last executing test programs: 37.488609956s ago: executing program 2 (id=19): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x5, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x2000000, &(0x7f0000000240), 0x21, 0x4a6, &(0x7f0000000a40)="$eJzs3cFPG9kZAPBvBgiEkEDaHNqqbdI0bVpFscFJUJRTemlVRZGqRj31kFBwEMLGCJs00BzI/1CpkXpq/4QeKvVQKae97233tpfsYaXsbrSrsNIevJqxIYRgYDcES/j3k55m3jzj7z2sec98gF8APetcRKxFxLGIuBcRo+3rSbvEzVbJHvfyxaPp9RePppNoNu98luTt2bXY8jWZE+3nHIqIP/4u4i/Jm3HrK6vzU5VKealdLzaqi8X6yurluerUbHm2vFAqTU5Mjl+/cq10YGM9W/3P89/O3frT///3k2fvr/36b1m3RtptW8dxkFpDH9iMk+mPiFvvIlgX9LXHc6zbHeE7SSPiexFxPr//R6MvfzUBgKOs2RyN5ujWOgBw1KV5DixJC+1cwEikaaHQyuGdieG0Uqs3Lt2vLS/MtHJlYzGQ3p+rlMfbucKxGEiy+kR+/qpe2la/EhGnI+Lvg8fzemG6Vpnp5hsfAOhhJ7at/18OttZ/AOCIG+p2BwCAQ2f9B4DeY/0HgN5j/QeA3mP9B4DeY/0HgN5j/QeAnvKH27ez0lxvf/71zIOV5fnag8sz5fp8obo8XZiuLS0WZmu12fwze6p7PV+lVlucuBrLD4uNcr1RrK+s3q3Wlhcad/PP9b5bHjiUUQEAuzl99umHSUSs3Tiel9iyl4O1Go62tNsdALqmr9sdALrGbl/Qu/yMD+ywRe9rOv6J0JOD7wtwOC7+UP4fepX8P/Qu+X/oXfL/0LuazcSe/wDQY+T4Ab//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG9vJC9JWmjvBT4SaVooRJyMiLEYSO7PVcrjEXEqIj4YHBjM6hPd7jQA8JbST5L2/l8XRy+MbG89lnw1mB8j4q//vPOPh1ONxtJEdv3zzeuNJ+3rpW70HwDYy8Y6vbGOb3j54tH0RjnM/jz/TWtz0Szueru0WvqjPz8OxUBEDH+RtOst2fuVvgOIv/Y4In6w0/iTPDcy1t75dHv8LPbJQ42fvhY/zdtax+x78f0D6Av0mqfZ/HNzp/svjXP5cef7fyifod7exvy3/sb8l27Of30d5r9z+41x9b3fd2x7HPGj/p3iJ5vxkw7xL+wz/kc//un5Tm3Nf0VcjJ3jb41VbFQXi/WV1ctz1anZ8mx5oVSanJgcv37lWqmY56iLG5nqN31649Kp3cY/3CH+0B7j/8U+x//vr+/9+We7xP/Vz3d+/c/sEj9bE3+5z/hTw//tuH13Fn+mw/j3ev0v7TP+s49XZ/b5UADgENRXVuenKpXykhMnTpxsnnR7ZgLetVc3fbd7AgAAAAAAAAAAAAAAdHIY/07U7TECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwdH0TAAD//yyP2UE=") r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001200)={{r0}, &(0x7f0000001180), &(0x7f00000011c0)='%+9llu \x00'}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='ext4_es_find_extent_range_exit\x00', r2}, 0x10) creat(0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000080)='ext4_es_find_extent_range_exit\x00', r1}, 0x19) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000540)=ANY=[], 0x118) 37.239120217s ago: executing program 2 (id=20): syz_mount_image$ext4(0x0, &(0x7f0000000440)='./file0\x00', 0x8, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='writeback_bdi_register\x00', r0}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='writeback_bdi_register\x00', r2}, 0x10) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r5 = dup(r4) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r5]) 37.048678389s ago: executing program 2 (id=22): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) socketpair$nbd(0x1, 0x1, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x7000000, &(0x7f00000023c0)=[{&(0x7f0000000b40)='?', 0x1}, {0x0, 0x1}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x20001) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r0}, &(0x7f0000000000), &(0x7f00000005c0)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000005c0)='sched_switch\x00', r2}, 0x10) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000070000000000000000000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) 36.746602s ago: executing program 2 (id=26): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x4, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) sendmsg$NFC_CMD_GET_TARGET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r3, &(0x7f0000000240)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000040)=""/2, 0x2}}, 0x120) readv(r3, &(0x7f0000000140)=[{&(0x7f0000000080)=""/155, 0x9b}, {0x0, 0x4}], 0x2) write$UHID_DESTROY(r3, &(0x7f0000000200), 0x4) 36.6147326s ago: executing program 2 (id=29): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000004000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x34, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000640)={{r0}, &(0x7f00000005c0), &(0x7f0000000600)='%pi6 \x00'}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000300)='sys_enter\x00', r1}, 0x10) mknodat$null(0xffffffffffffff9c, 0x0, 0x0, 0x103) socket$nl_route(0x10, 0x3, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x21081e, &(0x7f00000001c0), 0x1, 0x504, &(0x7f0000000ac0)="$eJzs3ctvW1kZAPDPTuw4aWaSGUYIEMyUmYGCqjqJOxONuqGsEEKVEF2C1IbEjaLYcZRHaUIX6ZoFGyQqsYIlfwDrrtizQbBjUxZIPCJQg8TC6F5fp25iN1HzcBT/ftLVPY/U3zlx7zm9x/U9AQysqxGxExHFiLgfERNZeS474nbrSH7uxe7j+b3dx/O5aDbv/jOX1idl0fFnEley1yxFxA++E/Hj3OG461vby3O1WnUty09t1Fen1re2byzV5xari9WVSmV2Znb6s5ufVk6trx/Ui1nqK8//sPPNnybNGs9KOvtxmlpdL+zHSQxHxPfOIlgfDGX9Kfa7IbyRfES8GxEfptf/RAyl7yYAcJk1mxPRnOjMAwCXXT5dA8vly9lawHjk8+Vyaw3vvRjL1xrrG9cfNDZXFlprZZNRyD9YqlWns7XCySjkkvxMmn6ZrxzI34yIdyLiFyOjab4836gt9PMfPgAwwK4cmP//M9Ka/wGAS67U7wYAAOfO/A8Ag8f8DwCDx/wPAIOnNf+P9rsZAMA5cv8PAIPn0Pz/+S5P7AQALovv37mTHM297PnXCw+3NpcbD28sVNeXy/XN+fJ8Y221vNhoLKbP7Kkf9Xq1RmN15pPYfDT58zutknv1xubKxr30ud73qoW0bOesuwUAvMY7Hzz7c3Kzv3NrND2iYy+HQl9bBpy1fL8bAPTNUL8bAPSN3b5gcJ3gHt/yAFwSR/2Hn1K3Lwg1m83m2TUJOGPXvmj9HwZVx/q/bwHBgLH+D4PL+j8MrmYzd9w9/6N4tlsRAwDnxBo/0OPz/3ez82+zDwd+tHDwJ56eZasAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgYmvv/1vO9gIfj3y+XI54KyImo5B7sFSrTkfE2xHxp5HCSJKf6XObAYCTyv8tl+3/dW3i4/FXqt6/sp8sRsRPfnX3l4/mNjbW/hhRzP1rpF2+8TQrr5x/6wGAo7Xn6fTccSP/YvfxfPs4z/b8/dsRUWrF39stxt5+/OEYTs+lKETE2L9zWb4l17F2cRI7TyLiC936n4vxdA2ktfPpwfhJ7LfONX7+lfj5tK51Tn4XnzuFtsCgeZaMP7e7XX/5uJqeu1//pXSEOrls/Etean4vHQNfxm+Pf0M9xr+rx43xye+/20qNHq57EvGl4Yh27L2O8acdP9cj/sfHjP+XL7//4cGy9r7zzV9HXIvu8TtjTW3UV6fWt7ZvLNXnFquL1ZVKZXZmdvqzm59WptI16qnes8E/bl1/u1dd0v+xHvFLR/T/a8fs/2/+d/+HX31N/G981C1+Pt57Tfzk9/f1Y8afG/tdqVddEn+hR/+Pev+vHzP+879uH9o2HADon/Wt7eW5Wq26JiFx8RPJX9kL0IyuiW91rSqcfqxidK/62Ueta/pAVbP5RrF6jRinseoGXAT7F31E/LffjQEAAAAAAAAAAAAAALo6j29H9buPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXF7/DwAA//89QcyD") r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) 36.369160902s ago: executing program 2 (id=33): msgget$private(0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x2, 0x0) msgrcv(0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0) msgsnd(0x0, &(0x7f0000000000)={0x3}, 0x8, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000540)='./file2\x00', 0x200801d, &(0x7f00000000c0), 0xfe, 0x4eb, &(0x7f0000000c40)="$eJzs3d9rHFsdAPDvTLL3Nm2um6si14K12EpStJuksW3woSqIPhXU+l5jsg0hm2xJNm2zFE3xDxBEVPBFn3wR/AMU6ZPPIhT0XVQU0VYffKiO7O5sTONuftD9UZLPB07mnNnZ/Z6TZc7OmTPMBHBqXYyIqYjIsiy7EhHFfH2ap9hppcZ2L54/XmykJLLszt+SSPJ17c96O1+ey992JiK+8sWIryf/H3dzu766UKmUN/LydG0teZll9asrawvL5eXy+tzc7I35m/PX52d60s6JiLj1+T9979s/+cKtX37y4e/v/mXqG60GtuxtRy+1ml5o/i/aRiNiox/BhmS02cKW60OuCwAAB2sc778/Ij4WEVeiGCPNozkAAADgJMk+Mx4vk9b8HwAAAHAypRExHklayq/3HY80LZVa1/B+MM6mlepm7RNZcfd8wUQU0nsrlfJMfu3ARBSSRnk2v8a2Xb62rzwXEe9GxHeLY81yabFaWRrqmQ8AAAA4Pc7tG///s9ga/wMAAAAnzMSwKwAAAAD0nfE/AAAAnHzG/wAAAHCifen27UbK2s+/XnqwvbVafXB1qby5WlrbWiwtVjful5ar1eXmPfvWDvu8SrV6/1OxvvVoulberE1vbtfvrlW31mt3V155BDYAAAAwQO9+9OnvkojY+fRY2l73Vr4sRGQjezceHXj1gD5Kj7PxH/tXD2DwRoZdAWBojn1I/6tf9KciwMAVhl0BYOgO6we6Xrzz697XBQAA6I/JD+/O/zdT7Jn/T4ZaM6Df8vn/xL4Op4/5fzi9zP/B6VU46AjAoABOvPQIu/rrz/9n2bEqBQAA9Nx4MyVpKR8HjEealkoR7zQfC1BI7q1UyjMR8b6I+G2x8HajPNt8Z+L0AAAAAAAAAAAAAAAAAAAAAAAAAAAcUZYlkQEAAAAnWkT65yR//tdk8fL4/vMDbyX/KjaXEfHwh3e+/2ihVtuYbaz/++762g/y9deGcQYDAAAA2K89Tm+P4wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgl148f7zYToOM+9fPRcREp/ijcaa5PBOFiDj7jyRG97wviYiRHsTfeRIR73WKnzSqFRN5LfbHTyNibMjxz/UgPpxmTxv9z2c77X9pXGwuO+9/o3l6Xd37v3S3/xvp0v+9c8QY55/9bLpr/CcR50c79z/t+EmX+JeOGP9rX63Xu72W/ThisuPvT/JKrOna2v3pze361ZW1heXycnl9bm72xvzN+evzM9P3Virl/G/HGN/5yM//c1D7z3aJP3FI+y8fsf3/fvbo+Qda2cK+lwrxoyybutT5+38vIj6UteyN3/7t+3j+O9AoT7bzO638Xhd++psLB7V/qUv7D/v+p47Y/itf/tYfjrgpADAAm9v11YVKpbwhI9O3zFgMMOhCvAlNrq8ufDPfx96Ir+DYmSF3TAAAQM/976A/n0AAAAAAAAAAAAAAAAAAAAAABu6w24BFD24ntj/mznCaCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwoP8GAAD//4dq3u8=") bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r0}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000001540)=@newtaction={0x18, 0x31, 0x829, 0x0, 0x0, {0x0, 0x0, 0x2}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) 35.321618357s ago: executing program 4 (id=44): socket$inet_tcp(0x2, 0x1, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x0, 0x0, 0x0, 0xf7, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x0, 0xc8, 0x2}, 0x0, 0x400000000000000, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x35, 0x1, 0x0, 0x0, 0x0, 0x210e, 0x14a0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf9, 0x0, @perf_config_ext={0x7ffa, 0xaea}, 0x110100, 0x32, 0x0, 0x3, 0x4002, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x1, 0xffffffffffffffff, 0x9) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000c40)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d649379071c33390e418ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fcb4e0b6eab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afcc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab2e4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea508000000a0c548552b571bed5647323c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151fcda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ecec37e83efceefd7ca2533659edc8bef9cb85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d350000000000000000e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e5a61561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a2946501559335781092cf8ce987c56cd31121624d7455f2a3666276c3c0e812b28e2f30d035cee5d0e77a3c72208ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31a0445859a5ece8fb11a4ee8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463aaf28345bde0c195bc9f022ca8ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262d0af3246eb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a0600adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cd50feeb7bfad9b7be3283b6450d264e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5631820420b75b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff201000000000000002e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa66237e0dacc107f532348cc2116473381e961f3d9c8c21578fe3245097c280abe51427b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d174b0000000000000000000000fa08ad0731ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282b6caa2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae0533496b6d58da50ee80a6b9a7438978c5465113f668eb4484350048289d07dbef325d3221a7cb35f812f257941a9781e3214c2a3dcf89d99844b762a9cf17548c54fccad2c7ae8072b82e0880815daf966bd5343c1635e123f868a7167cfcff33320253af570f4ef9c0254afdd89ac3943562b530dd88da8a94013bbaf204bebc38055adc39f07f7c22711f4d1f6dcc928d1578a093c072e0b92babc76f47ee367e745a024a2278319d9a4d1378482b74c516647652bfb6e93002494a5cd74e2a9a4734487062437da23e1efa6ef7674108aaa3ffac859c3577c2637bb3bdc69bc365b1f20dba96b8acca62f3f80045318de0facf2ed44b814e842c2a520159bb6c320cec0910c0b8bd3d547bdfba2e0bb24d117ed0388afd37affbad2f9c77c9c1314a16ffe64f5e3744a2fffd7039670f5706e589a4c3868"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x6, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) r4 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) write$binfmt_script(r4, 0x0, 0x0) sendmsg(r4, &(0x7f00000000c0)={0x0, 0x9504, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4) 35.270223658s ago: executing program 4 (id=45): r0 = gettid() prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000b28000)=0x3) fcntl$setsig(r3, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r4}], 0x2c, 0xffffffffffbffff8) dup2(r3, r4) fcntl$setown(r3, 0x8, r0) tkill(r0, 0x13) 35.194283908s ago: executing program 4 (id=46): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x4b0}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000b80)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000000000f7450000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b40)={&(0x7f0000000600)='kfree\x00', r1}, 0x10) syz_clone(0x26003500, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000340)='kfree\x00', 0xffffffffffffffff, 0x0, 0x4}, 0x18) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x2c, 0x11, 0x1, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x4}, {0x1}}, [{0x8, 0xb, 0x3ff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000004) 34.989984219s ago: executing program 4 (id=48): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x3804402, &(0x7f0000000440)={[{@user_xattr}, {@noload}, {@resuid}, {@errors_remount}, {@block_validity}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x2}}, {@stripe={'stripe', 0x3d, 0x8}}, {@noinit_itable}, {@nomblk_io_submit}, {@nodioread_nolock}, {@nogrpid}]}, 0x1, 0x54f, &(0x7f0000000680)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbZdnamc8HbnvOvTc995t7v6fn5iQkgKE1kf0oRLwcEd8kEQfbto1GvnFibb/V+1dnsyWJRuPTv5JI8nWt/ZP89/688lJE/PZVxPHCxnZryysLpXI5Xczrk/XKpcna8sqJC5XSfDqfXpyemTn19sz0e+++M7BY3zj7z/ef3P7w1NdHV7/75e6hm0mcjgP5tvY4nsC19spETOTPyVicfmTHqQE0tpMk230A9GUkz/OxyPqAgzGSZz3w//dlRDSAIZXIfxhSrXFA695+QPfBz417H6zdAG2Mf3TttZHY07w32reaPHRnlN3vjg+g/ayNX/+8dTNbYnCvQwBs6dr1iDg5Orqx/0vy/q9/J3vY59E29H/w7NzOxj9vdhr/FNbHP9Fh/LO/Q+72Y+v8L9wdQDNdZeO/9zuOf9cnrcZH8toLzTHfWHL+QjnN+rYXI+JYjO3O6pvN55xavdPotq19/JctWfutsWB+HHdHdz/8mLlSvfQkMbe7dz3ilY7j32T9/Ccdzn/2fJztsY0j6a3Xum3bOv6nq/FTxOsdz/+DGa1k8/nJyeb1MNm6Kjb6+8aR37u1v93xZ+d/3+bxjyft87W1x2/jxz3/pt229Xv970o+a5Z35euulOr1xamIXcnHG9dPP3hsq97aP4v/2NHN+79O1//eiPi8x/hvHP751f7jf7qy+Oce6/w/fuHOR1/80K393s7/W83SsXxNL/1frwf4JM8dAAAAAAAA7DSFiDgQSaG4Xi4UisW193ccjn2FcrVWP36+unRxLpqflR2PsUJrpvtg2/shpvL3w7bq04/UZyLiUER8O7K3WS/OVstz2x08AAAAAAAAAAAAAAAAAAAA7BD7u3z+P/PHyHYfHfDU+cpvGF5b5v8gvukJ2JH8/4fhJf9heMl/GF7yH4aX/IfhJf9heMl/GF7yHwAAAAAAAAAAAAAAAAAAAAAAAAAAAAbq7Jkz2dJYvX91NqvPXV5eWqhePjGX1haKlaXZ4mx18VJxvlqdL6fF2Wplq79XrlYvTU3H0pXJelqrT9aWV85VqksX6+cuVErz6bl07JlEBQAAAAAAAAAAAAAAAAAAAM+X2vLKQqlcThcVFPoqjO6Mw1AYcGG7eyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeOC/AAAA///ktDiZ") mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000040)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x1000, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mounts\x00') r2 = open(&(0x7f0000000080)='./file1\x00', 0x10b942, 0x0) mount$bind(&(0x7f0000000040)='./file0/../file0\x00', &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x1217880, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) sendfile(r2, r1, 0x0, 0x8000000d) 34.736852751s ago: executing program 4 (id=51): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xffd, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000004000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f9ffffffb703000000080000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="1801000000000000000000000000000085000000050000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008008000b703000000009c8c850000006d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x4000000}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) 34.417017152s ago: executing program 4 (id=54): prctl$PR_SET_SECUREBITS(0x1c, 0x1d) r0 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) setresuid(0x0, r1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) 34.416862592s ago: executing program 32 (id=54): prctl$PR_SET_SECUREBITS(0x1c, 0x1d) r0 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) setresuid(0x0, r1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) 21.332263429s ago: executing program 33 (id=33): msgget$private(0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x2, 0x0) msgrcv(0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0) msgsnd(0x0, &(0x7f0000000000)={0x3}, 0x8, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000540)='./file2\x00', 0x200801d, &(0x7f00000000c0), 0xfe, 0x4eb, &(0x7f0000000c40)="$eJzs3d9rHFsdAPDvTLL3Nm2um6si14K12EpStJuksW3woSqIPhXU+l5jsg0hm2xJNm2zFE3xDxBEVPBFn3wR/AMU6ZPPIhT0XVQU0VYffKiO7O5sTONuftD9UZLPB07mnNnZ/Z6TZc7OmTPMBHBqXYyIqYjIsiy7EhHFfH2ap9hppcZ2L54/XmykJLLszt+SSPJ17c96O1+ey992JiK+8sWIryf/H3dzu766UKmUN/LydG0teZll9asrawvL5eXy+tzc7I35m/PX52d60s6JiLj1+T9979s/+cKtX37y4e/v/mXqG60GtuxtRy+1ml5o/i/aRiNiox/BhmS02cKW60OuCwAAB2sc778/Ij4WEVeiGCPNozkAAADgJMk+Mx4vk9b8HwAAAHAypRExHklayq/3HY80LZVa1/B+MM6mlepm7RNZcfd8wUQU0nsrlfJMfu3ARBSSRnk2v8a2Xb62rzwXEe9GxHeLY81yabFaWRrqmQ8AAAA4Pc7tG///s9ga/wMAAAAnzMSwKwAAAAD0nfE/AAAAnHzG/wAAAHCifen27UbK2s+/XnqwvbVafXB1qby5WlrbWiwtVjful5ar1eXmPfvWDvu8SrV6/1OxvvVoulberE1vbtfvrlW31mt3V155BDYAAAAwQO9+9OnvkojY+fRY2l73Vr4sRGQjezceHXj1gD5Kj7PxH/tXD2DwRoZdAWBojn1I/6tf9KciwMAVhl0BYOgO6we6Xrzz697XBQAA6I/JD+/O/zdT7Jn/T4ZaM6Df8vn/xL4Op4/5fzi9zP/B6VU46AjAoABOvPQIu/rrz/9n2bEqBQAA9Nx4MyVpKR8HjEealkoR7zQfC1BI7q1UyjMR8b6I+G2x8HajPNt8Z+L0AAAAAAAAAAAAAAAAAAAAAAAAAAAcUZYlkQEAAAAnWkT65yR//tdk8fL4/vMDbyX/KjaXEfHwh3e+/2ihVtuYbaz/++762g/y9deGcQYDAAAA2K89Tm+P4wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgl148f7zYToOM+9fPRcREp/ijcaa5PBOFiDj7jyRG97wviYiRHsTfeRIR73WKnzSqFRN5LfbHTyNibMjxz/UgPpxmTxv9z2c77X9pXGwuO+9/o3l6Xd37v3S3/xvp0v+9c8QY55/9bLpr/CcR50c79z/t+EmX+JeOGP9rX63Xu72W/ThisuPvT/JKrOna2v3pze361ZW1heXycnl9bm72xvzN+evzM9P3Virl/G/HGN/5yM//c1D7z3aJP3FI+y8fsf3/fvbo+Qda2cK+lwrxoyybutT5+38vIj6UteyN3/7t+3j+O9AoT7bzO638Xhd++psLB7V/qUv7D/v+p47Y/itf/tYfjrgpADAAm9v11YVKpbwhI9O3zFgMMOhCvAlNrq8ufDPfx96Ir+DYmSF3TAAAQM/976A/n0AAAAAAAAAAAAAAAAAAAAAABu6w24BFD24ntj/mznCaCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwoP8GAAD//4dq3u8=") bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r0}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000001540)=@newtaction={0x18, 0x31, 0x829, 0x0, 0x0, {0x0, 0x0, 0x2}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) 20.850135672s ago: executing program 5 (id=214): r0 = socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0xb, 0x5, 0x400, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r1, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="b400000010000904000000000000000000002200", @ANYRES32=0x0, @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200367da1650e000000280003800c00010001800000002000000c000100a1000000c84200000c0001000800000008000000340004800c00010006000000ff0300000c00010004000000080000000c00010004000000020000000c000100050000000300000008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRESOCT], 0xb4}}, 0x0) 20.704283033s ago: executing program 5 (id=218): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x3c) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r2, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20088814}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x7400, &(0x7f00000001c0)={&(0x7f0000000200)=@delchain={0x24, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}}, 0x24}}, 0x0) 20.136153426s ago: executing program 5 (id=225): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000500)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000001c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000300)=@gcm_128={{0x304}, '\x00', "1ec2d524d78682576ec2d9e13dad1018", "993161e3", "be0692db0b429ee8"}, 0x28) write$binfmt_script(r0, &(0x7f0000001300), 0x8f) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f0000000240)=0x40) writev(r0, &(0x7f00000030c0)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000180)=0x40) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0x1}], 0x1) close(r0) 20.108326986s ago: executing program 5 (id=227): syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000005c0)={[{@dots}, {@dots}, {@dots}, {@dots}, {@fat=@nfs}, {@fat=@gid}, {@dots}, {@nodots}, {@fat=@umask={'umask', 0x3d, 0x8b3}}, {@fat=@check_strict}, {@fat=@allow_utime={'allow_utime', 0x3d, 0x1}}, {@dots}, {@dots}, {@fat=@umask={'umask', 0x3d, 0x7fff}}, {@nodots}, {@dots}, {@fat=@tz_utc}, {@nodots}, {@dots}, {@fat=@showexec}, {@nodots}, {@nodots}]}, 0xfd, 0x1bf, &(0x7f0000000300)="$eJzs3TGL02AYB/Cn9bzmnG4TRCHg4nSon+BEThADgtJBJ4XT5SqCt0SX9mP4Af0A0qmLRGrSxkaHWmxS6++39En/edvnHZp26ZNXN99dnL+/fPvl+udIkl70T+M0Zr04jn4sTAIA2CezooivRanrXgCAdqzx/f+t5ZYAgC17/uLlkwdZdvYsTZOI6SQf5sPyscwfPc7O7qY/HNerpnk+vLLM76XN3w7z/Gpcq/L75fp0NT+MO7fLfJ49fJo18kGcb3frAAAAAAAAAAAAAAAAAAAAAADQmVuRLvx2vs/JSTM/qvLy6Kf5QI35PQdx46A6rMcDFeM2NgUAAAAAAAAAAAAAAAAAAAD/mMuPny5ej0ZvPtTFICJWn/mTole98IbL2y76sRNtKP5qke5GG6MNPwWHEbGtxmZFUax1cn2NGHR1cQIAAAAAAAAAAAAAAAAAgP9M/affX7Oki4YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAP1/f83KMYRscbJyzc76nSrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7LHvAQAA///DgjXa") open(&(0x7f00000000c0)='./bus\x00', 0x64842, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file0\x00', 0x300, 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000340)='./bus\x00', 0x0, 0x1000, 0x0) r0 = open(&(0x7f00000005c0)='./bus\x00', 0x0, 0x0) syz_mount_image$iso9660(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x204018, &(0x7f0000000140)=ANY=[@ANYBLOB="6f76657272696465726f636b7065726d2c6e6f636f6d70726573732c686964652c73657373696f6e3d3078303030303030303030303030303032312c756e686964652c696f636861727365743d63703433372c6f76657272696465726f636b7065726d2c626c6f636b3d3078303030303030303030303030303430302c005fb50aab29cf1d32d24be5ab2a6506aa524c8f1cd5781842ee1c86bee627767fee958f25bb6db8e631262ed8a59d337d730b6698271aeb8c31c1902a7e236e5dd878e6c1352c0c799d8e80d7346f8d2870acebe617c694bbb925d3ab4fb01784c564c03d88c81d2f84f58e8c6ba18548f09fa6"], 0x1, 0x55c, &(0x7f0000000b00)="$eJzs3V1v08gawPHHpT1EOTrV0eEIoarAUM6RilSCk0CqiJv1OpN0ILEj20HtFapoiipSWFFW2vaG5YbdlXbv9gtwux9ivxHaj7Ar20nbtHmBvtBu9f9FMFN77HkmtfzITTwWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgllux7bwldeO1ltVwbiXwG3s/drc+tEDu9BWx8uLAfkWs+J9kMnItXXTtv3urr8b/zcls+tOsZOIiIzv/vPrvh1cmJ3rbjwj4i9ja3nmx2um0X591IKfo+uXh62raM6FvGk5NKxP6qlwq2feWqqGqmroOV8JIN5QbaCfyAzXv3lH5crmodG7Fb3m1ilPXvYWLdwu2XVKPck3tBKHv3XuUC90lU68br5a0iVfHbRbjA/GxiVSknYZS6xuddnHcAOJG+U9pVFBKXek7qg8o2IVCPl8o5EsPyg8WbXvy0AL7ADnU4uwPWpytkz6FA0c20c3/UhcjnrRkWdTAlysVCcSXxpD1Xb38//97emS/+/N/L8tf21s9I0n+vyEiX4ncGJb/h8Qy5vWvXi9H2rrvtSXbsiMvZFU60pG2vD6Bff6dXjXR4omRUHwx0hAnWaK6S5SUpSQlseWpLElVQlFSFSN10RLKioQSiU6OKFcC0eJIJL4EomReXLkjSvJSlrIURYmWnKyILy3xpCYVcZK9rMtG8r4XRVnDYtxtlB86jGzviGhLYcRoyf84vhM8ewPH82cv/wMAAAAAgAvLSv76Hl//T8n1pFY1dW2fdVgAAAAAAOAEJZ/8z8bFVFy7LhbX/wAAAAAAXDRWco+dJSJZuZnW1sVKbpfijwAAAAAAAFwQyef/N+IimQPlpli706Vw/Q8AAAAAwAXx49g59sPmZev3PyQIpqx3zeX/WZvJ3LzO5qV0u0sH9xhVZ6zp7k6SopQWk5OunrUyaaPdSTA/dov1cXFYewE4uwF8/zkBXJmUn+VW2ubWWlqu9dakvWSrpq5zrl9/mBfHmZ6I9HL07cuN7yQZ/k9eY9rKyEannXv2qrOWxPIu3su7ze4EiofmURwRy5tkvoXknouBI55KbsTo9pu1ZH2j07b3j38i3Xyiv8e30yP6fC9zaau57oy32f7xZ+I+87lho+9GkT/myN/L7bTN7fnbaTEgisK4KAr7oxj8Xhw/iuK4KIrHjAIAzsr6mCxkyaG8e4Sz3NGyu3xmdn8v82mb+ZnkxDo5M+CMbo87o9vHzG6/HXoG0rAcG/f7y4Gs+iHe4MPQfsN6wYrfwktvNr+Rq1vbO3c3Nleft5+3XxYKxZJ937YfFGQqGUa3IPcAAAZIn7EjI56xM7aFdX/MVfV/dr9SkJNn8ko6siYLyd0GyTcOBu41u+9rCAtjrlqzSZpMn/CyMOKq7h/JXQ69/RZGtu2PoXj6vwgAAL6guTF5+FPy/8KY6+7+XD766ji772ltAADgdOjgo5WNfrCCwDSf5svlvBMtaRX47mMVmEpNK+NFOnCXHK+mVTPwI9/163HlianoUIWtZtMPIlX1A9X0Q7OcTB+ouo9+D3XD8SLjhs26dkKtXN+LHDdSFRO6qtn6um7CJR0kG4dN7ZqqcZ3I+J4K/Vbg6pxSodb7GpqK9iJTNXHVU83ANJwgo5749VZDq4oO3cA0Iz/dYa8v41X9oJHsNnfWbzYAAOfE1vbOi9VOp/36FCtnPUYAANCPLA0AAAAAAAAAAAAAAAAAAAAAwPn3Je7/o3LMysQ5/zX1poI+L/F8euXyr5PnIYzzWBl76nh76icnAKfqrwAAAP//HHhNeA==") ioctl$FS_IOC_SETFLAGS(r0, 0x4c02, &(0x7f0000000140)) r1 = timerfd_create(0x7, 0x0) timerfd_settime(r1, 0x0, &(0x7f0000000040)={{0x77359400}, {0x0, 0x3938700}}, 0x0) r2 = open$dir(&(0x7f0000000240)='.\x00', 0x0, 0x0) renameat(r2, &(0x7f0000000400)='./file0\x00', r2, &(0x7f0000000440)='./file1\x00') 19.809062817s ago: executing program 5 (id=230): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd82, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='qdisc_destroy\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='qdisc_destroy\x00', r2}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) close(r3) 19.456979439s ago: executing program 5 (id=233): r0 = socket(0x11, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r3}, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @dev}, 0x14) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r0, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000004c0)=ANY=[@ANYBLOB="02011400012918000e3580009f0001140000002f0600ac141414e0000003808a8972bd0b72e41082b1a3d20680d7fdfe4b88942a31f48597e36e03b9d6579b1c599db6e466049c2d4c830345305135e65d3a895c50f80200f6c0aba61f6304000000ff"], 0xdd12}], 0x1}, 0x20048004) 19.456801859s ago: executing program 34 (id=233): r0 = socket(0x11, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r3}, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @dev}, 0x14) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r0, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000004c0)=ANY=[@ANYBLOB="02011400012918000e3580009f0001140000002f0600ac141414e0000003808a8972bd0b72e41082b1a3d20680d7fdfe4b88942a31f48597e36e03b9d6579b1c599db6e466049c2d4c830345305135e65d3a895c50f80200f6c0aba61f6304000000ff"], 0xdd12}], 0x1}, 0x20048004) 12.051714097s ago: executing program 3 (id=332): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = memfd_secret(0x0) fcntl$setlease(r1, 0x400, 0x0) fsetxattr$security_ima(r1, &(0x7f0000001300), 0x0, 0x0, 0x3) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0, 0x0, 0x4}, 0x18) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x1}]}) socket(0x1, 0x1, 0x0) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r3, 0x29, 0xc8, 0x0, 0xc000000) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000000)={0x1, 0x1, 0x0, 0x0, 0x4}, 0xc) close_range(r2, 0xffffffffffffffff, 0x0) 11.171374662s ago: executing program 3 (id=346): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x35, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x2, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000002800000028000000020000000100000000000001e5ff0000400000000000000001000084060004000000000001"], 0x0, 0x42, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) accept4$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000140)=0x6e, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x6, 0x4, &(0x7f0000002180)=ANY=[@ANYBLOB="180200000000000000000000b7050000850000001700000095"], &(0x7f0000000040)='syzkaller\x00', 0x5, 0xc0, &(0x7f00000020c0)=""/192, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'veth0\x00', 0x0}) r4 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r1, r3, 0x25, 0x2, @val=@tcx={@void, @value}}, 0x40) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x6, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="180200000000000000000000000000001800000008000000000000006e14000095"], &(0x7f0000000040)='syzkaller\x00', 0x5, 0xc0, &(0x7f00000020c0)=""/192, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000140)={r4, r5}, 0x5) 11.096225092s ago: executing program 3 (id=348): sendmsg$IEEE802154_LLSEC_ADD_DEV(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x50}, 0x4, 0x700000000000000}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x58}}, 0x0) r0 = syz_io_uring_setup(0x2e94, &(0x7f0000000180)={0x0, 0x100, 0x13090, 0x4, 0x1c4}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x30, 0x0, 0x0, 0x4}]}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff00000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/17], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r4}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r0, 0x497c, 0xe13b, 0x0, 0x0, 0x0) 11.003587803s ago: executing program 3 (id=350): mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) creat(&(0x7f00000000c0)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000650000000800000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000a40)="2e9b3d0007e03dd65193dfb6c575963f86dd", 0x12}], 0x1) 10.617865965s ago: executing program 3 (id=353): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x21081e, &(0x7f00000001c0)={[{@grpquota}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x800}}, {@minixdf}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x107042, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x187842, 0x0) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) fallocate(r3, 0x32, 0x10001, 0x1) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000240)={0x3920e, r1, 0x3, 0x1, 0x5}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) preadv2(r0, &(0x7f0000000440)=[{&(0x7f0000000080)=""/65, 0x41}, {&(0x7f0000000280)=""/208, 0xd0}, {&(0x7f00000003c0)=""/94, 0x5e}, {&(0x7f0000000140)=""/61, 0x3d}], 0x4, 0xffffffff, 0x7, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x8a00a8, &(0x7f0000000380)=ANY=[@ANYBLOB='defcontext']) 10.476150496s ago: executing program 3 (id=356): r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = semget$private(0x0, 0x6, 0x583) semop(r1, &(0x7f00000001c0)=[{0x0, 0x8000}], 0x1) semop(0x0, &(0x7f0000000240)=[{0x0, 0x8001}], 0x1) semop(0x0, &(0x7f0000000040)=[{0x0, 0xffff}, {0x0, 0x19}], 0x2) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)=[0x40]) 3.839943999s ago: executing program 1 (id=456): perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x66, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000680)=@mangle={'mangle\x00', 0x64, 0x6, 0x600, 0x0, 0x0, 0x1d0, 0x0, 0x1d0, 0x530, 0x530, 0x530, 0x530, 0x530, 0x6, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @multicast2}, [], [], 'vcan0\x00', 'veth1_virt_wifi\x00'}, 0x0, 0xa8, 0xe8, 0x0, {0x7a00000000000000}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x9}}}, {{@ipv6={@mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'syzkaller1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@private0}}}, {{@ipv6={@rand_addr=' \x01\x00', @mcast2, [], [], 'veth1_to_batadv\x00', 'vlan1\x00'}, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@inet=@ecn={{0x28}}, @common=@ipv6header={{0x28}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty}}}, {{@ipv6={@private0, @mcast2, [], [], 'veth1_to_team\x00', 'veth0_macvtap\x00'}, 0x0, 0xf0, 0x130, 0x0, {}, [@common=@hbh={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@remote}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4=@local}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x660) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f00000001c0)=@urb_type_iso={0x4, {0x1, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0x2, 0x0, 0x0, 0x0) 3.301375522s ago: executing program 6 (id=467): socket$inet6(0xa, 0x3, 0x8000000003c) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') r1 = memfd_create(&(0x7f00000002c0)='D\xa3\xd5Wj\x00\x00\x8b\x14\xc2\xac\x1a\x1a\vG\xa9~vB\xbc\t\x00\x00\x00VoA\xaa\xbc\xee[\xe1\xa2\xe0\xff\x04\x00\x9b\x12\x0eW\xcf\t\xb0\xa9 +H/\xfd\xa4\xcaN\x84\xadS\x8bqE\x99\x01t\xb1\x1f|\x99PL\x92\x8f\xc2y\xcd\x8cj\x03X\x05\x17mwI\xf0\x01\xe5z\xcdJ)\xc7\xfa)\xaa}\xef\xde\xf5\xcd\xb1o5\x18\xd6\v\x85q\x98\x9bB\xb9\xea\xe7\xff\x7f\x00\x00T\xc0\xd2\t?\bpBl\xf4\x86\xd4\xc9\xe3\x8f\xd9\x9f\x15\x1e\xf2\x18\r\xad\b\xe0\x96NH\x85\r+\xfc\xb3\xdd\xddhg(\x03\xa7\x92\xe5\x00+h\xb7@#K\x9cMY\xd3\x9b\b-G\xb1\xdaS\x81\xb2\x93\xb83\x8a\x94*\x8d\\\b\xff/\xf8A\xaf\\\xaa\xf5u\xde\xfa\xa1\xc0\xf9&gR\x81.\xff\x83k\xe6\rDa\x16\xbd\x1a\xb2w\b\x00'/244, 0x0) write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) fchdir(r0) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000040)='.\x00', 0x40000277) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) r3 = socket(0x1e, 0x1, 0x0) connect$tipc(r3, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r3, &(0x7f0000000080), 0x2000011a) 3.070332444s ago: executing program 6 (id=472): open(&(0x7f00000001c0)='./file0\x00', 0x2a4c0, 0x918d8ecf0d5d0600) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff018004000800395032303030"], 0x15) r4 = dup(r3) write$P9_RLERRORu(r4, &(0x7f0000000540)=ANY=[@ANYBLOB="8b"], 0x53) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) write$binfmt_elf64(r4, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c4600073f034b0b00000000000003003e00ffffffe935"], 0x7c8) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) 2.956399694s ago: executing program 1 (id=474): openat$binfmt_register(0xffffff9c, &(0x7f0000000240), 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000300)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @remote}, 0x14) syz_open_procfs(0x0, &(0x7f0000000100)='attr\x00') r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') r3 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) bind$packet(r3, &(0x7f0000000000)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @link_local}, 0x14) preadv(r2, &(0x7f0000000000)=[{&(0x7f0000000140)=""/198, 0xc6}], 0x1, 0x1a, 0x0) 2.945058814s ago: executing program 6 (id=475): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x80, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r3}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x1c, r5, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="400401fa08"], 0x7) 2.858894625s ago: executing program 1 (id=477): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='qdisc_create\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='qdisc_create\x00', r3}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @broadcast}) 2.827427735s ago: executing program 6 (id=478): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x759, &(0x7f0000000580)={[], [], 0x2c}, 0x0, 0x4f8, &(0x7f0000000700)="$eJzs3EtvVGUfAPD/mbaUvtC3fXm9cVFG0dhopLRcFy6AaMLGxERjcFnbQpAChtYESCPFGEhcaPgEXnYmfgJXujFqXGjcStwaE2K6AV2YY87MmTrt6fTGtGPp75fM8JzbPM//nPMwz2VOA9iwytlbErE1In6OiJ7q4uwdytV/7k5PDv8xPTmcRJq+8ntS2e/O9ORwbdfacVvyhb5SROm9JHYWs+0cv3zl7NDY2OjFfEX/RClPnRs6PXp69PzgkSMH9ncdPjR4sClxZmW6s+OdC7u2n3j95kvDJ2++8e3nWXnTfHt9HFW9lfdNS86hrbCmHOXZ57LOU0sv+rrQXZdO2rP3UusKw5Jld212uToq9b8n2ipLVT3x4rstLRywqtI0TTsLa2e+y6bSeklSPSBNr6XAfSCJVpcAaI3aF/2d6aynOjlc7Aff324fi0oPKIv7bv6qbmmv9GDLvdW+Uccq5f9ARJyc+vOj7BXzjkMAADTXl8cibhyvtjtqr+qWUjxUt99/87mh3oj4X0Rsi4j/5+2XByMq+z4cEY/UHdO9hFmA8pzlYvvnx648Ud9cbZqs/fd8Prc1u/03U/LetnypuxJ/R3LqzNjovvyc9EVHZ7Y8UPzomWG1r1746cNG+Zfr2n/ZK8u/1hbMy/Fb+5wBupGhiaF7jbvm9rXKib1ajD+J9qSWitgeETtW8PnZOTvzzGe7Gm2fFX8WZyH+Dxp/ePsKCjRH+knE09XrPxVz4o98/i+pzE+ee6t//PKV587Uz08OHD40eLB/c4yN7uuv3RVF3/1w/eU8WehGLHD9a1VjVSfSsuv/n3nv/5mZy94sNTNfO778PK7futGwT7PS+39T8molXZufvTQ0MXFxIGJTMlVcP/jPsZeGumbtn8Xft2f++r8t4q+P8+N2RkR2Ez8aEY9FxO687I9HxBMRsWeB+L85/uSbjbqQi8e/urL4R5Z1/Rsljn4fMf+mtrNff1HI+P1yIf6OaHT9D1RSffmakaGJzYvFtVBJ6xP3fAIBAABgHdgdEVsjKe3NB5q2Rqm0d2/ElpkRlPGJZ09dePv8SPUZgd7oKNVGunrqxkMH8rHhbDk7arBuOdu+vzJunKZp2pUtZ/33se7Whg4b3pYG9T/za/GRFuB+s6x5tEZPtAHr0tz6f2vJRzb/BxnA2mrC72iAdUr9h41ryfV/tZ6CA1pmvvp/NeJuC4oCrLH56v9rhTVH16QswNrS/4eNa+X1348BYL3z/Q8b0pIekl9BYtuJBfZJ2lcn08aJUiz8VwB6I2pram2ahT/wl1JEc0rY1tRIu2Zd09K8+2yOZuQVpUX3aV/GH2JY20Tp31GMaqIzIha5e2dutqu1xJXVLlilEnza2v+dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7t3fAQAA///tUdPr") open(&(0x7f00000001c0)='./file0\x00', 0x2a4c0, 0x918d8ecf0d5d0600) pipe2$9p(0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_NAME(0xf, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mounts\x00') r1 = open(&(0x7f0000000080)='./file1\x00', 0x10b942, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendfile(r1, r0, 0x0, 0x8000000d) 2.693488765s ago: executing program 1 (id=480): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffea9, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) io_setup(0x2007, &(0x7f0000000200)=0x0) r3 = eventfd2(0x0, 0x0) io_submit(r2, 0x2, &(0x7f0000000480)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1, r3}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f00000001c0)="5f18ab32505b5506", 0x8}]) shutdown(r1, 0x0) 2.529439366s ago: executing program 6 (id=482): r0 = io_uring_setup(0x177f, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000580)={@in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, 0x0, 0x0, 0x42, 0x0, "bd1c790806ed6dcd18899f9ea77ca9fb5184ff0ba54b7dfe784d2f6b7dcd9474d9b295588ac0b991d5c66461eca3f1ff5543acc6c970d0ad22d692e84d692972368e64c272da633a217b45fcc8b1ff3b"}, 0xd8) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000340)=0x2, 0xa2) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000540), 0x3c) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f000000e0c0), 0x10010) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000200)=@gcm_256={{0x304}, "00e0f07600", "832b4d2434b35bca8c0b78d2afff6d70d2025c7f53123828322d5af0d5c6c3a5", '`\a-N', "298f0e6df9ae9b3d"}, 0x38) sendfile(r1, r2, &(0x7f0000000100)=0x8dff, 0x100000000010001) close_range(r0, 0xffffffffffffffff, 0x0) 2.503205407s ago: executing program 1 (id=483): socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000500)='sched_switch\x00', r1}, 0x18) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0, r1, 0x0, 0x62f0}, 0x18) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 2.189019168s ago: executing program 6 (id=488): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0x3, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000001c0)='kmem_cache_free\x00', r1}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000500)={0x2c, r4, 0x1, 0x0, 0x0, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}]}]}, 0x2c}}, 0x0) 2.178291388s ago: executing program 35 (id=488): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0x3, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000001c0)='kmem_cache_free\x00', r1}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000500)={0x2c, r4, 0x1, 0x0, 0x0, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}]}]}, 0x2c}}, 0x0) 1.92495495s ago: executing program 7 (id=493): perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r0, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000780)={&(0x7f00000007c0)='skb_copy_datagram_iovec\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000780)={&(0x7f00000007c0)='skb_copy_datagram_iovec\x00', r2}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r3, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdc8}, 0x0) 1.85556409s ago: executing program 7 (id=494): syz_mount_image$ext4(&(0x7f0000000280)='ext4\x00', &(0x7f0000000740)='./file0\x00', 0x10040, &(0x7f0000000200)={[{@journal_dev}, {@nouid32}]}, 0xfe, 0x269, &(0x7f0000000780)="$eJzs3U9oHFUcB/Df7B/jJotEvQjiHxARDYR4E7zEi0JAQhARVIiIeJJEiAnesp68eNCzSkDwEkpvTXssvYReWgo9pW0O6aXQhh4aemgPW3Znt2ySDW33b9n5fGCYmbz35r0J832zLMxsAJk1GRGzEZGPiKmIKEZE0lrh7XSZbOxulLYXI6rVL+4m9XrpfqrZbiIiKhHxUUShWba29c3e/Z3P3vtjtfju/1tflwZ1fq3293Y/P/h3/vczcx+uXb56ez6J2Sg3ylrPo5eSNn8rJBGv9KOz50RSGPYIeBoLv56+Vsv9qxHxTj3/xcg1IvvnygsXivHBPye1/evOldcHOVag96rVYu0eWKkCmZOLiHIkuemISLdzuenp9DP89fx47qfllV+mflxeXfph2DMV0CvlSHY/PTd2duJI/m/l0/wDo6scsfvlwuaN2vZBftijAfqm9dv2N9JVLf9T362/H/IPmSP/kF3yD9kl/zACOsyu/EN2dZP/F/s0JmAw3P9hhBWbG5W2xfIP2SX/MKL+a/fU6WHyD9nVmn8AIFuqY8N+AhkYlmHPPwAAAAAAAAAAAAAAAAAAwHEbpe3F5jKoPi/+HbH/SUQU2vWfr/8ecfNt4+P3klq1x5K0WVe+favLA3TpVM+evi511Oqlm73qvzOX3uzPcX87vHviP2d9KaJSqzxTKBy//pLG9de5l59QXvy+yw6e0dG3An781WD7P+rh5nD7n9uJOF+bf2bazT+5eK2+bj//lFtfsdyhnx90eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG5lEAAAD//4oibec=") mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="82", 0xfff7}], 0x1) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x34, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) io_uring_setup(0x36a6, &(0x7f0000000340)={0x0, 0x133e, 0x80, 0x1, 0x1c5}) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) r2 = syz_pidfd_open(r1, 0x0) pidfd_send_signal(r2, 0x2, 0x0, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000000140)='2', 0xfdef, 0xfecc) 1.635805801s ago: executing program 7 (id=495): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) r1 = io_uring_setup(0x678d, &(0x7f0000000340)={0x0, 0xffffffff, 0x80, 0x0, 0xf1}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x3, 0x0, "7e12ddc5a89047bf00"}) r3 = syz_open_pts(r2, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000200)=0x2) read(r3, 0x0, 0x2006) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)) dup2(r3, r2) close_range(r1, 0xffffffffffffffff, 0x0) 1.527255502s ago: executing program 0 (id=496): socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) lseek(0xffffffffffffffff, 0x1, 0x0) r0 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r0, 0x1, &(0x7f0000258f88)) msgsnd(r0, &(0x7f0000000340)={0x3}, 0x0, 0x0) msgrcv(r0, 0x0, 0x0, 0x1, 0x1000) msgrcv(r0, &(0x7f00000000c0)={0x0, ""/245}, 0xfd, 0x0, 0x0) msgctl$IPC_SET(r0, 0x1, &(0x7f0000258f88)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8}) msgctl$IPC_STAT(r0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40048d0}, 0x0) 1.301863783s ago: executing program 7 (id=497): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x759, &(0x7f0000000580)={[], [], 0x2c}, 0x0, 0x4f8, &(0x7f0000000700)="$eJzs3EtvVGUfAPD/mbaUvtC3fXm9cVFG0dhopLRcFy6AaMLGxERjcFnbQpAChtYESCPFGEhcaPgEXnYmfgJXujFqXGjcStwaE2K6AV2YY87MmTrt6fTGtGPp75fM8JzbPM//nPMwz2VOA9iwytlbErE1In6OiJ7q4uwdytV/7k5PDv8xPTmcRJq+8ntS2e/O9ORwbdfacVvyhb5SROm9JHYWs+0cv3zl7NDY2OjFfEX/RClPnRs6PXp69PzgkSMH9ncdPjR4sClxZmW6s+OdC7u2n3j95kvDJ2++8e3nWXnTfHt9HFW9lfdNS86hrbCmHOXZ57LOU0sv+rrQXZdO2rP3UusKw5Jld212uToq9b8n2ipLVT3x4rstLRywqtI0TTsLa2e+y6bSeklSPSBNr6XAfSCJVpcAaI3aF/2d6aynOjlc7Aff324fi0oPKIv7bv6qbmmv9GDLvdW+Uccq5f9ARJyc+vOj7BXzjkMAADTXl8cibhyvtjtqr+qWUjxUt99/87mh3oj4X0Rsi4j/5+2XByMq+z4cEY/UHdO9hFmA8pzlYvvnx648Ud9cbZqs/fd8Prc1u/03U/LetnypuxJ/R3LqzNjovvyc9EVHZ7Y8UPzomWG1r1746cNG+Zfr2n/ZK8u/1hbMy/Fb+5wBupGhiaF7jbvm9rXKib1ajD+J9qSWitgeETtW8PnZOTvzzGe7Gm2fFX8WZyH+Dxp/ePsKCjRH+knE09XrPxVz4o98/i+pzE+ee6t//PKV587Uz08OHD40eLB/c4yN7uuv3RVF3/1w/eU8WehGLHD9a1VjVSfSsuv/n3nv/5mZy94sNTNfO778PK7futGwT7PS+39T8molXZufvTQ0MXFxIGJTMlVcP/jPsZeGumbtn8Xft2f++r8t4q+P8+N2RkR2Ez8aEY9FxO687I9HxBMRsWeB+L85/uSbjbqQi8e/urL4R5Z1/Rsljn4fMf+mtrNff1HI+P1yIf6OaHT9D1RSffmakaGJzYvFtVBJ6xP3fAIBAABgHdgdEVsjKe3NB5q2Rqm0d2/ElpkRlPGJZ09dePv8SPUZgd7oKNVGunrqxkMH8rHhbDk7arBuOdu+vzJunKZp2pUtZ/33se7Whg4b3pYG9T/za/GRFuB+s6x5tEZPtAHr0tz6f2vJRzb/BxnA2mrC72iAdUr9h41ryfV/tZ6CA1pmvvp/NeJuC4oCrLH56v9rhTVH16QswNrS/4eNa+X1348BYL3z/Q8b0pIekl9BYtuJBfZJ2lcn08aJUiz8VwB6I2pram2ahT/wl1JEc0rY1tRIu2Zd09K8+2yOZuQVpUX3aV/GH2JY20Tp31GMaqIzIha5e2dutqu1xJXVLlilEnza2v+dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7t3fAQAA///tUdPr") open(&(0x7f00000001c0)='./file0\x00', 0x2a4c0, 0x918d8ecf0d5d0600) pipe2$9p(0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_NAME(0xf, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mounts\x00') r1 = open(&(0x7f0000000080)='./file1\x00', 0x10b942, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendfile(r1, r0, 0x0, 0x8000000d) 676.671376ms ago: executing program 0 (id=498): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffea9, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) io_setup(0x2007, &(0x7f0000000200)=0x0) r3 = eventfd2(0x0, 0x0) io_submit(r2, 0x2, &(0x7f0000000480)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1, r3}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f00000001c0)="5f18ab32505b5506", 0x8}]) shutdown(r1, 0x0) 676.396966ms ago: executing program 1 (id=499): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x20000000000000f4, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000021b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r1}, 0x10) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e0, 0x0, 0x178, 0xc, 0x140, 0x178, 0x210, 0x258, 0x258, 0x210, 0x258, 0x3, 0x0, {[{{@ipv6={@loopback={0x1f0}, @remote, [0x0, 0x0, 0x0, 0xff], [], 'syzkaller0\x00', 'netpci0\x00', {}, {}, 0x3a}, 0x0, 0x118, 0x140, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0xc34, 0xce4, 0x4, 0x8, 0x0, 0x5, 0xc0de}}, @inet=@rpfilter={{0x28}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@ipv6={@mcast1, @private1, [], [0x0, 0xffffff00], 'wg2\x00', 'hsr0\x00', {}, {}, 0x0, 0x7}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x340) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_clone(0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0) 676.189136ms ago: executing program 7 (id=500): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r0, 0x2285, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote}], 0x38) write$sndseq(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x0, 0x0}}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @connect}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"448cc880fe353ca0f2c2e953"}}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @connect}], 0xc4) write$sndseq(r1, &(0x7f0000000640)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x0, 0x0}}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @addr}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control={0x6, 0x7fff, 0x8}}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time}], 0xc4) write$sndseq(r1, &(0x7f0000002840)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @addr}], 0x54) write$sndseq(r1, &(0x7f0000000300)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @result}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @queue}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @ext={0x0, 0x0}}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @connect}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}], 0xc4) write$sndseq(r1, &(0x7f0000000a40)=[{0x0, 0x0, 0x0, 0x0, @time}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @queue}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @queue}], 0x8c) write$sndseq(r0, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @addr}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @control}], 0x54) write$sndseq(r1, &(0x7f0000000f80)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @queue}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @quote}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr}, {}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @quote}], 0xc4) write$sndseq(r1, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @queue}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @result}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time}], 0x8c) 532.393886ms ago: executing program 7 (id=501): socket(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000003c0)="a9ca35608a3081c7c92c80840ef0424c3cf4", 0x12}], 0x1}, 0x44000) sendmsg$802154_dgram(r2, &(0x7f0000000000)={&(0x7f0000000040), 0x14, &(0x7f0000000100)={0x0}, 0x7, 0x0, 0x0, 0x8004}, 0x40040) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000180)) r3 = socket$inet6(0xa, 0x1, 0x8010800000000084) sendmmsg$inet6(r3, &(0x7f0000000040)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f0000000600)=[{&(0x7f00000000c0)='/', 0x1}], 0x1}}, {{&(0x7f0000000400)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000d00)='[', 0x4d0}], 0x21}}], 0x2, 0x4008040) 532.194067ms ago: executing program 36 (id=501): socket(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000003c0)="a9ca35608a3081c7c92c80840ef0424c3cf4", 0x12}], 0x1}, 0x44000) sendmsg$802154_dgram(r2, &(0x7f0000000000)={&(0x7f0000000040), 0x14, &(0x7f0000000100)={0x0}, 0x7, 0x0, 0x0, 0x8004}, 0x40040) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000180)) r3 = socket$inet6(0xa, 0x1, 0x8010800000000084) sendmmsg$inet6(r3, &(0x7f0000000040)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f0000000600)=[{&(0x7f00000000c0)='/', 0x1}], 0x1}}, {{&(0x7f0000000400)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000d00)='[', 0x4d0}], 0x21}}], 0x2, 0x4008040) 497.802577ms ago: executing program 0 (id=502): r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback, 0xfffffffc}, 0x1c) listen(r0, 0x20000005) r1 = socket$inet6(0xa, 0x6, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r3, 0x0, 0x2}, 0x18) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x7, @empty}, 0x1c) sendmsg$inet6(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="f0", 0x1}], 0x1}, 0x4804) r4 = accept4(r0, 0x0, 0x0, 0x800) close(r4) 393.563577ms ago: executing program 0 (id=503): perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x34, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="190000000400000008000000ff"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r0}, &(0x7f0000000800), &(0x7f0000000840)=r1}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file0\x00', 0x300001a, &(0x7f0000000b00)=ANY=[], 0xe, 0x2b3, &(0x7f0000000200)="$eJzs3UFrI3UUAPA3yTQb9ZAgXhTBAT14KluvXhplBbEnJYJ60ODugiRhYRcCVjDbUz+BR7+HH8GLF7+B4FXw1iKVkcnMNAlN2lJjCvX3Oz3mP+/Nm/mH5JQ3X70+Hj58ksTRyW/RbifR2I/9OE2iG42oPY80AIC74zTP48/8JplpY/PdAADbUP7+l267FwBgOz757POPegcHDz7Osna82jme9JOIGB9P+uV673F8E6N4FPejE2cR+bky/uDDgweRZoVuvDWeTvpF5vjLX6r6vT8iZvl70Ynu6vy9rLSQP530d+LFyKL3eKdutROvrM5/Z0V+9Fvx9psL/e9GJ379Op7EKB5GkTvP/34vy97Pfzj57oviMkV+0oj+vdl5c3lzm/sCAAAAAAAAAAAAAAAAAAAAAMDdtptlSTm+Zza/pzhUzd9pns3Wd7Nad3k+T5mf1IXK+UB5VCN6pnn8WM7X+Su/n2VZXp04z0/jtdSLBQAAAAAAAAAAAAAAAAAAAKDw7NvD4WA0evR0I0E9DaD+W/8N6qQxHIz2F468EYfDQXNdweR8AME1LrE4baDodd3JUQSRprGhx3JV8ELRTxHE8yrYROV78839NMqg3piN3sXL75VFD4eDrFqqH/JwkFx1rXa9cT8tLrXi3zaWzz4SZ/nSUrTPW13Oam3oabReWrn0d57n16vz7u/lHlVHktmIjetdfaf+9K66wSJoX9yLn9cXXPuV0dzE9w4AAAAAAAAAAAAAAAAAAHDR/E+/KxaPLk1t/GdNAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCWzd//XwftiFg+ciGYVsmXnVMFrXj67JZvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+BfwIAAP//j89OGA==") ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x62042, 0x0) lsm_get_self_attr(0x69, &(0x7f0000000240)={0x0, 0x0, 0xdb, 0xbb, ""/187}, &(0x7f0000000000)=0xdb, 0x0) 145.612498ms ago: executing program 0 (id=504): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000000e00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x8) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x19f, &(0x7f0000000100)={[{@noquota}, {@noquota}, {@min_batch_time={'min_batch_time', 0x3d, 0x82f}}, {@grpquota}, {@debug}, {@debug}, {@grpid}]}, 0x80, 0x536, &(0x7f0000000680)="$eJzs3c9rJFkdAPBv9XRn50dmO6sedMF1dVdmFp3uycbdDR7WEURPC+J6H2PSE8J00iHd2Z2EgJm/QBBR0ZNevAj+AYIMePEowoCeFVYU0YweBHVKqrqSyWa6k56xtzs/Ph+oqVevqvr7Xg2vUq/qURXAmfViRNyIiIdpmr4SEdUiv1RMsd2dsu0e7GzNZ1MSafr235JIirzd30qK+aVit/MR8bWvRHwzeTxue2Pz9lyz2Vgrluud5dV6e2Pz2tLy3GJjsbEyMzP9+uwbs6/NXh9KPS9HxJtf+tP3vv3TL7/5y8+++8ebf7maVTsmi/X76/EEskNUPmyDbtUr+bHYle2w9hTBjqtyXsPChV5bpGmaPkyr+3LujqRkAAAclF3AfigiPhURr0Q1zh1+OQsAAACcQOkXJuM/SfcJTQ8TffIBAACAE6SUj4FNSrViLMBklEq1WncM70fiYqnZanc+c6u1vrJw/4eTETEVldKtpWbjejFWeCoqSbY8nacfLb96YHkmIp6LiO9WL+TLtflWc2HcNz8AAADgjLh0oP//z2q3/w8AAACcMlOPZ5XGUQ4AAADgg9Oj/w8AAACcMvr/AAAAcKp99a23sind/f71wjsb67db71xbaLRv15bX52vzrbXV2mKrtZi/s2/5qN9rtlqrn4uV9Tv1TqPdqbc3Nm8ut9ZXOjeX3vcJbAAAAGCEnvvEvd8nEbH9+Qv5lJkYd6GAkSjvpZJi3qP1/+HZ7vy9ERUKGIlzA2zz3jMjKAgwcuVxFwAYm8q4CwCMXXLE+r6Dd35TzD853PIAAADDd+Vj/Z//H/4NgG2fCIATTiOGs+vA8/+0Oq6CACOXP/8fdMCviwU4VSoDjQAETrP/+/n/kdL0iQoEAAAM3WQ+JaVacXtvMkqlWi3icv5ZgEpya6nZuB4Rz0bE76qVZ7Ll6XzP5Mg+AwAAAAAAAAAAAAAAAAAAAAAAAADQlaZJpIe5cehaAAAA4ASIKP05+VX3Xf5Xqi9PHrw/MJH8K/8k8EREvPujt79/Z67TWZvO8v++l9/5QZH/6jjuYAAAAAAH7fbTd/vxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBMD3a25h/sbKX/3tmaH2Xcv34xIqb24udTd005zufz81GJiIv/SKK8b78kIs4NIf723Yj4aK/4SVasvZC94l/44OPHVHEUesW/NIT4cJbdy84/N3q1v1K8mM97t79yxPuWn1b/81/snf/O9Wn/lweM8fz9n9f7xr8b8Xy59/lnN37SJ/5LURoo/je+vrnZb13644gr0Tv+/lj1zvJqvb2xeW1peW6xsdhYmZmZfn32jdnXZq/Xby01G8W/PWN85+O/eHhY/S/2iT91RP1fHqj2Ef+9f2fnw91kpVf8qy/1iP/rnxRbPB6/VPzt+3SRztZf2U1vd9P7vfCz375wWP0XHtW/8iT//1cHrP9QGgoAMDTtjc3bc81mY+0kJCpPs1fWSz8OhZc4folvDfUH0zRNszbVY9W9iBjkd5I4DoclT4z7zAQAAAzbo4v+cZcEAAAAAAAAAAAAAAAAAAAAzq4hvjNsot9r9g7G3N5LJd4MDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcG/8LAAD//3uY3uY=") r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x10001, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r3}, 0x10) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r4, 0x4b72, &(0x7f0000000000)={0x0, 0x0, 0x8, 0x1e, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a73090000000000001b0f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f0000000f00)='.\x00', 0x1a4a438, &(0x7f0000000100)=ANY=[@ANYRES64=0x0, @ANYRES16, @ANYRES8=0x0, @ANYRES64], 0xb, 0x0, &(0x7f0000000000)) 0s ago: executing program 0 (id=505): mkdir(&(0x7f0000000100)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r1}}) write$P9_RLERRORu(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="8b"], 0x53) syz_io_uring_setup(0x207, &(0x7f0000000340)={0x0, 0x8e00, 0x10100}, &(0x7f0000000300), &(0x7f0000000100)=0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000300)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x6000, @fd_index=0x4, 0x8000, &(0x7f0000000380)=""/208, 0xd0, 0x0, 0x1}) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f00000008c0)={0xe, 0x18, 0xfa00, @ib_path={0x0}}, 0x20) write$binfmt_elf64(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c4600073f034b0b00000800000003003c02ffffffef3501"], 0x7c8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000680)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) kernel console output (not intermixed with test programs): n_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.619880][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.626902][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.652791][ T3314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.663645][ T3312] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.670895][ T3312] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.678224][ T3312] bridge_slave_1: entered allmulticast mode [ 24.684639][ T3312] bridge_slave_1: entered promiscuous mode [ 24.695379][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.702326][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.728310][ T3313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.739458][ T3319] team0: Port device team_slave_0 added [ 24.745305][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.752245][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.778432][ T3313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.803034][ T3319] team0: Port device team_slave_1 added [ 24.825140][ T3312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 24.838710][ T3319] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.845685][ T3319] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.871679][ T3319] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.883424][ T3319] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.890400][ T3319] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.916417][ T3319] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.930814][ T3312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 24.963644][ T3314] hsr_slave_0: entered promiscuous mode [ 24.969549][ T3314] hsr_slave_1: entered promiscuous mode [ 24.976537][ T3314] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 24.984084][ T3314] Cannot create hsr debugfs directory [ 24.996811][ T3312] team0: Port device team_slave_0 added [ 25.002867][ T3312] team0: Port device team_slave_1 added [ 25.032541][ T3313] hsr_slave_0: entered promiscuous mode [ 25.038554][ T3313] hsr_slave_1: entered promiscuous mode [ 25.044436][ T3313] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 25.052313][ T3313] Cannot create hsr debugfs directory [ 25.064776][ T3319] hsr_slave_0: entered promiscuous mode [ 25.070751][ T3319] hsr_slave_1: entered promiscuous mode [ 25.076782][ T3319] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 25.084312][ T3319] Cannot create hsr debugfs directory [ 25.105780][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 25.112746][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 25.138785][ T3312] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 25.156816][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 25.163802][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 25.190035][ T3312] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 25.225939][ T3317] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 25.241479][ T3317] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 25.274954][ T3317] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 25.294459][ T3312] hsr_slave_0: entered promiscuous mode [ 25.300519][ T3312] hsr_slave_1: entered promiscuous mode [ 25.306574][ T3312] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 25.314111][ T3312] Cannot create hsr debugfs directory [ 25.319728][ T3317] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 25.398363][ T3313] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 25.407264][ T3313] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 25.417995][ T3313] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 25.439761][ T3313] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 25.472041][ T3314] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 25.487166][ T3314] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 25.497923][ T3314] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 25.511806][ T3317] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.523458][ T3314] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 25.540800][ T3319] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 25.549092][ T3319] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 25.564943][ T3319] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 25.585304][ T3319] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 25.609042][ T3317] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.618907][ T3312] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 25.631866][ T55] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.639329][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.660689][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.668090][ T3312] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 25.677929][ T55] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.684972][ T55] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.698551][ T3312] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 25.712833][ T3313] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.724121][ T3312] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 25.740305][ T3317] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 25.760480][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.767622][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.799758][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.806970][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.836402][ T3314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.862774][ T3314] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.873008][ T3312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.882169][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.889214][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.902242][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.909377][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.920991][ T3317] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 25.943910][ T3312] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.967613][ T55] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.974712][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.989202][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.996302][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.009262][ T3319] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.021937][ T3313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.059607][ T3319] 8021q: adding VLAN 0 to HW filter on device team0 [ 26.081587][ T3312] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 26.121861][ T3317] veth0_vlan: entered promiscuous mode [ 26.129417][ T1965] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.136464][ T1965] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.145672][ T1965] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.152735][ T1965] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.178781][ T3317] veth1_vlan: entered promiscuous mode [ 26.190572][ T3314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.224587][ T3312] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.244700][ T3317] veth0_macvtap: entered promiscuous mode [ 26.269507][ T3317] veth1_macvtap: entered promiscuous mode [ 26.289588][ T3319] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.307581][ T3317] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.333481][ T3317] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.381794][ T3317] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.390599][ T3317] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.399331][ T3317] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.408106][ T3317] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.419038][ T3313] veth0_vlan: entered promiscuous mode [ 26.426118][ T3314] veth0_vlan: entered promiscuous mode [ 26.438302][ T3313] veth1_vlan: entered promiscuous mode [ 26.448642][ T3314] veth1_vlan: entered promiscuous mode [ 26.484631][ T3314] veth0_macvtap: entered promiscuous mode [ 26.509634][ T3312] veth0_vlan: entered promiscuous mode [ 26.517945][ T3317] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.531639][ T3313] veth0_macvtap: entered promiscuous mode [ 26.539755][ T3319] veth0_vlan: entered promiscuous mode [ 26.547385][ T3314] veth1_macvtap: entered promiscuous mode [ 26.555776][ T3312] veth1_vlan: entered promiscuous mode [ 26.571041][ T3313] veth1_macvtap: entered promiscuous mode [ 26.583448][ T3454] syz.3.4[3454] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 26.583594][ T3454] syz.3.4[3454] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 26.584546][ T3319] veth1_vlan: entered promiscuous mode [ 26.611887][ T3454] syz.3.4[3454] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 26.614613][ T3314] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 26.636548][ T3314] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.648150][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.659012][ T3313] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 26.669599][ T3313] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.679450][ T3313] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 26.689966][ T3313] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.700866][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.717262][ T3314] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.727765][ T3314] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.738475][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.747048][ T3319] veth0_macvtap: entered promiscuous mode [ 26.753697][ T3313] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.764279][ T3313] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.774235][ T3313] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 26.784673][ T3313] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 26.805920][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.809704][ T3456] loop3: detected capacity change from 0 to 4096 [ 26.816457][ T3312] veth0_macvtap: entered promiscuous mode [ 26.832631][ T3314] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.841626][ T3314] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.850476][ T3314] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.859766][ T3314] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.869110][ T3456] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 26.874260][ T3319] veth1_macvtap: entered promiscuous mode [ 26.887516][ T29] kauditd_printk_skb: 38 callbacks suppressed [ 26.887524][ T29] audit: type=1400 audit(1732038375.462:130): avc: denied { mount } for pid=3455 comm="syz.3.6" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 26.899826][ T3456] ext4: Unknown parameter 'ÿÿs—ø‰:Y‚‚–ÍçÔ' [ 26.914941][ T29] audit: type=1400 audit(1732038375.462:131): avc: denied { write } for pid=3455 comm="syz.3.6" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.942433][ T29] audit: type=1400 audit(1732038375.462:132): avc: denied { add_name } for pid=3455 comm="syz.3.6" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.962577][ T29] audit: type=1400 audit(1732038375.462:133): avc: denied { create } for pid=3455 comm="syz.3.6" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 26.990350][ T3319] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 27.000968][ T3319] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.010928][ T3319] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 27.021424][ T3319] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.031935][ T3319] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 27.035384][ T29] audit: type=1400 audit(1732038375.462:134): avc: denied { read write open } for pid=3455 comm="syz.3.6" path="/1/file0/bus" dev="loop3" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 27.045017][ T3319] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.072430][ T29] audit: type=1400 audit(1732038375.462:135): avc: denied { map } for pid=3455 comm="syz.3.6" path="/1/file0/bus" dev="loop3" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 27.072457][ T29] audit: type=1400 audit(1732038375.462:136): avc: denied { execute } for pid=3455 comm="syz.3.6" path="/1/file0/bus" dev="loop3" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 27.086755][ T3319] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 27.106817][ T29] audit: type=1400 audit(1732038375.462:137): avc: denied { read } for pid=3455 comm="syz.3.6" name="mISDNtimer" dev="devtmpfs" ino=249 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.140993][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 27.160610][ T29] audit: type=1400 audit(1732038375.462:138): avc: denied { open } for pid=3455 comm="syz.3.6" path="/dev/mISDNtimer" dev="devtmpfs" ino=249 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.192823][ T29] audit: type=1400 audit(1732038375.462:139): avc: denied { ioctl } for pid=3455 comm="syz.3.6" path="/dev/mISDNtimer" dev="devtmpfs" ino=249 ioctlcmd=0x4940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.206794][ T3460] loop3: detected capacity change from 0 to 128 [ 27.226381][ T3312] veth1_macvtap: entered promiscuous mode [ 27.237676][ T3312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 27.248200][ T3312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.258245][ T3312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 27.270086][ T3312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.280650][ T3312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 27.292443][ T3312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.305936][ T3312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 27.320314][ T3312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.332571][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 27.342997][ T3312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 27.354859][ T3312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.365038][ T3312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 27.375486][ T3312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.385653][ T3312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 27.396255][ T3312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.407304][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 27.416833][ T3313] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.425682][ T3313] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.434404][ T3313] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.443151][ T3313] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.460490][ T3312] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.469430][ T3312] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.478183][ T3312] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.487037][ T3312] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.499460][ T3319] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 27.510040][ T3319] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.520111][ T3319] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 27.530657][ T3319] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.540781][ T3319] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 27.551436][ T3319] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.561436][ T3319] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 27.571992][ T3319] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 27.583093][ T3319] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 27.602097][ T3319] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.610919][ T3319] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.619740][ T3319] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.628503][ T3319] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.738600][ T3476] loop2: detected capacity change from 0 to 512 [ 27.767636][ T3476] EXT4-fs (loop2): mounted filesystem 00800000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 27.792291][ T3485] loop0: detected capacity change from 0 to 1024 [ 27.806542][ T3476] EXT4-fs warning (device loop2): ext4_enable_quotas:7156: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 27.817330][ T3485] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 27.821817][ T3484] wireguard0: entered promiscuous mode [ 27.839295][ T3484] wireguard0: entered allmulticast mode [ 27.853685][ T3485] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2863: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 27.878664][ T3314] EXT4-fs (loop2): unmounting filesystem 00800000-0000-0000-0000-000000000000. [ 27.927201][ T3478] loop4: detected capacity change from 0 to 512 [ 27.948654][ T3312] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 27.981374][ T3478] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 28.028732][ T3499] syz.0.14[3499] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 28.028801][ T3499] syz.0.14[3499] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 28.068624][ T3478] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 28.080179][ T3499] syz.0.14[3499] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 28.119661][ T3493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13'. [ 28.150992][ T3504] loop2: detected capacity change from 0 to 1024 [ 28.160514][ T3504] EXT4-fs: Ignoring removed mblk_io_submit option [ 28.168331][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 28.195582][ T3504] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 28.319907][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 28.347172][ T3511] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14'. [ 28.356077][ T3511] netlink: 'syz.0.14': attribute type 15 has an invalid length. [ 28.364076][ T3511] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14'. [ 28.375730][ T3511] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 28.384881][ T3511] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 28.393676][ T3511] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 28.402724][ T3511] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 28.412340][ T3511] vxlan0: entered promiscuous mode [ 28.443942][ T3517] process 'syz.4.17' launched './file1' with NULL argv: empty string added [ 28.589055][ T3520] loop2: detected capacity change from 0 to 512 [ 28.627682][ T3520] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 28.656266][ T3520] ext4 filesystem being mounted at /5/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 28.718708][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 28.864658][ T3511] syz.0.14 (3511) used greatest stack depth: 10848 bytes left [ 28.973366][ C0] hrtimer: interrupt took 26685 ns [ 28.992138][ T3528] loop0: detected capacity change from 0 to 1024 [ 29.024399][ T3528] EXT4-fs: Ignoring removed nomblk_io_submit option [ 29.084709][ T3528] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 29.152156][ T3312] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 29.192046][ T3534] loop0: detected capacity change from 0 to 512 [ 29.239492][ T3389] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 29.250617][ T3534] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 29.263720][ T3534] ext4 filesystem being mounted at /3/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 29.276658][ T3389] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz0] on syz1 [ 29.306831][ T3542] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 29.366885][ T3312] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 29.401437][ T3548] loop2: detected capacity change from 0 to 512 [ 29.431158][ T3550] loop0: detected capacity change from 0 to 512 [ 29.448191][ T3548] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 29.475341][ T3548] ext4 filesystem being mounted at /9/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 29.493816][ T3550] EXT4-fs error (device loop0): ext4_xattr_block_get:596: inode #2: comm syz.0.30: corrupted xattr block 255: invalid header [ 29.538300][ T3550] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -117 [ 29.566921][ T3550] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 29.608616][ T3314] EXT4-fs error (device loop2): ext4_readdir:261: inode #12: block 32: comm syz-executor: path /9/file0/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 29.643758][ T3550] EXT4-fs error (device loop0): ext4_xattr_block_get:596: inode #2: comm syz.0.30: corrupted xattr block 255: invalid header [ 29.645348][ T3561] pim6reg1: entered promiscuous mode [ 29.658735][ T3550] SELinux: (dev loop0, type ext4) getxattr errno 117 [ 29.662447][ T3561] pim6reg1: entered allmulticast mode [ 29.669912][ T3550] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 29.711361][ T3550] ÿÿÿÿÿÿ: renamed from vlan1 (while UP) [ 29.759578][ T3563] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 29.847694][ T3546] loop3: detected capacity change from 0 to 65536 [ 29.854764][ T3546] ======================================================= [ 29.854764][ T3546] WARNING: The mand mount option has been deprecated and [ 29.854764][ T3546] and is ignored by this kernel. Remove the mand [ 29.854764][ T3546] option from the mount to silence this warning. [ 29.854764][ T3546] ======================================================= [ 29.945854][ T3566] loop4: detected capacity change from 0 to 512 [ 29.977588][ T3566] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e842c11c, mo2=0002] [ 29.996655][ T3566] System zones: 0-2, 18-18, 34-34 [ 30.012342][ T3566] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.36: bg 0: block 248: padding at end of block bitmap is not set [ 30.035677][ T3566] EXT4-fs error (device loop4): ext4_acquire_dquot:6938: comm syz.4.36: Failed to acquire dquot type 1 [ 30.048203][ T3566] EXT4-fs (loop4): 1 truncate cleaned up [ 30.048979][ T3546] loop3: detected capacity change from 0 to 1024 [ 30.054275][ T3566] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 30.073561][ T3566] ext4 filesystem being mounted at /2/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 30.090093][ T3546] EXT4-fs: Ignoring removed nobh option [ 30.095792][ T3546] EXT4-fs: Ignoring removed orlov option [ 30.120962][ T3566] syz.4.36 (3566) used greatest stack depth: 9304 bytes left [ 30.130972][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 30.150618][ T3546] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 30.211921][ T3572] dccp_close: ABORT with 1 bytes unread [ 30.252011][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 30.322663][ T3576] hub 1-0:1.0: USB hub found [ 30.337598][ T3576] hub 1-0:1.0: 8 ports detected [ 30.806875][ T3594] netlink: 12 bytes leftover after parsing attributes in process `syz.4.46'. [ 30.815839][ T3594] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 30.823216][ T3594] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 30.846791][ T3594] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 30.854329][ T3594] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 31.005831][ T3597] pim6reg1: entered promiscuous mode [ 31.011220][ T3597] pim6reg1: entered allmulticast mode [ 31.030443][ T3599] loop4: detected capacity change from 0 to 1024 [ 31.069030][ T3599] EXT4-fs: Ignoring removed nomblk_io_submit option [ 31.081213][ T3599] EXT4-fs (loop4): stripe (8) is not aligned with cluster size (16), stripe is disabled [ 31.178066][ T3599] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 31.399076][ T3608] tipc: Started in network mode [ 31.404014][ T3608] tipc: Node identity ac14140f, cluster identity 4711 [ 31.413113][ T3608] tipc: New replicast peer: 255.255.255.255 [ 31.419257][ T3608] tipc: Enabled bearer , priority 10 [ 31.464509][ T3313] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.875286][ T3614] chnl_net:caif_netlink_parms(): no params data found [ 32.086974][ T3614] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.094055][ T3614] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.102689][ T3614] bridge_slave_0: entered allmulticast mode [ 32.109720][ T3614] bridge_slave_0: entered promiscuous mode [ 32.118158][ T3614] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.125274][ T3614] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.132616][ T3614] bridge_slave_1: entered allmulticast mode [ 32.139269][ T3614] bridge_slave_1: entered promiscuous mode [ 32.157177][ T3614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.167832][ T3614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.201690][ T3614] team0: Port device team_slave_0 added [ 32.210043][ T3614] team0: Port device team_slave_1 added [ 32.225877][ T3614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 32.232841][ T3614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.258908][ T3614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.271870][ T3614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 32.278922][ T3614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.305120][ T3614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 32.368168][ T29] kauditd_printk_skb: 194 callbacks suppressed [ 32.368183][ T29] audit: type=1400 audit(1732038380.942:331): avc: denied { ioctl } for pid=3629 comm="syz.1.55" path="socket:[4092]" dev="sockfs" ino=4092 ioctlcmd=0x8955 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 32.437716][ T3378] tipc: Node number set to 2886997007 [ 32.459013][ T3614] hsr_slave_0: entered promiscuous mode [ 32.472743][ T3614] hsr_slave_1: entered promiscuous mode [ 32.478902][ T3614] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 32.487669][ T3614] Cannot create hsr debugfs directory [ 32.550088][ T3636] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 32.571882][ T3614] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 32.581962][ T3614] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 32.591706][ T3614] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 32.601923][ T3614] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 32.647729][ T3614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.668512][ T3614] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.682383][ T3336] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.689506][ T3336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.724376][ T3336] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.731749][ T3336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.824487][ T3614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.950557][ T3614] veth0_vlan: entered promiscuous mode [ 32.958908][ T3614] veth1_vlan: entered promiscuous mode [ 32.976118][ T3614] veth0_macvtap: entered promiscuous mode [ 32.983851][ T3614] veth1_macvtap: entered promiscuous mode [ 32.996886][ T3614] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.007858][ T3614] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.017798][ T3614] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.028357][ T3614] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.038219][ T3614] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.048733][ T3614] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.058625][ T3614] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.069300][ T3614] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.086323][ T3614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.102339][ T3614] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.113163][ T3614] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.123226][ T3614] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.133748][ T3614] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.143935][ T3614] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.154409][ T3614] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.164394][ T3614] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.175096][ T3614] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.188789][ T3614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.199016][ T3614] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.207885][ T3614] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.216649][ T3614] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.225470][ T3614] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.828685][ T1965] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.842010][ T29] audit: type=1400 audit(1732038382.412:332): avc: denied { create } for pid=3655 comm="syz.5.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 33.864570][ T29] audit: type=1400 audit(1732038382.432:333): avc: denied { connect } for pid=3655 comm="syz.5.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 33.910664][ T1965] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.995137][ T1965] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.055551][ T3661] loop3: detected capacity change from 0 to 512 [ 34.062291][ T29] audit: type=1400 audit(1732038382.622:334): avc: denied { create } for pid=3662 comm="syz.5.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.095719][ T1965] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.110815][ T3666] pim6reg1: entered promiscuous mode [ 34.116156][ T3666] pim6reg1: entered allmulticast mode [ 34.126822][ T3665] vlan2: entered promiscuous mode [ 34.131901][ T3665] bridge0: entered promiscuous mode [ 34.137316][ T3665] vlan2: entered allmulticast mode [ 34.142488][ T3665] bridge0: entered allmulticast mode [ 34.149414][ T3665] bridge0: port 3(vlan2) entered blocking state [ 34.155802][ T3665] bridge0: port 3(vlan2) entered disabled state [ 34.183148][ T29] audit: type=1400 audit(1732038382.752:335): avc: denied { ioctl } for pid=3667 comm="syz.0.59" path="socket:[4732]" dev="sockfs" ino=4732 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.210950][ T3665] bridge0: left allmulticast mode [ 34.215452][ T29] audit: type=1400 audit(1732038382.792:336): avc: denied { read } for pid=3667 comm="syz.0.59" name="usbmon7" dev="devtmpfs" ino=163 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 34.216025][ T3665] bridge0: left promiscuous mode [ 34.245243][ T29] audit: type=1400 audit(1732038382.812:337): avc: denied { open } for pid=3667 comm="syz.0.59" path="/dev/usbmon7" dev="devtmpfs" ino=163 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 34.249274][ T3661] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 34.268878][ T29] audit: type=1400 audit(1732038382.812:338): avc: denied { ioctl } for pid=3667 comm="syz.0.59" path="/dev/usbmon7" dev="devtmpfs" ino=163 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 34.307030][ T3661] ext4 filesystem being mounted at /12/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 34.342080][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.411708][ T29] audit: type=1326 audit(1732038382.982:339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3677 comm="syz.0.65" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 34.441739][ T29] audit: type=1326 audit(1732038383.012:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3677 comm="syz.0.65" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 34.492420][ T3680] 9pnet: p9_errstr2errno: server reported unknown error 184467440737 [ 34.525081][ T3682] loop1: detected capacity change from 0 to 512 [ 34.555878][ T3682] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 34.619939][ T3682] ext4 filesystem being mounted at /14/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 34.626684][ T3689] pim6reg1: entered promiscuous mode [ 34.635656][ T3689] pim6reg1: entered allmulticast mode [ 34.686382][ T1965] bridge_slave_1: left allmulticast mode [ 34.692098][ T1965] bridge_slave_1: left promiscuous mode [ 34.697888][ T1965] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.736596][ T1965] bridge_slave_0: left allmulticast mode [ 34.742298][ T1965] bridge_slave_0: left promiscuous mode [ 34.748081][ T1965] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.789631][ T3319] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.991331][ T1965] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 35.018863][ T3725] loop1: detected capacity change from 0 to 1024 [ 35.027162][ T1965] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 35.029016][ T1965] bond0 (unregistering): Released all slaves [ 35.140998][ T1965] hsr_slave_0: left promiscuous mode [ 35.147167][ T1965] hsr_slave_1: left promiscuous mode [ 35.154758][ T1965] veth1_macvtap: left promiscuous mode [ 35.160298][ T1965] veth0_macvtap: left promiscuous mode [ 35.166124][ T1965] veth1_vlan: left promiscuous mode [ 35.171391][ T1965] veth0_vlan: left promiscuous mode [ 35.216701][ T3725] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.379514][ T3319] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.428379][ T1965] team0 (unregistering): Port device team_slave_1 removed [ 35.482554][ T1965] team0 (unregistering): Port device team_slave_0 removed [ 35.611961][ T3739] syzkaller0: entered promiscuous mode [ 35.617675][ T3739] syzkaller0: entered allmulticast mode [ 35.975894][ T3764] loop3: detected capacity change from 0 to 512 [ 35.987798][ T3767] loop0: detected capacity change from 0 to 512 [ 36.047850][ T3764] EXT4-fs: Ignoring removed orlov option [ 36.097972][ T3767] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 36.105344][ T3764] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 36.114792][ T3767] ext4 filesystem being mounted at /13/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 36.123661][ T3764] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 36.180861][ T3764] EXT4-fs (loop3): 1 orphan inode deleted [ 36.186688][ T3764] EXT4-fs (loop3): 1 truncate cleaned up [ 36.204173][ T3764] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 36.228850][ T3312] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.279661][ T3764] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 36.371669][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.542673][ T3818] @ÿ: renamed from vlan0 (while UP) [ 36.863977][ T3861] loop3: detected capacity change from 0 to 2048 [ 36.887102][ T3861] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.018672][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.093549][ T3899] loop5: detected capacity change from 0 to 512 [ 37.152267][ T3899] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm syz.5.98: bg 0: block 393: padding at end of block bitmap is not set [ 37.192976][ T3899] EXT4-fs error (device loop5) in ext4_mb_clear_bb:6550: Corrupt filesystem [ 37.221195][ T3916] loop3: detected capacity change from 0 to 256 [ 37.269368][ T3899] EXT4-fs (loop5): 2 truncates cleaned up [ 37.276491][ T3899] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.583099][ T29] kauditd_printk_skb: 88 callbacks suppressed [ 37.583143][ T29] audit: type=1326 audit(1732038386.152:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3915 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fef0b9dd3ea code=0x7ffc0000 [ 37.618954][ T3614] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.689570][ T29] audit: type=1326 audit(1732038386.212:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3915 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fef0b9dd3ea code=0x7ffc0000 [ 37.713066][ T29] audit: type=1326 audit(1732038386.212:431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3915 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7fef0b9dcff7 code=0x7ffc0000 [ 37.736673][ T29] audit: type=1326 audit(1732038386.212:432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3915 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7fef0b9dfefa code=0x7ffc0000 [ 37.759942][ T29] audit: type=1326 audit(1732038386.212:433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3915 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fef0b9dd0f0 code=0x7ffc0000 [ 37.783337][ T29] audit: type=1326 audit(1732038386.212:434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3915 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7fef0b9dd4d7 code=0x7ffc0000 [ 37.807131][ T29] audit: type=1326 audit(1732038386.212:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3915 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fef0b9dd0f0 code=0x7ffc0000 [ 37.830694][ T29] audit: type=1326 audit(1732038386.212:436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3915 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef0b9de759 code=0x7ffc0000 [ 37.854168][ T29] audit: type=1326 audit(1732038386.212:437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3915 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef0b9de759 code=0x7ffc0000 [ 37.877476][ T29] audit: type=1326 audit(1732038386.212:438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3915 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fef0b9de759 code=0x7ffc0000 [ 38.378810][ T3987] IPv4: Oversized IP packet from 127.202.26.0 [ 38.387851][ T3985] pim6reg1: entered promiscuous mode [ 38.393196][ T3985] pim6reg1: entered allmulticast mode [ 38.437568][ T4024] syzkaller0: entered promiscuous mode [ 38.443136][ T4024] syzkaller0: entered allmulticast mode [ 38.468572][ T4026] Zero length message leads to an empty skb [ 38.477889][ T4006] hub 9-0:1.0: USB hub found [ 38.483441][ T4006] hub 9-0:1.0: 8 ports detected [ 38.560947][ T4034] syzkaller0: entered promiscuous mode [ 38.566503][ T4034] syzkaller0: entered allmulticast mode [ 38.589631][ T4040] loop1: detected capacity change from 0 to 512 [ 38.611538][ T4040] EXT4-fs error (device loop1): ext4_xattr_ibody_find:2240: inode #15: comm syz.1.117: corrupted in-inode xattr: invalid ea_ino [ 38.688574][ T4046] netlink: 16 bytes leftover after parsing attributes in process `syz.5.119'. [ 38.740863][ T4040] EXT4-fs error (device loop1): ext4_orphan_get:1394: comm syz.1.117: couldn't read orphan inode 15 (err -117) [ 38.787977][ T4040] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.872839][ T3319] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.983226][ T4064] loop5: detected capacity change from 0 to 164 [ 39.628967][ T4095] IPv6: Can't replace route, no match found [ 39.974150][ T4122] loop0: detected capacity change from 0 to 512 [ 39.983982][ T4122] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 40.007420][ T4122] EXT4-fs (loop0): 1 truncate cleaned up [ 40.016960][ T4122] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 40.075633][ T4127] capability: warning: `syz.1.149' uses 32-bit capabilities (legacy support in use) [ 40.096752][ T4125] syz.3.148 uses obsolete (PF_INET,SOCK_PACKET) [ 40.186839][ T4130] netlink: 4 bytes leftover after parsing attributes in process `syz.1.150'. [ 40.301688][ T4135] loop1: detected capacity change from 0 to 1024 [ 40.325074][ T4135] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 40.357719][ T4135] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 40.378245][ T4135] EXT4-fs (loop1): orphan cleanup on readonly fs [ 40.385946][ T4135] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5837: Corrupt filesystem [ 40.396507][ T4135] EXT4-fs (loop1): Remounting filesystem read-only [ 40.408642][ T4135] EXT4-fs (loop1): 1 orphan inode deleted [ 40.513539][ T4135] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 40.525583][ T4135] SELinux: (dev loop1, type ext4) getxattr errno 5 [ 40.532368][ T4135] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.568993][ T4135] loop1: detected capacity change from 0 to 1764 [ 40.690612][ T4157] loop5: detected capacity change from 0 to 512 [ 40.806191][ T4157] EXT4-fs error (device loop5): ext4_xattr_block_get:596: inode #2: comm syz.5.156: corrupted xattr block 255: invalid header [ 40.823083][ T3312] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.833388][ T4157] EXT4-fs (loop5): Cannot turn on journaled quota: type 1: error -117 [ 40.870156][ T4166] syz.0.159[4166] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 40.870324][ T4166] syz.0.159[4166] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 40.896828][ T4157] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.915354][ T4166] syz.0.159[4166] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 40.928651][ T4157] EXT4-fs error (device loop5): ext4_xattr_block_get:596: inode #2: comm syz.5.156: corrupted xattr block 255: invalid header [ 40.966353][ T4157] SELinux: (dev loop5, type ext4) getxattr errno 117 [ 40.976144][ T4166] pim6reg1: entered promiscuous mode [ 40.981092][ T4157] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.981475][ T4166] pim6reg1: entered allmulticast mode [ 41.140383][ T4173] loop0: detected capacity change from 0 to 512 [ 41.154806][ T4173] EXT4-fs: Ignoring removed nobh option [ 41.160649][ T4173] EXT4-fs: Ignoring removed mblk_io_submit option [ 41.184155][ T4173] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 41.270517][ T3312] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.331496][ T4180] netlink: 4 bytes leftover after parsing attributes in process `syz.3.162'. [ 41.346880][ T4180] bridge_slave_1: left allmulticast mode [ 41.352597][ T4180] bridge_slave_1: left promiscuous mode [ 41.358319][ T4180] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.386460][ T4180] bridge_slave_0: left allmulticast mode [ 41.392135][ T4180] bridge_slave_0: left promiscuous mode [ 41.398018][ T4180] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.879422][ T4211] usb usb1: usbfs: process 4211 (syz.1.176) did not claim interface 0 before use [ 42.182817][ T4234] netlink: 'syz.0.186': attribute type 10 has an invalid length. [ 42.223740][ T4234] team0: Port device geneve0 added [ 42.287892][ T4240] netlink: 4 bytes leftover after parsing attributes in process `syz.3.189'. [ 42.312816][ T4240] team0 (unregistering): Port device team_slave_0 removed [ 42.328410][ T4240] team0 (unregistering): Port device team_slave_1 removed [ 42.353493][ T4245] pim6reg1: entered promiscuous mode [ 42.358953][ T4245] pim6reg1: entered allmulticast mode [ 42.472167][ T4251] loop3: detected capacity change from 0 to 512 [ 42.481131][ T4251] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 42.508026][ T4251] EXT4-fs (loop3): 1 truncate cleaned up [ 42.514148][ T4251] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.548880][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.643962][ T4255] netlink: 12 bytes leftover after parsing attributes in process `syz.5.196'. [ 42.652951][ T4255] netlink: 'syz.5.196': attribute type 7 has an invalid length. [ 42.945567][ T4258] netlink: 1276 bytes leftover after parsing attributes in process `syz.1.197'. [ 43.424234][ T4254] syz.5.196 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 43.435273][ T4254] CPU: 0 UID: 0 PID: 4254 Comm: syz.5.196 Not tainted 6.12.0-syzkaller-00971-g158f238aa69d #0 [ 43.445509][ T4254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 43.455948][ T4254] Call Trace: [ 43.459298][ T4254] [ 43.462218][ T4254] dump_stack_lvl+0xf2/0x150 [ 43.466950][ T4254] dump_stack+0x15/0x20 [ 43.471096][ T4254] dump_header+0x83/0x2d0 [ 43.475539][ T4254] oom_kill_process+0x341/0x4c0 [ 43.480399][ T4254] out_of_memory+0x9af/0xbe0 [ 43.485151][ T4254] mem_cgroup_out_of_memory+0x13e/0x190 [ 43.491189][ T4254] try_charge_memcg+0x51b/0x810 [ 43.496068][ T4254] charge_memcg+0x50/0xc0 [ 43.500538][ T4254] mem_cgroup_swapin_charge_folio+0xd0/0x150 [ 43.506536][ T4254] __read_swap_cache_async+0x236/0x480 [ 43.512058][ T4254] swap_cluster_readahead+0x279/0x3f0 [ 43.517439][ T4254] swapin_readahead+0xe4/0x6f0 [ 43.522248][ T4254] ? swap_cache_get_folio+0x77/0x210 [ 43.527656][ T4254] do_swap_page+0x31e/0x2550 [ 43.532243][ T4254] ? hrtimer_start_range_ns+0x53d/0x580 [ 43.537791][ T4254] ? hrtimer_try_to_cancel+0x106/0x1d0 [ 43.543309][ T4254] ? __rcu_read_lock+0x36/0x50 [ 43.548079][ T4254] ? __pfx_default_wake_function+0x10/0x10 [ 43.553958][ T4254] handle_mm_fault+0x8c5/0x2aa0 [ 43.558847][ T4254] exc_page_fault+0x3b9/0x650 [ 43.563528][ T4254] asm_exc_page_fault+0x26/0x30 [ 43.568505][ T4254] RIP: 0033:0x7f6ada7c1afc [ 43.572997][ T4254] Code: 72 64 0f 1f 40 00 69 3d b6 3b e1 00 e8 03 00 00 48 8d 1d 97 44 2e 00 e8 c2 cb 12 00 eb 0c 48 81 c3 d8 00 00 00 48 39 dd 74 24 <80> 7b 20 00 74 ee 8b 43 0c 85 c0 74 e7 48 89 df 48 81 c3 d8 00 00 [ 43.592726][ T4254] RSP: 002b:00007fffc627dc60 EFLAGS: 00010202 [ 43.598864][ T4254] RAX: 0000000000000000 RBX: 00007f6adaaa5f80 RCX: 0000000000000000 [ 43.606998][ T4254] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000555591f78808 [ 43.614986][ T4254] RBP: 00007f6adaaa7a80 R08: 0000000000000000 R09: 7fffffffffffffff [ 43.623019][ T4254] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000a9c2 [ 43.631146][ T4254] R13: 00007fffc627dd60 R14: 0000000000000032 R15: ffffffffffffffff [ 43.639201][ T4254] [ 43.642464][ T4254] memory: usage 307200kB, limit 307200kB, failcnt 80 [ 43.649243][ T4254] memory+swap: usage 307460kB, limit 9007199254740988kB, failcnt 0 [ 43.657163][ T4254] kmem: usage 307132kB, limit 9007199254740988kB, failcnt 0 [ 43.664558][ T4254] Memory cgroup stats for /syz5: [ 43.708207][ T4254] cache 0 [ 43.716254][ T4254] rss 16384 [ 43.719400][ T4254] shmem 0 [ 43.722331][ T4254] mapped_file 0 [ 43.725948][ T4254] dirty 0 [ 43.728909][ T4254] writeback 0 [ 43.732236][ T4254] workingset_refault_anon 40 [ 43.736834][ T4254] workingset_refault_file 0 [ 43.741504][ T4254] swap 266240 [ 43.744793][ T4254] swapcached 69632 [ 43.748531][ T4254] pgpgin 9688 [ 43.751821][ T4254] pgpgout 9671 [ 43.755247][ T4254] pgfault 7780 [ 43.758613][ T4254] pgmajfault 10 [ 43.762115][ T4254] inactive_anon 0 [ 43.765773][ T4254] active_anon 69632 [ 43.769737][ T4254] inactive_file 0 [ 43.773447][ T4254] active_file 0 [ 43.777022][ T4254] unevictable 0 [ 43.780476][ T4254] hierarchical_memory_limit 314572800 [ 43.786130][ T4254] hierarchical_memsw_limit 9223372036854771712 [ 43.792268][ T4254] total_cache 0 [ 43.795832][ T4254] total_rss 16384 [ 43.799458][ T4254] total_shmem 0 [ 43.803009][ T4254] total_mapped_file 0 [ 43.807037][ T4254] total_dirty 0 [ 43.810491][ T4254] total_writeback 0 [ 43.814297][ T4254] total_workingset_refault_anon 40 [ 43.819616][ T4254] total_workingset_refault_file 0 [ 43.824637][ T4254] total_swap 266240 [ 43.828500][ T4254] total_swapcached 69632 [ 43.832784][ T4254] total_pgpgin 9688 [ 43.836601][ T4254] total_pgpgout 9671 [ 43.840538][ T4254] total_pgfault 7780 [ 43.844474][ T4254] total_pgmajfault 10 [ 43.848472][ T4254] total_inactive_anon 0 [ 43.852680][ T4254] total_active_anon 69632 [ 43.857013][ T4254] total_inactive_file 0 [ 43.861153][ T4254] total_active_file 0 [ 43.865126][ T4254] total_unevictable 0 [ 43.869285][ T4254] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz5,task_memcg=/syz5,task=syz.5.196,pid=4254,uid=0 [ 43.883945][ T4254] Memory cgroup out of memory: Killed process 4254 (syz.5.196) total-vm:89036kB, anon-rss:740kB, file-rss:16044kB, shmem-rss:0kB, UID:0 pgtables:112kB oom_score_adj:1000 [ 43.945263][ T29] kauditd_printk_skb: 86 callbacks suppressed [ 43.945277][ T29] audit: type=1400 audit(1732038392.502:521): avc: denied { connect } for pid=4267 comm="syz.1.200" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 44.050650][ T4277] syz.0.202[4277] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 44.050778][ T4277] syz.0.202[4277] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 44.075321][ T4277] syz.0.202[4277] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 44.187793][ T4284] pim6reg1: entered promiscuous mode [ 44.204450][ T4284] pim6reg1: entered allmulticast mode [ 44.459302][ T4291] can0: slcan on pts0. [ 44.525321][ T4291] can0 (unregistered): slcan off pts0. [ 44.599570][ T29] audit: type=1326 audit(1732038393.172:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4297 comm="syz.0.209" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 44.703068][ T29] audit: type=1326 audit(1732038393.212:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4297 comm="syz.0.209" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 44.726379][ T29] audit: type=1326 audit(1732038393.212:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4297 comm="syz.0.209" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 44.749604][ T29] audit: type=1326 audit(1732038393.212:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4297 comm="syz.0.209" exe="/root/syz-executor" sig=0 arch=c000003e syscall=137 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 44.775542][ T29] audit: type=1326 audit(1732038393.212:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4297 comm="syz.0.209" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 44.798852][ T29] audit: type=1326 audit(1732038393.212:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4297 comm="syz.0.209" exe="/root/syz-executor" sig=0 arch=c000003e syscall=103 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 44.822437][ T29] audit: type=1326 audit(1732038393.212:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4297 comm="syz.0.209" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 44.846086][ T29] audit: type=1326 audit(1732038393.212:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4297 comm="syz.0.209" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 44.911136][ T4317] loop3: detected capacity change from 0 to 1024 [ 44.940907][ T4317] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.956118][ T29] audit: type=1400 audit(1732038393.532:530): avc: denied { rename } for pid=4316 comm="syz.3.211" name="file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 45.018749][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.031002][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.047124][ T3336] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.079761][ T4255] syz.5.196 (4255) used greatest stack depth: 7280 bytes left [ 45.140993][ T3336] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.184112][ T4342] vlan2: entered allmulticast mode [ 45.203901][ T3336] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.268708][ T4353] netlink: 4 bytes leftover after parsing attributes in process `syz.5.218'. [ 45.313711][ T4356] ------------[ cut here ]------------ [ 45.319212][ T4356] refcount_t: underflow; use-after-free. [ 45.325336][ T4356] WARNING: CPU: 1 PID: 4356 at lib/refcount.c:28 refcount_warn_saturate+0x1c6/0x230 [ 45.335045][ T4356] Modules linked in: [ 45.338984][ T4356] CPU: 1 UID: 0 PID: 4356 Comm: syz.3.220 Not tainted 6.12.0-syzkaller-00971-g158f238aa69d #0 [ 45.349525][ T4356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 45.359711][ T4356] RIP: 0010:refcount_warn_saturate+0x1c6/0x230 [ 45.365903][ T4356] Code: 72 ff ff ff e8 4b e3 70 ff 48 c7 c7 37 f3 b2 86 e8 af ca 89 ff c6 05 9f 8a f3 04 01 90 48 c7 c7 eb d1 1b 86 e8 2b 9c 52 ff 90 <0f> 0b 90 90 e9 43 ff ff ff e8 1c e3 70 ff 48 c7 c7 34 f3 b2 86 e8 [ 45.385549][ T4356] RSP: 0018:ffffc9000139fcd8 EFLAGS: 00010246 [ 45.391683][ T4356] RAX: 0de40afff2cd0400 RBX: ffff888115e02ae4 RCX: 0000000000040000 [ 45.399829][ T4356] RDX: ffffc90005758000 RSI: 00000000000019f8 RDI: 00000000000019f9 [ 45.407845][ T4356] RBP: 0000000000000003 R08: ffffffff81120637 R09: 0000000000000000 [ 45.415952][ T4356] R10: 0001ffffffffffff R11: ffff8881033c8000 R12: ffff888114d73e68 [ 45.423936][ T4356] R13: ffff888114d73e18 R14: ffff888115e02ae4 R15: 0000000000000000 [ 45.432038][ T4356] FS: 00007fef0a6516c0(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 [ 45.441055][ T4356] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.447849][ T4356] CR2: 0000000000000000 CR3: 000000011f5c8000 CR4: 00000000003506f0 [ 45.455855][ T4356] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 45.463842][ T4356] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 45.471885][ T4356] Call Trace: [ 45.475171][ T4356] [ 45.478242][ T4356] ? __warn+0x141/0x350 [ 45.482482][ T4356] ? report_bug+0x315/0x420 [ 45.487025][ T4356] ? refcount_warn_saturate+0x1c6/0x230 [ 45.492633][ T4356] ? handle_bug+0x60/0x90 [ 45.497142][ T4356] ? exc_invalid_op+0x1a/0x50 [ 45.501829][ T4356] ? asm_exc_invalid_op+0x1a/0x20 [ 45.506893][ T4356] ? __warn_printk+0x167/0x1b0 [ 45.511752][ T4356] ? refcount_warn_saturate+0x1c6/0x230 [ 45.517506][ T4356] ? refcount_warn_saturate+0x1c5/0x230 [ 45.523086][ T4356] sk_skb_reason_drop+0xe9/0x290 [ 45.528071][ T4356] j1939_session_put+0x157/0x2a0 [ 45.533026][ T4356] j1939_sk_release+0x278/0x4f0 [ 45.538126][ T4356] ? __pfx_autoremove_wake_function+0x10/0x10 [ 45.544286][ T4356] sock_close+0x68/0x150 [ 45.548560][ T4356] ? __pfx_sock_close+0x10/0x10 [ 45.553600][ T4356] __fput+0x17a/0x6d0 [ 45.557703][ T4356] ____fput+0x1c/0x30 [ 45.561763][ T4356] task_work_run+0x13a/0x1a0 [ 45.566387][ T4356] syscall_exit_to_user_mode+0xbe/0x130 [ 45.571956][ T4356] do_syscall_64+0xd6/0x1c0 [ 45.576484][ T4356] ? clear_bhb_loop+0x55/0xb0 [ 45.581203][ T4356] ? clear_bhb_loop+0x55/0xb0 [ 45.585961][ T4356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.591944][ T4356] RIP: 0033:0x7fef0b9de759 [ 45.596493][ T4356] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 45.616233][ T4356] RSP: 002b:00007fef0a651038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 45.624754][ T4356] RAX: 0000000000000000 RBX: 00007fef0bb95f80 RCX: 00007fef0b9de759 [ 45.632799][ T4356] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000004 [ 45.640902][ T4356] RBP: 00007fef0ba5175e R08: 0000000000000000 R09: 0000000000000000 [ 45.648968][ T4356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 45.656971][ T4356] R13: 0000000000000000 R14: 00007fef0bb95f80 R15: 00007ffc3beb3848 [ 45.665057][ T4356] [ 45.668203][ T4356] ---[ end trace 0000000000000000 ]--- [ 45.678267][ T3336] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.696209][ T4308] chnl_net:caif_netlink_parms(): no params data found [ 45.705521][ T4353] netlink: 4 bytes leftover after parsing attributes in process `syz.5.218'. [ 45.766698][ T4362] vlan0: entered promiscuous mode [ 45.801477][ T4362] vlan1: entered promiscuous mode [ 45.806668][ T4362] vlan1: entered allmulticast mode [ 45.884197][ T4376] loop5: detected capacity change from 0 to 256 [ 45.917544][ T4372] lo speed is unknown, defaulting to 1000 [ 45.966280][ T4372] lo speed is unknown, defaulting to 1000 [ 45.974156][ T3336] bridge_slave_1: left allmulticast mode [ 45.979876][ T3336] bridge_slave_1: left promiscuous mode [ 45.985613][ T3336] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.995355][ T4376] loop5: detected capacity change from 256 to 0 [ 46.002845][ T4376] syz.5.227: attempt to access beyond end of device [ 46.002845][ T4376] loop5: rw=0, sector=12, nr_sectors = 4 limit=0 [ 46.022923][ T3336] bridge_slave_0: left allmulticast mode [ 46.028639][ T3336] bridge_slave_0: left promiscuous mode [ 46.034248][ T3336] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.036234][ T4376] FAT-fs (loop5): Directory bread(block 3) failed [ 46.050817][ T4376] syz.5.227: attempt to access beyond end of device [ 46.050817][ T4376] loop5: rw=0, sector=12, nr_sectors = 4 limit=0 [ 46.085305][ T4376] FAT-fs (loop5): Directory bread(block 3) failed [ 46.156421][ T3614] syz-executor: attempt to access beyond end of device [ 46.156421][ T3614] loop5: rw=0, sector=12, nr_sectors = 4 limit=0 [ 46.169820][ T3614] FAT-fs (loop5): Directory bread(block 3) failed [ 46.184402][ T28] kworker/u8:1: attempt to access beyond end of device [ 46.184402][ T28] loop5: rw=0, sector=48, nr_sectors = 4 limit=0 [ 46.204079][ T28] FAT-fs (loop5): unable to read inode block for updating (i_pos 770) [ 46.214636][ T3614] syz-executor: attempt to access beyond end of device [ 46.214636][ T3614] loop5: rw=0, sector=0, nr_sectors = 4 limit=0 [ 46.228867][ T3336] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 46.235402][ T3614] FAT-fs (loop5): unable to read boot sector to mark fs as dirty [ 46.249491][ T3336] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 46.260083][ T3336] bond0 (unregistering): Released all slaves [ 46.269304][ T4372] lo speed is unknown, defaulting to 1000 [ 46.276025][ T4372] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 46.284092][ T4372] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 46.306114][ T4308] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.313183][ T4308] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.320794][ T4308] bridge_slave_0: entered allmulticast mode [ 46.328470][ T4308] bridge_slave_0: entered promiscuous mode [ 46.335532][ T4372] lo speed is unknown, defaulting to 1000 [ 46.346885][ T4400] team0 (unregistering): Port device team_slave_0 removed [ 46.357330][ T4400] team0 (unregistering): Port device team_slave_1 removed [ 46.368282][ T4400] team0 (unregistering): Port device geneve0 removed [ 46.378070][ T4308] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.385113][ T4308] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.393282][ T4308] bridge_slave_1: entered allmulticast mode [ 46.399785][ T4308] bridge_slave_1: entered promiscuous mode [ 46.410280][ T4372] lo speed is unknown, defaulting to 1000 [ 46.417785][ T4372] lo speed is unknown, defaulting to 1000 [ 46.431103][ T4308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 46.440215][ T4372] lo speed is unknown, defaulting to 1000 [ 46.446496][ T4308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 46.456572][ T4372] lo speed is unknown, defaulting to 1000 [ 46.465738][ T4372] lo speed is unknown, defaulting to 1000 [ 46.494646][ T3336] hsr_slave_0: left promiscuous mode [ 46.505484][ T3336] hsr_slave_1: left promiscuous mode [ 46.524268][ T3336] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 46.531764][ T3336] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 46.587864][ T3336] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 46.595371][ T3336] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 46.610614][ T3336] veth1_macvtap: left promiscuous mode [ 46.616231][ T3336] veth0_macvtap: left promiscuous mode [ 46.621744][ T3336] veth1_vlan: left promiscuous mode [ 46.627083][ T3336] veth0_vlan: left promiscuous mode [ 46.677972][ T4429] serio: Serial port pts0 [ 46.719964][ T3336] team0 (unregistering): Port device team_slave_1 removed [ 46.730708][ T3336] team0 (unregistering): Port device team_slave_0 removed [ 46.761338][ T4435] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 46.783463][ T4440] syz.1.241[4440] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 46.783589][ T4440] syz.1.241[4440] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 46.784277][ T4308] team0: Port device team_slave_0 added [ 46.796379][ T4440] syz.1.241[4440] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 46.865301][ T4434] syzkaller0: entered promiscuous mode [ 46.882121][ T4434] syzkaller0: entered allmulticast mode [ 46.895284][ T4308] team0: Port device team_slave_1 added [ 46.945630][ T4308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 46.952637][ T4308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 46.957409][ T4452] mmap: syz.0.242 (4452) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 46.978569][ T4308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.012346][ T4308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.019365][ T4308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 47.045345][ T4308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.057503][ T4449] pim6reg1: entered promiscuous mode [ 47.062800][ T4449] pim6reg1: entered allmulticast mode [ 47.123377][ T4412] lo speed is unknown, defaulting to 1000 [ 47.154809][ T4308] hsr_slave_0: entered promiscuous mode [ 47.165805][ T4308] hsr_slave_1: entered promiscuous mode [ 47.181941][ T4308] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 47.195494][ T4308] Cannot create hsr debugfs directory [ 47.208321][ T4461] syzkaller0: entered promiscuous mode [ 47.213847][ T4461] syzkaller0: entered allmulticast mode [ 47.324529][ T3410] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.358443][ T4412] chnl_net:caif_netlink_parms(): no params data found [ 47.422015][ T3410] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.489291][ T3410] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.547715][ T3410] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.563193][ T4412] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.570611][ T4412] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.578019][ T4412] bridge_slave_0: entered allmulticast mode [ 47.584650][ T4412] bridge_slave_0: entered promiscuous mode [ 47.597586][ T4510] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.611639][ T4412] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.619005][ T4412] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.627765][ T4412] bridge_slave_1: entered allmulticast mode [ 47.634235][ T4412] bridge_slave_1: entered promiscuous mode [ 47.645693][ T4308] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 47.670952][ T4510] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.708108][ T4308] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 47.730664][ T4510] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.742048][ T4308] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 47.751066][ T4526] veth0_to_team: entered promiscuous mode [ 47.756926][ T4526] veth0_to_team: entered allmulticast mode [ 47.765615][ T4412] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.783059][ T4308] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 47.793811][ T4412] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.794218][ T4531] syz.1.255[4531] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 47.805568][ T4531] syz.1.255[4531] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 47.816888][ T4531] syz.1.255[4531] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 47.818130][ T4510] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.875390][ T4412] team0: Port device team_slave_0 added [ 47.882045][ T4412] team0: Port device team_slave_1 added [ 47.902603][ T3410] bridge_slave_1: left allmulticast mode [ 47.908322][ T3410] bridge_slave_1: left promiscuous mode [ 47.913937][ T3410] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.921733][ T3410] bridge_slave_0: left allmulticast mode [ 47.927437][ T3410] bridge_slave_0: left promiscuous mode [ 47.933065][ T3410] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.007925][ T3410] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 48.018394][ T3410] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 48.028503][ T3410] bond0 (unregistering): Released all slaves [ 48.041886][ T4412] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.048956][ T4412] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 48.074880][ T4412] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.097687][ T4534] 9pnet_fd: p9_fd_create_tcp (4534): problem connecting socket to 127.0.0.1 [ 48.102249][ T4510] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.116468][ T4412] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.123441][ T4412] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 48.149767][ T4412] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.166360][ T3410] hsr_slave_0: left promiscuous mode [ 48.172041][ T3410] hsr_slave_1: left promiscuous mode [ 48.177897][ T3410] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 48.185446][ T3410] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 48.192971][ T3410] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 48.200405][ T3410] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 48.209493][ T3410] veth1_macvtap: left promiscuous mode [ 48.214977][ T3410] veth0_macvtap: left promiscuous mode [ 48.220606][ T3410] veth1_vlan: left promiscuous mode [ 48.225929][ T3410] veth0_vlan: left promiscuous mode [ 48.294966][ T3410] team0 (unregistering): Port device team_slave_1 removed [ 48.307130][ T3410] team0 (unregistering): Port device team_slave_0 removed [ 48.346855][ T4510] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.358276][ T4510] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.401729][ T4510] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.432385][ T4412] hsr_slave_0: entered promiscuous mode [ 48.466570][ T4412] hsr_slave_1: entered promiscuous mode [ 48.472800][ T4412] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 48.481127][ T4412] Cannot create hsr debugfs directory [ 48.532685][ T4308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.575560][ T4551] loop1: detected capacity change from 0 to 512 [ 48.598689][ T4551] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 48.606749][ T4551] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 48.695401][ T4551] System zones: 0-1, 15-15, 18-18, 34-34 [ 48.706532][ T4551] EXT4-fs (loop1): orphan cleanup on readonly fs [ 48.716415][ T4308] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.737902][ T4551] EXT4-fs warning (device loop1): ext4_enable_quotas:7156: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 48.752567][ T4551] EXT4-fs (loop1): Cannot turn on quotas: error -22 [ 48.792457][ T4569] bridge_slave_0: left allmulticast mode [ 48.798155][ T4569] bridge_slave_0: left promiscuous mode [ 48.803791][ T4569] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.822114][ T4551] EXT4-fs error (device loop1): ext4_orphan_get:1415: comm syz.1.261: bad orphan inode 16 [ 48.844585][ T4551] ext4_test_bit(bit=15, block=18) = 1 [ 48.850039][ T4551] is_bad_inode(inode)=0 [ 48.854201][ T4551] NEXT_ORPHAN(inode)=0 [ 48.858380][ T4551] max_ino=32 [ 48.861564][ T4551] i_nlink=2 [ 48.869408][ T4569] bridge_slave_1: left allmulticast mode [ 48.875097][ T4569] bridge_slave_1: left promiscuous mode [ 48.880886][ T4569] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.903346][ T4551] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 48.927281][ T4569] bond0: (slave bond_slave_0): Releasing backup interface [ 48.951945][ T4569] bond0: (slave bond_slave_1): Releasing backup interface [ 48.968734][ T4569] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 48.976330][ T4569] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 49.007735][ T3319] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.018929][ T4569] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 49.026381][ T4569] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 49.125386][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.132490][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.143388][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.150548][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.182091][ T4308] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 49.192524][ T4308] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 49.247534][ T4574] pim6reg1: entered promiscuous mode [ 49.252872][ T4574] pim6reg1: entered allmulticast mode [ 49.253077][ T29] kauditd_printk_skb: 190 callbacks suppressed [ 49.253088][ T29] audit: type=1400 audit(1732038397.822:720): avc: denied { sqpoll } for pid=4583 comm="syz.0.266" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 49.322328][ T4412] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 49.330381][ T4585] random: crng reseeded on system resumption [ 49.331172][ T29] audit: type=1400 audit(1732038397.902:721): avc: denied { write } for pid=4583 comm="syz.0.266" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 49.365367][ T4412] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 49.412740][ T4308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.421197][ T4412] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 49.432943][ T4412] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 49.494463][ T4412] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.509856][ T4412] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.520321][ T1965] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.527402][ T1965] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.549063][ T1965] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.556281][ T1965] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.659611][ T4412] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.680480][ T4308] veth0_vlan: entered promiscuous mode [ 49.695997][ T4308] veth1_vlan: entered promiscuous mode [ 49.722796][ T4308] veth0_macvtap: entered promiscuous mode [ 49.736839][ T4308] veth1_macvtap: entered promiscuous mode [ 49.753890][ T4308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 49.764461][ T4308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 49.774377][ T4308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 49.785019][ T4308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 49.798840][ T4308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.811922][ T4308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 49.822571][ T4308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 49.832417][ T4308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 49.842999][ T4308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 49.858914][ T4308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.870181][ T4308] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.879028][ T4308] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.887794][ T4308] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.896593][ T4308] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.927057][ T29] audit: type=1400 audit(1732038398.492:722): avc: denied { mount } for pid=4308 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 49.952640][ T29] audit: type=1400 audit(1732038398.522:723): avc: denied { mounton } for pid=4308 comm="syz-executor" path="/root/syzkaller.chLrC7/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 49.986057][ T4665] syzkaller0: entered promiscuous mode [ 49.991581][ T4665] syzkaller0: entered allmulticast mode [ 50.024054][ T4675] loop6: detected capacity change from 0 to 128 [ 50.053964][ T4675] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 50.071880][ T4675] ext4 filesystem being mounted at /0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 50.136660][ T4308] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 50.167848][ T4412] veth0_vlan: entered promiscuous mode [ 50.189592][ T4412] veth1_vlan: entered promiscuous mode [ 50.216749][ T29] audit: type=1326 audit(1732038398.792:724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4693 comm="syz.6.271" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda75b5e759 code=0x7ffc0000 [ 50.240188][ T29] audit: type=1326 audit(1732038398.792:725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4693 comm="syz.6.271" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda75b5e759 code=0x7ffc0000 [ 50.287654][ T4696] tipc: Started in network mode [ 50.292541][ T4696] tipc: Node identity ac1414aa, cluster identity 4711 [ 50.314742][ T29] audit: type=1326 audit(1732038398.842:726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4693 comm="syz.6.271" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fda75b5e759 code=0x7ffc0000 [ 50.323062][ T4696] tipc: New replicast peer: 100.1.1.1 [ 50.338537][ T29] audit: type=1326 audit(1732038398.842:727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4693 comm="syz.6.271" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda75b5e759 code=0x7ffc0000 [ 50.343802][ T4696] tipc: Enabled bearer , priority 10 [ 50.367125][ T29] audit: type=1326 audit(1732038398.842:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4693 comm="syz.6.271" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda75b5e759 code=0x7ffc0000 [ 50.396533][ T29] audit: type=1326 audit(1732038398.842:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4693 comm="syz.6.271" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fda75b5e759 code=0x7ffc0000 [ 50.406204][ T4412] veth0_macvtap: entered promiscuous mode [ 50.459657][ T4412] veth1_macvtap: entered promiscuous mode [ 50.470556][ T4685] loop1: detected capacity change from 0 to 1024 [ 50.493261][ T4412] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 50.503760][ T4412] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 50.513705][ T4412] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 50.515694][ T4685] EXT4-fs: Ignoring removed orlov option [ 50.524283][ T4412] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 50.529907][ T4685] EXT4-fs: Ignoring removed nomblk_io_submit option [ 50.539685][ T4412] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 50.539701][ T4412] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 50.578070][ T4412] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.591810][ T4685] ext3: Unknown parameter 'obj_type' [ 50.604061][ T4412] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 50.614589][ T4412] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 50.624519][ T4412] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 50.635769][ T4412] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 50.646070][ T4412] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 50.656595][ T4412] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 50.689030][ T4412] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.707396][ T4412] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.716188][ T4412] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.724993][ T4412] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.733833][ T4412] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.877638][ T4745] loop7: detected capacity change from 0 to 512 [ 50.888198][ T4751] loop1: detected capacity change from 0 to 256 [ 50.926505][ T4745] EXT4-fs error (device loop7): ext4_orphan_get:1389: inode #17: comm syz.7.277: iget: bogus i_mode (0) [ 50.948180][ T4745] EXT4-fs error (device loop7): ext4_orphan_get:1394: comm syz.7.277: couldn't read orphan inode 17 (err -117) [ 51.010376][ T4745] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 51.063908][ T4762] serio: Serial port pts0 [ 51.091520][ T4745] EXT4-fs error (device loop7): ext4_validate_block_bitmap:432: comm syz.7.277: bg 0: block 7: invalid block bitmap [ 51.140224][ T4412] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.284717][ T4788] syzkaller0: entered promiscuous mode [ 51.290251][ T4788] syzkaller0: entered allmulticast mode [ 51.345376][ T35] tipc: Node number set to 2886997162 [ 51.363579][ T4804] syzkaller0: entered promiscuous mode [ 51.369189][ T4804] syzkaller0: entered allmulticast mode [ 51.476409][ T4814] Illegal XDP return value 4211318170 on prog (id 273) dev N/A, expect packet loss! [ 51.517137][ T4824] netlink: 16 bytes leftover after parsing attributes in process `syz.0.289'. [ 51.753100][ T4858] Process accounting resumed [ 51.895663][ T4876] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 52.102971][ T4893] loop1: detected capacity change from 0 to 128 [ 52.134514][ T4893] syz.1.301: attempt to access beyond end of device [ 52.134514][ T4893] loop1: rw=2049, sector=177, nr_sectors = 1 limit=128 [ 52.143229][ T4897] loop7: detected capacity change from 0 to 1024 [ 52.177720][ T4893] syz.1.301: attempt to access beyond end of device [ 52.177720][ T4893] loop1: rw=2049, sector=153, nr_sectors = 24 limit=128 [ 52.177807][ T4897] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 52.215257][ T4893] syz.1.301: attempt to access beyond end of device [ 52.215257][ T4893] loop1: rw=2049, sector=177, nr_sectors = 1 limit=128 [ 52.228811][ T4893] Buffer I/O error on dev loop1, logical block 177, lost async page write [ 52.239846][ T4897] EXT4-fs error (device loop7): ext4_clear_blocks:876: inode #14: comm syz.7.302: attempt to clear invalid blocks 1634560256 len 1 [ 52.300454][ T4412] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.526262][ T4945] capability: warning: `syz.1.309' uses deprecated v2 capabilities in a way that may be insecure [ 52.582540][ T4954] loop1: detected capacity change from 0 to 128 [ 52.624134][ T4954] syz.1.311: attempt to access beyond end of device [ 52.624134][ T4954] loop1: rw=2049, sector=145, nr_sectors = 896 limit=128 [ 52.646229][ T4954] syz.1.311: attempt to access beyond end of device [ 52.646229][ T4954] loop1: rw=0, sector=177, nr_sectors = 1 limit=128 [ 52.661736][ T4953] syz.1.311: attempt to access beyond end of device [ 52.661736][ T4953] loop1: rw=524288, sector=145, nr_sectors = 32 limit=128 [ 52.678175][ T4953] syz.1.311: attempt to access beyond end of device [ 52.678175][ T4953] loop1: rw=524288, sector=185, nr_sectors = 184 limit=128 [ 52.694308][ T4953] syz.1.311: attempt to access beyond end of device [ 52.694308][ T4953] loop1: rw=0, sector=177, nr_sectors = 1 limit=128 [ 52.707477][ T4953] Buffer I/O error on dev loop1, logical block 177, async page read [ 52.716996][ T4953] syz.1.311: attempt to access beyond end of device [ 52.716996][ T4953] loop1: rw=0, sector=178, nr_sectors = 1 limit=128 [ 52.730174][ T4953] Buffer I/O error on dev loop1, logical block 178, async page read [ 52.739589][ T4953] syz.1.311: attempt to access beyond end of device [ 52.739589][ T4953] loop1: rw=0, sector=179, nr_sectors = 1 limit=128 [ 52.752784][ T4953] Buffer I/O error on dev loop1, logical block 179, async page read [ 52.765863][ T4953] Buffer I/O error on dev loop1, logical block 180, async page read [ 52.776726][ T4953] Buffer I/O error on dev loop1, logical block 181, async page read [ 52.785077][ T4953] Buffer I/O error on dev loop1, logical block 182, async page read [ 52.793826][ T4953] Buffer I/O error on dev loop1, logical block 183, async page read [ 52.804999][ T4953] Buffer I/O error on dev loop1, logical block 184, async page read [ 52.813174][ T4953] Buffer I/O error on dev loop1, logical block 177, async page read [ 52.883721][ T4982] lo speed is unknown, defaulting to 1000 [ 52.885503][ T4987] pim6reg1: entered promiscuous mode [ 52.894821][ T4987] pim6reg1: entered allmulticast mode [ 53.189064][ T5023] loop6: detected capacity change from 0 to 128 [ 53.248490][ T5019] syzkaller0: entered promiscuous mode [ 53.254221][ T5019] syzkaller0: entered allmulticast mode [ 53.486434][ T5044] netlink: 4 bytes leftover after parsing attributes in process `syz.6.325'. [ 53.495472][ T5044] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 53.503236][ T5044] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 53.554718][ T5050] serio: Serial port ptm0 [ 53.564087][ T5044] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 53.571649][ T5044] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 53.838734][ T5068] syzkaller0: entered promiscuous mode [ 53.844263][ T5068] syzkaller0: entered allmulticast mode [ 53.982714][ T5076] pim6reg: entered allmulticast mode [ 53.990404][ T5076] pim6reg: left allmulticast mode [ 54.457584][ T5090] loop7: detected capacity change from 0 to 128 [ 54.652754][ T5101] syzkaller0: entered promiscuous mode [ 54.658445][ T5101] syzkaller0: entered allmulticast mode [ 54.664927][ T5103] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 54.673235][ T5103] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 54.726098][ T29] kauditd_printk_skb: 135 callbacks suppressed [ 54.726120][ T29] audit: type=1400 audit(1732038403.302:865): avc: denied { name_bind } for pid=5106 comm="syz.7.342" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 54.834907][ T5126] netlink: 268 bytes leftover after parsing attributes in process `syz.6.344'. [ 54.844429][ T5126] unsupported nla_type 65024 [ 54.888682][ T5128] loop7: detected capacity change from 0 to 512 [ 54.936304][ T5128] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 54.970269][ T29] audit: type=1326 audit(1732038403.542:866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5139 comm="syz.6.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda75b5e759 code=0x7ffc0000 [ 54.975407][ T5128] ext4 filesystem being mounted at /14/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 54.993728][ T29] audit: type=1326 audit(1732038403.542:867): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5139 comm="syz.6.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda75b5e759 code=0x7ffc0000 [ 55.028038][ T29] audit: type=1326 audit(1732038403.542:868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5139 comm="syz.6.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fda75b5e759 code=0x7ffc0000 [ 55.051388][ T29] audit: type=1326 audit(1732038403.542:869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5139 comm="syz.6.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda75b5e759 code=0x7ffc0000 [ 55.133360][ T5147] 9pnet_fd: Insufficient options for proto=fd [ 55.145671][ T4412] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.176774][ T29] audit: type=1400 audit(1732038403.602:870): avc: denied { read } for pid=5127 comm="syz.7.347" name="autofs" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 55.200030][ T29] audit: type=1400 audit(1732038403.602:871): avc: denied { open } for pid=5127 comm="syz.7.347" path="/dev/autofs" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 55.223491][ T29] audit: type=1400 audit(1732038403.602:872): avc: denied { ioctl } for pid=5127 comm="syz.7.347" path="/dev/autofs" dev="devtmpfs" ino=91 ioctlcmd=0x9374 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 55.248781][ T29] audit: type=1326 audit(1732038403.662:874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5139 comm="syz.6.349" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fda75b5d0f0 code=0x7ffc0000 [ 55.272205][ T29] audit: type=1326 audit(1732038403.662:873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5140 comm="syz.3.350" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fef0b9de759 code=0x7ffc0000 [ 55.316982][ T5150] vhci_hcd: invalid port number 255 [ 55.322275][ T5150] vhci_hcd: default hub control req: 0400 v0000 i00ff l0 [ 55.361326][ T5154] loop3: detected capacity change from 0 to 512 [ 55.375948][ T5156] netlink: 8 bytes leftover after parsing attributes in process `syz.6.354'. [ 55.384854][ T5156] netlink: 8 bytes leftover after parsing attributes in process `syz.6.354'. [ 55.397055][ T5156] erspan1: entered promiscuous mode [ 55.402449][ T5156] erspan1: entered allmulticast mode [ 55.414097][ T5154] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 55.427717][ T5154] ext4 filesystem being mounted at /78/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 55.471002][ T5154] devtmpfs: Bad value for 'defcontext' [ 55.489481][ T3317] EXT4-fs error (device loop3): ext4_readdir:261: inode #12: block 32: comm syz-executor: path /78/bus/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 55.633225][ T5166] loop1: detected capacity change from 0 to 4096 [ 55.658673][ T5175] xt_CT: You must specify a L4 protocol and not use inversions on it [ 55.668461][ T5166] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 55.686710][ T5175] loop6: detected capacity change from 0 to 1024 [ 55.817664][ T5175] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 55.935997][ T5166] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.499506][ T4308] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.535146][ T5195] netlink: 24 bytes leftover after parsing attributes in process `syz.6.367'. [ 56.546045][ T5195] netlink: 8 bytes leftover after parsing attributes in process `syz.6.367'. [ 56.589698][ T5200] loop6: detected capacity change from 0 to 512 [ 56.629187][ T5200] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.633146][ T5206] loop1: detected capacity change from 0 to 512 [ 56.643684][ T5200] ext4 filesystem being mounted at /25/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 56.676859][ T5206] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 56.703020][ T5206] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 56.716798][ T5206] ext4 filesystem being mounted at /88/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 56.717722][ T4308] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.737841][ T5206] EXT4-fs error (device loop1): __ext4_remount:6749: comm syz.1.372: Abort forced by user [ 56.778044][ T5206] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000d40000 ro. Quota mode: writeback. [ 56.855123][ T3319] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 56.879795][ T5219] ref_ctr increment failed for inode: 0x22d offset: 0x0 ref_ctr_offset: 0x82 of mm: 0xffff888114f39f80 [ 56.926063][ T5218] uprobe: syz.0.377:5218 failed to unregister, leaking uprobe [ 56.982970][ T5226] pim6reg1: entered promiscuous mode [ 56.988493][ T5226] pim6reg1: entered allmulticast mode [ 57.030234][ T5228] loop1: detected capacity change from 0 to 2048 [ 57.066578][ T5228] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 57.191149][ T5236] geneve0: entered allmulticast mode [ 57.317213][ T3319] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.423494][ T5245] tipc: Started in network mode [ 57.428443][ T5245] tipc: Node identity 0a8b8477104f, cluster identity 4711 [ 57.435803][ T5245] tipc: Enabled bearer , priority 7 [ 57.453399][ T5245] ªªªªªª: renamed from syzkaller0 [ 57.466214][ T5245] tipc: Disabling bearer [ 57.589582][ T5249] netlink: 4 bytes leftover after parsing attributes in process `syz.1.389'. [ 57.599542][ T5249] bridge_slave_1: left allmulticast mode [ 57.605310][ T5249] bridge_slave_1: left promiscuous mode [ 57.610963][ T5249] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.627241][ T5249] bridge_slave_0: left allmulticast mode [ 57.633023][ T5249] bridge_slave_0: left promiscuous mode [ 57.638836][ T5249] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.777879][ T5259] netlink: 8 bytes leftover after parsing attributes in process `syz.1.394'. [ 58.001644][ T5277] bridge_slave_0: left allmulticast mode [ 58.007329][ T5277] bridge_slave_0: left promiscuous mode [ 58.012990][ T5277] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.023599][ T5277] bridge_slave_1: left allmulticast mode [ 58.029320][ T5277] bridge_slave_1: left promiscuous mode [ 58.035054][ T5277] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.046170][ T5277] bond0: (slave bond_slave_0): Releasing backup interface [ 58.065435][ T5266] netlink: 'syz.1.397': attribute type 3 has an invalid length. [ 58.080611][ T5277] bond0: (slave bond_slave_1): Releasing backup interface [ 58.113419][ T5277] team0: Port device team_slave_0 removed [ 58.132581][ T5277] team0: Port device team_slave_1 removed [ 58.253176][ T5291] loop6: detected capacity change from 0 to 512 [ 58.258892][ T5287] loop1: detected capacity change from 0 to 4096 [ 58.268539][ T5293] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(3) [ 58.275146][ T5293] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 58.282698][ T5293] vhci_hcd vhci_hcd.0: Device attached [ 58.305827][ T5287] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 58.314229][ T5294] vhci_hcd: connection closed [ 58.320617][ T5291] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 58.337986][ T3440] vhci_hcd: stop threads [ 58.342322][ T3440] vhci_hcd: release socket [ 58.346954][ T3440] vhci_hcd: disconnect device [ 58.369848][ T5291] ext4 filesystem being mounted at /37/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 58.381522][ T5301] netlink: 28 bytes leftover after parsing attributes in process `syz.0.410'. [ 58.408430][ T5291] EXT4-fs error (device loop6): ext4_do_update_inode:5153: inode #18: comm syz.6.408: corrupted inode contents [ 58.420386][ T5291] EXT4-fs error (device loop6): ext4_dirty_inode:6041: inode #18: comm syz.6.408: mark_inode_dirty error [ 58.443117][ T5291] EXT4-fs error (device loop6): ext4_do_update_inode:5153: inode #18: comm syz.6.408: corrupted inode contents [ 58.464279][ T5291] EXT4-fs error (device loop6): ext4_xattr_delete_inode:3006: inode #18: comm syz.6.408: mark_inode_dirty error [ 58.482437][ T5291] EXT4-fs error (device loop6): ext4_xattr_delete_inode:3009: inode #18: comm syz.6.408: mark inode dirty (error -117) [ 58.496584][ T5291] EXT4-fs warning (device loop6): ext4_evict_inode:276: xattr delete (err -117) [ 58.546988][ T4308] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.571268][ T3319] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.593410][ T5312] syz.6.413[5312] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 58.593459][ T5312] syz.6.413[5312] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 58.605137][ T5312] syz.6.413[5312] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 58.700638][ T5317] infiniband syz1: set down [ 58.716475][ T5317] infiniband syz1: added team_slave_0 [ 58.765768][ T5317] RDS/IB: syz1: added [ 58.769809][ T5317] smc: adding ib device syz1 with port count 1 [ 58.776153][ T5317] smc: ib device syz1 port 1 has pnetid [ 59.054084][ T5327] loop1: detected capacity change from 0 to 512 [ 59.069462][ T5326] netlink: 'syz.0.417': attribute type 3 has an invalid length. [ 59.226529][ T5327] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 59.239973][ T5327] ext4 filesystem being mounted at /99/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 59.309382][ T3319] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.352941][ T5340] pim6reg1: entered promiscuous mode [ 59.358343][ T5340] pim6reg1: entered allmulticast mode [ 59.526367][ T5350] loop6: detected capacity change from 0 to 128 [ 59.559783][ T5350] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 59.574858][ T5350] ext4 filesystem being mounted at /40/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 59.661120][ T5350] EXT4-fs (loop6): shut down requested (0) [ 59.682713][ T4308] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 60.210064][ T29] kauditd_printk_skb: 419 callbacks suppressed [ 60.210124][ T29] audit: type=1400 audit(1732038408.782:1294): avc: denied { create } for pid=5408 comm="syz.0.439" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 60.274851][ T29] audit: type=1326 audit(1732038408.842:1295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5411 comm="syz.0.441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 60.305646][ T29] audit: type=1326 audit(1732038408.872:1296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5411 comm="syz.0.441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=68 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 60.328956][ T29] audit: type=1326 audit(1732038408.872:1297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5411 comm="syz.0.441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 60.352347][ T29] audit: type=1326 audit(1732038408.872:1298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5411 comm="syz.0.441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe249c9d0f0 code=0x7ffc0000 [ 60.375680][ T29] audit: type=1326 audit(1732038408.872:1299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5411 comm="syz.0.441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe249c9e35b code=0x7ffc0000 [ 60.399212][ T29] audit: type=1326 audit(1732038408.872:1300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5411 comm="syz.0.441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 60.422661][ T29] audit: type=1326 audit(1732038408.872:1301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5411 comm="syz.0.441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 60.431162][ T5412] loop1: detected capacity change from 0 to 512 [ 60.446113][ T29] audit: type=1326 audit(1732038408.872:1302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5411 comm="syz.0.441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fe249c9e793 code=0x7ffc0000 [ 60.446178][ T29] audit: type=1326 audit(1732038408.872:1303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5411 comm="syz.0.441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fe249c9e793 code=0x7ffc0000 [ 60.506878][ T5415] netlink: 8 bytes leftover after parsing attributes in process `syz.7.442'. [ 60.515980][ T5415] netlink: 12 bytes leftover after parsing attributes in process `syz.7.442'. [ 60.525014][ T5415] netlink: 16 bytes leftover after parsing attributes in process `syz.7.442'. [ 60.560199][ T5412] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 60.572998][ T5412] ext4 filesystem being mounted at /103/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 60.626229][ T3319] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 60.665329][ T5420] loop7: detected capacity change from 0 to 2048 [ 60.726718][ T5420] loop7: p1 < > p3 p4 < > [ 60.733597][ T5420] loop7: p3 start 4284289 is beyond EOD, truncated [ 60.756507][ T5431] loop6: detected capacity change from 0 to 256 [ 60.829336][ T5433] loop1: detected capacity change from 0 to 2048 [ 60.891773][ T5433] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 60.940265][ T5433] ext4 filesystem being mounted at /106/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 61.022176][ T3319] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 61.205540][ T5447] netlink: 28 bytes leftover after parsing attributes in process `syz.0.452'. [ 61.231157][ T5446] lo speed is unknown, defaulting to 1000 [ 61.387487][ T5448] syzkaller0: entered promiscuous mode [ 61.393097][ T5448] syzkaller0: entered allmulticast mode [ 62.133115][ T5461] xt_TPROXY: Can be used only with -p tcp or -p udp [ 62.307512][ T3306] udevd[3306]: inotify_add_watch(7, /dev/loop7p4, 10) failed: No such file or directory [ 62.322241][ T3302] udevd[3302]: inotify_add_watch(7, /dev/loop7p1, 10) failed: No such file or directory [ 62.541006][ T5488] vlan2: entered allmulticast mode [ 62.548540][ T5488] bond0: entered allmulticast mode [ 62.570468][ T5488] bond0: left allmulticast mode [ 62.579462][ T5490] serio: Serial port ptm0 [ 63.158835][ T5533] loop6: detected capacity change from 0 to 512 [ 63.168778][ T5528] pim6reg1: entered promiscuous mode [ 63.174123][ T5528] pim6reg1: entered allmulticast mode [ 63.183031][ T5535] serio: Serial port pts1 [ 63.188354][ T5533] EXT4-fs (loop6): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 63.218351][ T5533] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a842e01c, mo2=0002] [ 63.226479][ T5533] System zones: 1-12 [ 63.230507][ T5533] EXT4-fs (loop6): orphan cleanup on readonly fs [ 63.238357][ T5533] EXT4-fs error (device loop6): ext4_validate_block_bitmap:441: comm syz.6.478: bg 0: block 361: padding at end of block bitmap is not set [ 63.277569][ T5533] EXT4-fs error (device loop6) in ext4_mb_clear_bb:6550: Corrupt filesystem [ 63.295246][ T5533] EXT4-fs error (device loop6): ext4_clear_blocks:876: inode #11: comm syz.6.478: attempt to clear invalid blocks 33619980 len 1 [ 63.310100][ T5541] vlan2: entered allmulticast mode [ 63.315755][ T5541] bond0: entered allmulticast mode [ 63.320886][ T5541] bond_slave_0: entered allmulticast mode [ 63.326676][ T5541] bond_slave_1: entered allmulticast mode [ 63.326980][ T5533] EXT4-fs error (device loop6): ext4_free_branches:1023: inode #11: comm syz.6.478: invalid indirect mapped block 1811939328 (level 0) [ 63.348307][ T5533] EXT4-fs error (device loop6): ext4_free_branches:1023: inode #11: comm syz.6.478: invalid indirect mapped block 2 (level 2) [ 63.348314][ T5541] bond0: left allmulticast mode [ 63.348359][ T5541] bond_slave_0: left allmulticast mode [ 63.348372][ T5541] bond_slave_1: left allmulticast mode [ 63.362035][ T5533] EXT4-fs (loop6): 1 truncate cleaned up [ 63.384588][ T5533] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: none. [ 63.432286][ T4308] EXT4-fs error (device loop6): ext4_map_blocks:671: inode #2: block 5: comm syz-executor: lblock 0 mapped to illegal pblock 5 (length 1) [ 63.467612][ T4308] EXT4-fs warning (device loop6): dx_probe:823: inode #2: lblock 0: comm syz-executor: error -117 reading directory block [ 63.487580][ T5549] SELinux: Context system_u:object_r:passwd_exec_t:s0 is not valid (left unmapped). [ 63.569291][ T5551] loop7: detected capacity change from 0 to 4096 [ 63.576623][ T5554] xt_TPROXY: Can be used only with -p tcp or -p udp [ 63.604304][ T5551] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 63.638443][ T5551] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 63.716027][ T5545] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 63.739514][ T3440] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.790490][ T3440] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.854369][ T5576] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 63.860907][ T5576] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 63.868454][ T5576] vhci_hcd vhci_hcd.0: Device attached [ 63.878578][ T3440] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.901577][ T5578] vhci_hcd: cannot find the pending unlink 0 [ 63.921545][ T5578] vhci_hcd: connection closed [ 63.923888][ T40] vhci_hcd: stop threads [ 63.932921][ T40] vhci_hcd: release socket [ 63.937678][ T40] vhci_hcd: disconnect device [ 63.968024][ T5586] loop7: detected capacity change from 0 to 256 [ 63.992906][ T3440] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.112717][ T5597] loop7: detected capacity change from 0 to 128 [ 64.138149][ T5597] EXT4-fs (loop7): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 64.165329][ T5597] ext4 filesystem being mounted at /42/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 64.237690][ T3440] bond0 (unregistering): Released all slaves [ 64.260937][ T5581] lo speed is unknown, defaulting to 1000 [ 64.296906][ T3440] tipc: Disabling bearer [ 64.302160][ T3440] tipc: Left network mode [ 64.329035][ T4412] EXT4-fs (loop7): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 64.419650][ T5608] serio: Serial port pts0 [ 64.433961][ T3440] hsr_slave_0: left promiscuous mode [ 64.448916][ T3440] hsr_slave_1: left promiscuous mode [ 64.457151][ T3440] veth1_macvtap: left promiscuous mode [ 64.462748][ T3440] veth0_macvtap: left promiscuous mode [ 64.468292][ T3440] veth1_vlan: left promiscuous mode [ 64.473598][ T3440] veth0_vlan: left promiscuous mode [ 64.627301][ T5581] chnl_net:caif_netlink_parms(): no params data found [ 64.692335][ T5631] loop7: detected capacity change from 0 to 512 [ 64.711842][ T5581] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.719061][ T5581] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.729814][ T5631] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 64.740662][ T5631] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a842e01c, mo2=0002] [ 64.749832][ T5581] bridge_slave_0: entered allmulticast mode [ 64.757593][ T5631] System zones: 1-12 [ 64.763078][ T5581] bridge_slave_0: entered promiscuous mode [ 64.770519][ T5631] EXT4-fs (loop7): orphan cleanup on readonly fs [ 64.778629][ T5581] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.786012][ T5581] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.795290][ T5631] EXT4-fs error (device loop7): ext4_validate_block_bitmap:441: comm syz.7.497: bg 0: block 361: padding at end of block bitmap is not set [ 64.810511][ T5631] EXT4-fs error (device loop7) in ext4_mb_clear_bb:6550: Corrupt filesystem [ 64.821667][ T5581] bridge_slave_1: entered allmulticast mode [ 64.828649][ T5631] EXT4-fs error (device loop7): ext4_clear_blocks:876: inode #11: comm syz.7.497: attempt to clear invalid blocks 33619980 len 1 [ 64.842922][ T5581] bridge_slave_1: entered promiscuous mode [ 64.855120][ T5631] EXT4-fs error (device loop7): ext4_free_branches:1023: inode #11: comm syz.7.497: invalid indirect mapped block 1811939328 (level 0) [ 64.875557][ T5631] EXT4-fs error (device loop7): ext4_free_branches:1023: inode #11: comm syz.7.497: invalid indirect mapped block 2 (level 2) [ 64.897189][ T5581] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 64.906272][ T5631] EXT4-fs (loop7): 1 truncate cleaned up [ 64.907995][ T5581] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 64.952074][ T5581] team0: Port device team_slave_0 added [ 64.959842][ T5581] team0: Port device team_slave_1 added [ 64.980773][ T4412] EXT4-fs error (device loop7): ext4_map_blocks:671: inode #2: block 5: comm syz-executor: lblock 0 mapped to illegal pblock 5 (length 1) [ 65.004709][ T4412] EXT4-fs warning (device loop7): dx_probe:823: inode #2: lblock 0: comm syz-executor: error -117 reading directory block [ 65.019199][ T5581] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.026200][ T5581] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.052265][ T5581] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.072886][ T5581] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.080360][ T5581] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.106305][ T5581] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.163650][ T5581] hsr_slave_0: entered promiscuous mode [ 65.169910][ T5581] hsr_slave_1: entered promiscuous mode [ 65.177090][ T5581] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 65.184939][ T5581] Cannot create hsr debugfs directory [ 65.293991][ T5581] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 65.306344][ T5648] EXT4-fs unmount: 1 callbacks suppressed [ 65.306358][ T5648] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 65.321619][ T29] kauditd_printk_skb: 104 callbacks suppressed [ 65.321633][ T29] audit: type=1400 audit(1732038413.892:1408): avc: denied { unlink } for pid=2997 comm="syslogd" name="messages.0" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.356108][ T48] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.386663][ T5581] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 65.405685][ T5581] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 65.418480][ T48] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.441893][ T5581] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 65.472421][ T48] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.487031][ T5688] dccp_close: ABORT with 1 bytes unread [ 65.536214][ T5581] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.543270][ T5581] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.550687][ T5581] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.557739][ T5581] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.588147][ T29] audit: type=1326 audit(1732038414.162:1409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5694 comm="syz.0.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 65.611650][ T29] audit: type=1326 audit(1732038414.162:1410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5694 comm="syz.0.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 65.641663][ T29] audit: type=1326 audit(1732038414.162:1411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5694 comm="syz.0.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 65.665083][ T29] audit: type=1326 audit(1732038414.162:1412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5694 comm="syz.0.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 65.688612][ T29] audit: type=1326 audit(1732038414.162:1413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5694 comm="syz.0.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 65.711937][ T29] audit: type=1326 audit(1732038414.162:1414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5694 comm="syz.0.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 65.735474][ T29] audit: type=1326 audit(1732038414.162:1415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5694 comm="syz.0.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 65.758771][ T29] audit: type=1326 audit(1732038414.162:1416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5694 comm="syz.0.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 65.782367][ T29] audit: type=1326 audit(1732038414.162:1417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5694 comm="syz.0.503" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe249c9e759 code=0x7ffc0000 [ 65.823903][ T48] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.850211][ T3410] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.865653][ T3410] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.882554][ T5676] lo speed is unknown, defaulting to 1000 [ 65.937046][ T48] bridge_slave_1: left allmulticast mode [ 65.942717][ T48] bridge_slave_1: left promiscuous mode [ 65.948438][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.963683][ T48] bridge_slave_0: left allmulticast mode [ 65.969624][ T48] bridge_slave_0: left promiscuous mode [ 65.975417][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.128055][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 66.144383][ T48] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 66.163019][ T48] bond0 (unregistering): Released all slaves [ 66.207337][ T5581] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.343217][ T5689] lo speed is unknown, defaulting to 1000 [ 66.353043][ T48] hsr_slave_0: left promiscuous mode [ 66.366508][ T48] hsr_slave_1: left promiscuous mode [ 66.372307][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 66.379738][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 66.407610][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 66.415027][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 66.434007][ T3015] ================================================================== [ 66.442106][ T3015] BUG: KCSAN: data-race in dont_mount / step_into [ 66.448524][ T3015] [ 66.450842][ T3015] read-write to 0xffff8881067a2480 of 4 bytes by task 3302 on cpu 0: [ 66.458989][ T3015] dont_mount+0x2a/0x40 [ 66.463143][ T3015] vfs_unlink+0x298/0x430 [ 66.467475][ T3015] do_unlinkat+0x237/0x4d0 [ 66.471888][ T3015] __x64_sys_unlink+0x2e/0x40 [ 66.476569][ T3015] x64_sys_call+0x2329/0x2dc0 [ 66.481251][ T3015] do_syscall_64+0xc9/0x1c0 [ 66.485745][ T3015] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.491640][ T3015] [ 66.493959][ T3015] read to 0xffff8881067a2480 of 4 bytes by task 3015 on cpu 1: [ 66.501491][ T3015] step_into+0x12f/0x810 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 66.505739][ T3015] walk_component+0x169/0x230 [ 66.510416][ T3015] path_lookupat+0x10a/0x2b0 [ 66.515018][ T3015] filename_lookup+0x150/0x340 [ 66.519966][ T3015] do_readlinkat+0x89/0x210 [ 66.524471][ T3015] __x64_sys_readlink+0x47/0x60 [ 66.529328][ T3015] x64_sys_call+0x28ba/0x2dc0 [ 66.534007][ T3015] do_syscall_64+0xc9/0x1c0 [ 66.538517][ T3015] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.544422][ T3015] [ 66.546740][ T3015] value changed: 0x00600008 -> 0x00008008 [ 66.552448][ T3015] [ 66.554769][ T3015] Reported by Kernel Concurrency Sanitizer on: [ 66.560921][ T3015] CPU: 1 UID: 0 PID: 3015 Comm: udevd Tainted: G W 6.12.0-syzkaller-00971-g158f238aa69d #0 [ 66.572293][ T3015] Tainted: [W]=WARN [ 66.576080][ T3015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 66.586123][ T3015] ================================================================== [ 66.599210][ T48] veth1_macvtap: left promiscuous mode [ 66.604889][ T48] veth0_macvtap: left promiscuous mode [ 66.610508][ T48] veth1_vlan: left promiscuous mode [ 66.615786][ T48] veth0_vlan: left promiscuous mode [ 66.700923][ T48] team0 (unregistering): Port device team_slave_1 removed [ 66.710570][ T48] team0 (unregistering): Port device team_slave_0 removed [ 66.909529][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 67.109026][ T48] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.168404][ T48] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.211266][ T48] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.268201][ T48] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.426321][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 67.437045][ T48] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 67.446746][ T48] bond0 (unregistering): Released all slaves [ 67.478409][ T48] tipc: Left network mode [ 67.532133][ T48] hsr_slave_0: left promiscuous mode [ 67.539894][ T48] hsr_slave_1: left promiscuous mode [ 67.547393][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 67.554943][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 67.565387][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 67.572850][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 67.592228][ T48] veth1_macvtap: left promiscuous mode [ 67.597746][ T48] veth0_macvtap: left promiscuous mode [ 67.603243][ T48] veth1_vlan: left promiscuous mode [ 67.608537][ T48] veth0_vlan: left promiscuous mode [ 67.671560][ T48] team0 (unregistering): Port device team_slave_1 removed [ 67.682887][ T48] team0 (unregistering): Port device team_slave_0 removed [ 68.193810][ T48] bridge_slave_1: left allmulticast mode [ 68.199698][ T48] bridge_slave_1: left promiscuous mode [ 68.205368][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.213024][ T48] bridge_slave_0: left allmulticast mode [ 68.218689][ T48] bridge_slave_0: left promiscuous mode [ 68.224390][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.298213][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 68.308070][ T48] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 68.317851][ T48] bond0 (unregistering): Released all slaves [ 68.363732][ T48] hsr_slave_0: left promiscuous mode [ 68.369454][ T48] hsr_slave_1: left promiscuous mode [ 68.375128][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 68.384001][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 68.436536][ T48] team0 (unregistering): Port device team_slave_1 removed [ 68.449699][ T48] team0 (unregistering): Port device team_slave_0 removed