last executing test programs: 2.388213883s ago: executing program 0 (id=327): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000005"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x21045e, &(0x7f0000001400), 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101042, 0x174) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000140)) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) pwritev2(r3, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) 2.337585284s ago: executing program 4 (id=329): socket$kcm(0x10, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, r1, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f00000003c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) getdents64(0xffffffffffffffff, &(0x7f0000000100)=""/80, 0x2f) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000020c0)=@newtaction={0x894, 0x30, 0xffff, 0x4, 0x0, {}, [{0x880, 0x1, [@m_police={0x87c, 0x1, 0x0, 0x0, {{0xb}, {0x850, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x8, 0x0, 0xfffffffd, 0x0, 0x4, 0x0, 0x0, 0x4000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x5, 0x0, 0x0, 0x22, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x8, 0x0, 0x0, 0x27ffdbfc, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x6, 0xfffffffe, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x9, 0x0, 0x0, 0xeeb, 0x7, 0x0, 0x0, 0x0, 0x0, 0x400, 0x8, 0x0, 0x0, 0x0, 0x81b, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0xffffffff, 0x0, 0x40, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8001, 0x0, 0x0, 0x0, 0xa, 0x0, 0xfffffffe, 0xfffffffd, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0xf853, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf1, 0x0, 0x0, 0x2, 0x0, 0x100, 0xfffffffc, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x55, 0xfff, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0xffffff9c, 0x0, 0x0, 0xfffffffd, 0x1, 0x0, 0x0, 0x2, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x100000]}], [@TCA_POLICE_AVRATE={0x8, 0x4, 0x80000001}, @TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x7, 0xfffeffff, 0x100, 0x8, {0x4, 0x0, 0x400, 0x3200, 0x7fff, 0x7}, {0x7, 0x2, 0x5, 0x8, 0xd3, 0x766}, 0xfeea, 0x4, 0x2}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x3, 0xc, 0x7ff, 0x9, 0x3, 0x80000000, 0x6, 0x3, 0x2, 0x1, 0x80000000, 0x0, 0x4, 0x80, 0x5, 0x3, 0x5, 0x9d, 0xfffffffe, 0x2, 0x8c, 0x80000001, 0x6, 0x7f, 0x2, 0x0, 0x5, 0x76, 0x3, 0x2, 0x7, 0x800, 0x0, 0x10000, 0xf0, 0x8, 0xb8, 0x151, 0xfff, 0x6, 0x9, 0x401, 0xfffffff8, 0x5, 0x8, 0xfffffffa, 0x4, 0x7, 0x8000, 0xf9, 0xfff, 0x7fff, 0x1, 0x0, 0xff, 0x5c0078f0, 0x7f, 0x0, 0x2, 0xfffffffa, 0x8, 0x7, 0x7, 0x7, 0x6, 0x80000000, 0x5, 0x4, 0x3, 0x6, 0xffffffff, 0x10000, 0x5, 0x6, 0x3, 0x2, 0x1, 0x8, 0x3, 0x74, 0x4, 0xfee, 0x401, 0x5, 0x5, 0xfff, 0x8f4, 0x3, 0x8000, 0x2, 0x6, 0x1, 0x1ff, 0x9, 0x1, 0x6, 0x9, 0xc, 0x0, 0x80, 0xe, 0xd, 0x6, 0x8, 0xfffffffe, 0xef, 0x2, 0x3, 0x1f, 0x7, 0x9, 0x1ec0, 0x2, 0xfffff001, 0x2, 0x0, 0x10001, 0xd5b, 0x5, 0x0, 0x1, 0x7, 0x3, 0x7, 0x8, 0x1, 0x4, 0x8, 0x101, 0x200, 0x6, 0x80000000, 0x5, 0x2, 0x2, 0x7fff, 0x7, 0x6, 0x3ff, 0x7, 0xffff935a, 0x8, 0xf64, 0x8, 0x4, 0x80000001, 0x3, 0xfe000000, 0x3, 0x2, 0x8, 0xba, 0x400000, 0x3, 0x8, 0x7, 0x5, 0x2, 0x400, 0x7, 0x1ff, 0x1, 0x746, 0x2, 0x6, 0x0, 0x1, 0x6, 0x53a, 0x5, 0x8, 0x6, 0x8, 0x3, 0x7ff, 0x6, 0xf, 0xa, 0x3, 0xfffff000, 0xdae4, 0x5, 0xa, 0x5, 0x7, 0x2, 0x1000, 0xe, 0x4, 0x0, 0x6, 0x1, 0x0, 0x9, 0x5, 0x10000, 0x3, 0x2, 0x7ff, 0x4, 0x5, 0x4, 0x4, 0x0, 0x80000000, 0x80, 0x5a78, 0xf96, 0x7, 0x6, 0x80, 0xc, 0xfffffff9, 0x7, 0x4, 0x5, 0x4, 0x9, 0x2, 0xffff4fba, 0x5, 0x3, 0x800, 0x93, 0x3, 0x3000000, 0x8, 0x80000001, 0x6, 0x6, 0xde4a, 0x9, 0xd, 0x10001, 0x4c, 0x8, 0xf0, 0x0, 0x5, 0x9, 0x4, 0x2, 0x8, 0x3, 0x2, 0x5, 0x9, 0x2, 0x4, 0x9, 0x7, 0x5, 0x10001, 0x8, 0x9]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x894}}, 0x0) 1.745576694s ago: executing program 4 (id=331): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r0}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x3, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0xfffff801}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r3}, &(0x7f00000002c0), &(0x7f0000000440)=r1}, 0x20) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000700)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) 1.732807044s ago: executing program 0 (id=340): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001400001cb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='kfree\x00', r1}, 0x18) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r3 = fsopen(&(0x7f00000004c0)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) open(&(0x7f0000000280)='.\x00', 0x0, 0x8) close_range(r2, 0xffffffffffffffff, 0x0) 1.725952184s ago: executing program 4 (id=334): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x18) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x10, 0x803, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001e80)=@newtfilter={0x5c, 0x2c, 0xd27, 0x30bd29, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0xc}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x4, 0x81, 0x1}, {0x2, 0xa5, 0x2}}}]}}]}]}]}}]}, 0x5c}}, 0x0) 1.661629055s ago: executing program 0 (id=338): perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext, 0x0, 0xb2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) syz_clone(0x630c1100, 0x0, 0x0, 0x0, 0x0, 0x0) 1.594344526s ago: executing program 4 (id=341): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x400}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x26}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000dc0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='kfree\x00', r3, 0x0, 0x6}, 0x18) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000008c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="8b3329bd0400000000000500"], 0x1c}}, 0x0) 1.509897657s ago: executing program 4 (id=342): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000007800"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x400000}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) unshare(0x26000400) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000080)=[{&(0x7f00000004c0)="7cd1", 0x2}, {&(0x7f0000000540)}], 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r1}, 0x10) 1.039685994s ago: executing program 3 (id=357): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000007c0)='./file2\x00', 0x0, &(0x7f0000000800)={[{@jqfmt_vfsv1}, {@nouid32}, {@block_validity}, {@norecovery}, {@auto_da_alloc}, {@dioread_lock}]}, 0x3, 0x546, &(0x7f0000000f80)="$eJzs3dFrZFcZAPDv3mR2s7upmaoPtWAttrJbdSdJ47bBh6og+lRQKz4Ja0wmIWSSWZJJuwmLTfFVEES04Is++SL4BwjSF99FKNR3UVGkZvVBoe2VO3Onm0xmkhRncpfk94Oz9557Zu73nQlz5tyZu/cGcGE9GRE3ImIsIp6JiKlie1qU2OuU/HH39+8t5iWJLHvp7SSSYlt3X5eL5bXiaRMR8Y2vRnw3ORp3a2d3baHRqG8W9enWevJOlu3eXF1fWKmv1Dfm5mafm39+/tb8zFD6WY2IF77815/88JdfeeG3n33lT7f/fuN7eVr/zbJXo6cfw9TpeqX9WnSNR8TmKIKVZLzdw45bJecCAMDx8vn+hyPik+35/1SMtWdzAAAAwHmSfWEy3kkiMgAAAODcSiNiMpK0VpzvO1mcsXotIj4aV9NGc6v1meXm9sZS3hZRjUq6vNqoz8RE+9yBalSSvD5bnGPbrT/bU5+LiEcj4sdTV9r12mKzsVT2lx8AAABwQVzrOf7/91Sa1mpF417JyQEAAADDUy07AQAAAGDkHP8DAADA+VfN+tyh66h09JkAAAAAI/C1F1/MS9a9//XSyzvba82Xby7Vt9Zq69uLtcXm5p3aSrO50r5m3/pJ+2s0m3c+Fxvbd6db9a3W9NbO7u315vZG6/bqoVtgAwAAAGfo0U+88cckIvY+f6VdcpeKtkpENnbwweNlZAiMygc6p+cvo8sDOHsHP9+vlJgHcPZM6eHiqpSdAFC6k/4D0MCTd34//FwAAIDRuP6xwb//v71camrAiBW//yenugAIcK6MlZ0AUJrO73/vZR1lZwOcpcpxMwAHBXDupcP5/f+EUwkTAwoAAJRssl2StFYcB0xGmtZqEY+0bwtYSZZXG/WZiPhQRLw1Vbmc12fbz0zM5gEAAAAAAAAAAAAAAAAAAAAAAADglLIsiQwAAAA41yLSv3XvzHV96unJ3u8HLiX/mWovI+KVn73007sLrdbmbL79n+9vb71ebH+2jG8wAAAAgF7d4/TucTwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADNP9/XuL97Msy/bvLZ5l3H98KSKqRfyidFrGY6K9nIhKRFz9VxLjB56XRMTYEOLvvRYRj/WLn+RpRbXI4lD8SxFpRFwZVvz4gPGjE//aEOLDRfZGPv58sd/7L40n28v+77/xovy/Bo9/6fvj39iA8e+RQTutHK4+/uavpwfGfy3i8fH+4083fpLvr0/8p07Zx+98c3d3UFv2i4jr/ca/5HCs6db6nemtnd2bq+sLK/WV+sbc3Oxz88/P35qfmV5ebdSLf/vG+NHHf/Peg9q7R/p/9Zjxt93/Aa//06fs/7tv3t3/SGe15y8Tlfh5lt14qv/f/7F88emj8buffZ8qPgfyev4apq9/q2/8J371hycG5Zb3f2lA/yd6+n+5p/83Ttn/Z77+/T+f8qEAwBnY2tldW2g06ptWDq5E9aFI4+FdyeedpaeRRBL5yluHmhbKT6yz8mrxHltodN9tQ9rz74qDo1EmX9J4BAAAjM6DSX9vS1JOQgAAAAAAAAAAAAAAAAAAAHABnXgZsEFNaUQ82PLtHxxzNbLemHvldBUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Fj/CwAA//8GI9aV") pipe(0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000008", @ANYBLOB], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000200)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) socket$netlink(0x10, 0x3, 0x0) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f0000001dc0)='.\x00', 0x1a4a438, &(0x7f00000008c0)=ANY=[], 0xb, 0x0, &(0x7f0000000000)) 640.75251ms ago: executing program 0 (id=362): ioctl$FS_IOC_GETFSUUID(0xffffffffffffffff, 0x80111500, 0x0) r0 = socket(0x8000000010, 0x2, 0x0) write(r0, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r4, &(0x7f0000000040)='\f\x00', 0xffeb, 0x0, &(0x7f0000000340), 0x10) ioctl$sock_inet_SIOCSARP(r3, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x2, 0x0, @multicast1=0xe000cc02}}) 640.208021ms ago: executing program 4 (id=363): r0 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018040000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xe3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x1}, 0x50) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000880)={0x0, 0x5, 0x10}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x18, 0x1, &(0x7f0000000200)=@raw=[@generic={0x10, 0x7, 0xf, 0x3ff, 0x101}], &(0x7f0000000380)='GPL\x00', 0x2, 0x3a, &(0x7f00000003c0)=""/58, 0x40f00, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000780)={0x6, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfff}, 0x94) recvfrom(r0, &(0x7f0000000480)=""/110, 0x168f6f3d, 0x734, 0x0, 0xfffffffffffffecb) 555.884612ms ago: executing program 2 (id=366): sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x40000) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000181200", @ANYRES32, @ANYBLOB], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$selinux_access(r0, 0x0, 0x0) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4e, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x1694, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r1, 0x10, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}], 0x0, 0x1}, 0x20) 513.342752ms ago: executing program 0 (id=367): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000200), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r1) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001500)={0x34, r3, 0x1, 0x4000, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES={0x8, 0x3, 0xa000000}]}, 0x34}}, 0x0) 434.556704ms ago: executing program 2 (id=368): r0 = socket(0x10, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000340)={0xa, 0x3, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0xe}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7030000ec000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r3}, 0x18) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x304}, "a6341a1a379332f5", "1fd33c81cf7995313c09de00fd6ded74", "62266bd8", "1e00040000000100"}, 0x28) write$binfmt_script(r1, &(0x7f0000000240)={'#! ', './file0'}, 0xb) close_range(r0, r1, 0x0) 433.901773ms ago: executing program 0 (id=369): socket$kcm(0x10, 0x2, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x38, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0, 0xd}, 0x0, 0x10000, 0x1, 0x1, 0x8, 0x20005, 0x2b, 0x0, 0x0, 0x0, 0xffffffffffffff7f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000e00)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002, 0xfffffffd}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback, 0xffffffff}, 0x1c) sendto$inet6(r1, &(0x7f0000000080)='D', 0x1, 0x4014, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x400000107ffff000, 0x0) 432.760564ms ago: executing program 2 (id=371): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) write$binfmt_elf32(r1, &(0x7f00000014c0)=ANY=[], 0x46b) sendmmsg$inet(r1, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000006c0)="ed", 0x1}, {&(0x7f0000000200)="b5", 0x1}, {&(0x7f0000000340)='.', 0x1}, {&(0x7f0000000140)='U', 0x1}, {&(0x7f0000000180)="f3", 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000580)="f1", 0x1}, {&(0x7f0000000c80)='a', 0x1}, {&(0x7f0000000b40)='M', 0x1}, {&(0x7f0000000d80)='o', 0x1}, {&(0x7f0000000e80)='\b', 0x1}], 0xa6}, 0x70040000}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000380)="bb", 0x1}, {&(0x7f00000007c0)="a1", 0x1}, {&(0x7f0000000800)='s', 0x1}, {&(0x7f00000009c0)='\\', 0x1}], 0x4}}, {{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000440)="88", 0x1}, {&(0x7f0000000840)="e5", 0x1}, {&(0x7f0000001040)="96", 0x1}], 0x3}}], 0x4, 0x4048841) close_range(r0, 0xffffffffffffffff, 0x0) 374.854185ms ago: executing program 2 (id=372): symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f0000000180)='./file0\x00') r0 = memfd_create(&(0x7f0000001040)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1\x8c.?}jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x2) write$binfmt_script(r0, &(0x7f0000000300)={'#! ', './file0'}, 0x17) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000660000000000"], 0x0, 0x7ff}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 352.834945ms ago: executing program 2 (id=374): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r3}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r2}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000100)={'vlan0\x00', 0x400}) 309.759275ms ago: executing program 1 (id=376): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000006d00000095"], 0x0}, 0x90) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0a000000070000000300000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r2, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000020d0039000000000000b4a518110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000080)='9p_client_res\x00', r4}, 0x10) r5 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[], [], 0x6b}}) 239.875196ms ago: executing program 2 (id=377): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000cc0)='mmap_lock_acquire_returned\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 230.191097ms ago: executing program 1 (id=378): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0x26e1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x4, 0xfff, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r1}, &(0x7f00000002c0), &(0x7f0000000380)}, 0x20) close(r0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x8901, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110c23003f) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) write$cgroup_type(r0, &(0x7f0000000080), 0xfffffed8) bpf$PROG_LOAD(0x5, 0x0, 0x0) 229.655637ms ago: executing program 3 (id=379): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[], 0x48) futex(0x0, 0x3, 0x2, &(0x7f0000000700), 0x0, 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0xfffffffffffffdd0, 0x0, 0x41000}, 0x94) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r1}, 0x18) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='block_bio_remap\x00', r2}, 0x10) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) 174.971068ms ago: executing program 3 (id=380): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x28}, 0x1, 0x0, 0x0, 0xc00}, 0x0) r0 = syz_io_uring_setup(0x24fe, &(0x7f0000000300)={0x0, 0xf36e, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000004c0)=""/120, 0x78}], 0x1) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='='], 0x38}}, 0x80) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00'}, 0x10) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_FALLOCATE={0x11, 0x10, 0x0, @fd_index=0x8, 0xfff, 0x0, 0x6, 0x0, 0x1}) io_uring_enter(r0, 0x2d3e, 0x2936, 0x0, 0x0, 0x0) 119.974908ms ago: executing program 3 (id=381): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x2, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback=0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000004c0)='mm_page_free\x00', 0xffffffffffffffff, 0x0, 0x178}, 0x18) socket$netlink(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00'}, 0x18) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x18, 0x7, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000e50003000000000085100000fcffffff250000001000000006000000faffffff95"], &(0x7f0000000140)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000}, 0x94) r0 = socket$inet_udp(0x2, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x10) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) sendmmsg$inet(r0, &(0x7f00000055c0)=[{{&(0x7f0000000000)={0x2, 0x4e22, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000001540)=[@ip_retopts={{0x10}}], 0x10}}, {{&(0x7f00000015c0)={0x2, 0x4e22, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000001800)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x7}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8001}}], 0x30}}], 0x2, 0x80) 119.259429ms ago: executing program 1 (id=382): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x700000, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f0000000000)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a80)={{r4}, &(0x7f0000000a00), &(0x7f0000000a40)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r4}, &(0x7f0000000880), &(0x7f00000008c0)=r3}, 0x20) 118.867538ms ago: executing program 3 (id=383): syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x800) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000140)={@broadcast, @remote, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "2e5cea", 0x10, 0x3c, 0x0, @rand_addr=' \x01\x00', @mcast2, {[], {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}}, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000180), 0x0, 0x0) pipe2$9p(&(0x7f00000000c0), 0x80080) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b4000000000000006111200000000000c60000000000000095000000008b00003d01409fb354dc26638fae0bbc40080607de9eb68a88edd188a26a4a7439"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) setuid(0xee01) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x9200000000004000) prctl$PR_CAPBSET_DROP(0x18, 0x23) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000000)) 113.316298ms ago: executing program 3 (id=384): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x7f, 0x7ffc0002}]}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={0x0}, 0x18) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) readv(r1, &(0x7f00000007c0)=[{&(0x7f0000000580)=""/148, 0x94}, {&(0x7f00000004c0)=""/110, 0x6e}, {&(0x7f0000000540)=""/3, 0x3}], 0x3) readv(r1, &(0x7f0000001240)=[{&(0x7f0000000040)=""/73, 0x49}], 0x1) 83.756279ms ago: executing program 1 (id=385): symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f0000000180)='./file0\x00') r0 = memfd_create(&(0x7f0000001040)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1\x8c.?}jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x2) write$binfmt_script(r0, &(0x7f0000000300)={'#! ', './file0'}, 0x17) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000660000000000"], 0x0, 0x7ff}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 60.932469ms ago: executing program 1 (id=386): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) connect$inet(r1, &(0x7f0000000280)={0x2, 0x4, @multicast1}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, &(0x7f00000008c0), &(0x7f0000000040)=r3}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x80}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r4}, 0x10) sendmmsg$inet(r1, &(0x7f0000004540)=[{{&(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x7e1f, 0x0}, 0xee0000b0}, {{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001100)="15b26f226e2966667482d50903b0a8d92ccd9e69d5cc4cb3d467a670b237a9225fb56c0f7ea725dee27c4bb43bb50c6748c83b71d59f0537405dfab648c096607340fac939a2efd31cbe2f8ca29c409e87ea0974b7bceff9afef5d07d691575f5115f2f961ad488e3386036913e98181a6034febaab853a3e928b9035b0e3a8e1cb393c70f6d0448970e0af2476f8b923ee09c19deca55d58f70e8eeff55dda6381cb96afe97196c0af0a8fd450a1447a1a521e2c211fb84cbcf4aebd31298972ec6bea1764fbde5500fa30c5f2459cff4d7f123ab94cfd5762d586ec7a28abc2f8c9e608f8f964b96ecb0883d60d444f317834a3d734cb304051a60d1a084a84da8f9a23a1b9d4951c0a81985c63ae193f40e9deb358b2f08553324fd6086be9e70e5061568abefebcda50e70f4dab2e4dc0cf6d85aced044d7005326922886194895267165f7f592036ebe11dcf1cad98f5cda766eaea90fb4cb5e793525126c7594f8599055192d63a81d3cd26aadd50983f1c3f1d4655c1b5f59e80f733e3abc4792b760729fd26298ef15141cf76cc4", 0xc3}, {&(0x7f0000000d80)="7d68e6de85f9b0cbc9d710267f321ec64eab043ecad9af7e01e9463218ec45924a99867163e468d36a682fadd749caa325e685d75559a87139e02fae7271be8f55671cfd32a09896278d1941370174720838039d0989bc3394b8a4c4f4a30f0496be313d6d60fe47966c634a3ee1f659e8ef310647725bda0130d5de5028220a4cf5fc808a75694738ee26cb21302b4bba4265b845a5d5dce706d9820c6936b122f9658446d74a9016b94424971dd443a6907eb5c73b6b200e92b23f2c36a214729b0bc231511e4c", 0xc8}, {&(0x7f0000000380)="73fd71361e8d6c80ae1bc9953e2a4aeac7a314273066fc7f65a51969b46df1774bb0be94ccd4824f2d57ad2cd37242b1258402395481f9f07e067652e52aa8ccefcd0962ba0c48757b68d493f3ad702e65d4daa7dfc1605a173185472ae12470eea64c70ef4e64793b8a830447de0f423bef3964934eef4243cac42939ba6fa68d821b9373b5f3e2c26e7ca75ed8fb3203aef3a6637cecdd0251532b99537e02f604058f50e66c8a657d59beeed127695475f082d3d2b9790181fc987ad000ac00887d1506be89f388ecb405660b4ea196ee8f5a92b12ec43bbf49567db613d478ebe2358364f7600bf4f80ef4b2756fb13416c4fa22880cc96a03f07888575aedb001d5a74bb2f906797912b5ac080a0a3d361425f1a92ab03bbe65d5dcb235f43b5ad1162a16ebdc647baac013bf076945126cdd5a080853976a97ad55184601102fbb8df86b21aa8162858d74465c5fb7dc766602a3567f6eaf441f85ec50ca7fb3a4fdb450d1420531da25d01a412958a5e3895c59542238cf8e188e7fb5641eb24a5f1819bf8d2e9dd6c1d0e93564d723e311db9cd268bb1e477036e822b135cdbaf40f812aa7db01d22c829ab01ae24997dae96ddeed49e62d285701d5419e3f94a8b95790cf5a296ed15bffae1f71470c6a6eda872528844a2df42590d898630263cab5cccec57b7cea365ad8c91bfbe7cb419635ce6bf340a56115c0ad922b6fade9538e543bc5def2a85d35ab16d20c219c4733837be2c14ba4d3d32c3a6882ce6857626f55109b4cdcb634425d710bf3108f9b31b4af0cc17a58e49e871a56126dd8bed08e038ba64008587237b3442d28032e52fc9fae1a5784ba59d0edfa03d38352724903ed6f6970b3f4dfa6e40bf933b6765c6ee648174765f1e8ec71b80cac86abd065a3005b40a43a665707cc590997c5048183006a9dd8026d39def05950183b3d4f12f4e1644ef78cddac7c5569985c2c232bb350f28857675339e53f63a868704d2e0b38993dc57a02d3e297fc9a5b9384622841018c303a05bac25d509df5a2d0e3232927283fcc3ec67e4fa7b71d22f115cf693851dcceab4bce38cbfbb32829e211cdcb6a359e14fe416663541050d340aef2555dbd292bd9cbab8fcf20378149cc994569c2bc95fb33fd2d9321b8ac8e5160b02e202492f470eb719a8f2ac3a4be37ea0918b54b14789b7aa228d47f7b13fd9af608740c5a8fe02109a7cc0e555b22628ef790e513ecadfd338d30aed8ca219e64ee4fb0bd0e21e5101bf2072ffa071eb1aa0454caccc015ff1e166813f819a142b56a22e4ff387bb319288a0ef747c6fc8fdee3a0e193b0d086eb816e97e0322fcdaa30da61cd26ac9d8d0748fccd911ce0fd4adc953e9486e137fe66bc8aedfd5b78c562ebfc578ac9f96a453311766564541e16955e30b95914e9411a0b4cd95e0d8732d5ff7a4f921ef41d986a195334266585353b16b9449955523913a30c087532bcb899f733af3abea59baea174cf04359547a633b5f8a582ae3ef12a1d0125bef8c6e8c9fb589d3597c5ab3879491b0c5e3607203f06836a6805d3f7979c4325f9fecb2aceddedb272237132460cda812ef7d613a585898d59f92ef68ec95f12b47b440f6d899ecbfab48055e0c1605ba4cd9dbc17c4cbfec8a953ebbd38c45a6737a57ee58e21a20e530171137968ae4f0d0366cdb0b9d6a4667b011fcd7cd9e77364e5221989d8f0d80793260e748e3bd394849c090c744f6044328304cd6f02e941c5405647daffc1fd2f2864b37f92bbf4931c8e4a7c6bafd0ea79d39d330e70e6776bf6a926de227e5a43653bba04883e98d67bb64aa86e8bf271ba87604bc598e47f2992c7618ad25068860a481554b53352c7339de7e79c3bd1aed5bef8f398432858c888a5d8651969ea40eb3d486e9fe61d49b20500fdfd1548f567da970103d36730657c35d03d2c36b142665f62203b1fb12d616478cfef6f38b34cda87a634dd06d359f33e98b94a5e5b46b2a8d73126352d1d5b65af75055455cc903e384c41876fbdff935d047284d9d203b147a6ba0e9cb50beef7798886c33d2f2f0c0d9abe0e32c7c809f8b0b28fc59471987353c862a311776b8275bf319d5cb9a59f8f103b6e567ef5dd8859973cc3fe41e356bf5bd3186240e49286977eca36a8ad44185973b276cd7958b73e14a221b7fd567818bebf54ad27ee95161bd2aeeb356482ff467500a7d36f0464f58a591ec6b728f984ec78d0abe14c6d3411ac3ffc4c3179d1f95d029f26cceb545723519d3d4209a2b1243e78767273c13dc2bd320512674b6f1a50313bae7b9d16aebb476dbc829e8fd8dd46a1696efaff5795cf75de57c90f05ed9ef4a5cdfbf20d3d9ed95fb4114b1d5c9ade0856212e7ba330ce5bccf2c993dff89112b28bd3b17d3fcfacef7590f62bf948977dd79e2d8025946c80bf263e34035409b5ba1443d4929727180761bd56d258c3670a0aa4de21111fc3172367582de2d164ff3a18d0696b8dd8e5c1423b2ea1e2c0cfe141e4cf04f8cdaed48976b94c40d6a581300458661bbdbfeeb4969af6319eb1798843d0872f68f0c6537bbc9c7dd1e9b0564bf442d8d25f8aa884aba1df074d374f99750d9227bb821ba0355f60de2829a5c8cd47c89d29a2e3d7d53d59db5c3ace8f484664202c210c68a3b33076fb00d59938e84fbad6d6618c0bb89cf94035fa2de4da351e0d71df416450ea7ec3af33aa5c0313c63e654bd79c73b39dc1933636956761058d76648746daca469f8fce62c17a8160cdefc6a927eef9ec4a8dd684e46f35282546ce2362ab8afedd39bf699fd7c2cde538f52ea43c08558f42ba77b2986b800c45fa76a130b30919b3e1d504573e3c1e7dd2dc5d81379df53d736511f1da4ad8791e46adb27bb5c38129e89edda0aed99dcc03fe400f7d05d48e3e9e17744e8487f8ac464c86f7332211fb9799e9d27a6832d5f17ccd1a2da255f6da047e4728dd80860c04391bca4b7833f0346866401ec20033bcf6dfa85fd1520de5a03b4f9f6f5d2f8d7b6e7d7df1cbe5c05e23e080cf335639c94c48aaeb0bfebbe79530d67d35fb101c91839954c0e50dd4b90a86428b22b0be1e906fee30f68d7ce4bf9c68eafe695f07f5e4e4d473d77104b7b1b5dcfeb84e8c83624c0068d4e1cccfe740f8e5d5699603f8481ef2a1f2d4b8fd2314c5cb1985fe34cf8ede7d2e8bddea269422490903489c7f5951114d7ccb29a19455a987d538955712a460243105b25ccb6e6f34c370a6bbb234bee150dbcea5188e45305253f1014f7c0b5d60d517d2d05707f5ca9249a921d6c5307caf41deca0509b49102d801320db65c00f6e1c05fb8c2e1cc554673bf6168dd64086b19af28eec508fd0c304837e802173ac9947c4d73929c61d9632ab929a25f2a04350954612c2de705c1c25215284fe933fc8ccfd30ab3fc9ff5e04dd68d4720d95a29d6da176ac9d332c9ce77358f3c262777ea828fe6473638bc77be2aa586a3733e275744bc42c3742c1ad8f89d25c31958902f2f498c58fc85e9b78fb7a331734cb081cfa9ccfd262df927c0ff46983f8765af4add3532de2b91f2436df028", 0x9fd}], 0x3}}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)="a6", 0x1}], 0x300}}], 0x3, 0x0) 0s ago: executing program 1 (id=387): syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f00000002c0)='./bus\x00', 0x404, &(0x7f0000000580)={[{@orlov}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}]}, 0x1, 0x5d8, &(0x7f0000000c00)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x4040, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kmem_cache_free\x00', r3, 0x0, 0xd22}, 0x17) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7ffff000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.239' (ED25519) to the list of known hosts. [ 24.784150][ T29] audit: type=1400 audit(1751043062.440:62): avc: denied { mounton } for pid=3292 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.785063][ T3292] cgroup: Unknown subsys name 'net' [ 24.806871][ T29] audit: type=1400 audit(1751043062.440:63): avc: denied { mount } for pid=3292 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.834313][ T29] audit: type=1400 audit(1751043062.470:64): avc: denied { unmount } for pid=3292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.999458][ T3292] cgroup: Unknown subsys name 'cpuset' [ 25.005493][ T3292] cgroup: Unknown subsys name 'rlimit' [ 25.194568][ T29] audit: type=1400 audit(1751043062.850:65): avc: denied { setattr } for pid=3292 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.217905][ T29] audit: type=1400 audit(1751043062.850:66): avc: denied { create } for pid=3292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.238396][ T29] audit: type=1400 audit(1751043062.850:67): avc: denied { write } for pid=3292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.245595][ T3297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.258786][ T29] audit: type=1400 audit(1751043062.850:68): avc: denied { read } for pid=3292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.287714][ T29] audit: type=1400 audit(1751043062.860:69): avc: denied { mounton } for pid=3292 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.312572][ T29] audit: type=1400 audit(1751043062.860:70): avc: denied { mount } for pid=3292 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.335837][ T29] audit: type=1400 audit(1751043062.920:71): avc: denied { relabelto } for pid=3297 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.367434][ T3292] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.201640][ T3303] chnl_net:caif_netlink_parms(): no params data found [ 27.264073][ T3303] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.271189][ T3303] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.278429][ T3303] bridge_slave_0: entered allmulticast mode [ 27.284989][ T3303] bridge_slave_0: entered promiscuous mode [ 27.303656][ T3303] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.310754][ T3303] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.317833][ T3303] bridge_slave_1: entered allmulticast mode [ 27.324434][ T3303] bridge_slave_1: entered promiscuous mode [ 27.364575][ T3303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.373807][ T3311] chnl_net:caif_netlink_parms(): no params data found [ 27.388862][ T3304] chnl_net:caif_netlink_parms(): no params data found [ 27.400416][ T3303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.466822][ T3303] team0: Port device team_slave_0 added [ 27.473775][ T3303] team0: Port device team_slave_1 added [ 27.494150][ T3308] chnl_net:caif_netlink_parms(): no params data found [ 27.511101][ T3311] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.518205][ T3311] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.525543][ T3311] bridge_slave_0: entered allmulticast mode [ 27.532019][ T3311] bridge_slave_0: entered promiscuous mode [ 27.549463][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.556430][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.582380][ T3303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.593561][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.600544][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.626471][ T3303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.637113][ T3311] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.644202][ T3311] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.651345][ T3311] bridge_slave_1: entered allmulticast mode [ 27.657744][ T3311] bridge_slave_1: entered promiscuous mode [ 27.664087][ T3310] chnl_net:caif_netlink_parms(): no params data found [ 27.691225][ T3304] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.698364][ T3304] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.705596][ T3304] bridge_slave_0: entered allmulticast mode [ 27.712112][ T3304] bridge_slave_0: entered promiscuous mode [ 27.729198][ T3311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.738422][ T3304] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.745603][ T3304] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.752859][ T3304] bridge_slave_1: entered allmulticast mode [ 27.759127][ T3304] bridge_slave_1: entered promiscuous mode [ 27.772673][ T3311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.805911][ T3311] team0: Port device team_slave_0 added [ 27.816952][ T3304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.838970][ T3303] hsr_slave_0: entered promiscuous mode [ 27.845040][ T3303] hsr_slave_1: entered promiscuous mode [ 27.851965][ T3311] team0: Port device team_slave_1 added [ 27.858704][ T3304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.867884][ T3308] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.875003][ T3308] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.882255][ T3308] bridge_slave_0: entered allmulticast mode [ 27.888553][ T3308] bridge_slave_0: entered promiscuous mode [ 27.895148][ T3308] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.902232][ T3308] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.909458][ T3308] bridge_slave_1: entered allmulticast mode [ 27.916089][ T3308] bridge_slave_1: entered promiscuous mode [ 27.953919][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.960926][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.986940][ T3311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.003139][ T3304] team0: Port device team_slave_0 added [ 28.010228][ T3308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.020023][ T3304] team0: Port device team_slave_1 added [ 28.030449][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.037399][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.063396][ T3311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.088528][ T3308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.100094][ T3310] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.107254][ T3310] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.114518][ T3310] bridge_slave_0: entered allmulticast mode [ 28.120897][ T3310] bridge_slave_0: entered promiscuous mode [ 28.129990][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.136976][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.163045][ T3304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.180966][ T3310] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.188024][ T3310] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.195208][ T3310] bridge_slave_1: entered allmulticast mode [ 28.201767][ T3310] bridge_slave_1: entered promiscuous mode [ 28.208411][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.215399][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.241368][ T3304] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.262842][ T3308] team0: Port device team_slave_0 added [ 28.278413][ T3310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.294232][ T3308] team0: Port device team_slave_1 added [ 28.321939][ T3310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.338576][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.345583][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.371589][ T3308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.384170][ T3311] hsr_slave_0: entered promiscuous mode [ 28.390318][ T3311] hsr_slave_1: entered promiscuous mode [ 28.396125][ T3311] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.403715][ T3311] Cannot create hsr debugfs directory [ 28.420230][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.427250][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.453347][ T3308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.473242][ T3304] hsr_slave_0: entered promiscuous mode [ 28.479445][ T3304] hsr_slave_1: entered promiscuous mode [ 28.485349][ T3304] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.492929][ T3304] Cannot create hsr debugfs directory [ 28.511308][ T3310] team0: Port device team_slave_0 added [ 28.534686][ T3310] team0: Port device team_slave_1 added [ 28.547017][ T3308] hsr_slave_0: entered promiscuous mode [ 28.553033][ T3308] hsr_slave_1: entered promiscuous mode [ 28.558779][ T3308] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.566463][ T3308] Cannot create hsr debugfs directory [ 28.593756][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.600763][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.626754][ T3310] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.650441][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.657424][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.683436][ T3310] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.745573][ T3303] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 28.755777][ T3310] hsr_slave_0: entered promiscuous mode [ 28.761797][ T3310] hsr_slave_1: entered promiscuous mode [ 28.767595][ T3310] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.775165][ T3310] Cannot create hsr debugfs directory [ 28.790158][ T3303] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 28.798723][ T3303] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 28.820997][ T3303] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 28.885531][ T3311] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 28.895475][ T3311] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 28.909920][ T3311] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 28.934963][ T3311] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 28.956130][ T3304] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 28.968231][ T3304] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 28.976767][ T3304] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 28.985683][ T3304] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 29.033285][ T3308] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 29.042161][ T3308] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 29.050923][ T3308] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 29.060430][ T3308] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 29.093875][ T3303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.112756][ T3311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.120034][ T3310] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 29.133568][ T3310] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 29.143277][ T3303] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.152512][ T3310] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 29.162100][ T3310] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 29.178327][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.185423][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.195846][ T3304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.204218][ T3311] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.216062][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.223266][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.232261][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.239317][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.253610][ T3304] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.267690][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.274804][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.303837][ T3319] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.310943][ T3319] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.323155][ T133] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.330311][ T133] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.386604][ T3308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.401594][ T3310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.431397][ T3308] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.446895][ T3310] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.466577][ T409] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.473742][ T409] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.482228][ T409] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.489285][ T409] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.515053][ T133] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.522163][ T133] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.531869][ T133] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.538960][ T133] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.552977][ T3311] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.566632][ T3303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.576366][ T3304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.693517][ T3308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.708076][ T3310] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.739410][ T3303] veth0_vlan: entered promiscuous mode [ 29.747370][ T3303] veth1_vlan: entered promiscuous mode [ 29.785197][ T3311] veth0_vlan: entered promiscuous mode [ 29.794068][ T3311] veth1_vlan: entered promiscuous mode [ 29.804185][ T3303] veth0_macvtap: entered promiscuous mode [ 29.819328][ T3303] veth1_macvtap: entered promiscuous mode [ 29.826512][ T3311] veth0_macvtap: entered promiscuous mode [ 29.854868][ T3311] veth1_macvtap: entered promiscuous mode [ 29.863490][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.890444][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.905854][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.918179][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.925771][ T3310] veth0_vlan: entered promiscuous mode [ 29.932336][ T3303] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.941136][ T3303] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.949993][ T3303] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.958682][ T3303] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.977872][ T3308] veth0_vlan: entered promiscuous mode [ 29.989989][ T3304] veth0_vlan: entered promiscuous mode [ 29.995858][ T3311] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.004722][ T3311] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.013445][ T3311] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.022203][ T3311] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.036391][ T3310] veth1_vlan: entered promiscuous mode [ 30.046769][ T3308] veth1_vlan: entered promiscuous mode [ 30.055300][ T3304] veth1_vlan: entered promiscuous mode [ 30.064648][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 30.064659][ T29] audit: type=1400 audit(1751043067.720:81): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/root/syzkaller.UpUXZE/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 30.069789][ T3310] veth0_macvtap: entered promiscuous mode [ 30.094512][ T29] audit: type=1400 audit(1751043067.750:82): avc: denied { mount } for pid=3303 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 30.122521][ T29] audit: type=1400 audit(1751043067.750:83): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/root/syzkaller.UpUXZE/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 30.147745][ T29] audit: type=1400 audit(1751043067.750:84): avc: denied { mount } for pid=3303 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 30.169532][ T29] audit: type=1400 audit(1751043067.750:85): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/root/syzkaller.UpUXZE/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 30.196113][ T29] audit: type=1400 audit(1751043067.750:86): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/root/syzkaller.UpUXZE/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3858 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 30.223501][ T29] audit: type=1400 audit(1751043067.750:87): avc: denied { unmount } for pid=3303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 30.244305][ T29] audit: type=1400 audit(1751043067.750:88): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 30.257696][ T3310] veth1_macvtap: entered promiscuous mode [ 30.267136][ T29] audit: type=1400 audit(1751043067.750:89): avc: denied { mount } for pid=3303 comm="syz-executor" name="/" dev="gadgetfs" ino=4279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 30.283788][ T3308] veth0_macvtap: entered promiscuous mode [ 30.308120][ T3303] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.320325][ T3308] veth1_macvtap: entered promiscuous mode [ 30.332380][ T3304] veth0_macvtap: entered promiscuous mode [ 30.338607][ T29] audit: type=1400 audit(1751043067.990:90): avc: denied { read write } for pid=3311 comm="syz-executor" name="loop3" dev="devtmpfs" ino=103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 30.350734][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.372596][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.385507][ T3474] netlink: 'syz.3.4': attribute type 4 has an invalid length. [ 30.387089][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.409533][ T3304] veth1_macvtap: entered promiscuous mode [ 30.416221][ T3308] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.425150][ T3308] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.433910][ T3308] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.442638][ T3308] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.455303][ T3477] netlink: 'syz.3.4': attribute type 4 has an invalid length. [ 30.462468][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.474475][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.493194][ T3310] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.502071][ T3310] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.510797][ T3310] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.519526][ T3310] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.530407][ T3474] syz.3.4 (3474) used greatest stack depth: 10672 bytes left [ 30.538332][ T3476] netlink: 'syz.1.2': attribute type 7 has an invalid length. [ 30.545985][ T3476] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2'. [ 30.556100][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.578202][ T3304] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.587076][ T3304] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.595911][ T3304] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.604665][ T3304] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.624580][ T3480] loop3: detected capacity change from 0 to 2048 [ 30.658171][ T3480] loop3: p1 < > p4 [ 30.670174][ T3480] loop3: p4 size 8388608 extends beyond EOD, truncated [ 30.716520][ T2994] loop3: p1 < > p4 [ 30.729692][ T2994] loop3: p4 size 8388608 extends beyond EOD, truncated [ 30.748583][ T3495] netlink: 'syz.4.5': attribute type 4 has an invalid length. [ 30.781507][ T3497] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 30.812728][ T3497] netlink: 96 bytes leftover after parsing attributes in process `syz.0.11'. [ 30.824795][ T3495] netlink: 'syz.4.5': attribute type 4 has an invalid length. [ 30.851488][ T3503] udevd[3503]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 30.851739][ T3294] udevd[3294]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 30.874036][ T2994] udevd[2994]: worker [3296] terminated by signal 33 (Unknown signal 33) [ 30.893410][ T2994] udevd[2994]: worker [3296] failed while handling '/devices/virtual/block/loop0' [ 30.922754][ T3502] udevd[3502]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 30.925707][ T3509] veth0: entered promiscuous mode [ 30.949408][ T3294] udevd[3294]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 30.991363][ T3509] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15'. [ 30.993825][ T3515] loop2: detected capacity change from 0 to 512 [ 31.010016][ T3515] EXT4-fs: Ignoring removed i_version option [ 31.031137][ T3515] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 31.044343][ T3515] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 31.056047][ T3521] netlink: 16 bytes leftover after parsing attributes in process `syz.1.20'. [ 31.070657][ T3519] netlink: 96 bytes leftover after parsing attributes in process `syz.4.19'. [ 31.083996][ T3515] EXT4-fs (loop2): 1 truncate cleaned up [ 31.098431][ T3515] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 31.161333][ T3533] netlink: 'syz.3.24': attribute type 3 has an invalid length. [ 31.217447][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.282663][ T3548] wg2: entered promiscuous mode [ 31.287622][ T3548] wg2: entered allmulticast mode [ 31.338331][ T3552] loop1: detected capacity change from 0 to 128 [ 31.362596][ T3552] EXT4-fs: Ignoring removed nobh option [ 31.392879][ T3552] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 31.409692][ T3552] ext4 filesystem being mounted at /8/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 31.460714][ T3560] netlink: 'syz.2.34': attribute type 10 has an invalid length. [ 31.476619][ T3303] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 31.487161][ T3560] veth0_vlan: entered allmulticast mode [ 31.504412][ T3560] veth0_vlan: left promiscuous mode [ 31.511423][ T3560] veth0_vlan: entered promiscuous mode [ 31.519295][ T3560] team0: Device veth0_vlan failed to register rx_handler [ 31.630626][ T3560] syz.2.34 (3560) used greatest stack depth: 10224 bytes left [ 31.648305][ T3571] netlink: 'syz.4.39': attribute type 1 has an invalid length. [ 31.675669][ T3571] geneve2: entered allmulticast mode [ 31.746179][ T3571] netlink: 28 bytes leftover after parsing attributes in process `syz.4.39'. [ 31.957690][ T3600] netlink: 4 bytes leftover after parsing attributes in process `syz.4.47'. [ 31.996390][ T3600] bridge_slave_1: left allmulticast mode [ 32.002145][ T3600] bridge_slave_1: left promiscuous mode [ 32.007890][ T3600] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.022383][ T3600] bridge_slave_0: left allmulticast mode [ 32.028079][ T3600] bridge_slave_0: left promiscuous mode [ 32.033853][ T3600] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.195508][ T3631] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.202757][ T3631] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.252639][ T3631] bridge0: entered allmulticast mode [ 32.263519][ T3629] loop2: detected capacity change from 0 to 8192 [ 32.274733][ T3632] bridge_slave_1: left allmulticast mode [ 32.280538][ T3632] bridge_slave_1: left promiscuous mode [ 32.286200][ T3632] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.329487][ T3632] bridge_slave_0: left allmulticast mode [ 32.335206][ T3632] bridge_slave_0: left promiscuous mode [ 32.341028][ T3632] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.396515][ C0] hrtimer: interrupt took 27186 ns [ 32.684186][ T3650] vxcan1 speed is unknown, defaulting to 1000 [ 32.714121][ T3650] vxcan1 speed is unknown, defaulting to 1000 [ 32.721468][ T3650] vxcan1 speed is unknown, defaulting to 1000 [ 32.761925][ T3650] infiniband syz2: set active [ 32.766776][ T3650] infiniband syz2: added vxcan1 [ 32.771914][ T3357] vxcan1 speed is unknown, defaulting to 1000 [ 32.802491][ T3650] RDS/IB: syz2: added [ 32.814787][ T3650] smc: adding ib device syz2 with port count 1 [ 32.821172][ T3650] smc: ib device syz2 port 1 has pnetid [ 32.827105][ T23] vxcan1 speed is unknown, defaulting to 1000 [ 32.833308][ T3650] vxcan1 speed is unknown, defaulting to 1000 [ 32.874700][ T3650] vxcan1 speed is unknown, defaulting to 1000 [ 32.972279][ T3650] vxcan1 speed is unknown, defaulting to 1000 [ 33.006146][ T3650] vxcan1 speed is unknown, defaulting to 1000 [ 33.047541][ T3650] vxcan1 speed is unknown, defaulting to 1000 [ 33.078809][ T3664] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.161368][ T3665] vxcan1 speed is unknown, defaulting to 1000 [ 33.215066][ T3671] loop4: detected capacity change from 0 to 512 [ 33.225897][ T3671] journal_path: Non-blockdev passed as './bus' [ 33.232246][ T3671] EXT4-fs: error: could not find journal device path [ 33.341802][ T3664] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.402661][ T3664] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.472626][ T3664] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.515554][ T3664] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.539788][ T3664] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.585641][ T3664] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.611989][ T3664] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.668110][ T3705] netlink: 4 bytes leftover after parsing attributes in process `syz.4.85'. [ 33.685970][ T3704] wg2: entered promiscuous mode [ 33.690905][ T3704] wg2: entered allmulticast mode [ 33.719022][ T3705] netlink: 12 bytes leftover after parsing attributes in process `syz.4.85'. [ 33.767420][ T3693] tipc: Started in network mode [ 33.772389][ T3693] tipc: Node identity 76a04ad7d4a2, cluster identity 4711 [ 33.779782][ T3693] tipc: Enabled bearer , priority 0 [ 33.792143][ T3713] loop0: detected capacity change from 0 to 512 [ 33.817275][ T3713] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2 [ 33.835657][ T3713] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2 [ 33.846520][ T3713] EXT4-fs (loop0): 1 truncate cleaned up [ 33.852911][ T3713] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.871156][ T3713] EXT4-fs error (device loop0): ext4_append:79: inode #2: comm syz.0.88: Logical block already allocated [ 33.882547][ T3690] tipc: Resetting bearer [ 33.916128][ T3310] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.943013][ T3690] tipc: Disabling bearer [ 33.970259][ T3727] vxcan1 speed is unknown, defaulting to 1000 [ 34.213364][ T3734] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.315491][ T3737] netlink: 'syz.1.96': attribute type 29 has an invalid length. [ 34.361500][ T3738] netlink: 'syz.1.96': attribute type 29 has an invalid length. [ 34.397704][ T3744] netlink: 12 bytes leftover after parsing attributes in process `syz.1.98'. [ 34.401148][ T3734] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.440917][ T3746] loop0: detected capacity change from 0 to 128 [ 34.464911][ T3746] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 34.501441][ T3746] ext4 filesystem being mounted at /15/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 34.534328][ T3751] vxcan1 speed is unknown, defaulting to 1000 [ 34.544266][ T3734] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.582016][ T3310] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 34.612341][ T3756] team0: Port device dummy0 added [ 34.677268][ T3756] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 34.701260][ T3756] team0: Failed to send options change via netlink (err -105) [ 34.710862][ T3756] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 34.721262][ T3756] team0: Port device dummy0 removed [ 34.728492][ T3756] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 34.749793][ T3734] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.852446][ T3734] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.881818][ T3734] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.917412][ T3734] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.951705][ T3734] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.172062][ T29] kauditd_printk_skb: 225 callbacks suppressed [ 35.172142][ T29] audit: type=1400 audit(1751043072.830:316): avc: denied { ioctl } for pid=3776 comm="syz.4.111" path="socket:[5799]" dev="sockfs" ino=5799 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 35.173748][ T3777] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 35.220791][ T3777] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 35.242627][ T3777] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 35.250208][ T3777] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 35.451086][ T3791] vxcan1 speed is unknown, defaulting to 1000 [ 35.505956][ T3794] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 35.523922][ T3794] syz.0.117 (3794) used greatest stack depth: 10072 bytes left [ 35.713026][ T29] audit: type=1400 audit(1751043073.370:317): avc: denied { create } for pid=3803 comm="syz.2.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 35.733258][ T29] audit: type=1400 audit(1751043073.370:318): avc: denied { write } for pid=3803 comm="syz.2.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 35.816605][ T3812] vxcan1 speed is unknown, defaulting to 1000 [ 35.885034][ T3817] vlan2: entered allmulticast mode [ 35.890326][ T3817] dummy0: entered allmulticast mode [ 35.917021][ T29] audit: type=1326 audit(1751043073.570:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3818 comm="syz.0.126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cd7fee929 code=0x7ffc0000 [ 35.940460][ T29] audit: type=1326 audit(1751043073.570:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3818 comm="syz.0.126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cd7fee929 code=0x7ffc0000 [ 35.940787][ T3819] loop0: detected capacity change from 0 to 128 [ 35.963931][ T3817] Zero length message leads to an empty skb [ 35.971984][ T29] audit: type=1326 audit(1751043073.570:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3818 comm="syz.0.126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3cd7fee929 code=0x7ffc0000 [ 35.976744][ T3819] ======================================================= [ 35.976744][ T3819] WARNING: The mand mount option has been deprecated and [ 35.976744][ T3819] and is ignored by this kernel. Remove the mand [ 35.976744][ T3819] option from the mount to silence this warning. [ 35.976744][ T3819] ======================================================= [ 35.999211][ T29] audit: type=1326 audit(1751043073.570:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3818 comm="syz.0.126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cd7fee929 code=0x7ffc0000 [ 35.999238][ T29] audit: type=1326 audit(1751043073.570:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3818 comm="syz.0.126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=61 compat=0 ip=0x7f3cd7fee929 code=0x7ffc0000 [ 35.999258][ T29] audit: type=1326 audit(1751043073.570:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3818 comm="syz.0.126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cd7fee929 code=0x7ffc0000 [ 35.999348][ T29] audit: type=1326 audit(1751043073.570:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3818 comm="syz.0.126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cd7fee929 code=0x7ffc0000 [ 36.154783][ T3821] Cannot find add_set index 0 as target [ 36.212512][ T3827] validate_nla: 4 callbacks suppressed [ 36.212527][ T3827] netlink: 'syz.1.130': attribute type 1 has an invalid length. [ 36.859929][ T3842] loop0: detected capacity change from 0 to 1024 [ 36.867529][ T3842] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 36.878490][ T3842] EXT4-fs (loop0): group descriptors corrupted! [ 36.888585][ T3842] SELinux: security_context_str_to_sid (Ð-šXܘ7.H\¹ÿ %ºu@) failed with errno=-22 [ 36.913973][ T3844] loop0: detected capacity change from 0 to 128 [ 36.923100][ T3844] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 36.935490][ T3844] ext4 filesystem being mounted at /27/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 36.957547][ T3310] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 36.974761][ T3848] netlink: 'syz.0.138': attribute type 1 has an invalid length. [ 36.983163][ T3848] __nla_validate_parse: 1 callbacks suppressed [ 36.983173][ T3848] netlink: 8 bytes leftover after parsing attributes in process `syz.0.138'. [ 37.093245][ T3854] loop3: detected capacity change from 0 to 2048 [ 37.115033][ T3854] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.132904][ T3854] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 37.147992][ T3854] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 8 with error 28 [ 37.160257][ T3854] EXT4-fs (loop3): This should not happen!! Data will be lost [ 37.160257][ T3854] [ 37.169916][ T3854] EXT4-fs (loop3): Total free blocks count 0 [ 37.175906][ T3854] EXT4-fs (loop3): Free/Dirty block details [ 37.181838][ T3854] EXT4-fs (loop3): free_blocks=2415919504 [ 37.187589][ T3854] EXT4-fs (loop3): dirty_blocks=16 [ 37.192720][ T3854] EXT4-fs (loop3): Block reservation details [ 37.198768][ T3854] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 37.294937][ T3854] syz.3.140 (3854) used greatest stack depth: 9744 bytes left [ 37.303501][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.518725][ T3886] loop2: detected capacity change from 0 to 1024 [ 37.525745][ T3886] EXT4-fs: Ignoring removed orlov option [ 37.534960][ T3886] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.776068][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.982349][ T3909] loop1: detected capacity change from 0 to 1024 [ 38.001521][ T3909] EXT4-fs: Ignoring removed nobh option [ 38.007180][ T3909] EXT4-fs: Ignoring removed bh option [ 38.049801][ T3909] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.090456][ T3909] EXT4-fs error (device loop1): ext4_xattr_inode_iget:437: comm syz.1.157: inode #327696: comm syz.1.157: iget: illegal inode # [ 38.121546][ T3915] Driver unsupported XDP return value 0 on prog (id 148) dev N/A, expect packet loss! [ 38.131598][ T3909] EXT4-fs (loop1): Remounting filesystem read-only [ 38.142427][ T3909] EXT4-fs warning (device loop1): ext4_xattr_inode_inc_ref_all:1129: inode #18: comm syz.1.157: cleanup dec ref error -30 [ 38.155388][ T3909] EXT4-fs warning (device loop1): ext4_xattr_block_set:2190: inode #18: comm syz.1.157: dec ref error=-30 [ 38.192923][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.227037][ T3921] vxcan1 speed is unknown, defaulting to 1000 [ 38.236429][ T3923] tls_set_device_offload_rx: netdev not found [ 38.312312][ T3930] netlink: 'syz.3.167': attribute type 10 has an invalid length. [ 38.336472][ T3930] team0: Port device dummy0 added [ 38.347055][ T3930] netlink: 'syz.3.167': attribute type 10 has an invalid length. [ 38.358441][ T3930] team0: Port device dummy0 removed [ 38.365983][ T3930] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 38.481407][ T3943] $Hÿ: renamed from bond0 (while UP) [ 38.488701][ T3943] $Hÿ: entered promiscuous mode [ 38.493783][ T3943] bond_slave_0: entered promiscuous mode [ 38.499568][ T3943] bond_slave_1: entered promiscuous mode [ 38.639596][ T3950] vxcan1 speed is unknown, defaulting to 1000 [ 38.648246][ T3953] netlink: 4 bytes leftover after parsing attributes in process `syz.3.176'. [ 38.657500][ T3953] netlink: 4 bytes leftover after parsing attributes in process `syz.3.176'. [ 38.675637][ T3953] netlink: 4 bytes leftover after parsing attributes in process `syz.3.176'. [ 38.692887][ T3953] netlink: 4 bytes leftover after parsing attributes in process `syz.3.176'. [ 38.741509][ T3953] netlink: 4 bytes leftover after parsing attributes in process `syz.3.176'. [ 38.750558][ T3953] netlink: 4 bytes leftover after parsing attributes in process `syz.3.176'. [ 38.915541][ T3967] vxcan1 speed is unknown, defaulting to 1000 [ 39.123568][ T3983] loop1: detected capacity change from 0 to 128 [ 39.656262][ T4004] 9pnet_fd: Insufficient options for proto=fd [ 40.064114][ T4013] loop1: detected capacity change from 0 to 128 [ 40.071740][ T4013] EXT4-fs: Ignoring removed oldalloc option [ 40.088753][ T4013] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 40.101653][ T4013] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 40.195365][ T29] kauditd_printk_skb: 501 callbacks suppressed [ 40.195380][ T29] audit: type=1400 audit(1751043077.850:827): avc: denied { read } for pid=4020 comm="syz.2.201" name="qrtr-tun" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.224318][ T29] audit: type=1400 audit(1751043077.850:828): avc: denied { open } for pid=4020 comm="syz.2.201" path="/dev/qrtr-tun" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.248985][ T29] audit: type=1400 audit(1751043077.880:829): avc: denied { connect } for pid=4020 comm="syz.2.201" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 40.271351][ T29] audit: type=1400 audit(1751043077.930:830): avc: denied { write } for pid=4020 comm="syz.2.201" path="socket:[7239]" dev="sockfs" ino=7239 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 40.301866][ T4025] netlink: 20 bytes leftover after parsing attributes in process `syz.4.202'. [ 40.311000][ T4025] x_tables: ip_tables: udp match: only valid for protocol 17 [ 40.384532][ T29] audit: type=1400 audit(1751043078.040:831): avc: denied { name_bind } for pid=4029 comm="syz.4.204" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 40.406265][ T29] audit: type=1400 audit(1751043078.040:832): avc: denied { node_bind } for pid=4029 comm="syz.4.204" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 40.427885][ T29] audit: type=1400 audit(1751043078.040:833): avc: denied { write } for pid=4029 comm="syz.4.204" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 40.462786][ T3303] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 40.498943][ T29] audit: type=1400 audit(1751043078.150:834): avc: denied { shutdown } for pid=4029 comm="syz.4.204" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 40.558129][ T4040] netlink: 48 bytes leftover after parsing attributes in process `syz.4.207'. [ 40.593107][ T4043] batadv_slave_0: entered promiscuous mode [ 40.599737][ T4043] netlink: 4 bytes leftover after parsing attributes in process `syz.4.208'. [ 40.625934][ T4043] batadv_slave_0 (unregistering): left promiscuous mode [ 40.744281][ T4062] sd 0:0:1:0: device reset [ 40.744800][ T29] audit: type=1400 audit(1751043078.400:835): avc: denied { read } for pid=4061 comm="syz.4.212" name="sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 40.753000][ T4059] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 40.782381][ T4059] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 40.815356][ T4059] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 40.823786][ T4059] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 41.009032][ T29] audit: type=1400 audit(1751043078.660:836): avc: denied { getopt } for pid=4070 comm="syz.3.214" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 41.075533][ T4079] vlan2: entered allmulticast mode [ 41.232392][ T4099] x_tables: ip_tables: udp match: only valid for protocol 17 [ 41.394676][ T4110] vxcan1 speed is unknown, defaulting to 1000 [ 42.025015][ T4143] wg2: left promiscuous mode [ 42.029900][ T4143] wg2: left allmulticast mode [ 42.045413][ T4143] wg2: entered promiscuous mode [ 42.050437][ T4143] wg2: entered allmulticast mode [ 42.245657][ T4158] __nla_validate_parse: 6 callbacks suppressed [ 42.245671][ T4158] netlink: 24 bytes leftover after parsing attributes in process `syz.0.251'. [ 42.301437][ T4162] sch_tbf: burst 88 is lower than device veth1 mtu (1514) ! [ 42.377008][ T4166] loop3: detected capacity change from 0 to 2048 [ 42.419887][ T4173] gtp0: entered promiscuous mode [ 42.430020][ T3502] loop3: p1 < > p4 [ 42.434552][ T3502] loop3: p4 size 8388608 extends beyond EOD, truncated [ 42.470020][ T4166] loop3: p1 < > p4 [ 42.476462][ T4166] loop3: p4 size 8388608 extends beyond EOD, truncated [ 42.565559][ T4177] loop4: detected capacity change from 0 to 1024 [ 42.583856][ T2994] loop3: p1 < > p4 [ 42.588229][ T2994] loop3: p4 size 8388608 extends beyond EOD, truncated [ 42.611011][ T4177] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.701330][ T3502] udevd[3502]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 42.732065][ T3503] udevd[3503]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 42.751691][ T4177] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4113: comm syz.4.259: Allocating blocks 449-513 which overlap fs metadata [ 42.788820][ T4185] vxcan1 speed is unknown, defaulting to 1000 [ 42.808535][ T3502] udevd[3502]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 42.810838][ T4176] EXT4-fs (loop4): pa ffff888106e665b0: logic 48, phys. 177, len 21 [ 42.826427][ T4176] EXT4-fs error (device loop4): ext4_mb_release_inode_pa:5364: group 0, free 0, pa_free 4 [ 42.843261][ T3502] udevd[3502]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 42.948585][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.976792][ T4187] vxcan1 speed is unknown, defaulting to 1000 [ 43.007409][ T4199] netlink: 'syz.4.267': attribute type 1 has an invalid length. [ 43.038680][ T4199] 8021q: adding VLAN 0 to HW filter on device bond1 [ 43.113609][ T4209] process 'syz.1.271' launched '/dev/fd/3' with NULL argv: empty string added [ 43.124411][ T4199] bond1: (slave gretap1): making interface the new active one [ 43.139758][ T4199] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 43.196536][ T4199] syz.4.267 (4199) used greatest stack depth: 9360 bytes left [ 43.245345][ T4224] netlink: 28 bytes leftover after parsing attributes in process `syz.4.277'. [ 43.254315][ T4224] netlink: 28 bytes leftover after parsing attributes in process `syz.4.277'. [ 43.312043][ T4229] netlink: 12 bytes leftover after parsing attributes in process `syz.4.279'. [ 43.637032][ T4244] vlan2: entered allmulticast mode [ 43.642390][ T4244] dummy0: entered allmulticast mode [ 43.727528][ T4250] loop4: detected capacity change from 0 to 128 [ 44.060960][ T4261] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.153467][ T4261] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.258674][ T4272] syzkaller0: entered promiscuous mode [ 44.264304][ T4272] syzkaller0: entered allmulticast mode [ 44.274207][ T4261] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.327281][ T4261] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.382162][ T4261] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.413755][ T4261] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.426351][ T4261] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.448295][ T4261] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.477889][ T4280] netlink: 44 bytes leftover after parsing attributes in process `syz.1.299'. [ 44.501322][ T4282] bridge: RTM_NEWNEIGH with invalid ether address [ 44.515683][ T4284] netlink: 28 bytes leftover after parsing attributes in process `syz.2.301'. [ 44.524632][ T4284] netlink: 28 bytes leftover after parsing attributes in process `syz.2.301'. [ 44.778835][ T4316] loop4: detected capacity change from 0 to 4096 [ 44.791524][ T4316] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 44.824160][ T4324] netlink: 28 bytes leftover after parsing attributes in process `syz.1.317'. [ 44.833158][ T4324] netlink: 28 bytes leftover after parsing attributes in process `syz.1.317'. [ 44.849106][ T4326] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=4326 comm=syz.2.316 [ 44.877847][ T4332] 9pnet_fd: Insufficient options for proto=fd [ 44.918577][ T3304] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.060029][ T4348] loop0: detected capacity change from 0 to 512 [ 45.112609][ T4348] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.125788][ T4348] ext4 filesystem being mounted at /66/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 45.169437][ T4348] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #18: comm syz.0.327: corrupted inode contents [ 45.181648][ T4348] EXT4-fs error (device loop0): ext4_dirty_inode:6459: inode #18: comm syz.0.327: mark_inode_dirty error [ 45.193097][ T4348] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #18: comm syz.0.327: corrupted inode contents [ 45.205118][ T4348] EXT4-fs error (device loop0): ext4_xattr_delete_inode:2991: inode #18: comm syz.0.327: mark_inode_dirty error [ 45.217695][ T4348] EXT4-fs error (device loop0): ext4_xattr_delete_inode:2994: inode #18: comm syz.0.327: mark inode dirty (error -117) [ 45.230416][ T4348] EXT4-fs warning (device loop0): ext4_evict_inode:274: xattr delete (err -117) [ 45.250796][ T3310] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.692236][ T4358] netlink: 28 bytes leftover after parsing attributes in process `syz.3.330'. [ 45.726642][ T4360] sch_fq: defrate 4294967295 ignored. [ 45.751050][ T4371] loop2: detected capacity change from 0 to 128 [ 45.791838][ T4377] netlink: 'syz.3.339': attribute type 1 has an invalid length. [ 45.805290][ T4371] syz.2.336: attempt to access beyond end of device [ 45.805290][ T4371] loop2: rw=2049, sector=145, nr_sectors = 16 limit=128 [ 45.820344][ T4371] syz.2.336: attempt to access beyond end of device [ 45.820344][ T4371] loop2: rw=2049, sector=169, nr_sectors = 16 limit=128 [ 45.854118][ T4377] 8021q: adding VLAN 0 to HW filter on device bond1 [ 45.859397][ T4371] syz.2.336: attempt to access beyond end of device [ 45.859397][ T4371] loop2: rw=2049, sector=193, nr_sectors = 8 limit=128 [ 45.884834][ T4371] syz.2.336: attempt to access beyond end of device [ 45.884834][ T4371] loop2: rw=2049, sector=209, nr_sectors = 8 limit=128 [ 45.900190][ T4377] 8021q: adding VLAN 0 to HW filter on device bond1 [ 45.906398][ T4371] syz.2.336: attempt to access beyond end of device [ 45.906398][ T4371] loop2: rw=2049, sector=225, nr_sectors = 8 limit=128 [ 45.909587][ T4377] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 45.926741][ T4371] syz.2.336: attempt to access beyond end of device [ 45.926741][ T4371] loop2: rw=2049, sector=241, nr_sectors = 8 limit=128 [ 45.937895][ T4377] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 45.944040][ T4371] syz.2.336: attempt to access beyond end of device [ 45.944040][ T4371] loop2: rw=2049, sector=257, nr_sectors = 8 limit=128 [ 45.964571][ T4371] syz.2.336: attempt to access beyond end of device [ 45.964571][ T4371] loop2: rw=2049, sector=273, nr_sectors = 8 limit=128 [ 45.979625][ T4371] syz.2.336: attempt to access beyond end of device [ 45.979625][ T4371] loop2: rw=2049, sector=289, nr_sectors = 9 limit=128 [ 45.990437][ T29] kauditd_printk_skb: 119 callbacks suppressed [ 45.990451][ T29] audit: type=1400 audit(1751043083.650:956): avc: denied { execute } for pid=4385 comm="syz.1.343" path="/73/cpu.stat" dev="tmpfs" ino=399 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 46.042155][ T29] audit: type=1400 audit(1751043083.700:957): avc: denied { mounton } for pid=4388 comm="syz.1.344" path="/74/file0" dev="tmpfs" ino=405 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 46.057412][ T4384] ip6erspan0: entered promiscuous mode [ 46.076459][ T4384] bond1: (slave ip6erspan0): making interface the new active one [ 46.084348][ T29] audit: type=1400 audit(1751043083.730:958): avc: denied { read write } for pid=4390 comm="syz.2.345" name="virtual_nci" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 46.093845][ T4384] bond1: (slave ip6erspan0): Enslaving as an active interface with an up link [ 46.107854][ T29] audit: type=1400 audit(1751043083.730:959): avc: denied { open } for pid=4390 comm="syz.2.345" path="/dev/virtual_nci" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 46.117056][ T4375] vxcan1 speed is unknown, defaulting to 1000 [ 46.206694][ T29] audit: type=1400 audit(1751043083.860:960): avc: denied { setopt } for pid=4398 comm="syz.2.347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 46.265247][ T29] audit: type=1400 audit(1751043083.910:961): avc: denied { write } for pid=4398 comm="syz.2.347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 46.383831][ T4422] loop3: detected capacity change from 0 to 512 [ 46.496686][ T4422] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 46.601977][ T29] audit: type=1400 audit(1751043084.050:962): avc: denied { setattr } for pid=4419 comm="syz.1.356" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 46.659614][ T4422] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 46.667579][ T4422] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e000e118, mo2=0002] [ 46.681644][ T4430] mmap: syz.2.360 (4430) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 46.697937][ T29] audit: type=1326 audit(1751043084.330:963): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4429 comm="syz.2.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3054afe929 code=0x7ffc0000 [ 46.721314][ T29] audit: type=1326 audit(1751043084.330:964): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4429 comm="syz.2.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3054afe929 code=0x7ffc0000 [ 46.744575][ T29] audit: type=1326 audit(1751043084.330:965): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4429 comm="syz.2.360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3054afe929 code=0x7ffc0000 [ 46.779472][ T4422] System zones: 0-1, 15-15, 18-18, 34-34 [ 46.815995][ T4422] EXT4-fs (loop3): orphan cleanup on readonly fs [ 46.822963][ T4422] EXT4-fs warning (device loop3): ext4_enable_quotas:7168: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 46.837558][ T4422] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 46.855949][ T4436] netlink: 'syz.0.362': attribute type 12 has an invalid length. [ 46.889770][ T4422] EXT4-fs error (device loop3): ext4_validate_block_bitmap:441: comm syz.3.357: bg 0: block 40: padding at end of block bitmap is not set [ 46.911652][ T4439] pim6reg: entered allmulticast mode [ 46.920381][ T4439] pim6reg: left allmulticast mode [ 46.935135][ T4422] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6548: Corrupt filesystem [ 46.944868][ T4422] EXT4-fs (loop3): 1 truncate cleaned up [ 46.951408][ T4422] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 47.021853][ T4455] TCP: out of memory -- consider tuning tcp_mem [ 47.144805][ T4422] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 47.152869][ T4422] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e000e118, mo2=0002] [ 47.200727][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.399878][ T4494] loop1: detected capacity change from 0 to 1024 [ 47.407261][ T4494] EXT4-fs: Ignoring removed orlov option [ 47.416446][ T4494] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.548005][ T4494] ================================================================== [ 47.556139][ T4494] BUG: KCSAN: data-race in vfs_fsync_range / writeback_single_inode [ 47.564142][ T4494] [ 47.566473][ T4494] write to 0xffff888106e2b5c0 of 4 bytes by task 4496 on cpu 0: [ 47.574114][ T4494] writeback_single_inode+0x14a/0x3e0 [ 47.579610][ T4494] sync_inode_metadata+0x5b/0x90 [ 47.584574][ T4494] generic_buffers_fsync_noflush+0xd9/0x120 [ 47.590497][ T4494] ext4_sync_file+0x1ab/0x690 [ 47.595201][ T4494] vfs_fsync_range+0x10a/0x130 [ 47.599992][ T4494] ext4_buffered_write_iter+0x34f/0x3c0 [ 47.605533][ T4494] ext4_file_write_iter+0x383/0xf00 [ 47.610721][ T4494] iter_file_splice_write+0x5ef/0x970 [ 47.616088][ T4494] direct_splice_actor+0x153/0x2a0 [ 47.621190][ T4494] splice_direct_to_actor+0x30f/0x680 [ 47.626555][ T4494] do_splice_direct+0xda/0x150 [ 47.631313][ T4494] do_sendfile+0x380/0x650 [ 47.635823][ T4494] __x64_sys_sendfile64+0x105/0x150 [ 47.641005][ T4494] x64_sys_call+0xb39/0x2fb0 [ 47.645591][ T4494] do_syscall_64+0xd2/0x200 [ 47.650105][ T4494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 47.656003][ T4494] [ 47.658317][ T4494] read to 0xffff888106e2b5c0 of 4 bytes by task 4494 on cpu 1: [ 47.665849][ T4494] vfs_fsync_range+0x9b/0x130 [ 47.670526][ T4494] ext4_buffered_write_iter+0x34f/0x3c0 [ 47.676073][ T4494] ext4_file_write_iter+0x383/0xf00 [ 47.681268][ T4494] iter_file_splice_write+0x5ef/0x970 [ 47.686643][ T4494] direct_splice_actor+0x153/0x2a0 [ 47.691752][ T4494] splice_direct_to_actor+0x30f/0x680 [ 47.697135][ T4494] do_splice_direct+0xda/0x150 [ 47.701907][ T4494] do_sendfile+0x380/0x650 [ 47.706327][ T4494] __x64_sys_sendfile64+0x105/0x150 [ 47.711527][ T4494] x64_sys_call+0xb39/0x2fb0 [ 47.716108][ T4494] do_syscall_64+0xd2/0x200 [ 47.720604][ T4494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 47.726489][ T4494] [ 47.728801][ T4494] value changed: 0x00000038 -> 0x00000002 [ 47.734504][ T4494] [ 47.736813][ T4494] Reported by Kernel Concurrency Sanitizer on: [ 47.742960][ T4494] CPU: 1 UID: 0 PID: 4494 Comm: syz.1.387 Not tainted 6.16.0-rc3-syzkaller-00190-g67a993863163 #0 PREEMPT(voluntary) [ 47.755278][ T4494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 47.765326][ T4494] ================================================================== [ 47.816635][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.