, 0x0, 0x1000, 0xfffffffc, 0x0, 0x0, 0x0, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4000005, 0xbab, 0xffffffff, 0x272, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x2, 0x0, 0xfffffffe, 0x401, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x40003, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffc, 0x0, 0xfffffffb, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x20000, 0x3, 0x60, 0xfffffffc, 0x8, 0x0, 0x0, 0x400000, 0x5, 0x4, 0xc, 0x0, 0x0, 0x0, 0x0, 0x4ff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x3, 0x1, 0x2, 0x9, 0x0, 0x0, 0x0, 0xb, 0x3, 0x0, 0x0, 0x0, 0xa847, 0x2, 0x0, 0x4b7, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0xfffffffe, 0xc, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x3, 0x7, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0xb3c, 0x0, 0xfffffff6, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x7db, 0x0, 0x800000, 0x0, 0x0, 0xfffffffe, 0xfffffffd, 0x4, 0x0, 0x0, 0x0, 0x4, 0xfffffffc, 0x0, 0x82, 0x4, 0x0, 0x414d, 0x10000000, 0x0, 0x0, 0x5, 0x4, 0x1, 0x0, 0x0, 0x1, 0x2, 0x0, 0x1, 0x0, 0x400, 0x0, 0x0, 0x4000d79, 0x0, 0x0, 0x0, 0x4, 0x2, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x2, 0x0, 0x1, 0x0, 0x100, 0x0, 0x8, 0xfffffefd, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffffffd, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffd]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0x0, 0x0, 0x4, 0x6}, {0xff}, 0x0, 0x7f}}]}}]}, 0x45c}, 0x1, 0x0, 0x0, 0x240040c4}, 0x0) 1.820863594s ago: executing program 6 (id=6249): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='pids.max\x00', 0x2, 0x0) symlinkat(&(0x7f0000003040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x7, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) lstat(&(0x7f0000001800)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) write$cgroup_subtree(r1, &(0x7f00000002c0)=ANY=[@ANYRESDEC], 0x8) bind$netlink(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r2}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x18, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], 0x0, 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x20081e, &(0x7f0000000840)={[{@grpjquota}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0xa30}}, {@grpquota}]}, 0x1, 0x52a, &(0x7f0000001440)="$eJzs3c9vHFcdAPDvjL22k7h1WnoABG1oCwFFWcebNqp6gHJCCFVC9AhSauyNFWXXa3nXpTaRcM9ckajECY78AZx74s4FwY1LOSDxwwLVSBwGzezY2di7tpPYXmv385FG+9688XzfizPvzbxd7wtgbF2LiO2ImIqI9yNirtyflFu8093y4z7bebi0u/NwKYkse++fSVGe74uen8ldKc85ExE/+E7Ej5PDcdubWw8WG436epmf7zTX5tubWzfvNxdX6iv11VrtzsKdW2/dfrP2BK2ZObL0leZUmfryp3/Y/sZP82rNlnt623Gauk2v7MfJTUbE984i2BBMlO2ZGnZFeCppRLwYEa8W1/9cTBS/TQBglGXZXGRzvXkAYNSlxRxYklbLuYDZSNNqtTuH91JcThutdufGvdbG6nJ3ruxqVNJ79xv1W+Vc4dWoJHl+oUg/ytcO5G9HxAsR8YvpS0W+utRqLA/zxgcAxtiVA+P/f6a74z8AMOKO/tgMADCKjP8AMH6M/wAwfoz/ADB+uuP/pSf9sSzLfnYW1QEAzoHnfwAYP8Z/ABgr33/33XzLdsvvv17+YHPjQeuDm8v19oNqc2OputRaX6uutForxXf2NI87X6PVWlt4IzY+vPrNtXZnvr25dbfZ2ljt3C2+1/tuvVIctX0OLQMABnnhlU/+nOQj8tuXii161nKoDLVmwFlLh10BYGgmhl0BYGi6q331WaAPGHmPnvGf+EMApgdgRBx3BzDT7w+EsizLzq5KwBm7/gXz/zCuyvn/SZ8ChvFz3Px/sTawNwlhJE0OuwLA0GRZctI1/+OkBwIAF9sRc/xXz/M+BBieAe//v1i+/rZ8c+BHyweP+PgsawUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX2976v9Vymd/ZSNNqNeK5YgGgSnLvfqN+KyKej4g/TVem8/zCkOsMADyr9G9Juf7X9bnXZx8revnKfnIqIn7yq/d++eFip7P+x4ip5F/Te/s7H5f7a8cGmzmLFgAAR9sbp4vXngf5z3YeLu1t51mfv3+7e1eQx93dmYrd/fiTMVm8zkQlIi7/OynzXUnP3MWz2P4oIj7fr/1JzBZzIN1bloPx89jPnVL8iRPFTx+Ln5YLNKflv8XnTqEuMG4+yfufd/pdf2lcK177X/8zRQ/17Mr+Lz/V0m7RBz6Kv9f/TQzo/66dNMYbv/9uN3XpcNlHEV+cjNiLvdvT/+zFTwbEf/2E8f/ypZdfHVSW/TrievSP3xtrvtNcm29vbt2831xcqa/UV2u1Owt3br11+83afDFHPT94NPjH2zeeH1SWt//ygPgzx7T/q4NOeuAp9zf/e/+HXzki/tdf6xc/jZeOiJ+PiV8b2OLHLV7+3cDn7jz+8uH2Jyf5/d84YfxP/7p1aNlwAGB42ptbDxYbjfq6hMTFT+T/ZS9ANfomvnVesaaif9HPX+te0weKsuypYg3qMU5j1g24CPYv+oj477ArAwAAAAAAAAAAAAAA9HUef7E07DYCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwuv4fAAD//9VG0+g=") r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1202, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x3ffff) get_mempolicy(&(0x7f0000000100), 0x0, 0x2000000000007, &(0x7f0000ffc000/0x3000)=nil, 0x0) move_pages(0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0) 1.787849328s ago: executing program 3 (id=6250): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="0600000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r1}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00'}, 0x18) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x18, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000ac0000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000004000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x62, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r5}, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0x1, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x8080) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r12 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r13, r12, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r13}, &(0x7f0000000000), &(0x7f0000000080)=r9}, 0x20) recvmsg$unix(r10, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0xb3}], 0x1}, 0x0) sendmsg$inet(r11, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000280)='>', 0x1}], 0x1}, 0x0) 1.609998926s ago: executing program 6 (id=6251): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000080)={0x2, &(0x7f00000000c0)=[{0x48, 0x8, 0xfe, 0xff7ffeff}, {0x6, 0xa, 0xfe, 0x8001}]}) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000180)="1a06848abe2704548ab878a293b32a0e0000000000000ab16b757e8811716bdef1a91bd5f485a7ffa232c4f5fca2c7", 0x2f}, {&(0x7f0000000340)="11e256dcf6f85d2e27c8c635fb37377aa336aa8f7e790a6a9d57accf04c2f91d3fe742d1de46d06d5c82d4ff28b39242f43770376d81e513d02670dedcdb1e177d0071a7a2e10312af375e26185db40b901b34aaade3aa38dfbe60b2f9d1e4177103cd08d1f42de94f18fea5a1cfa48bd0e80cd5a594719250416a2b6c", 0x7d}, {&(0x7f0000000040)="51e216b524fba92e0b3bb9cb9f764879555ab853c6981e5d376d46ad2d2be813b52bc43e5ff840a6d8", 0x29}, {&(0x7f00000004c0)="04227b53b2acecdee16aceb155f070909ba3e84227c93e2e536371e1a63fa34a97b92e03e1e1355fb92d67e23c51f4638a7e627ab1efaf6420e4ed63f1ee28388a898042185a9b0bdce47d17f1853860889ef5fe1c6b8adc953ab13336fb9df3f76817f3ce034a41d2ac8a8a08533a2c109febde8b66e6ebbccbb808de68c01907dc945aad2e608138422e38906e45d0a0419357d518e59299f1abb9d9771ce7586527e3ee6012f509f3afc991fbd2b71e91710af1e678ab8ec63561228694b664ebe6a3f6557aa10740205948c51af598525e9f4f97b047e48903a067d2c2b934b21d65d807964a2da526fd944dd8c2095d84", 0xf3}], 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1, 0xffffffff}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000003200)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r4}, &(0x7f0000000340), &(0x7f0000000380)=r5}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r5, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r6}, 0x18) syz_open_dev$tty20(0xc, 0x4, 0x1) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x510, 0x3a8, 0x210, 0x210, 0x0, 0x138, 0x478, 0x478, 0x478, 0x478, 0x478, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x11000000, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x570) 1.579294079s ago: executing program 1 (id=6252): prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r0}, 0x18) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f00000000c0)={0x200c}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0x58, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = open(0x0, 0x10900, 0x142) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x7, 0x8604, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_config_ext={0x8, 0x6}, 0x0, 0x10000, 0x0, 0x6, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$inet(0x2, 0x3, 0x8) sendmmsg$inet(r2, &(0x7f0000001a80)=[{{&(0x7f0000000280)={0x2, 0x4e24, @empty}, 0x10, &(0x7f0000000880)=[{&(0x7f0000000480)="bbc94fe2d5639ad25dfc32d9fa0949a5c1a757491598bb3828b619c481ca0624749b128d61f6202e44f4ad257f093f97fc5667c9fb48477c3eca0be718b2b793c7e16a5c8e33e0533ae2cc537ea1f2003c1e87e76f", 0x55}, {&(0x7f0000000500)="c78e5f3164581859fd60bce5b8a115cf56e4e82c6557a9e3a38fa2b3cce7c133ba36ea5390fd3334ee6c6c341077e20ddd6c163d1cf27cbeeb0410ae7e12f3d7ae45fb28b40dd91f3bbf", 0x4a}, {&(0x7f0000000580)="4feaa5d8c9a805ab6248502f9b885a46466ff024d5f1293a0269bf93f9ceb574853282f39005ac46d1db8dee0bc7cc47b846f211d0b9bd3c87b7d7b0f9d45e36213448aafdd473c689a3518e1357f62cfb78329a8bac82226a1166b641b9fc5202df539b6a59c4eb80bc848ca9b3da063d549903", 0x74}, {&(0x7f0000000680)="b6f430cca58d506ef95f95c5184913bfe615ee5a63f1e2138d65fd242f50b8f2f8d46b655c27b505a6b6d9541f360fa63a683a0d510d2b2e4ddafe6e3a027632ecb86ed84caa90b4101e737f5f2b8ef8c3dbd1e36b96951fb58d6ae76a68861ff3a4a1cbfc47ff4f41f0dcb31579652d8a6e710b0858d9ce218c3a4bfb86feacfcf7e51cb610bc124c268c19972df09a007c6b3fe82949aa6d4da4044b29b82999ef0ad6e4122c3d054e255a37de1e6b5cba394046d7db41965944659c18cb9a4fa4f15e08b5cc83fa104b4d013b2890ed1f21ecd681f45ebe78cc92a31bdcaf3761cca5e9", 0xe5}, {&(0x7f0000000780)="33dc26987d572be0a73d7716356706fe2b25b032e746147b76f83c0ccdd79835192b1394164c97ce49bf9ee9a4872e767880875f32e2871dc4b765505767c412cfe5ae57a65fb07e732193175303167f1193c74e7e0addf5b3fdbef6d7a0f00192e7ac5b6a6ddb713b355d3080a4f4a64ccb569b3578f010c2c9ff457f7e23f615d5bcafdb188e0528323b9d216311fb98886c1a7d20607de0420238ed72b4680102df742ec8d97d4eeef8223a3ef72b7cc97153a7f65e55f218d669a0a50f014c821cfbe934551e8143d3ae6587c5f925c782df902231af698fef28acb30cebb8796721d2b255e88dcb62", 0xeb}], 0x5, &(0x7f0000000b00)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x52cc}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x6}}, @ip_retopts={{0xa4, 0x0, 0x7, {[@rr={0x7, 0x13, 0xc9, [@multicast2, @loopback, @multicast2, @rand_addr=0x64010101]}, @timestamp_addr={0x44, 0x3c, 0x61, 0x1, 0x2, [{@remote, 0x43ad}, {@broadcast, 0x9}, {@rand_addr=0x64010100, 0x5}, {@dev={0xac, 0x14, 0x14, 0x12}, 0xffff0000}, {@loopback, 0x6}, {@multicast1, 0x8}, {@dev={0xac, 0x14, 0x14, 0x2e}, 0xfff}]}, @timestamp_addr={0x44, 0x1c, 0xd2, 0x1, 0x8, [{@broadcast, 0x2}, {@rand_addr=0x64010101, 0x8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}]}, @timestamp_addr={0x44, 0x1c, 0x89, 0x1, 0x7, [{@broadcast, 0x15d5}, {@local}, {@multicast1, 0x2}]}, @timestamp={0x44, 0xc, 0x5, 0x0, 0x9, [0x101, 0xfffff801]}]}}}, @ip_retopts={{0x80, 0x0, 0x7, {[@generic={0x88, 0xa, "e9017a9858f64fbc"}, @timestamp_prespec={0x44, 0x24, 0xca, 0x3, 0x7, [{@private=0xa010101, 0x92}, {@private=0xa010100}, {@multicast1, 0x6f3a}, {@rand_addr=0x64010101, 0x80000000}]}, @cipso={0x86, 0x3f, 0x2, [{0x5, 0x11, "6d4e39b58caf730ef218c99a90cd34"}, {0x2, 0x5, "619cbd"}, {0x6, 0xb, "cda9cd5345c1b27c4f"}, {0x5, 0x3, "98"}, {0x0, 0x9, "a68aeb468b6f8d"}, {0x5, 0xc, "8b017ccafb7561960a6a"}]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x25}}], 0x188}}, {{&(0x7f0000000600)={0x2, 0x4e23, @rand_addr=0x7a99}, 0x10, &(0x7f0000000e40)=[{&(0x7f0000000900)="36fb93ed47e8c0713fd3a08b7e496f46b1ec30087c", 0x15}, {&(0x7f0000000940)="d99a4b66449ff1757c7bfec0303206606e8f551cf8b9b87430ff2012886935ee822f5866f22b824ead40d794", 0x2c}, {&(0x7f0000000cc0)="4ba778e176af7586d9897d2f73a6cb95f5d702d24d969c2233f7fd4acabb1ed266d44a7e358e265a3c436c0f44fdf6efd7fd2c3be996f61176140e611c13a7432eaf8cd732401cc56afebd31d3974de340854efa099bb96ec1c80b626e4e649676cc339a7f4e042174179a0c6dabc1ced9908a35d5e6ba9c27a09747dd94e5c617aef33f78e16806e6509ce853381f7150de3838c09ec9a6b90d65987f652b27ec83a9ae544cf42c82fc032fb605f89c43d86c31dc793366f8f7ea19efb0b26f2d581b6ba0d707dbe37ba3fe96aa17fbae7722640e70c781466c6211933fde52d388ec9436", 0xe5}, {&(0x7f0000000980)="784e10129585089bbe11e06ce16e8581525b4b4f7358a10b3731829f72dd972648846a081b60ee4aed9497c1b2f5e563a9094c797272dc905a848d6b5ab006f06bf61a0b19c020f5d950d6c5178e8576175a1d0707c583771d4ff0f19e926855635586f67b0932d2f39ed293565ac4b429c308c358598bd864f6d7fc62d7b0302838e461f97cbc131a7222319ea8dadefe9434eb5051970781ae584e78907441de26df47d5be78ff6507", 0xaa}, {&(0x7f0000000dc0)="d96ec9fcd9c788552410f6162d4377a60ed77f336980738a972ec6b8bab88944f45b29b5925e9fec686504c8d1098fff854686acbaa9666912e973034fab97049dea0277357ff8a420965d861d0564275fdc2e7ed4f7648d5e3a53b36a93", 0x5e}], 0x5, &(0x7f0000000ec0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x40000000}}], 0x18}}, {{&(0x7f0000000f00)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000001080)=[{&(0x7f0000000f40)}, {&(0x7f0000000f80)="7afa2ead5d4417574f03216089c134233ffc652c15953a55f532950869f4cff4b0f9a27b6ce6f4db3c4bc7806468a6f3bdd146f9a6167a2f9070fa72fa4da757e4c914b703a42c1b18d3ee7d7a6b804942cce09e3da6f37b6a24ef81af66c92492fffae3272583af1c184f23e865f158bfc50216226aa479e846416e04aee942e56fa2eb56ec88fb5a7d02a6aef1df1ae27b9ed9c8b90b9b1fa207507b64274c12607d99473fcbefc2ef2ea592ec5438d74915cf404f9fcc4bae363e955306de76b9226e27430187fa4fd80021f68e23786ca3d152131dd231c392e63c", 0xdd}, {&(0x7f0000001440)="03f106963be46c77c9b88526d75d19e7a32aae99e82d5072c3f6cea437823b6719fade95fee504ef0d2ad7bb135a8cc2b481d512280042ad0266fed0d7ab254393067dab9878a6cd95d48569915689065a89a41bca7df98a6144e7869244d5876142529955f166ee88317b31a47ced19347bef5d3b6eac487c071ddc12112c323f282f89a88a2065ed46b449053dd223d599f065da42319c703c0e2873be2a08e7443c19713f72ab3e6cbe5ebef5a087d44ec50540dde203058d4ff54581853674a72fc89cd0", 0xc6}], 0x3}}, {{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000001540)="52608a23c390a6d22ca0c56b7f024818b51df3e0b2281464753bef1de3b5b8eceda27f6febfa0095078bd746734e3e080898edfde7369faa1a9c72f642baa8137f36fdd5da7039", 0x47}, {&(0x7f00000015c0)="f70ef87f3ee190e65edcfe54632b47cc3cda28fb967640123aec60818a4fa84b6d02f69dda0abff2905f9f844c47a7f9e7ce98c484eedd0f4da36f35fc8090dc332bcf2839d325acbf877075ce3c863af7bcc2a3fd901d", 0x57}], 0x2, &(0x7f0000001680)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x3}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_retopts={{0x74, 0x0, 0x7, {[@generic={0x88, 0x9, "fb4b9d67a69d47"}, @end, @generic={0x88, 0x11, "1698834f1e3dd531831d77145c4cce"}, @cipso={0x86, 0x36, 0xffffffffffffffff, [{0x6, 0x11, "e230eb6f021c39deb8ac654c8450e9"}, {0x7, 0xd, "f40aca61c6cac80255456d"}, {0x0, 0x2}, {0x0, 0x10, "8a1da6b8cc55dcbdddbaa2ebae09"}]}, @noop, @generic={0x82, 0x12, "23365e51ba67d62f88ee12d651ed1e02"}]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @broadcast}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @broadcast, @loopback}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xf}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x1000}}], 0x118}}, {{&(0x7f00000017c0)={0x2, 0x4e20, @private=0xa010102}, 0x10, &(0x7f0000001840)=[{&(0x7f0000001800)="46bddbf6bed199e26bfd0270d660657a2baa607f014345a3123ea90671e0ed08a6ecb1f6ff96ed0c50ea36095efb8cf9", 0x30}], 0x1, &(0x7f0000001880)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x7}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x4}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast2, @loopback}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_retopts={{0x130, 0x0, 0x7, {[@timestamp_addr={0x44, 0x54, 0xbc, 0x1, 0x9, [{@loopback, 0x4}, {@multicast2, 0x7}, {@multicast1, 0x8001}, {@local, 0x8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}, {@broadcast, 0x8}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@remote, 0x3}, {@multicast1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}]}, @timestamp_prespec={0x44, 0x34, 0x63, 0x3, 0x3, [{@multicast2, 0xfffffffa}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}, {@local, 0xc0c}, {@loopback, 0x38a}, {@rand_addr=0x64010101, 0x8}, {@private=0xa010101, 0x3}]}, @cipso={0x86, 0x4c, 0x2, [{0x2, 0x3, '='}, {0x1, 0x5, "981de5"}, {0x6, 0x11, "4147b01b08d322dbf74aad8fa21f35"}, {0x2, 0xc, "c73923551723552909fd"}, {0x5, 0x9, "e73d2be1ea1ce1"}, {0x6, 0xd, "9b9d8cf76481283bd89208"}, {0x7, 0xb, "95e6d946628771a43e"}]}, @timestamp_prespec={0x44, 0x34, 0xdf, 0x3, 0xd, [{@initdev={0xac, 0x1e, 0x1, 0x0}}, {@rand_addr=0x64010100, 0x3}, {@empty, 0xb}, {@multicast2, 0xe}, {@multicast1, 0x9}, {@empty, 0x739f5936}]}, @timestamp_addr={0x44, 0x14, 0xcb, 0x1, 0xe, [{@local, 0xfffff801}, {@loopback, 0xa5e}]}, @ra={0x94, 0x4, 0x1}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5}}], 0x1c8}}], 0x5, 0x40000) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000010c0)=@raw={'raw\x00', 0x8, 0x3, 0x310, 0x0, 0xe138, 0x198, 0x1c0, 0x198, 0x278, 0x358, 0x358, 0x278, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, '\x00', 'veth0_to_bond\x00', {}, {}, 0x21}, 0x0, 0x158, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "0d0004000000000000000004fff0cf81dfd28c89544e14cd3e01dd24289831867846c88621039b284c3ff45c42995560a99952bed40cf5a8c1df6cdbdb7e2378d5afd35f4c16827f55b3af494e39e8fb330200000000000032b6a99a8d87298e88a94cb519f5c17631af916a0002000000000000000000000000000000000049", 0xc}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0xfffffffd, 0x0, 'snmp_trap\x00', 'syz0\x00', {0xfffffffffffffffc}}}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0xfffd, 0x0, 0x0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x370) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000100)={r5, 0x20, &(0x7f0000000640)={0x0, 0x56, 0x0, &(0x7f0000000380)=""/249, 0xee}}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 1.453953222s ago: executing program 2 (id=6253): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_SET_TIME(r0, 0x4024700a, 0x0) 1.201212878s ago: executing program 2 (id=6254): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x80, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x8001, 0x3151, 0x401, 0x6, 0xaa3c}, 0x3, 0x1, 0x6, 0x6, 0x7, 0x13, 0x11, 0xf, 0x7, 0x7f, {0x6, 0x407c, 0x7, 0x5, 0x2b52, 0x2}}}}, @TCA_RATE={0x6, 0x5, {0x0, 0x5}}]}, 0x80}, 0x1, 0x0, 0x0, 0x400dc}, 0x20000000) 1.17618543s ago: executing program 3 (id=6255): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000180)={0xfffffffd, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000100)={0x0, 0x0, {0x1, 0x0, 0x0, 0x0, 0x80000}, 0x100}) 858.492453ms ago: executing program 2 (id=6256): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ec0)=ANY=[@ANYBLOB="18000000000080000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000a3850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='kmem_cache_free\x00', r0}, 0x18) io_setup(0x3, &(0x7f0000000080)) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) 833.904075ms ago: executing program 3 (id=6257): bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00'}, 0x18) gettid() openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x2082) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x18, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYBLOB], &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r0, 0x0, 0x4}, 0x18) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000040)="24000000180003041dfffd946f610500020100000005fe060c10880008000f00fff3c00e", 0x24}], 0x1}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000001040)={'lo\x00', {0x2, 0x4e1e, @broadcast}}) r3 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="540000002000010000000000000000000200200003000000000000001400110076657468305f6d616376746170000000080002"], 0x54}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000040000000100000000000000000a20000000000a05000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021940000000c0a01030000000000000000070000000900020073797a31000000000900010073797a3000000000680003806400dec6080003400000000258000b80200001800a00010071756f7461000000100002800c0001400000000000000000340001800a0001006c696d69740000002400028008000440000000010c00024000000000000000000c00014000000000000000"], 0x118}}, 0x0) 726.897236ms ago: executing program 2 (id=6258): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000ac0)=ANY=[], 0x64}}, 0x0) 662.204252ms ago: executing program 2 (id=6259): mount$cgroup(0x0, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', &(0x7f00000005c0), 0x0, &(0x7f0000000400)={[{@none}]}) setxattr(&(0x7f0000000040)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="73797327e8f75dad8b6f42"], &(0x7f00000000c0)='devlink\x00', 0x8, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x15, 0xe, &(0x7f0000003540)=ANY=[@ANYBLOB="b700000050000008bca30000000000002403000040feffff7b1af0ff0000000079a4f0ff000000001f030000000000002e030200000000002604fdffffff000e61141800000000001d430000000000007a0a00fe0000001f61141400000000004603f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566de74e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48b936e6f9e0fcda88fe4413537528fd79153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b602396df7e0c1e02b88c114f2440000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54dd84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f0e6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c9494963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637d4219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf699b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a4a274000000000000000000000000000000000000000000000009dd14b38f2f5426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd030000006d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10b0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c88629a6c921c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fc3167a257e040fa7cf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0c69c2c03f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fbf05b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac98708007c80d6c7d0de4614195e40d797c0348dd70f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fc52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97a4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71ca3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812dc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a296c22fdcea26498d26229110b1aade386b113045033a6188d56e675564d8cb8d5b40114b0f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795835f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb7ed9d12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b88ae780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca780049d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e2848890522c2288072467d2afe269f589fb7e034b92d3ca245b16b71998711bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb16e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b2676c07bb0fd14020a66718378825d5ed789711b77d40dc31e0b8fc651b45559da463f0000000000000000000000000052d42124e9c26aba885015e69d42ecd710342ac597ebea576ae15fdf611356f622e831741ab15549e0d7a2bd0324e2b3b48a10551607492c19eaf58485feb4cab19c303b30ba2ddea0d792d77724c9fa4ed58b93668fc20484f141ee2b6a0029e88fdc853189b4dafd36ff23b11967090e508f45e3f10857038a52ef275cf9e3e4b5d30b12d138dfa70930c603b5e3f4b7be67be3dba3cbd8d4d143195af0697d779445d67dcfbd922d12a8b49f93eac7a72faacf80346b3b60f132a2bf8a858392f34072d99aee0ec70aa6d75096e608d97ac4b7bfa2e0ae3e59718e7a7691a98b1334e34553300000000000000000000000000000000062c7cf52e9624806a4833e1c0059e5a703ab9c2e9b38779270dc5e80af75d509b1a31fe6ed3f8c0172659256dc88de4e377c8a07e95ec5549ae47dc43b93a159a201be254048b9e0857ea3c736c761e686f9b3d0690f035617a12055b2cb3a03794d67b95e7f4fc6af323120c09d0503c8ce92e869e22bb2590299ad76d541f844d32f96184f74d433793bbd75ec15fb1497ce835445212421cb4e3ce08395c9055a2"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xffffffffffffffc2}, 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000004b0000000e0001"], 0x3c}}, 0x0) 658.308833ms ago: executing program 1 (id=6260): r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b0800000000000000030000008000000000126631d95cb93f69392088ccfef0dd1d610c58120e3d1d030051805abb9f6faf3ab47caf97"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x7, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000016000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000095", @ANYRESOCT=r0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x18) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000000) getpid() r4 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000640)={&(0x7f0000000000)={0x2a, 0x0, @broadcast}, 0x10, 0x0}, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) r7 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, &(0x7f0000001440)={0x0, 0x0}) sched_setaffinity(r8, 0x8, &(0x7f00000014c0)=0x80000000) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r6, 0x89f4, &(0x7f0000000280)={'sit0\x00', &(0x7f0000000380)={@empty}}) connect$inet6(r7, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x4, &(0x7f0000000040)=ANY=[@ANYRESHEX, @ANYRES8=r3], &(0x7f0000001b80)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r9}, 0x10) r10 = socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x19, 0xc, &(0x7f0000000240)=ANY=[@ANYRES8, @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000300000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000001100)={0x0, @in6={{0xa, 0x2, 0x47, @mcast1, 0x6}}, 0x7, 0x9dc, 0x7, 0x75ebaa0c, 0x9, 0x9, 0xb8}, &(0x7f00000011c0)=0x9c) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r7, 0x84, 0x75, &(0x7f00000012c0)={0x0, 0x6}, &(0x7f0000001300)=0x8) getsockopt$inet_sctp6_SCTP_STATUS(r6, 0x84, 0xe, &(0x7f0000001340)={r11, 0x8000000, 0x3, 0x3ff, 0xd5b, 0x8, 0x0, 0x2, {r12, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x41}}}, 0x4, 0x0, 0x3, 0x4, 0xffff}}, &(0x7f0000001400)=0xb0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$packet_tx_ring(r10, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x808000, 0x4, 0x20300, 0xfc}, 0x1c) 94.61204ms ago: executing program 6 (id=6261): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_NAME(0xf, &(0x7f0000000980)='\xff\x00\x00\x00\x00\x00\x000`\x14\x99\x06\xc0\x7fs\x00\t\x14\x17\xc3\xf5\xc9\v\x85\xe7\x00\x00\x18\x88\x06\x94\x98\xa9\xe7\x1c\x8a\x89\xdc\xcc\xf7L\xbd%\xc3!\x0e\x91S\xb2~8\"\xe2\xed\xbf\x12\x1a\\6p\'p\xef\x1a\n\x99\x12\xe8\'\x1c\x97M\xa5N\xd9\xbeV&\x1c2K?\x95\xd9\"\xbe\x050+\xca\xea\'\xe9)\xfe\xeb\x9c\xb5\xa0F`\xe4D\x10F\x831\xec\\v\xf0\xab_M\b\x03\xc3\n\x89\x01E`\xd35Q2\xecZz\xdc\x065p\x1c\x8f\x9b\x99IGXO\x00\x00\v\xed\xb0\xc5\xd4\xc7,\x1a\xb3}CMOO\x8a\xa8kh\x7f\x05c\xfc\xebb\xc8\xa2\xa9\xbf\xb3\x9b\xafE\xbd\xc5\xdc\xde\xbe_') bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007d000000180100002020732600000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r2, @ANYBLOB], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x2000, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x4}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x78, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x24, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x78}}, 0x0) 48.757625ms ago: executing program 6 (id=6262): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x3, 0x0, 0x0, 0x40e00, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0, 0x0, 0xfffffffffffffffd}, 0x18) r1 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000280)='kfree\x00', r4}, 0x18) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$selinux_validatetrans(r1, &(0x7f0000001cc0)=ANY=[@ANYBLOB='system_u:object_r:semanage_t system_u:object_r:fixed_disk_device_t:s0 00000000000w'], 0x79) r5 = syz_open_dev$hidraw(&(0x7f00000000c0), 0xc, 0x1) read$hidraw(r5, &(0x7f0000000100)=""/43, 0x2b) 44.976475ms ago: executing program 3 (id=6263): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000e00000850000001b000000b700000000fa000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f00000002c0)='kmem_cache_free\x00', r1}, 0x18) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x34, 0x10, 0x503, 0x70bd2d, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0xc0b0) 21.790368ms ago: executing program 6 (id=6264): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000080000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000a3850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, 0x0, 0x310) 0s ago: executing program 3 (id=6265): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="02000000040000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f00000003c0)={[{@max_batch_time={'max_batch_time', 0x3d, 0x7}}, {@journal_dev={'journal_dev', 0x3d, 0x1}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@user_xattr}, {@errors_remount}, {@nouid32}]}, 0x1, 0x441, &(0x7f00000011c0)="$eJzs28tvG8UfAPDv2kn66zP5VeXRBxAoiIpH0qSl9MAFBBIHkJDgUI4hSatQt0FNkGgVQUCoHFEl7ogjEv8AnOCCgBMSV7ijShXKpYWT0dq7ie3aaZI62RR/PtK2M7tjzXw9O/bMThxAzxpO/0ki9kTE7xExWM82Fxiu/3draWHy76WFySSq1Tf/Smrlbi4tTOZF89ftzjN9EaVPkzjcpt65y1fOT1Qq05ey/Oj8hfdG5y5feXbmwsS56XPTF8dPnz55Yuz5U+PPdSXONK6bhz6cPXLw1bevvT555to7P3+T5PG3xNElw6tdfKJa7XJ1xdrbkE76CmwI61KuD9Por43/wSjHSucNxiufFNo4YFNVq9Xq/Z0vL1aB/7Akim4BUIz8iz5d/+bHFk09toUbL9YXQGnct7KjfqUvSlmZ/pb1bTcNR8SZxX++TI/YnOcQAABNvk/nP8+0m/+VovG50L5sD2UoIv4fEfsj4lREHIiI+yJqZR+IiAfXWX/rJsnt85/S9Q0Ftkbp/O+FbG+ref6Xz/5iqJzl9tbi70/OzlSmj2fvybHo35Hmx1ap44eXf/u807XG+V96pPXnc8GsHdf7djS/ZmpifuJuYm504+OIQ33t4k+WdwKSiDgYEYc2WMfMU18f6XTtzvGvogv7TNWvIp6s9/9itMSfS1bfnxz9X1Smj4/md8Xtfvn16hud6r+r+Lsg7f9dbe//5fiHksb92rn113H1j8/ar2n2bfz+H0jeajr3wcT8/KWxiIHktXqjG8+Pt5QbXymfxn/saPvxvz9W3onDEZHexA9FxMMR8UjWd49GxGMRcXSV+H966fF3O13bDv0/ta7+X0kMROuZ9ony+R+/a6p0aD3xp/1/spY6lp1Zy+ffWtq1sbsZAAAA7j2liNgTSWlkOV0qjYzU/4b/QOwqVWbn5p8+O/v+xan6bwSGor+UP+kabHgeOpYt6/P8eEv+RPbc+Ivyzlp+ZHK2MlV08NDjdncY/6k/y0W3Dth0fq8Fvcv4h95l/EPvMv6hd7UZ/zuLaAew9dp9/39UQDuArdcy/m37QQ+x/ofe1Tj+kwLbAWw93//Qk+Z2xp1/JN8DiYHt0Yx7KBGltRf+Nrvbim6zxNoTBX8wAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMm/AQAA//8iOuPQ") kernel console output (not intermixed with test programs): p=0x7fa2fce2f749 code=0x7ffc0000 [ 321.733095][T20797] veth1_macvtap: entered promiscuous mode [ 321.766271][T20797] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 321.780021][T20797] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 321.798061][T21020] bond1 (unregistering): Released all slaves [ 321.822156][T10234] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 321.844240][T10234] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 321.933131][T10234] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.067188][T10234] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.233813][T21029] process '/newroot/495/file0' started with executable stack [ 322.263841][T21041] loop1: detected capacity change from 0 to 1024 [ 322.293352][T21041] EXT4-fs: Ignoring removed bh option [ 322.303479][T21041] EXT4-fs: inline encryption not supported [ 322.350631][T21041] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 322.431439][T21052] loop2: detected capacity change from 0 to 512 [ 322.461882][T21052] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 322.476895][T21041] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 322.500629][T21055] macsec0: entered allmulticast mode [ 322.505968][T21055] macvlan0: entered allmulticast mode [ 322.511415][T21055] veth1_vlan: entered allmulticast mode [ 322.521984][T21041] EXT4-fs error (device loop1): ext4_map_blocks:783: inode #3: block 2: comm syz.1.5550: lblock 2 mapped to illegal pblock 2 (length 1) [ 322.551493][T21052] ext4 filesystem being mounted at /497/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 322.570332][T21055] macvlan0: left allmulticast mode [ 322.575487][T21055] veth1_vlan: left allmulticast mode [ 322.586612][T21041] EXT4-fs error (device loop1): ext4_map_blocks:783: inode #3: block 48: comm syz.1.5550: lblock 0 mapped to illegal pblock 48 (length 1) [ 322.649506][T21041] EXT4-fs error (device loop1): ext4_acquire_dquot:6986: comm syz.1.5550: Failed to acquire dquot type 0 [ 322.711298][T21041] EXT4-fs error (device loop1) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 322.740807][T21063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5558'. [ 322.753819][T21041] EXT4-fs error (device loop1): ext4_evict_inode:253: inode #11: comm syz.1.5550: mark_inode_dirty error [ 322.766251][T21041] EXT4-fs warning (device loop1): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 322.777014][T21041] EXT4-fs (loop1): 1 orphan inode deleted [ 322.783386][T10218] EXT4-fs error (device loop1): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:36: lblock 1 mapped to illegal pblock 1 (length 1) [ 322.806996][T10218] EXT4-fs error (device loop1): ext4_release_dquot:7022: comm kworker/u8:36: Failed to release dquot type 0 [ 322.824828][T21041] EXT4-fs error (device loop1): __ext4_get_inode_loc:4830: comm syz.1.5550: Invalid inode table block 1 in block_group 0 [ 322.838836][T21041] EXT4-fs error (device loop1) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 322.843379][T21067] loop3: detected capacity change from 0 to 1024 [ 322.860504][T21041] EXT4-fs error (device loop1): ext4_quota_off:7270: inode #3: comm syz.1.5550: mark_inode_dirty error [ 322.873482][T21067] EXT4-fs: Ignoring removed bh option [ 322.886894][T21067] EXT4-fs: inline encryption not supported [ 322.895957][T21067] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 322.940331][T21067] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 322.958525][T21067] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 2: comm syz.3.5560: lblock 2 mapped to illegal pblock 2 (length 1) [ 322.975739][T21067] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 48: comm syz.3.5560: lblock 0 mapped to illegal pblock 48 (length 1) [ 322.992439][T21077] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5562'. [ 323.001358][T21077] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5562'. [ 323.002190][T21074] sd 0:0:1:0: device reset [ 323.014548][T21067] EXT4-fs error (device loop3): ext4_acquire_dquot:6986: comm syz.3.5560: Failed to acquire dquot type 0 [ 323.027393][T21067] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 323.037130][T21067] EXT4-fs error (device loop3): ext4_evict_inode:253: inode #11: comm syz.3.5560: mark_inode_dirty error [ 323.048852][T21067] EXT4-fs warning (device loop3): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 323.059138][T21067] EXT4-fs (loop3): 1 orphan inode deleted [ 323.067745][T10218] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:36: lblock 1 mapped to illegal pblock 1 (length 1) [ 323.084953][T10218] EXT4-fs error (device loop3): ext4_release_dquot:7022: comm kworker/u8:36: Failed to release dquot type 0 [ 323.110651][T21083] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5563'. [ 323.111808][T21075] sd 0:0:1:0: device reset [ 323.119682][T21083] netlink: 20 bytes leftover after parsing attributes in process `syz.6.5563'. [ 323.135748][T21067] EXT4-fs error (device loop3): __ext4_get_inode_loc:4830: comm syz.3.5560: Invalid inode table block 1 in block_group 0 [ 323.148534][T21067] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 323.158143][T21067] EXT4-fs error (device loop3): ext4_quota_off:7270: inode #3: comm syz.3.5560: mark_inode_dirty error [ 323.174943][T21083] bridge0: port 3(gretap0) entered blocking state [ 323.181486][T21083] bridge0: port 3(gretap0) entered disabled state [ 323.188065][T21083] gretap0: entered allmulticast mode [ 323.194181][T21083] gretap0: entered promiscuous mode [ 323.199689][T21083] bridge0: port 3(gretap0) entered blocking state [ 323.206139][T21083] bridge0: port 3(gretap0) entered forwarding state [ 323.214328][T21083] gretap0: left allmulticast mode [ 323.219453][T21083] gretap0: left promiscuous mode [ 323.224624][T21083] bridge0: port 3(gretap0) entered disabled state [ 323.243481][T21083] loop6: detected capacity change from 0 to 512 [ 323.250565][T21083] EXT4-fs (loop6): feature flags set on rev 0 fs, running e2fsck is recommended [ 323.260508][T21083] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=42c028, mo2=0002] [ 323.268421][T21083] EXT4-fs (loop6): orphan cleanup on readonly fs [ 323.276077][T21083] EXT4-fs error (device loop6): mb_free_blocks:2037: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 323.290729][T21083] EXT4-fs (loop6): Remounting filesystem read-only [ 323.297349][T21083] EXT4-fs (loop6): 1 truncate cleaned up [ 323.303221][T10234] EXT4-fs (loop6): Quota write (off=8192, len=1024) cancelled because transaction is not started [ 323.314161][T10234] EXT4-fs (loop6): Quota write (off=8192, len=1024) cancelled because transaction is not started [ 323.327798][T10234] EXT4-fs (loop6): Quota write (off=8, len=24) cancelled because transaction is not started [ 323.477241][T21093] netlink: 4 bytes leftover after parsing attributes in process `ÿ'. [ 323.553468][T21097] ALSA: seq fatal error: cannot create timer (-19) [ 323.752129][T21107] sd 0:0:1:0: device reset [ 323.854410][T21114] loop6: detected capacity change from 0 to 512 [ 323.865000][T21114] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 323.877733][T21114] EXT4-fs (loop6): 1 truncate cleaned up [ 323.883549][T21116] loop1: detected capacity change from 0 to 1024 [ 323.890749][T21116] EXT4-fs: Ignoring removed nomblk_io_submit option [ 323.919968][T21116] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 323.928690][T21116] System zones: 0-1, 3-36 [ 323.951366][T21116] siw: device registration error -23 [ 323.965371][T21122] bond1 (unregistering): Released all slaves [ 324.082416][T21108] loop3: detected capacity change from 0 to 32768 [ 324.095047][T21143] loop1: detected capacity change from 0 to 512 [ 324.102256][T21143] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 324.124551][T21143] ext4 filesystem being mounted at /8/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 324.140838][T21108] loop3: p1 p2 p3 < > p4 < p5 p6 > [ 324.146745][T21108] loop3: p1 start 460800 is beyond EOD, truncated [ 324.153292][T21108] loop3: p2 size 83886080 extends beyond EOD, truncated [ 324.166176][T21108] loop3: p5 start 460800 is beyond EOD, truncated [ 324.172663][T21108] loop3: p6 size 83886080 extends beyond EOD, truncated [ 324.193326][T21144] sd 0:0:1:0: device reset [ 324.199586][T21148] loop1: detected capacity change from 0 to 1024 [ 324.206351][T21148] EXT4-fs: Ignoring removed bh option [ 324.211841][T21148] EXT4-fs: inline encryption not supported [ 324.218088][T21148] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 324.230011][T21148] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 324.239087][T21148] EXT4-fs error (device loop1): ext4_map_blocks:783: inode #3: block 2: comm syz.1.5589: lblock 2 mapped to illegal pblock 2 (length 1) [ 324.260506][T21148] EXT4-fs error (device loop1): ext4_map_blocks:783: inode #3: block 48: comm syz.1.5589: lblock 0 mapped to illegal pblock 48 (length 1) [ 324.275004][T21148] EXT4-fs error (device loop1): ext4_acquire_dquot:6986: comm syz.1.5589: Failed to acquire dquot type 0 [ 324.286670][T21148] EXT4-fs error (device loop1) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 324.305829][T21148] EXT4-fs error (device loop1): ext4_evict_inode:253: inode #11: comm syz.1.5589: mark_inode_dirty error [ 324.320476][T21148] EXT4-fs warning (device loop1): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 324.411241][T21148] EXT4-fs (loop1): 1 orphan inode deleted [ 324.421375][T10242] EXT4-fs error (device loop1): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:60: lblock 1 mapped to illegal pblock 1 (length 1) [ 324.436160][T21149] loop6: detected capacity change from 0 to 32768 [ 324.454654][T10242] EXT4-fs error (device loop1): ext4_release_dquot:7022: comm kworker/u8:60: Failed to release dquot type 0 [ 324.480904][T21148] EXT4-fs error (device loop1): __ext4_get_inode_loc:4830: comm syz.1.5589: Invalid inode table block 1 in block_group 0 [ 324.497682][T21149] loop6: p1 p2 p3 < > p4 < p5 p6 > [ 324.510561][T21149] loop6: p1 start 460800 is beyond EOD, truncated [ 324.517019][T21149] loop6: p2 size 83886080 extends beyond EOD, truncated [ 324.524077][T21148] EXT4-fs error (device loop1) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 324.534886][T21148] EXT4-fs error (device loop1): ext4_quota_off:7270: inode #3: comm syz.1.5589: mark_inode_dirty error [ 324.563825][T21149] loop6: p5 start 460800 is beyond EOD, truncated [ 324.564491][T21155] loop2: detected capacity change from 0 to 1024 [ 324.570305][T21149] loop6: p6 size 83886080 extends beyond EOD, truncated [ 324.577168][T21155] EXT4-fs: Ignoring removed nomblk_io_submit option [ 324.604542][T21155] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 324.619206][T21155] System zones: 0-1, 3-36 [ 324.645786][T21160] netlink: 'syz.0.5593': attribute type 9 has an invalid length. [ 324.662028][T21155] siw: device registration error -23 [ 324.778871][T21193] smc: net device hsr0 applied user defined pnetid SYZ2 [ 324.786412][T21193] smc: net device hsr0 erased user defined pnetid SYZ2 [ 324.816223][T21196] loop0: detected capacity change from 0 to 512 [ 324.825512][T21196] ext4: Bad value for 'resgid' [ 324.830388][T21196] ext4: Bad value for 'resgid' [ 324.889940][T21194] sd 0:0:1:0: device reset [ 324.963816][T21213] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 324.975959][T21213] EXT4-fs (loop6): 1 truncate cleaned up [ 325.088985][T21222] netlink: 'syz.6.5613': attribute type 10 has an invalid length. [ 325.109031][T21222] bond0: (slave dummy0): Releasing backup interface [ 325.119102][T21222] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 325.128116][T21222] team0: Failed to send options change via netlink (err -105) [ 325.135734][T21222] team0: Port device dummy0 added [ 325.142755][T21222] netlink: 'syz.6.5613': attribute type 10 has an invalid length. [ 325.151106][T21194] loop2: p1 p2 p3 < > p4 < p5 p6 > [ 325.151349][T21222] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 325.156493][T21194] loop2: p1 start 460800 is beyond EOD, truncated [ 325.171736][T21194] loop2: p2 size 83886080 extends beyond EOD, truncated [ 325.178781][T21222] team0: Failed to send options change via netlink (err -105) [ 325.179987][T21194] loop2: p5 start 460800 is beyond EOD, truncated [ 325.187504][T21222] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 325.192757][T21194] loop2: p6 size 83886080 extends beyond EOD, truncated [ 325.202107][T21222] team0: Port device dummy0 removed [ 325.216206][T21222] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 325.257962][T21231] smc: net device hsr0 applied user defined pnetid SYZ2 [ 325.265459][T21231] smc: net device hsr0 erased user defined pnetid SYZ2 [ 325.321997][T21237] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 325.334349][T21237] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 325.346362][T21243] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 325.358215][T21243] EXT4-fs (loop1): 1 truncate cleaned up [ 325.581894][ T10] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 325.593025][ T10] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 325.652696][T21283] EXT4-fs warning (device loop0): ext4_enable_quotas:7221: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 325.667668][T21283] EXT4-fs (loop0): mount failed [ 325.675247][T21297] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 325.766378][T21300] netlink: 'syz.2.5628': attribute type 10 has an invalid length. [ 325.775477][T21300] bond0: (slave dummy0): Releasing backup interface [ 325.792416][T21300] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 325.801644][T21300] team0: Failed to send options change via netlink (err -105) [ 325.809391][T21300] team0: Port device dummy0 added [ 325.828534][T21318] netlink: 'syz.2.5628': attribute type 10 has an invalid length. [ 325.847202][T21317] xt_CT: No such helper "snmp_trap" [ 325.848482][T21318] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 326.103301][T21326] netlink: 'syz.3.5633': attribute type 9 has an invalid length. [ 326.112646][T21318] team0: Failed to send options change via netlink (err -105) [ 326.137444][T21318] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 326.178985][T21318] team0: Port device dummy0 removed [ 326.200214][T21332] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 326.215199][T21318] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 326.242065][T21332] ext4 filesystem being mounted at /580/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 326.252810][ T29] kauditd_printk_skb: 982 callbacks suppressed [ 326.252822][ T29] audit: type=1326 audit(1768150531.013:61217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21299 comm="syz.2.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fb9703c2005 code=0x7ffc0000 [ 326.344413][T21343] Invalid argument reading file caps for ./file0 [ 326.355324][ T29] audit: type=1326 audit(1768150531.043:61218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21299 comm="syz.2.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fb9703c2005 code=0x7ffc0000 [ 326.379075][ T29] audit: type=1326 audit(1768150531.043:61219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21299 comm="syz.2.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 326.402903][ T29] audit: type=1326 audit(1768150531.043:61220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21299 comm="syz.2.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 326.426501][ T29] audit: type=1326 audit(1768150531.043:61221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21325 comm="syz.3.5633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9c373f749 code=0x7ffc0000 [ 326.450091][ T29] audit: type=1326 audit(1768150531.043:61222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21325 comm="syz.3.5633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9c373f749 code=0x7ffc0000 [ 326.473765][ T29] audit: type=1326 audit(1768150531.043:61223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21325 comm="syz.3.5633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9c373f749 code=0x7ffc0000 [ 326.497420][ T29] audit: type=1326 audit(1768150531.043:61224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21325 comm="syz.3.5633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fe9c373f749 code=0x7ffc0000 [ 326.520916][ T29] audit: type=1326 audit(1768150531.043:61225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21325 comm="syz.3.5633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9c373f749 code=0x7ffc0000 [ 326.544546][ T29] audit: type=1326 audit(1768150531.043:61226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21325 comm="syz.3.5633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9c373f749 code=0x7ffc0000 [ 326.606987][T21354] __nla_validate_parse: 7 callbacks suppressed [ 326.607002][T21354] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5639'. [ 326.664264][T21362] tipc: Enabling of bearer rejected, failed to enable media [ 326.708290][T21371] ALSA: seq fatal error: cannot create timer (-19) [ 326.724903][T21359] sd 0:0:1:0: device reset [ 326.751759][T21382] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 326.992701][T21417] netlink: 'syz.3.5649': attribute type 10 has an invalid length. [ 327.014163][T21417] bond0: (slave dummy0): Releasing backup interface [ 327.028982][T21417] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 327.049318][T21417] team0: Failed to send options change via netlink (err -105) [ 327.056829][T21417] team0: Port device dummy0 added [ 327.094361][T21399] netlink: 'syz.3.5649': attribute type 10 has an invalid length. [ 327.118852][T21399] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 327.132742][T21399] team0: Failed to send options change via netlink (err -105) [ 327.140644][T21399] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 327.149674][T21399] team0: Port device dummy0 removed [ 327.157911][T21399] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 327.167337][T21380] loop6: p1 p2 p3 < > p4 < p5 p6 > [ 327.172974][T21380] loop6: p1 start 460800 is beyond EOD, truncated [ 327.179402][T21380] loop6: p2 size 83886080 extends beyond EOD, truncated [ 327.191376][T21380] loop6: p5 start 460800 is beyond EOD, truncated [ 327.197824][T21380] loop6: p6 size 83886080 extends beyond EOD, truncated [ 327.237236][T21443] ext4 filesystem being mounted at /514/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 327.252356][T21447] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5656'. [ 327.318178][T21452] 9p: Could not find request transport: fd0x0000000000000003 [ 327.506451][T21475] macsec1: entered allmulticast mode [ 327.511825][T21475] macvlan0: entered allmulticast mode [ 327.517297][T21475] veth1_vlan: entered allmulticast mode [ 327.525266][T21475] macvlan0: left allmulticast mode [ 327.530505][T21475] veth1_vlan: left allmulticast mode [ 327.605540][T21480] IPv6: Can't replace route, no match found [ 327.637145][T21482] ALSA: seq fatal error: cannot create timer (-19) [ 327.661743][T21485] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 327.675616][T21486] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvlan0, syncid = 0, id = 0 [ 327.685531][T21485] IPVS: stopping backup sync thread 21486 ... [ 327.869339][T21492] netlink: 'syz.6.5668': attribute type 1 has an invalid length. [ 327.882021][T21492] set_capacity_and_notify: 8 callbacks suppressed [ 327.882035][T21492] loop6: detected capacity change from 0 to 1024 [ 327.936866][T21496] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 327.975019][T21501] Invalid argument reading file caps for ./file0 [ 328.033500][T21508] smc: net device hsr0 applied user defined pnetid SYZ2 [ 328.041092][T21508] smc: net device hsr0 erased user defined pnetid SYZ2 [ 328.058385][T21511] ALSA: seq fatal error: cannot create timer (-19) [ 328.068149][T21515] loop6: detected capacity change from 0 to 1024 [ 328.074821][T21515] EXT4-fs: Ignoring removed bh option [ 328.080338][T21515] EXT4-fs: inline encryption not supported [ 328.093178][T21515] EXT4-fs (loop6): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 328.106827][T21515] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 328.151004][T21515] EXT4-fs error (device loop6): ext4_map_blocks:783: inode #3: block 2: comm syz.6.5677: lblock 2 mapped to illegal pblock 2 (length 1) [ 328.180369][T21515] EXT4-fs error (device loop6): ext4_map_blocks:783: inode #3: block 48: comm syz.6.5677: lblock 0 mapped to illegal pblock 48 (length 1) [ 328.220703][T21515] EXT4-fs error (device loop6): ext4_acquire_dquot:6986: comm syz.6.5677: Failed to acquire dquot type 0 [ 328.247339][T21519] FAULT_INJECTION: forcing a failure. [ 328.247339][T21519] name failslab, interval 1, probability 0, space 0, times 0 [ 328.260000][T21519] CPU: 0 UID: 0 PID: 21519 Comm: syz.0.5676 Not tainted syzkaller #0 PREEMPT(voluntary) [ 328.260027][T21519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 328.260039][T21519] Call Trace: [ 328.260047][T21519] [ 328.260054][T21519] __dump_stack+0x1d/0x30 [ 328.260075][T21519] dump_stack_lvl+0x95/0xd0 [ 328.260093][T21519] dump_stack+0x15/0x1b [ 328.260117][T21519] should_fail_ex+0x265/0x280 [ 328.260140][T21519] should_failslab+0x8c/0xb0 [ 328.260162][T21519] __kmalloc_cache_noprof+0x65/0x4c0 [ 328.260185][T21519] ? resv_map_alloc+0x32/0x190 [ 328.260286][T21519] ? vfs_write+0x7e8/0x960 [ 328.260303][T21519] resv_map_alloc+0x32/0x190 [ 328.260328][T21519] hugetlbfs_get_inode+0x67/0x370 [ 328.260352][T21519] ? mutex_unlock+0x4f/0x90 [ 328.260442][T21519] hugetlb_file_setup+0x192/0x3d0 [ 328.260467][T21519] ksys_mmap_pgoff+0x157/0x310 [ 328.260492][T21519] x64_sys_call+0x16bb/0x3000 [ 328.260573][T21519] do_syscall_64+0xca/0x2b0 [ 328.260603][T21519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.260620][T21519] RIP: 0033:0x7f99d0baf749 [ 328.260634][T21519] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 328.260668][T21519] RSP: 002b:00007f99cf5f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 328.260685][T21519] RAX: ffffffffffffffda RBX: 00007f99d0e06090 RCX: 00007f99d0baf749 [ 328.260696][T21519] RDX: 0000000000000002 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 328.260706][T21519] RBP: 00007f99cf5f6090 R08: ffffffffffffffff R09: 0000000000000000 [ 328.260772][T21519] R10: 000000000004c831 R11: 0000000000000246 R12: 0000000000000001 [ 328.260785][T21519] R13: 00007f99d0e06128 R14: 00007f99d0e06090 R15: 00007fff511a1b78 [ 328.260828][T21519] [ 328.466411][T21528] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5681'. [ 328.477060][T21515] EXT4-fs error (device loop6) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 328.485340][T21535] netlink: 72 bytes leftover after parsing attributes in process `syz.0.5684'. [ 328.517264][T21515] EXT4-fs error (device loop6): ext4_evict_inode:253: inode #11: comm syz.6.5677: mark_inode_dirty error [ 328.532623][T21515] EXT4-fs warning (device loop6): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 328.543022][T21515] EXT4-fs (loop6): 1 orphan inode deleted [ 328.558473][T10236] EXT4-fs error (device loop6): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:54: lblock 1 mapped to illegal pblock 1 (length 1) [ 328.579690][T10236] EXT4-fs error (device loop6): ext4_release_dquot:7022: comm kworker/u8:54: Failed to release dquot type 0 [ 328.601925][T21515] EXT4-fs error (device loop6): __ext4_get_inode_loc:4830: comm syz.6.5677: Invalid inode table block 1 in block_group 0 [ 328.615117][T21515] EXT4-fs error (device loop6) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 328.627456][T21544] netlink: 'syz.3.5688': attribute type 9 has an invalid length. [ 328.636142][T21515] EXT4-fs error (device loop6): ext4_quota_off:7270: inode #3: comm syz.6.5677: mark_inode_dirty error [ 328.667890][T21553] macsec0: entered allmulticast mode [ 328.673260][T21553] macvlan0: entered allmulticast mode [ 328.675835][T21554] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5686'. [ 328.687681][T21554] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5686'. [ 328.698293][T21553] macvlan0: left allmulticast mode [ 328.709929][T21554] bridge0: port 3(gretap0) entered blocking state [ 328.716611][T21554] bridge0: port 3(gretap0) entered disabled state [ 328.723889][T21554] gretap0: entered allmulticast mode [ 328.729673][T21554] gretap0: entered promiscuous mode [ 328.735541][T21554] bridge0: port 3(gretap0) entered blocking state [ 328.741990][T21554] bridge0: port 3(gretap0) entered forwarding state [ 328.758810][T21554] gretap0: left allmulticast mode [ 328.763979][T21554] gretap0: left promiscuous mode [ 328.764112][T21554] bridge0: port 3(gretap0) entered disabled state [ 328.842357][T21572] loop1: detected capacity change from 0 to 512 [ 328.857670][T21572] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 328.870930][T21572] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=42c028, mo2=0002] [ 328.879419][T21572] EXT4-fs (loop1): orphan cleanup on readonly fs [ 328.892335][T21572] EXT4-fs error (device loop1): mb_free_blocks:2037: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 328.921918][T21583] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5699'. [ 328.931181][T21572] EXT4-fs (loop1): Remounting filesystem read-only [ 328.939416][T21578] loop3: detected capacity change from 0 to 2048 [ 328.946486][T21572] EXT4-fs (loop1): 1 truncate cleaned up [ 328.952331][T10211] EXT4-fs (loop1): Quota write (off=8192, len=1024) cancelled because transaction is not started [ 328.962869][T10211] EXT4-fs (loop1): Quota write (off=8192, len=1024) cancelled because transaction is not started [ 328.973516][T10211] EXT4-fs (loop1): Quota write (off=8, len=24) cancelled because transaction is not started [ 328.987642][T21586] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5705'. [ 329.015604][T21591] macsec0: entered allmulticast mode [ 329.021052][T21591] macvlan0: entered allmulticast mode [ 329.024441][T21578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5700'. [ 329.044506][T21591] macvlan0: left allmulticast mode [ 329.271314][T21615] ip6_vti0 speed is unknown, defaulting to 1000 [ 329.294313][T21630] ALSA: seq fatal error: cannot create timer (-19) [ 329.318490][T21635] loop2: detected capacity change from 0 to 512 [ 329.326277][T21635] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 329.342576][T21635] ext4 filesystem being mounted at /529/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 329.392816][T21615] chnl_net:caif_netlink_parms(): no params data found [ 329.405535][T21642] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 329.414063][T10211] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.423866][T10211] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.462589][T21644] loop1: detected capacity change from 0 to 1024 [ 329.503840][T21644] EXT4-fs: inline encryption not supported [ 329.513786][T10211] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.523592][T10211] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.533689][T21644] EXT4-fs: Ignoring removed bh option [ 329.539344][T21644] EXT4-fs: Mount option(s) incompatible with ext2 [ 329.578716][T21615] bridge0: port 1(bridge_slave_0) entered blocking state [ 329.585835][T21615] bridge0: port 1(bridge_slave_0) entered disabled state [ 329.626884][T21615] bridge_slave_0: entered allmulticast mode [ 329.637212][T21615] bridge_slave_0: entered promiscuous mode [ 329.644045][T21652] 9p: Unknown access argument 18446744073709551615: -34 [ 329.653978][T10211] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.663764][T10211] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.676423][T21615] bridge0: port 2(bridge_slave_1) entered blocking state [ 329.683558][T21615] bridge0: port 2(bridge_slave_1) entered disabled state [ 329.691763][T21615] bridge_slave_1: entered allmulticast mode [ 329.698194][T21615] bridge_slave_1: entered promiscuous mode [ 329.712388][T21652] SELinux: failed to load policy [ 329.721599][T10211] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.731446][T10211] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.772833][T21656] netlink: 'syz.1.5721': attribute type 10 has an invalid length. [ 329.782736][T21615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 329.793637][T21615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 329.813940][T21656] team0: Failed to send options change via netlink (err -105) [ 329.821450][T21656] team0: Port device dummy0 added [ 329.864308][T21654] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 329.885352][T21654] team0: Failed to send options change via netlink (err -105) [ 329.931581][T21654] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 329.965757][T21654] team0: Port device dummy0 removed [ 329.972895][T21666] netlink: 4 bytes leftover after parsing attributes in process `ÿ'. [ 329.974276][T21654] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 330.011701][T21615] team0: Port device team_slave_0 added [ 330.024421][T21615] team0: Port device team_slave_1 added [ 330.069881][T21670] loop6: detected capacity change from 0 to 1024 [ 330.082315][T21670] EXT4-fs: Ignoring removed nomblk_io_submit option [ 330.104620][T21670] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 330.120758][T10210] smc: removing ib device syz2 [ 330.125607][T21670] System zones: 0-1, 3-36 [ 330.160116][T10211] dvmrp8 (unregistering): left allmulticast mode [ 330.181826][T21675] validate_nla: 1 callbacks suppressed [ 330.181839][T21675] netlink: 'syz.1.5730': attribute type 9 has an invalid length. [ 330.222907][T21677] siw: device registration error -23 [ 330.286337][T21680] loop2: detected capacity change from 0 to 512 [ 330.293393][T21680] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 330.321894][T21680] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=42c028, mo2=0002] [ 330.340024][T21680] EXT4-fs (loop2): orphan cleanup on readonly fs [ 330.365954][T21680] EXT4-fs error (device loop2): mb_free_blocks:2037: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 330.400012][T21680] EXT4-fs (loop2): Remounting filesystem read-only [ 330.427742][T21680] EXT4-fs (loop2): 1 truncate cleaned up [ 330.433592][T12903] EXT4-fs (loop2): Quota write (off=8192, len=1024) cancelled because transaction is not started [ 330.444378][T12903] EXT4-fs (loop2): Quota write (off=8192, len=1024) cancelled because transaction is not started [ 330.455402][T12903] EXT4-fs (loop2): Quota write (off=8, len=24) cancelled because transaction is not started [ 330.732664][T10211] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 330.741106][T10211] dummy0: left promiscuous mode [ 330.746566][T10211] bond0 (unregistering): Released all slaves [ 330.759739][T21676] bridge0: port 1(gretap0) entered blocking state [ 330.766227][T21676] bridge0: port 1(gretap0) entered disabled state [ 330.772744][T21676] gretap0: entered allmulticast mode [ 330.778565][T21676] gretap0: entered promiscuous mode [ 330.784390][T21678] gretap0: left allmulticast mode [ 330.789419][T21678] gretap0: left promiscuous mode [ 330.794666][T21678] bridge0: port 1(gretap0) entered disabled state [ 330.804791][T21615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 330.811784][T21615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 330.837712][T21615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 330.854741][T10211] hsr_slave_0: left promiscuous mode [ 330.861991][T10211] hsr_slave_1: left promiscuous mode [ 330.870288][T10211] veth0_macvtap: left promiscuous mode [ 330.875981][T10211] veth1_vlan: left promiscuous mode [ 330.881512][T10211] veth0_vlan: left promiscuous mode [ 330.975658][T21615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 330.982661][T21615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 331.008639][T21615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 331.044241][T21705] Invalid argument reading file caps for ./file0 [ 331.054410][T21615] hsr_slave_0: entered promiscuous mode [ 331.060593][T21615] hsr_slave_1: entered promiscuous mode [ 331.066555][T21615] debugfs: 'hsr0' already exists in 'hsr' [ 331.072317][T21615] Cannot create hsr debugfs directory [ 331.222726][T21716] netlink: 'syz.2.5742': attribute type 10 has an invalid length. [ 331.231667][T21716] bond0: (slave dummy0): Releasing backup interface [ 331.240027][T21716] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 331.248869][T21716] team0: Failed to send options change via netlink (err -105) [ 331.256369][T21716] team0: Port device dummy0 added [ 331.261842][ T29] kauditd_printk_skb: 1287 callbacks suppressed [ 331.261854][ T29] audit: type=1326 audit(1768150536.013:62495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21715 comm="syz.2.5742" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 331.264797][T21716] netlink: 'syz.2.5742': attribute type 10 has an invalid length. [ 331.291739][ T29] audit: type=1326 audit(1768150536.013:62496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21715 comm="syz.2.5742" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 331.300141][T21716] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 331.323111][ T29] audit: type=1326 audit(1768150536.013:62497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21715 comm="syz.2.5742" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 331.355316][ T29] audit: type=1326 audit(1768150536.013:62498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21715 comm="syz.2.5742" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 331.386142][T21716] team0: Failed to send options change via netlink (err -105) [ 331.393881][T21716] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 331.402684][ T29] audit: type=1326 audit(1768150536.153:62499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21715 comm="syz.2.5742" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fb9703c2005 code=0x7ffc0000 [ 331.417798][T21716] team0: Port device dummy0 removed [ 331.426350][ T29] audit: type=1326 audit(1768150536.153:62500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21715 comm="syz.2.5742" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fb9703c2005 code=0x7ffc0000 [ 331.433300][T21716] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 331.455115][ T29] audit: type=1326 audit(1768150536.163:62501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21715 comm="syz.2.5742" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fb9703c2005 code=0x7ffc0000 [ 331.455218][ T29] audit: type=1326 audit(1768150536.163:62502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21715 comm="syz.2.5742" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fb9703c2005 code=0x7ffc0000 [ 331.510842][ T29] audit: type=1326 audit(1768150536.163:62503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21715 comm="syz.2.5742" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fb9703c2005 code=0x7ffc0000 [ 331.534438][ T29] audit: type=1326 audit(1768150536.163:62504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=21715 comm="syz.2.5742" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fb9703c2005 code=0x7ffc0000 [ 331.569109][T10211] IPVS: stop unused estimator thread 0... [ 331.594632][T21726] loop2: detected capacity change from 0 to 512 [ 331.601640][T21726] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 331.636757][T21729] loop6: detected capacity change from 0 to 512 [ 331.652616][T21729] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 331.652859][T21726] ext4 filesystem being mounted at /542/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 331.685597][T21729] ext4 filesystem being mounted at /162/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 331.695436][T21737] ALSA: seq fatal error: cannot create timer (-19) [ 331.722995][T21615] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 331.741670][T21615] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 331.755248][T21615] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 331.771031][T21615] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 331.777349][T21744] Invalid argument reading file caps for ./file0 [ 331.812535][T21752] __nla_validate_parse: 7 callbacks suppressed [ 331.812550][T21752] netlink: 72 bytes leftover after parsing attributes in process `syz.2.5753'. [ 331.853497][T21615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 331.884082][T21615] 8021q: adding VLAN 0 to HW filter on device team0 [ 331.906460][T10211] bridge0: port 1(bridge_slave_0) entered blocking state [ 331.907345][T21760] 9p: Could not find request transport: fd0x0000000000000003 [ 331.913600][T10211] bridge0: port 1(bridge_slave_0) entered forwarding state [ 331.928146][T21615] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 331.938715][T21615] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 331.963479][T10211] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.964528][T21770] ALSA: seq fatal error: cannot create timer (-19) [ 331.970597][T10211] bridge0: port 2(bridge_slave_1) entered forwarding state [ 331.991560][T21772] netlink: 'syz.3.5758': attribute type 1 has an invalid length. [ 332.004608][T21772] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5758'. [ 332.077593][T21782] syzkaller0: entered promiscuous mode [ 332.083164][T21782] syzkaller0: entered allmulticast mode [ 332.100902][T21615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 332.170701][T21615] veth0_vlan: entered promiscuous mode [ 332.180628][T21615] veth1_vlan: entered promiscuous mode [ 332.198848][T21615] veth0_macvtap: entered promiscuous mode [ 332.199289][T21792] EXT4-fs: Ignoring removed nomblk_io_submit option [ 332.206825][T21615] veth1_macvtap: entered promiscuous mode [ 332.218090][T21792] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 332.223542][T21615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 332.226921][T21792] System zones: 0-1, 3-36 [ 332.239482][T21615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 332.251514][T10227] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.260499][T10227] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.269478][T10227] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.272893][T21792] siw: device registration error -23 [ 332.287385][T10227] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.309172][T21795] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 332.421330][T21800] netlink: 'syz.2.5765': attribute type 10 has an invalid length. [ 332.431491][T21800] bond0: (slave dummy0): Releasing backup interface [ 332.439873][T21800] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 332.449001][T21800] team0: Failed to send options change via netlink (err -105) [ 332.458464][T21800] team0: Port device dummy0 added [ 332.467233][T21800] netlink: 'syz.2.5765': attribute type 10 has an invalid length. [ 332.475729][T21800] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 332.485822][T21800] team0: Failed to send options change via netlink (err -105) [ 332.493511][T21800] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 332.502592][T21800] team0: Port device dummy0 removed [ 332.509297][T21800] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 332.565202][T21809] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 332.596167][T21811] FAULT_INJECTION: forcing a failure. [ 332.596167][T21811] name failslab, interval 1, probability 0, space 0, times 0 [ 332.604039][T21809] ext4 filesystem being mounted at /554/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 332.608875][T21811] CPU: 0 UID: 0 PID: 21811 Comm: syz.0.5770 Not tainted syzkaller #0 PREEMPT(voluntary) [ 332.608902][T21811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 332.608915][T21811] Call Trace: [ 332.608923][T21811] [ 332.608932][T21811] __dump_stack+0x1d/0x30 [ 332.608956][T21811] dump_stack_lvl+0x95/0xd0 [ 332.608977][T21811] dump_stack+0x15/0x1b [ 332.609039][T21811] should_fail_ex+0x265/0x280 [ 332.609069][T21811] should_failslab+0x8c/0xb0 [ 332.609102][T21811] kmem_cache_alloc_noprof+0x69/0x4b0 [ 332.609131][T21811] ? audit_log_start+0x342/0x720 [ 332.609152][T21811] audit_log_start+0x342/0x720 [ 332.609224][T21811] ? kstrtouint+0x76/0xc0 [ 332.609243][T21811] audit_seccomp+0x48/0x100 [ 332.609272][T21811] ? __seccomp_filter+0x832/0x1260 [ 332.609333][T21811] __seccomp_filter+0x843/0x1260 [ 332.609440][T21811] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 332.609467][T21811] ? vfs_write+0x7e8/0x960 [ 332.609499][T21811] ? __rcu_read_unlock+0x4f/0x70 [ 332.609519][T21811] ? __fget_files+0x184/0x1c0 [ 332.609544][T21811] __secure_computing+0x82/0x150 [ 332.609569][T21811] syscall_trace_enter+0xcf/0x1e0 [ 332.609605][T21811] do_syscall_64+0xa4/0x2b0 [ 332.609637][T21811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.609658][T21811] RIP: 0033:0x7fd9d20af749 [ 332.609674][T21811] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 332.609692][T21811] RSP: 002b:00007fd9d0b17038 EFLAGS: 00000246 ORIG_RAX: 000000000000005d [ 332.609754][T21811] RAX: ffffffffffffffda RBX: 00007fd9d2305fa0 RCX: 00007fd9d20af749 [ 332.609767][T21811] RDX: 000000000000ee01 RSI: 0000000000000000 RDI: 0000000000000003 [ 332.609922][T21811] RBP: 00007fd9d0b17090 R08: 0000000000000000 R09: 0000000000000000 [ 332.609934][T21811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 332.609947][T21811] R13: 00007fd9d2306038 R14: 00007fd9d2305fa0 R15: 00007fff03c9eff8 [ 332.609966][T21811] [ 332.661342][T21815] ALSA: seq fatal error: cannot create timer (-19) [ 332.884031][T21829] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 332.920100][T21834] netlink: 4 bytes leftover after parsing attributes in process `ÿ'. [ 332.986814][T21841] set_capacity_and_notify: 2 callbacks suppressed [ 332.986831][T21841] loop3: detected capacity change from 0 to 1024 [ 333.005678][T21847] netlink: 'syz.0.5780': attribute type 1 has an invalid length. [ 333.014731][T21847] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5780'. [ 333.028918][T21841] EXT4-fs: Ignoring removed bh option [ 333.043062][T21841] EXT4-fs: inline encryption not supported [ 333.050179][T21841] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 333.062518][T21841] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 333.082644][T21841] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 2: comm syz.3.5782: lblock 2 mapped to illegal pblock 2 (length 1) [ 333.105058][T21841] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 48: comm syz.3.5782: lblock 0 mapped to illegal pblock 48 (length 1) [ 333.134879][T21841] EXT4-fs error (device loop3): ext4_acquire_dquot:6986: comm syz.3.5782: Failed to acquire dquot type 0 [ 333.146533][T21841] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 333.156289][T21841] EXT4-fs error (device loop3): ext4_evict_inode:253: inode #11: comm syz.3.5782: mark_inode_dirty error [ 333.168439][T21841] EXT4-fs warning (device loop3): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 333.184814][T21841] EXT4-fs (loop3): 1 orphan inode deleted [ 333.193035][T10197] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:15: lblock 1 mapped to illegal pblock 1 (length 1) [ 333.219429][T10197] EXT4-fs error (device loop3): ext4_release_dquot:7022: comm kworker/u8:15: Failed to release dquot type 0 [ 333.242728][T21841] EXT4-fs error (device loop3): __ext4_get_inode_loc:4830: comm syz.3.5782: Invalid inode table block 1 in block_group 0 [ 333.265967][T21841] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 333.276282][T21841] EXT4-fs error (device loop3): ext4_quota_off:7270: inode #3: comm syz.3.5782: mark_inode_dirty error [ 333.290878][T21860] Invalid argument reading file caps for ./file0 [ 333.373788][T21864] IPv6: Can't replace route, no match found [ 333.393269][T21871] netlink: 'syz.1.5792': attribute type 9 has an invalid length. [ 333.454834][T21899] macsec1: entered allmulticast mode [ 333.460181][T21899] macvlan0: entered allmulticast mode [ 333.465587][T21899] veth1_vlan: entered allmulticast mode [ 333.473551][T21899] macvlan0: left allmulticast mode [ 333.478918][T21899] veth1_vlan: left allmulticast mode [ 333.610842][T21909] Invalid argument reading file caps for ./file0 [ 333.611074][T21908] loop1: detected capacity change from 0 to 512 [ 333.626958][T21908] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 333.647254][T21908] EXT4-fs (loop1): 1 truncate cleaned up [ 333.699721][T21918] loop3: detected capacity change from 0 to 1024 [ 333.746719][T21918] EXT4-fs: Ignoring removed bh option [ 333.762485][T21918] EXT4-fs: inline encryption not supported [ 333.769733][T21911] netlink: 'syz.0.5798': attribute type 10 has an invalid length. [ 333.781387][T21911] team0: Failed to send options change via netlink (err -105) [ 333.788862][T21911] team0: Port device dummy0 added [ 333.797887][T21911] netlink: 'syz.0.5798': attribute type 10 has an invalid length. [ 333.809183][T21911] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 333.812018][T21918] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 333.828323][T21911] team0: Failed to send options change via netlink (err -105) [ 333.836529][T21911] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 333.850016][T21911] team0: Port device dummy0 removed [ 333.857946][T21911] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 333.878407][T21918] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 333.894395][T21927] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5804'. [ 333.911032][T21918] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 2: comm syz.3.5801: lblock 2 mapped to illegal pblock 2 (length 1) [ 333.926636][T21929] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 333.927009][T21918] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 48: comm syz.3.5801: lblock 0 mapped to illegal pblock 48 (length 1) [ 333.960667][T21918] EXT4-fs error (device loop3): ext4_acquire_dquot:6986: comm syz.3.5801: Failed to acquire dquot type 0 [ 333.974202][T21918] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 333.983869][T21918] EXT4-fs error (device loop3): ext4_evict_inode:253: inode #11: comm syz.3.5801: mark_inode_dirty error [ 333.995523][T21918] EXT4-fs warning (device loop3): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 334.006057][T21918] EXT4-fs (loop3): 1 orphan inode deleted [ 334.021200][T10211] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:29: lblock 1 mapped to illegal pblock 1 (length 1) [ 334.052670][T21938] macsec1: entered allmulticast mode [ 334.058059][T21938] macvlan0: entered allmulticast mode [ 334.063532][T21938] veth1_vlan: entered allmulticast mode [ 334.071573][T21938] macvlan0: left allmulticast mode [ 334.076705][T21938] veth1_vlan: left allmulticast mode [ 334.095254][T10211] EXT4-fs error (device loop3): ext4_release_dquot:7022: comm kworker/u8:29: Failed to release dquot type 0 [ 334.141094][T21918] EXT4-fs error (device loop3): __ext4_get_inode_loc:4830: comm syz.3.5801: Invalid inode table block 1 in block_group 0 [ 334.179184][T21918] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 334.188856][T21918] EXT4-fs error (device loop3): ext4_quota_off:7270: inode #3: comm syz.3.5801: mark_inode_dirty error [ 334.254004][T21944] ALSA: seq fatal error: cannot create timer (-19) [ 334.362640][T21963] netlink: 48 bytes leftover after parsing attributes in process `syz.6.5817'. [ 334.399728][T21969] FAULT_INJECTION: forcing a failure. [ 334.399728][T21969] name failslab, interval 1, probability 0, space 0, times 0 [ 334.412472][T21969] CPU: 1 UID: 0 PID: 21969 Comm: syz.1.5820 Not tainted syzkaller #0 PREEMPT(voluntary) [ 334.412496][T21969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 334.412530][T21969] Call Trace: [ 334.412582][T21969] [ 334.412591][T21969] __dump_stack+0x1d/0x30 [ 334.412623][T21969] dump_stack_lvl+0x95/0xd0 [ 334.412643][T21969] dump_stack+0x15/0x1b [ 334.412659][T21969] should_fail_ex+0x265/0x280 [ 334.412822][T21969] should_failslab+0x8c/0xb0 [ 334.412845][T21969] __kmalloc_cache_noprof+0x65/0x4c0 [ 334.412871][T21969] ? sg_read+0x3ce/0xcb0 [ 334.412988][T21969] sg_read+0x3ce/0xcb0 [ 334.413007][T21969] ? __pfx_sg_read+0x10/0x10 [ 334.413021][T21969] vfs_read+0x1a8/0x770 [ 334.413102][T21969] ? __rcu_read_unlock+0x4f/0x70 [ 334.413123][T21969] ? __fget_files+0x184/0x1c0 [ 334.413188][T21969] ksys_read+0xda/0x1a0 [ 334.413204][T21969] __x64_sys_read+0x40/0x50 [ 334.413219][T21969] x64_sys_call+0x2889/0x3000 [ 334.413239][T21969] do_syscall_64+0xca/0x2b0 [ 334.413285][T21969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.413309][T21969] RIP: 0033:0x7f0c7fd3f749 [ 334.413326][T21969] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 334.413412][T21969] RSP: 002b:00007f0c7e7a7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 334.413457][T21969] RAX: ffffffffffffffda RBX: 00007f0c7ff95fa0 RCX: 00007f0c7fd3f749 [ 334.413468][T21969] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 334.413561][T21969] RBP: 00007f0c7e7a7090 R08: 0000000000000000 R09: 0000000000000000 [ 334.413573][T21969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 334.413586][T21969] R13: 00007f0c7ff96038 R14: 00007f0c7ff95fa0 R15: 00007ffd141cd198 [ 334.413611][T21969] [ 334.646169][T21974] macsec0: entered allmulticast mode [ 334.651526][T21974] macvlan0: entered allmulticast mode [ 334.656914][T21974] veth1_vlan: entered allmulticast mode [ 334.667998][T21974] macvlan0: left allmulticast mode [ 334.673196][T21974] veth1_vlan: left allmulticast mode [ 334.723946][T21983] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5824'. [ 334.782238][T21989] loop6: detected capacity change from 0 to 512 [ 334.803205][T21989] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 334.820379][T21986] ALSA: seq fatal error: cannot create timer (-19) [ 334.828233][T21989] EXT4-fs (loop6): 1 truncate cleaned up [ 334.828542][T21960] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5816'. [ 334.843583][T21996] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5830'. [ 334.859015][T21960] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5816'. [ 334.925120][T22007] macsec1: entered allmulticast mode [ 334.930593][T22007] macvlan0: entered allmulticast mode [ 334.936004][T22007] veth1_vlan: entered allmulticast mode [ 334.944611][T22007] macvlan0: left allmulticast mode [ 334.949806][T22007] veth1_vlan: left allmulticast mode [ 334.977631][T22009] loop6: detected capacity change from 0 to 256 [ 335.093164][T22032] sd 0:0:1:0: device reset [ 335.095919][T22031] loop1: detected capacity change from 0 to 512 [ 335.114265][T22031] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 335.130993][T22031] EXT4-fs (loop1): 1 truncate cleaned up [ 335.221758][T22037] ALSA: seq fatal error: cannot create timer (-19) [ 335.343758][T22050] IPv6: Can't replace route, no match found [ 335.352069][T22048] loop6: detected capacity change from 0 to 512 [ 335.360627][T22048] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 335.390251][T22048] EXT4-fs (loop6): 1 truncate cleaned up [ 335.438703][T22025] loop3: detected capacity change from 0 to 32768 [ 335.457198][T22064] Invalid argument reading file caps for ./file0 [ 335.473556][T22070] validate_nla: 3 callbacks suppressed [ 335.473566][T22070] netlink: 'syz.2.5856': attribute type 9 has an invalid length. [ 335.491570][T22025] loop3: p1 p2 p3 < > p4 < p5 p6 > [ 335.505491][T22025] loop3: p1 start 460800 is beyond EOD, truncated [ 335.512075][T22025] loop3: p2 size 83886080 extends beyond EOD, truncated [ 335.522567][T22025] loop3: p5 start 460800 is beyond EOD, [ 335.522573][T22073] netlink: 'syz.6.5855': attribute type 1 has an invalid length. [ 335.536065][T22025] truncated [ 335.539173][T22025] loop3: p6 size 83886080 extends beyond EOD, truncated [ 335.726938][T22106] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 335.865272][T22117] Invalid argument reading file caps for ./file0 [ 335.983134][T22127] loop6: detected capacity change from 0 to 1024 [ 335.989789][T22127] EXT4-fs: Ignoring removed nomblk_io_submit option [ 336.000553][T22132] 9pnet_fd: Insufficient options for proto=fd [ 336.048394][T22127] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 336.067802][T22127] System zones: 0-1, 3-36 [ 336.083671][T22127] siw: device registration error -23 [ 336.106821][T22144] 9pnet_fd: Insufficient options for proto=fd [ 336.127297][T22146] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 336.192516][T22155] Invalid argument reading file caps for ./file0 [ 336.247034][T22159] loop6: detected capacity change from 0 to 2048 [ 336.259768][T22161] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 336.268722][T22164] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvlan0, syncid = 0, id = 0 [ 336.278742][T22161] IPVS: stopping backup sync thread 22164 ... [ 336.424607][T22170] EXT4-fs: Ignoring removed bh option [ 336.447030][T22170] EXT4-fs: inline encryption not supported [ 336.460643][T22170] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 336.467875][T22175] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 336.486366][ T29] kauditd_printk_skb: 1009 callbacks suppressed [ 336.486380][ T29] audit: type=1400 audit(1768150541.233:63506): avc: denied { listen } for pid=22171 comm="syz.2.5889" path=2F3536382FE91F7189591E9233614B scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 336.570706][T22170] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 336.580889][T22170] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 2: comm syz.3.5888: lblock 2 mapped to illegal pblock 2 (length 1) [ 336.660307][ T29] audit: type=1400 audit(1768150541.273:63507): avc: denied { connect } for pid=22177 comm="syz.6.5891" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 336.680277][ T29] audit: type=1326 audit(1768150541.293:63508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22180 comm="syz.2.5892" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 336.703925][ T29] audit: type=1326 audit(1768150541.293:63509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22180 comm="syz.2.5892" exe="/root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 336.727520][ T29] audit: type=1326 audit(1768150541.293:63510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22180 comm="syz.2.5892" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 336.751313][ T29] audit: type=1326 audit(1768150541.293:63511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22182 comm="syz.2.5892" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fb9703c2005 code=0x7ffc0000 [ 336.768710][T22170] Quota error (device loop3): qtree_write_dquot: dquota write failed [ 336.774943][ T29] audit: type=1326 audit(1768150541.303:63512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22180 comm="syz.2.5892" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 336.806547][ T29] audit: type=1326 audit(1768150541.303:63513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22180 comm="syz.2.5892" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 336.808782][T22170] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 48: comm syz.3.5888: lblock 0 mapped to illegal pblock 48 (length 1) [ 336.830105][ T29] audit: type=1326 audit(1768150541.303:63514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22180 comm="syz.2.5892" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97038f749 code=0x7ffc0000 [ 336.868558][T22170] EXT4-fs error (device loop3): ext4_acquire_dquot:6986: comm syz.3.5888: Failed to acquire dquot type 0 [ 336.882024][T22170] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 336.891806][T22170] EXT4-fs error (device loop3): ext4_evict_inode:253: inode #11: comm syz.3.5888: mark_inode_dirty error [ 336.907488][T22190] netlink: 'syz.2.5896': attribute type 9 has an invalid length. [ 336.962180][T22196] __nla_validate_parse: 17 callbacks suppressed [ 336.962196][T22196] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5898'. [ 336.984198][T22170] EXT4-fs warning (device loop3): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 336.999132][T22200] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 337.010903][T22170] EXT4-fs (loop3): 1 orphan inode deleted [ 337.018212][T22170] EXT4-fs mount: 73 callbacks suppressed [ 337.018227][T22170] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 337.036491][T10238] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:56: lblock 1 mapped to illegal pblock 1 (length 1) [ 337.061799][T22200] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 337.070816][T10238] EXT4-fs error (device loop3): ext4_release_dquot:7022: comm kworker/u8:56: Failed to release dquot type 0 [ 337.086855][T22170] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 337.096316][T22170] EXT4-fs error (device loop3): __ext4_get_inode_loc:4830: comm syz.3.5888: Invalid inode table block 1 in block_group 0 [ 337.097024][T22203] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 337.110468][T22170] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 337.129615][T22200] ext4 filesystem being mounted at /72/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 337.142203][T22208] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 337.153343][T22203] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5900'. [ 337.182667][T22170] EXT4-fs error (device loop3): ext4_quota_off:7270: inode #3: comm syz.3.5888: mark_inode_dirty error [ 337.199355][T20797] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 337.323155][T13133] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 337.349886][T22232] ALSA: seq fatal error: cannot create timer (-19) [ 337.369761][T22238] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 337.446197][T22247] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 337.481501][T22251] EXT4-fs: Ignoring removed bh option [ 337.492502][T22251] EXT4-fs: inline encryption not supported [ 337.499904][T22247] EXT4-fs (loop6): 1 truncate cleaned up [ 337.505979][T22251] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 337.516722][T22247] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 337.541388][T22251] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 337.551691][T19064] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 337.585327][T22251] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #3: block 2: comm syz.2.5920: lblock 2 mapped to illegal pblock 2 (length 1) [ 337.612233][T22260] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 337.639106][T22251] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #3: block 48: comm syz.2.5920: lblock 0 mapped to illegal pblock 48 (length 1) [ 337.668936][T22260] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5924'. [ 337.750011][T14695] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 337.760350][T22251] EXT4-fs error (device loop2): ext4_acquire_dquot:6986: comm syz.2.5920: Failed to acquire dquot type 0 [ 337.773543][T22271] netlink: 'syz.0.5928': attribute type 9 has an invalid length. [ 337.786537][T22251] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 337.811142][T22251] EXT4-fs error (device loop2): ext4_evict_inode:253: inode #11: comm syz.2.5920: mark_inode_dirty error [ 337.822729][T22251] EXT4-fs warning (device loop2): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 337.837547][T22278] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 337.848556][T22251] EXT4-fs (loop2): 1 orphan inode deleted [ 337.854864][T22251] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 337.868519][T22278] EXT4-fs (loop3): 1 truncate cleaned up [ 337.874718][T22278] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 337.887364][T10213] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:31: lblock 1 mapped to illegal pblock 1 (length 1) [ 337.915385][T10213] EXT4-fs error (device loop2): ext4_release_dquot:7022: comm kworker/u8:31: Failed to release dquot type 0 [ 337.928065][T22282] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5931'. [ 337.976067][T22251] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 337.985595][T22251] EXT4-fs error (device loop2): __ext4_get_inode_loc:4830: comm syz.2.5920: Invalid inode table block 1 in block_group 0 [ 338.008509][T22251] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 338.033970][T14695] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 338.045022][T22251] EXT4-fs error (device loop2): ext4_quota_off:7270: inode #3: comm syz.2.5920: mark_inode_dirty error [ 338.128331][T22295] bond1 (unregistering): Released all slaves [ 338.138452][T22293] smc: net device hsr0 applied user defined pnetid SYZ2 [ 338.150733][T22293] smc: net device hsr0 erased user defined pnetid SYZ2 [ 338.237557][T22307] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5943'. [ 338.252732][T22306] set_capacity_and_notify: 7 callbacks suppressed [ 338.252749][T22306] loop2: detected capacity change from 0 to 512 [ 338.311813][T22305] loop3: detected capacity change from 0 to 2048 [ 338.344441][T22306] EXT4-fs error (device loop2): ext4_do_update_inode:5617: inode #3: comm syz.2.5941: corrupted inode contents [ 338.358498][T22305] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 338.374981][T22317] 9pnet_fd: Insufficient options for proto=fd [ 338.401709][T22306] EXT4-fs error (device loop2): ext4_dirty_inode:6502: inode #3: comm syz.2.5941: mark_inode_dirty error [ 338.432830][T22305] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5940'. [ 338.447904][T22306] EXT4-fs error (device loop2): ext4_do_update_inode:5617: inode #3: comm syz.2.5941: corrupted inode contents [ 338.481670][T22324] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 338.491871][T22324] IPVS: stopping backup sync thread 22325 ... [ 338.509708][T22306] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #3: comm syz.2.5941: mark_inode_dirty error [ 338.523796][T22306] EXT4-fs error (device loop2): ext4_acquire_dquot:6986: comm syz.2.5941: Failed to acquire dquot type 0 [ 338.524824][T14695] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 338.546987][T22306] EXT4-fs error (device loop2): ext4_do_update_inode:5617: inode #16: comm syz.2.5941: corrupted inode contents [ 338.566047][T22306] EXT4-fs error (device loop2): ext4_dirty_inode:6502: inode #16: comm syz.2.5941: mark_inode_dirty error [ 338.577997][T22306] EXT4-fs error (device loop2): ext4_do_update_inode:5617: inode #16: comm syz.2.5941: corrupted inode contents [ 338.674742][T22306] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #16: comm syz.2.5941: mark_inode_dirty error [ 338.692363][T22306] EXT4-fs error (device loop2): ext4_do_update_inode:5617: inode #16: comm syz.2.5941: corrupted inode contents [ 338.705947][T22306] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 338.715178][T22306] EXT4-fs error (device loop2): ext4_do_update_inode:5617: inode #16: comm syz.2.5941: corrupted inode contents [ 338.732939][T22306] EXT4-fs error (device loop2): ext4_truncate:4635: inode #16: comm syz.2.5941: mark_inode_dirty error [ 338.764110][T22332] loop6: detected capacity change from 0 to 1024 [ 338.771176][T22332] EXT4-fs: Ignoring removed nomblk_io_submit option [ 338.850761][T22306] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 338.860892][T22306] EXT4-fs (loop2): 1 truncate cleaned up [ 338.867944][T22306] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 338.881027][T22306] ext4 filesystem being mounted at /578/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 338.922543][T22332] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 338.936456][T22332] System zones: 0-1, 3-36 [ 338.943218][T22332] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 338.995111][T13133] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 339.039495][T22332] siw: device registration error -23 [ 339.142156][T19064] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 339.480936][T22362] lo speed is unknown, defaulting to 1000 [ 339.486700][T22362] lo speed is unknown, defaulting to 1000 [ 339.492764][T22362] lo speed is unknown, defaulting to 1000 [ 339.499923][T22362] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 339.572909][T22362] lo speed is unknown, defaulting to 1000 [ 339.579485][T22362] lo speed is unknown, defaulting to 1000 [ 339.585867][T22362] lo speed is unknown, defaulting to 1000 [ 339.592381][T22362] lo speed is unknown, defaulting to 1000 [ 339.598852][T22362] lo speed is unknown, defaulting to 1000 [ 339.605719][T22362] lo speed is unknown, defaulting to 1000 [ 339.612489][T22362] lo speed is unknown, defaulting to 1000 [ 339.770212][T22359] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5961'. [ 339.801662][T22367] bond3 (unregistering): Released all slaves [ 339.921120][T22378] loop3: detected capacity change from 0 to 512 [ 339.921615][T22373] netlink: 12 bytes leftover after parsing attributes in process `ÿ'. [ 339.936824][T22378] EXT4-fs error (device loop3): ext4_xattr_inode_iget:446: comm syz.3.5968: error while reading EA inode 32 err=-116 [ 339.952969][T22378] EXT4-fs (loop3): Remounting filesystem read-only [ 339.959488][T22378] EXT4-fs warning (device loop3): ext4_evict_inode:256: couldn't mark inode dirty (err -30) [ 339.970446][T22378] EXT4-fs (loop3): 1 orphan inode deleted [ 339.976560][T22378] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 339.990431][T22378] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 340.027189][T22384] smc: net device hsr0 applied user defined pnetid SYZ2 [ 340.035875][T22384] smc: net device hsr0 erased user defined pnetid SYZ2 [ 340.243731][T22400] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 340.275516][T22401] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvlan0, syncid = 0, id = 0 [ 340.275701][T22400] IPVS: stopping backup sync thread 22401 ... [ 340.317190][T22403] ALSA: seq fatal error: cannot create timer (-19) [ 340.346848][T22406] netlink: 'syz.1.5976': attribute type 9 has an invalid length. [ 340.369246][T22411] ip6gre0: entered promiscuous mode [ 340.379659][T22411] team0: Port device ip6gre0 added [ 340.391052][T22411] xt_CT: You must specify a L4 protocol and not use inversions on it [ 340.424060][T22415] syzkaller0: entered allmulticast mode [ 340.429976][T22415] syzkaller0: entered promiscuous mode [ 340.450108][T22415] syzkaller0 (unregistering): left promiscuous mode [ 340.456770][T22415] syzkaller0 (unregistering): left allmulticast mode [ 340.495103][T22417] netlink: 'syz.1.5980': attribute type 10 has an invalid length. [ 340.512695][T22417] bond0: (slave dummy0): Releasing backup interface [ 340.521852][T22417] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 340.530665][T22417] team0: Failed to send options change via netlink (err -105) [ 340.538119][T22417] team0: Port device dummy0 added [ 340.547564][T22417] netlink: 'syz.1.5980': attribute type 10 has an invalid length. [ 340.556078][T22417] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 340.566686][T22417] team0: Failed to send options change via netlink (err -105) [ 340.574196][T22417] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 340.583203][T22417] team0: Port device dummy0 removed [ 340.590185][T22417] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 340.690177][T22421] netlink: 'syz.1.5982': attribute type 10 has an invalid length. [ 340.701369][T22421] bond0: (slave dummy0): Releasing backup interface [ 340.712359][T22421] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 340.722128][T22421] team0: Failed to send options change via netlink (err -105) [ 340.729601][T22421] team0: Port device dummy0 added [ 340.742474][T22421] netlink: 'syz.1.5982': attribute type 10 has an invalid length. [ 340.764423][T22429] Invalid argument reading file caps for ./file0 [ 340.771011][T22421] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 340.782755][T22431] ALSA: seq fatal error: cannot create timer (-19) [ 340.791523][T22421] team0: Failed to send options change via netlink (err -105) [ 340.799003][T22421] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 340.823811][T22421] team0: Port device dummy0 removed [ 340.832214][T22421] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 340.859179][T22437] bond3 (unregistering): Released all slaves [ 340.962629][T22448] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5993'. [ 341.012100][T22454] netlink: 12 bytes leftover after parsing attributes in process `ÿ'. [ 341.041316][T22458] loop6: detected capacity change from 0 to 1024 [ 341.048398][T22458] ext4: Unknown parameter 'noacl' [ 341.091860][T22469] ALSA: seq fatal error: cannot create timer (-19) [ 341.127625][T22476] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 341.135690][T22476] IPVS: stopping backup sync thread 22479 ... [ 341.178162][T22483] bond1 (unregistering): Released all slaves [ 341.200991][T22488] smc: net device hsr0 applied user defined pnetid SYZ2 [ 341.208443][T22488] smc: net device hsr0 erased user defined pnetid SYZ2 [ 341.230793][T22491] FAULT_INJECTION: forcing a failure. [ 341.230793][T22491] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 341.232402][T22492] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 341.244036][T22491] CPU: 0 UID: 0 PID: 22491 Comm: syz.6.6012 Not tainted syzkaller #0 PREEMPT(voluntary) [ 341.244063][T22491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 341.244076][T22491] Call Trace: [ 341.244082][T22491] [ 341.244089][T22491] __dump_stack+0x1d/0x30 [ 341.244110][T22491] dump_stack_lvl+0x95/0xd0 [ 341.244133][T22491] dump_stack+0x15/0x1b [ 341.244152][T22491] should_fail_ex+0x265/0x280 [ 341.244176][T22491] should_fail+0xb/0x20 [ 341.244195][T22491] should_fail_usercopy+0x1a/0x20 [ 341.244236][T22491] _copy_from_user+0x1c/0xb0 [ 341.244327][T22491] __sys_bpf+0x183/0x7c0 [ 341.244354][T22491] __x64_sys_bpf+0x41/0x50 [ 341.244490][T22491] x64_sys_call+0x28e1/0x3000 [ 341.244514][T22491] do_syscall_64+0xca/0x2b0 [ 341.244547][T22491] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 341.244568][T22491] RIP: 0033:0x7fa2fce2f749 [ 341.244627][T22491] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 341.244701][T22491] RSP: 002b:00007fa2fb88f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 341.244720][T22491] RAX: ffffffffffffffda RBX: 00007fa2fd085fa0 RCX: 00007fa2fce2f749 [ 341.244733][T22491] RDX: 0000000000000048 RSI: 00002000000008c0 RDI: 0000000000000000 [ 341.244784][T22491] RBP: 00007fa2fb88f090 R08: 0000000000000000 R09: 0000000000000000 [ 341.244804][T22491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 341.244817][T22491] R13: 00007fa2fd086038 R14: 00007fa2fd085fa0 R15: 00007ffc33dcb0d8 [ 341.244912][T22491] [ 341.513863][ T29] kauditd_printk_skb: 932 callbacks suppressed [ 341.513876][ T29] audit: type=1400 audit(1768150546.263:64440): avc: denied { read } for pid=22506 comm="wg1" name="autofs" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 341.543185][ T29] audit: type=1400 audit(1768150546.263:64441): avc: denied { open } for pid=22506 comm="wg1" path="/dev/autofs" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 341.566459][ T29] audit: type=1400 audit(1768150546.263:64442): avc: denied { ioctl } for pid=22506 comm="wg1" path="/dev/autofs" dev="devtmpfs" ino=91 ioctlcmd=0x9374 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 341.567475][T22507] loop6: detected capacity change from 0 to 512 [ 341.601034][ T29] audit: type=1326 audit(1768150546.353:64443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22506 comm="wg1" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa2fce2f749 code=0x0 [ 341.623865][T22508] loop2: detected capacity change from 0 to 512 [ 341.630670][T22508] ext4: Bad value for 'resgid' [ 341.635460][T22508] ext4: Bad value for 'resgid' [ 341.892225][ T29] audit: type=1400 audit(1768150546.633:64444): avc: denied { read write } for pid=22519 comm="syz.3.6022" name="sg0" dev="devtmpfs" ino=137 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 341.916615][ T29] audit: type=1400 audit(1768150546.633:64445): avc: denied { open } for pid=22519 comm="syz.3.6022" path="/dev/sg0" dev="devtmpfs" ino=137 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 341.940722][ T29] audit: type=1400 audit(1768150546.633:64446): avc: denied { ioctl } for pid=22519 comm="syz.3.6022" path="/dev/sg0" dev="devtmpfs" ino=137 ioctlcmd=0x227b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 341.974219][ T29] audit: type=1400 audit(1768150546.733:64447): avc: denied { read } for pid=22519 comm="syz.3.6022" name="qrtr-tun" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 341.997272][ T29] audit: type=1400 audit(1768150546.733:64448): avc: denied { open } for pid=22519 comm="syz.3.6022" path="/dev/qrtr-tun" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 342.023538][T22522] sch_tbf: burst 6 is lower than device ip6gre0 mtu (1448) ! [ 342.049305][ T29] audit: type=1400 audit(1768150546.773:64449): avc: denied { write } for pid=22517 comm="syz.1.6021" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 342.113824][T22530] __nla_validate_parse: 4 callbacks suppressed [ 342.113838][T22530] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6025'. [ 342.138073][T22531] loop1: detected capacity change from 0 to 164 [ 342.145402][T22531] iso9660: Unknown parameter 'Ôeth0_to_bridge' [ 342.286888][T22547] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6033'. [ 342.287263][T22545] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6032'. [ 342.308580][T22545] siw: device registration error -23 [ 342.366193][T22554] netlink: 4 bytes leftover after parsing attributes in process `ÿ'. [ 342.583397][T22563] loop6: detected capacity change from 0 to 2048 [ 342.603462][T22567] loop2: detected capacity change from 0 to 512 [ 342.610953][T22567] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 342.621258][T22563] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 342.765250][T22567] EXT4-fs (loop2): 1 truncate cleaned up [ 342.771836][T19064] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 342.772498][T22567] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 342.860647][T13133] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 342.883459][T22599] netlink: 24 bytes leftover after parsing attributes in process `syz.6.6044'. [ 342.900378][T22602] netlink: 'syz.3.6048': attribute type 9 has an invalid length. [ 342.938120][T22608] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6050'. [ 343.191524][T22629] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 343.203347][T22629] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 343.555002][T22637] netlink: 4 bytes leftover after parsing attributes in process `ÿ'. [ 343.583959][T22639] set_capacity_and_notify: 1 callbacks suppressed [ 343.584016][T22639] loop1: detected capacity change from 0 to 732 [ 343.597217][T22639] isofs_fill_super: get root inode failed [ 343.648770][T22643] netlink: 'syz.0.6063': attribute type 9 has an invalid length. [ 343.699471][T22648] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6064'. [ 343.873893][T22660] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6070'. [ 343.979042][T22661] lo speed is unknown, defaulting to 1000 [ 344.085503][T22661] chnl_net:caif_netlink_parms(): no params data found [ 344.164074][T22678] loop6: detected capacity change from 0 to 2048 [ 344.181962][T22678] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 344.299446][T19064] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 344.571851][T10227] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 344.580705][T10227] bond0 (unregistering): Released all slaves [ 344.632211][T22661] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.639371][T22661] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.646714][T22661] bridge_slave_0: entered allmulticast mode [ 344.653310][T22661] bridge_slave_0: entered promiscuous mode [ 344.661950][T10227] hsr_slave_0: left promiscuous mode [ 344.667477][T10227] hsr_slave_1: left promiscuous mode [ 344.792258][T22661] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.799398][T22661] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.819478][T22661] bridge_slave_1: entered allmulticast mode [ 344.826542][T22661] bridge_slave_1: entered promiscuous mode [ 344.846497][T22661] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 344.857581][T22661] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 344.888541][T22661] team0: Port device team_slave_0 added [ 344.896659][T22661] team0: Port device team_slave_1 added [ 344.914886][T22661] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 344.921993][T22661] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 344.947959][T22661] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 344.974024][T22661] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 344.981125][T22661] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.007045][T22661] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 345.027136][T22719] lo speed is unknown, defaulting to 1000 [ 345.037895][T22735] loop1: detected capacity change from 0 to 512 [ 345.050883][T22735] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 345.082894][T22661] hsr_slave_0: entered promiscuous mode [ 345.089104][T22661] hsr_slave_1: entered promiscuous mode [ 345.089225][T22735] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 345.095194][T22661] debugfs: 'hsr0' already exists in 'hsr' [ 345.112928][T22661] Cannot create hsr debugfs directory [ 345.120732][T22735] ext4 filesystem being mounted at /103/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 345.141490][T10227] IPVS: stop unused estimator thread 0... [ 345.192963][T20797] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 345.249473][T22749] netlink: 'syz.6.6088': attribute type 9 has an invalid length. [ 345.367097][T22754] ALSA: seq fatal error: cannot create timer (-19) [ 345.389092][T22758] xt_CT: No such helper "snmp_trap" [ 345.670973][T22661] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 345.682088][T22766] loop1: detected capacity change from 0 to 1024 [ 345.710880][T22766] EXT4-fs: Ignoring removed nomblk_io_submit option [ 345.719948][T22661] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 345.748895][T22661] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 345.774978][T22766] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 345.787615][T22661] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 345.798822][T22766] System zones: 0-1, 3-36 [ 345.816986][T22766] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 345.893376][T22766] siw: device registration error -23 [ 345.917807][T22661] 8021q: adding VLAN 0 to HW filter on device bond0 [ 345.952727][T22781] loop3: detected capacity change from 0 to 512 [ 345.961472][T22661] 8021q: adding VLAN 0 to HW filter on device team0 [ 345.980286][T22781] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 345.995965][T10236] bridge0: port 1(bridge_slave_0) entered blocking state [ 346.003054][T10236] bridge0: port 1(bridge_slave_0) entered forwarding state [ 346.024349][T20797] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 346.050353][T22781] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 346.064474][T10236] bridge0: port 2(bridge_slave_1) entered blocking state [ 346.071549][T10236] bridge0: port 2(bridge_slave_1) entered forwarding state [ 346.101705][T22781] ext4 filesystem being mounted at /533/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 346.116571][T22785] syzkaller0: entered promiscuous mode [ 346.122127][T22785] syzkaller0: entered allmulticast mode [ 346.152825][T14695] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 346.182269][T22661] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 346.270829][T22809] xt_CT: No such helper "snmp_trap" [ 346.985756][T22824] ip6gre0: entered promiscuous mode [ 347.011803][T22824] team0: Device ip6gre0 is of different type [ 347.035319][T22826] netlink: 'syz.0.6109': attribute type 1 has an invalid length. [ 347.041428][T22661] veth0_vlan: entered promiscuous mode [ 347.059482][T22661] veth1_vlan: entered promiscuous mode [ 347.087287][T22661] veth0_macvtap: entered promiscuous mode [ 347.099212][ T29] kauditd_printk_skb: 464 callbacks suppressed [ 347.099225][ T29] audit: type=1326 audit(1768150551.853:64914): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22827 comm="syz.6.6111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2fce2f749 code=0x7ffc0000 [ 347.132362][T22661] veth1_macvtap: entered promiscuous mode [ 347.138271][ T29] audit: type=1326 audit(1768150551.883:64915): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22827 comm="syz.6.6111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa2fce2f749 code=0x7ffc0000 [ 347.171717][T22661] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 347.177638][ T29] audit: type=1326 audit(1768150551.883:64916): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22827 comm="syz.6.6111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2fce2f749 code=0x7ffc0000 [ 347.195257][T22661] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 347.202603][ T29] audit: type=1326 audit(1768150551.883:64917): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22827 comm="syz.6.6111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2fce2f749 code=0x7ffc0000 [ 347.233280][ T29] audit: type=1326 audit(1768150551.923:64918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22827 comm="syz.6.6111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa2fce2f749 code=0x7ffc0000 [ 347.256946][ T29] audit: type=1326 audit(1768150551.923:64919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22827 comm="syz.6.6111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2fce2f749 code=0x7ffc0000 [ 347.280629][ T29] audit: type=1326 audit(1768150551.923:64920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22827 comm="syz.6.6111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2fce2f749 code=0x7ffc0000 [ 347.304578][ T29] audit: type=1326 audit(1768150551.923:64921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22827 comm="syz.6.6111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=459 compat=0 ip=0x7fa2fce2f749 code=0x7ffc0000 [ 347.328600][ T29] audit: type=1326 audit(1768150551.923:64922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22827 comm="syz.6.6111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2fce2f749 code=0x7ffc0000 [ 347.352262][ T29] audit: type=1326 audit(1768150551.923:64923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22827 comm="syz.6.6111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa2fce2f749 code=0x7ffc0000 [ 347.392229][T22836] netlink: 'syz.6.6114': attribute type 9 has an invalid length. [ 347.418657][T10227] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.429663][T22830] syzkaller0: entered promiscuous mode [ 347.435314][T22830] syzkaller0: entered allmulticast mode [ 347.484580][T10227] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.496158][T22843] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 347.535942][T10227] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.562034][T10227] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.606490][T22852] lo speed is unknown, defaulting to 1000 [ 347.656420][T22859] netlink: 'syz.1.6116': attribute type 10 has an invalid length. [ 347.670962][T22859] bond0: (slave dummy0): Releasing backup interface [ 347.691011][T22859] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 347.704595][T22861] netlink: 'syz.6.6122': attribute type 9 has an invalid length. [ 347.728115][T22859] team0: Failed to send options change via netlink (err -105) [ 347.735693][T22859] team0: Port device dummy0 added [ 347.896678][T22848] netlink: 'syz.1.6116': attribute type 10 has an invalid length. [ 347.911326][T22848] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 347.938180][T22848] team0: Failed to send options change via netlink (err -105) [ 347.958735][T22848] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 347.968196][T22848] team0: Port device dummy0 removed [ 347.976121][T22848] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 347.982361][T22870] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6123'. [ 347.993681][T22870] netlink: 20 bytes leftover after parsing attributes in process `syz.6.6123'. [ 348.004959][T22852] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6118'. [ 348.018784][T22870] bridge0: port 3(gretap0) entered blocking state [ 348.025437][T22870] bridge0: port 3(gretap0) entered disabled state [ 348.032069][T22870] gretap0: entered allmulticast mode [ 348.037916][T22870] gretap0: entered promiscuous mode [ 348.043899][T22870] bridge0: port 3(gretap0) entered blocking state [ 348.050363][T22870] bridge0: port 3(gretap0) entered forwarding state [ 348.085079][T22870] gretap0: left allmulticast mode [ 348.090267][T22870] gretap0: left promiscuous mode [ 348.095326][T22870] bridge0: port 3(gretap0) entered disabled state [ 348.110161][T22870] loop6: detected capacity change from 0 to 512 [ 348.115011][T22875] loop1: detected capacity change from 0 to 256 [ 348.124281][T22870] EXT4-fs (loop6): feature flags set on rev 0 fs, running e2fsck is recommended [ 348.149363][T22870] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=42c028, mo2=0002] [ 348.161532][T22870] EXT4-fs (loop6): orphan cleanup on readonly fs [ 348.169172][T22870] EXT4-fs error (device loop6): mb_free_blocks:2037: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 348.184340][T22870] EXT4-fs (loop6): Remounting filesystem read-only [ 348.191022][T22870] EXT4-fs (loop6): 1 truncate cleaned up [ 348.196830][T10236] EXT4-fs (loop6): Quota write (off=8192, len=1024) cancelled because transaction is not started [ 348.207559][T10236] EXT4-fs (loop6): Quota write (off=8192, len=1024) cancelled because transaction is not started [ 348.230127][T10236] EXT4-fs (loop6): Quota write (off=8, len=24) cancelled because transaction is not started [ 348.262644][T22870] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 348.268173][T22887] loop2: detected capacity change from 0 to 512 [ 348.295079][T22887] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 348.309484][T22889] syzkaller0: entered promiscuous mode [ 348.315043][T22889] syzkaller0: entered allmulticast mode [ 348.343572][T22887] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 348.345948][T22885] netlink: 'syz.1.6129': attribute type 10 has an invalid length. [ 348.356276][T22887] ext4 filesystem being mounted at /4/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 348.374413][T22885] bond0: (slave dummy0): Releasing backup interface [ 348.384723][T22885] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 348.393711][T22885] team0: Failed to send options change via netlink (err -105) [ 348.401287][T22885] team0: Port device dummy0 added [ 348.407471][T22661] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 348.427631][T22885] netlink: 'syz.1.6129': attribute type 10 has an invalid length. [ 348.436357][T22885] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 348.467813][T22885] team0: Failed to send options change via netlink (err -105) [ 348.475520][T22885] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 348.487099][T22885] team0: Port device dummy0 removed [ 348.494986][T22885] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 348.552832][T22897] loop2: detected capacity change from 0 to 2048 [ 348.605620][T22897] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 348.632813][T22912] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 348.649968][T22912] IPVS: stopping backup sync thread 22913 ... [ 348.707607][T22917] siw: device registration error -23 [ 348.717506][T22918] netlink: 'syz.1.6139': attribute type 1 has an invalid length. [ 348.730684][T22918] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6139'. [ 348.741337][T19064] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 348.884606][T22953] loop6: detected capacity change from 0 to 2048 [ 348.918753][T22953] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 348.931397][T22661] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 349.015340][T22964] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 349.018098][T22961] ALSA: seq fatal error: cannot create timer (-19) [ 349.083085][T22976] netlink: 'syz.1.6149': attribute type 9 has an invalid length. [ 349.113757][T22975] loop2: detected capacity change from 0 to 2048 [ 349.135197][T19064] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 349.169558][T22975] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 349.198624][T22984] loop1: detected capacity change from 0 to 256 [ 349.270442][T23007] syzkaller0: entered allmulticast mode [ 349.280482][T23007] syzkaller0: entered promiscuous mode [ 349.296864][T23007] syzkaller0 (unregistering): left promiscuous mode [ 349.303583][T23007] syzkaller0 (unregistering): left allmulticast mode [ 349.323731][T23021] netlink: 'syz.6.6153': attribute type 1 has an invalid length. [ 349.372455][T23021] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6153'. [ 349.419366][T23027] netlink: 4 bytes leftover after parsing attributes in process `ÿ'. [ 349.437494][T23029] loop3: detected capacity change from 0 to 512 [ 349.444748][T23029] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 349.471451][T22661] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 349.481729][T23029] EXT4-fs (loop3): 1 truncate cleaned up [ 349.489479][T23029] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 349.538556][T23039] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6162'. [ 349.637410][T23047] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6164'. [ 349.650106][T23046] loop6: detected capacity change from 0 to 1024 [ 349.676581][T14695] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 349.693520][T23049] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6164'. [ 349.694129][T23046] EXT4-fs: Ignoring removed bh option [ 349.732242][T23046] EXT4-fs: inline encryption not supported [ 349.749866][T23046] EXT4-fs (loop6): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 349.792174][T23046] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 349.800983][T23047] loop2: detected capacity change from 0 to 512 [ 349.814727][T23047] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 349.827587][T23046] EXT4-fs error (device loop6): ext4_map_blocks:783: inode #3: block 2: comm syz.6.6165: lblock 2 mapped to illegal pblock 2 (length 1) [ 349.856032][T23047] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 349.872899][T23046] EXT4-fs error (device loop6): ext4_map_blocks:783: inode #3: block 48: comm syz.6.6165: lblock 0 mapped to illegal pblock 48 (length 1) [ 349.897952][T23059] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6166'. [ 349.935962][T23060] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 349.959617][T23046] EXT4-fs error (device loop6): ext4_acquire_dquot:6986: comm syz.6.6165: Failed to acquire dquot type 0 [ 350.002455][T23046] EXT4-fs error (device loop6) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 350.015109][T23046] EXT4-fs error (device loop6): ext4_evict_inode:253: inode #11: comm syz.6.6165: mark_inode_dirty error [ 350.067058][T23077] loop2: detected capacity change from 0 to 512 [ 350.074025][T23077] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 350.085567][T23046] EXT4-fs warning (device loop6): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 350.096025][T23046] EXT4-fs (loop6): 1 orphan inode deleted [ 350.102196][T23046] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 350.136875][T23081] ip6gre0: entered promiscuous mode [ 350.142408][T10213] EXT4-fs error (device loop6): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:31: lblock 1 mapped to illegal pblock 1 (length 1) [ 350.160815][T23081] team0: Device ip6gre0 is of different type [ 350.192206][T23077] EXT4-fs (loop2): 1 truncate cleaned up [ 350.198879][T10213] EXT4-fs error (device loop6): ext4_release_dquot:7022: comm kworker/u8:31: Failed to release dquot type 0 [ 350.211947][T23077] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 350.224131][T23085] loop3: detected capacity change from 0 to 512 [ 350.225881][T23046] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 350.239713][T23085] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 350.249613][T23085] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 350.249935][T23046] EXT4-fs error (device loop6): __ext4_get_inode_loc:4830: comm syz.6.6165: Invalid inode table block 1 in block_group 0 [ 350.258656][T23085] EXT4-fs (loop3): The Hurd can't support 64-bit file systems [ 350.293431][T23083] syzkaller0: entered promiscuous mode [ 350.298985][T23083] syzkaller0: entered allmulticast mode [ 350.324285][T23046] EXT4-fs error (device loop6) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 350.344920][T23046] EXT4-fs error (device loop6): ext4_quota_off:7270: inode #3: comm syz.6.6165: mark_inode_dirty error [ 350.369815][T22661] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 350.436300][T23091] team0: Device ip6gre0 is of different type [ 350.494790][T23093] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 350.872125][T23112] syzkaller0: entered allmulticast mode [ 350.907506][T23112] syzkaller0: entered promiscuous mode [ 350.949077][T23116] loop3: detected capacity change from 0 to 1024 [ 350.992338][T23112] syzkaller0 (unregistering): left promiscuous mode [ 350.998968][T23112] syzkaller0 (unregistering): left allmulticast mode [ 351.009277][T23116] EXT4-fs: Ignoring removed bh option [ 351.046458][T23116] EXT4-fs: inline encryption not supported [ 351.059388][T23116] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 351.070843][T23116] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 351.082968][T23116] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 2: comm syz.3.6190: lblock 2 mapped to illegal pblock 2 (length 1) [ 351.097257][T23116] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 48: comm syz.3.6190: lblock 0 mapped to illegal pblock 48 (length 1) [ 351.112669][T23120] siw: device registration error -23 [ 351.126749][T23116] EXT4-fs error (device loop3): ext4_acquire_dquot:6986: comm syz.3.6190: Failed to acquire dquot type 0 [ 351.138691][T23116] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 351.159537][T23116] EXT4-fs error (device loop3): ext4_evict_inode:253: inode #11: comm syz.3.6190: mark_inode_dirty error [ 351.172322][T23116] EXT4-fs warning (device loop3): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 351.182770][T23116] EXT4-fs (loop3): 1 orphan inode deleted [ 351.188904][T23116] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 351.197543][T23113] lo speed is unknown, defaulting to 1000 [ 351.207238][T10233] EXT4-fs error (device loop3): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:51: lblock 1 mapped to illegal pblock 1 (length 1) [ 351.250883][T10233] EXT4-fs error (device loop3): ext4_release_dquot:7022: comm kworker/u8:51: Failed to release dquot type 0 [ 351.272282][T23116] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 351.289142][T23116] EXT4-fs error (device loop3): __ext4_get_inode_loc:4830: comm syz.3.6190: Invalid inode table block 1 in block_group 0 [ 351.303806][T23130] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 351.312578][T23116] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 351.323336][T23116] EXT4-fs error (device loop3): ext4_quota_off:7270: inode #3: comm syz.3.6190: mark_inode_dirty error [ 351.338777][T23135] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvlan0, syncid = 0, id = 0 [ 351.338809][T23134] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 351.356128][T23130] IPVS: stopping backup sync thread 23135 ... [ 351.438065][T23140] smc: net device hsr0 applied user defined pnetid SYZ2 [ 351.456671][T23137] veth1_macvtap: left promiscuous mode [ 351.476353][T23145] xt_CT: No such helper "snmp_trap" [ 351.482452][T23140] smc: net device hsr0 erased user defined pnetid SYZ2 [ 351.598039][T23148] loop3: detected capacity change from 0 to 1024 [ 351.617932][T23148] EXT4-fs: Ignoring removed nomblk_io_submit option [ 351.661547][T23137] ext4: Bad value for 'resgid' [ 351.666448][T23137] ext4: Bad value for 'resgid' [ 351.725116][T23148] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 351.746811][T10233] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 351.811897][T23148] System zones: 0-1, 3-36 [ 351.864387][T23148] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 351.935180][T10233] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.050748][T23148] siw: device registration error -23 [ 352.120199][T10233] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.165012][T14695] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 352.204545][T10233] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.249483][T23170] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 352.286420][T23157] lo speed is unknown, defaulting to 1000 [ 352.292672][T23175] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 352.318562][T23170] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 352.332535][T10233] bridge_slave_1: left allmulticast mode [ 352.338177][T10233] bridge_slave_1: left promiscuous mode [ 352.343871][T10233] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.350758][T23170] ext4 filesystem being mounted at /547/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 352.371123][T10233] bridge_slave_0: left allmulticast mode [ 352.376892][T10233] bridge_slave_0: left promiscuous mode [ 352.382771][T10233] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.390837][T14695] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 352.391133][T23175] EXT4-fs (loop1): 1 truncate cleaned up [ 352.408784][T23175] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 352.427033][ T29] kauditd_printk_skb: 1071 callbacks suppressed [ 352.427047][ T29] audit: type=1400 audit(1768150557.173:65981): avc: denied { execute } for pid=23184 comm="syz.3.6214" name="file0" dev="tmpfs" ino=2943 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 352.513113][ T29] audit: type=1400 audit(1768150557.173:65982): avc: denied { execute_no_trans } for pid=23184 comm="syz.3.6214" path="/548/file0" dev="tmpfs" ino=2943 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 352.599035][T20797] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 352.621096][ T29] audit: type=1400 audit(1768150557.373:65983): avc: denied { name_bind } for pid=23198 comm="syz.3.6219" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 352.645701][ T29] audit: type=1400 audit(1768150557.373:65984): avc: denied { node_bind } for pid=23198 comm="syz.3.6219" saddr=224.0.0.1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 352.675222][T10233] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 352.686869][T10233] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 352.699168][ T29] audit: type=1400 audit(1768150557.453:65985): avc: denied { create } for pid=23210 comm="syz.3.6221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 352.730629][ T29] audit: type=1400 audit(1768150557.453:65986): avc: denied { bind } for pid=23210 comm="syz.3.6221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 352.751554][T10233] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 352.759665][ T29] audit: type=1400 audit(1768150557.503:65987): avc: denied { write } for pid=23210 comm="syz.3.6221" path="socket:[82046]" dev="sockfs" ino=82046 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 352.784384][T10233] bond0 (unregistering): Released all slaves [ 352.818866][ T29] audit: type=1326 audit(1768150557.563:65988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23212 comm="syz.1.6222" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c7fd3f749 code=0x7ffc0000 [ 352.852419][T23216] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 352.880311][ T29] audit: type=1326 audit(1768150557.563:65989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23212 comm="syz.1.6222" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c7fd3f749 code=0x7ffc0000 [ 352.903921][ T29] audit: type=1326 audit(1768150557.563:65990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23212 comm="syz.1.6222" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c7fd3f749 code=0x7ffc0000 [ 352.932807][T23216] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 352.949887][T23216] ext4 filesystem being mounted at /260/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 352.996338][T19064] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 353.012712][T10233] hsr_slave_0: left promiscuous mode [ 353.018741][T10233] hsr_slave_1: left promiscuous mode [ 353.028647][T10233] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 353.036087][T10233] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 353.069366][T23226] EXT4-fs: Ignoring removed bh option [ 353.075180][T23226] EXT4-fs: inline encryption not supported [ 353.080722][T23229] validate_nla: 2 callbacks suppressed [ 353.080737][T23229] netlink: 'syz.1.6222': attribute type 10 has an invalid length. [ 353.095004][T10233] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 353.095016][T23226] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 353.102460][T10233] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 353.120571][T23226] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 353.132514][T10233] veth1_macvtap: left promiscuous mode [ 353.133239][T23213] netlink: 'syz.1.6222': attribute type 10 has an invalid length. [ 353.137990][T10233] veth0_macvtap: left promiscuous mode [ 353.151397][T10233] veth1_vlan: left promiscuous mode [ 353.156611][T10233] veth0_vlan: left promiscuous mode [ 353.204389][T23226] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #3: block 2: comm syz.2.6226: lblock 2 mapped to illegal pblock 2 (length 1) [ 353.218830][T23226] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #3: block 48: comm syz.2.6226: lblock 0 mapped to illegal pblock 48 (length 1) [ 353.236525][T23226] EXT4-fs error (device loop2): ext4_acquire_dquot:6986: comm syz.2.6226: Failed to acquire dquot type 0 [ 353.248705][T23226] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 353.258340][T23226] EXT4-fs error (device loop2): ext4_evict_inode:253: inode #11: comm syz.2.6226: mark_inode_dirty error [ 353.258534][T10233] team0 (unregistering): Port device team_slave_1 removed [ 353.270637][T23226] EXT4-fs warning (device loop2): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 353.287265][T10233] team0 (unregistering): Port device team_slave_0 removed [ 353.287371][T23226] EXT4-fs (loop2): 1 orphan inode deleted [ 353.300645][T10238] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:56: lblock 1 mapped to illegal pblock 1 (length 1) [ 353.300798][T23226] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 353.316448][T10238] EXT4-fs error (device loop2): ext4_release_dquot:7022: comm kworker/u8:56: Failed to release dquot type 0 [ 353.342137][T23226] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 353.351537][T23226] EXT4-fs error (device loop2): __ext4_get_inode_loc:4830: comm syz.2.6226: Invalid inode table block 1 in block_group 0 [ 353.364471][T23226] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 353.374626][T23226] EXT4-fs error (device loop2): ext4_quota_off:7270: inode #3: comm syz.2.6226: mark_inode_dirty error [ 353.386142][T23229] bond0: (slave dummy0): Releasing backup interface [ 353.412124][T23229] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 353.428223][T23229] team0: Failed to send options change via netlink (err -105) [ 353.435784][T23229] team0: Port device dummy0 added [ 353.446691][T23213] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 353.466531][T23213] team0: Failed to send options change via netlink (err -105) [ 353.474248][T23213] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 353.483309][T23213] team0: Port device dummy0 removed [ 353.491007][T23213] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 353.519236][T23157] chnl_net:caif_netlink_parms(): no params data found [ 353.553277][T23245] smc: net device hsr0 applied user defined pnetid SYZ2 [ 353.640904][T23254] netlink: 'syz.2.6237': attribute type 9 has an invalid length. [ 353.641511][T23252] EXT4-fs: Ignoring removed nomblk_io_submit option [ 353.657080][T23157] bridge0: port 1(bridge_slave_0) entered blocking state [ 353.664196][T23157] bridge0: port 1(bridge_slave_0) entered disabled state [ 353.679857][T23257] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 353.694449][T23252] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 353.697299][T23157] bridge_slave_0: entered allmulticast mode [ 353.709933][T23252] System zones: 0-1, 3-36 [ 353.710544][T23257] ext4 filesystem being mounted at /554/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 353.725623][T23157] bridge_slave_0: entered promiscuous mode [ 353.744172][T23157] bridge0: port 2(bridge_slave_1) entered blocking state [ 353.751390][T23157] bridge0: port 2(bridge_slave_1) entered disabled state [ 353.752680][T23243] netlink: 'syz.1.6232': attribute type 10 has an invalid length. [ 353.759634][T23157] bridge_slave_1: entered allmulticast mode [ 353.773195][T23157] bridge_slave_1: entered promiscuous mode [ 353.783185][T23243] bond0: (slave dummy0): Releasing backup interface [ 353.791878][T23252] siw: device registration error -23 [ 353.802068][T23243] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 353.811147][T23243] team0: Failed to send options change via netlink (err -105) [ 353.818634][T23243] team0: Port device dummy0 added [ 353.819274][T23264] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 353.830856][T23265] netlink: 'syz.1.6232': attribute type 10 has an invalid length. [ 353.848765][T23264] EXT4-fs (loop2): 1 truncate cleaned up [ 353.856894][T23265] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 353.868295][T23268] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 353.893718][T23268] EXT4-fs (loop3): 1 truncate cleaned up [ 353.902069][T23265] team0: Failed to send options change via netlink (err -105) [ 353.911203][T23265] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 353.920658][T23265] team0: Port device dummy0 removed [ 353.928818][T23265] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 353.941378][T23157] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 353.965553][T23157] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 354.001254][T23157] team0: Port device team_slave_0 added [ 354.008620][T23157] team0: Port device team_slave_1 added [ 354.033715][T23282] netlink: 'syz.2.6241': attribute type 10 has an invalid length. [ 354.048394][T23282] team0: Failed to send options change via netlink (err -105) [ 354.055916][T23282] team0: Port device dummy0 added [ 354.091872][T23288] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 354.100963][T23275] netlink: 'syz.2.6241': attribute type 10 has an invalid length. [ 354.112029][T23292] __nla_validate_parse: 10 callbacks suppressed [ 354.112044][T23292] netlink: 4 bytes leftover after parsing attributes in process `ÿ'. [ 354.126534][T23157] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 354.133557][T23157] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 354.133707][T23290] set_capacity_and_notify: 10 callbacks suppressed [ 354.133721][T23290] loop6: detected capacity change from 0 to 512 [ 354.159561][T23157] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 354.161365][T23157] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 354.189922][T23157] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 354.216077][T23157] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 354.227388][T23275] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 354.239575][T23290] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 354.248152][T23275] team0: Failed to send options change via netlink (err -105) [ 354.251929][T23290] ext4 filesystem being mounted at /270/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 354.256015][T23275] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 354.275089][T23275] team0: Port device dummy0 removed [ 354.282643][T23275] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 354.321075][T23157] hsr_slave_0: entered promiscuous mode [ 354.340193][T23304] xt_CT: No such helper "snmp_trap" [ 354.359252][T23157] hsr_slave_1: entered promiscuous mode [ 354.366162][T23157] debugfs: 'hsr0' already exists in 'hsr' [ 354.371994][T23157] Cannot create hsr debugfs directory [ 354.377786][T23294] syzkaller0: entered promiscuous mode [ 354.383281][T23294] syzkaller0: entered allmulticast mode [ 354.574562][T23310] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0' [ 354.942392][T23316] ALSA: seq fatal error: cannot create timer (-19) [ 355.082124][T23157] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 355.092115][T23157] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 355.101111][T23157] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 355.111156][T23157] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 355.123821][T23321] lo speed is unknown, defaulting to 1000 [ 355.223688][T23157] 8021q: adding VLAN 0 to HW filter on device bond0 [ 355.244541][T23332] cgroup: Need name or subsystem set [ 355.264133][T23157] 8021q: adding VLAN 0 to HW filter on device team0 [ 355.297475][T23332] ------------[ cut here ]------------ [ 355.303023][T23332] verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0xfffffffefffff630, 0xffffffff00000000] s64=[0xfffffffefffff630, 0xffffffff00000000] u32=[0x30, 0x8000050] s32=[0x30, 0x0] var_off=(0xfffffffe00000030, 0x10fffffc0) [ 355.326786][T23332] WARNING: kernel/bpf/verifier.c:2748 at reg_bounds_sanity_check+0x15b/0x660, CPU#0: syz.2.6259/23332 [ 355.337951][T23332] Modules linked in: [ 355.341946][T23332] CPU: 0 UID: 0 PID: 23332 Comm: syz.2.6259 Not tainted syzkaller #0 PREEMPT(voluntary) [ 355.342941][T23333] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6259'. [ 355.351880][T23332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 355.370987][T23332] RIP: 0010:reg_bounds_sanity_check+0x27d/0x660 [ 355.377243][T23332] Code: 24 78 4c 8b 44 24 70 4c 8b 4c 24 60 41 ff 74 24 20 41 55 53 ff 74 24 68 ff 74 24 78 ff b4 24 90 00 00 00 ff b4 24 b0 00 00 00 <67> 48 0f b9 3a 48 83 c4 38 4c 8b ac 24 98 00 00 00 49 8d 85 80 08 [ 355.396946][T23332] RSP: 0018:ffffc9000173f3a0 EFLAGS: 00010246 [ 355.403047][T23332] RAX: ffff8881019f6d90 RBX: 0000000000000000 RCX: fffffffefffff630 [ 355.411182][T23332] RDX: ffffffff865fbe83 RSI: ffffffff865d09b7 RDI: ffffffff86db6a10 [ 355.419148][T23332] RBP: ffff88811c307190 R08: ffffffff00000000 R09: fffffffefffff630 [ 355.427159][T23332] R10: 00000000000000d0 R11: 0000000000000002 R12: ffff88811c307150 [ 355.435255][T23332] R13: fffffffe00000030 R14: ffff88811c30719c R15: ffff88811c307188 [ 355.443253][T23332] FS: 00007fb16bf176c0(0000) GS:ffff8882aedc5000(0000) knlGS:0000000000000000 [ 355.452218][T23332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 355.458850][T23332] CR2: 0000001b3460eff8 CR3: 000000011b278000 CR4: 00000000003506f0 [ 355.466845][T23332] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 355.474841][T23332] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 355.483323][T23332] Call Trace: [ 355.486745][T23332] [ 355.489674][T23332] reg_set_min_max+0x21c/0x260 [ 355.494472][T23332] check_cond_jmp_op+0x13bd/0x1a80 [ 355.499591][T23332] do_check+0x3347/0x81f0 [ 355.503967][T23332] do_check_common+0xccf/0x1300 [ 355.508829][T23332] bpf_check+0x2f98/0xc860 [ 355.513313][T23332] ? __alloc_frozen_pages_noprof+0x18f/0x360 [ 355.519367][T23332] ? alloc_pages_bulk_noprof+0x4b9/0x540 [ 355.525098][T23332] ? __vmap_pages_range_noflush+0xbc4/0xcf0 [ 355.531017][T23332] ? pcpu_block_update+0x24e/0x3b0 [ 355.536139][T23332] ? pcpu_block_refresh_hint+0x157/0x170 [ 355.541897][T23332] ? pcpu_block_update_hint_alloc+0x63d/0x660 [ 355.547963][T23332] ? css_rstat_updated+0xbb/0x280 [ 355.553019][T23332] ? mod_memcg_state+0x182/0x270 [ 355.558064][T23332] ? __rcu_read_unlock+0x4f/0x70 [ 355.563025][T23332] ? pcpu_memcg_post_alloc_hook+0xec/0x170 [ 355.568882][T23332] ? bpf_prog_alloc+0x5b/0x150 [ 355.573663][T23332] ? pcpu_alloc_noprof+0xd0d/0x1240 [ 355.578924][T23332] ? should_fail_ex+0x30/0x280 [ 355.582392][T10231] bridge0: port 1(bridge_slave_0) entered blocking state [ 355.583735][T23332] ? __kmalloc_noprof+0x2b4/0x5a0 [ 355.590789][T10231] bridge0: port 1(bridge_slave_0) entered forwarding state [ 355.595827][T23332] ? security_bpf_prog_load+0x60/0x140 [ 355.608454][T23332] ? selinux_bpf_prog_load+0xad/0xd0 [ 355.613838][T23332] ? security_bpf_prog_load+0x9e/0x140 [ 355.616641][T10231] bridge0: port 2(bridge_slave_1) entered blocking state [ 355.619297][T23332] bpf_prog_load+0xf6e/0x1140 [ 355.626324][T10231] bridge0: port 2(bridge_slave_1) entered forwarding state [ 355.631003][T23332] ? security_bpf+0x2b/0x90 [ 355.642673][T23332] __sys_bpf+0x469/0x7c0 [ 355.646940][T23332] __x64_sys_bpf+0x41/0x50 [ 355.651461][T23332] x64_sys_call+0x28e1/0x3000 [ 355.656181][T23332] do_syscall_64+0xca/0x2b0 [ 355.660820][T23332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.666712][T23332] RIP: 0033:0x7fb16d4af749 [ 355.671150][T23332] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 355.690846][T23332] RSP: 002b:00007fb16bf17038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 355.690866][T23332] RAX: ffffffffffffffda RBX: 00007fb16d705fa0 RCX: 00007fb16d4af749 [ 355.690878][T23332] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 355.690931][T23332] RBP: 00007fb16d533f91 R08: 0000000000000000 R09: 0000000000000000 [ 355.723242][T23332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 355.723256][T23332] R13: 00007fb16d706038 R14: 00007fb16d705fa0 R15: 00007ffff808f838 [ 355.723275][T23332] [ 355.723283][T23332] ---[ end trace 0000000000000000 ]--- [ 355.731756][T20996] ================================================================== [ 355.731784][T20996] BUG: KCSAN: data-race in __mod_timer / __mod_timer [ 355.731814][T20996] [ 355.731819][T20996] write to 0xffff88811b1ccae0 of 8 bytes by task 3424 on cpu 0: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 355.731832][T20996] __mod_timer+0x5a1/0x840 [ 355.731853][T20996] mod_timer+0x1f/0x30 [ 355.731873][T20996] wg_timers_any_authenticated_packet_traversal+0xd0/0x100 [ 355.731892][T20996] wg_packet_tx_worker+0xeb/0x330 [ 355.731910][T20996] process_scheduled_works+0x4ce/0x9d0 [ 355.731933][T20996] worker_thread+0x582/0x770 [ 355.731956][T20996] kthread+0x489/0x510 [ 355.731981][T20996] ret_from_fork+0x149/0x290 [ 355.732007][T20996] ret_from_fork_asm+0x1a/0x30 [ 355.732030][T20996] [ 355.732035][T20996] read to 0xffff88811b1ccae0 of 8 bytes by task 20996 on cpu 1: [ 355.732051][T20996] __mod_timer+0x69/0x840 [ 355.732074][T20996] mod_timer+0x1f/0x30 [ 355.732093][T20996] wg_timers_any_authenticated_packet_traversal+0xd0/0x100 [ 355.732119][T20996] wg_packet_rx_poll+0x7f5/0x1160 [ 355.732135][T20996] __napi_poll+0x5f/0x300 [ 355.732166][T20996] napi_threaded_poll_loop+0x1ac/0x630 [ 355.732197][T20996] napi_threaded_poll+0x164/0x200 [ 355.732224][T20996] kthread+0x489/0x510 [ 355.732245][T20996] ret_from_fork+0x149/0x290 [ 355.732264][T20996] ret_from_fork_asm+0x1a/0x30 [ 355.732288][T20996] [ 355.732292][T20996] value changed: 0x0000000100001cec -> 0x0000000100001d05 [ 355.732305][T20996] [ 355.732309][T20996] Reported by Kernel Concurrency Sanitizer on: [ 355.732325][T20996] CPU: 1 UID: 0 PID: 20996 Comm: napi/wg2-0 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 355.732350][T20996] Tainted: [W]=WARN [ 355.732357][T20996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 355.732368][T20996] ================================================================== [ 355.741312][T23321] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6257'. [ 355.742148][T23157] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 355.742201][T23157] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 355.824150][T23342] netlink: 4 bytes leftover after parsing attributes in process `ÿ'. [ 355.844160][T23157] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 355.908027][T23354] loop3: detected capacity change from 0 to 512 [ 355.908614][T23354] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 355.909930][T23354] EXT4-fs (loop3): 1 truncate cleaned up [ 356.285100][T10228] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.352641][T10228] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.452933][T10228] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.503929][T10228] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.572567][T10228] bridge_slave_1: left allmulticast mode [ 356.578230][T10228] bridge_slave_1: left promiscuous mode [ 356.583870][T10228] bridge0: port 2(bridge_slave_1) entered disabled state [ 356.591494][T10228] bridge_slave_0: left allmulticast mode [ 356.597117][T10228] bridge_slave_0: left promiscuous mode [ 356.602910][T10228] bridge0: port 1(bridge_slave_0) entered disabled state [ 356.832381][T10228] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 356.842403][T10228] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 356.851881][T10228] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 356.860875][T10228] bond0 (unregistering): Released all slaves [ 356.893811][T10228] hsr_slave_0: left promiscuous mode [ 356.899458][T10228] hsr_slave_1: left promiscuous mode [ 356.905145][T10228] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 356.912626][T10228] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 356.920027][T10228] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 356.927485][T10228] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 356.936413][T10228] veth1_macvtap: left promiscuous mode [ 356.942039][T10228] veth0_macvtap: left promiscuous mode [ 356.947553][T10228] veth1_vlan: left promiscuous mode [ 356.952854][T10228] veth0_vlan: left promiscuous mode [ 356.996874][T10228] smc: removing net device hsr0 with user defined pnetid SYZ2 [ 357.012664][T10228] team0 (unregistering): Port device team_slave_1 removed [ 357.022919][T10228] team0 (unregistering): Port device team_slave_0 removed [ 358.073675][T10228] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.102678][T10228] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.143416][T10228] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.202561][T10228] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.263934][T10228] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.333247][T10228] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.392784][T10228] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.452306][T10228] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.513285][T10228] bridge_slave_1: left allmulticast mode [ 358.518932][T10228] bridge_slave_1: left promiscuous mode [ 358.524633][T10228] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.532371][T10228] bridge_slave_0: left allmulticast mode [ 358.538015][T10228] bridge_slave_0: left promiscuous mode [ 358.543714][T10228] bridge0: port 1(bridge_slave_0) entered disabled state [ 358.551891][T10228] bridge_slave_1: left allmulticast mode [ 358.557510][T10228] bridge_slave_1: left promiscuous mode [ 358.563175][T10228] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.570868][T10228] bridge_slave_0: left allmulticast mode [ 358.576528][T10228] bridge_slave_0: left promiscuous mode [ 358.582168][T10228] bridge0: port 1(bridge_slave_0) entered disabled state [ 358.590486][T10228] bridge_slave_1: left allmulticast mode [ 358.596103][T10228] bridge_slave_1: left promiscuous mode [ 358.601802][T10228] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.609350][T10228] bridge_slave_0: left allmulticast mode [ 358.615054][T10228] bridge_slave_0: left promiscuous mode [ 358.620797][T10228] bridge0: port 1(bridge_slave_0) entered disabled state [ 358.712538][T10228] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 358.722255][T10228] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 358.731891][T10228] bond0 (unregistering): Released all slaves [ 358.842126][T10228] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 358.851759][T10228] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 358.861125][T10228] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 358.869996][T10228] bond0 (unregistering): Released all slaves [ 358.922102][T10228] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 358.931947][T10228] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 358.941681][T10228] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 358.950659][T10228] bond0 (unregistering): Released all slaves [ 358.958795][T10228] bond1 (unregistering): Released all slaves [ 359.043147][T10228] hsr_slave_0: left promiscuous mode [ 359.048766][T10228] hsr_slave_1: left promiscuous mode [ 359.054463][T10228] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 359.061821][T10228] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 359.070552][T10228] hsr_slave_0: left promiscuous mode [ 359.076218][T10228] hsr_slave_1: left promiscuous mode [ 359.081866][T10228] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 359.089217][T10228] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 359.096696][T10228] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 359.104091][T10228] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 359.112783][T10228] hsr_slave_0: left promiscuous mode [ 359.118278][T10228] hsr_slave_1: left promiscuous mode [ 359.123894][T10228] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 359.131288][T10228] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 359.138764][T10228] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 359.146203][T10228] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 359.157712][T10228] veth1_macvtap: left promiscuous mode [ 359.163278][T10228] veth0_macvtap: left promiscuous mode [ 359.168830][T10228] veth1_vlan: left promiscuous mode [ 359.174122][T10228] veth0_vlan: left promiscuous mode [ 359.179668][T10228] veth0_macvtap: left promiscuous mode [ 359.185179][T10228] veth1_vlan: left promiscuous mode [ 359.190546][T10228] veth0_vlan: left promiscuous mode [ 359.289581][T10228] team0 (unregistering): Port device team_slave_1 removed [ 359.298557][T10228] team0 (unregistering): Port device team_slave_0 removed [ 359.348752][T10228] team0 (unregistering): Port device team_slave_1 removed [ 359.358153][T10228] team0 (unregistering): Port device team_slave_0 removed [ 359.406079][T10228] team0 (unregistering): Port device team_slave_1 removed [ 359.415746][T10228] team0 (unregistering): Port device team_slave_0 removed [ 359.445106][ T3424] lo speed is unknown, defaulting to 1000 [ 359.450880][ T3424] infiniband syz2: ib_query_port failed (-19) [ 360.164012][T10228] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 360.174366][T10228] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.232563][T10228] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 360.242873][T10228] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.292810][T10228] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 360.303138][T10228] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.362694][T10228] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 360.373101][T10228] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.412142][T10228] bond1: left allmulticast mode [ 360.417013][T10228] bond1: left promiscuous mode [ 360.421856][T10228] bridge0: port 1(bond1) entered disabled state [ 360.457706][T10228] team0: Port device ip6gre0 removed [ 361.102211][T10228] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 361.111143][T10228] bond0 (unregistering): Released all slaves [ 361.119212][T10228] bond1 (unregistering): Released all slaves [ 361.127166][T10228] bond2 (unregistering): Released all slaves [ 361.135303][T10228] bond3 (unregistering): Released all slaves [ 361.185750][T10228] hsr_slave_0: left promiscuous mode [ 361.191277][T10228] hsr_slave_1: left promiscuous mode [ 361.198002][T10228] veth0_macvtap: left promiscuous mode [ 361.203600][T10228] veth1_vlan: left promiscuous mode [ 361.208802][T10228] veth0_vlan: left promiscuous mode [ 361.502903][T10228] IPVS: stop unused estimator thread 0...