last executing test programs: 4.177783203s ago: executing program 2 (id=31): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) r2 = socket$packet(0x11, 0x2, 0x300) bind$packet(r2, &(0x7f0000000200)={0x11, 0x1a, r1, 0x1, 0x0, 0x6, @random="00002430c576"}, 0x14) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r2, 0x0) write(r2, &(0x7f0000000000)="01", 0x1) 4.155077055s ago: executing program 0 (id=32): munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000140)) fcntl$setpipe(r1, 0x407, 0x0) read$FUSE(r0, &(0x7f00000045c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r1, &(0x7f00000024c0)={0x90, 0x0, 0x0, {0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, {0x2, 0xb3b, 0x0, 0x0, 0x20000000000007f, 0x5, 0x0, 0x9, 0x0, 0x0, 0x0, r3, r4, 0x3, 0x5}}}, 0x90) 4.071052604s ago: executing program 2 (id=35): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 3.993813762s ago: executing program 2 (id=39): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0xfffa, [0x0, 0x41]}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) 3.362932156s ago: executing program 4 (id=54): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001200)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f07df33c9f7b986", 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.296647043s ago: executing program 0 (id=56): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x181) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xb, &(0x7f0000000a80)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xd}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffff3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x14a0, &(0x7f0000000180)=ANY=[], 0x1, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x5f, 0x3}) 3.271343316s ago: executing program 0 (id=57): syz_mount_image$ext4(&(0x7f0000000340)='ext4\x00', &(0x7f00000003c0)='./file1\x00', 0x0, &(0x7f0000000000)={[{@noauto_da_alloc}]}, 0xfe, 0x259, &(0x7f0000000440)="$eJzs3T1oJGUcBvBnZnc9c7fo+VEI4geIiAbC2Qk2Z6NwIMchIqhwImKj3Alngl1iZWOhtUoqmyB2RktJE2wUwSpqitgIGiwMFlqs7M4G8rEmZnfdlczvB5OZybzz/t9h53l3m9kNUFvnk1xM0kgym6SVpNjb4P5qOd/fXZ5Zv5p0Os/8VvTaVfuV3fPOJVlK8liStbLIa81kYfWFrT82nnro3fnWgx+vPj8z0Yvs297afHrno8vvfHbp0YVvvvvlcpGLae+7rvErBvyvWSS3/xfF/ieK5rRHwL9x5a1Pv+/m/o4kD/Ty30qZ6sV778ZNa6088uE/nfv+r9/ePcmxAuPX6bS674FLHaB2yiTtFOVckmq7LOfmqs/wPzTOlq9fv/Hm7KvX56+9Mu2ZChiXdrL55BdnPj93IP8/N6r8A6dXN//PXln5sbu905j2aICJuKdadfM/+9Liw5F/qB35h/qSf6gv+Yf6kn+oL/mH+pJ/OMVaRx+Wf6gv+Yf6kn+or735BwDqpXNmmKeGbx3/g8jAxE17/gEAAAAAAAAAAAAAAAAAAA5bnlm/ursM20dxwvZffZBsP5GkOah+o/d7xMnNvb9nfy+6zfbVag470L4X7xuxgxF9Mo6nr4/5ntej3PLTGOqP4Ot7p1t/8Vqy9HaSC83m4fuv6N9/w7vtmOOtl0cscEIH8/n4c5Otf9BfK2Pu8M6TNb+0kXzZnX8uDJp/ytzVWw+ef9qjRa/njT9H7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICJ+TsAAP//wphsdg==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./file1\x00', 0x42, 0x0) pwrite64(r0, &(0x7f0000000040)='\f', 0x39, 0x8000c65) r1 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) read$FUSE(r1, &(0x7f0000004940)={0x2020}, 0xfffffeb1) 3.242573979s ago: executing program 4 (id=59): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) wait4(0xffffffffffffffff, 0x0, 0x40000000, 0x0) clock_adjtime(0xc, 0x0) 3.212713731s ago: executing program 3 (id=60): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x5, &(0x7f0000000600)=ANY=[@ANYBLOB="bf16000000000000b7070000ff030000487000000000000050000000000000009500000000000000e83d24a394a293b3bd23212fb56fa54f0b71d0e6adfefc41d86b60717142fa9ea4318123741c0a0f168c1886bf0fccf8d56ccb659427cf8593dbe3a2a3ad358061011fbc5ba1f07318988e6e01a41cc0990d0dc840a23f72eca0b2d89fc474c2a10000000077beee1cebf45fab73962fa8f6296b32a8343881dcc7b1b85f3c3da4cd36414e90a61965c3de4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d0054ce21fa41181a9580cfca031e5388ee5c9a7ddd04201f5200001fcadf95e5a4725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f588cb211624f40401691721715f46e0500000000000000a663739a190a4e825c908c0abc85d457ec5a57cb706eef32a3ed12d63c9c4c508530e173650a8a8f2a9c81bcffe437bccbe158024d8d4939e6fd9adc43f0f4b049218db92bf466e934330ed79bc9f626d68b0000600057d14854eef851bc8c30f5d0df6b94ea0b852d495085ff4eabaac9606f0497958c2c357a7124a69f6770ea6702bc53896a15fad5e55c64efd217450a975221b20d78e445e3da74a3c1e59bae44546bde4ac6de55a480f3ad5dc0f2d1818b696492285f60d914283f8d687b0bdb46261277671bba2c550bfef679bddf38ab35eaaf0268c4efa45b56a188a9195044a222ec06bb49784d5608d87c4832e4305bf8889e5db2a70f6a83d4b3cdc12546d2e9f6720dec489b6276856de6d895704ba3e8ee12c8121ffc4f5d2ae03f0227dcc4f38699d3db16f69ed45e918b07ce58bf576e253364fe0000000084f897400d4f5503a6e9ea4a480e3221f3c247ee8c55e487eaa25a7689689c9c305da4b0181f0f653fec399fcc0cc800e82bde039cc29c19b538c76e65642875bddbef61e5985751d9ebd37d2f32375357b5d2b4dc24baa6a7010038380f7029a292f1ad05000000e4e801a819aef69d081e2cacaa8ad1b4ca6df5dc37962ebc5337379e00645b6d2bec249c0612510000000000a7060d8d9b9ad109b62d1dab0eec6beabc76d765b9caf70900000399772ddfe89be4338e70d0ecfed537780a31fcaf4acaf9bd3711a4359d68ec71b0693ede07e7d18e797697901fbae4a9d9966b68eadae75ef1b8931b0818a57e5136fb8c61d73b17d8fd55c2b8d321a6cba8743114fcff01e5c10200c512000800009a021d377e477ea807cc00919ee8bfbd090034f67609cfde8877b5bb072572b421d6b1fdae83e5e250190628d02d01f978323fe36685e652ceb218a9cc9e125a4880faccaf5ac2345f20b1ee403885790500d0bc75c7e95d23904dc446e0201aafea0d3f4cc0cf285ccd000000000100005aee4199a34686905441c1fa62ed20328a10690432f59a4d3e05bd00997ea2b6f5213cb883d05b620f31869f6cce80f1ae09009ed7e3c5f3aa61bfd240cb9726bc512ba0eb1f68579c76144feb0100809f12bcf79c4d57f66703c2aee08e52de3eff160623e1af555dc7481128ed0bab22dcb6e5b6ac5e4010eaf2510fa440aabfdc80c77108c769ed2d666c555c6c38b30899a688d96a6c6dc0dd4309f6548765d3f53261b4890aa004e7f667a230b22bc6e248bf56b219d9a547b6e1c5077c9ba463329323b53910e7358b4d0c6882c590cf25e4d044a6afb10a070f285e3c94ed405aa8dc41718dd3f4bf474868538aad9a23f85a707e325c10a9f22e37c4213d0ca2910726de8e62d2e3ae7f64e40c7af3dc00bab70cf607869c5a11a03bce8aa43fa010348bc2fb420ba5e344fcdcb302548e571157d323f5fd535800284d32ffff000088ccd685f07309101a3196b705479897f4c9d97c4c7b77db7b15bfb4305d5e954a34385418e665af882a7d505323070929b228bc94b70300000066dab8c4e63debff174621a0ac7dd85b14cb7616ca23f044bd0ccd1c79292c3aa8f6e4a1c27315ef8d55781edbe368f72aeb2f48256131aaab707451c14747dfa3bb5f8725a98f6d3c797573f18810bf378e38107ece5cb7cf3b98975e9254248af60de2f04e2429d9b6eba525fd1b1b665f77710fa494e2b619c975acd535fc78696fc980573c35e9916f0000000000002c8ee5ec55faffffffffffffffcd59cc0600000053d0a1f4ea4477022c9f376b3191efeb46be3c174fb24009379bbc949fd2923715540556450f12d1645177ce3eca0d65d17deff51a024f0180000000006100499e829bda469048c70e5968375feb39e6918e591a384851ba3079ad9c376bdaf0650e212eb4185cbbb6c0dc0e699afc34ca3b9a307cd2519cd9b192d678492ea2228ff0817d68f97b18402d271036067c141b911c4e0207e2c9d37ac203f440e1a065a2d227c6ec860c0104000000000000fe7144ec680c0dac7b5906a6197c8173080c9ab3ecb72820f04a42e4a43ee3f325f93edb3a204b9c9dc8953375e37c83876f248d91f166676b54781c6855c5e067ab2c2c6d22b20a703d68d77312333deff80883cb5a25c738f4e7cbb075e10f5c36396156abb221adebb9303342bfa2b745a5e045d5db847e4810270ed1c5bbb1548ec3184ff9b8ed1687333d0e0412d452ba6b390199bd684ff458d6c8114833efde87215e5f9569d92d24579f3ef473bce24e61eb21336ad441eea93cbcb69d2156b9b6e3000000000000000000fc411d2eadcadc7c0a2c12410e4b9d634807f2a6f1c3a13508e274ecef5cfccb707a1640973973fd2d1d60138d9b7a778827fd07fbd093a0ba779dcd32556613e1fac161825da91acde7fa964c689b1f0ea96047a98260270c3a3ccb2142b074db79aa88614663ff33f9966502a2361e49aabe58eb086c5827dd9d92fa4ff0c0e8b949d585f2cbc111de478905cb37f3cbfb019c6daace508b926718506a577234468f9279a52360d1a80b88b4eb1cda949ca77b6ec43bdf5f5a400989705746b86b400947891b33d591ec5ea9ae45983273f62027998d72f83625021a72e27e0449fa154ade55071546d4000000000000000000000000000000002f907c5db9c967a1f86c57bb5062fed7c37ec16a7e62b6e370c3c5a32adee9032367814394a7a7fd12c44b81fb5ac2ad92220a72aa3355e894cbefe344a6b5eb4c25128d5427a640faae401eccf3aca4294410461e946010c50f9ee556b38eae0b252ef288397672bbbd17e5306589f93dc130b6be5b19dfb2462348355ef24762509cf29becacf8515abe299b8a7dfd585f5dbf7578bfdbfa37deeb872c3291b59349238add315cd18e6f4196b404e48955657d680511c7ba7f5e0f9d97d649583190c78015aaf4db05aa2a6cc9d00084ce958406e09fe508a0ee5feb2d34f48d87000000000000001108780004ec696f618c20771a7ae436d733f603f20c9189567b63d47fae002e616969d888a418d139a25b11c0da7aecb8c14f1a879f7b985ab634b0f5cdb2090ad2c336e9a28289247ef4f3cfcafa393927d27711ed0543a5e8ec6c1c62082549791f75fccd54582f990234496954e6e54bcbb90f2756912ab7e511a55a9e0512e5c1c10bcd76ee4799af611179a39bd0c0323cae1aaaaaa8dafb55bca104ada3252c5d9de5b9cdb6217c35ca3d28b1d8b9d2fa79376c13167a9ef1b1f4b7509debbeacc153ca8bea4a0a65ee1d1d20a9106499f0bf7f416b051e835d790ac978b90143d9125224f74b6167f7a967c7e33eb5f43570b9f3c91371968a30e528968b233d0396db424e5fd73d380318e9676d074dd5ce552a222e250f9f6d0bdd9e46e7f22d9abfd4573b57e3b52d407b464b0146ea15560a2ce034b1623fecc84842928223d17ce4ab31ef4c2a9f9caebf65341fa3da1bbae7972097e24603b9db8edc25a152bd39af179eab23ed555040c2bbb89ea22c08b97264b3616a41abfad0ab12a79574c60cf1841ea45f10e9438e55e1e0eb645200993b08833bb14517b0d0e5ba72bdacd92d57b6029129c95ab0a93857c7205e8450b27aee5e684ece77f53112873f40247a998cc896ab4d55573c7a7ef2936a29425cab46cd4fdd1452ea8429c63c74d5673f5e4d47d1b001d0d3a9e1d5c840ab37a69cb30d17ff7591f01549e552dc43b672e0feff94408171d682565dc2d84476297c6901040000cb9f7f2eb690d7a032c09f0a3d48663fe5ece30f592d71755dd6cbfac96016a2ecd4e499ce9adce6e59db0494fa25117a2bc13275c9a94a3532c1b8417e9ed5e6cd5f51f8ccc878ba73305ad19b0cf05625439cdf688d33c8fd6cf52c5c5685444b65eb918884727d3a780bdac17d447745e4accd85d3aca4d63127bb3a58095cffa08a6cecae329dd5f47552c40b560b05e962363e99300d61931ddd97444c2bae02edb26383cb96ee7d2742d24dc7e9b6dac831674ae09b7d180ebb30b9221480ad78706dadf7ca3540eb6c6c43dc7e31b2c8d188f28d6ab10d3c0c97b9f6b5feb9abeb6a801975c0bbab0b1fed7485f2fca1730906a6dc1914386118646dab2618582c4ce0a8ce7a1a3ca7d56f6ca8c7d43cad0116c70751a0db051d9adc4ab34dafbca31fecd9191d38fa011a4c1fc19df0b9aac3a0de17dc01b413c4d4eccf9eb1cd90569508fc6479111544807f11dad193a170ac290f28d3e7f702c5bced7ed90c3251897446fdbb1195136d9092168e2deedb3e0afdf0f543363fbf8759df07270981c0bd7260998963e45a2c84e8b82ddfa98dab68a23cfb2ffa4fcc4ebcd38f273e9bdb240f77eb51e259bb88dc383b19107af39ffcc708a1278b3e53c2130a9c7150593794f8f22ae9b2ff0d46c8d175bf9ff227870f1dcecd5b564d20230ac32a10982cf1bbe5ca15ed6d85b2c447f3fb0872ea6170352fd4c76c75941d1c3684a466c81a5892e9f56c0b512be586381c2390aaf93347d318aa5de4322b11088435730c69bc1cfd96d869803a3113b2a33dbf7973434ba9e4ec15c0423bb384975498ff56bf8b51237dadf6264532fdca7c44e485e4c9b695cd000"/3569], &(0x7f0000001400)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000001440)=r1, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000001b80)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001bc0)={'bridge0\x00', 0x0}) sendto$packet(r2, &(0x7f0000001c00)="05031600d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000001c40)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) 3.199623663s ago: executing program 4 (id=61): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000880)={{0x80e3000, 0x25000, 0x8, 0xd, 0x3, 0x0, 0x45, 0x5, 0x0, 0x2e, 0x18}, {0x30000, 0x2, 0x9, 0x2, 0x42, 0x9, 0x7f, 0x40, 0x5, 0x5, 0x3}, {0x54000, 0x4000, 0xe, 0x3, 0x1, 0x9, 0x7, 0x60, 0x0, 0xa7, 0x8}, {0x8000000, 0x10000, 0xa, 0x6, 0x4, 0x2, 0xa6, 0xf8, 0x9, 0x1, 0xf}, {0x60000, 0x70000, 0xc, 0x2, 0x15, 0x6, 0xab, 0x7c, 0x1, 0x83, 0xf7, 0x6}, {0xdddd0000, 0xfec00000, 0x8, 0xa0, 0xb1, 0x8, 0x7, 0x29, 0x9, 0x13, 0x8, 0xf}, {0x0, 0x1, 0xa, 0x5, 0x0, 0x5, 0x4, 0x3, 0x3, 0x83, 0x3, 0x79}, {0xffffffff, 0x5000, 0xc, 0x9, 0xf, 0x7, 0x1, 0xe2, 0x2, 0x8, 0xf0, 0x7}, {0x40002, 0x2f}, {0x3000, 0xfffd}, 0xc0000021, 0x0, 0x6000, 0x2024, 0x7, 0x0, 0x3000, [0x7, 0x9, 0x60, 0x4132]}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f000019a000/0x18000)=nil, &(0x7f0000000540)=[@textreal={0x8, 0x0}], 0x1, 0x61, 0x0, 0x0) 3.158836197s ago: executing program 3 (id=62): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x19, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = fsopen(&(0x7f0000000180)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r1, r3, 0x16, 0x0, @void}, 0x10) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000000)=@req3={0x2, 0x5, 0x0, 0xdd8, 0x6, 0x4, 0x5}, 0x1c) 3.12791019s ago: executing program 3 (id=63): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc, 0x2}, 0x10) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) r2 = dup3(r1, r0, 0x0) recvmmsg(r2, &(0x7f0000008840)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}, 0x1}], 0x1, 0x40000001, 0x0) 3.001841383s ago: executing program 4 (id=65): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x3, 0xc, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1a0}, 0x1, 0x0, 0x0, 0xd4}, 0x40d4) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x588}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 2.899595454s ago: executing program 3 (id=66): bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x3, 0x13, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002000000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000018"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000540)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x2}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.888993735s ago: executing program 0 (id=67): r0 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000200)=@abs, 0x6e) recvmmsg(r2, &(0x7f0000004980)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x100, 0x0) sendmmsg$unix(r2, &(0x7f0000000280), 0x318, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000002c0)) recvfrom$unix(r1, 0x0, 0x0, 0x40002000, 0x0, 0x0) 2.792815054s ago: executing program 1 (id=70): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'bridge0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@setlink={0x28, 0x13, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_MASTER={0x8, 0xa, r2}]}, 0x28}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="3800000054000104000000000000000007000000", @ANYRES32=r2, @ANYBLOB="20000100", @ANYRES32=r3, @ANYBLOB="01000000ef"], 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@setlink={0x28, 0x13, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) 2.764340217s ago: executing program 3 (id=71): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="05000000050000000200000007"], 0x50) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'ip_vti0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @ldst={0x2, 0x0, 0x3, 0x2, 0x9, 0x30, 0x10}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x24, 0x1, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x6}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x2}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x2000}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x404c080) 2.757160458s ago: executing program 1 (id=72): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, r0, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/4\x00') read$FUSE(r2, &(0x7f0000000a00)={0x2020}, 0x2020) 2.742981579s ago: executing program 3 (id=73): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0xa0000004}) poll(&(0x7f0000000140)=[{r2, 0x80}, {r1, 0x2cfc08c20dafc34e}], 0x2, 0x101) 2.73865906s ago: executing program 1 (id=74): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0x10, 0x0, 0x0, 0x800, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e000000040000000400000010"], 0x48) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="61100c0000000000150003000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000050002000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000000000000b7030000000000008500000033000000b70000000200000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000340)="00112233445566778899aabb0800", 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) write$binfmt_register(r0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 2.585896246s ago: executing program 4 (id=75): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x5, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f00000002c0)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000300)={0xa002a000}) 2.54277294s ago: executing program 4 (id=76): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x2901, 0x0) close(r1) socket$can_raw(0x1d, 0x3, 0x1) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller0\x00', @link_local}) write$tun(r0, &(0x7f00000001c0)=ANY=[], 0x16) 1.317883776s ago: executing program 0 (id=77): r0 = socket(0x2, 0x3, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000640)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3b8, 0x0, 0x98, 0x130, 0x1c8, 0x288, 0x0, 0x98, 0x130, 0x288, 0x320, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x450) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a80)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000ac0)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) sendto$inet(r0, &(0x7f0000000b00)="8ce2ad4d4f95e087a7846d3f81", 0xfdef, 0x0, &(0x7f0000000b40)={0x2, 0x0, @multicast2}, 0x10) 1.312593026s ago: executing program 2 (id=78): syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x4028, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000600)={0x18, 0x0, 0x0, {0xffffffffffffffff}}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000640)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x1010080, &(0x7f0000000700)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@aname={'aname', 0x3d, 'wfdno'}}, {@access_client}], [], 0x6b}}) 330.332817ms ago: executing program 0 (id=79): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'veth1\x00', 0x0}) bind$packet(r0, &(0x7f0000000200)={0x11, 0x3, r2, 0x1, 0x1, 0x6, @multicast}, 0x14) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x0) write(r0, &(0x7f0000000000)="010000000000000020", 0x9) 319.551708ms ago: executing program 2 (id=80): chdir(0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x20008, 0x0, 0xff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000dc0)='.\x00', 0x5db) mount$incfs(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./bus\x00', &(0x7f00000000c0), 0x1004002, 0x0) chown(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) 290.238811ms ago: executing program 1 (id=81): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001980)=ANY=[@ANYBLOB="0e00000004000000080000000a"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=@base={0x19, 0x4, 0x4, 0x100, 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x7}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000004007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000880)={r3}, 0xc) 241.983606ms ago: executing program 1 (id=82): syz_mount_image$vfat(&(0x7f00000004c0), &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=0xee00, @ANYBLOB=',shortname=mixed,utf8=1,gid=', @ANYRESHEX=0xee01, @ANYBLOB="2c757466383d302c756e695f786c6174653d302c7379735f696d6d757461626c652c73686f72746e616d653d77696e6e742c6e66732c73686f72746e616d653d6d697865642c757466383d302c757466383d302c646f733178666c6f7070792c005ed7e1c60e1e4f99bc11ea609b1c727da01621a57ec76f5bbcab08114fe9bcb8b11c670e963f24066af5d9629c983f94e83f78466f5eb1e250818b781f5babb206ca79c3ee4e7c386cbd0b7cc5dfaff3fcf343740f655d1fde1fbf4bb1f8f043977cb3805cce6be75394f05cfed0c7b937f49dfaec4a2878e925c3f8dd7dddf3b8bff64caa3d56dd247561ce0f84966d189d8edeed649e3f8f88360bee647aaadc37398e9a7bf998ba5ea6094df5510268935eb02a9033a748019ae6f0e811711fd14dddb34f2a7ed6cf17e400dfb35a"], 0x1, 0x2b4, &(0x7f00000006c0)="$eJzs3cFr024YwPFn7bZ2HVt7GIPfD8QHveglbPUvKLKBWFDmOqYHIXOplsZmNLVSEbeb1/0dw6MnBfUf2GU38SpeiiB42UGsrEm2rqu4ztVM8/1Aydv3fZ/kTd60PAk0bS5vPiwXXaNo1iSWVImJbMiuSGav5Bvyl7F2eVQ6bcjl8a/vz926fed6Lp+fW1Cdzy1eyarq5Pk3j5++uPCuNr70cvJ1QrYzd5tfsh+3p7f/a35fDNbuiJi64jg1c8W2dLXklg3Vm7ZlupaWKq5VrWlHe9F21tYaalZWJ1JrVct11aw0tGw1tOZordpQ875ZqqhhGDqRkqiJ9x1R2FpYMHMDGQzCMNarslrNmfGejYWtPzEoAABwtjSXN+Nh5P8PSq6WXK04h/L7o/l/TPrI/0Uinf/3j/w/Cvby/5T/+T2M/B8AAAAAAAAAAAAAAAAAAAAAgL/BbquVbrVa6WAZvBIikhSR4H3Y48RgMP/R1vHDvaSI/bxeqBe8pdeeK0pJbLFkZkTkW/t88Hnl+Wv5uRltm5a39rofv14vxCURxAcyveNnvXjtjF+XEUl1bj8raZnqHZ/tEV8vjMqli62Ev2VLDEnLzj1xxJbV9nl9EP9sVvXqjXxX/Fi7HwAAAAAA/wJD92W6r9/b7YYGjw3pavcqD+4PSPoX9we6rq+H5f/h8PYbAAAAAIAocRtPyqZtW9UIFIL/PziVFYZ/6JLH7TwsIn7Nq7MyFweFoQ1vVo42xUTkpGuO/94sfxaRQzVToU/3aRQ+PfKO9X7Nh593XpoI7UsJAAAAwEAESf9Q35GFnYEMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAACACDruw8OC/id59ljH5uLh7CUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwNvwIAAD//5jbFjk=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001f40)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000001f80), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000001fc0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x8000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2) ftruncate(r0, 0xc2b) 232.502437ms ago: executing program 2 (id=83): r0 = openat(0xffffffffffffff9c, &(0x7f0000000840)='mnt\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, 0x0) syz_emit_ethernet(0x63e, &(0x7f00000001c0)={@multicast, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x608, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, [{0x5, 0xe, "7db4000005d4a3b4364be7baa2d73b4ac24ab977edb940e63f49a7129f45462e5eecc39f468544e3c13aa9017ccd638e784912ef2c2589d0d45cf0ed4bbe909218459bcbeaf63697aef1702b895af582b2e3b5cd435f497d415f29c5d941df10c1ca58197441e0e9b3400d980110420fa979a3"}, {0x0, 0x9, "1598a4a8a719ffe0621615f6d04dcae3360546cf06f2665bae2296931fd1d71c1f7e8f222b9ddc4e0bfb5e5c9a484353b785e79b4d8181cf146261723484c54803466e8bedb8ecd2"}, {0x1f, 0x4, "d429145c793e823829b4376332b2c98aee2dae3e1cb11adb2b381eb30650ac6c45f9"}, {0x0, 0xa2, "130c3818a2eaac43f1a6efc4f7772852ea05bff405aa28758ba53e0f2060e4e027f24bb723a5571d0da2ebeb3fe47f34e606cb3987e3681841f511126b773758e143f6be25d6965fcca35155fec3f970e2067f5db8a5de787eaf96b5957e6b988c02ae9fe26ec3118d9fdcca129d1269b290f687cde5b4eaba737c806335ca0d1e43697d144c6df4dc0d31e84004bc22e87b6e2daab5674479c76a1be360d309e7e7e5fa089032b331a3ceea18d92124681c0b78a0f1665ffcba0bee11950f6b4912bb302b3e648fad7ff4862ccc823e720fdb20af8ab0a6a09dfcdacf69923d60a0efeacf81e1e7e17db9547a4962bdec794c013af7210e54d43f3fe7da2f88c674f4cfd818f6a7461368bf62f1d5f98fd9394eb74bf0559f1c6b1ebec57dba007f143108ca4be3fa330cc21a411b0b7af23ebd9282be17fb702a5ca61650b283eec78e0280e4f2713b42bd4e3615c48c55c1abe5827601038109736f9c6b7242e7c9c917309397b864eedf5ca71db1debb609b6381b54955706017731319e0cc41083f99bd11da748b47d8715080899eb15caf19df36632b73bb22596b8e16186a2e51e277f8c78df609ca44a83914e8f7a8b053210573941b560ff8b114326678c6851c74596300b1c2a1ddc0af5b4cb5f15fa61e42214341368152275070973f3063f35fded9eeb535a0837783921dc2b705e0a0ceacca1882ff23813bc9199a9be39559c9f82a7452ce6113780cd7d26f532b72603afbfe994f5baf7257c9a33b9ac1ecd0b69da263daa9ac7e6a8d4400341926ed1f0c0e9086009c7945c0b255716f5b0dac45a9af480dc1f17beba2a2cddeafed29ecc91ce704895e28d0c46e639591c667a7f34500ea98ef557801dccf733fa61f3cf6740e40418745a42a738440ba9fc2ec415ba0fbf34800e6987b902302d552cf869eb350a9a862cd946f8285b03f03067dc9bae653dc701d97c7e6f7c1f0767624ac9e48b041c51697968b1e1733921270e569ac0b1ac7c25d00936ad05f14d67d3225d6a8cecd9fb63205ab14131e2e742977860e4a38ec056cda185aa357a059d0180056816a7902bdc0951253005099039bd945a6a4e525123cd4fcb8c5b335626464707fc21e92039b9190020eb9ef84c61cddede466a4c3ea2572927153997c33433ce9de0a7d2ed0b5fb0dce9cc6630bd0635a66be0cb490689169618184e896233d49b8f0e0717ae5d557333d54887ed8d983ee01091326af86e76583131104c66753efd58c32e499be23a05249b98e505c4c0237e2e70506fed29a33169d02b74ba5cbefad267e1107f4468e1144ece9656d35b88e405405fbb1438510f0395752c61e57e760de178a58a8da65040946656220817732fa0cd36189027287597cc5ebe709ca9d9a507babd39f1e56a37657326c7ffb654ce5e2773e92e99783e3152562a21a574f521022314da92315c13a6a696122b211e29a85e81ba7a8fb4dee770d1cacaa2fb02d5fb97676d6402513cccc770ff1a9b9d3b1454ff071d6ed6c4e84249607b64a034b8127893a00aac7ce06a0c2820f7084a8d8e61fc6868c0c2c74005af049ea328a94d5d4534aa99c49208a5f339dec460f5231d6a3e42e4b314c913da4d4127f3d8407e7edbbb044d2e034d6c14c0b86de30afe2d0b92bcaa10cb48c54576114ab1844e25eabc3a8c7906e917b052dfe31e110aaf94876488e3ef926f2d6e6cb635836cb11dbd146a83e2034b7d41ebdaa959f4f74444aceab064af4fb73b5ac964eca5e12834cc5c6d280855bc19c25ce7a5a3dd1a64c1fba0001ee7eebfd25e67ebb5ca47dd6c08543f96a01"}]}}}}}}, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000380)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xff}, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x40, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @private0={0xfc, 0x0, '\x00', 0x1}, [@hopopts={0x3a}], '\x00\x00\x00\x00\x00\x00\x00\x00'}}}}}}}, 0x0) openat(0xffffffffffffff9c, 0x0, 0x101042, 0xb0) 0s ago: executing program 1 (id=84): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x2200, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000380)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 13.181240][ T207] sed (207) used greatest stack depth: 22664 bytes left [ 15.167804][ T28] audit: type=1400 audit(1792790737.775:59): avc: denied { transition } for pid=224 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.190313][ T28] audit: type=1400 audit(1792790737.775:60): avc: denied { noatsecure } for pid=224 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.209941][ T28] audit: type=1400 audit(1792790737.775:61): avc: denied { write } for pid=224 comm="sh" path="pipe:[14688]" dev="pipefs" ino=14688 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 15.232406][ T28] audit: type=1400 audit(1792790737.775:62): avc: denied { rlimitinh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.251078][ T28] audit: type=1400 audit(1792790737.775:63): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.232' (ED25519) to the list of known hosts. [ 22.836348][ T28] audit: type=1400 audit(1792790745.445:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.839231][ T278] cgroup: Unknown subsys name 'net' [ 22.858993][ T28] audit: type=1400 audit(1792790745.445:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.886287][ T28] audit: type=1400 audit(1792790745.475:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.886592][ T278] cgroup: Unknown subsys name 'devices' [ 23.003799][ T278] cgroup: Unknown subsys name 'hugetlb' [ 23.009453][ T278] cgroup: Unknown subsys name 'rlimit' [ 23.114007][ T28] audit: type=1400 audit(1792790745.725:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.137187][ T28] audit: type=1400 audit(1792790745.725:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.162058][ T28] audit: type=1400 audit(1792790745.725:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.172970][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.194193][ T28] audit: type=1400 audit(1792790745.805:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.219619][ T28] audit: type=1400 audit(1792790745.805:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.226447][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.246048][ T28] audit: type=1400 audit(1792790745.835:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.279558][ T28] audit: type=1400 audit(1792790745.835:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.063146][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.070216][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.077660][ T290] device bridge_slave_0 entered promiscuous mode [ 24.097073][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.104192][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.111556][ T290] device bridge_slave_1 entered promiscuous mode [ 24.135852][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.142981][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.150407][ T287] device bridge_slave_0 entered promiscuous mode [ 24.157596][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.164736][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.172220][ T287] device bridge_slave_1 entered promiscuous mode [ 24.184824][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.191886][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.199326][ T286] device bridge_slave_0 entered promiscuous mode [ 24.208942][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.216017][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.223398][ T286] device bridge_slave_1 entered promiscuous mode [ 24.269344][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.276438][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.283898][ T289] device bridge_slave_0 entered promiscuous mode [ 24.314347][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.321408][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.328894][ T289] device bridge_slave_1 entered promiscuous mode [ 24.344433][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.351593][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.359083][ T288] device bridge_slave_0 entered promiscuous mode [ 24.368745][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.375844][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.383290][ T288] device bridge_slave_1 entered promiscuous mode [ 24.503744][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.510826][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.518108][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.525141][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.570386][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.577470][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.584762][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.591785][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.603387][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.610432][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.617747][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.624785][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.641019][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.648335][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.656004][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.663666][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.671236][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.678629][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.686680][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.694172][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.725822][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.734273][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.741313][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.775093][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.783151][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.790749][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.799106][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.806184][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.814133][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.822133][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.830257][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.837325][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.845846][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.854068][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.861086][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.887569][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.895333][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.904480][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.913536][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.921646][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.928696][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.936084][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.944297][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.951314][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.959541][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.971802][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.996422][ T290] device veth0_vlan entered promiscuous mode [ 25.003893][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.012067][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.019644][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.027961][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.036568][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.043618][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.051013][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.059039][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.067186][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.074252][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.081610][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.089783][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.097797][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.105781][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.114198][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.131629][ T288] device veth0_vlan entered promiscuous mode [ 25.144297][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.152688][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.160810][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.167861][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.175410][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.184172][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.192385][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.199413][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.206842][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.215428][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.223850][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.231655][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.239797][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.247977][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.257480][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.265221][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.272883][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.280818][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.289040][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.298718][ T290] device veth1_macvtap entered promiscuous mode [ 25.316278][ T288] device veth1_macvtap entered promiscuous mode [ 25.322925][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.330608][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.338798][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.347138][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.355601][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.364035][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.372294][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.380358][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.394029][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.402282][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.410379][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.418808][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.436234][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.443711][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.451083][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.459576][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.468126][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.476532][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.484940][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.493286][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.502445][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.510724][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.523401][ T286] device veth0_vlan entered promiscuous mode [ 25.532449][ T289] device veth0_vlan entered promiscuous mode [ 25.542298][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.550231][ T290] request_module fs-gadgetfs succeeded, but still no fs? [ 25.551189][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.572598][ T286] device veth1_macvtap entered promiscuous mode [ 25.583899][ T289] device veth1_macvtap entered promiscuous mode [ 25.592574][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.600252][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.608483][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.616890][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.625445][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.633230][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.641631][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.650267][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.658690][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.667186][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.685755][ T287] device veth0_vlan entered promiscuous mode [ 25.700188][ T313] loop4: detected capacity change from 0 to 128 [ 25.701404][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.714657][ T313] ======================================================= [ 25.714657][ T313] WARNING: The mand mount option has been deprecated and [ 25.714657][ T313] and is ignored by this kernel. Remove the mand [ 25.714657][ T313] option from the mount to silence this warning. [ 25.714657][ T313] ======================================================= [ 25.721295][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.760868][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.770347][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.782635][ T313] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 25.812645][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.827760][ T324] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.842497][ T313] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 25.852981][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.860507][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.861342][ T313] ext2 filesystem being mounted at /2/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 25.879312][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.890835][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.899384][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.909088][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.909149][ T313] EXT4-fs error (device loop4): htree_dirblock_to_tree:1112: inode #2: block 4: comm syz.4.7: bad entry in directory: rec_len is smaller than minimal - offset=1012, inode=0, rec_len=5, size=1024 fake=1 [ 25.918915][ T313] EXT4-fs (loop4): Remounting filesystem read-only [ 25.940642][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.956747][ T287] device veth1_macvtap entered promiscuous mode [ 25.967091][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.977297][ T290] EXT4-fs (loop4): unmounting filesystem. [ 25.990166][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.000889][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.023983][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.032922][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.041394][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.050144][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.220732][ T348] loop2: detected capacity change from 0 to 40427 [ 26.228103][ T348] F2FS-fs (loop2): fault_injection options not supported [ 26.237239][ T348] F2FS-fs (loop2): fault_type options not supported [ 26.253290][ T348] F2FS-fs (loop2): invalid crc value [ 26.263012][ T358] loop3: detected capacity change from 0 to 512 [ 26.264177][ T348] F2FS-fs (loop2): Found nat_bits in checkpoint [ 26.317383][ T358] EXT4-fs error (device loop3): ext4_orphan_get:1405: inode #15: comm syz.3.19: inode has both inline data and extents flags [ 26.331328][ T358] EXT4-fs error (device loop3): ext4_orphan_get:1410: comm syz.3.19: couldn't read orphan inode 15 (err -117) [ 26.340264][ T348] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 26.350941][ T358] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 26.404129][ T287] EXT4-fs (loop3): unmounting filesystem. [ 28.621935][ C1] sched: RT throttling activated [ 28.639982][ T28] kauditd_printk_skb: 338 callbacks suppressed [ 28.639995][ T28] audit: type=1326 audit(1792790751.245:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=371 comm="syz.4.23" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7feef419f559 code=0x7ffc0000 [ 29.633065][ T28] audit: type=1326 audit(1792790751.245:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=371 comm="syz.4.23" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feef419f559 code=0x7ffc0000 [ 29.658422][ T28] audit: type=1326 audit(1792790751.245:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=371 comm="syz.4.23" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feef419f559 code=0x7ffc0000 [ 29.699451][ T28] audit: type=1326 audit(1792790751.245:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=371 comm="syz.4.23" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7feef419f559 code=0x7ffc0000 [ 29.724269][ T28] audit: type=1400 audit(1792790752.305:416): avc: denied { create } for pid=386 comm="syz.2.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 29.747325][ T28] audit: type=1400 audit(1792790752.355:417): avc: denied { connect } for pid=383 comm="syz.3.28" lport=56 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 29.785337][ T28] audit: type=1400 audit(1792790752.355:418): avc: denied { setopt } for pid=386 comm="syz.2.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 29.813148][ T292] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 29.822258][ T292] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 29.830862][ T28] audit: type=1400 audit(1792790752.355:419): avc: denied { bind } for pid=386 comm="syz.2.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 29.855656][ T28] audit: type=1400 audit(1792790752.355:420): avc: denied { setopt } for pid=383 comm="syz.3.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 29.903398][ T403] Driver unsupported XDP return value 0 on prog (id 7) dev N/A, expect packet loss! [ 29.922108][ T28] audit: type=1400 audit(1792790752.395:421): avc: denied { read write } for pid=390 comm="syz.3.30" name="uhid" dev="devtmpfs" ino=267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 29.988259][ T411] FAULT_INJECTION: forcing a failure. [ 29.988259][ T411] name failslab, interval 1, probability 0, space 0, times 1 [ 30.002663][ T411] CPU: 1 PID: 411 Comm: syz.4.38 Not tainted syzkaller #0 [ 30.009801][ T411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 30.019896][ T411] Call Trace: [ 30.023280][ T411] [ 30.026235][ T411] __dump_stack+0x21/0x24 [ 30.030591][ T411] dump_stack_lvl+0x110/0x170 [ 30.035285][ T411] ? __cfi_dump_stack_lvl+0x8/0x8 [ 30.040319][ T411] ? sock_common_setsockopt+0xb1/0xc0 [ 30.045715][ T411] ? do_syscall_64+0x4c/0xa0 [ 30.050319][ T411] dump_stack+0x15/0x24 [ 30.054502][ T411] should_fail_ex+0x3bf/0x510 [ 30.059198][ T411] __should_failslab+0xac/0xf0 [ 30.063989][ T411] should_failslab+0x9/0x20 [ 30.068513][ T411] __kmem_cache_alloc_node+0x3d/0x2d0 [ 30.074026][ T411] ? kvmalloc_node+0x28a/0x460 [ 30.078832][ T411] ? kvmalloc_node+0x28a/0x460 [ 30.083610][ T411] __kmalloc_node+0xa2/0x1e0 [ 30.088213][ T411] kvmalloc_node+0x28a/0x460 [ 30.092825][ T411] ? __cfi_kvmalloc_node+0x10/0x10 [ 30.097962][ T411] nf_hook_entries_grow+0x32a/0x770 [ 30.103191][ T411] __nf_register_net_hook+0x225/0x820 [ 30.108583][ T411] nf_register_net_hook+0xbb/0x1a0 [ 30.113708][ T411] nf_register_net_hooks+0x47/0x1b0 [ 30.118921][ T411] nf_defrag_ipv4_enable+0x85/0x110 [ 30.124143][ T411] nf_ct_netns_do_get+0x1e9/0x650 [ 30.129194][ T411] ? bm_init+0xd83/0xf00 [ 30.133453][ T411] ? nf_ct_netns_inet_get+0x1f0/0x1f0 [ 30.138862][ T411] nf_ct_netns_get+0x90/0xc0 [ 30.143476][ T411] connmark_tg_check+0x55/0x100 [ 30.148374][ T411] xt_check_target+0x4ab/0xbf0 [ 30.153177][ T411] ? __cfi_xt_check_target+0x10/0x10 [ 30.158495][ T411] ? mutex_unlock+0x8f/0x230 [ 30.163140][ T411] ? __cfi_mutex_unlock+0x10/0x10 [ 30.168181][ T411] ? xt_find_match+0x245/0x270 [ 30.172967][ T411] ? xt_find_target+0x1f/0x270 [ 30.177761][ T411] ? xt_find_target+0x245/0x270 [ 30.182662][ T411] translate_table+0x176f/0x1f70 [ 30.187629][ T411] ? ipt_register_table+0x7b0/0x7b0 [ 30.192848][ T411] ? __kasan_kmalloc+0x95/0xb0 [ 30.197635][ T411] ? kvmalloc_node+0x28a/0x460 [ 30.202415][ T411] ? __kmalloc_node+0xb2/0x1e0 [ 30.207193][ T411] ? kvmalloc_node+0x2b3/0x460 [ 30.211983][ T411] ? _copy_from_user+0x8f/0xc0 [ 30.216772][ T411] ? copy_from_sockptr_offset+0x77/0x90 [ 30.222361][ T411] do_ipt_set_ctl+0x9e0/0xdf0 [ 30.227075][ T411] ? __cfi_avc_has_perm_noaudit+0x10/0x10 [ 30.232821][ T411] ? __cfi_do_ipt_set_ctl+0x10/0x10 [ 30.238048][ T411] ? __cfi_avc_has_perm+0x10/0x10 [ 30.243093][ T411] ? __kasan_check_write+0x14/0x20 [ 30.248221][ T411] ? mutex_unlock+0x8f/0x230 [ 30.252844][ T411] ? __cfi_mutex_unlock+0x10/0x10 [ 30.257899][ T411] ? selinux_socket_setsockopt+0x282/0x360 [ 30.263738][ T411] nf_setsockopt+0x284/0x2b0 [ 30.268370][ T411] ip_setsockopt+0xed/0x100 [ 30.272895][ T411] udp_setsockopt+0x8a/0xa0 [ 30.277435][ T411] sock_common_setsockopt+0xb1/0xc0 [ 30.282664][ T411] ? __cfi_sock_common_setsockopt+0x10/0x10 [ 30.288579][ T411] __sys_setsockopt+0x2ff/0x4e0 [ 30.293469][ T411] ? __cfi___sys_setsockopt+0x10/0x10 [ 30.298872][ T411] ? __this_cpu_preempt_check+0x13/0x20 [ 30.304460][ T411] ? xfd_validate_state+0x70/0x150 [ 30.309590][ T411] ? __kasan_check_write+0x14/0x20 [ 30.314717][ T411] ? fpregs_restore_userregs+0x128/0x260 [ 30.320381][ T411] __x64_sys_setsockopt+0xbf/0xd0 [ 30.325432][ T411] x64_sys_call+0x124/0x9a0 [ 30.329963][ T411] do_syscall_64+0x4c/0xa0 [ 30.334405][ T411] ? clear_bhb_loop+0x30/0x80 [ 30.339118][ T411] ? clear_bhb_loop+0x30/0x80 [ 30.343816][ T411] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 30.349742][ T411] RIP: 0033:0x7feef419f559 [ 30.354200][ T411] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.373833][ T411] RSP: 002b:00007feef5019028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 30.382264][ T411] RAX: ffffffffffffffda RBX: 00007feef4425fa0 RCX: 00007feef419f559 [ 30.390249][ T411] RDX: 0000000000000040 RSI: 0004000000000000 RDI: 0000000000000004 [ 30.398236][ T411] RBP: 00007feef4236b20 R08: 00000000000003a4 R09: 0000000000000000 [ 30.406215][ T411] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000000 [ 30.414214][ T411] R13: 00007feef4426038 R14: 00007feef4425fa0 R15: 00007ffff6c84e38 [ 30.420539][ T421] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 30.422228][ T411] [ 30.435387][ T421] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 30.445102][ T411] cannot load conntrack support for proto=2 [ 30.502781][ T432] loop4: detected capacity change from 0 to 128 [ 30.543019][ T432] syz.4.47: attempt to access beyond end of device [ 30.543019][ T432] loop4: rw=2049, sector=145, nr_sectors = 896 limit=128 [ 30.567914][ T432] syz.4.47: attempt to access beyond end of device [ 30.567914][ T432] loop4: rw=524288, sector=145, nr_sectors = 224 limit=128 [ 30.600739][ T447] netlink: 7 bytes leftover after parsing attributes in process `syz.3.53'. [ 30.702833][ T458] loop0: detected capacity change from 0 to 128 [ 30.740427][ T458] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 30.788377][ T458] ext4 filesystem being mounted at /5/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 30.991012][ T495] xt_hashlimit: size too large, truncated to 1048576 [ 31.124898][ T288] EXT4-fs (loop0): unmounting filesystem. [ 31.174937][ T516] device bridge_slave_0 left promiscuous mode [ 31.181097][ T516] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.623022][ T419] Bluetooth: hci0: command 0x1003 tx timeout [ 32.624125][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 32.657737][ T537] ip_tables: iptables: counters copy to user failed while replacing table [ 33.617092][ T537] raw_sendmsg: syz.0.77 forgot to set AF_INET. Fix it! [ 33.690823][ T28] kauditd_printk_skb: 52 callbacks suppressed [ 33.690836][ T28] audit: type=1400 audit(1792790756.295:474): avc: denied { watch watch_reads } for pid=541 comm="syz.2.80" path="/10" dev="tmpfs" ino=67 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 33.732700][ T289] ------------[ cut here ]------------ [ 33.738312][ T289] WARNING: CPU: 0 PID: 289 at fs/inode.c:335 drop_nlink+0xc5/0x110 [ 33.746391][ T289] Modules linked in: [ 33.750307][ T289] CPU: 0 PID: 289 Comm: syz-executor Not tainted syzkaller #0 [ 33.757886][ T289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 33.768035][ T289] RIP: 0010:drop_nlink+0xc5/0x110 [ 33.773197][ T289] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 03 aa f0 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 7b 0d ab ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c [ 33.792911][ T289] RSP: 0000:ffffc9000db1fc60 EFLAGS: 00010293 [ 33.798989][ T289] RAX: ffffffff81c66155 RBX: ffff888133f09af8 RCX: ffff88810dbe9440 [ 33.801082][ T28] audit: type=1400 audit(1792790756.335:475): avc: denied { setattr } for pid=541 comm="syz.2.80" name="/" dev="incremental-fs" ino=67 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 33.807200][ T289] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 33.837487][ T289] RBP: ffffc9000db1fc88 R08: 0000000000000003 R09: 0000000000000004 [ 33.845557][ T289] R10: dffffc0000000000 R11: fffff52001b63f7c R12: dffffc0000000000 [ 33.853621][ T289] R13: 1ffff110267e1368 R14: ffff888133f09b40 R15: 0000000000000000 [ 33.861598][ T289] FS: 000055557c530500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 33.870721][ T289] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.877426][ T289] CR2: 0000001b2ee20ff8 CR3: 0000000130e1a000 CR4: 00000000003506b0 [ 33.885611][ T289] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.893685][ T289] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.901664][ T289] Call Trace: [ 33.905056][ T289] [ 33.907998][ T289] shmem_rmdir+0x5b/0x90 [ 33.912376][ T289] vfs_rmdir+0x381/0x4f0 [ 33.916649][ T289] incfs_kill_sb+0xfe/0x210 [ 33.921177][ T289] deactivate_locked_super+0xb5/0x120 [ 33.926691][ T289] deactivate_super+0xaf/0xe0 [ 33.931391][ T289] cleanup_mnt+0x45e/0x4e0 [ 33.935959][ T289] __cleanup_mnt+0x19/0x20 [ 33.940386][ T289] task_work_run+0x1e1/0x250 [ 33.945096][ T289] ? __cfi_task_work_run+0x10/0x10 [ 33.950224][ T289] ? __x64_sys_umount+0x12d/0x170 [ 33.955379][ T289] ? __cfi___x64_sys_umount+0x10/0x10 [ 33.960781][ T289] exit_to_user_mode_loop+0x9b/0xb0 [ 33.966149][ T289] exit_to_user_mode_prepare+0x87/0xd0 [ 33.971628][ T289] syscall_exit_to_user_mode+0x1a/0x30 [ 33.977209][ T289] do_syscall_64+0x58/0xa0 [ 33.981647][ T289] ? clear_bhb_loop+0x30/0x80 [ 33.986439][ T289] ? clear_bhb_loop+0x30/0x80 [ 33.991136][ T289] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 33.997160][ T289] RIP: 0033:0x7f6ff65a0797 [ 34.001584][ T289] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 34.021316][ T289] RSP: 002b:00007ffd25d47708 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 34.029848][ T289] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6ff65a0797 [ 34.037924][ T289] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd25d477c0 [ 34.045998][ T289] RBP: 00007ffd25d477c0 R08: 00007ffd25d487c0 R09: 00000000ffffffff [ 34.054078][ T289] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd25d48850 [ 34.062154][ T289] R13: 00007f6ff6635f63 R14: 00000000000083a5 R15: 00007ffd25d48890 [ 34.070143][ T289] [ 34.073265][ T289] ---[ end trace 0000000000000000 ]--- [ 34.079406][ T289] ================================================================== [ 34.087494][ T289] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 [ 34.093740][ T289] Write of size 4 at addr 0000000000000170 by task syz-executor/289 [ 34.101740][ T289] [ 34.104062][ T289] CPU: 0 PID: 289 Comm: syz-executor Tainted: G W syzkaller #0 [ 34.113083][ T289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 34.123144][ T289] Call Trace: [ 34.126422][ T289] [ 34.129369][ T289] __dump_stack+0x21/0x24 [ 34.133710][ T289] dump_stack_lvl+0x110/0x170 [ 34.138388][ T289] ? __cfi_dump_stack_lvl+0x8/0x8 [ 34.143410][ T289] ? __cfi_call_rcu+0x10/0x10 [ 34.148107][ T289] ? ihold+0x20/0x60 [ 34.152006][ T289] ? ihold+0x20/0x60 [ 34.155906][ T289] print_report+0x3d/0x60 [ 34.160242][ T289] kasan_report+0x122/0x150 [ 34.164751][ T289] ? ihold+0x20/0x60 [ 34.168648][ T289] kasan_check_range+0x249/0x2a0 [ 34.173596][ T289] __kasan_check_write+0x14/0x20 [ 34.178637][ T289] ihold+0x20/0x60 [ 34.182379][ T289] vfs_rmdir+0x24c/0x4f0 [ 34.186641][ T289] incfs_kill_sb+0xfe/0x210 [ 34.191157][ T289] deactivate_locked_super+0xb5/0x120 [ 34.196540][ T289] deactivate_super+0xaf/0xe0 [ 34.201225][ T289] cleanup_mnt+0x45e/0x4e0 [ 34.205650][ T289] __cleanup_mnt+0x19/0x20 [ 34.210065][ T289] task_work_run+0x1e1/0x250 [ 34.214657][ T289] ? __cfi_task_work_run+0x10/0x10 [ 34.219771][ T289] ? __x64_sys_umount+0x12d/0x170 [ 34.224799][ T289] ? __cfi___x64_sys_umount+0x10/0x10 [ 34.230178][ T289] exit_to_user_mode_loop+0x9b/0xb0 [ 34.235387][ T289] exit_to_user_mode_prepare+0x87/0xd0 [ 34.240873][ T289] syscall_exit_to_user_mode+0x1a/0x30 [ 34.246346][ T289] do_syscall_64+0x58/0xa0 [ 34.250775][ T289] ? clear_bhb_loop+0x30/0x80 [ 34.255489][ T289] ? clear_bhb_loop+0x30/0x80 [ 34.260183][ T289] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.266088][ T289] RIP: 0033:0x7f6ff65a0797 [ 34.270532][ T289] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 34.290138][ T289] RSP: 002b:00007ffd25d47708 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 34.298551][ T289] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6ff65a0797 [ 34.306520][ T289] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd25d477c0 [ 34.314496][ T289] RBP: 00007ffd25d477c0 R08: 00007ffd25d487c0 R09: 00000000ffffffff [ 34.322471][ T289] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd25d48850 [ 34.330447][ T289] R13: 00007f6ff6635f63 R14: 00000000000083a5 R15: 00007ffd25d48890 [ 34.338438][ T289] [ 34.341460][ T289] ================================================================== [ 34.349805][ T289] Disabling lock debugging due to kernel taint [ 34.356977][ T289] BUG: kernel NULL pointer dereference, address: 0000000000000170 [ 34.364798][ T289] #PF: supervisor write access in kernel mode [ 34.370873][ T289] #PF: error_code(0x0002) - not-present page [ 34.376856][ T289] PGD 133593067 P4D 133593067 PUD 0 [ 34.382146][ T289] Oops: 0002 [#1] PREEMPT SMP KASAN [ 34.387338][ T289] CPU: 1 PID: 289 Comm: syz-executor Tainted: G B W syzkaller #0 [ 34.396277][ T289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 34.406328][ T289] RIP: 0010:ihold+0x26/0x60 [ 34.410857][ T289] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 e1 04 ab ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 a1 f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 d1 [ 34.430462][ T289] RSP: 0018:ffffc9000db1fca0 EFLAGS: 00010246 [ 34.436524][ T289] RAX: ffff88810dbe9400 RBX: 0000000000000000 RCX: ffff88810dbe9440 [ 34.444497][ T289] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 34.452468][ T289] RBP: ffffc9000db1fcb0 R08: ffffffff87b777e7 R09: 1ffffffff0f6eefc [ 34.460439][ T289] R10: dffffc0000000000 R11: fffffbfff0f6eefd R12: ffff888133f09b04 [ 34.468410][ T289] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 34.476376][ T289] FS: 000055557c530500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 34.485401][ T289] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.492244][ T289] CR2: 0000000000000170 CR3: 0000000130e1a000 CR4: 00000000003506a0 [ 34.500221][ T289] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.508300][ T289] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.516270][ T289] Call Trace: [ 34.519549][ T289] [ 34.522567][ T289] vfs_rmdir+0x24c/0x4f0 [ 34.526829][ T289] incfs_kill_sb+0xfe/0x210 [ 34.531362][ T289] deactivate_locked_super+0xb5/0x120 [ 34.536751][ T289] deactivate_super+0xaf/0xe0 [ 34.541437][ T289] cleanup_mnt+0x45e/0x4e0 [ 34.545873][ T289] __cleanup_mnt+0x19/0x20 [ 34.550290][ T289] task_work_run+0x1e1/0x250 [ 34.554892][ T289] ? __cfi_task_work_run+0x10/0x10 [ 34.560009][ T289] ? __x64_sys_umount+0x12d/0x170 [ 34.565042][ T289] ? __cfi___x64_sys_umount+0x10/0x10 [ 34.570422][ T289] exit_to_user_mode_loop+0x9b/0xb0 [ 34.575621][ T289] exit_to_user_mode_prepare+0x87/0xd0 [ 34.581087][ T289] syscall_exit_to_user_mode+0x1a/0x30 [ 34.586564][ T289] do_syscall_64+0x58/0xa0 [ 34.590990][ T289] ? clear_bhb_loop+0x30/0x80 [ 34.595677][ T289] ? clear_bhb_loop+0x30/0x80 [ 34.600364][ T289] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.606283][ T289] RIP: 0033:0x7f6ff65a0797 [ 34.610695][ T289] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 34.630312][ T289] RSP: 002b:00007ffd25d47708 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 34.638719][ T289] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6ff65a0797 [ 34.646685][ T289] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd25d477c0 [ 34.654660][ T289] RBP: 00007ffd25d477c0 R08: 00007ffd25d487c0 R09: 00000000ffffffff [ 34.662635][ T289] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd25d48850 [ 34.670607][ T289] R13: 00007f6ff6635f63 R14: 00000000000083a5 R15: 00007ffd25d48890 [ 34.678581][ T289] [ 34.681604][ T289] Modules linked in: [ 34.685514][ T289] CR2: 0000000000000170 [ 34.689668][ T289] ---[ end trace 0000000000000000 ]--- [ 34.695121][ T289] RIP: 0010:ihold+0x26/0x60 [ 34.699806][ T289] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 e1 04 ab ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 a1 f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 d1 [ 34.719499][ T289] RSP: 0018:ffffc9000db1fca0 EFLAGS: 00010246 [ 34.725566][ T289] RAX: ffff88810dbe9400 RBX: 0000000000000000 RCX: ffff88810dbe9440 [ 34.733540][ T289] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 34.741516][ T289] RBP: ffffc9000db1fcb0 R08: ffffffff87b777e7 R09: 1ffffffff0f6eefc [ 34.749494][ T289] R10: dffffc0000000000 R11: fffffbfff0f6eefd R12: ffff888133f09b04 [ 34.757481][ T289] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 34.765451][ T289] FS: 000055557c530500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 34.774389][ T289] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.780975][ T289] CR2: 0000000000000170 CR3: 0000000130e1a000 CR4: 00000000003506a0 [ 34.788951][ T289] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.796927][ T289] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.804908][ T289] Kernel panic - not syncing: Fatal exception [ 34.811508][ T289] Kernel Offset: disabled [ 34.815826][ T289] Rebooting in 86400 seconds..