last executing test programs: 13.986093758s ago: executing program 4 (id=90): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x1, 0x0, 0x7ffc1ffb}]}) bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18020000090000000000000000000000850000004100000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f0000000240)="bf1ea0e3c19ed614ebadb3161741", 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) 13.86367149s ago: executing program 4 (id=93): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0x2000000000000288, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000030000000"], 0x0, 0x0, 0x51}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000280)={'pim6reg1\x00', 0x2}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='qdisc_create\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='qdisc_create\x00', r3}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @broadcast}) 13.766868812s ago: executing program 4 (id=95): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001400001cb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000300)={'#! ', '', [{0x20, 'memory.events\x00'}]}, 0x13) perf_event_open(&(0x7f0000000140)={0x8, 0x80, 0x7, 0x0, 0x0, 0x3, 0x82, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0xf}, 0x8080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x10000000000007}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000400)={0x8, 0x80, 0x0, 0x94, 0x10, 0x0, 0x82, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0xb}, 0x1, 0x0, 0x2}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1e, 0x12, r4, 0x0) 13.559047836s ago: executing program 4 (id=96): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$bind(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x12f451, 0x0) mount$bind(&(0x7f00000000c0)='.\x00', &(0x7f0000000080)='./file0/file0/file0\x00', 0x0, 0x80700a, 0x0) 13.503767818s ago: executing program 4 (id=97): bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYRES16], 0x48) r0 = socket$rxrpc(0x21, 0x2, 0xa) r1 = syz_io_uring_setup(0x10e, &(0x7f0000000140)={0x0, 0x334a, 0x10, 0x4, 0x1000312}, &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r4, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x60, 0x185100}) io_uring_enter(r1, 0x7277, 0x0, 0x28, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000240), 0x4) 13.248922292s ago: executing program 4 (id=100): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x2, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xa1b96aadc3618c72}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) setgroups(0x0, 0x0) 13.248614112s ago: executing program 32 (id=100): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x2, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xa1b96aadc3618c72}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) setgroups(0x0, 0x0) 2.090538029s ago: executing program 1 (id=299): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r2}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x40, 0x7ffc1ffb}]}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r3, 0x400, 0x0) fsetxattr$trusted_overlay_redirect(r3, &(0x7f0000000040), 0x0, 0x0, 0x0) 2.0543377s ago: executing program 1 (id=300): mkdir(0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sendmsg$NFC_CMD_LLC_SDREQ(0xffffffffffffffff, 0x0, 0x4000044) sched_setaffinity(0x0, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@getqdisc={0x24, 0x26, 0x10, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x5}, {0x10, 0xd}, {0x3, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x20040000) r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ec0)=@newqdisc={0x68, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe, 0x4, 0x7, 0x4, 0x2, 0x2cf, 0x8d2, 0x1}}, {0x6, 0x2, [0xffff]}}]}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}, @qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0x401}}]}, 0x68}, 0x1, 0x0, 0x0, 0x80d1}, 0x34008098) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.989006431s ago: executing program 1 (id=301): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xcac2d78a}}, 0x0, 0x0, 0x3f, 0x0, "ee080e650926a96ecc136e7fb980e989db9e8bf9b93129488f65178de213eb94cd46e19d9c65a018444a131f4000000065569607462029add09240005c6776267517308a3d40aa1c788df600"}, 0xd8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x3ff, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r0, 0x5421, &(0x7f0000000140)=0x1) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) 1.714551317s ago: executing program 1 (id=307): syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000780)='./file0\x00', 0x0, &(0x7f00000007c0), 0x1, 0x73a, &(0x7f0000000800)="$eJzs3M9rHGUfAPDvTJO2b5v33bzgQTwJFSvUTtJU7UmIeC4U+gfUsJmEkEk2ZDe1iQFbDx4EQUXwRy/6H3hRBC+l/4MieFPwIGhN40HwsLKT3a1ud9PYJl2onw/Mzvd5Zme+zzc7PGRgnw3gX+vJ1ksSMRYRFyKi0u5PI+JwGR2NuLrzvttbm9Xtrc1qEs3mxVtJ67Syr3OtpL0/HuUp8XhE3ByNOPXG3Xnr6xuLM0WRr7bbE42llYn6+sbphaWZ+Xw+X56anDx79oWp55+b3Lda337ts1/e+vLlrz8+t/THi7eenU1iuqw7eurYTzt/k9GY7ulfPohkQ9RsNpvDHgMAAPeWlv+dRoyU+0ocKiMAAADgUdI80gQAAAAeeUkMewQAAADAwep8D+D21ma1sz3M7x/8/FJEjN9ZW7zdzT9SriGOOFquTzi2nfxtZUKycxo8kKvXIuLGdJ/7P2nff/evd+V68oDXY//daM0/0/3mv7Q7/0Sf+Wek89sJD6gz/23fNf/dyX9owPx3YY85jqye/GZg/msRT4z0y5908ycD8r+yx/yfj333/aBjzU8jTkb//H/NtcvvQ0zMLRR5+7VvjhNfvH5qt/qPDcqf7F7/yh7r/+H61PyguaSV/5kTu3/+/fK37ol32uNII+Ld9r7Vfq8nx9M3Jz/arf7ZAfXf6/P/ZI/1f/Xmxo97fCsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACU0ogYiyTNunGaZlnE8Yh4LI6lRa3eODVXW1uebR2LGI/RdG6hyCcjorLTTlrtM2V8pz3V0z4bEf+PiPcr/ynbWbVWzA67eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALqOR8RYJGkWEWlE/FZJ0ywb9qgAAACAfTc+7AEAAAAAB87zPwAAADz6PP8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8GF8+dbW3N7a7Paas9eXl9brF0+PZvXF7OltWpWra2uZPO12nyRZ9Xa0r2uV9RqK+diee3KRCOvNybq6xuXlmpry41LC0sz8/mlfPShVAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMA/NVZuSZpFRFrGaZplEf+NiPEYTeYWinwyIv4XEd9WRo+02meGPWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2XX19Y3GmKPJVgUAg6AbDnpkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABiG+vrG4kxR5Kv1YY8EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA4Up/SiKitZ2sPDXWe/Rw8nul3EfEq9cvfnBlptFYPdPq/7Xb3/iw3T81jPEDAAAAvTrP6Z3neAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgL2qr28szhRFvnqAwbBrBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7s+fAQAA//8gLc9Y") timer_create(0x3, 0x0, &(0x7f0000001b40)=0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000100)={[0x3ffffffe]}, 0x8, 0x80000) readv(r1, &(0x7f0000000140)=[{&(0x7f0000000240)=""/144, 0x90}], 0x1) timer_create(0x1, 0x0, &(0x7f0000000000)=0x0) timer_settime(r2, 0x1, &(0x7f0000000880)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000240)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_settime(r0, 0x0, &(0x7f0000000140)={{0x0, 0x3938700}}, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) rt_sigaction(0xe, &(0x7f00000000c0)={&(0x7f0000000180)="f30f1efc6645f10f0808c482adbcaf07000000c4e1fd5aa13c9c43713ef2400f1ed3c4c2e93be7f2262e669f8f88a4a2e100430f12957b2c0000653ed9fa", 0x80000004, 0x0, {[0x7ffc]}}, 0x0, 0x8, &(0x7f0000000200)) 1.595715239s ago: executing program 5 (id=309): r0 = io_uring_setup(0x3c92, &(0x7f0000000100)={0x0, 0x3, 0x0, 0xffffffff, 0x2}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r3 = accept(r1, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="120000000400000004000000a4"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r4, &(0x7f0000000080), &(0x7f00000002c0)=@udp=r3}, 0x20) recvmsg$can_bcm(r3, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.595049549s ago: executing program 1 (id=319): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route_sched(r0, 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) timer_settime(r2, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x200000000000000) 1.497679201s ago: executing program 5 (id=311): fstat(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@local, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private0}, 0x0, @in=@empty}}, &(0x7f0000000240)=0xe8) madvise(&(0x7f0000920000/0x3000)=nil, 0x3000, 0x12) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x13) setreuid(r0, r1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) umount2(&(0x7f0000000580)='./file0\x00', 0x3) 1.477102911s ago: executing program 5 (id=312): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000400)=[{0x6, 0x1, 0x2, 0x7fff7ffc}]}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) fsopen(0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="11000000040000000400000001"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r3}, 0x10) r4 = socket$kcm(0x2c, 0x3, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r1}, &(0x7f0000000080), &(0x7f00000001c0)=r4}, 0x20) close_range(r0, 0xffffffffffffffff, 0x0) 1.455999951s ago: executing program 5 (id=313): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_queued\x00', 0x275a, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x0, &(0x7f0000000000)={{}, {0x0, 0x3938700}}, 0x0) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) 1.316181914s ago: executing program 3 (id=315): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2, 0x4}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="0600000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0xad06, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r3}, 0x10) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) r4 = dup3(r1, r0, 0x0) recvmmsg(r4, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)=""/34, 0x22}], 0x1}, 0x96d}], 0x1, 0x40, 0x0) 1.178270107s ago: executing program 3 (id=318): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x1}, 0x10) sendmsg$tipc(r1, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x80) r2 = dup3(r0, r1, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000001000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(r2, 0x10f, 0x88) 1.108012688s ago: executing program 3 (id=322): syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x20c006, &(0x7f0000000240)={[{@grpjquota}, {@lazytime}, {@barrier}, {@barrier}, {@max_batch_time={'max_batch_time', 0x3d, 0x5}}, {@grpquota}], [{@seclabel}]}, 0x3, 0x446, &(0x7f0000000d40)="$eJzs28tvG8UfAPDv2kn6/P1qqvLoAwgURMQjadJSeuACAokDSEhwKMeQpFWo26AmSLSKICBUjqgSd8QRib+AE1wQcELiCndUqUK5tMDFaOPdxHbttA5ONtSfj7TJzO44M1/vjj07kw2gbw2nP5KIvRHxa0Tsq2ebCwzXf91cXpz6c3lxKola7Y0/kpVyN5YXp/Ki+ev25JmBiNInSRxuU+/8pcvnJqvVmYtZfmzh/Ltj85cuPzN7fvLszNmZCxOnTp04Pv7cyYlnexJnGteNQx/MHTn4yltXX5s6ffXtH79O8vhb4uiR4fUOPl6r9bi6Yv2vIZ0MFNgQulKud9MYXOn/+6IcaydvX7z8caGNAzZVrVar3df58FINuIslUXQLgGLkX/Tp/W++bdHQY1u4/kL9BiiN+2a21Y8MRCkrM9hyf9tLwxFxeumvL9ItNmceAgCgybfp+OfpbPzXtPBTisZ5of9nayiViLgnIvZHxMmIOBAR90aslL0/Ih7osv7WRZJbxz+la13+ya6k47/ns7Wt5vFfPvqLSjni73y4XInB5MxsdeZY9p6MxOCOND++Th3fvfTLZ52ONY7/0i2tPx8LZu24NrCj+TXTkwuT/ybmRtc/ijg00C7+ZHUlIL0sDkbEoQ3WMfvkV0c6Hbt9/M2GGjM9WGeqfRnxRP38L0VL/Llk/fXJsZ1RnTk2ll8Vt/rp5yuvd6q/2/h7LT3/u9te/6vxV5LG9dr57uu48tunHe9pNnr9DyVvNu17f3Jh4eJ4xFDyar3RjfsnWspNrJVP4x852r7/74+1d+JwRKQX8YMR8VBEPJy1/ZGIeDQijq4T/w8vPvZO856ki/g3Vxr/dFfnfy0xFK172ifK577/pqnSSnQRf3r+T6ykRrI9d/L5dyft2tjVDAAAAP89pYjYG0lpdDVdKo2O1v+H/0DsLlXn5heeOjP33oXp+jMClRgs5TNd9fng+nzoeHZbn+cnWvLHs3njz8u7VvKjU3PV6aKDhz63p0P/T/1eLrp1wKbzvBb0L/0f+pf+D/1L/4f+1ab/7yqiHcDWa/f9/2EB7QC2Xkv/t+wHfcT9P/Qv/R/6l/4PfWl+V9z+Ifntmti5PZrRn4koFVd7PkNV+JtwFycK/mACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADokX8CAAD//2Ts5lU=") r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000000)='.\x00', 0x400017e) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x7, &(0x7f0000000080)=0x1f, 0x4) getsockopt$inet_tcp_int(r2, 0x6, 0x7, 0x0, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x60, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r3, 0x800, 0x55007}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x30, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}, @IFLA_BR_MCAST_SNOOPING={0x5}, @IFLA_BR_AGEING_TIME={0x8, 0x4, 0x81}, @IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x1}, @IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x0) open(0x0, 0x50500, 0x0) 1.069666229s ago: executing program 0 (id=323): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x40) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0xf4) r3 = dup2(r2, r2) ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x200000a, 0x1, 0x8}) ioctl$BLKTRACESETUP(r3, 0x1276, 0x0) 918.886262ms ago: executing program 3 (id=324): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0900000004000000e27f000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340), &(0x7f0000000500), 0x81, r2}, 0x38) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='writeback_bdi_register\x00', r3}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='writeback_bdi_register\x00', r4}, 0x10) r5 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[], [], 0x6b}}) 758.546275ms ago: executing program 2 (id=326): socket$nl_xfrm(0x10, 0x3, 0x6) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x24, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, @perf_bp={0x0, 0x224ef61b12363fa4}, 0x0, 0x4, 0x5, 0xffffffffffffffff, 0x8, 0x2, 0x1, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0x1, 0xffffffffffffffff, 0x2) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x48) pipe(0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) open(&(0x7f0000000740)='./bus\x00', 0x143c62, 0x0) mount(&(0x7f0000000000), &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x40, &(0x7f0000000300)='trans=rdma,') 750.799095ms ago: executing program 0 (id=327): pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa100000000000007010000b8ffffffb702000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r3}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r2}, 0x10) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000280), 0x1010000, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 725.136826ms ago: executing program 3 (id=328): openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x3c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r2, &(0x7f0000000080)=[{&(0x7f0000003140)=""/4110, 0x100e}], 0x1) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) 691.018267ms ago: executing program 1 (id=329): socket$netlink(0x10, 0x3, 0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x4ca80, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}, 0x1, 0x0, 0x0, 0x4000844}, 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x2, @rand_addr=' \x01\x00', 0x2}, 0x1c) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 664.019537ms ago: executing program 2 (id=330): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x15) remap_file_pages(&(0x7f000051c000/0x400000)=nil, 0x400d00, 0x0, 0x0, 0x0) 640.000948ms ago: executing program 0 (id=331): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r2, &(0x7f0000003280)={0x0, 0x0, 0x0}, 0x0) sendmsg$tipc(r2, &(0x7f0000000e40)={0x0, 0x0, 0x0}, 0x0) sendmsg$inet(r2, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000042c0)="86", 0x1}], 0x1}, 0x0) sendmsg$tipc(r2, &(0x7f0000002700)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x21, &(0x7f0000000040), 0x4) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) close(r2) recvmsg(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000600)=""/203, 0xcb}], 0x1}, 0x0) 565.338709ms ago: executing program 3 (id=332): socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x5, 0x84) socket$kcm(0x2, 0x5, 0x84) r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$inet(r0, 0x0, 0x408c4) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) 560.304089ms ago: executing program 0 (id=333): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x10000}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) setrlimit(0x40000000000008, &(0x7f0000000000)) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000600)={0x200000000000001, 0x3}, 0x8) sendto$inet6(r0, 0x0, 0x0, 0xc880, &(0x7f0000000540)={0xa, 0x4e20, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x8}, 0x1c) sendmmsg$inet6(r0, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)='\x00', 0x1}], 0x1}}], 0x2, 0x404c484) 511.29426ms ago: executing program 5 (id=334): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0700000004000000200100000102"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000140)='kmem_cache_free\x00', r1, 0x0, 0xb}, 0x18) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) 251.795805ms ago: executing program 2 (id=335): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYBLOB="01980000000000002000128008000100677265001400028008000100", @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=@newqdisc={0x58, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x5, 0x7, 0x9, 0x200, 0x6, 0x500, 0x7, 0x398, 0x620b}}}}]}, 0x58}}, 0x800) r5 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route_sched(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b40)=@newtfilter={0x24, 0x29, 0xd27, 0x1004001, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x2, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x48c0) 249.863515ms ago: executing program 0 (id=345): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1b, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1004}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xeb48195b69e85694, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r1, 0x0, 0x5}, 0x18) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r2, &(0x7f0000000200)={0xa, 0xffff, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x304}, '\x00', "07f217bd74511e465bbbd5de01000000f9044677d4d588363d63af84db44be59", "00f8ff00", "8ce63ecbc640735f"}, 0x38) sendto$inet6(r2, &(0x7f0000000280)='S', 0x1, 0x8000, 0x0, 0x0) close(r2) 204.123206ms ago: executing program 0 (id=336): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="07000000040000000001000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='kfree\x00', r1, 0x0, 0x7}, 0x18) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) recvmsg(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000600)=""/203, 0xcb}], 0x1}, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) ioctl$EVIOCGMASK(r4, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) syz_open_dev$evdev(&(0x7f0000000240), 0x20000, 0x0) 192.033736ms ago: executing program 2 (id=337): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1, 0x8, 0x0, 0x401}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@jmp={0x5, 0x0, 0x3, 0x1, 0xb, 0x100, 0xffffffffffffffff}], &(0x7f0000000200)='GPL\x00', 0xe, 0xf1, &(0x7f0000000240)=""/241, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000380)={0x1, 0x1, 0x7, 0x9}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000013000000850000008600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r2, 0x0, 0x4000004}, 0x18) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000180)=0x4000000) pwritev(r3, &(0x7f0000000040)=[{&(0x7f0000000880)='\x00!', 0x2}], 0x1, 0x73a, 0xffffffff) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000080)=0xc, 0x4) 39.872199ms ago: executing program 5 (id=338): syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f00000002c0)='./bus\x00', 0x80040c, &(0x7f0000000580)={[{@orlov}, {@norecovery}]}, 0x1, 0x5e8, &(0x7f0000001200)="$eJzs3c9vFdUeAPDv3P6gpbzXQl7ee7iQJsZAorS0gCHGBWwNafBH3Lix0oJIgYbWaNGEkuDGxLgxxsSVC/G/UCJbVrpy4caVISFqWJp4zdzOlP6Y2x+X207T+XySS2fOmeGc4fLtOXPuOXMDqKzB9I9axMGImE4i+pP5xbzOyDIHF4579OdH59NXEvX6a78nkWRp+fFJ9rMvO7knIn78IYkDHavLnZm7cXl8amryerY/PHtlenhm7sbRS1fGL05enLw6+sLoqZMnTp4aOdbSdd0sSDt7+933+z8Ze/Obr/5KRr79ZSyJ0/FyduDS62iXwRhs/Jskq7P6TrW7sJJ0ZP9Plr7FSWeJFWJT8vevKyL+F/3REY/fvP74+JVSKwdsqXoSUQcqKhH/UFF5PyC/t195H1wrpVcCbIeHZxYGAFbHf+fC2GD0NMYG9j5KYumwThIRrY3MLbcvIu7fG7t94d7Y7diicTig2PytiPh/UfwnjfgfiJ4YaMR/bVn8p/2Cc9nPNP3VFstfOVQs/mH7LMR/z5rxH03i/60l8f92i+UPPt58p3dZ/Pe2ekkAAAAAAABQWXfPRMTzRZ//1xbn/0TB/J++iDjdhvIHV+yv/vy/9qANxQAFHp6JeKlw/m8tn/070JFt/asxH6AruXBpavJYRPw7Io5E1550f2SNMo5+euDLZnmD2fy//JWWfz+bC5jV40HnnuXnTIzPjj/pdQMRD29FPFU4/zdZbP+TgvY//X0wvcEyDjx751yzvPXjH9gq9a8jDhe2/4+fWpGs/XyO4UZ/YDjvFaz29Ieffdes/Fbj3yMm4Mml7f/eteN/IFn6vJ6ZzZdxfK6z3iyv1f5/d/J645Ez3VnaB+Ozs9dHIrqTsx1p6rL00c3XGXajPB7yeEnj/8gza4//FfX/eyNifsXfnfyxfE1x7r9/9/3arD76/1CeNP4nNtX+b35j9M7A983K31j7f6LR1h/JUoz/wYIv8jDtXp5eEI6dRVnbXV8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2A1qEbEvktrQ4natNjQU0RcR/4m9talrM7PPXbj23tWJNK/x/f+1/Jt++xf2k/z7/weW7I+u2D8eEfsj4vOO3sb+0PlrUxNlXzwAAAAAAAAAAAAAAAAAAADsEH1N1v+nfusou3bAlussuwJAaQri/6cy6gFsP+0/VJf4h+oS/1Bd4h+qq8X472p3PYDtp/2H6hL/UF3iHwAAAAAAdpX9h+7+nETE/Iu9jVeqO8szvwd2t1rZFQBK4xE/UF2m/kB1uccHknXye5qetN6Za5k+/wQnAwAAAAAAAAAAAEDlHD5o/T9UlfX/UF3W/0N15ev/D5VcD2D7uccHYp2V/IXr/9c9CwAAAAAAAAAAAABop5m5G5fHp6Ymr9t4Y2dUox0b6Tu7kYPr9frNxrEtlbVnB1zpjtrIp8LvlPqs2MjX+m3srNJ+JQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACv8EwAA//8IGSKz") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x4040, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1202, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7ffff000) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x42, 0x109) pwrite64(r2, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x3c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 39.144999ms ago: executing program 2 (id=349): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="070000000400000008000000d9"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x11, 0x8, &(0x7f0000001480)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r1, 0x0, 0xfffffffffffffffc}, 0x18) r2 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r2) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, 0x0, r3, 0x0, 0x46) close(r3) 0s ago: executing program 2 (id=339): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet6(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000001100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a000000020000000110000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r3}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000380)='neigh_update\x00', r2}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000380)='neigh_update\x00', r4}, 0x10) sendto$inet6(r1, &(0x7f00000000c0)="900000001c001f4d154a817393278bff0a80a578020000000104740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.183' (ED25519) to the list of known hosts. [ 33.346110][ T30] audit: type=1400 audit(1757007578.666:62): avc: denied { mounton } for pid=3295 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.347352][ T3295] cgroup: Unknown subsys name 'net' [ 33.368952][ T30] audit: type=1400 audit(1757007578.666:63): avc: denied { mount } for pid=3295 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.396359][ T30] audit: type=1400 audit(1757007578.706:64): avc: denied { unmount } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.613176][ T3295] cgroup: Unknown subsys name 'cpuset' [ 33.619577][ T3295] cgroup: Unknown subsys name 'rlimit' [ 33.770903][ T30] audit: type=1400 audit(1757007579.096:65): avc: denied { setattr } for pid=3295 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 33.799175][ T30] audit: type=1400 audit(1757007579.096:66): avc: denied { create } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.819903][ T30] audit: type=1400 audit(1757007579.096:67): avc: denied { write } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.840350][ T30] audit: type=1400 audit(1757007579.096:68): avc: denied { read } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.849987][ T3299] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 33.860814][ T30] audit: type=1400 audit(1757007579.096:69): avc: denied { mounton } for pid=3295 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 33.894268][ T30] audit: type=1400 audit(1757007579.096:70): avc: denied { mount } for pid=3295 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 33.917807][ T30] audit: type=1400 audit(1757007579.196:71): avc: denied { relabelto } for pid=3299 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.947623][ T3295] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 36.217306][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 36.243383][ T3305] chnl_net:caif_netlink_parms(): no params data found [ 36.348906][ T3305] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.356078][ T3305] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.363289][ T3305] bridge_slave_0: entered allmulticast mode [ 36.369765][ T3305] bridge_slave_0: entered promiscuous mode [ 36.378358][ T3305] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.385542][ T3305] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.392680][ T3305] bridge_slave_1: entered allmulticast mode [ 36.399034][ T3305] bridge_slave_1: entered promiscuous mode [ 36.405634][ T3312] chnl_net:caif_netlink_parms(): no params data found [ 36.421667][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.428884][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.436269][ T3307] bridge_slave_0: entered allmulticast mode [ 36.443361][ T3307] bridge_slave_0: entered promiscuous mode [ 36.450100][ T3311] chnl_net:caif_netlink_parms(): no params data found [ 36.471073][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.478268][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.485673][ T3307] bridge_slave_1: entered allmulticast mode [ 36.492154][ T3307] bridge_slave_1: entered promiscuous mode [ 36.537600][ T3305] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.548284][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.571287][ T3305] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.581461][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.619423][ T3310] chnl_net:caif_netlink_parms(): no params data found [ 36.633915][ T3305] team0: Port device team_slave_0 added [ 36.640510][ T3307] team0: Port device team_slave_0 added [ 36.666385][ T3307] team0: Port device team_slave_1 added [ 36.672900][ T3305] team0: Port device team_slave_1 added [ 36.684092][ T3312] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.691176][ T3312] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.698410][ T3312] bridge_slave_0: entered allmulticast mode [ 36.704903][ T3312] bridge_slave_0: entered promiscuous mode [ 36.714456][ T3311] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.721630][ T3311] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.728876][ T3311] bridge_slave_0: entered allmulticast mode [ 36.735436][ T3311] bridge_slave_0: entered promiscuous mode [ 36.758388][ T3312] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.765542][ T3312] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.772733][ T3312] bridge_slave_1: entered allmulticast mode [ 36.779344][ T3312] bridge_slave_1: entered promiscuous mode [ 36.790809][ T3311] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.798035][ T3311] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.805409][ T3311] bridge_slave_1: entered allmulticast mode [ 36.811917][ T3311] bridge_slave_1: entered promiscuous mode [ 36.824217][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.831201][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.857687][ T3305] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.882078][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.889202][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.915304][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.926441][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.933454][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.959421][ T3305] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.983899][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.990986][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.016991][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.042306][ T3312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.061273][ T3311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.082953][ T3312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.094645][ T3305] hsr_slave_0: entered promiscuous mode [ 37.100853][ T3305] hsr_slave_1: entered promiscuous mode [ 37.113469][ T3311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.135942][ T3307] hsr_slave_0: entered promiscuous mode [ 37.142004][ T3307] hsr_slave_1: entered promiscuous mode [ 37.149055][ T3307] debugfs: 'hsr0' already exists in 'hsr' [ 37.154915][ T3307] Cannot create hsr debugfs directory [ 37.172229][ T3312] team0: Port device team_slave_0 added [ 37.184041][ T3311] team0: Port device team_slave_0 added [ 37.189839][ T3310] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.197083][ T3310] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.204365][ T3310] bridge_slave_0: entered allmulticast mode [ 37.210833][ T3310] bridge_slave_0: entered promiscuous mode [ 37.217614][ T3310] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.224761][ T3310] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.231989][ T3310] bridge_slave_1: entered allmulticast mode [ 37.238641][ T3310] bridge_slave_1: entered promiscuous mode [ 37.251369][ T3312] team0: Port device team_slave_1 added [ 37.257617][ T3311] team0: Port device team_slave_1 added [ 37.306631][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.313681][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.339727][ T3311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.358592][ T3310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.374594][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.381561][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.407546][ T3312] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.418672][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.425780][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.451731][ T3311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.466879][ T3310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.484803][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.491788][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.517770][ T3312] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.567778][ T3310] team0: Port device team_slave_0 added [ 37.601139][ T3310] team0: Port device team_slave_1 added [ 37.610350][ T3311] hsr_slave_0: entered promiscuous mode [ 37.616369][ T3311] hsr_slave_1: entered promiscuous mode [ 37.622156][ T3311] debugfs: 'hsr0' already exists in 'hsr' [ 37.627966][ T3311] Cannot create hsr debugfs directory [ 37.638881][ T3312] hsr_slave_0: entered promiscuous mode [ 37.645645][ T3312] hsr_slave_1: entered promiscuous mode [ 37.651576][ T3312] debugfs: 'hsr0' already exists in 'hsr' [ 37.657346][ T3312] Cannot create hsr debugfs directory [ 37.711106][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.718195][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.744173][ T3310] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.772540][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.779524][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.805472][ T3310] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.881801][ T3310] hsr_slave_0: entered promiscuous mode [ 37.887954][ T3310] hsr_slave_1: entered promiscuous mode [ 37.894145][ T3310] debugfs: 'hsr0' already exists in 'hsr' [ 37.899894][ T3310] Cannot create hsr debugfs directory [ 37.928268][ T3305] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 37.937871][ T3305] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 37.965773][ T3305] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 37.986025][ T3305] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 38.016133][ T3307] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 38.025862][ T3307] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 38.035141][ T3307] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 38.053402][ T3307] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 38.094625][ T3311] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 38.106716][ T3311] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 38.123183][ T3311] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 38.132206][ T3311] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 38.173695][ T3312] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 38.182638][ T3312] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 38.193230][ T3312] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 38.215364][ T3305] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.224655][ T3312] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 38.259173][ T3305] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.284643][ T1683] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.291886][ T1683] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.299952][ T3310] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.309117][ T3310] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.324378][ T3311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.333410][ T1683] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.340522][ T1683] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.353366][ T3310] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.369301][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.385845][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.393161][ T3310] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.413356][ T1792] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.420550][ T1792] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.435025][ T3311] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.445113][ T1792] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.452304][ T1792] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.490781][ T1683] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.497950][ T1683] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.519487][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.526596][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.552339][ T3312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.570222][ T3310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.585851][ T3312] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.602139][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.609308][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.626878][ T3311] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 38.637332][ T3311] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 38.656964][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.664168][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.680859][ T3310] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.719204][ T1683] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.726358][ T1683] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.735884][ T1683] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.743034][ T1683] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.767611][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.780114][ T3305] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.830369][ T3311] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.935350][ T3312] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.951215][ T3310] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.978243][ T3305] veth0_vlan: entered promiscuous mode [ 39.004544][ T3305] veth1_vlan: entered promiscuous mode [ 39.026897][ T3311] veth0_vlan: entered promiscuous mode [ 39.054720][ T3311] veth1_vlan: entered promiscuous mode [ 39.077238][ T3307] veth0_vlan: entered promiscuous mode [ 39.087578][ T3311] veth0_macvtap: entered promiscuous mode [ 39.104190][ T3305] veth0_macvtap: entered promiscuous mode [ 39.113831][ T3307] veth1_vlan: entered promiscuous mode [ 39.122907][ T3311] veth1_macvtap: entered promiscuous mode [ 39.147329][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.156190][ T3305] veth1_macvtap: entered promiscuous mode [ 39.171700][ T3307] veth0_macvtap: entered promiscuous mode [ 39.181638][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.194961][ T3310] veth0_vlan: entered promiscuous mode [ 39.208529][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.216066][ T41] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.228179][ T3307] veth1_macvtap: entered promiscuous mode [ 39.240628][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.249999][ T41] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.259323][ T41] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.271013][ T3310] veth1_vlan: entered promiscuous mode [ 39.280624][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 39.280641][ T30] audit: type=1400 audit(1757007584.606:81): avc: denied { mounton } for pid=3311 comm="syz-executor" path="/root/syzkaller.c0rq0m/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 39.281491][ T41] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.312575][ T30] audit: type=1400 audit(1757007584.616:82): avc: denied { mount } for pid=3311 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 39.339657][ T3312] veth0_vlan: entered promiscuous mode [ 39.341736][ T30] audit: type=1400 audit(1757007584.616:83): avc: denied { mounton } for pid=3311 comm="syz-executor" path="/root/syzkaller.c0rq0m/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 39.372386][ T30] audit: type=1400 audit(1757007584.616:84): avc: denied { mount } for pid=3311 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 39.394305][ T30] audit: type=1400 audit(1757007584.616:85): avc: denied { mounton } for pid=3311 comm="syz-executor" path="/root/syzkaller.c0rq0m/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 39.420871][ T30] audit: type=1400 audit(1757007584.616:86): avc: denied { mounton } for pid=3311 comm="syz-executor" path="/root/syzkaller.c0rq0m/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3764 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 39.448247][ T30] audit: type=1400 audit(1757007584.616:87): avc: denied { unmount } for pid=3311 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 39.476086][ T3312] veth1_vlan: entered promiscuous mode [ 39.484008][ T41] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.485421][ T30] audit: type=1400 audit(1757007584.796:88): avc: denied { mounton } for pid=3311 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 39.503965][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.515640][ T30] audit: type=1400 audit(1757007584.796:89): avc: denied { mount } for pid=3311 comm="syz-executor" name="/" dev="gadgetfs" ino=3767 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 39.530794][ T3312] veth0_macvtap: entered promiscuous mode [ 39.554945][ T3311] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 39.561224][ T3310] veth0_macvtap: entered promiscuous mode [ 39.582733][ T3310] veth1_macvtap: entered promiscuous mode [ 39.589139][ T41] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.599731][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.610850][ T30] audit: type=1400 audit(1757007584.926:90): avc: denied { read write } for pid=3311 comm="syz-executor" name="loop3" dev="devtmpfs" ino=103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 39.645286][ T41] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.654612][ T3312] veth1_macvtap: entered promiscuous mode [ 39.665523][ C1] hrtimer: interrupt took 27817 ns [ 39.670858][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.680365][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.704677][ T41] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.725021][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.732488][ T1683] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.761831][ T1792] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.773602][ T3474] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4'. [ 39.791515][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.800489][ T1792] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.824050][ T3479] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.834590][ T3479] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.844420][ T1792] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.886009][ T1792] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.901733][ T1792] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.939789][ T1792] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.948786][ T1792] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.984118][ T1792] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.013274][ T1792] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.033538][ T1792] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.050130][ T1792] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.058187][ T3484] loop1: detected capacity change from 0 to 8192 [ 40.077274][ T3492] netlink: '+}[@': attribute type 13 has an invalid length. [ 40.172876][ T3500] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 40.172876][ T3500] The task syz.0.9 (3500) triggered the difference, watch for misbehavior. [ 40.277854][ T3505] loop4: detected capacity change from 0 to 1024 [ 40.284878][ T3505] EXT4-fs: Ignoring removed nomblk_io_submit option [ 40.308181][ T3492] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 40.334250][ T3505] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.295747][ T3521] loop3: detected capacity change from 0 to 1024 [ 41.329171][ T3521] ======================================================= [ 41.329171][ T3521] WARNING: The mand mount option has been deprecated and [ 41.329171][ T3521] and is ignored by this kernel. Remove the mand [ 41.329171][ T3521] option from the mount to silence this warning. [ 41.329171][ T3521] ======================================================= [ 41.526378][ T3521] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 41.566245][ T3521] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:483: comm syz.3.16: Invalid block bitmap block 0 in block_group 0 [ 41.602417][ T3529] netlink: 12 bytes leftover after parsing attributes in process `syz.2.21'. [ 41.628033][ T3521] EXT4-fs error (device loop3): ext4_acquire_dquot:6937: comm syz.3.16: Failed to acquire dquot type 0 [ 41.674377][ T3535] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 41.694934][ T3521] EXT4-fs error (device loop3): ext4_free_blocks:6696: comm syz.3.16: Freeing blocks not in datazone - block = 0, count = 4096 [ 41.758307][ T3521] EXT4-fs error (device loop3): ext4_read_inode_bitmap:139: comm syz.3.16: Invalid inode bitmap blk 0 in block_group 0 [ 41.822589][ T3521] EXT4-fs error (device loop3) in ext4_free_inode:361: Corrupt filesystem [ 41.866404][ T3521] EXT4-fs (loop3): 1 orphan inode deleted [ 41.905185][ T3521] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 41.969209][ T1792] EXT4-fs error (device loop3): ext4_release_dquot:6973: comm kworker/u8:8: Failed to release dquot type 0 [ 41.990058][ T3521] syz.3.16 (3521) used greatest stack depth: 9312 bytes left [ 41.999441][ T3312] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.010724][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.799652][ T3593] loop0: detected capacity change from 0 to 2048 [ 42.816008][ T3593] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 43.110790][ T3310] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.147174][ T3613] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 43.161254][ T3613] netlink: 4 bytes leftover after parsing attributes in process `syz.0.45'. [ 43.172615][ T3613] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 43.185322][ T3613] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 43.459242][ T3632] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.010458][ T3638] syzkaller0: entered promiscuous mode [ 44.180341][ T3644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.190536][ T3644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.211693][ T3646] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.326324][ T3646] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.371118][ T3646] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.408023][ T3632] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.438009][ T3646] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.472140][ T3632] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.515602][ T1792] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.527941][ T12] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.539586][ T3632] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.556105][ T12] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.568885][ T12] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.608894][ T12] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.634472][ T12] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.652524][ T30] kauditd_printk_skb: 444 callbacks suppressed [ 44.652543][ T30] audit: type=1400 audit(1757007589.966:532): avc: denied { read } for pid=3655 comm="syz.1.63" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 44.689127][ T12] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.697716][ T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.727968][ T3662] ALSA: seq fatal error: cannot create timer (-22) [ 44.736380][ T3661] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.750449][ T3663] Zero length message leads to an empty skb [ 44.776665][ T30] audit: type=1400 audit(1757007590.096:533): avc: denied { tracepoint } for pid=3666 comm="syz.3.67" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 44.800529][ T3670] loop2: detected capacity change from 0 to 512 [ 44.808261][ T3670] EXT4-fs: Ignoring removed orlov option [ 44.827823][ T3670] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 44.835383][ T30] audit: type=1400 audit(1757007590.096:534): avc: denied { ioctl } for pid=3664 comm="syz.1.64" path="socket:[6363]" dev="sockfs" ino=6363 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 44.894376][ T3661] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.928725][ T3674] loop1: detected capacity change from 0 to 2048 [ 44.943545][ T3661] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.040774][ T3661] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.099706][ T30] audit: type=1400 audit(1757007590.416:535): avc: denied { getopt } for pid=3686 comm="syz.3.75" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 45.140678][ T3674] loop1: unable to read partition table [ 45.146697][ T3674] loop1: partition table beyond EOD, truncated [ 45.152965][ T3674] loop_reread_partitions: partition scan of loop1 () failed (rc=-5) [ 45.189500][ T3694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.189587][ T3694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.276466][ T2996] loop1: unable to read partition table [ 45.282481][ T2996] loop1: partition table beyond EOD, truncated [ 45.283321][ T30] audit: type=1400 audit(1757007590.616:536): avc: denied { create } for pid=3701 comm="syz.4.82" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 45.331992][ T30] audit: type=1400 audit(1757007590.636:537): avc: denied { ioctl } for pid=3701 comm="syz.4.82" path="socket:[5298]" dev="sockfs" ino=5298 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 45.452082][ T30] audit: type=1400 audit(1757007590.766:538): avc: denied { read write } for pid=3708 comm="syz.1.84" name="uhid" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 45.475441][ T30] audit: type=1400 audit(1757007590.766:539): avc: denied { open } for pid=3708 comm="syz.1.84" path="/dev/uhid" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 45.485205][ T3711] loop4: detected capacity change from 0 to 1764 [ 45.524988][ T30] audit: type=1400 audit(1757007590.846:540): avc: denied { mount } for pid=3710 comm="syz.4.85" name="/" dev="loop4" ino=1920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:iso9660_t tclass=filesystem permissive=1 [ 45.549182][ T3711] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 45.577240][ T30] audit: type=1400 audit(1757007590.896:541): avc: denied { unmount } for pid=3312 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:iso9660_t tclass=filesystem permissive=1 [ 45.774500][ T3721] Driver unsupported XDP return value 0 on prog (id 87) dev N/A, expect packet loss! [ 45.857988][ T3727] pim6reg1: entered promiscuous mode [ 45.863425][ T3727] pim6reg1: entered allmulticast mode [ 45.955231][ T3731] ref_ctr increment failed for inode: 0x7c offset: 0xb ref_ctr_offset: 0x82 of mm: 0xffff888104666780 [ 45.966885][ T3731] ref_ctr increment failed for inode: 0x7c offset: 0xf ref_ctr_offset: 0x82 of mm: 0xffff888104666780 [ 45.978937][ T3730] uprobe: syz.4.95:3730 failed to unregister, leaking uprobe [ 46.043036][ T3730] uprobe: syz.4.95:3730 failed to unregister, leaking uprobe [ 46.108376][ T3732] netlink: 'syz.3.94': attribute type 6 has an invalid length. [ 46.298703][ T3737] loop1: detected capacity change from 0 to 128 [ 46.308759][ T3737] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 46.332061][ T3741] loop3: detected capacity change from 0 to 512 [ 46.336387][ T3737] ext4 filesystem being mounted at /17/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 46.346143][ T3741] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.362384][ T3741] ext4 filesystem being mounted at /23/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 46.386107][ T3741] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 46.424379][ T3737] support for cryptoloop has been removed. Use dm-crypt instead. [ 46.454467][ T3307] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 46.484672][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.501370][ T3746] syz.1.102 uses obsolete (PF_INET,SOCK_PACKET) [ 46.512050][ T3746] loop1: detected capacity change from 0 to 512 [ 46.543295][ T3746] EXT4-fs: Ignoring removed mblk_io_submit option [ 46.557441][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.562577][ T3746] EXT4-fs: Ignoring removed nomblk_io_submit option [ 46.575293][ T3746] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 46.583813][ T3746] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 46.603944][ T3746] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4183: comm syz.1.102: Allocating blocks 41-42 which overlap fs metadata [ 46.619965][ T3746] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4183: comm syz.1.102: Allocating blocks 41-42 which overlap fs metadata [ 46.644182][ T3746] EXT4-fs error (device loop1): ext4_acquire_dquot:6937: comm syz.1.102: Failed to acquire dquot type 1 [ 46.656891][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.659301][ T3762] netlink: 8 bytes leftover after parsing attributes in process `syz.0.104'. [ 46.669923][ T3746] EXT4-fs error (device loop1): mb_free_blocks:2017: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 46.709892][ T3746] EXT4-fs error (device loop1): ext4_do_update_inode:5653: inode #12: comm syz.1.102: corrupted inode contents [ 46.726736][ T3746] EXT4-fs error (device loop1): ext4_dirty_inode:6538: inode #12: comm syz.1.102: mark_inode_dirty error [ 46.739966][ T3746] EXT4-fs error (device loop1): ext4_do_update_inode:5653: inode #12: comm syz.1.102: corrupted inode contents [ 46.752102][ T3746] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #12: comm syz.1.102: mark_inode_dirty error [ 46.753185][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.768527][ T3746] EXT4-fs error (device loop1): ext4_do_update_inode:5653: inode #12: comm syz.1.102: corrupted inode contents [ 46.787325][ T3746] EXT4-fs error (device loop1) in ext4_orphan_del:305: Corrupt filesystem [ 46.797534][ T3746] EXT4-fs error (device loop1): ext4_do_update_inode:5653: inode #12: comm syz.1.102: corrupted inode contents [ 46.810027][ T3746] EXT4-fs error (device loop1): ext4_truncate:4666: inode #12: comm syz.1.102: mark_inode_dirty error [ 46.821391][ T3746] EXT4-fs error (device loop1) in ext4_process_orphan:347: Corrupt filesystem [ 46.823349][ T3747] chnl_net:caif_netlink_parms(): no params data found [ 46.832585][ T3746] EXT4-fs (loop1): 1 truncate cleaned up [ 46.844871][ T3746] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.883427][ T3746] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 46.907889][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.934103][ T12] bridge_slave_1: left allmulticast mode [ 46.939825][ T12] bridge_slave_1: left promiscuous mode [ 46.945766][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.980383][ T12] bridge_slave_0: left allmulticast mode [ 46.986156][ T12] bridge_slave_0: left promiscuous mode [ 46.991918][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.105062][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 47.117576][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 47.128086][ T12] bond0 (unregistering): Released all slaves [ 47.145540][ T3747] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.152681][ T3747] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.162601][ T3747] bridge_slave_0: entered allmulticast mode [ 47.177703][ T3747] bridge_slave_0: entered promiscuous mode [ 47.185006][ T3747] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.192289][ T3747] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.199780][ T3747] bridge_slave_1: entered allmulticast mode [ 47.207613][ T3747] bridge_slave_1: entered promiscuous mode [ 47.214864][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.238425][ T3794] loop1: detected capacity change from 0 to 512 [ 47.253072][ T3796] netlink: 12 bytes leftover after parsing attributes in process `syz.3.110'. [ 47.268989][ T3747] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.280929][ T12] hsr_slave_0: left promiscuous mode [ 47.287124][ T12] hsr_slave_1: left promiscuous mode [ 47.287684][ T3794] EXT4-fs error (device loop1): ext4_acquire_dquot:6937: comm syz.1.109: Failed to acquire dquot type 1 [ 47.293277][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 47.307150][ T3794] EXT4-fs (loop1): 1 truncate cleaned up [ 47.311098][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 47.317518][ T3794] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.336784][ T3794] ext4 filesystem being mounted at /22/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 47.337125][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 47.354780][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 47.368363][ T12] veth1_macvtap: left promiscuous mode [ 47.373977][ T12] veth0_macvtap: left promiscuous mode [ 47.379569][ T12] veth1_vlan: left promiscuous mode [ 47.385883][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.386293][ T12] veth0_vlan: left promiscuous mode [ 47.417641][ T3800] netlink: 'syz.1.111': attribute type 1 has an invalid length. [ 47.477067][ T12] team0 (unregistering): Port device team_slave_1 removed [ 47.481402][ T3801] netlink: 8 bytes leftover after parsing attributes in process `syz.1.111'. [ 47.496626][ T12] team0 (unregistering): Port device team_slave_0 removed [ 47.536005][ T3747] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.549972][ T3801] vlan2: entered promiscuous mode [ 47.555148][ T3801] vlan1: entered promiscuous mode [ 47.564520][ T3800] dummy0: entered promiscuous mode [ 47.624557][ T3747] team0: Port device team_slave_0 added [ 47.633632][ T3747] team0: Port device team_slave_1 added [ 47.701279][ T3747] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.708359][ T3747] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 47.734538][ T3747] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.767918][ T3747] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.775144][ T3747] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 47.801271][ T3747] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.853532][ T3747] hsr_slave_0: entered promiscuous mode [ 47.859632][ T3747] hsr_slave_1: entered promiscuous mode [ 47.870024][ T3747] debugfs: 'hsr0' already exists in 'hsr' [ 47.875887][ T3747] Cannot create hsr debugfs directory [ 47.940442][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 47.947958][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 47.955551][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 47.992495][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 48.000046][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 48.007604][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 48.015279][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 48.022731][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 48.030148][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 48.037697][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 48.115663][ T23] hid-generic 0000:0000:0000.0001: hidraw0: HID v8.00 Device [syz0] on syz0 [ 48.156399][ T3747] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 48.175251][ T3747] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 48.194532][ T3747] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 48.211105][ T3747] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 48.357807][ T3747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.381167][ T3747] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.407207][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.414377][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.444604][ T3874] loop0: detected capacity change from 0 to 512 [ 48.449257][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.458033][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.500353][ T3874] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 48.532872][ T41] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.555527][ T36] IPVS: starting estimator thread 0... [ 48.581353][ T41] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.617087][ T3874] ext4 filesystem being mounted at /26/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 48.627992][ T41] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.642494][ T3880] IPVS: using max 2112 ests per chain, 105600 per kthread [ 48.673565][ T41] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.695630][ T3890] loop3: detected capacity change from 0 to 1024 [ 48.723407][ T3310] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.747551][ T3890] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 48.754789][ T3747] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 48.801060][ T3900] loop0: detected capacity change from 0 to 128 [ 49.119369][ T3747] veth0_vlan: entered promiscuous mode [ 49.146798][ T3747] veth1_vlan: entered promiscuous mode [ 49.165925][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.172436][ T3747] veth0_macvtap: entered promiscuous mode [ 49.195992][ T3747] veth1_macvtap: entered promiscuous mode [ 49.211819][ T3747] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.234756][ T3747] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.251800][ T1792] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.270269][ T1792] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.297549][ T1792] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.313970][ T1792] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.398960][ T3947] loop2: detected capacity change from 0 to 128 [ 49.430561][ T3947] syz.2.138: attempt to access beyond end of device [ 49.430561][ T3947] loop2: rw=2049, sector=138, nr_sectors = 2 limit=128 [ 49.475143][ T3946] syz.2.138: attempt to access beyond end of device [ 49.475143][ T3946] loop2: rw=2049, sector=138, nr_sectors = 2 limit=128 [ 49.806887][ T3964] netlink: 24 bytes leftover after parsing attributes in process `syz.5.145'. [ 49.827274][ T3964] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=3964 comm=syz.5.145 [ 49.837478][ T3967] netlink: 'syz.0.143': attribute type 13 has an invalid length. [ 49.847751][ T30] kauditd_printk_skb: 92 callbacks suppressed [ 49.847767][ T30] audit: type=1400 audit(1757007595.156:628): avc: denied { ioctl } for pid=3965 comm="syz.2.146" path="/21/file0" dev="tmpfs" ino=130 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 49.957859][ T30] audit: type=1400 audit(1757007595.276:629): avc: denied { write } for pid=3971 comm="syz.3.149" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 50.106519][ T3967] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.113903][ T3967] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.141600][ T30] audit: type=1326 audit(1757007595.456:630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3981 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd30250ebe9 code=0x7ffc0000 [ 50.165805][ T30] audit: type=1326 audit(1757007595.456:631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3981 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fd30250ebe9 code=0x7ffc0000 [ 50.189327][ T30] audit: type=1326 audit(1757007595.456:632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3981 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd30250ebe9 code=0x7ffc0000 [ 50.212886][ T30] audit: type=1326 audit(1757007595.456:633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3981 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd30250ebe9 code=0x7ffc0000 [ 50.236331][ T30] audit: type=1326 audit(1757007595.456:634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3981 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fd30250ebe9 code=0x7ffc0000 [ 50.259884][ T30] audit: type=1326 audit(1757007595.456:635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3981 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd30250ebe9 code=0x7ffc0000 [ 50.283266][ T30] audit: type=1326 audit(1757007595.456:636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3981 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fd30250ebe9 code=0x7ffc0000 [ 50.307637][ T30] audit: type=1326 audit(1757007595.566:637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3981 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd30250ebe9 code=0x7ffc0000 [ 50.367575][ T3967] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 50.448079][ T3990] loop2: detected capacity change from 0 to 512 [ 50.456240][ T3990] EXT4-fs: Ignoring removed mblk_io_submit option [ 50.466549][ T3990] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 50.479732][ T3990] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 50.496186][ T3990] EXT4-fs (loop2): 1 truncate cleaned up [ 50.502947][ T3990] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 50.590847][ T3985] tipc: Enabling of bearer rejected, failed to enable media [ 50.607483][ T29] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.616565][ T29] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.637858][ T29] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.673261][ T29] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.691437][ T3997] loop0: detected capacity change from 0 to 128 [ 50.710890][ T3997] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 50.723762][ T3997] ext4 filesystem being mounted at /30/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 50.742655][ T3998] netlink: 8 bytes leftover after parsing attributes in process `syz.3.158'. [ 50.809343][ T3310] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 51.120632][ T3386] IPVS: starting estimator thread 0... [ 51.120715][ T4018] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 51.212336][ T4020] IPVS: using max 2400 ests per chain, 120000 per kthread [ 51.420253][ T4027] capability: warning: `syz.1.167' uses deprecated v2 capabilities in a way that may be insecure [ 51.545762][ T4032] bridge_slave_0: left allmulticast mode [ 51.551598][ T4032] bridge_slave_0: left promiscuous mode [ 51.557416][ T4032] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.592973][ T4035] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 51.618602][ T4032] bridge_slave_1: left allmulticast mode [ 51.624362][ T4032] bridge_slave_1: left promiscuous mode [ 51.630072][ T4032] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.650431][ T4032] bond0: (slave bond_slave_0): Releasing backup interface [ 51.664090][ T4032] bond0: (slave bond_slave_1): Releasing backup interface [ 51.679014][ T4032] team0: Port device team_slave_0 removed [ 51.688923][ T4032] team0: Port device team_slave_1 removed [ 51.698421][ T4032] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 51.705930][ T4032] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 51.716947][ T4032] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 51.724668][ T4032] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 51.963643][ T4048] pim6reg1: entered promiscuous mode [ 51.968995][ T4048] pim6reg1: entered allmulticast mode [ 52.058093][ T4051] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.106257][ T4051] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.166077][ T4051] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.225745][ T4059] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 52.276159][ T4051] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 52.342495][ T1683] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.370399][ T1683] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.393168][ T1683] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.411423][ T1683] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.671655][ T4077] syz.3.183 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 52.673009][ T4076] loop5: detected capacity change from 0 to 256 [ 52.697557][ T4076] netlink: 52 bytes leftover after parsing attributes in process `syz.5.184'. [ 52.769985][ T4079] netlink: 4 bytes leftover after parsing attributes in process `syz.5.185'. [ 52.795078][ T4079] hsr_slave_1 (unregistering): left promiscuous mode [ 53.220688][ T3305] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.233033][ T4097] loop1: detected capacity change from 0 to 164 [ 53.261330][ T4097] rock: directory entry would overflow storage [ 53.267580][ T4097] rock: sig=0x66, size=4, remaining=3 [ 53.615869][ T4115] netlink: 12 bytes leftover after parsing attributes in process `syz.1.198'. [ 53.883116][ T4125] SELinux: failed to load policy [ 54.210193][ T4151] netlink: 'syz.3.210': attribute type 1 has an invalid length. [ 54.226170][ T4153] C: renamed from team_slave_0 (while UP) [ 54.258350][ T4153] netlink: 'syz.2.211': attribute type 1 has an invalid length. [ 54.266109][ T4153] netlink: 152 bytes leftover after parsing attributes in process `syz.2.211'. [ 54.275122][ T4153] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 54.325508][ T4158] netlink: 4 bytes leftover after parsing attributes in process `syz.3.210'. [ 54.370757][ T4151] 8021q: adding VLAN 0 to HW filter on device bond1 [ 54.445684][ T4158] bond1 (unregistering): Released all slaves [ 54.523976][ T4163] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.214'. [ 54.594636][ T4165] netlink: 'syz.0.215': attribute type 10 has an invalid length. [ 54.608340][ T4165] netlink: 40 bytes leftover after parsing attributes in process `syz.0.215'. [ 54.633782][ T4167] netlink: 8 bytes leftover after parsing attributes in process `syz.3.216'. [ 54.665583][ T4165] dummy0: entered promiscuous mode [ 54.690842][ T4170] netlink: 12 bytes leftover after parsing attributes in process `syz.2.217'. [ 54.715416][ T4165] bridge0: port 3(dummy0) entered blocking state [ 54.724033][ T4165] bridge0: port 3(dummy0) entered disabled state [ 54.736055][ T4165] dummy0: entered allmulticast mode [ 54.787619][ T4172] netlink: 4 bytes leftover after parsing attributes in process `syz.3.216'. [ 54.923985][ T30] kauditd_printk_skb: 415 callbacks suppressed [ 54.924067][ T30] audit: type=1400 audit(1757007600.246:1053): avc: denied { bind } for pid=4178 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 55.041349][ T30] audit: type=1400 audit(1757007600.276:1054): avc: denied { connect } for pid=4178 comm="syz.0.219" lport=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 55.061940][ T30] audit: type=1400 audit(1757007600.276:1055): avc: denied { setopt } for pid=4178 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 55.081485][ T30] audit: type=1400 audit(1757007600.276:1056): avc: denied { bind } for pid=4178 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 55.100876][ T30] audit: type=1400 audit(1757007600.276:1057): avc: denied { name_bind } for pid=4178 comm="syz.0.219" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 55.122114][ T30] audit: type=1400 audit(1757007600.276:1058): avc: denied { node_bind } for pid=4178 comm="syz.0.219" saddr=172.30.0.1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 55.144724][ T30] audit: type=1400 audit(1757007600.336:1059): avc: denied { write } for pid=4182 comm="syz.3.222" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 55.164412][ T30] audit: type=1400 audit(1757007600.336:1060): avc: denied { setopt } for pid=4182 comm="syz.3.222" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 55.276675][ T30] audit: type=1400 audit(1757007600.566:1061): avc: denied { ioctl } for pid=4191 comm="syz.3.226" path="socket:[8563]" dev="sockfs" ino=8563 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 55.333498][ T4200] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=4200 comm=syz.2.228 [ 55.372184][ T4205] loop5: detected capacity change from 0 to 512 [ 55.383292][ T30] audit: type=1326 audit(1757007600.706:1062): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4203 comm="syz.3.230" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3dc320ebe9 code=0x7ffc0000 [ 55.458096][ T4205] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 55.499194][ T4205] ext4 filesystem being mounted at /12/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 55.564006][ T3747] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.633653][ T4225] loop2: detected capacity change from 0 to 1024 [ 55.642545][ T4227] team0: Port device team_slave_0 removed [ 55.680106][ T4225] EXT4-fs: Ignoring removed orlov option [ 55.730412][ T4225] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 55.780667][ T4235] tipc: Started in network mode [ 55.785738][ T4235] tipc: Node identity 86f13ece42, cluster identity 4711 [ 55.792854][ T4235] tipc: Enabled bearer , priority 0 [ 55.904764][ T4235] syzkaller0: entered promiscuous mode [ 55.910424][ T4235] syzkaller0: entered allmulticast mode [ 55.917278][ T4235] tipc: Resetting bearer [ 55.929594][ T4245] netlink: 'syz.1.244': attribute type 7 has an invalid length. [ 55.938569][ T4234] tipc: Resetting bearer [ 55.958589][ T4234] tipc: Disabling bearer [ 56.149542][ T4257] 9pnet: p9_errstr2errno: server reported unknown error [ 56.228164][ T3305] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.724020][ T4300] @ÿ: renamed from bond_slave_0 (while UP) [ 56.749133][ T4302] loop1: detected capacity change from 0 to 512 [ 56.759062][ T4302] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 56.774367][ T4302] EXT4-fs (loop1): 1 truncate cleaned up [ 56.783710][ T4302] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.875841][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.928582][ T4318] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.994394][ T4318] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.005884][ T4324] loop1: detected capacity change from 0 to 512 [ 57.020701][ T4324] EXT4-fs: Ignoring removed orlov option [ 57.027524][ T4324] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 57.084365][ T4318] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.150169][ T4318] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.255803][ T1683] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.288684][ T1683] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.312777][ T1683] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.327895][ T1683] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.337801][ T4347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.347206][ T4347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.397406][ T4355] @ÿ: renamed from bond_slave_0 [ 57.423373][ T4358] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.514984][ T4358] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.575441][ T4358] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.624105][ T4358] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.681853][ T1683] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.702869][ T1683] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.711483][ T1683] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.720464][ T1683] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.894559][ T4385] @ÿ: renamed from bond_slave_0 (while UP) [ 57.952213][ T4388] __nla_validate_parse: 7 callbacks suppressed [ 57.958569][ T4388] netlink: 28 bytes leftover after parsing attributes in process `syz.3.305'. [ 57.967529][ T4388] netlink: 28 bytes leftover after parsing attributes in process `syz.3.305'. [ 57.978334][ T4391] loop1: detected capacity change from 0 to 2048 [ 57.998728][ T4391] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 58.011287][ T4391] ext4 filesystem being mounted at /71/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 58.035637][ T4395] loop3: detected capacity change from 0 to 512 [ 58.054408][ T4395] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 58.068469][ T4395] ext4 filesystem being mounted at /68/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 58.095357][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.140683][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.274230][ T4414] netlink: 'syz.3.310': attribute type 1 has an invalid length. [ 58.355096][ T4418] netlink: 'syz.5.313': attribute type 2 has an invalid length. [ 58.363145][ T4418] netlink: 'syz.5.313': attribute type 1 has an invalid length. [ 58.370816][ T4418] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.313'. [ 58.440182][ T4422] netlink: 24 bytes leftover after parsing attributes in process `syz.0.316'. [ 58.486670][ T4422] netlink: 8 bytes leftover after parsing attributes in process `syz.0.316'. [ 58.517487][ T4427] @ÿ: renamed from bond_slave_0 [ 58.595112][ T4431] netlink: 'syz.0.321': attribute type 1 has an invalid length. [ 58.619540][ T4434] loop3: detected capacity change from 0 to 512 [ 58.637737][ T4434] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 58.653789][ T4434] EXT4-fs (loop3): 1 truncate cleaned up [ 58.666700][ T4434] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 58.715074][ T4434] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.722385][ T4434] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.786068][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.256321][ T4478] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.268083][ T4465] mmap: syz.2.330 (4465) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 59.326501][ T4478] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.396909][ T4478] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.459976][ T4478] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.474250][ T4485] netlink: 8 bytes leftover after parsing attributes in process `syz.2.335'. [ 59.521731][ T4489] pim6reg: entered allmulticast mode [ 59.536596][ T4489] pim6reg: left allmulticast mode [ 59.550941][ T12] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.564038][ T29] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.586828][ T1683] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.603824][ T1683] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.685922][ T4494] loop5: detected capacity change from 0 to 1024 [ 59.703872][ T4494] EXT4-fs: Ignoring removed orlov option [ 59.715036][ T2996] ================================================================== [ 59.723179][ T2996] BUG: KCSAN: data-race in dentry_unlink_inode / step_into [ 59.730430][ T2996] [ 59.732869][ T2996] write to 0xffff888106e4edb0 of 8 bytes by task 3705 on cpu 0: [ 59.740516][ T2996] dentry_unlink_inode+0x65/0x260 [ 59.745573][ T2996] d_delete+0x164/0x180 [ 59.749753][ T2996] d_delete_notify+0x32/0x100 [ 59.754450][ T2996] vfs_unlink+0x30b/0x420 [ 59.758798][ T2996] do_unlinkat+0x24e/0x480 [ 59.763224][ T2996] __x64_sys_unlink+0x2e/0x40 [ 59.767942][ T2996] x64_sys_call+0x2dc0/0x2ff0 [ 59.772650][ T2996] do_syscall_64+0xd2/0x200 [ 59.777195][ T2996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.783109][ T2996] [ 59.785440][ T2996] read to 0xffff888106e4edb0 of 8 bytes by task 2996 on cpu 1: [ 59.792998][ T2996] step_into+0x122/0x820 [ 59.797274][ T2996] walk_component+0x162/0x220 [ 59.801979][ T2996] path_lookupat+0xfe/0x2a0 [ 59.806545][ T2996] filename_lookup+0x147/0x340 [ 59.811333][ T2996] do_readlinkat+0x7d/0x320 [ 59.815846][ T2996] __x64_sys_readlink+0x47/0x60 [ 59.820715][ T2996] x64_sys_call+0x28da/0x2ff0 [ 59.825407][ T2996] do_syscall_64+0xd2/0x200 [ 59.829931][ T2996] entry_SYSCALL_64_after_hwframe+0x77/0x7f SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 59.835839][ T2996] [ 59.838163][ T2996] value changed: 0xffff88811a71f1e8 -> 0x0000000000000000 [ 59.845272][ T2996] [ 59.847614][ T2996] Reported by Kernel Concurrency Sanitizer on: [ 59.853878][ T2996] CPU: 1 UID: 0 PID: 2996 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) [ 59.863170][ T2996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 59.873239][ T2996] ================================================================== [ 59.890024][ T4496] netlink: 96 bytes leftover after parsing attributes in process `syz.2.339'. [ 59.929740][ T4494] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 60.443376][ T41] dummy0: left allmulticast mode [ 60.448507][ T41] bridge0: port 3(dummy0) entered disabled state [ 60.457675][ T41] bridge_slave_1: left allmulticast mode [ 60.463479][ T41] bridge_slave_1: left promiscuous mode [ 60.469186][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.478515][ T41] bridge_slave_0: left allmulticast mode [ 60.484240][ T41] bridge_slave_0: left promiscuous mode [ 60.489947][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.510106][ T30] kauditd_printk_skb: 726 callbacks suppressed [ 60.510138][ T30] audit: type=1400 audit(1757007605.826:1789): avc: denied { read } for pid=3035 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 60.554855][ T41] bond0 (unregistering): (slave 5@ÿ): Releasing backup interface [ 60.563893][ T41] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 60.573269][ T41] bond0 (unregistering): Released all slaves [ 60.647441][ T41] hsr_slave_0: left promiscuous mode [ 60.653395][ T41] hsr_slave_1: left promiscuous mode [ 60.659035][ T41] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 60.700012][ T41] team0 (unregistering): Port device team_slave_1 removed [ 60.709670][ T41] team0 (unregistering): Port device team_slave_0 removed [ 62.145769][ T29] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.204018][ T29] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.263997][ T29] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.324332][ T29] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.412423][ T29] bridge_slave_1: left allmulticast mode [ 62.418144][ T29] bridge_slave_1: left promiscuous mode [ 62.423870][ T29] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.431743][ T29] bridge_slave_0: left allmulticast mode [ 62.437530][ T29] bridge_slave_0: left promiscuous mode [ 62.443297][ T29] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.574872][ T29] bond0 (unregistering): (slave 5@ÿ): Releasing backup interface [ 62.584233][ T29] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 62.593863][ T29] bond0 (unregistering): Released all slaves [ 62.637331][ T29] hsr_slave_0: left promiscuous mode [ 62.643312][ T29] hsr_slave_1: left promiscuous mode [ 62.649197][ T29] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 62.656662][ T29] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 62.664682][ T29] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 62.672090][ T29] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 62.683196][ T29] veth1_macvtap: left promiscuous mode [ 62.688734][ T29] veth0_macvtap: left promiscuous mode [ 62.694410][ T29] veth1_vlan: left promiscuous mode [ 62.699651][ T29] veth0_vlan: left promiscuous mode [ 62.768509][ T29] team0 (unregistering): Port device team_slave_1 removed [ 62.779507][ T29] team0 (unregistering): Port device C removed [ 63.405132][ T1683] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.463795][ T1683] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.534357][ T1683] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.574270][ T1683] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.648999][ T1683] bridge_slave_1: left allmulticast mode [ 63.654812][ T1683] bridge_slave_1: left promiscuous mode [ 63.660522][ T1683] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.672602][ T1683] bridge_slave_0: left allmulticast mode [ 63.678299][ T1683] bridge_slave_0: left promiscuous mode [ 63.684105][ T1683] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.762042][ T4494] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 63.804941][ T1683] bond0 (unregistering): (slave 5@ÿ): Releasing backup interface [ 63.814471][ T1683] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 63.824149][ T1683] bond0 (unregistering): Released all slaves [ 63.877544][ T1683] hsr_slave_0: left promiscuous mode [ 63.883335][ T1683] hsr_slave_1: left promiscuous mode [ 63.889107][ T1683] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 63.896581][ T1683] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 63.905172][ T1683] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 63.912830][ T1683] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 63.924953][ T1683] veth1_macvtap: left promiscuous mode [ 63.930538][ T1683] veth0_macvtap: left promiscuous mode [ 63.936447][ T1683] veth1_vlan: left promiscuous mode [ 63.941717][ T1683] veth0_vlan: left promiscuous mode [ 64.005514][ T1683] team0 (unregistering): Port device team_slave_1 removed [ 64.015977][ T1683] team0 (unregistering): Port device team_slave_0 removed [ 64.254772][ T1683] IPVS: stop unused estimator thread 0... [ 64.304870][ T1683] netdevsim netdevsim5 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.364107][ T1683] netdevsim netdevsim5 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.414036][ T1683] netdevsim netdevsim5 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.454106][ T1683] netdevsim netdevsim5 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.530151][ T1683] bridge_slave_1: left allmulticast mode [ 64.535971][ T1683] bridge_slave_1: left promiscuous mode [ 64.541726][ T1683] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.549853][ T1683] bridge_slave_0: left allmulticast mode [ 64.555617][ T1683] bridge_slave_0: left promiscuous mode [ 64.561236][ T1683] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.644677][ T1683] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 64.654717][ T1683] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 64.664230][ T1683] bond0 (unregistering): Released all slaves [ 64.704129][ T1683] tipc: Left network mode [ 64.711118][ T1683] hsr_slave_0: left promiscuous mode [ 64.717324][ T1683] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 64.724772][ T1683] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 64.732479][ T1683] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 64.739887][ T1683] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 64.750941][ T1683] veth1_macvtap: left promiscuous mode [ 64.756742][ T1683] veth0_macvtap: left promiscuous mode [ 64.762561][ T1683] veth1_vlan: left promiscuous mode [ 64.767851][ T1683] veth0_vlan: left promiscuous mode [ 64.830230][ T1683] team0 (unregistering): Port device team_slave_1 removed