last executing test programs: 13.447534192s ago: executing program 4 (id=2557): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r1, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r0}, 0x20) recvmmsg(r0, &(0x7f0000002940)=[{{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000540)=""/215, 0xd7}], 0x1}, 0xb}], 0x2, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000080), 0x4) 13.377157757s ago: executing program 4 (id=2559): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060101000000000000000000000080050005000a000000050001000700000005000400030000000900020073797a310000000011000300686173683a6e65742c6e6574"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x64, 0xb, 0x6, 0x801, 0x0, 0x0, {0x6, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @mcast1}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x24}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x64}}, 0x4800) 13.355345159s ago: executing program 4 (id=2560): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000340)={0x0, 0xcc}, 0x8) r1 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback, 0x7}], 0x1c) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES16=r0, @ANYRES16=r1], 0x1000f) 13.326183032s ago: executing program 4 (id=2561): syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./file2\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x6, 0x36e, &(0x7f00000001c0)="$eJzs3U1oM0UYwPEnaZImeXmbHERRkA6+CHpZ2uhZDNKCELC0jdgKwrbdaMialGyoRsS2J4+Kd0+Ch9KbBQ8F7VnoxZteRPDWi6BgBXVlv5LNV9PGpMH2/4OSycw8uzPZSXk27WYv3vj03UrJ0kp6Q6JJJRERkUuRrEQlEPEfo245IfLJd622A3n+wW8/PL22UUx6FWo5v/5CTik1N//Nex+m/G6ns3Kefevi19wv54+fP3nxz/o7ZUuVLVWtNZSutmo/NfQt01A7ZauiKbViGrplqHLVMupe+1f+dsza7m5T6dWdh+ndumFZSq82VcVoqkZNNepNpb+tl6tK0zT1MC0Ypni0uqrnRwzeHvNgMCH1el6fEZFUT0vxaCoDAgAAU9Wd/0edlH5Y/h/Syv83Za5QWFpVTud2/n/8zFnjwesnc37+f5rol/+/+KO3rY783zmdaOf/Ne/8oDQ8//9cbpD/92ZE98vI+X92AoPBaOYTPVWRjmdO/p/237+uwzePF9wC+T8AAAAAAAAAAAAAAAAAAAAAAP8Hl7adsW07EzwGP+1LCPznuJMGHf9ZEUk6R9/m+N9laxubknQv3HOOsfnxXnGv6D36Hc5ExBTjb7ubszaCK4+UIyvfmvt+/P5eccZtyZek7MTLomQk666nULxtL79aWFpUHj++dZlSOhyfk4w8Fo7/2l2dTnyuM97ff0KeexSK1yQj329LTUzZcSPb+/9oUalXXit0xafcfiLy860fFAAAAAAAxkxTLX3P3zVtULv3LSP5kvsxkSELkpG/+p/fL/Q9P49lnopNe/YAAAAAANwPVvODii5Ro+4WTLNfISUDm8ZQiHXUxEWkb+dEV038qi3PhGZ43fEkxLuDyX+d1xfBq3qTqOAfKZyBt5r8O6rIaOMJ5u/WRGLP/u43/XnTeUUOxF0AB+GmqFwjPNY9+HmnQvXt/Gjgdg79ibRqgo+NEgNeZ1np3U70ipUQ76mxI6MtgCc++/KP8b1BXjrxV8D7wzsfmoa9L9c5KF0FZxe9TfGJ/+IBAAAAcOvaSX9Q83K4OXwjkfDNcvjLPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYzSRr/TrKgze++xtThUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYun8DAAD//7ct9c4=") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x105042, 0x40) r0 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x3010}, &(0x7f0000000040)=0x0, &(0x7f0000000340)=0x0) io_setup(0x3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r0, 0x47ba, 0x3e80, 0x0, 0x0, 0x0) 13.139590256s ago: executing program 4 (id=2566): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f00000000c0)=0x14) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) readv(r0, &(0x7f0000000380)=[{&(0x7f0000000440)=""/162, 0xab}], 0x1) 13.070290612s ago: executing program 4 (id=2569): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x10c, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in=@private=0xa010100, 0x0, 0x2b}, @in=@multicast2, {0x0, 0x0, 0x2}, {0x0, 0x200001, 0x7}, {0x40000}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}, @extra_flags={0x8, 0x18, 0x9}]}, 0x10c}}, 0x0) 13.070213422s ago: executing program 32 (id=2569): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x10c, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in=@private=0xa010100, 0x0, 0x2b}, @in=@multicast2, {0x0, 0x0, 0x2}, {0x0, 0x200001, 0x7}, {0x40000}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}, @extra_flags={0x8, 0x18, 0x9}]}, 0x10c}}, 0x0) 3.610582788s ago: executing program 2 (id=2789): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x4000) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB, @ANYRES64, @ANYRES64=0x0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000080008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b700000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200008, &(0x7f0000000380)={[{@nolazytime}, {@auto_da_alloc}, {@oldalloc}, {@norecovery}, {@jqfmt_vfsv0}, {@orlov}, {@nogrpid}, {@noauto_da_alloc}, {@user_xattr}]}, 0x3, 0x56a, &(0x7f00000015c0)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwFy9SBBEL4h/g3WPxH/CvKGihSAl68BKZzWy7TbL5uXW3zucD0743M5s3b998335nZ5cNoLBGsn9KEa9GxDdJxOG2bYORbxxZ2W/p8Y3JbEliefmzP5NI8nWt/ZP8/4N55ZWI+PWriJOlte3WFxZnKtVqOpfXRxuzV0frC4unLs9WptPp9Mr4xMSZdybG33/v3a719c0Lf3//6f2Pznx9fOm7nx8euZvEuTiUb2vvxy7caq+MxEj+nAzFuVU7jnWhsX6S9PoA2JGBPM6HIpsDDsdAHvXA/9/NiFgGCioR/1BQrTygdW3fpevgF8ajD1cugNb2f3DlvZHY17w2OrCUPHNllF3vDneh/ayNX/64dzdbYpP3IW52oT2Allu3I+L04ODa+S/J57+dO91883hjq9so2usP9NL9LP95a738p/Qk/4l18p+D68TuTmwe/6WHXWimoyz/+2Dd/PfJ1DU8kNdeauZ8Q8mly9X0dES8HBEnYmhvVt/ofs6ZpQfLnba153/ZkrXfygXz43g4uPfZx0xVGpXd9Lndo9sRrz3Nf5NYM//va+a6q8c/ez4ubLGNY+m91ztt27z/7bqfAS//FPHGuuP/9I5WsvH9ydHm+TDaOivW+uvOsd86tb+9/ndfNv4HNu7/cNJ+v7a+/TZ+3PdP2mnbTs//PcnnzfKefN31SqMxNxaxJ/lk7frxp49t1Vv7Z/0/cXzj+W+9839/RHyxxf7fOXqn4679MP5T2xr/7RcefPzlD53a39r4v90sncjXbGX+2+oB7ua5AwAAAAAAgH5TiohDkZTKT8qlUrm88vmOo3GgVK3VGycv1eavTEXzu7LDMVRq3ek+3PZ5iLH887Ct+viq+kREHImIbwf2N+vlyVp1qtedBwAAAAAAAAAAAAAAAAAAgD5xsMP3/zO/D/T66IDnzk9+Q3FtGv/d+KUnoC95/YfiEv9QXOIfikv8Q3GJfygu8Q/FJf6huMQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAAdNWF8+ezZXnp8Y3JrD51bWF+pnbt1FRanynPzk+WJ2tzV8vTtdp0NS1P1mY3+3vVWu3q2HjMXx9tpPXGaH1h8eJsbf5K4+Ll2cp0ejEd+k96BQAAAAAAAAAAAAAAAAAAAC+W+sLiTKVaTecUOhbORl8cxo4LyWajfDY/GXbUxGDvO6jwHAo9npgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoM2/AQAA///fKTPH") r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x3fffffffc}, 0x0, 0x0, 0x0, 0x3, 0xfff, 0x8001, 0x7fff}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r3 = gettid() process_vm_writev(r3, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0x7ffff000}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) ftruncate(r4, 0x2007ffc) sendfile(r4, r4, 0x0, 0x800000009) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000440)=ANY=[@ANYRESHEX, @ANYRESDEC, @ANYBLOB="0000000000000000b703000000040000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r5}, 0x18) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r4, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x3}}, './file1\x00'}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0xb3) pwritev2(r8, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x8800000, 0x0, 0x0) ioctl$BTRFS_IOC_INO_PATHS(r7, 0xc0389423, &(0x7f00000001c0)={0x5, 0x20, [0x8001, 0x401, 0x7, 0x5], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0]}) bind$inet6(r6, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) 2.799530114s ago: executing program 2 (id=2801): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r1) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = accept(r1, &(0x7f0000001780)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @remote}}, &(0x7f00000006c0)=0x80) sendmsg$TIPC_CMD_SHOW_PORTS(r4, &(0x7f00000018c0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001880)={&(0x7f0000001840)={0x1c, 0x0, 0x2, 0x70bd28, 0x25dfdbfb, {}, [""]}, 0x1c}}, 0x4000) r5 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0x20, &(0x7f0000000540)={&(0x7f0000000740)=""/4096, 0x1000, 0x0, &(0x7f0000000480)=""/176, 0xb0}}, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f00000005c0)={0x0, r5}, 0x8) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b70300000000002085000000730000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000001740)='mem_connect\x00', r8}, 0x18) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a3000000000e4000000160a01000000000000000000010000010900010073797a30000000000900020073797a3000000000b80003800800014000000000a400038014000100776c616e3000000000000000000000001400010076657468305f746f5f62617461647600120001006d6163766c616e3100000000000000001400010067656e657665310000000000000000000a0001006772653000000000000000000000000014000100776c616e3100000000000000000000001400010076657468315f766972745f77696669001400010076657468305f746f5f626f6e64000000080002400000000604020000180a0101000b000000000000010000000900010073797a3000000000e800038008000140000000000800014000000000cc0003801400010069703665727370616e3000000000000014000100776732000000000000000000000000001400010076657468305f6d61637674617000000014000100626f6e645f736c6176655f310000000014000100626f6e645f736c6176655f300000000014000100636169663000000000000000000000001400010070696d726567300000000000000000001400010070696d726567310000000000000000001400010076657468315f746f5f7465616d0000001400010070696d3672656731000000000000000008000140000000200900020073797a3000"], 0x330}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc9ffb}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r9 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) fdatasync(r9) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x1, &(0x7f0000000300)=[{0x50, 0xff, 0x0, 0x6}]}) write$ppp(r0, &(0x7f0000000200)="4176adc3a0", 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000001900)={0x0, 0x8, 0x7, [0x9, 0xe0fe, 0x4, 0x1c0, 0x8, 0x5, 0x1ff]}, 0x16) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x30046, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 2.731261279s ago: executing program 1 (id=2803): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) 2.711224661s ago: executing program 1 (id=2804): bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x8, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="180000000000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000b60901000000000065000c000000000018010000646c6c2500000000002020207b9af8ff000000002d9a00000000000037090000f8ffffffb702000008000000b70300000000000015000000060000003d93000000000000b5030000000000008500000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x0) socket$pppoe(0x18, 0x1, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @remote, 'macvlan0\x00'}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x2) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000000200)=0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000080000000d"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0500000004000000990000000b"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000700000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r3}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r5, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="28000000506dd8e29fdd419b085b2684ee279463ba185c1f1f71bbfafa35adf44662f096a2c6fd24275735d311b59278923fdb54f9245fe0331551cfd7cd1d5820dfc868af67807e59c80c92607b85f0ac45668ce96fd676094fd0", @ANYBLOB="6828d02adc9b2f0a66e73e485cc6d079cb9fc23ca588e538701c71b9e85e2178f4bb953a5b515af3cd110f3f273786d8c1965c6566eed0f63d0ac6526ab13639db5fd39d47a3bfac48b8a45dfe19513b26ebe8ee32b1a5f48b9072c6f21ef6ae11bb96d43453c1e17df11f0facd12e46a66dd4f4cf7ca3e65dce2e9ce1b43fa7676ae864beb9746786814c937d331e93e328e5d26f3f85aebbb83e78a6ae18203fbc37e2dc2914da106ec5f94a9f94c5422951397d193bb8fe28b6e9752acf6126da85cb403e222799fd6541486e8f4ddf6e7926541d8eca0c04cf00ff2de57c446792", @ANYRESOCT=r1, @ANYRESHEX=r4, @ANYRESDEC=r0], 0x28}}, 0x20008049) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="640100001900010000000000040000001d0100001500040001000080fe02000031171e44b2b50e8f040000001e0106000000fd0000ec058cdecf0fa4f69652b23bf9968d372a0ddfe196faa30f83514813d0527685407bc8366e2838397d6abc25357799ac708b65efffdb10e1376a4f6d4ab9949102000036dbf30bf928c37695658578feb8f3cce47f43a42919c288f7d5430ffc0226139916866a978312dd970e64629d7cd799c5e08b64de41458eb8951a54a7cf29a810823e869f5c087d15d9d3bae1c089701f970f8e7ce853654222f07959e7cdcfcf27332cb82016ccd91be54e588f6ea7b5c35a62c0ceaa4e90b29c3edc16f20db3d7fb4d6236232de07ccd7d7301f46a287dd296abe9baba499721311e1597853a2d0c7e1e64f827d31e6917175792398e0edaa900000000000000000002c900c08ac1d7b606000000000000000000000000000008000900", @ANYRES32, @ANYBLOB="080005"], 0x164}}, 0x0) 2.674942324s ago: executing program 1 (id=2805): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000093850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000340)='kfree\x00', r0, 0x0, 0x1ffffffffffffffd}, 0x18) r1 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x149a82, 0x0) writev(r1, 0x0, 0x0) 2.60519842s ago: executing program 1 (id=2806): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8e7}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001700)={&(0x7f0000000100)='kmem_cache_free\x00', r4, 0x0, 0xfffffffffffffff8}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000cc0)={{r3}, &(0x7f0000000740), &(0x7f0000000c80)}, 0x20) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB='ya\x00\x00\x00\x00\x00\x00\x00\x00~'], 0x1c}, 0x1, 0x0, 0x0, 0x4008084}, 0x0) 2.604271449s ago: executing program 1 (id=2807): perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x24, 0x1, 0x0, 0x0, 0x0, 0x7, 0xf1110, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0xc, 0x3, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000001000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000100006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000020000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) socket$packet(0x11, 0xa, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x9}, 0x94) socket$inet6(0xa, 0x2, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) syz_emit_ethernet(0x122, &(0x7f0000000340)={@random="e9a200", @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x114, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x100, 0x0, @gue={{0x2, 0x1, 0x2, 0x4}, "2494fc90f69e0f584311c11e93ffa2e321837940512190ca30df1f733fc6dc680d4f0475f11e277a57e8f3c73700ddb47df76635d47171efec64d1a5d8825cad226db731ec8650f4a677038120d585238d0fe3f86e1714382fccc2e3221660783267a3696fdfcd7b65ccaa2e1ff021a13c3ca13706a9f50200f8759e549f299622666643a0ae2b8510a0576ad9dada20e61b85da68a3eb98eea4309d829894d2803b0da5a1b24d94959d9cfebcbb56df2cb68ee4e9b0be58d934f23594711f9e725b4b74769299d2525bcb8fd3225a41bc5520610de0b9f6b49c4030b9956d0d96b054b9d8c9499a658e84a1bfcca5ed"}}}}}}, 0x0) syz_emit_ethernet(0x3a, &(0x7f00000000c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x4e22, 0x7, 0x18, 0x0, @wg=@data={0x4, 0x1, 0x6}}}}}}, 0x0) 2.564616923s ago: executing program 1 (id=2808): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r1) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = accept(r1, &(0x7f0000001780)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @remote}}, &(0x7f00000006c0)=0x80) sendmsg$TIPC_CMD_SHOW_PORTS(r4, &(0x7f00000018c0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001880)={&(0x7f0000001840)={0x1c, 0x0, 0x2, 0x70bd28, 0x25dfdbfb, {}, [""]}, 0x1c}}, 0x4000) r5 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0x20, &(0x7f0000000540)={&(0x7f0000000740)=""/4096, 0x1000, 0x0, &(0x7f0000000480)=""/176, 0xb0}}, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f00000005c0)={0x0, r5}, 0x8) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000001740)='mem_connect\x00', r8}, 0x18) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a3000000000e4000000160a01000000000000000000010000010900010073797a30000000000900020073797a3000000000b80003800800014000000000a400038014000100776c616e3000000000000000000000001400010076657468305f746f5f62617461647600120001006d6163766c616e3100000000000000001400010067656e657665310000000000000000000a0001006772653000000000000000000000000014000100776c616e3100000000000000000000001400010076657468315f766972745f77696669001400010076657468305f746f5f626f6e64000000080002400000000604020000180a0101000b000000000000010000000900010073797a3000000000e800038008000140000000000800014000000000cc0003801400010069703665727370616e3000000000000014000100776732000000000000000000000000001400010076657468305f6d61637674617000000014000100626f6e645f736c6176655f310000000014000100626f6e645f736c6176655f300000000014000100636169663000000000000000000000001400010070696d726567300000000000000000001400010070696d726567310000000000000000001400010076657468315f746f5f7465616d0000001400010070696d3672656731000000000000000008000140000000200900020073797a3000"], 0x330}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc9ffb}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r9 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) fdatasync(r9) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x1, &(0x7f0000000300)=[{0x50, 0xff, 0x0, 0x6}]}) write$ppp(r0, &(0x7f0000000200)="4176adc3a0", 0x5) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000001900)={0x0, 0x8, 0x7, [0x9, 0xe0fe, 0x4, 0x1c0, 0x8, 0x5, 0x1ff]}, 0x16) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x30046, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 2.275984116s ago: executing program 2 (id=2809): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(0x0, r2) getsockname$packet(r2, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000780)=@newtfilter={0x3c, 0x28, 0x575ac7824d421509, 0x70bd2a, 0x4, {0x0, 0x0, 0x0, r3, {}, {0x1}, {0x4, 0x3d}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x5}}, @filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x3c}}, 0x40) 2.250770718s ago: executing program 2 (id=2810): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2000000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8e7}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001700)={&(0x7f0000000100)='kmem_cache_free\x00', r6, 0x0, 0xfffffffffffffff8}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000cc0)={{r5}, &(0x7f0000000740), &(0x7f0000000c80)}, 0x20) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB='ya\x00\x00\x00\x00\x00\x00\x00\x00~'], 0x1c}, 0x1, 0x0, 0x0, 0x4008084}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000880)=ANY=[@ANYBLOB="20ecd5443d00988dec1d34d24778e64a259ebbc8b96497dc5ad7fff0f98c5852e3e21903fab3b9f8b734bc0f59caf6a55c7c4cbe3ada3e0278ee3ca4858025839abb0f3c13d83a94334d83b056b9977de1521ca7d51e05bbcd6324e7aeacb9eff44c36f5484a16fdc59a85f69e4c831a2dfdea3e44eb0f14519eb4529daf8d921c85ececfee336826019037855b3070c3f0e490d30a87453cb3a7998a7accd1173d2c90199e271b9d040c26169d13464a703ba982517d3098441fdd40691caf8966635a7fd5e12fbd4a48e07ea36ad4a0feb4dec7c63c853c7", @ANYRES16=r7, @ANYBLOB="8b332abd700000000000150000000c009900c70000003a000000"], 0x20}}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000300)={0x0, r2}, 0x8) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5ba}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='kmem_cache_free\x00', r8, 0x0, 0x3}, 0x18) r9 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r9, 0x29, 0x24, &(0x7f0000000080), 0x4) sendmsg$kcm(r9, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x8, @mcast1, 0x3, 0xffffffff}, 0x80, &(0x7f0000001880)=[{&(0x7f0000000780)="f4000900062b2c25fe80000000000000dc8b850f238466cc00007a000000ad6e911b51818462b400", 0x28}], 0x1}, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r10, 0x84, 0x1c, &(0x7f0000000280), &(0x7f00000002c0)=0x4) setfsuid(0xee00) setresuid(0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x74}}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x25dfdbfb, {}, [@IFLA_MASTER={0x8}, @IFLA_LINK={0x8}]}, 0x30}}, 0x4) 2.210507521s ago: executing program 2 (id=2811): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000400)=[@mss={0x2, 0x8}, @window={0x3, 0xe, 0x7ff}, @timestamp, @sack_perm, @window={0x3, 0x16}, @window={0x3, 0x8000, 0xfffc}, @sack_perm, @window={0x3, 0xa4, 0xfff7}], 0x8) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0xc7) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25) 2.193596842s ago: executing program 2 (id=2812): r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x161042, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r1) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = accept(r1, &(0x7f0000001780)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @remote}}, &(0x7f00000006c0)=0x80) sendmsg$TIPC_CMD_SHOW_PORTS(r4, &(0x7f00000018c0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001880)={&(0x7f0000001840)={0x1c, 0x0, 0x2, 0x70bd28, 0x25dfdbfb, {}, [""]}, 0x1c}}, 0x4000) r5 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0x20, &(0x7f0000000540)={&(0x7f0000000740)=""/4096, 0x1000, 0x0, &(0x7f0000000480)=""/176, 0xb0}}, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f00000005c0)={0x0, r5}, 0x8) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b70300000000002085000000730000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000001740)='mem_connect\x00', r8}, 0x18) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a3000000000e4000000160a01000000000000000000010000010900010073797a30000000000900020073797a3000000000b80003800800014000000000a400038014000100776c616e3000000000000000000000001400010076657468305f746f5f62617461647600120001006d6163766c616e3100000000000000001400010067656e657665310000000000000000000a0001006772653000000000000000000000000014000100776c616e3100000000000000000000001400010076657468315f766972745f77696669001400010076657468305f746f5f626f6e64000000080002400000000604020000180a0101000b000000000000010000000900010073797a3000000000e800038008000140000000000800014000000000cc0003801400010069703665727370616e3000000000000014000100776732000000000000000000000000001400010076657468305f6d61637674617000000014000100626f6e645f736c6176655f310000000014000100626f6e645f736c6176655f300000000014000100636169663000000000000000000000001400010070696d726567300000000000000000001400010070696d726567310000000000000000001400010076657468315f746f5f7465616d0000001400010070696d3672656731000000000000000008000140000000200900020073797a3000"], 0x330}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc9ffb}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r9 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) fdatasync(r9) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x1, &(0x7f0000000300)=[{0x50, 0xff, 0x0, 0x6}]}) write$ppp(r0, &(0x7f0000000200)="4176adc3a0", 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000001900)={0x0, 0x8, 0x7, [0x9, 0xe0fe, 0x4, 0x1c0, 0x8, 0x5, 0x1ff]}, 0x16) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x30046, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 1.169229086s ago: executing program 0 (id=2823): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2000000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8e7}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001700)={&(0x7f0000000100)='kmem_cache_free\x00', r6, 0x0, 0xfffffffffffffff8}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000cc0)={{r5}, &(0x7f0000000740), &(0x7f0000000c80)}, 0x20) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB='ya\x00\x00\x00\x00\x00\x00\x00\x00~'], 0x1c}, 0x1, 0x0, 0x0, 0x4008084}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000880)=ANY=[@ANYBLOB="20ecd5443d00988dec1d34d24778e64a259ebbc8b96497dc5ad7fff0f98c5852e3e21903fab3b9f8b734bc0f59caf6a55c7c4cbe3ada3e0278ee3ca4858025839abb0f3c13d83a94334d83b056b9977de1521ca7d51e05bbcd6324e7aeacb9eff44c36f5484a16fdc59a85f69e4c831a2dfdea3e44eb0f14519eb4529daf8d921c85ececfee336826019037855b3070c3f0e490d30a87453cb3a7998a7accd1173d2c90199e271b9d040c26169d13464a703ba982517d3098441fdd40691caf8966635a7fd5e12fbd4a48e07ea36ad4a0feb4dec7c63c853c7", @ANYRES16=r7, @ANYBLOB="8b332abd700000000000150000000c009900c70000003a000000"], 0x20}}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000300)={0x0, r2}, 0x8) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5ba}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='kmem_cache_free\x00', r8, 0x0, 0x3}, 0x18) r9 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r9, 0x29, 0x24, &(0x7f0000000080), 0x4) sendmsg$kcm(r9, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x8, @mcast1, 0x3, 0xffffffff}, 0x80, &(0x7f0000001880)=[{&(0x7f0000000780)="f4000900062b2c25fe80000000000000dc8b850f238466cc00007a000000ad6e911b51818462b400", 0x28}], 0x1}, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r10, 0x84, 0x1c, &(0x7f0000000280), &(0x7f00000002c0)=0x4) setfsuid(0xee00) setresuid(0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x74}}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x25dfdbfb, {}, [@IFLA_MASTER={0x8}, @IFLA_LINK={0x8}]}, 0x30}}, 0x4) 1.134555309s ago: executing program 0 (id=2824): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060101000000000000000000000080050005000a000000050001000700000005000400030000"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x64, 0xb, 0x6, 0x801, 0x0, 0x0, {0x6, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @mcast1}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x24}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x64}}, 0x4800) 1.10965035s ago: executing program 0 (id=2826): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001d00)=ANY=[@ANYBLOB="0b00000005000000050000000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000080000000000000000000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffea4, 0x0, 0x0, 0x0}, 0x90) setregid(0xffffffffffffffff, 0x0) 1.071840543s ago: executing program 3 (id=2828): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) tkill(0x0, 0x16) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x9}, 0x1c) listen(r1, 0x3) syz_emit_ethernet(0x4a, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd602a8435001406ff00000000000000000000000000000000fe8000000000000400000000000000aa00004e225ee87a335732a5bd5e18675f02ebc5b6ead9ce7b2f85fc137716f56acb18e5611dae51445d0646d1ff67439f13b1fc2d89fb606294ed47aba55c214ced7efc5ae3a805111e84ea2d76491020b61e4faeabdcc8128d050000000000000078e83cc73d4424d2a8a096f4c6948039fca394eb130cab2b85fbbfca889a0ff3", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="58c2000090780000"], 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007baaf8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000540)='inet_sock_set_state\x00', r3}, 0x10) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) shutdown(r4, 0x2) 1.071548864s ago: executing program 0 (id=2829): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000000c0), r0) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r1, 0xba87317d461c07c9, 0x70bd2d, 0x4004}, 0x14}}, 0x4009080) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)=0x0) timer_settime(r3, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x86, 0xfffffffe, 0x0, 0x0, 0xfffffffc) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000"], 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r8}, 0x10) sendmsg$NFT_BATCH(r6, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x90, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x64, 0x3, 0x0, 0x1, [{0x60, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_EXPR={0x58, 0x7, 0x0, 0x1, @target={{0xb}, @val={0x48, 0x2, 0x0, 0x1, [@NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TARGET_INFO={0x30, 0x3, "b08c674515113085726709225a7547b6f14c1aa7a7202afc0811618e3b5a514fb651ff7360e7749fe5bee390"}, @NFTA_TARGET_NAME={0x9, 0x1, 'SNAT\x00'}]}}}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x114}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r5}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 1.054682855s ago: executing program 3 (id=2831): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, 0x0, &(0x7f0000000100)) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000780)=@newtfilter={0x3c, 0x28, 0x575ac7824d421509, 0x70bd2a, 0x4, {0x0, 0x0, 0x0, 0x0, {}, {0x1}, {0x4, 0x3d}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x5}}, @filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x3c}}, 0x40) 1.038541876s ago: executing program 3 (id=2833): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = syz_io_uring_setup(0x236, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x3, 0x42}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r2, r3, 0x0) io_uring_enter(r1, 0x2def, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13) ioctl$TCXONC(r0, 0x540a, 0x2) 1.030368986s ago: executing program 5 (id=2834): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r1}, 0x18) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) set_mempolicy_home_node(&(0x7f0000146000/0x1000)=nil, 0x1000, 0x0, 0x0) 1.016694708s ago: executing program 3 (id=2835): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2000000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8e7}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001700)={&(0x7f0000000100)='kmem_cache_free\x00', r6, 0x0, 0xfffffffffffffff8}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000cc0)={{r5}, &(0x7f0000000740), &(0x7f0000000c80)}, 0x20) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB='ya\x00\x00\x00\x00\x00\x00\x00\x00~'], 0x1c}, 0x1, 0x0, 0x0, 0x4008084}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000880)=ANY=[@ANYBLOB="20ecd5443d00988dec1d34d24778e64a259ebbc8b96497dc5ad7fff0f98c5852e3e21903fab3b9f8b734bc0f59caf6a55c7c4cbe3ada3e0278ee3ca4858025839abb0f3c13d83a94334d83b056b9977de1521ca7d51e05bbcd6324e7aeacb9eff44c36f5484a16fdc59a85f69e4c831a2dfdea3e44eb0f14519eb4529daf8d921c85ececfee336826019037855b3070c3f0e490d30a87453cb3a7998a7accd1173d2c90199e271b9d040c26169d13464a703ba982517d3098441fdd40691caf8966635a7fd5e12fbd4a48e07ea36ad4a0feb4dec7c63c853c7", @ANYRES16=r7, @ANYBLOB="8b332abd700000000000150000000c009900c70000003a000000"], 0x20}}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000300)={0x0, r2}, 0x8) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5ba}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='kmem_cache_free\x00', r8, 0x0, 0x3}, 0x18) r9 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r9, 0x29, 0x24, &(0x7f0000000080), 0x4) sendmsg$kcm(r9, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x8, @mcast1, 0x3, 0xffffffff}, 0x80, &(0x7f0000001880)=[{&(0x7f0000000780)="f4000900062b2c25fe80000000000000dc8b850f238466cc00007a000000ad6e911b51818462b400", 0x28}], 0x1}, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r10, 0x84, 0x1c, &(0x7f0000000280), &(0x7f00000002c0)=0x4) setfsuid(0xee00) setresuid(0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x74}}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x25dfdbfb, {}, [@IFLA_MASTER={0x8}, @IFLA_LINK={0x8}]}, 0x30}}, 0x4) 997.851989ms ago: executing program 5 (id=2836): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060101000000000000000000000080050005000a000000050001000700000005000400030000"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x64, 0xb, 0x6, 0x801, 0x0, 0x0, {0x6, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @mcast1}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x24}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x64}}, 0x4800) 963.400132ms ago: executing program 5 (id=2837): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000001850000001b000000b70000000000070095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kfree\x00', r1}, 0x18) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@gettaction={0x38, 0x32, 0x100, 0x70bd2a, 0x25dfdbff, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x800}, @action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000280), 0x88182, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1110000000000000af0c7a0002"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x200000000000004b, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', 0xffffffffffffffff, 0x0, 0xffffffffffffffff}, 0x13) r4 = socket$inet6(0xa, 0x80002, 0x0) r5 = gettid() r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) read$ptp(r6, 0x0, 0x0) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)=0x0) timer_settime(r7, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) connect$inet(r8, &(0x7f0000000280)={0x2, 0x4, @multicast1}, 0x10) sendmmsg$inet(r8, &(0x7f0000004540)=[{{&(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x7e1f, 0x0}, 0xee0000b0}, {{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001100)="15b26f226e2966667482d50903b0a8d92ccd9e69d5cc4cb3d467a670b237a9225fb56c0f7ea725dee27c4bb43bb50c6748c83b71d59f0537405dfab648c096607340fac939a2efd31cbe2f8ca29c409e87ea0974b7bceff9afef5d07d691575f5115f2f961ad488e3386036913e98181a6034febaab853a3e928b9035b0e3a8e1cb393c70f6d0448970e0af2476f8b923ee09c19deca55d58f70e8eeff55dda6381cb96afe97196c0af0a8fd450a1447a1a521e2c211fb84cbcf4aebd31298972ec6bea1764fbde5500fa30c5f2459cff4d7f123ab94cfd5762d586ec7a28abc2f8c9e608f8f964b96ecb0883d60d444f317834a3d734cb304051a60d1a084a84da8f9a23a1b9d4951c0a81985c63ae193f40e9deb358b2f08553324fd6086be9e70e5061568abefebcda50e70f4dab2e4dc0cf6d85aced044d7005326922886194895267165f7f592036ebe11dcf1cad98f5cda766eaea90fb4cb5e793525126c7594f8599055192d63a81d3cd26aadd50983f1c3f1d4655c1b5f59e80f733e3abc4792b760729fd26298ef15141cf76cc4", 0xc3}, {&(0x7f0000000d80)="7d68e6de85f9b0cbc9d710267f321ec64eab043ecad9af7e01e9463218ec45924a99867163e468d36a682fadd749caa325e685d75559a87139e02fae7271be8f55671cfd32a09896278d1941370174720838039d0989bc3394b8a4c4f4a30f0496be313d6d60fe47966c634a3ee1f659e8ef310647725bda0130d5de5028220a4cf5fc808a75694738ee26cb21302b4bba4265b845a5d5dce706d9820c6936b122f9658446d74a9016b94424971dd443a6907eb5c73b6b200e92b23f2c36a214729b0bc231511e4c", 0xc8}, {&(0x7f0000000380)="73fd71361e8d6c80ae1bc9953e2a4aeac7a314273066fc7f65a51969b46df1774bb0be94ccd4824f2d57ad2cd37242b1258402395481f9f07e067652e52aa8ccefcd0962ba0c48757b68d493f3ad702e65d4daa7dfc1605a173185472ae12470eea64c70ef4e64793b8a830447de0f423bef3964934eef4243cac42939ba6fa68d821b9373b5f3e2c26e7ca75ed8fb3203aef3a6637cecdd0251532b99537e02f604058f50e66c8a657d59beeed127695475f082d3d2b9790181fc987ad000ac00887d1506be89f388ecb405660b4ea196ee8f5a92b12ec43bbf49567db613d478ebe2358364f7600bf4f80ef4b2756fb13416c4fa22880cc96a03f07888575aedb001d5a74bb2f906797912b5ac080a0a3d361425f1a92ab03bbe65d5dcb235f43b5ad1162a16ebdc647baac013bf076945126cdd5a080853976a97ad55184601102fbb8df86b21aa8162858d74465c5fb7dc766602a3567f6eaf441f85ec50ca7fb3a4fdb450d1420531da25d01a412958a5e3895c59542238cf8e188e7fb5641eb24a5f1819bf8d2e9dd6c1d0e93564d723e311db9cd268bb1e477036e822b135cdbaf40f812aa7db01d22c829ab01ae24997dae96ddeed49e62d285701d5419e3f94a8b95790cf5a296ed15bffae1f71470c6a6eda872528844a2df42590d898630263cab5cccec57b7cea365ad8c91bfbe7cb419635ce6bf340a56115c0ad922b6fade9538e543bc5def2a85d35ab16d20c219c4733837be2c14ba4d3d32c3a6882ce6857626f55109b4cdcb634425d710bf3108f9b31b4af0cc17a58e49e871a56126dd8bed08e038ba64008587237b3442d28032e52fc9fae1a5784ba59d0edfa03d38352724903ed6f6970b3f4dfa6e40bf933b6765c6ee648174765f1e8ec71b80cac86abd065a3005b40a43a665707cc590997c5048183006a9dd8026d39def05950183b3d4f12f4e1644ef78cddac7c5569985c2c232bb350f28857675339e53f63a868704d2e0b38993dc57a02d3e297fc9a5b9384622841018c303a05bac25d509df5a2d0e3232927283fcc3ec67e4fa7b71d22f115cf693851dcceab4bce38cbfbb32829e211cdcb6a359e14fe416663541050d340aef2555dbd292bd9cbab8fcf20378149cc994569c2bc95fb33fd2d9321b8ac8e5160b02e202492f470eb719a8f2ac3a4be37ea0918b54b14789b7aa228d47f7b13fd9af608740c5a8fe02109a7cc0e555b22628ef790e513ecadfd338d30aed8ca219e64ee4fb0bd0e21e5101bf2072ffa071eb1aa0454caccc015ff1e166813f819a142b56a22e4ff387bb319288a0ef747c6fc8fdee3a0e193b0d086eb816e97e0322fcdaa30da61cd26ac9d8d0748fccd911ce0fd4adc953e9486e137fe66bc8aedfd5b78c562ebfc578ac9f96a453311766564541e16955e30b95914e9411a0b4cd95e0d8732d5ff7a4f921ef41d986a195334266585353b16b9449955523913a30c087532bcb899f733af3abea59baea174cf04359547a633b5f8a582ae3ef12a1d0125bef8c6e8c9fb589d3597c5ab3879491b0c5e3607203f06836a6805d3f7979c4325f9fecb2aceddedb272237132460cda812ef7d613a585898d59f92ef68ec95f12b47b440f6d899ecbfab48055e0c1605ba4cd9dbc17c4cbfec8a953ebbd38c45a6737a57ee58e21a20e530171137968ae4f0d0366cdb0b9d6a4667b011fcd7cd9e77364e5221989d8f0d80793260e748e3bd394849c090c744f6044328304cd6f02e941c5405647daffc1fd2f2864b37f92bbf4931c8e4a7c6bafd0ea79d39d330e70e6776bf6a926de227e5a43653bba04883e98d67bb64aa86e8bf271ba87604bc598e47f2992c7618ad25068860a481554b53352c7339de7e79c3bd1aed5bef8f398432858c888a5d8651969ea40eb3d486e9fe61d49b20500fdfd1548f567da970103d36730657c35d03d2c36b142665f62203b1fb12d616478cfef6f38b34cda87a634dd06d359f33e98b94a5e5b46b2a8d73126352d1d5b65af75055455cc903e384c41876fbdff935d047284d9d203b147a6ba0e9cb50beef7798886c33d2f2f0c0d9abe0e32c7c809f8b0b28fc59471987353c862a311776b8275bf319d5cb9a59f8f103b6e567ef5dd8859973cc3fe41e356bf5bd3186240e49286977eca36a8ad44185973b276cd7958b73e14a221b7fd567818bebf54ad27ee95161bd2aeeb356482ff467500a7d36f0464f58a591ec6b728f984ec78d0abe14c6d3411ac3ffc4c3179d1f95d029f26cceb545723519d3d4209a2b1243e78767273c13dc2bd320512674b6f1a50313bae7b9d16aebb476dbc829e8fd8dd46a1696efaff5795cf75de57c90f05ed9ef4a5cdfbf20d3d9ed95fb4114b1d5c9ade0856212e7ba330ce5bccf2c993dff89112b28bd3b17d3fcfacef7590f62bf948977dd79e2d8025946c80bf263e34035409b5ba1443d4929727180761bd56d258c3670a0aa4de21111fc3172367582de2d164ff3a18d0696b8dd8e5c1423b2ea1e2c0cfe141e4cf04f8cdaed48976b94c40d6a581300458661bbdbfeeb4969af6319eb1798843d0872f68f0c6537bbc9c7dd1e9b0564bf442d8d25f8aa884aba1df074d374f99750d9227bb821ba0355f60de2829a5c8cd47c89d29a2e3d7d53d59db5c3ace8f484664202c210c68a3b33076fb00d59938e84fbad6d6618c0bb89cf94035fa2de4da351e0d71df416450ea7ec3af33aa5c0313c63e654bd79c73b39dc1933636956761058d76648746daca469f8fce62c17a8160cdefc6a927eef9ec4a8dd684e46f35282546ce2362ab8afedd39bf699fd7c2cde538f52ea43c08558f42ba77b2986b800c45fa76a130b30919b3e1d504573e3c1e7dd2dc5d81379df53d736511f1da4ad8791e46adb27bb5c38129e89edda0aed99dcc03fe400f7d05d48e3e9e17744e8487f8ac464c86f7332211fb9799e9d27a6832d5f17ccd1a2da255f6da047e4728dd80860c04391bca4b7833f0346866401ec20033bcf6dfa85fd1520de5a03b4f9f6f5d2f8d7b6e7d7df1cbe5c05e23e080cf335639c94c48aaeb0bfebbe79530d67d35fb101c91839954c0e50dd4b90a86428b22b0be1e906fee30f68d7ce4bf9c68eafe695f07f5e4e4d473d77104b7b1b5dcfeb84e8c83624c0068d4e1cccfe740f8e5d5699603f8481ef2a1f2d4b8fd2314c5cb1985fe34cf8ede7d2e8bddea269422490903489c7f5951114d7ccb29a19455a987d538955712a460243105b25ccb6e6f34c370a6bbb234bee150dbcea5188e45305253f1014f7c0b5d60d517d2d05707f5ca9249a921d6c5307caf41deca0509b49102d801320db65c00f6e1c05fb8c2e1cc554673bf6168dd64086b19af28eec508fd0c304837e802173ac9947c4d73929c61d9632ab929a25f2a04350954612c2de705c1c25215284fe933fc8ccfd30ab3fc9ff5e04dd68d4720d95a29d6da176ac9d332c9ce77358f3c262777ea828fe6473638bc77be2aa586a3733e275744bc42c3742c1ad8f89d25c31958902f2f498c58fc85e9b78fb7a331734cb081cfa9ccfd262df927c0ff46983f8765af4add3532de2b91f2436df028", 0x9fd}], 0x3}}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)="a6", 0x1}], 0x300}}], 0x3, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x400}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0), 0x0, 0x4040010) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r9, 0x0, 0x4000005) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r10}, 0x10) 900.566307ms ago: executing program 3 (id=2838): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='cdg\x00', 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0xc7) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25) 900.055018ms ago: executing program 0 (id=2839): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000400)=[@mss={0x2, 0x8}, @window={0x3, 0xe, 0x7ff}, @timestamp, @sack_perm, @window={0x3, 0x16}, @window={0x3, 0x8000, 0xfffc}, @sack_perm, @window={0x3, 0xa4, 0xfff7}], 0x8) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0xc7) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11) 845.310152ms ago: executing program 0 (id=2840): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001d00)=ANY=[@ANYBLOB="0b00000005000000050000000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000080000000000000000000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffea4, 0x0, 0x0, 0x0}, 0x90) setregid(0xffffffffffffffff, 0x0) 134.000439ms ago: executing program 5 (id=2842): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001d00)=ANY=[@ANYBLOB="0b000000050000000500000009"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffea4, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='sys_enter\x00', r1}, 0x10) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x1809049, 0x0, 0xff, 0x0, 0x0) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000040)=@v2={0x2000000, [{0x8771, 0x6}, {0xa07, 0x401}]}, 0x14, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0xffffffffffffffff, r3) socket$inet_icmp(0x2, 0x2, 0x1) syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./file2\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x6, 0x36e, &(0x7f00000007c0)="$eJzs3U1oM0UYwPEnaZImeXmbHERRkA6+CHpZ2uhZDNKCELC0jdgKwrbdaMialGyoRsS2J4+Kd0+Ch9KbBQ8F7VnoxZteRPDWi6BgBXVlv5LNV9PGpMH2/4OSycw8uzPZSXk27WYv3vj03UrJ0kp6Q6JJJRERkUuRrEQlEPEfo245IfLJd622A3n+wW8/PL22UUx6FWo5v/5CTik1N//Nex+m/G6ns3Kefevi19wv54+fP3nxz/o7ZUuVLVWtNZSutmo/NfQt01A7ZauiKbViGrplqHLVMupe+1f+dsza7m5T6dWdh+ndumFZSq82VcVoqkZNNepNpb+tl6tK0zT1MC0Ypni0uqrnRwzeHvNgMCH1el6fEZFUT0vxaCoDAgAAU9Wd/0edlH5Y/h/Syv83Za5QWFpVTud2/n/8zFnjwesnc37+f5rol/+/+KO3rY783zmdaOf/Ne/8oDQ8//9cbpD/92ZE98vI+X92AoPBaOYTPVWRjmdO/p/237+uwzePF9wC+T8AAAAAAAAAAAAAAAAAAAAAAP8Hl7adsW07EzwGP+1LCPznuJMGHf9ZEUk6R9/m+N9laxubknQv3HOOsfnxXnGv6D36Hc5ExBTjb7ubszaCK4+UIyvfmvt+/P5eccZtyZek7MTLomQk666nULxtL79aWFpUHj++dZlSOhyfk4w8Fo7/2l2dTnyuM97ff0KeexSK1yQj329LTUzZcSPb+/9oUalXXit0xafcfiLy860fFAAAAAAAxkxTLX3P3zVtULv3LSP5kvsxkSELkpG/+p/fL/Q9P49lnopNe/YAAAAAANwPVvODii5Ro+4WTLNfISUDm8ZQiHXUxEWkb+dEV038qi3PhGZ43fEkxLuDyX+d1xfBq3qTqOAfKZyBt5r8O6rIaOMJ5u/WRGLP/u43/XnTeUUOxF0AB+GmqFwjPNY9+HmnQvXt/Gjgdg79ibRqgo+NEgNeZ1np3U70ipUQ76mxI6MtgCc++/KP8b1BXjrxV8D7wzsfmoa9L9c5KF0FZxe9TfGJ/+IBAAAAcOvaSX9Q83K4OXwjkfDNcvjLPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYzSRr/TrKgze++xtThUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYun8DAAD//7ct9c4=") 109.003542ms ago: executing program 3 (id=2843): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, 0x0, &(0x7f0000000100)) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000780)=@newtfilter={0x3c, 0x28, 0x575ac7824d421509, 0x70bd2a, 0x4, {0x0, 0x0, 0x0, 0x0, {}, {0x1}, {0x4, 0x3d}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x5}}, @filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x3c}}, 0x40) 91.926483ms ago: executing program 5 (id=2844): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x8, 0xf9, 0x7ffc1ffb}]}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kmem_cache_free\x00', r0}, 0x10) timerfd_gettime(0xffffffffffffffff, &(0x7f0000000040)) 0s ago: executing program 5 (id=2845): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = syz_io_uring_setup(0x236, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x3, 0x42}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r2, r3, 0x0) io_uring_enter(r1, 0x2def, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13) ioctl$TCXONC(r0, 0x540a, 0x2) kernel console output (not intermixed with test programs): pe 10 has an invalid length. [ 198.492889][ T9684] FAULT_INJECTION: forcing a failure. [ 198.492889][ T9684] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 198.506031][ T9684] CPU: 0 UID: 0 PID: 9684 Comm: syz.3.1943 Not tainted syzkaller #0 PREEMPT(voluntary) [ 198.506055][ T9684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 198.506086][ T9684] Call Trace: [ 198.506093][ T9684] [ 198.506103][ T9684] __dump_stack+0x1d/0x30 [ 198.506181][ T9684] dump_stack_lvl+0xe8/0x140 [ 198.506199][ T9684] dump_stack+0x15/0x1b [ 198.506216][ T9684] should_fail_ex+0x265/0x280 [ 198.506238][ T9684] should_fail+0xb/0x20 [ 198.506284][ T9684] should_fail_usercopy+0x1a/0x20 [ 198.506307][ T9684] _copy_from_user+0x1c/0xb0 [ 198.506404][ T9684] ___sys_sendmsg+0xc1/0x1d0 [ 198.506435][ T9684] __x64_sys_sendmsg+0xd4/0x160 [ 198.506456][ T9684] x64_sys_call+0x191e/0x2ff0 [ 198.506473][ T9684] do_syscall_64+0xd2/0x200 [ 198.506498][ T9684] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 198.506582][ T9684] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 198.506608][ T9684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.506630][ T9684] RIP: 0033:0x7f196e61ebe9 [ 198.506644][ T9684] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 198.506659][ T9684] RSP: 002b:00007f196d07f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 198.506752][ T9684] RAX: ffffffffffffffda RBX: 00007f196e845fa0 RCX: 00007f196e61ebe9 [ 198.506765][ T9684] RDX: 0000000004000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 198.506779][ T9684] RBP: 00007f196d07f090 R08: 0000000000000000 R09: 0000000000000000 [ 198.506792][ T9684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 198.506806][ T9684] R13: 00007f196e846038 R14: 00007f196e845fa0 R15: 00007ffc68dcc8a8 [ 198.506825][ T9684] [ 198.520656][ T9686] netlink: 'syz.4.1944': attribute type 6 has an invalid length. [ 198.618225][ T9693] loop3: detected capacity change from 0 to 8192 [ 198.722670][ T9700] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1948'. [ 198.732262][ T9697] loop4: detected capacity change from 0 to 1024 [ 198.738967][ T9697] EXT4-fs: Ignoring removed oldalloc option [ 198.746518][ T9698] loop2: detected capacity change from 0 to 1024 [ 198.757382][ T9693] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 198.761449][ T9698] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 198.779399][ T9698] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 198.809595][ T9697] EXT4-fs: Ignoring removed orlov option [ 198.846308][ T9697] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 198.860210][ T9713] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1952'. [ 198.875242][ T9698] JBD2: no valid journal superblock found [ 198.881023][ T9698] EXT4-fs (loop2): Could not load journal inode [ 198.907639][ T9714] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1953'. [ 199.028765][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 199.084836][ T9728] loop4: detected capacity change from 0 to 128 [ 199.132178][ T9736] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1960'. [ 199.205603][ T9740] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1962'. [ 199.299653][ T9756] loop4: detected capacity change from 0 to 512 [ 199.326548][ T9758] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 199.339278][ T9758] FAULT_INJECTION: forcing a failure. [ 199.339278][ T9758] name failslab, interval 1, probability 0, space 0, times 0 [ 199.352655][ T9758] CPU: 1 UID: 0 PID: 9758 Comm: syz.2.1968 Not tainted syzkaller #0 PREEMPT(voluntary) [ 199.352741][ T9758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 199.352752][ T9758] Call Trace: [ 199.352757][ T9758] [ 199.352817][ T9758] __dump_stack+0x1d/0x30 [ 199.352878][ T9758] dump_stack_lvl+0xe8/0x140 [ 199.352893][ T9758] dump_stack+0x15/0x1b [ 199.352908][ T9758] should_fail_ex+0x265/0x280 [ 199.352977][ T9758] ? __hw_addr_add_ex+0x162/0x440 [ 199.353002][ T9758] should_failslab+0x8c/0xb0 [ 199.353021][ T9758] __kmalloc_cache_noprof+0x4c/0x320 [ 199.353038][ T9758] __hw_addr_add_ex+0x162/0x440 [ 199.353049][ T9758] ? __pfx_wg_setup+0x10/0x10 [ 199.353068][ T9758] dev_addr_init+0xb1/0x120 [ 199.353085][ T9758] alloc_netdev_mqs+0x1c5/0xa30 [ 199.353098][ T9758] rtnl_create_link+0x239/0x710 [ 199.353111][ T9758] rtnl_newlink_create+0x14c/0x620 [ 199.353171][ T9758] ? security_capable+0x83/0x90 [ 199.353185][ T9758] ? netlink_ns_capable+0x86/0xa0 [ 199.353203][ T9758] rtnl_newlink+0xf29/0x12d0 [ 199.353221][ T9758] ? xas_load+0x413/0x430 [ 199.353307][ T9758] ? __memcg_slab_free_hook+0x135/0x230 [ 199.353353][ T9758] ? __rcu_read_unlock+0x4f/0x70 [ 199.353416][ T9758] ? avc_has_perm_noaudit+0x1b1/0x200 [ 199.353430][ T9758] ? cred_has_capability+0x210/0x280 [ 199.353444][ T9758] ? selinux_capable+0x31/0x40 [ 199.353458][ T9758] ? security_capable+0x83/0x90 [ 199.353495][ T9758] ? ns_capable+0x7d/0xb0 [ 199.353506][ T9758] ? __pfx_rtnl_newlink+0x10/0x10 [ 199.353583][ T9758] rtnetlink_rcv_msg+0x5fe/0x6d0 [ 199.353599][ T9758] netlink_rcv_skb+0x123/0x220 [ 199.353610][ T9758] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 199.353696][ T9758] rtnetlink_rcv+0x1c/0x30 [ 199.353709][ T9758] netlink_unicast+0x5bd/0x690 [ 199.353755][ T9758] netlink_sendmsg+0x58b/0x6b0 [ 199.353768][ T9758] ? __pfx_netlink_sendmsg+0x10/0x10 [ 199.353780][ T9758] __sock_sendmsg+0x145/0x180 [ 199.353845][ T9758] ____sys_sendmsg+0x31e/0x4e0 [ 199.353913][ T9758] ___sys_sendmsg+0x17b/0x1d0 [ 199.353931][ T9758] __x64_sys_sendmsg+0xd4/0x160 [ 199.354007][ T9758] x64_sys_call+0x191e/0x2ff0 [ 199.354021][ T9758] do_syscall_64+0xd2/0x200 [ 199.354045][ T9758] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 199.354089][ T9758] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 199.354172][ T9758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.354183][ T9758] RIP: 0033:0x7f252449ebe9 [ 199.354192][ T9758] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 199.354277][ T9758] RSP: 002b:00007f2522f07038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 199.354289][ T9758] RAX: ffffffffffffffda RBX: 00007f25246c5fa0 RCX: 00007f252449ebe9 [ 199.354345][ T9758] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 199.354352][ T9758] RBP: 00007f2522f07090 R08: 0000000000000000 R09: 0000000000000000 [ 199.354359][ T9758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 199.354366][ T9758] R13: 00007f25246c6038 R14: 00007f25246c5fa0 R15: 00007ffe6bb0ccd8 [ 199.354376][ T9758] [ 199.682640][ T9764] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1970'. [ 199.737800][ T9768] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1972'. [ 199.781614][ T9774] loop2: detected capacity change from 0 to 512 [ 199.792120][ T9774] EXT4-fs error (device loop2): ext4_orphan_get:1392: inode #15: comm syz.2.1975: casefold flag without casefold feature [ 199.805259][ T9774] EXT4-fs error (device loop2): ext4_orphan_get:1397: comm syz.2.1975: couldn't read orphan inode 15 (err -117) [ 199.833133][ T9774] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 200.088438][ T9786] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1978'. [ 200.120876][ T9786] netlink: 'syz.3.1978': attribute type 10 has an invalid length. [ 200.134324][ T9786] bond0: (slave dummy0): Releasing backup interface [ 200.149102][ T9792] loop4: detected capacity change from 0 to 512 [ 200.167685][ T9792] EXT4-fs: Ignoring removed orlov option [ 200.168133][ T9786] team0: Port device dummy0 added [ 200.177016][ T9792] EXT4-fs: EXT4-fs: inode_readahead_blks must be 0 or a power of 2 smaller than 2^31 [ 200.189415][ T9793] netlink: 'syz.3.1978': attribute type 10 has an invalid length. [ 200.230281][ T9793] team0: Port device dummy0 removed [ 200.250482][ T9793] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 200.276777][ T9795] loop4: detected capacity change from 0 to 128 [ 200.700996][ T3304] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 200.815104][ T9823] loop2: detected capacity change from 0 to 512 [ 200.828481][ T29] kauditd_printk_skb: 156 callbacks suppressed [ 200.828494][ T29] audit: type=1326 audit(1756437033.304:13143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9821 comm="syz.2.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 200.878400][ T29] audit: type=1326 audit(1756437033.304:13144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9821 comm="syz.2.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 200.901997][ T29] audit: type=1326 audit(1756437033.304:13145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9821 comm="syz.2.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 200.925545][ T29] audit: type=1326 audit(1756437033.304:13146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9821 comm="syz.2.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 200.949170][ T29] audit: type=1326 audit(1756437033.304:13147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9821 comm="syz.2.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 200.972686][ T29] audit: type=1326 audit(1756437033.304:13148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9821 comm="syz.2.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 200.996242][ T29] audit: type=1326 audit(1756437033.304:13149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9821 comm="syz.2.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 201.019816][ T29] audit: type=1326 audit(1756437033.304:13150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9821 comm="syz.2.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 201.043301][ T29] audit: type=1326 audit(1756437033.304:13151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9821 comm="syz.2.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 201.066863][ T29] audit: type=1326 audit(1756437033.304:13152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9821 comm="syz.2.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f252449ec23 code=0x7ffc0000 [ 201.197620][ T9842] loop3: detected capacity change from 0 to 128 [ 201.406562][ T9859] netlink: 'syz.1.2003': attribute type 10 has an invalid length. [ 201.416172][ T9859] bond0: (slave dummy0): Releasing backup interface [ 201.426052][ T9859] team0: Port device dummy0 added [ 201.432747][ T9859] netlink: 'syz.1.2003': attribute type 10 has an invalid length. [ 201.465269][ T9859] team0: Port device dummy0 removed [ 201.471976][ T9859] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 201.506448][ T9864] netlink: 'syz.1.2005': attribute type 10 has an invalid length. [ 201.527609][ T9864] bond0: (slave dummy0): Releasing backup interface [ 201.578324][ T9864] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 201.597861][ T9871] netlink: 'syz.1.2005': attribute type 10 has an invalid length. [ 201.613470][ T9864] team0: Failed to send options change via netlink (err -105) [ 201.621626][ T9864] team0: Port device dummy0 added [ 201.635934][ T9871] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 201.641658][ T9869] loop2: detected capacity change from 0 to 128 [ 201.658594][ T9871] team0: Failed to send options change via netlink (err -105) [ 201.678313][ T9871] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 201.690800][ T9871] team0: Port device dummy0 removed [ 201.721569][ T9871] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 202.339456][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 202.471728][ T9909] loop3: detected capacity change from 0 to 128 [ 202.500090][ T9911] loop3: detected capacity change from 0 to 128 [ 202.556463][ T9913] loop2: detected capacity change from 0 to 8192 [ 202.566280][ T9913] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 202.586185][ T9917] loop3: detected capacity change from 0 to 128 [ 202.601067][ T9917] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000100) [ 202.609014][ T9917] FAT-fs (loop3): Filesystem has been set read-only [ 202.615799][ T9917] bio_check_eod: 14260 callbacks suppressed [ 202.621853][ T9917] syz.3.2025: attempt to access beyond end of device [ 202.621853][ T9917] loop3: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 202.635912][ T9917] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000100) [ 202.643738][ T9917] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000100) [ 202.668021][ T9917] syz.3.2025: attempt to access beyond end of device [ 202.668021][ T9917] loop3: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 202.681803][ T9917] syz.3.2025: attempt to access beyond end of device [ 202.681803][ T9917] loop3: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 202.696473][ T9917] syz.3.2025: attempt to access beyond end of device [ 202.696473][ T9917] loop3: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 202.710649][ T9917] syz.3.2025: attempt to access beyond end of device [ 202.710649][ T9917] loop3: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 202.724629][ T9918] syz.3.2025: attempt to access beyond end of device [ 202.724629][ T9918] loop3: rw=0, sector=2065, nr_sectors = 1 limit=128 [ 202.738003][ T9918] buffer_io_error: 14254 callbacks suppressed [ 202.738015][ T9918] Buffer I/O error on dev loop3, logical block 2065, async page read [ 202.752704][ T9918] syz.3.2025: attempt to access beyond end of device [ 202.752704][ T9918] loop3: rw=0, sector=2066, nr_sectors = 1 limit=128 [ 202.766714][ T9918] Buffer I/O error on dev loop3, logical block 2066, async page read [ 202.776508][ T9918] syz.3.2025: attempt to access beyond end of device [ 202.776508][ T9918] loop3: rw=0, sector=2067, nr_sectors = 1 limit=128 [ 202.790440][ T9918] Buffer I/O error on dev loop3, logical block 2067, async page read [ 202.800474][ T9918] syz.3.2025: attempt to access beyond end of device [ 202.800474][ T9918] loop3: rw=0, sector=2068, nr_sectors = 1 limit=128 [ 202.814454][ T9918] Buffer I/O error on dev loop3, logical block 2068, async page read [ 202.822669][ T9918] syz.3.2025: attempt to access beyond end of device [ 202.822669][ T9918] loop3: rw=0, sector=2069, nr_sectors = 1 limit=128 [ 202.836612][ T9918] Buffer I/O error on dev loop3, logical block 2069, async page read [ 202.844757][ T9918] Buffer I/O error on dev loop3, logical block 2070, async page read [ 202.854775][ T9918] Buffer I/O error on dev loop3, logical block 2071, async page read [ 202.862858][ T9918] Buffer I/O error on dev loop3, logical block 2072, async page read [ 202.871021][ T9918] Buffer I/O error on dev loop3, logical block 2065, async page read [ 202.882261][ T9918] Buffer I/O error on dev loop3, logical block 2066, async page read [ 203.017261][ T9941] loop2: detected capacity change from 0 to 1024 [ 203.048288][ T9941] EXT4-fs: Ignoring removed orlov option [ 203.059984][ T9941] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 203.394842][ T9941] tipc: Started in network mode [ 203.399889][ T9941] tipc: Node identity ac14140f, cluster identity 4711 [ 203.416555][ T9941] tipc: New replicast peer: 255.255.255.255 [ 203.422659][ T9941] tipc: Enabled bearer , priority 10 [ 203.490120][ T3304] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 203.586563][ T9953] loop3: detected capacity change from 0 to 8192 [ 203.602021][ T9953] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 203.609591][ T9959] netlink: 'syz.0.2039': attribute type 10 has an invalid length. [ 203.633263][ T9959] bond0: (slave dummy0): Releasing backup interface [ 203.655395][ T9959] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 203.678224][ T9959] team0: Failed to send options change via netlink (err -105) [ 203.685866][ T9959] team0: Port device dummy0 added [ 203.693392][ T9966] netlink: 'syz.0.2039': attribute type 10 has an invalid length. [ 203.702722][ T9966] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 203.714602][ T9966] team0: Failed to send options change via netlink (err -105) [ 203.722519][ T9966] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 203.732392][ T9966] team0: Port device dummy0 removed [ 203.785646][ T9966] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 203.947306][ T9975] __nla_validate_parse: 9 callbacks suppressed [ 203.947322][ T9975] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2043'. [ 204.070837][ T9979] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2045'. [ 204.093819][ T9977] block device autoloading is deprecated and will be removed. [ 204.104685][ T9977] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.152702][ T9981] FAULT_INJECTION: forcing a failure. [ 204.152702][ T9981] name failslab, interval 1, probability 0, space 0, times 0 [ 204.166060][ T9981] CPU: 1 UID: 0 PID: 9981 Comm: syz.3.2046 Not tainted syzkaller #0 PREEMPT(voluntary) [ 204.166088][ T9981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 204.166100][ T9981] Call Trace: [ 204.166107][ T9981] [ 204.166114][ T9981] __dump_stack+0x1d/0x30 [ 204.166134][ T9981] dump_stack_lvl+0xe8/0x140 [ 204.166152][ T9981] dump_stack+0x15/0x1b [ 204.166168][ T9981] should_fail_ex+0x265/0x280 [ 204.166188][ T9981] should_failslab+0x8c/0xb0 [ 204.166211][ T9981] kmem_cache_alloc_noprof+0x50/0x310 [ 204.166236][ T9981] ? vm_area_alloc+0x2c/0xb0 [ 204.166264][ T9981] vm_area_alloc+0x2c/0xb0 [ 204.166287][ T9981] mmap_region+0xaa2/0x1630 [ 204.166329][ T9981] do_mmap+0x9b3/0xbe0 [ 204.166361][ T9981] vm_mmap_pgoff+0x17a/0x2e0 [ 204.166390][ T9981] ksys_mmap_pgoff+0xc2/0x310 [ 204.166424][ T9981] ? __x64_sys_mmap+0x49/0x70 [ 204.166445][ T9981] x64_sys_call+0x14a3/0x2ff0 [ 204.166463][ T9981] do_syscall_64+0xd2/0x200 [ 204.166489][ T9981] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 204.166509][ T9981] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 204.166528][ T9981] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.166545][ T9981] RIP: 0033:0x7f196e61ec23 [ 204.166564][ T9981] Code: f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 89 ca 41 f7 c1 ff 0f 00 00 75 14 b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 25 c3 0f 1f 40 00 48 c7 c0 a8 ff ff ff 64 c7 [ 204.166579][ T9981] RSP: 002b:00007f196d07ee18 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 204.166595][ T9981] RAX: ffffffffffffffda RBX: 00000000000004e8 RCX: 00007f196e61ec23 [ 204.166607][ T9981] RDX: 0000000000000003 RSI: 0000000008400000 RDI: 0000000000000000 [ 204.166617][ T9981] RBP: 00002000000006c2 R08: 00000000ffffffff R09: 0000000000000000 [ 204.166627][ T9981] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000000006 [ 204.166637][ T9981] R13: 00007f196d07eef0 R14: 00007f196d07eeb0 R15: 0000200000002240 [ 204.166652][ T9981] [ 204.371125][ T9977] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.427436][ T9977] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.439285][ T9984] loop4: detected capacity change from 0 to 8192 [ 204.447963][ T9984] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 204.482858][ T8855] tipc: Node number set to 2886997007 [ 204.503568][ T9977] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.594173][ T41] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.617867][ T9994] loop3: detected capacity change from 0 to 8192 [ 204.624396][ T41] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.645941][ T41] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.656141][ T9994] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 204.677178][ T41] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.723133][T10000] loop1: detected capacity change from 0 to 512 [ 204.768574][T10000] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 204.830333][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 204.912407][T10014] loop2: detected capacity change from 0 to 8192 [ 204.933124][T10014] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 205.063023][ T36] hid_parser_main: 22 callbacks suppressed [ 205.063039][ T36] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 205.076912][ T36] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 205.084323][ T36] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 205.091704][ T36] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 205.099878][ T36] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 205.107281][ T36] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 205.115375][ T36] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 205.122784][ T36] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 205.130168][ T36] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 205.138319][ T36] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 205.154559][ T36] hid-generic 0000:0000:0000.0011: hidraw0: HID v0.00 Device [sy] on syz0 [ 205.185706][T10047] fido_id[10047]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 205.516282][T10058] vlan2: entered promiscuous mode [ 205.521546][T10058] vlan2: entered allmulticast mode [ 205.526671][T10058] hsr_slave_1: entered allmulticast mode [ 205.600340][T10062] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2069'. [ 205.683686][T10062] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 205.725591][T10058] selinux_netlink_send: 24 callbacks suppressed [ 205.725607][T10058] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10058 comm=syz.2.2068 [ 205.770435][T10058] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2068'. [ 205.839462][ T29] kauditd_printk_skb: 370 callbacks suppressed [ 205.839478][ T29] audit: type=1326 audit(1756437038.564:13523): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10092 comm="syz.0.2078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 205.870615][ T29] audit: type=1326 audit(1756437038.564:13524): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10092 comm="syz.0.2078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 205.895173][ T29] audit: type=1326 audit(1756437038.564:13525): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10092 comm="syz.0.2078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 205.919945][ T29] audit: type=1326 audit(1756437038.564:13526): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10092 comm="syz.0.2078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 205.944680][ T29] audit: type=1326 audit(1756437038.564:13527): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10092 comm="syz.0.2078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 206.002025][ T29] audit: type=1326 audit(1756437038.574:13528): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10092 comm="syz.0.2078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 206.026808][ T29] audit: type=1326 audit(1756437038.574:13529): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10092 comm="syz.0.2078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 206.051600][ T29] audit: type=1326 audit(1756437038.574:13530): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10092 comm="syz.0.2078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 206.076220][ T29] audit: type=1326 audit(1756437038.574:13531): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10092 comm="syz.0.2078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 206.100827][ T29] audit: type=1326 audit(1756437038.574:13532): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10092 comm="syz.0.2078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 206.462607][T10162] FAULT_INJECTION: forcing a failure. [ 206.462607][T10162] name failslab, interval 1, probability 0, space 0, times 0 [ 206.476146][T10162] CPU: 1 UID: 0 PID: 10162 Comm: syz.1.2086 Not tainted syzkaller #0 PREEMPT(voluntary) [ 206.476235][T10162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 206.476245][T10162] Call Trace: [ 206.476253][T10162] [ 206.476291][T10162] __dump_stack+0x1d/0x30 [ 206.476379][T10162] dump_stack_lvl+0xe8/0x140 [ 206.476398][T10162] dump_stack+0x15/0x1b [ 206.476415][T10162] should_fail_ex+0x265/0x280 [ 206.476445][T10162] should_failslab+0x8c/0xb0 [ 206.476465][T10162] kmem_cache_alloc_lru_noprof+0x55/0x310 [ 206.476493][T10162] ? __d_alloc+0x3d/0x340 [ 206.476601][T10162] __d_alloc+0x3d/0x340 [ 206.476623][T10162] d_alloc_parallel+0x53/0xc60 [ 206.476667][T10162] ? bpf_trace_run4+0x134/0x1d0 [ 206.476691][T10162] ? __rcu_read_unlock+0x4f/0x70 [ 206.476712][T10162] ? __d_lookup+0x316/0x340 [ 206.476818][T10162] __lookup_slow+0x8c/0x250 [ 206.476895][T10162] lookup_noperm+0xc9/0x180 [ 206.476921][T10162] simple_start_creating+0x97/0x120 [ 206.476997][T10162] start_creating+0xe9/0x160 [ 206.477020][T10162] __debugfs_create_file+0x6b/0x330 [ 206.477046][T10162] debugfs_create_file_full+0x3f/0x60 [ 206.477132][T10162] ? __pfx_macsec_setup+0x10/0x10 [ 206.477161][T10162] ref_tracker_dir_debugfs+0x100/0x1e0 [ 206.477189][T10162] alloc_netdev_mqs+0x1a2/0xa30 [ 206.477221][T10162] rtnl_create_link+0x239/0x710 [ 206.477245][T10162] rtnl_newlink_create+0x14c/0x620 [ 206.477271][T10162] ? security_capable+0x83/0x90 [ 206.477322][T10162] ? netlink_ns_capable+0x86/0xa0 [ 206.477352][T10162] rtnl_newlink+0xf29/0x12d0 [ 206.477373][T10162] ? mod_memcg_lruvec_state+0x1fc/0x2c0 [ 206.477471][T10162] ? __rcu_read_unlock+0x4f/0x70 [ 206.477518][T10162] ? bpf_trace_run4+0x134/0x1d0 [ 206.477537][T10162] ? __rcu_read_unlock+0x4f/0x70 [ 206.477555][T10162] ? avc_has_perm_noaudit+0x1b1/0x200 [ 206.477633][T10162] ? cred_has_capability+0x210/0x280 [ 206.477653][T10162] ? selinux_capable+0x31/0x40 [ 206.477674][T10162] ? security_capable+0x83/0x90 [ 206.477758][T10162] ? ns_capable+0x7d/0xb0 [ 206.477778][T10162] ? __pfx_rtnl_newlink+0x10/0x10 [ 206.477804][T10162] rtnetlink_rcv_msg+0x5fe/0x6d0 [ 206.477865][T10162] ? avc_has_perm_noaudit+0x1b1/0x200 [ 206.477889][T10162] netlink_rcv_skb+0x123/0x220 [ 206.477905][T10162] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 206.477933][T10162] rtnetlink_rcv+0x1c/0x30 [ 206.477996][T10162] netlink_unicast+0x5bd/0x690 [ 206.478026][T10162] netlink_sendmsg+0x58b/0x6b0 [ 206.478050][T10162] ? __pfx_netlink_sendmsg+0x10/0x10 [ 206.478073][T10162] __sock_sendmsg+0x145/0x180 [ 206.478161][T10162] ____sys_sendmsg+0x31e/0x4e0 [ 206.478186][T10162] ___sys_sendmsg+0x17b/0x1d0 [ 206.478287][T10162] __x64_sys_sendmsg+0xd4/0x160 [ 206.478314][T10162] x64_sys_call+0x191e/0x2ff0 [ 206.478336][T10162] do_syscall_64+0xd2/0x200 [ 206.478361][T10162] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 206.478455][T10162] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 206.478475][T10162] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.478496][T10162] RIP: 0033:0x7f23ea43ebe9 [ 206.478559][T10162] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 206.478577][T10162] RSP: 002b:00007f23e8ea7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 206.478597][T10162] RAX: ffffffffffffffda RBX: 00007f23ea665fa0 RCX: 00007f23ea43ebe9 [ 206.478608][T10162] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000006 [ 206.478620][T10162] RBP: 00007f23e8ea7090 R08: 0000000000000000 R09: 0000000000000000 [ 206.478654][T10162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 206.478665][T10162] R13: 00007f23ea666038 R14: 00007f23ea665fa0 R15: 00007ffd6d742078 [ 206.478680][T10162] [ 206.850566][T10162] bridge0: port 3(macsec1) entered blocking state [ 206.857785][T10162] bridge0: port 3(macsec1) entered disabled state [ 206.886992][T10162] macsec1: entered allmulticast mode [ 206.892354][T10162] bridge0: entered allmulticast mode [ 206.919130][T10162] macsec1: left allmulticast mode [ 206.924248][T10162] bridge0: left allmulticast mode [ 206.958211][T10169] loop4: detected capacity change from 0 to 256 [ 207.004346][T10179] loop3: detected capacity change from 0 to 512 [ 207.393713][T10203] loop2: detected capacity change from 0 to 512 [ 207.415593][T10203] EXT4-fs error (device loop2): ext4_orphan_get:1392: inode #15: comm syz.2.2095: casefold flag without casefold feature [ 207.482427][T10203] EXT4-fs (loop2): Remounting filesystem read-only [ 207.499454][T10203] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 207.577721][T10217] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2101'. [ 207.871657][T10244] netlink: 'syz.1.2113': attribute type 10 has an invalid length. [ 207.883025][T10244] bond0: (slave dummy0): Releasing backup interface [ 207.891017][T10244] team0: Port device dummy0 added [ 207.897741][T10244] netlink: 'syz.1.2113': attribute type 10 has an invalid length. [ 207.906958][T10244] team0: Port device dummy0 removed [ 207.914547][T10244] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 208.084436][T10264] loop4: detected capacity change from 0 to 8192 [ 208.094290][T10264] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 208.159601][ T3304] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 208.251245][T10279] tmpfs: Bad value for 'mpol' [ 208.259723][T10279] netlink: 'syz.1.2129': attribute type 2 has an invalid length. [ 208.304483][T10283] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2130'. [ 208.753838][T10291] sd 0:0:1:0: device reset [ 208.762359][T10291] netlink: 'syz.3.2131': attribute type 10 has an invalid length. [ 208.851685][T10295] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2132'. [ 208.920517][T10300] loop3: detected capacity change from 0 to 8192 [ 208.929826][T10300] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 208.943930][T10302] pim6reg1: entered promiscuous mode [ 208.949252][T10302] pim6reg1: entered allmulticast mode [ 208.967459][T10302] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10302 comm=syz.1.2135 [ 209.096971][T10310] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2139'. [ 209.115526][T10312] netlink: 'syz.4.2140': attribute type 10 has an invalid length. [ 209.183930][T10312] bond0: (slave dummy0): Releasing backup interface [ 209.219381][T10312] team0: Port device dummy0 added [ 209.254692][T10312] netlink: 'syz.4.2140': attribute type 10 has an invalid length. [ 209.280809][T10312] team0: Port device dummy0 removed [ 209.289240][T10312] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 209.313485][T10322] sd 0:0:1:0: device reset [ 209.575313][T10325] netlink: 'syz.2.2142': attribute type 10 has an invalid length. [ 210.075501][T10334] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2145'. [ 210.089164][T10332] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 210.097577][T10334] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 210.121269][T10336] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2146'. [ 210.176366][T10340] wg2: entered promiscuous mode [ 210.181873][T10340] wg2: entered allmulticast mode [ 210.234419][T10349] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2151'. [ 210.244945][T10349] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 210.398849][ T3362] hid_parser_main: 22 callbacks suppressed [ 210.398937][ T3362] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 210.412784][ T3362] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 210.420224][ T3362] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 210.427630][ T3362] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 210.435203][ T3362] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 210.443224][ T3362] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 210.450725][ T3362] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 210.458828][ T3362] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 210.466311][ T3362] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 210.474441][ T3362] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 210.537976][T10369] FAULT_INJECTION: forcing a failure. [ 210.537976][T10369] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 210.551080][T10369] CPU: 0 UID: 0 PID: 10369 Comm: syz.4.2153 Not tainted syzkaller #0 PREEMPT(voluntary) [ 210.551111][T10369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 210.551124][T10369] Call Trace: [ 210.551131][T10369] [ 210.551138][T10369] __dump_stack+0x1d/0x30 [ 210.551156][T10369] dump_stack_lvl+0xe8/0x140 [ 210.551174][T10369] dump_stack+0x15/0x1b [ 210.551187][T10369] should_fail_ex+0x265/0x280 [ 210.551210][T10369] should_fail+0xb/0x20 [ 210.551229][T10369] should_fail_usercopy+0x1a/0x20 [ 210.551248][T10369] _copy_to_user+0x20/0xa0 [ 210.551336][T10369] simple_read_from_buffer+0xb5/0x130 [ 210.551355][T10369] proc_fail_nth_read+0x10e/0x150 [ 210.551421][T10369] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 210.551487][T10369] vfs_read+0x1a8/0x770 [ 210.551508][T10369] ? __rcu_read_unlock+0x4f/0x70 [ 210.551530][T10369] ? __fget_files+0x184/0x1c0 [ 210.551551][T10369] ? finish_task_switch+0xad/0x2b0 [ 210.551569][T10369] ksys_read+0xda/0x1a0 [ 210.551660][T10369] __x64_sys_read+0x40/0x50 [ 210.551682][T10369] x64_sys_call+0x27bc/0x2ff0 [ 210.551755][T10369] do_syscall_64+0xd2/0x200 [ 210.551777][T10369] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 210.551798][T10369] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 210.551892][T10369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.551959][T10369] RIP: 0033:0x7f5b97d8d5fc [ 210.551973][T10369] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 210.552018][T10369] RSP: 002b:00007f5b967ad030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 210.552037][T10369] RAX: ffffffffffffffda RBX: 00007f5b97fb6180 RCX: 00007f5b97d8d5fc [ 210.552051][T10369] RDX: 000000000000000f RSI: 00007f5b967ad0a0 RDI: 0000000000000005 [ 210.552064][T10369] RBP: 00007f5b967ad090 R08: 0000000000000000 R09: 0000000000000000 [ 210.552151][T10369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 210.552164][T10369] R13: 00007f5b97fb6218 R14: 00007f5b97fb6180 R15: 00007fffcc21a3f8 [ 210.552240][T10369] [ 210.797309][ T3362] hid-generic 0000:0000:0000.0012: hidraw0: HID v0.00 Device [sy] on syz0 [ 210.820722][T10372] fido_id[10372]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 210.870564][T10371] loop4: detected capacity change from 0 to 8192 [ 210.879352][T10371] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 211.027371][ T29] kauditd_printk_skb: 335 callbacks suppressed [ 211.027387][ T29] audit: type=1326 audit(1756437044.013:13868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10381 comm="syz.2.2161" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 211.068188][ T29] audit: type=1326 audit(1756437044.013:13869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10381 comm="syz.2.2161" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 211.092662][ T29] audit: type=1326 audit(1756437044.013:13870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10381 comm="syz.2.2161" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 211.116860][ T29] audit: type=1326 audit(1756437044.013:13871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10381 comm="syz.2.2161" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 211.141146][ T29] audit: type=1326 audit(1756437044.013:13872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10381 comm="syz.2.2161" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 211.165426][ T29] audit: type=1326 audit(1756437044.013:13873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10381 comm="syz.2.2161" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 211.189352][ T29] audit: type=1326 audit(1756437044.013:13874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10381 comm="syz.2.2161" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 211.193385][T10389] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2164'. [ 211.213471][ T29] audit: type=1326 audit(1756437044.013:13875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10381 comm="syz.2.2161" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 211.246077][ T29] audit: type=1326 audit(1756437044.013:13876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10381 comm="syz.2.2161" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 211.255738][T10389] netlink: 'syz.3.2164': attribute type 10 has an invalid length. [ 211.269663][ T29] audit: type=1326 audit(1756437044.013:13877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10381 comm="syz.2.2161" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 211.275249][T10390] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2163'. [ 211.310979][T10393] netlink: 'syz.3.2164': attribute type 10 has an invalid length. [ 211.316171][T10392] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2165'. [ 211.319791][T10390] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 211.328121][T10389] bond0: (slave dummy0): Releasing backup interface [ 211.337072][T10392] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 211.354280][T10389] team0: Port device dummy0 added [ 211.370203][T10393] team0: Port device dummy0 removed [ 211.381003][T10393] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 211.436068][T10406] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2168'. [ 211.445438][T10406] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 211.520030][T10417] netlink: 'syz.3.2176': attribute type 10 has an invalid length. [ 211.530612][T10417] bond0: (slave dummy0): Releasing backup interface [ 211.543293][T10417] team0: Failed to send options change via netlink (err -105) [ 211.550824][T10417] team0: Port device dummy0 added [ 211.563014][T10417] netlink: 'syz.3.2176': attribute type 10 has an invalid length. [ 211.572016][T10417] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 211.583570][T10417] team0: Failed to send options change via netlink (err -105) [ 211.591629][T10417] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 211.600702][T10417] team0: Port device dummy0 removed [ 211.607809][T10417] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 212.023928][T10431] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2180'. [ 212.034981][T10431] netlink: 'syz.2.2180': attribute type 10 has an invalid length. [ 212.044616][T10431] bond0: (slave dummy0): Releasing backup interface [ 212.054448][T10431] team0: Port device dummy0 added [ 212.061891][T10431] netlink: 'syz.2.2180': attribute type 10 has an invalid length. [ 212.073938][T10431] team0: Port device dummy0 removed [ 212.081504][T10431] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 212.418548][T10461] block device autoloading is deprecated and will be removed. [ 212.472250][T10465] sd 0:0:1:0: device reset [ 212.495848][T10470] bond0: (slave dummy0): Releasing backup interface [ 212.505037][T10470] team0: Port device dummy0 added [ 212.506886][T10471] loop1: detected capacity change from 0 to 128 [ 212.517036][T10470] team0: Port device dummy0 removed [ 212.525781][T10470] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 213.095229][T10485] 8021q: adding VLAN 0 to HW filter on device bond1 [ 213.112190][T10483] loop1: detected capacity change from 0 to 2048 [ 213.126148][T10485] 8021q: adding VLAN 0 to HW filter on device bond1 [ 213.135664][T10485] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 213.152677][T10485] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 213.162607][T10483] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000900 r/w without journal. Quota mode: none. [ 213.260578][T10504] bond0: (slave dummy0): Releasing backup interface [ 213.270670][T10504] team0: Failed to send options change via netlink (err -105) [ 213.278235][T10504] team0: Port device dummy0 added [ 213.287544][T10504] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 213.298911][T10504] team0: Failed to send options change via netlink (err -105) [ 213.308094][T10504] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 213.317499][T10504] team0: Port device dummy0 removed [ 213.332265][T10504] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 213.705315][T10512] validate_nla: 6 callbacks suppressed [ 213.705329][T10512] netlink: 'syz.2.2210': attribute type 10 has an invalid length. [ 213.745097][T10505] __nla_validate_parse: 10 callbacks suppressed [ 213.745112][T10505] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2201'. [ 213.760989][T10505] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2201'. [ 213.765870][T10518] netlink: 'syz.2.2210': attribute type 10 has an invalid length. [ 213.770283][T10505] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2201'. [ 213.792573][T10512] bond0: (slave dummy0): Releasing backup interface [ 213.816137][T10512] team0: Failed to send options change via netlink (err -105) [ 213.823679][T10512] team0: Port device dummy0 added [ 213.843613][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000900. [ 213.844110][T10518] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 213.864077][T10518] team0: Failed to send options change via netlink (err -105) [ 213.871652][T10518] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 213.881714][T10518] team0: Port device dummy0 removed [ 213.889503][T10518] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 213.960151][T10527] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2214'. [ 214.024078][T10531] wg0: entered promiscuous mode [ 214.072929][T10536] tmpfs: Unknown parameter 'Š_ÚS' [ 214.138330][T10539] netlink: 240 bytes leftover after parsing attributes in process `syz.4.2218'. [ 214.149947][ T11] I/O error, dev loop9, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 214.764390][T10548] netlink: 'syz.1.2220': attribute type 10 has an invalid length. [ 214.773635][T10548] bond0: (slave dummy0): Releasing backup interface [ 214.782960][T10548] team0: Port device dummy0 added [ 214.789008][T10548] netlink: 'syz.1.2220': attribute type 10 has an invalid length. [ 214.799426][T10548] team0: Port device dummy0 removed [ 214.805804][T10548] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 214.922189][T10566] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2227'. [ 214.933453][T10566] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 214.977850][T10569] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2228'. [ 215.017990][T10568] netlink: 'syz.0.2228': attribute type 10 has an invalid length. [ 215.031604][T10572] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2229'. [ 215.036724][T10568] bond0: (slave dummy0): Releasing backup interface [ 215.052555][T10572] block device autoloading is deprecated and will be removed. [ 215.063101][T10568] team0: Port device dummy0 added [ 215.078014][T10569] netlink: 'syz.0.2228': attribute type 10 has an invalid length. [ 215.122560][T10569] team0: Port device dummy0 removed [ 215.129676][T10569] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 215.229463][T10579] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2232'. [ 215.248248][T10580] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2233'. [ 215.272105][T10579] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 215.310975][T10594] netlink: 'syz.3.2237': attribute type 10 has an invalid length. [ 215.337626][T10594] bond0: (slave dummy0): Releasing backup interface [ 215.349115][T10594] team0: Port device dummy0 added [ 215.357050][T10594] netlink: 'syz.3.2237': attribute type 10 has an invalid length. [ 215.370710][T10601] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 215.380694][T10594] team0: Port device dummy0 removed [ 215.388596][T10594] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 215.939996][ T29] kauditd_printk_skb: 489 callbacks suppressed [ 215.940011][ T29] audit: type=1400 audit(1756437049.158:14367): avc: denied { ioctl } for pid=10616 comm="syz.0.2244" path="/dev/input/event2" dev="devtmpfs" ino=249 ioctlcmd=0x4504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 216.011343][ T29] audit: type=1326 audit(1756437049.242:14368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10620 comm="syz.0.2246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 216.012203][ T81] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 216.056289][T10622] FAULT_INJECTION: forcing a failure. [ 216.056289][T10622] name failslab, interval 1, probability 0, space 0, times 0 [ 216.068979][T10622] CPU: 0 UID: 0 PID: 10622 Comm: syz.1.2245 Not tainted syzkaller #0 PREEMPT(voluntary) [ 216.069003][T10622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 216.069014][T10622] Call Trace: [ 216.069011][ T29] audit: type=1326 audit(1756437049.242:14369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10620 comm="syz.0.2246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 216.069022][T10622] [ 216.069030][T10622] __dump_stack+0x1d/0x30 [ 216.069118][T10622] dump_stack_lvl+0xe8/0x140 [ 216.069137][T10622] dump_stack+0x15/0x1b [ 216.069154][T10622] should_fail_ex+0x265/0x280 [ 216.069174][T10622] should_failslab+0x8c/0xb0 [ 216.069235][T10622] kmem_cache_alloc_noprof+0x50/0x310 [ 216.069261][T10622] ? xfrm_state_alloc+0x2c/0x190 [ 216.069290][T10622] xfrm_state_alloc+0x2c/0x190 [ 216.069393][T10622] xfrm_add_sa+0xf4e/0x2430 [ 216.069418][T10622] xfrm_user_rcv_msg+0x563/0x660 [ 216.069441][T10622] ? obj_cgroup_charge_account+0x122/0x1a0 [ 216.069518][T10622] netlink_rcv_skb+0x123/0x220 [ 216.069537][T10622] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 216.069563][T10622] xfrm_netlink_rcv+0x48/0x60 [ 216.069582][T10622] netlink_unicast+0x5bd/0x690 [ 216.069613][T10622] netlink_sendmsg+0x58b/0x6b0 [ 216.069709][T10622] ? __pfx_netlink_sendmsg+0x10/0x10 [ 216.069794][T10622] __sock_sendmsg+0x145/0x180 [ 216.069890][T10622] ____sys_sendmsg+0x31e/0x4e0 [ 216.069914][T10622] ___sys_sendmsg+0x17b/0x1d0 [ 216.070006][T10622] __x64_sys_sendmsg+0xd4/0x160 [ 216.070032][T10622] x64_sys_call+0x191e/0x2ff0 [ 216.070052][T10622] do_syscall_64+0xd2/0x200 [ 216.070085][T10622] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 216.070107][T10622] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 216.070130][T10622] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.070217][T10622] RIP: 0033:0x7f23ea43ebe9 [ 216.070233][T10622] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 216.070252][T10622] RSP: 002b:00007f23e8e86038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 216.070271][T10622] RAX: ffffffffffffffda RBX: 00007f23ea666090 RCX: 00007f23ea43ebe9 [ 216.070346][T10622] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 000000000000000b [ 216.070358][T10622] RBP: 00007f23e8e86090 R08: 0000000000000000 R09: 0000000000000000 [ 216.070370][T10622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 216.070383][T10622] R13: 00007f23ea666128 R14: 00007f23ea666090 R15: 00007ffd6d742078 [ 216.070401][T10622] [ 216.329014][ T29] audit: type=1326 audit(1756437049.242:14370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10620 comm="syz.0.2246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 216.353044][ T29] audit: type=1326 audit(1756437049.242:14371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10620 comm="syz.0.2246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 216.377161][ T29] audit: type=1326 audit(1756437049.242:14372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10620 comm="syz.0.2246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 216.401198][ T29] audit: type=1326 audit(1756437049.242:14373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10620 comm="syz.0.2246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 216.425165][ T29] audit: type=1326 audit(1756437049.242:14374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10620 comm="syz.0.2246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 216.449296][ T29] audit: type=1326 audit(1756437049.242:14375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10620 comm="syz.0.2246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=75 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 216.473370][ T29] audit: type=1326 audit(1756437049.284:14376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10620 comm="syz.0.2246" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 216.608533][T10635] loop1: detected capacity change from 0 to 1024 [ 216.618922][T10639] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 216.628751][T10635] EXT4-fs: Ignoring removed oldalloc option [ 216.634785][T10635] EXT4-fs: Ignoring removed orlov option [ 216.648377][T10636] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 216.687690][T10635] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 216.912734][ T36] hid_parser_main: 22 callbacks suppressed [ 216.912750][ T36] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 216.926213][ T36] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 216.934467][ T36] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 216.941987][ T36] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 216.949424][ T36] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 216.957731][ T36] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 216.965280][ T36] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 216.973283][ T36] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 216.980843][ T36] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 216.988301][ T36] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 217.262615][ T36] hid-generic 0000:0000:0000.0013: hidraw0: HID v0.00 Device [sy] on syz0 [ 217.408475][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 218.056759][T10696] netlink: 'syz.1.2273': attribute type 4 has an invalid length. [ 218.071952][T10696] netlink: 'syz.1.2273': attribute type 4 has an invalid length. [ 218.086071][T10696] FAULT_INJECTION: forcing a failure. [ 218.086071][T10696] name failslab, interval 1, probability 0, space 0, times 0 [ 218.099479][T10696] CPU: 1 UID: 0 PID: 10696 Comm: syz.1.2273 Not tainted syzkaller #0 PREEMPT(voluntary) [ 218.099508][T10696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 218.099578][T10696] Call Trace: [ 218.099585][T10696] [ 218.099592][T10696] __dump_stack+0x1d/0x30 [ 218.099611][T10696] dump_stack_lvl+0xe8/0x140 [ 218.099628][T10696] dump_stack+0x15/0x1b [ 218.099644][T10696] should_fail_ex+0x265/0x280 [ 218.099664][T10696] ? igmpv3_add_delrec+0x89/0x2e0 [ 218.099771][T10696] should_failslab+0x8c/0xb0 [ 218.099806][T10696] __kmalloc_cache_noprof+0x4c/0x320 [ 218.099832][T10696] ? __mod_timer+0x86/0x840 [ 218.099856][T10696] igmpv3_add_delrec+0x89/0x2e0 [ 218.099880][T10696] __igmp_group_dropped+0x409/0x460 [ 218.099931][T10696] ? mod_timer+0x1f/0x30 [ 218.099954][T10696] ? ip_mc_del_src+0x35d/0x480 [ 218.099986][T10696] __ip_mc_dec_group+0x194/0x3d0 [ 218.100010][T10696] ip_mc_leave_group+0x2f8/0x370 [ 218.100038][T10696] do_ip_setsockopt+0x1e98/0x2240 [ 218.100067][T10696] ip_setsockopt+0x58/0x110 [ 218.100099][T10696] udp_setsockopt+0x99/0xb0 [ 218.100126][T10696] sock_common_setsockopt+0x66/0x80 [ 218.100211][T10696] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 218.100236][T10696] __sys_setsockopt+0x184/0x200 [ 218.100253][T10696] __x64_sys_setsockopt+0x64/0x80 [ 218.100271][T10696] x64_sys_call+0x20ec/0x2ff0 [ 218.100290][T10696] do_syscall_64+0xd2/0x200 [ 218.100312][T10696] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 218.100412][T10696] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 218.100432][T10696] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.100497][T10696] RIP: 0033:0x7f23ea43ebe9 [ 218.100510][T10696] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 218.100531][T10696] RSP: 002b:00007f23e8ea7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 218.100549][T10696] RAX: ffffffffffffffda RBX: 00007f23ea665fa0 RCX: 00007f23ea43ebe9 [ 218.100562][T10696] RDX: 0000000000000024 RSI: 0000000000000000 RDI: 0000000000000003 [ 218.100575][T10696] RBP: 00007f23e8ea7090 R08: 000000000000000c R09: 0000000000000000 [ 218.100587][T10696] R10: 0000200000000440 R11: 0000000000000246 R12: 0000000000000001 [ 218.100676][T10696] R13: 00007f23ea666038 R14: 00007f23ea665fa0 R15: 00007ffd6d742078 [ 218.100693][T10696] [ 218.395722][T10701] sd 0:0:1:0: device reset [ 218.404468][T10707] loop1: detected capacity change from 0 to 128 [ 218.677611][T10731] __nla_validate_parse: 12 callbacks suppressed [ 218.677668][T10731] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2286'. [ 219.221865][T10746] sd 0:0:1:0: device reset [ 219.228983][T10746] validate_nla: 3 callbacks suppressed [ 219.229000][T10746] netlink: 'syz.3.2290': attribute type 10 has an invalid length. [ 219.276938][T10755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.285804][T10755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.294555][ T8858] hid-generic 0000:0000:0000.0014: hidraw0: HID v0.00 Device [sy] on syz0 [ 219.310641][T10753] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2292'. [ 219.345037][T10762] fido_id[10762]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 219.397369][T10765] loop1: detected capacity change from 0 to 8192 [ 219.404959][T10765] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 219.619140][T10780] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2300'. [ 219.973319][ T36] hid-generic 0000:0000:0000.0015: hidraw0: HID v0.00 Device [sy] on syz0 [ 219.997239][T10794] fido_id[10794]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 220.070971][T10798] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2308'. [ 220.087504][T10800] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2309'. [ 220.099692][T10800] netlink: 'syz.3.2309': attribute type 10 has an invalid length. [ 220.110579][T10800] bond0: (slave dummy0): Releasing backup interface [ 220.120674][T10800] team0: Port device dummy0 added [ 220.127757][T10800] netlink: 'syz.3.2309': attribute type 10 has an invalid length. [ 220.139774][T10800] team0: Port device dummy0 removed [ 220.147582][T10800] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 220.276888][T10813] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2314'. [ 220.287268][T10813] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 220.361102][T10816] loop1: detected capacity change from 0 to 8192 [ 220.376425][T10816] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 220.568390][T10826] netlink: 240 bytes leftover after parsing attributes in process `syz.2.2320'. [ 220.583793][T10818] loop1: detected capacity change from 0 to 8192 [ 220.598458][T10826] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.619546][T10818] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 220.676109][T10826] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.720599][T10832] IPVS: Unknown mcast interface: € [ 220.770926][T10826] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.848577][ T29] kauditd_printk_skb: 173 callbacks suppressed [ 220.848588][ T29] audit: type=1326 audit(1756437054.323:14550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10839 comm="syz.3.2325" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f196e61ebe9 code=0x0 [ 220.909133][ T29] audit: type=1400 audit(1756437054.386:14551): avc: denied { create } for pid=10837 comm="syz.4.2324" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 220.951553][T10838] syz_tun: refused to change device tx_queue_len [ 220.957956][T10838] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 220.975487][T10826] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 221.032185][ T67] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.040441][T10846] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2324'. [ 221.048320][ T67] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.062691][T10844] loop1: detected capacity change from 0 to 8192 [ 221.065190][ T29] audit: type=1326 audit(1756437054.523:14552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10825 comm="syz.2.2320" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 221.099530][T10844] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 221.100606][ T67] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.132940][ T67] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.171339][ T29] audit: type=1326 audit(1756437054.659:14553): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10847 comm="syz.2.2328" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 221.187586][T10849] SELinux: ebitmap: truncated map [ 221.195358][ T29] audit: type=1326 audit(1756437054.659:14554): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10847 comm="syz.2.2328" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 221.258333][ T29] audit: type=1326 audit(1756437054.691:14555): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10847 comm="syz.2.2328" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 221.282975][ T29] audit: type=1326 audit(1756437054.691:14556): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10847 comm="syz.2.2328" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 221.307601][ T29] audit: type=1326 audit(1756437054.691:14557): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10847 comm="syz.2.2328" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 221.332095][ T29] audit: type=1326 audit(1756437054.691:14558): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10847 comm="syz.2.2328" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 221.356456][ T29] audit: type=1326 audit(1756437054.691:14559): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10847 comm="syz.2.2328" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f252449ebe9 code=0x7ffc0000 [ 221.401084][T10849] SELinux: failed to load policy [ 221.655472][T10866] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2334'. [ 221.686531][T10866] netlink: 'syz.2.2334': attribute type 10 has an invalid length. [ 221.697107][T10866] bond0: (slave dummy0): Releasing backup interface [ 221.705935][T10866] team0: Port device dummy0 added [ 221.716935][T10866] netlink: 'syz.2.2334': attribute type 10 has an invalid length. [ 221.730080][T10866] team0: Port device dummy0 removed [ 221.730618][T10872] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2336'. [ 221.737674][T10866] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 221.745060][T10872] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 222.106117][ T11] I/O error, dev loop9, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 222.121220][T10896] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.259064][T10896] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.329237][T10901] block device autoloading is deprecated and will be removed. [ 222.342602][T10896] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.360501][ T11] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 222.383254][T10903] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.420041][T10896] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.499015][T10903] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.524074][ T67] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.539546][ T67] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.570616][ T67] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.579532][ T67] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.602609][T10903] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.629172][T10909] loop3: detected capacity change from 0 to 8192 [ 222.649347][T10909] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 222.673642][T10911] netlink: 'syz.4.2351': attribute type 10 has an invalid length. [ 222.697769][T10911] bond0: (slave dummy0): Releasing backup interface [ 222.736148][T10914] netlink: 'syz.4.2351': attribute type 10 has an invalid length. [ 222.745836][T10889] syz.2.2344 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 222.756826][T10889] CPU: 1 UID: 0 PID: 10889 Comm: syz.2.2344 Not tainted syzkaller #0 PREEMPT(voluntary) [ 222.756849][T10889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 222.756861][T10889] Call Trace: [ 222.756895][T10889] [ 222.756901][T10889] __dump_stack+0x1d/0x30 [ 222.756923][T10889] dump_stack_lvl+0xe8/0x140 [ 222.756942][T10889] dump_stack+0x15/0x1b [ 222.756960][T10889] dump_header+0x81/0x220 [ 222.756990][T10889] oom_kill_process+0x342/0x400 [ 222.757071][T10889] out_of_memory+0x979/0xb80 [ 222.757107][T10889] try_charge_memcg+0x5e6/0x9e0 [ 222.757138][T10889] charge_memcg+0x51/0xc0 [ 222.757250][T10889] mem_cgroup_swapin_charge_folio+0xcc/0x150 [ 222.757273][T10889] __read_swap_cache_async+0x1df/0x350 [ 222.757306][T10889] swap_cluster_readahead+0x277/0x3e0 [ 222.757349][T10889] swapin_readahead+0xde/0x6f0 [ 222.757389][T10889] ? __filemap_get_folio+0x4f7/0x6b0 [ 222.757414][T10889] ? __rcu_read_unlock+0x34/0x70 [ 222.757432][T10889] ? swap_cache_get_folio+0x77/0x200 [ 222.757529][T10889] do_swap_page+0x301/0x2430 [ 222.757553][T10889] ? css_rstat_updated+0xb7/0x240 [ 222.757581][T10889] ? __pfx_default_wake_function+0x10/0x10 [ 222.757627][T10889] handle_mm_fault+0x9a5/0x2c20 [ 222.757673][T10889] do_user_addr_fault+0x636/0x1090 [ 222.757704][T10889] exc_page_fault+0x62/0xa0 [ 222.757725][T10889] asm_exc_page_fault+0x26/0x30 [ 222.757742][T10889] RIP: 0033:0x7f2524375629 [ 222.757798][T10889] Code: 35 00 00 0f 8e 09 fe ff ff e8 43 9e fe ff 49 39 c4 72 66 66 0f 1f 44 00 00 69 3d 76 00 e8 00 e8 03 00 00 48 8d 1d 77 09 35 00 12 95 12 00 eb 0c 48 81 c3 f0 00 00 00 48 39 eb 74 24 80 7b 20 [ 222.757813][T10889] RSP: 002b:00007ffe6bb0ce40 EFLAGS: 00010206 [ 222.757826][T10889] RAX: 0000000000036d20 RBX: 00007f25246c5fa0 RCX: 0000000000036b00 [ 222.757837][T10889] RDX: 0000000000000220 RSI: 00007ffe6bb0ce20 RDI: 00000000000003e8 [ 222.757848][T10889] RBP: 00007f25246c7da0 R08: 00000000206ed4a9 R09: 7fffffffffffffff [ 222.757859][T10889] R10: 3fffffffffffffff R11: 0000000000000293 R12: 0000000000036d3d [ 222.757948][T10889] R13: 00007f25246c6090 R14: ffffffffffffffff R15: 00007ffe6bb0cf50 [ 222.757965][T10889] [ 222.757972][T10889] memory: usage 307200kB, limit 307200kB, failcnt 1669 [ 222.779441][T10911] team0: Port device dummy0 added [ 222.782539][T10889] memory+swap: usage 307400kB, limit 9007199254740988kB, failcnt 0 [ 222.993036][T10889] kmem: usage 307192kB, limit 9007199254740988kB, failcnt 0 [ 223.000340][T10889] Memory cgroup stats for /syz2: [ 223.000520][T10889] cache 0 [ 223.009056][T10889] rss 0 [ 223.011816][T10889] shmem 0 [ 223.014744][T10889] mapped_file 0 [ 223.018225][T10889] dirty 0 [ 223.021148][T10889] writeback 0 [ 223.024425][T10889] workingset_refault_anon 302 [ 223.029717][T10889] workingset_refault_file 3570 [ 223.034467][T10889] swap 204800 [ 223.037775][T10889] swapcached 4096 [ 223.041402][T10889] pgpgin 255083 [ 223.044848][T10889] pgpgout 255081 [ 223.049051][T10889] pgfault 278652 [ 223.052600][T10889] pgmajfault 429 [ 223.056239][T10889] inactive_anon 0 [ 223.059950][T10889] active_anon 4096 [ 223.063658][T10889] inactive_file 0 [ 223.067967][T10889] active_file 4096 [ 223.071683][T10889] unevictable 0 [ 223.075175][T10889] hierarchical_memory_limit 314572800 [ 223.080544][T10889] hierarchical_memsw_limit 9223372036854771712 [ 223.087339][T10889] total_cache 0 [ 223.090809][T10889] total_rss 0 [ 223.094116][T10889] total_shmem 0 [ 223.097565][T10889] total_mapped_file 0 [ 223.101540][T10889] total_dirty 0 [ 223.105578][T10889] total_writeback 0 [ 223.109422][T10889] total_workingset_refault_anon 302 [ 223.114676][T10889] total_workingset_refault_file 3570 [ 223.119953][T10889] total_swap 204800 [ 223.124481][T10889] total_swapcached 4096 [ 223.128647][T10889] total_pgpgin 255083 [ 223.132697][T10889] total_pgpgout 255081 [ 223.136762][T10889] total_pgfault 278660 [ 223.140819][T10889] total_pgmajfault 436 [ 223.145526][T10889] total_inactive_anon 0 [ 223.149681][T10889] total_active_anon 4096 [ 223.153941][T10889] total_inactive_file 0 [ 223.158083][T10889] total_active_file 4096 [ 223.163033][T10889] total_unevictable 0 [ 223.167022][T10889] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.2344,pid=10889,uid=0 [ 223.182424][T10889] Memory cgroup out of memory: Killed process 10889 (syz.2.2344) total-vm:93764kB, anon-rss:944kB, file-rss:22312kB, shmem-rss:0kB, UID:0 pgtables:132kB oom_score_adj:1000 [ 223.201684][T10903] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 223.235719][T10914] team0: Port device dummy0 removed [ 223.252289][T10914] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 223.291161][ T31] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.335593][ T31] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.378997][ T31] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.400904][ T31] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.485859][T10925] __nla_validate_parse: 5 callbacks suppressed [ 223.485876][T10925] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2356'. [ 223.507142][ T3362] hid_parser_main: 86 callbacks suppressed [ 223.507158][ T3362] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 223.521021][ T3362] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 223.528455][ T3362] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 223.536600][ T3362] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 223.544144][ T3362] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 223.552150][ T3362] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 223.559559][ T3362] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 223.567039][ T3362] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 223.575097][ T3362] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 223.582531][ T3362] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 223.593601][ T3362] hid-generic 0000:0000:0000.0016: hidraw0: HID v0.00 Device [sy] on syz0 [ 223.654748][T10933] loop1: detected capacity change from 0 to 1024 [ 223.676208][T10933] EXT4-fs: Ignoring removed oldalloc option [ 223.686167][T10933] EXT4-fs: Ignoring removed orlov option [ 223.717978][T10933] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 223.762921][T10942] loop3: detected capacity change from 0 to 8192 [ 223.774935][T10942] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 223.857927][T10950] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2365'. [ 223.910110][T10955] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2366'. [ 223.930072][T10955] netlink: 'syz.3.2366': attribute type 10 has an invalid length. [ 223.953696][T10955] bond0: (slave dummy0): Releasing backup interface [ 223.973682][T10955] team0: Port device dummy0 added [ 223.979701][T10956] netlink: 'syz.3.2366': attribute type 10 has an invalid length. [ 223.990992][T10956] team0: Port device dummy0 removed [ 223.998882][T10956] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 224.009106][T10958] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2367'. [ 224.020773][T10958] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 224.028232][T10958] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 224.037140][T10958] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 224.044593][T10958] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 224.054295][T10958] bond0: (slave batadv0): Releasing backup interface [ 224.091260][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.095477][T10964] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2370'. [ 224.125578][T10969] loop3: detected capacity change from 0 to 1024 [ 224.134901][T10969] EXT4-fs: Ignoring removed oldalloc option [ 224.134990][T10971] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2372'. [ 224.173116][T10969] EXT4-fs: Ignoring removed orlov option [ 224.201415][T10969] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 224.224724][T10973] loop4: detected capacity change from 0 to 764 [ 224.252954][T10973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2375'. [ 224.261978][T10973] netlink: 'syz.4.2375': attribute type 30 has an invalid length. [ 224.284789][ T31] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.294204][ T31] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.302447][ T31] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.311085][ T31] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.433807][T10973] Symlink component flag not implemented [ 224.458045][T10973] Symlink component flag not implemented (129) [ 224.466324][T10988] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2380'. [ 224.487458][T10973] rock: directory entry would overflow storage [ 224.493668][T10973] rock: sig=0x4f50, size=4, remaining=3 [ 224.499238][T10973] iso9660: Corrupted directory entry in block 6 of inode 1792 [ 224.517667][ T81] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 224.735608][ T8858] hid-generic 0000:0000:0000.0017: hidraw0: HID v0.00 Device [sy] on syz0 [ 224.783611][T11002] fido_id[11002]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 224.842430][T11012] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2389'. [ 224.855022][ T81] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 224.886032][T11012] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 224.945367][T11019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 224.954063][T11019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 224.971399][T11012] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 224.998595][ T3316] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 225.020435][T11012] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.069897][T11012] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.124077][T11032] loop1: detected capacity change from 0 to 4096 [ 225.135278][T11032] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 225.163881][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 225.624889][T11056] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 225.660128][T11056] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 226.322835][T11092] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2422'. [ 226.393565][T11098] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 226.402554][T11098] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 226.945965][ T29] kauditd_printk_skb: 378 callbacks suppressed [ 226.945979][ T29] audit: type=1400 audit(1756437060.717:14938): avc: denied { remount } for pid=11116 comm="syz.1.2433" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 227.009726][ T29] audit: type=1400 audit(1756437060.791:14939): avc: denied { create } for pid=11122 comm="syz.4.2436" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 227.035112][ T29] audit: type=1400 audit(1756437060.812:14940): avc: denied { connect } for pid=11122 comm="syz.4.2436" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 227.110404][T11141] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 227.116980][T11141] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 227.118594][T11146] random: crng reseeded on system resumption [ 227.125077][T11141] vhci_hcd vhci_hcd.0: Device attached [ 227.132079][ T29] audit: type=1400 audit(1756437060.896:14941): avc: denied { write } for pid=11145 comm="syz.4.2445" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 227.140136][T11141] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 227.175346][T11141] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(10) [ 227.181968][T11141] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 227.190112][T11141] vhci_hcd vhci_hcd.0: Device attached [ 227.199447][T11141] vhci_hcd vhci_hcd.0: pdev(2) rhport(3) sockfd(12) [ 227.206056][T11141] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 227.214276][T11141] vhci_hcd vhci_hcd.0: Device attached [ 227.220824][T11141] vhci_hcd vhci_hcd.0: pdev(2) rhport(4) sockfd(14) [ 227.227418][T11141] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 227.235424][T11141] vhci_hcd vhci_hcd.0: Device attached [ 227.242476][T11155] vhci_hcd: connection closed [ 227.242620][T11149] vhci_hcd: connection closed [ 227.243007][ T1771] vhci_hcd: stop threads [ 227.247982][T11142] vhci_hcd: connection closed [ 227.252151][ T1771] vhci_hcd: release socket [ 227.258128][T11153] vhci_hcd: connection closed [ 227.261049][ T1771] vhci_hcd: disconnect device [ 227.275263][ T1771] vhci_hcd: stop threads [ 227.279509][ T1771] vhci_hcd: release socket [ 227.283916][ T1771] vhci_hcd: disconnect device [ 227.289559][ T1771] vhci_hcd: stop threads [ 227.293865][ T1771] vhci_hcd: release socket [ 227.298370][ T1771] vhci_hcd: disconnect device [ 227.303272][ T1771] vhci_hcd: stop threads [ 227.308153][ T1771] vhci_hcd: release socket [ 227.312572][ T1771] vhci_hcd: disconnect device [ 227.312661][T11159] loop4: detected capacity change from 0 to 164 [ 227.323217][ T3362] vhci_hcd: vhci_device speed not set [ 227.537239][ T1771] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.547759][ T31] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.559077][ T31] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.570822][ T1771] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.636691][ T29] audit: type=1400 audit(1756437061.452:14942): avc: denied { shutdown } for pid=11166 comm="syz.0.2453" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 227.669554][ T29] audit: type=1400 audit(1756437061.484:14943): avc: denied { map } for pid=11168 comm="syz.1.2454" path="socket:[39197]" dev="sockfs" ino=39197 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 227.692984][ T29] audit: type=1400 audit(1756437061.484:14944): avc: denied { read } for pid=11168 comm="syz.1.2454" path="socket:[39197]" dev="sockfs" ino=39197 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 227.763131][T11179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 227.771820][T11179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 227.781378][T11179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 227.789920][T11179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.026706][ T29] audit: type=1400 audit(1756437061.851:14945): avc: denied { write } for pid=11201 comm="syz.4.2467" name="autofs" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 228.114762][T11207] loop4: detected capacity change from 0 to 512 [ 228.129388][T11207] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 228.138520][T11207] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 228.155296][T11207] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a002e01c, mo2=0006] [ 228.164225][T11207] System zones: 0-2, 18-18, 34-35 [ 228.169996][T11207] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 228.199136][T11207] EXT4-fs (loop4): warning: mounting unchecked fs, running e2fsck is recommended [ 228.209953][T11207] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a002e01c, mo2=0006] [ 228.245991][T11207] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 228.264685][ T29] audit: type=1400 audit(1756437062.103:14946): avc: denied { getopt } for pid=11216 comm="syz.3.2472" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 228.285666][T11207] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.2469: bg 0: block 353: padding at end of block bitmap is not set [ 228.319967][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 228.600929][T11281] netlink: set zone limit has 8 unknown bytes [ 228.666951][T11298] __nla_validate_parse: 3 callbacks suppressed [ 228.666971][T11298] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2511'. [ 228.686380][ T29] audit: type=1400 audit(1756437064.551:14947): avc: denied { bind } for pid=11301 comm="syz.0.2513" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 228.768582][T11316] loop4: detected capacity change from 0 to 256 [ 228.814291][T11316] FAT-fs (loop4): codepage cp874 not found [ 228.817598][T11323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 228.829541][T11323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.914943][T11339] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2529'. [ 228.946981][T11345] loop4: detected capacity change from 0 to 1024 [ 228.957354][T11345] EXT4-fs (loop4): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 228.967199][T11345] EXT4-fs (loop4): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 228.978231][T11345] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (52321!=20869) [ 228.987957][T11345] EXT4-fs (loop4): filesystem has both journal inode and journal device! [ 229.213831][T11392] loop4: detected capacity change from 0 to 512 [ 229.232974][T11392] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 229.242719][T11392] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 229.265515][T11392] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a002e01c, mo2=0006] [ 229.297391][T11392] System zones: 0-2, 18-18, 34-35 [ 229.316248][T11392] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 229.413779][ T3311] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 229.466023][T11411] loop4: detected capacity change from 0 to 764 [ 229.724336][T11436] loop4: detected capacity change from 0 to 128 [ 229.777532][T11440] random: crng reseeded on system resumption [ 229.919801][T11447] netlink: 'syz.2.2567': attribute type 4 has an invalid length. [ 229.932343][ T8857] FAT-fs (loop4): error, invalid access to FAT (entry 0x00000100) [ 229.940233][ T8857] FAT-fs (loop4): Filesystem has been set read-only [ 229.949351][ T1771] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 229.959184][ T1771] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 230.031967][T11463] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2573'. [ 230.048122][ T1771] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 230.058098][ T1771] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 230.113330][T11473] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.121867][T11473] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.133164][T11473] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2576'. [ 230.145111][ T1771] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 230.154942][ T1771] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 230.167675][T11455] chnl_net:caif_netlink_parms(): no params data found [ 230.200253][ T1771] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 230.210610][ T1771] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 230.221346][T11455] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.228729][T11455] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.236046][T11455] bridge_slave_0: entered allmulticast mode [ 230.242698][T11455] bridge_slave_0: entered promiscuous mode [ 230.249822][T11455] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.256939][T11455] bridge0: port 2(bridge_slave_1) entered disabled state [ 230.265336][T11455] bridge_slave_1: entered allmulticast mode [ 230.276254][T11482] loop3: detected capacity change from 0 to 128 [ 230.277053][T11455] bridge_slave_1: entered promiscuous mode [ 230.284130][T11482] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 230.300838][T11482] ext4 filesystem being mounted at /481/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 230.319213][T11455] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 230.330221][ T3316] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 230.330972][T11455] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 230.374084][T11455] team0: Port device team_slave_0 added [ 230.381880][T11455] team0: Port device team_slave_1 added [ 230.388473][T11487] netlink: 'syz.3.2581': attribute type 21 has an invalid length. [ 230.397083][T11487] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2581'. [ 230.446358][T11455] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 230.453377][T11455] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 230.457132][T11493] loop3: detected capacity change from 0 to 1024 [ 230.480468][T11455] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 230.498176][ T1771] bridge_slave_1: left allmulticast mode [ 230.503824][ T1771] bridge_slave_1: left promiscuous mode [ 230.509743][ T1771] bridge0: port 2(bridge_slave_1) entered disabled state [ 230.520036][ T1771] bridge_slave_0: left promiscuous mode [ 230.525873][ T1771] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.541455][T11493] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 230.569848][ T3316] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 230.633684][T11506] loop3: detected capacity change from 0 to 1024 [ 230.641099][T11506] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 230.650994][T11506] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 230.661893][T11506] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (52321!=20869) [ 230.672529][T11506] EXT4-fs (loop3): filesystem has both journal inode and journal device! [ 230.710243][T11511] loop3: detected capacity change from 0 to 128 [ 230.762778][T11517] serio: Serial port ptm0 [ 230.943715][ T1771] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 230.953749][ T1771] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 230.963735][ T1771] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 230.973108][ T1771] bond0 (unregistering): Released all slaves [ 230.981688][ T1771] bond1 (unregistering): Released all slaves [ 230.990321][T11455] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 230.997294][T11455] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 231.023411][T11455] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 231.034152][T11500] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 231.042170][T11524] veth0: entered promiscuous mode [ 231.055755][T11523] veth0: left promiscuous mode [ 231.085434][ T1771] tipc: Left network mode [ 231.093053][T11455] hsr_slave_0: entered promiscuous mode [ 231.107246][T11455] hsr_slave_1: entered promiscuous mode [ 231.113617][T11455] debugfs: 'hsr0' already exists in 'hsr' [ 231.119372][T11455] Cannot create hsr debugfs directory [ 231.143585][ T1771] hsr_slave_0: left promiscuous mode [ 231.149605][ T1771] hsr_slave_1: left promiscuous mode [ 231.163626][ T1771] veth1_macvtap: left promiscuous mode [ 231.176622][ T1771] veth0_macvtap: left promiscuous mode [ 231.203676][ T1771] veth1_vlan: left promiscuous mode [ 231.223744][ T1771] veth0_vlan: left promiscuous mode [ 231.242334][T11563] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2608'. [ 231.275750][ T1771] pim6reg (unregistering): left allmulticast mode [ 231.304151][ T1771] team0 (unregistering): Port device team_slave_1 removed [ 231.313352][ T1771] team0 (unregistering): Port device team_slave_0 removed [ 231.374044][T11570] netlink: 'syz.1.2610': attribute type 21 has an invalid length. [ 231.407396][T11577] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.419631][T11570] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2610'. [ 231.459871][T11577] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.497587][T11455] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 231.508685][T11455] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 231.517514][T11455] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 231.526701][T11455] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 231.536748][T11577] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.584929][T11455] 8021q: adding VLAN 0 to HW filter on device bond0 [ 231.597118][T11455] 8021q: adding VLAN 0 to HW filter on device team0 [ 231.606201][T11577] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.621597][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 231.628699][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 231.637870][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.644933][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 231.682963][ T41] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.699718][ T41] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.713253][ T41] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.726719][ T41] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.739685][T11455] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 231.894829][T11455] veth0_vlan: entered promiscuous mode [ 231.906861][T11455] veth1_vlan: entered promiscuous mode [ 231.946086][T11455] veth0_macvtap: entered promiscuous mode [ 231.960931][T11455] veth1_macvtap: entered promiscuous mode [ 231.977641][T11455] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 231.994129][T11455] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 232.005351][ T41] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.013539][T11670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.023814][T11670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.032432][ T41] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.047758][ T29] kauditd_printk_skb: 5 callbacks suppressed [ 232.047771][ T29] audit: type=1400 audit(1756437068.078:14953): avc: denied { mounton } for pid=11455 comm="syz-executor" path="/root/syzkaller.SrMCFz/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 232.048319][ T41] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.090038][ T41] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.090185][ T29] audit: type=1400 audit(1756437068.120:14954): avc: denied { mount } for pid=11455 comm="syz-executor" name="/" dev="gadgetfs" ino=3847 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 232.143415][T11677] : renamed from bond0 (while UP) [ 232.167348][ T8854] IPVS: starting estimator thread 0... [ 232.173695][T11686] tap0: tun_chr_ioctl cmd 1074025677 [ 232.179155][T11686] tap0: linktype set to 805 [ 232.179990][ T29] audit: type=1400 audit(1756437068.204:14955): avc: denied { connect } for pid=11682 comm="syz.5.2629" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 232.210042][T11688] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2631'. [ 232.275681][T11684] IPVS: using max 2640 ests per chain, 132000 per kthread [ 232.630832][T11738] 9pnet_fd: Insufficient options for proto=fd [ 232.652586][T11740] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2652'. [ 232.669549][T11740] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2652'. [ 233.239511][T11771] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge_slave_0, syncid = 0, id = 0 [ 233.634570][T11784] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2671'. [ 233.645554][ T29] audit: type=1326 audit(1756437069.758:14956): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11783 comm="syz.1.2671" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f23ea43ebe9 code=0x7ffc0000 [ 233.669391][ T29] audit: type=1326 audit(1756437069.758:14957): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11783 comm="syz.1.2671" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f23ea43ebe9 code=0x7ffc0000 [ 233.699609][ T11] I/O error, dev loop3, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 233.751030][ T29] audit: type=1326 audit(1756437069.810:14958): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11783 comm="syz.1.2671" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f23ea43ebe9 code=0x7ffc0000 [ 233.774747][ T29] audit: type=1326 audit(1756437069.810:14959): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11783 comm="syz.1.2671" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f23ea43ebe9 code=0x7ffc0000 [ 233.798387][ T29] audit: type=1326 audit(1756437069.810:14960): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11783 comm="syz.1.2671" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f23ea43ebe9 code=0x7ffc0000 [ 233.822138][ T29] audit: type=1326 audit(1756437069.810:14961): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11783 comm="syz.1.2671" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f23ea43ebe9 code=0x7ffc0000 [ 233.845752][ T29] audit: type=1326 audit(1756437069.810:14962): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11783 comm="syz.1.2671" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f23ea43ebe9 code=0x7ffc0000 [ 233.886868][T11788] netlink: 240 bytes leftover after parsing attributes in process `syz.2.2672'. [ 233.906317][T11788] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.921789][T11791] loop5: detected capacity change from 0 to 512 [ 233.945311][T11788] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.977439][T11793] netlink: 'syz.1.2674': attribute type 10 has an invalid length. [ 234.011725][T11788] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.013195][T11805] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2677'. [ 234.031700][T11805] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 234.039115][T11805] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 234.047304][T11805] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 234.054756][T11805] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 234.071357][T11788] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.087915][T11811] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2680'. [ 234.098330][T11811] netlink: 'syz.1.2680': attribute type 10 has an invalid length. [ 234.110145][T11811] bond0: (slave dummy0): Releasing backup interface [ 234.118289][T11811] team0: Port device dummy0 added [ 234.124590][T11811] netlink: 'syz.1.2680': attribute type 10 has an invalid length. [ 234.136843][T11811] team0: Port device dummy0 removed [ 234.143519][T11811] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 234.171365][T11819] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2684'. [ 234.184519][T11821] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2685'. [ 234.195556][ T81] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 234.206199][T11821] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.281450][T11827] loop3: detected capacity change from 0 to 128 [ 234.288610][T11821] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.321223][T11829] netlink: 'syz.3.2687': attribute type 21 has an invalid length. [ 234.329379][T11829] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2687'. [ 234.353443][T11831] loop3: detected capacity change from 0 to 512 [ 234.367297][T11821] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.394271][T11833] netlink: 'syz.3.2689': attribute type 10 has an invalid length. [ 234.429752][T11821] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.469897][ T8854] hid_parser_main: 54 callbacks suppressed [ 234.469915][ T8854] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 234.483193][ T8854] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 234.490666][ T8854] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 234.498094][ T8854] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 234.505526][ T8854] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 234.512891][ T8854] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 234.520341][ T8854] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 234.527762][ T8854] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 234.535218][ T8854] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 234.542665][ T8854] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 234.550747][ T8854] hid-generic 0000:0000:0000.0018: hidraw0: HID v0.00 Device [sy] on syz0 [ 234.574104][T11838] fido_id[11838]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 234.579899][ T41] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.601969][ T41] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.613672][ T41] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.622676][ T41] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.653799][T11844] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2694'. [ 234.664454][T11844] netlink: 'syz.3.2694': attribute type 10 has an invalid length. [ 234.672855][T11844] : (slave dummy0): Releasing backup interface [ 234.683320][T11844] team0: Port device dummy0 added [ 234.690886][T11844] netlink: 'syz.3.2694': attribute type 10 has an invalid length. [ 234.702867][T11844] team0: Port device dummy0 removed [ 234.711253][T11844] : (slave dummy0): Enslaving as an active interface with an up link [ 234.752041][T11853] netlink: 'syz.3.2698': attribute type 21 has an invalid length. [ 234.760948][T11853] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2698'. [ 234.842531][T11860] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2701'. [ 235.123058][ T12] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.156848][ T12] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.183707][ T12] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.192810][ T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.272922][T11876] netlink: 'syz.1.2708': attribute type 10 has an invalid length. [ 235.320628][T11883] smc: net device bond0 applied user defined pnetid SYZ2 [ 235.330285][T11883] smc: removing net device bond0 with user defined pnetid SYZ2 [ 235.348019][T11883] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 235.358155][T11883] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 235.372041][T11883] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 235.380731][T11883] bond0 (unregistering): Released all slaves [ 235.717329][T11905] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 235.789276][T11912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.798027][T11912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.820054][T11905] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 235.835170][T11916] netlink: 'syz.5.2724': attribute type 10 has an invalid length. [ 235.848551][T11916] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 235.879039][T11905] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 235.925091][T11905] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 235.977310][ T31] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.988951][ T31] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.999305][ T31] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.011235][ T12] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.096895][T11930] netlink: 'syz.0.2730': attribute type 21 has an invalid length. [ 236.178232][T11941] sd 0:0:1:0: device reset [ 236.184542][T11941] netlink: 'syz.0.2734': attribute type 10 has an invalid length. [ 236.206979][T11945] netlink: 'syz.0.2735': attribute type 10 has an invalid length. [ 236.236016][ T11] I/O error, dev loop1, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 236.246943][T11947] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.287485][T11947] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.299610][T11949] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.324058][ T3362] hid-generic 0000:0000:0000.0019: hidraw0: HID v0.00 Device [sy] on syz0 [ 236.340496][T11947] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.372989][T11949] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.411703][T11947] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.440177][T11949] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.492298][T11973] netlink: 'syz.2.2746': attribute type 10 has an invalid length. [ 236.535025][T11949] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.739698][T11978] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 236.749208][T11978] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 237.263340][ T3362] hid-generic 0000:0000:0000.001A: hidraw0: HID v0.00 Device [sy] on syz0 [ 237.287274][T11988] fido_id[11988]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 237.424013][T12006] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 237.432762][T12006] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 237.478682][ T29] kauditd_printk_skb: 435 callbacks suppressed [ 237.478699][ T29] audit: type=1400 audit(1756437073.779:15398): avc: denied { getopt } for pid=12003 comm="syz.5.2759" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 237.958671][ T8858] hid-generic 0000:0000:0000.001B: hidraw0: HID v0.00 Device [sy] on syz0 [ 237.986208][T12012] fido_id[12012]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 238.253432][T12021] chnl_net:caif_netlink_parms(): no params data found [ 238.331957][T12021] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.339202][T12021] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.366469][T12021] bridge_slave_0: entered allmulticast mode [ 238.384750][T12021] bridge_slave_0: entered promiscuous mode [ 238.397410][T12044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.414807][ T1771] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.444577][ T1771] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.466127][T12044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 238.476097][T12021] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.483249][T12021] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.497878][T12021] bridge_slave_1: entered allmulticast mode [ 238.504886][T12021] bridge_slave_1: entered promiscuous mode [ 238.512473][ T1771] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.523385][ T1771] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.538568][ T31] bridge_slave_1: left allmulticast mode [ 238.544256][ T31] bridge_slave_1: left promiscuous mode [ 238.549906][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.573291][ T31] bridge_slave_0: left allmulticast mode [ 238.579032][ T31] bridge_slave_0: left promiscuous mode [ 238.584711][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.625324][ T3362] hid-generic 0000:0000:0000.001C: hidraw0: HID v0.00 Device [sy] on syz0 [ 238.669116][T12058] fido_id[12058]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 238.802229][ T31] bond1 (unregistering): Released all slaves [ 238.823881][T12021] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 238.834788][T12021] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 238.854670][ T31] hsr_slave_0: left promiscuous mode [ 238.860911][ T31] hsr_slave_1: left promiscuous mode [ 238.870202][ T31] pim6reg (unregistering): left allmulticast mode [ 238.900914][ T31] team0 (unregistering): Port device team_slave_1 removed [ 238.910411][ T31] team0 (unregistering): Port device team_slave_0 removed [ 238.931752][ T31] dummy0 (unregistering): left allmulticast mode [ 238.951222][T12021] team0: Port device team_slave_0 added [ 238.961049][T12021] team0: Port device team_slave_1 added [ 238.992869][T12021] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 238.999937][T12021] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 239.025856][T12021] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 239.049462][T12021] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 239.056518][T12021] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 239.082507][T12021] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 239.113313][T12086] : renamed from bond0 (while UP) [ 239.161574][T12021] hsr_slave_0: entered promiscuous mode [ 239.172852][T12021] hsr_slave_1: entered promiscuous mode [ 239.179133][T12101] __nla_validate_parse: 11 callbacks suppressed [ 239.179147][T12101] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2784'. [ 239.234822][T12104] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2785'. [ 239.246548][T12098] loop5: detected capacity change from 0 to 8192 [ 239.271467][T12098] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 239.313367][ T31] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.330622][ T31] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.359598][ T31] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.378465][ T12] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.392581][T12123] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.407197][T12123] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.418582][T12123] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2788'. [ 239.494653][T12021] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 239.504349][T12021] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 239.517791][T12021] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 239.544263][T12021] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 239.595091][T12021] 8021q: adding VLAN 0 to HW filter on device bond0 [ 239.615409][T12021] 8021q: adding VLAN 0 to HW filter on device team0 [ 239.633076][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 239.640167][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 239.672536][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.679716][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 239.687585][ T29] audit: type=1326 audit(1756437076.099:15399): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12160 comm="syz.0.2794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 239.730886][ T29] audit: type=1326 audit(1756437076.099:15400): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12160 comm="syz.0.2794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 239.754869][ T29] audit: type=1326 audit(1756437076.099:15401): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12160 comm="syz.0.2794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 239.778829][ T29] audit: type=1326 audit(1756437076.099:15402): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12160 comm="syz.0.2794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 239.803108][ T29] audit: type=1326 audit(1756437076.099:15403): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12160 comm="syz.0.2794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 239.826989][ T29] audit: type=1326 audit(1756437076.099:15404): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12160 comm="syz.0.2794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 239.851007][ T29] audit: type=1326 audit(1756437076.099:15405): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12160 comm="syz.0.2794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 239.875443][ T29] audit: type=1326 audit(1756437076.099:15406): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12160 comm="syz.0.2794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 239.899412][ T29] audit: type=1326 audit(1756437076.099:15407): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12160 comm="syz.0.2794" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7fdcd944ebe9 code=0x7ffc0000 [ 240.019287][T12177] loop5: detected capacity change from 0 to 8192 [ 240.023976][T12021] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 240.047218][T12177] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 240.133003][T12021] veth0_vlan: entered promiscuous mode [ 240.140955][T12021] veth1_vlan: entered promiscuous mode [ 240.159521][T12021] veth0_macvtap: entered promiscuous mode [ 240.175353][T12021] veth1_macvtap: entered promiscuous mode [ 240.186489][T12021] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 240.199031][T12021] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 240.210280][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.219656][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.230237][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.249655][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.345931][T12221] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2804'. [ 240.365743][T12223] netlink: 240 bytes leftover after parsing attributes in process `syz.2.2801'. [ 240.382547][ T81] I/O error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 240.393454][T12223] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.406571][T12227] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2806'. [ 240.440293][T12223] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.482366][T12232] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2808'. [ 240.493885][ T11] I/O error, dev loop3, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 240.506488][T12232] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.518958][T12223] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.545911][T12232] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.583514][T12223] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.623227][T12232] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.664312][ T31] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.675316][ T31] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.687852][ T12] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.698816][ T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 240.768270][T12235] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2809'. [ 240.796630][T12237] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2810'. [ 240.852867][T12243] netlink: 240 bytes leftover after parsing attributes in process `syz.2.2812'. [ 240.865567][ T81] I/O error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 2 [ 240.876275][T12243] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.935444][T12243] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.982376][T12250] loop5: detected capacity change from 0 to 128 [ 241.002760][T12243] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.080283][T12243] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.916728][T12232] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.328736][T12349] chnl_net:caif_netlink_parms(): no params data found [ 242.361060][T12349] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.368201][T12349] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.375499][T12349] bridge_slave_0: entered allmulticast mode [ 242.381955][T12349] bridge_slave_0: entered promiscuous mode [ 242.388639][T12349] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.395802][T12349] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.403281][T12349] bridge_slave_1: entered allmulticast mode [ 242.409608][T12349] bridge_slave_1: entered promiscuous mode [ 242.426144][T12349] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 242.436491][T12349] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 242.454804][T12349] team0: Port device team_slave_0 added [ 242.461369][T12349] team0: Port device team_slave_1 added [ 242.475500][T12349] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 242.482552][T12349] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 242.508536][T12349] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 242.519972][T12349] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 242.526937][T12349] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 242.552916][T12349] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 242.576456][T12349] hsr_slave_0: entered promiscuous mode [ 242.582359][T12349] hsr_slave_1: entered promiscuous mode [ 242.588247][T12349] debugfs: 'hsr0' already exists in 'hsr' [ 242.593975][T12349] Cannot create hsr debugfs directory [ 242.640318][T12349] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.669454][T12349] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.716908][T12349] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.774010][T12349] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.833118][T12349] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 242.841874][T12349] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 242.850483][T12349] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 242.859145][T12349] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 242.874493][T12349] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.881604][T12349] bridge0: port 2(bridge_slave_1) entered forwarding state [ 242.888961][T12349] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.895997][T12349] bridge0: port 1(bridge_slave_0) entered forwarding state [ 242.933846][T12349] 8021q: adding VLAN 0 to HW filter on device bond0 [ 242.955450][ T1771] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.957740][ T29] kauditd_printk_skb: 98 callbacks suppressed [ 242.957753][ T29] audit: type=1326 audit(1756437079.531:15506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12376 comm="syz.5.2844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff65a87ebe9 code=0x7ffc0000 [ 242.992912][ T1771] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.000602][ T29] audit: type=1326 audit(1756437079.542:15507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12376 comm="syz.5.2844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff65a87ebe9 code=0x7ffc0000 [ 243.024292][ T29] audit: type=1326 audit(1756437079.542:15508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12376 comm="syz.5.2844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff65a87ebe9 code=0x7ffc0000 [ 243.047858][ T29] audit: type=1326 audit(1756437079.542:15509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12376 comm="syz.5.2844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff65a87ebe9 code=0x7ffc0000 [ 243.071612][ T29] audit: type=1326 audit(1756437079.542:15510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12376 comm="syz.5.2844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff65a87ebe9 code=0x7ffc0000 [ 243.071646][ T29] audit: type=1326 audit(1756437079.542:15511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12376 comm="syz.5.2844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff65a87ebe9 code=0x7ffc0000 [ 243.071668][ T29] audit: type=1326 audit(1756437079.542:15512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12376 comm="syz.5.2844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff65a87ebe9 code=0x7ffc0000 [ 243.071692][ T2984] ================================================================== [ 243.071724][ T29] audit: type=1326 audit(1756437079.542:15513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12376 comm="syz.5.2844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff65a87ebe9 code=0x7ffc0000 [ 243.071717][ T2984] BUG: KCSAN: data-race in _prb_read_valid / data_alloc SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 243.071748][ T29] audit: type=1326 audit(1756437079.542:15514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12376 comm="syz.5.2844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=287 compat=0 ip=0x7ff65a87ebe9 code=0x7ffc0000 [ 243.071755][ T2984] [ 243.071761][ T2984] write to 0xffffffff86878428 of 8 bytes by task 29 on cpu 1: [ 243.071783][ T2984] data_alloc+0x271/0x2b0 [ 243.071805][ T2984] prb_reserve+0x808/0xaf0 [ 243.071827][ T2984] vprintk_store+0x56d/0x860 [ 243.071851][ T2984] vprintk_emit+0x178/0x650 [ 243.071863][ T2984] vprintk_default+0x26/0x30 [ 243.071802][ T29] audit: type=1326 audit(1756437079.542:15515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12376 comm="syz.5.2844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff65a87ebe9 code=0x7ffc0000 [ 243.071879][ T2984] vprintk+0x1d/0x30 [ 243.071898][ T2984] _printk+0x79/0xa0 [ 243.071920][ T2984] kauditd_hold_skb+0x1b1/0x1c0 [ 243.071936][ T2984] kauditd_send_queue+0x270/0x2c0 [ 243.071952][ T2984] kauditd_thread+0x421/0x630 [ 243.071978][ T2984] kthread+0x486/0x510 [ 243.071994][ T2984] ret_from_fork+0xda/0x150 [ 243.072011][ T2984] ret_from_fork_asm+0x1a/0x30 [ 243.072030][ T2984] [ 243.072035][ T2984] read to 0xffffffff86878428 of 16 bytes by task 2984 on cpu 0: [ 243.072049][ T2984] _prb_read_valid+0x1bc/0x920 [ 243.072072][ T2984] prb_read_valid+0x3c/0x60 [ 243.314765][ T2984] syslog_print+0xeb/0x540 [ 243.314794][ T2984] do_syslog+0x52b/0x7e0 [ 243.314816][ T2984] __x64_sys_syslog+0x41/0x50 [ 243.314839][ T2984] x64_sys_call+0x2f36/0x2ff0 [ 243.314855][ T2984] do_syscall_64+0xd2/0x200 [ 243.314877][ T2984] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.314893][ T2984] [ 243.314897][ T2984] Reported by Kernel Concurrency Sanitizer on: [ 243.314917][ T2984] CPU: 0 UID: 0 PID: 2984 Comm: klogd Not tainted syzkaller #0 PREEMPT(voluntary) [ 243.314938][ T2984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 243.314951][ T2984] ================================================================== [ 243.334810][T12349] 8021q: adding VLAN 0 to HW filter on device team0 [ 243.425681][ T31] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.425790][ T31] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.433831][ T31] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.433885][ T31] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.620523][ T31] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.698304][ T31] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.765060][ T31] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.850864][ T31] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.914657][ T31] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.957308][ T31] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.042819][ T31] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.099681][ T31] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.162630][ T31] bridge_slave_1: left allmulticast mode [ 244.168405][ T31] bridge_slave_1: left promiscuous mode [ 244.174122][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.183986][ T31] bridge_slave_0: left allmulticast mode [ 244.189730][ T31] bridge_slave_0: left promiscuous mode [ 244.195489][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.205166][ T31] bridge_slave_1: left allmulticast mode [ 244.210866][ T31] bridge_slave_1: left promiscuous mode [ 244.216644][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.224553][ T31] bridge_slave_0: left allmulticast mode [ 244.230293][ T31] bridge_slave_0: left promiscuous mode [ 244.236005][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.480157][ T31]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 244.489841][ T31]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 244.499835][ T31]  (unregistering): (slave batadv0): Releasing backup interface [ 244.508667][ T31]  (unregistering): (slave dummy0): Releasing backup interface [ 244.518043][ T31]  (unregistering): Released all slaves [ 244.585034][ T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 244.595202][ T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 244.605211][ T31] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 244.614265][ T31] bond0 (unregistering): Released all slaves [ 244.634263][ T1771] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.643748][ T1771] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.655647][ T1771] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.667356][ T31] IPVS: stopping master sync thread 11771 ... [ 244.673510][ T67] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.684980][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 244.692421][ T31] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 244.700084][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 244.707490][ T31] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 244.717609][ T31] hsr_slave_0: left promiscuous mode [ 244.723305][ T31] hsr_slave_1: left promiscuous mode [ 244.731145][ T31] veth1_macvtap: left promiscuous mode [ 244.736793][ T31] veth0_macvtap: left promiscuous mode [ 244.742360][ T31] veth1_vlan: left promiscuous mode [ 244.747873][ T31] veth0_vlan: left promiscuous mode [ 244.753593][ T31] veth1_macvtap: left promiscuous mode [ 244.759166][ T31] veth0_macvtap: left promiscuous mode [ 244.764811][ T31] veth1_vlan: left promiscuous mode [ 244.769998][ T31] veth0_vlan: left promiscuous mode [ 244.837759][ T31] pim6reg (unregistering): left allmulticast mode [ 244.863281][ T31] team0 (unregistering): Port device team_slave_1 removed [ 244.873162][ T31] team0 (unregistering): Port device team_slave_0 removed [ 244.916458][ T31] team0 (unregistering): Port device team_slave_1 removed [ 244.925658][ T31] team0 (unregistering): Port device team_slave_0 removed [ 245.801965][ T31] bridge_slave_1: left allmulticast mode [ 245.807714][ T31] bridge_slave_1: left promiscuous mode [ 245.813398][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 245.821052][ T31] bridge_slave_0: left allmulticast mode [ 245.826813][ T31] bridge_slave_0: left promiscuous mode [ 245.832468][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.889711][ T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 245.899157][ T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 245.908345][ T31] bond0 (unregistering): Released all slaves [ 245.940443][ T31] hsr_slave_0: left promiscuous mode [ 245.946173][ T31] hsr_slave_1: left promiscuous mode [ 245.951772][ T31] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 245.959967][ T31] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 245.997634][ T31] team0 (unregistering): Port device team_slave_1 removed [ 246.009191][ T31] team0 (unregistering): Port device team_slave_0 removed [ 247.167906][ T12] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.217169][ T12] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.270549][ T12] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.318380][ T12] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.374061][ T12] bridge_slave_1: left allmulticast mode [ 247.379730][ T12] bridge_slave_1: left promiscuous mode [ 247.385424][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.393352][ T12] bridge_slave_0: left allmulticast mode [ 247.399034][ T12] bridge_slave_0: left promiscuous mode [ 247.404800][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 247.509103][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 247.518962][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 247.528498][ T12] bond0 (unregistering): Released all slaves [ 247.587271][ T12] hsr_slave_0: left promiscuous mode [ 247.592913][ T12] hsr_slave_1: left promiscuous mode [ 247.598899][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 247.606299][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 247.614106][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 247.621483][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 247.632244][ T12] veth1_macvtap: left promiscuous mode [ 247.637740][ T12] veth0_macvtap: left promiscuous mode [ 247.643504][ T12] veth1_vlan: left promiscuous mode [ 247.648707][ T12] veth0_vlan: left promiscuous mode [ 247.702218][ T12] team0 (unregistering): Port device team_slave_1 removed [ 247.712620][ T12] team0 (unregistering): Port device team_slave_0 removed [ 248.175816][ T31] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.214618][ T31] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.270547][ T31] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.346573][ T31] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.400011][ T31] bridge_slave_1: left allmulticast mode [ 248.406119][ T31] bridge_slave_1: left promiscuous mode [ 248.411893][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.419895][ T31] bridge_slave_0: left allmulticast mode [ 248.425564][ T31] bridge_slave_0: left promiscuous mode [ 248.431272][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 248.604773][ T31]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 248.614146][ T31]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 248.623397][ T31]  (unregistering): (slave dummy0): Releasing backup interface [ 248.631575][ T31]  (unregistering): Released all slaves [ 248.672254][ T31] tipc: Disabling bearer [ 248.677503][ T31] tipc: Left network mode [ 248.683150][ T31] IPVS: stopping backup sync thread 6953 ... [ 248.691591][ T31] hsr_slave_0: left promiscuous mode [ 248.699088][ T31] veth1_macvtap: left promiscuous mode [ 248.704567][ T31] veth0_macvtap: left promiscuous mode [ 248.710565][ T31] veth1_vlan: left promiscuous mode [ 248.715873][ T31] veth0_vlan: left promiscuous mode [ 248.750370][ T31] pim6reg (unregistering): left allmulticast mode [ 248.776085][ T31] team0 (unregistering): Port device team_slave_1 removed [ 248.785402][ T31] team0 (unregistering): Port device team_slave_0 removed