last executing test programs: 1m49.415265109s ago: executing program 0 (id=1213): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100000000001c000000000000ea04850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='cachefiles_mark_inactive\x00', r0}, 0x18) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) perf_event_open(&(0x7f0000000400)={0x5, 0x80, 0x0, 0x0, 0x0, 0x5, 0x82, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) (async) creat(0x0, 0x48) (async, rerun: 32) pipe2$9p(0x0, 0x0) (async, rerun: 32) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x8e) (async) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="18010000008000000000000000000004850000006d00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) (async) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x0, 0x81, &(0x7f0000000280)="1a00000002000000", 0x5b) close(r2) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000340)=ANY=[], 0x7c8) mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800"], 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xd, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async, rerun: 32) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async, rerun: 32) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000), 0x4) (rerun: 32) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r3) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) (async, rerun: 64) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) (rerun: 64) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r4, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) (async, rerun: 32) shutdown(r4, 0x1) (rerun: 32) 1m49.414916648s ago: executing program 0 (id=1214): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c40)={{0x14}, [@NFT_MSG_NEWRULE={0x268, 0x6, 0xa, 0x40b, 0x24000000, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x23c, 0x4, 0x0, 0x1, [{0x238, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x228, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x214, 0x3, "d67a8527f76ec1d39e537c4c3060c6a405106c72848aa8bcb429b3a20d532452032d5f166334739d1719a5778bd4f724ee4ca57f2527aeeb0c75755d68fc6fa55f4825682ee95e581039823e5963beedcf65b8b005623d90772b8b6ebd2498b0aff725a3eabb6c99cb2edfe10b9c33be8a971e08401bc0807e75a2ff376b7934473bc1f02bb512b77414daf260c9c7d4e1f0758b56ec5823892af310e6252fcfb1d9dbaddefdaa26f43f12f831fd221926d6536eeff641db46920ae0e48f3ff5de599714ba6510ce479d4116a519792281736f39c9fc0e10ef557392c43389271cebcf36543fcf6f83bf74b93ee4eb5e8c82e35bb4784cc1ed0ad291b16e8368487589f7590bf5896f340a36555a1cf69736da230a809176dbdfba3d47efb9a6932e5503d277532b7d4e6f7c7373a298e5843a9f74d5fd07fbc6ad22bc644ba9b3c94ec3c8f0b9321b16e5826b1f058f781760a5d4b6a8880202b41689139c37cd51f65a92d883f8901add03b650c9ec182fb565a4d657ebba9d6a5eb426b22d5933b72362e6ec327fb679aa8034b8b3b6680ad138be47652a3e77981187d2921cebfc1639aa280e3d38dba9b1af49ceded79c78a2d656b3a3e946e17e6257def6679f70f11aa01a2d906aecf4dbc7d1a332a8932ed719ce7eecb5450f494f944b3f6b637502ddba609c6e45dcfad1db7c7dda3e2c755ddcf27132985442e9b8df16f96c82e72e3e2491856d07756b9f"}, @NFTA_MATCH_NAME={0x8, 0x1, 'bpf\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x290}}, 0x4048014) 1m49.397493509s ago: executing program 0 (id=1216): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f000000850000000500000095"], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_buf(r1, 0x6, 0x21, &(0x7f0000000280)="dc8daf8d760c0b8caa98fa19c6a35a18883775d272c579ff33a6effc0c49320f", 0x20) getsockopt$inet_tcp_buf(r1, 0x6, 0x21, 0x0, &(0x7f0000000580)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)=@generic={&(0x7f0000000080)='./file0\x00', 0x0, 0x18}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000014c0)=[{0x200000000006, 0x1, 0x7, 0x7ffc1ffb}]}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000001480)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a0ef010095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000200)='kmem_cache_free\x00', r2}, 0x18) syz_mount_image$ext4(0x0, &(0x7f0000000140)='./file0\x00', 0x2000000, 0x0, 0x0, 0x0, &(0x7f0000000000)) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1c, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a500850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r5}, 0x10) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000600)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}}) wait4(0x0, 0x0, 0x40000000, 0x0) r6 = socket$caif_stream(0x25, 0x1, 0x1) recvmmsg(r6, &(0x7f0000004340)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x1, 0x0) timer_gettime(0x0, 0x0) set_mempolicy(0x3, &(0x7f0000000000)=0x4000000ffb, 0x8) syz_clone(0x4021400, 0x0, 0x9000, 0x0, 0x0, 0x0) 1m49.283744021s ago: executing program 0 (id=1218): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) statx(0xffffffffffffffff, &(0x7f0000002340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000, 0x10, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000040)='./file0\x00', 0x100c404, &(0x7f0000000240)={[{@dots}, {@nodots}, {@fat=@uid}, {@fat=@uid={'uid', 0x3d, 0xee00}}, {@dots}, {@nodots}, {@fat=@gid={'gid', 0x3d, 0xee00}}, {@nodots}, {@nodots}, {@nodots}, {@nodots}, {@nodots}, {@nodots}, {@nodots}, {@nodots}, {@fat=@nfs}, {@nodots}, {@nodots}, {@fat=@flush}, {@fat=@umask={'umask', 0x3d, 0x7}}, {@nodots}, {@dots}]}, 0x1, 0x1f5, &(0x7f0000000600)="$eJzs3cFqE1EUANCbmCYTcdGdIAgjLnRV1C+oSAUxIFSy0J2gK7NqN6mb9jP8Bf/LD5CuspEncSadmKYxBDKj7Tmb3pn7Xt+7M2SSTW5SFL7f/RpZ1or2fuzHpBW70Y6ZswAArpNJSvEjFZreCwBQjzXe/3/WvCUAYMvevnv/+vlgcHCY51nE+dl4OB4Wf4v8y1eDgyf5b7vVrPPxeHjrIv80X/zsMM3vxO0y/6yYn1+kuxEx7Mbjh0V+mnvxZpD/Ob8XH7dcOwAAAAAAAAAAAAAAAAAAAAAANOV+5DNL+/vs7S3m+2W+OJrrD7TQv6cT9zrlYdUeKJ3WURQAAAAAAAAAAAAAAAAAAAD8Z45Pvnz+MBp9OqqCXkTMn+ksGXN10Cr/8VqDmw/asdn0flnmBou2yku03QL7y2/uOkF0/pW7s2mQ17BWf+XlTWkaLH8VzNpiXDm9GxGrV390uOnmJyml0bcHR8cnkVYOrp4RvVqfSAAAAAAAAAAAAAAAAAAAcHPNfev7kqyJDQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAA6rf/58Gl8+sDE4j4k78dfBsrZ3IGq0VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA6+tXAAAA//85ziI4") r2 = mq_open(&(0x7f000084dff0)='\xa1sxt\x1a\x00\x00\x00\x00\x00\x00\x00\x01\x88\xbdd', 0x6e93ebbbcc0884f2, 0x100, &(0x7f0000000300)={0x0, 0x1, 0x3}) mq_timedsend(r2, 0x0, 0x0, 0xb, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x109}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000080)='kfree\x00', r3}, 0x18) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) umount2(&(0x7f0000000340)='./file0/file0\x00', 0x1) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kfree\x00', r5}, 0x18) openat(0xffffffffffffffff, 0x0, 0x101242, 0x160) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mq_timedsend(r2, 0x0, 0x0, 0x0, 0x0) mq_timedreceive(r2, &(0x7f0000000180)=""/204, 0xcc, 0x0, 0x0) 1m49.123397834s ago: executing program 0 (id=1221): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180200000020702500000000002020207b1af8ff00000000bfa100000000000007010000dbffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x23, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000340)='kfree\x00', r0, 0x0, 0xfffffffffffffffc}, 0x18) dup3(r0, r0, 0x80000) r1 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0xffffff5d}, 0x1c) listen(r1, 0x50) r2 = socket$inet(0x2, 0x80001, 0x84) bind$inet(r2, &(0x7f0000000180)={0x2, 0xce20, @local}, 0x10) listen(r2, 0x3) close(0x4) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='attr/fscreate\x00') writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000040)="dc", 0x1}], 0x8) 1m49.102726884s ago: executing program 0 (id=1222): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, 0x0, 0x0, 0x0, 0x10b8}, 0x0) 1m49.066881435s ago: executing program 32 (id=1222): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, 0x0, 0x0, 0x0, 0x10b8}, 0x0) 2.899403775s ago: executing program 1 (id=3600): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0x22, &(0x7f0000000000)={{0xa, 0xfffc, 0x103, @loopback, 0xa3c}, {0xa, 0xfffe, 0xfffffffd, @dev={0xfe, 0x80, '\x00', 0x12}, 0x4}, 0x1000, {[0x9, 0xdaa, 0x7fff, 0x31, 0x5, 0x1, 0x6d2e, 0xc33]}}, 0x5c) socket(0x11, 0xa, 0x8) syz_emit_ethernet(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cgroups\x00', 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r3 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e22, @broadcast}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) flock(r4, 0x1) close_range(r2, 0xffffffffffffffff, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004d808}, 0x20030004) 2.852546186s ago: executing program 1 (id=3603): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f00000002c0)='+}[@\x00G5\v\x89n\xb2\x0e\xb7\xb4\x9a\xb3\xb9\xe1\xff@`\x87\xefy\xb7\xe0\xe6c\x91\x81ND\t3\xc4\xca\xf0\xd0Zp\xadbdY\xdcz\xc6lo\xd0\xc7\'CT') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="58000000020605000000000000000000000000000900020073797a3100000000050005000a000000050001000600000013000300686173683a6e65742c696661636500000c0007800800124005000000050004"], 0x58}, 0x1, 0x0, 0x0, 0xc090}, 0x800) 2.771371887s ago: executing program 4 (id=3604): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0700000004000000800000000e"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r2}, 0x10) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8040, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000040)={0x0, 0xffffffff, 0x1, 0x0, 0x90, "ff00f7000000000000000020af88008300"}) r5 = syz_open_pts(r4, 0x141601) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) write(r5, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TCSETSF(r5, 0x5404, &(0x7f0000000080)={0x400008, 0x1ffffffe, 0x0, 0x200007, 0x19, "680c1acfa4a5000000070000faffffff000800"}) pipe(&(0x7f0000000180)) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000940)=ANY=[@ANYBLOB="1800000000000000000000000700000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b000000070000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r7}, 0x18) 2.351328906s ago: executing program 3 (id=3607): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000021007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r2}, 0x8) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'syztnl0\x00', &(0x7f0000000540)={'gretap0\x00', 0x0, 0x700, 0x8, 0x5, 0x0, {{0xf, 0x4, 0x0, 0x19, 0x3c, 0x67, 0x0, 0xa9, 0x29, 0x0, @remote, @remote, {[@timestamp={0x44, 0x28, 0x44, 0x0, 0x6, [0x5, 0x86, 0xfffffffb, 0xf74, 0x2, 0xf, 0x80000001, 0x4a, 0x800]}]}}}}}) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a000020095b344bfec0c2b61cd0125f01b3ae27c6d13333ce7014f9b09fff75f9fea7de56becf3134ba6a7008489bff4517185ecb90abe0334c79af774fe1cca61e3e661d8f397d54651c57b1bedeb67fb48ba91a2717a91f21b5fdcca4152a0a3328179a5a1481ad8d0328f19fde1d7"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r3, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000200)='kmem_cache_free\x00', r4}, 0x10) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, 0x0, 0x2) r5 = socket$packet(0x11, 0x2, 0x300) socket$nl_netfilter(0x10, 0x3, 0xc) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x1}, 0x4) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x3, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) 2.345455846s ago: executing program 5 (id=3608): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x21}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1200, 0x0, 0x14080, 0x10000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r2}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) 2.334106746s ago: executing program 3 (id=3609): syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r3], 0x1c}}, 0x0) sendmsg$NFC_CMD_LLC_SET_PARAMS(r0, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000540)={&(0x7f0000000340)={0x3c, r1, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NFC_ATTR_LLC_PARAM_MIUX={0x6, 0x11, 0x174}, @NFC_ATTR_LLC_PARAM_MIUX={0x6, 0x11, 0x31d}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_LLC_PARAM_MIUX={0x6, 0x11, 0xa4}, @NFC_ATTR_LLC_PARAM_LTO={0x5, 0xf, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x80) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="bc0100001900010000000000fffffffffc020000000000000000000000000000fc02000000000000000000000000000100000006000000000a00000008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000c0000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000000000000000000000dd020000000000000000000000000000000100020000000004010500ac14143b000000000000000000000000000004d32b00000000000000ac141435000000000000000000000000000000000000ff00000000000000000000000000fc000000000000000000000000000001000000003200000000000000ac1414aa000000000000000000000000000000400100000000000000ffffffff000000000a010101000000000000000000000000000000003c000000dffffffffb00000000000000000000000000000100000000010300"], 0x1bc}}, 0x0) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x33, &(0x7f0000000640)={0x1, &(0x7f0000000680)=[{0x6, 0x0, 0x0, 0x2}]}, 0x10) bind$inet6(r6, &(0x7f0000000000)={0xa, 0x4e20, 0x4, @loopback, 0x7}, 0x1c) listen(r6, 0xb) sendmsg$IEEE802154_ASSOCIATE_RESP(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, 0x0, 0x800, 0x70bd26, 0x25dfdbfb, {}, [@IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x6000004) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c00"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r9}, 0x10) mount$9p_rdma(&(0x7f00000013c0), &(0x7f0000001400)='.\x00', &(0x7f0000001440), 0x800, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=rdma,']) 2.10676801s ago: executing program 5 (id=3612): openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x50}}, 0x4008840) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a030200020000000000000200000009000200"], 0x80}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000000010000000900010073797a30000000000900020073797a3000000000400003800800014000000000080002400000fbff2b0003801400010067656e6576653000000000000000000014000100776732000000000000000000c6e49c0f5c000000180a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380140001"], 0x110}}, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00'}, 0x18) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000001480)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a0ef010095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000200)='kmem_cache_free\x00', r2}, 0x18) mq_open(0x0, 0x1, 0x109, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$KDFONTOP_SET(r3, 0x4b72, &(0x7f0000000080)={0x0, 0x0, 0x8, 0x1b, 0x100, &(0x7f00000000c0)="387ed7626d850509a2d6c1aa38f15cd00f85c263cb226db671261fff7ce9c555f189afae3530db6dd493f28fd988721b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef495689092883b902a41cd75387ef6f7bc7d460d5e665f398ff95596dc94ec97003a3db08e500c2fb07e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1f7a1e850ecb3421143c5c4ded0f083a0c524dcf320827266819b6a952db5bc96141b26c54db857edbcbbc81c7af7aadf50bc549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3a256c7520b285d8da0dbf5e20d604413ed2ddf9bcbf881caf811852806175d63892a15234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d77881387fdeaa02863be90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695ef060000001bbe1b649f42f310859122c0d2c1e558dc6586958a28374f386ecf369274e43003a09b5159ea515eb44521901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc509254a12cece59181fcb5bad8c24bd9f8f78d17ab01831325501e80d899e9252f99d3a2666343392fda115048e4f4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd3330000000000000009a3237aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b5b66ab89d2d6333f699b16db68986ab3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9b647ba812f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d14df8aa9df6f40a80ace2bb8a2aad3b0c66915927db4173181943d88c0c76d5969e2043db5bd77fd60ba0f012139929ccfec965c1f769785a4d23332d71f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fdc1bc31152538db50f47dc38ba908a0d808687e478a609fe0daa0000000000000000e7f2e98597e27f3e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d4794ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e8fd4e71929f918b98c4cbfcb11a90139264a9ee807c973167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d174d2465380b1a00ddc42915e4f3a5db640600000095a3d63904c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e04c93a5470774975b42091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00000000ddffffff00"}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18020000ffffffff00000000000000001801000011646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000007d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000400)='itimer_state\x00'}, 0x10) syz_usb_disconnect(r1) 1.890146784s ago: executing program 4 (id=3614): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000010000000a00000008"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f0000000200), &(0x7f0000000240)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000002000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/ip_mr_vif\x00') lseek(r2, 0x47, 0x0) 1.871571315s ago: executing program 4 (id=3615): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001340)={0xffffffffffffffff, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0], 0x0, 0x64, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x86, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r2, {0x7, 0xa}, {0xd, 0xc}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC=r0, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0xc, 0x0, 0x0, 0x40f00, 0x45, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r4, 0x0, 0x1}, 0xb) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$sock_int(r5, 0x1, 0x29, &(0x7f0000000300)=0x20, 0x4) readv(r5, &(0x7f0000000000)=[{&(0x7f0000000340)=""/4096, 0x1000}], 0x1) write$binfmt_misc(r5, &(0x7f0000000300), 0x6) r6 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r7 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000054850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r8}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010025bd7000fbdbdf2101"], 0x38}, 0x1, 0x0, 0x0, 0xc0d4}, 0x4000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r7, 0x0) write$selinux_load(r6, &(0x7f0000000000)=ANY=[], 0x603f) 1.807547196s ago: executing program 1 (id=3619): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x12, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) (async) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYRES8=r2], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="00000000000000b70300e2ec000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r4}, 0x18) (async) getpid() (async) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) (async) r7 = socket$netlink(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r8, 0x1, 0x200000, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40840d4}, 0x0) r9 = dup(0xffffffffffffffff) write$binfmt_aout(r9, 0x0, 0x808) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001800)={0x6, 0x3, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000000c950000"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r6}, 0x94) (async) openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) (async) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r11}, 0x10) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) 1.466047753s ago: executing program 3 (id=3621): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYRES32], &(0x7f0000000540)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) fsetxattr$trusted_overlay_nlink(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) sched_setscheduler(0x0, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0xd9}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r3}, 0x18) unshare(0x42000000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000340)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xd, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'macsec0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5800000010000304000000000000000400000000", @ANYRES32=0x0, @ANYBLOB="15020000044402001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r5, @ANYBLOB="08000400030000000a000200bbbbbbbbbbbb0000"], 0x58}, 0x1, 0xba01}, 0x40) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x0, 0x4b, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x7, 0x0, 0x401}, 0x50) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r6, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fdff00000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0xe, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r8}, 0x16) syz_mount_image$iso9660(&(0x7f0000000cc0), &(0x7f0000000180)='./file0\x00', 0x100c085, &(0x7f0000001640)=ANY=[], 0x10, 0x7f4, &(0x7f0000000e40)="$eJzs3U9oHOfZAPBnFMl2FD5/Id9HPmMcZ2znA5s6ymqVKBU5pJvVSJ5ktSt2V8WmlMTEcjCWk5AQ0pjS1JekLS2lpx7TXEMuubUUWuih7anQHHrpoRDIpSUtLZSWUnDZ2V1r9Wcl/5HlNP39RPadfeeZd953drLPznpnJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACASKqzpdJkErW8vnQ6Ha4622wsbDG/395P1xRbrDci6fwX+/bFgW7Vgf9dnX1/5+FoHOo+OxT7OsW+uHzP/fc+8T+jI/3lt+jQzToyfNbY4JMk4uudTl08u7Ky/Mpt6Mgu+taPexP7rnuRv1/tPM5n9bzVyBcq81matxrpzPR06ZFTc610Lq9lrTOtdraQVptZpd1opserJ9LJmZmpNJs401iqz89Walm/8vGHy6XSdPr0xGJWabYa9UeenmhVT+W1Wl6fL2LKpdejE/N4Z0d8Jm+n7ayykKbnL6wsT23X1U7Q5JqavWt2nEMP3fvxax/95cJyZ4cc1kjS2zHLk5Pl8uT0YzOPPV4qjZZL5bUVpXXiWkSMRHQibstOy511zyZ1o709ZsOMiKv/vTNv3nCLRnr5P2qRRz2W4nSkkcZI8bj6NxbVmI1mNGKh8/w3Y+vmb8j////IH3+11XoH838/yx9YnX0wivx/uPvs8LD8v6EXO/A3OqzV+vvd3gzWvRpvxOW4GGdjJVZiOV65mTXuWd/qbfwb2dn25iOLeuTRikbksRCVoibt1aQxE9MxHaV4Nk7FXLQijbnIoxZZtOJMtKIdWbFHVaMZWVSiHY1oRhrHoxonIo3JmImZmIo0spiIM9GIpajHfMxGpWjlfFwotvvUun7d/7XnfvTCrz9+pzN9LWhyi4EknQ9znaA/bxG0Id3fQP7vRIz09u5dyUnskn03+Kru0Ds33LqrRf4fvdPdAAAAAG6jpPj2PYmIsXigmJrLa9mX7nS3AAAAgB1U/K75UKcY60w9EEnn+L+0SeSHu943AAAAYGckxTl2SUSMx4Pdqf7pUpt9CQAAAAD8Gyr+/f9wpxiPeLOocPwPAAAAnzHfGHaN/Y/29K6x21rcm/zkT9FsjiVXFk8/lFyqdOIql+7qLtcrvnitxfbcwWR/r5GimB69fE8SEaPV7FDSv/rlP/d2y0+Kx4OrFyAcdq3/ZJsOxNYdKJ7Ft+NIN+bIuW55rj+nu5bxubyWTVQbtScmk96XI+3XXrzwlSiG/836wv4kzl9YWZ54/qWVc0VfrnRauXKpd3n4pL9URPeEii36crW3BeKBzUc8VpyI0VvveHe9pcHx964mO7L1+JPBdb4VR7sxR8e75fja8e/rrHNy4onJqFT2j7Sz0+3Xrg6MvteLydWR7+2PNrmBV+GtONaNOXb8WLfYpBflNb14cWMvyoPb//q2xXX34p0jb57+688bSTa1XS+mbrEXAHfK+eKqP6tZ6O4iC/3jalcnoa3Lu3f3l7yRd7nzq58y+ssP5LrR2JDd05vJ7m/F8W7M8e7nidGDm+SV0ibv6C9fePkXvXf0R9/7/g++fPiXH6zL6zfQi/fiRDemV8R9PxuSYztj/s66rPpuZ4l3h663VSsnr++dGku6Nx+Kyw9fuHT2heUXll8sl6emS4+WSo+VY6z4qNArhvRU5gH4z7bdPXY++Oq10GF34Uke3eao+r5rPymYiOfjpViJc3GyONsgIh7cvNXxgZ8hnNzmqHV84A4vJ7c5tlyNLa+P3XssiSGxUwNb7P++VxR/u00vCADsgqPb5OEk7u3Of/2/ekusi7grSU5uc9y9Npef6N44t390HMNz+aDf98rP3/YtAgCffVnzk2S8/XbSbOaLz07OzExW2qeytNmoPpM289n5LM3r7axZPVWpz2fpYrPRblT7Xx3PZq20tbS42Gi207lGM11stPLTxZ3f096t31vZQqXezqutxVpWaWVptVFvV6rtdDZvVdPFpadqeetU1iwWbi1m1Xwur1baeaOethpLzWo2kaatLBsIzGezejufy7OxNK+ni818odK8EhG1pYUsnc1a1Wa+2G50G+yvK6/PNZoLRbMTG4f/h93e3gDwafDqG5cvnl1ZWX7l5iZ+ez3Bd3qMAMBasjQAAAAAAAAAAAAAAHz6bTxdr1N7QycCjsVNnz746t64lbMPP3sTn3u/+7LsRIO30s7da17TPb2d5c5vnxueeO7JJy+u1iSjg5v3qTcPnPpdFv3RbdHO5v+nbHaq69v7I/b88Lvdmi8MCU5Gd3ikH0bETSx+NdkiZvffiwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgO/8KAAD//wifUTs=") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) ptrace(0x10, r7) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x10, r7) ptrace$peeksig(0x4209, r7, &(0x7f0000000140)={0x0, 0x0, 0x4e}, &(0x7f0000000fc0)) syz_io_uring_setup(0x3c0c, &(0x7f0000000400)={0x0, 0xc890, 0x4002, 0x4}, 0x0, 0x0) 1.465775282s ago: executing program 1 (id=3622): socket$inet_udplite(0x2, 0x2, 0x88) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r0}, 0x10) socket$kcm(0x10, 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000001140)='ext4\x00', &(0x7f0000000e40)='./file2\x00', 0x410c84, &(0x7f0000000340), 0x1, 0x775, &(0x7f0000001180)="$eJzs3c9rXNUeAPDvnSRNm/a95MGD9+oqIGigdGJqbBVcVFyIYKGga9thMg01k0zJTEoTAlpEcCOouBB007U/6s6tP7b6X7gQS9W0WHEhkTu5t502M2mSJpnqfD5wM+fceyfnfOf+OGfmHu4NoGeNpn8KEYcj4t0kYjibn0TEQDPVH3Fybb1bK8vldEpidfXlX5LmOjdXlsvR8p7UwSzz/4j45q2II4X15dYXl2ZK1WplPsuPN2YvjNcXl46eny1NV6Yrc8cnJiePnXjqxPGdi/W375cOXXvvhcc/P/nHm/+7+s63SZyMQ9my1jh2ymiMZp/JQPoR3uX5nS6sy5JuV4BtSQ/NvrWjPA7HcPQ1UwDAP9nrEbEKAPSYRPsPAD0m/x3g5spyOZ+6+4vE3rr+XETsX4s/v765tqQ/u2a3v3kddOhmcteVkSQiRnag/NGI+PjLVz9Np9il65AA7bxxOSLOjoyuP/8n68YsbNUTGyzbl72O3jPf+Q/2zldp/+fpdv2/wu3+T7Tp/wy2OXa3477H/4EdKGQDaf/v2Zaxbbda4s+M9GW5fzX7fAPJufPVSnpu+3dEjMXAYJqf2KCMsRt/3ui0rLX/9+v7r32Slp++3lmj8FP/4N3vmSo1Sg8Sc6vrlyMe6W8Xf3J7+ycd+r+nN1nGi8+8/VGnZWn8abz5tD7+yEYn7Y7VKxGPtd3+d0a0JRuOTxxv7g7j+U7Rxhc/fDjUqfzW7Z9Oafn5d4G9kG7/oY3jH0lax2vWt17Gd1eGv+607P7xt9//9yWvNNN5P+JSqdGYn4jYl7y0fv6xO+/N8/n6afxjj7Y//jfa/9PvhGc3GX//tZ8/2378uyuNf2pL23/riau3Zvo6lb+57T/ZTI1lczZz/ttsBR/kswMAAAAAAAAAAAAAAAAAAAAAAACAzSpExKFICsXb6UKhWFx7hvd/Y6hQrdUbR87VFuamovms7JEYKOS3uhxuuR/qRHY//Dx/7J78kxHxn4j4YPBAkt9HcarLsQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA7mCH5/+nfhzsdu0AgF2zv9sVAAD2nPYfAHqP9h8Aeo/2HwB6j/YfAHqP9h8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBddvrUqXRa/X1luZzmpy4uLszULh6dqtRnirML5WK5Nn+hOF2rTVcrxXJt9n7/r1qrXZiMuYVL441KvTFeX1w6M1tbmGucOT9bmq6cqQzsSVQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsDX1xaWZUrVamZfYRmL14ahG9xN92e70sNRnTxPJw1GNHU50+cQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8DfxVwAAAP//02Ii/w==") bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000700000010000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000300)='sched_switch\x00', r6}, 0x18) open(0x0, 0x0, 0x68) setns(r2, 0x24020000) setresuid(0xee00, 0xee01, 0x0) syz_clone(0xd5986500, 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.465411512s ago: executing program 2 (id=3623): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x3, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x8d) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, 0x0, &(0x7f0000000000)=""/3, 0x2}, 0x20) 1.432075153s ago: executing program 2 (id=3624): r0 = socket$isdn(0x22, 0x3, 0x26) getpeername(r0, &(0x7f0000000000), &(0x7f0000000080)=0x80) (async) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80080) r3 = syz_io_uring_complete(0x0) write$binfmt_format(r3, &(0x7f0000000100)='1\x00', 0x2) io_uring_register$IORING_UNREGISTER_RING_FDS(r3, 0x15, &(0x7f0000000600)=[{0x5, 0x1, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)=""/17, 0x11}, {&(0x7f0000000180)=""/150, 0x96}, {&(0x7f0000000240)=""/60, 0x3c}, {&(0x7f0000000280)=""/127, 0x7f}, {&(0x7f0000000300)=""/76, 0x4c}], &(0x7f0000000400)=[0x3e, 0x3]}, {0x2, 0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000440)=""/146, 0x92}, {&(0x7f0000000500)=""/98, 0x62}], &(0x7f00000005c0)=[0xa, 0x4, 0x1, 0x4, 0x3, 0xa, 0x40, 0x80000000]}], 0x2) (async) socketpair(0x8, 0x4, 0x9, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x30, 0x1404, 0x1, 0x70bd2d, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040040}, 0x20008091) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000800)={{r2, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f00000007c0)=r3}, 0x20) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r6, 0x80089419, &(0x7f0000000840)) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x7, 0x1}, {0x9, 0xd}, {0x6, 0x10}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x8080) (async) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r4, 0x8002f515, &(0x7f0000000980)) (async) ioctl$TCXONC(r3, 0x540a, 0x0) (async) fcntl$addseals(r1, 0x409, 0x4) (async) r7 = accept4$inet(r5, &(0x7f00000009c0)={0x2, 0x0, @dev}, &(0x7f0000000a00)=0x10, 0x800) accept4$inet(r7, &(0x7f0000000a40)={0x2, 0x0, @broadcast}, &(0x7f0000000a80)=0x10, 0x0) (async) setsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, &(0x7f0000000ac0)=0x4875, 0x2) (async) readv(r5, &(0x7f0000001100)=[{&(0x7f0000000b00)=""/130, 0x82}, {&(0x7f0000000bc0)=""/161, 0xa1}, {&(0x7f0000000c80)=""/70, 0x46}, {&(0x7f0000000d00)=""/142, 0x8e}, {&(0x7f0000000dc0)=""/49, 0x31}, {&(0x7f0000000e00)=""/204, 0xcc}, {&(0x7f0000000f00)=""/37, 0x25}, {&(0x7f0000000f40)=""/15, 0xf}, {&(0x7f0000000f80)=""/92, 0x5c}, {&(0x7f0000001000)=""/230, 0xe6}], 0xa) (async) ioctl$KDSKBENT(r3, 0x4b47, &(0x7f00000011c0)={0x8, 0x0, 0x2}) (async) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000001200)={0x3, 0x9, 0x8, 0x4, 0xff, 0x4, 0xb5, 0x0, 0x0}, &(0x7f0000001240)=0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x1f, &(0x7f0000001280)={r8, @in6={{0xa, 0x4e23, 0x4, @mcast2, 0x7}}, 0x5, 0x8000}, 0x90) ioctl$BTRFS_IOC_QUOTA_RESCAN(r4, 0x4040942c, &(0x7f0000001340)={0x0, 0x4, [0x7ff, 0x9, 0x9, 0x3, 0x3ca, 0xfffffffffffffff7]}) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000013c0), r4) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000001400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_BEACONS(r9, &(0x7f00000014c0)={&(0x7f0000001380), 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x28, r10, 0x100, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x1, 0x56}}}}, ["", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x20004090) fcntl$setstatus(r3, 0x4, 0x800) syz_open_dev$usbfs(&(0x7f0000001500), 0x9cc7, 0x107b21) (async) socket$kcm(0x29, 0x7, 0x0) (async) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000001580)={0x6, &(0x7f0000001540)=[{0x101, 0x0, 0x0, 0x81}, {0x0, 0x6, 0x5, 0xfffffff9}, {0x1, 0x1, 0x5}, {0x2727, 0x8, 0xcf}, {0x3, 0xfb, 0x5, 0x6ce}, {0x7, 0x5, 0xd, 0x6}]}) 1.362287025s ago: executing program 5 (id=3625): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000010000000a00000008"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f0000000200), &(0x7f0000000240)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000002000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/ip_mr_vif\x00') lseek(r2, 0x47, 0x0) 1.296065656s ago: executing program 5 (id=3626): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x13012, r0, 0x0) openat$rfkill(0xffffff9c, &(0x7f0000000040), 0x182, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f00000002c0)="9e", 0x1, 0x41, &(0x7f0000000200)={0xa, 0x4e23, 0x10003, @loopback, 0x7}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000300)={0x0, 0x200002, 0x30}, 0xc) sendto$inet6(r1, &(0x7f0000000040)='\v', 0x1, 0x20008081, 0x0, 0x0) writev(r1, &(0x7f0000000100)=[{&(0x7f00000000c0)='2', 0x1}], 0x1) r2 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x32}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r5, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="3800000010000507000000000004000000000000", @ANYRES32=r6, @ANYBLOB="0000000a010000001800120008000100736974000c0002000800030036887fbd52a5e1fcea0727799ee9e5e9baae5f8277"], 0x38}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=@newlink={0x58, 0x10, 0x439, 0x70bd2a, 0xffffffea, {0x0, 0x0, 0xe403, r7, 0x3, 0x610c3}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @sit={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r6}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @remote}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x2d}}, @IFLA_IPTUN_6RD_RELAY_PREFIX={0x8, 0xc, 0xffffffff}, @IFLA_IPTUN_TOS={0x5, 0x5, 0x16}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x4008040) r8 = fsmount(r2, 0x0, 0x20) symlinkat(&(0x7f0000000000)='.\x00', r8, &(0x7f0000000140)='./file0\x00') openat(r8, &(0x7f00000000c0)='./file0\x00', 0x515a02, 0x52abe154ad664fa4) getsockopt$EBT_SO_GET_INFO(r8, 0x0, 0x80, &(0x7f00000014c0)={'filter\x00', 0x0, 0x0, 0x0, [0x100000000, 0x0, 0x5, 0x40, 0x800, 0x7]}, &(0x7f0000001540)=0x78) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000340)=',', 0x34000}], 0x1) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r9 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x400, 0x0, 0x1a5}, &(0x7f0000001480)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r9, 0x47ba, 0x3e82, 0x60, 0x0, 0xa7ff) 1.247278787s ago: executing program 2 (id=3627): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xb, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020a07b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x6f, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000700)='kfree\x00', r0}, 0x18) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000380)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0/../file0\x00'}) bind$isdn_base(r1, &(0x7f00000003c0)={0x22, 0x5, 0x9, 0x81, 0x51}, 0x6) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x800, 0x11c, 0x1}, 0x20) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0xe, r4, 0xfffffffe}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0xc, &(0x7f0000000300)=ANY=[@ANYRESHEX=r0], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r5, 0x0, 0x81}, 0x18) r6 = socket(0x10, 0x3, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r7}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) chroot(&(0x7f0000000000)='./file0/../file0\x00') r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x8401, 0x0) syz_extract_tcp_res(&(0x7f0000000340)={0x41424344}, 0x0, 0x2) write$tun(r8, &(0x7f0000001800)=ANY=[@ANYBLOB="020106000200ffff0200707242bddd58aaaaaaaaaa2608004c011088006600004006907800000000ac1e0001440869f00000000244144021ac1414bb0000000affffffff000000008913ad00000000e000000264010100e0000002892b98ac1e0101e000000264010100ac1414280a012dd60a010101ac141417e00000017f0000010000000000004e214e24", @ANYRES32=0x41424344, @ANYRES32=r9, @ANYBLOB="6040800090780004000402003e10d1e822a995838a68645c0824a73d379f88e104e4f0cd4f603eed815880db1be8ca6503705cca0deaeeca5d1166dcd95d8c7d2e98b9858551c37f45352cce9325b5782a4513ed6309511ad3116bb6b9cab2ec2bc788b690756160846f832fbc33127385acffd9ed26be095f437c23c2420dd1ac7c58b95c365bf03455cabc7f03d9edf6ee3ffd5a320932b11bb46f57609d0cda6ef16a67e99c1d1a9cda78a88cdc57d87c251f401be937e1fb0e790a910edaaf07ee69588ae44ee635a878177223d525a587a3aa39d7e6426c1604f8de37e6fd9a09b4303215e1aa09c778c61e46aad47859a3d38761f9b9119596488e3a39f12c1c9cf20111e20a4622d5156be0ca005bc95bdd5de4a4ddf1e9597b443d7fdadbb4d100d5cef76338adf2f50dd4ba1bbf1783a41403966720bb367d0032e069b36b94757d7a64a8c76d18942d4317cbf3a3952e122ef386818b061940313893b9c5f5d8d47c93d8b169de50407d20ebf470b1acb7f7eb428bcadfedc4e5d655295b086066c1f37d95d895cf099f04d7eb00fc4ca1a5a9dea1270e367cdbab6c2516d465f4f7519f0c42cb937278b23114a0021c0deffeeea0784f41f8581dd4ffdd432a1ace925502f20adcc8aa0901875b6f3da6a1b60588e3a7dcc171c6c98e2c74ed05d7e91cc1989393496ae300e44ddf270246813bcde571445fdc6d3c38fa40b545a36b4e38ec78c13fe8dda5c914cd3fc6c80c1a8d2a48c78a9742fc17fdb412e6d4da419ec3d2fc9f2ed8053d6025b2dc2103c5113265bd891b708e803f00a5fc8ef723fd096b9e94bed8a1599b2a98ceaedd576224ce5e62be8309641ee2692a02a3b63405ca16ea2853e2293c505d3d3085b87feea17dd8228205dcc2bf12eaa57943c267e6c7b729e846b1f468f24f311e04e472b2f25b87cd9c9171854d1020ebdf0b70bb33ecf405f07f137adeb60ecb620ac3fc96455fa379b9ca31777e6e736e72cf3583536cdec9d3d9ca69e9232dd5d125b44cea9a57865940b8a69896d50ccf4462aab6af68b4098c86a7f6388805d131f0f330554451f24eb4c8c31f601d15458dfd20b6b5ea62583a5b9e7d85665db1f70acf1a97e494336d582414af41c30542bbeb60bce784baa8ede9cd174658a3bbb033862c730ff29057c7becc0c8c8af8830333f0e8e723138807f54809b89452f9d8cdaf04bdf58e2caab0b9237938393a3f2dbfdfd3c0fb3f4dcfdf949f8d810f546a032e97fa3d252b3493bd6571e4ae52933d411c5f66d415810c99fef8e4e6fa98929cb14669e66db4d9e672fc06df367252c140279f987c03a76d6a1189fb642487beb675ec4e5a4ae77ccce8133c14664a98ea6b77e86f69b0ff3951bdf96829c10825db39312adda0c3ae66f5beebee724386568d594c42757633dd7bde86611c8ecbdef17a9f48d895479dc5626be38758f2f46bc1b8c20d0196658786563d8ab4c7a583542931d28758678ec0b4d81b1f40047013f9da1937246ae2042cb1294b14f9a8aec5d2e9d8dfeb36051a168611c0ee19929e48fa99f2fece5860717028e327d8582b724481f5315592e2b67379198a3554f5b7ca464ec200c4d2812ad6dd87d2e21428117e587189203d2c70408ebcac1a462ffaa5efca2f6ec9c221bd811c0463630da40aa3699679a4d239ec37dcdf37944a0b3c0a415a699eba7cb7df2290ca9a1fbadb7235277424b707b0fb06d3297ee002666b6d66ec5e966b265aaa7d618ee8ac72661f197422517072fc8ece896249e1843560595045b98b03b40ca49e7a382180e6ef1167d38b529ca145bca8896aaae25843330bc20f5c4123236ce92f2c3080d1cbe8daf235075e8e920f6c785707a3ad0db3785a0b5e7560f8ab09aacee7e97c871598b3946532d79aa19fe64ed8bb09cfdf665b5f68795f74b7ddb1ff6610de80fcee0f155bd3811e8277d5b1d8a132ed3b24ac799a08ad86e35969a4f88e4b907deb248e69ae918575bcb02b6f69211322bda669a07f331f1473d8133c872fe84e32a2baab08e194a50b59ac165d9ef5636f4754d7f6e1c50889e74d6e8575447c99975d994f77db62dd997ab35968f4447cdf27e69eab382cfe5e129d67d84f1bb87f9cd78886c17e93e29a82ab6b4b06130cb5ed22b965743b3d3c2f54803c408fc3987acb2a54a420a121a58c9170ea758c5b4a08118d9417f370e777cb6c8047710ca847ad9a0cdb53df2b6ad28ec45104b43e2c3ac8c33949191ab509a2cc9f67cc4fe5cbed51f84b1f451ac7f7659bf9cf223011c91540e7bee41f58ce314b4ae2b75a6eca366f9fbf00fc756606522c9aca23790472aba8a8393109c1adf0fdc898db0c1d9adc3483dc1df82d95a99c4eda7da839333b8f9a044e5557193dd42d7a606d4cb1b2bcd3ac2e85fe40aea412e38e30b9ecd17e9d2d0c8ef4874625bbcef081171afd40b293bd4775084e1bc13376d74abe7606abf90bcbf21481a84f68745a5752732e58b78c3207bde57ba05a59a58b25e2a187a5251501c4aae645a125fe989d088648793a95dba6df493f4f5aedbb1e3f3f5bfd18c1b9e50f2d930c450ee4b713f7f5d752e53158dfdedd3302f12bfb9ac4ff529189eb02e7a375273aba095126832b9d501662f21258f2d003f16f8bcc306ca02c09d85e39264b6cc476cd729fab92a13c628cdaf45aa724da7ddab4669cd040d1c85d41f98833f858b58870eb02af4be63fbc3a07fc5c3df8d3b72644ab1b6c58a40ec6483d0181b21849d8198967550e1d34be749c3ca7dad5252963b122e38bae81ed50c300e664acb231c282563f60f9ca1834bfc0c37b77647183a23940de4ec5602ddd846fc5fb4c066ea175141a1feeb0bbeb49ce9b946ecb2b866ae0e775813a5fa027a93bed4a977e8fb7e5431a79710cffbd3c83ea07228455f5ceee7e11743d3ce38fc7354f98b8b9f3b5650d0635c4371331b77e3be31525945dafa101ead87bb566bac470bede3546abbddc8fff0f9d9197e0a02f448e62b37f1e8d57f2b6aad2befa5896902dedd6f8319cf44eeb9471547e520be5650f92096ca8e3d34b0003eed1758ab60746c73a125f8daf45aec65f332078c2ba041d6555890b5ca1d44b4109e625af7264f03634500aa9bf186032927c2d89c0d86e86addd4f7f0856539715a50c95c923b11f58f1b5d419ea8d235f681f5ed96abb874821a7ba16fc589bcf991141a6077e57390ce36efd7bb70217fe2e879508a6c36a71382b84e966a93ce8462188fe329966e5b62fdf7283b5d9f5da1b151cbcc47337a2bf96c7ceaebd9b04046337e9b21564876090fe70596711f3c69e63b2ff80582188de149f888c0fd1ae116edd2190b75fe76679d60e0b45e9525f66da6bc1bfa13ae5553eb696783d38cbd7dced15f933363bf6f92dabb577d5cf89eaefbaea81047c7ea1b76363091fdd5be7e4ee9e01c2b1293405dffc70247a079959c4fe627452bad5001a3c719e46e6a26d7cb87c1db494a54f337972f2e0de041c400caf43d00b8424a960eecd345279aae939b743daaf7b2e15f0597231996382e7b632af5d4ce2e5d8e8d90b6089b6a2c7055cafb6723a506f87c056ecc273d7fb47d22bacfffd6a1a60d74811fd5db4e09e30adc7c190417f6112aad2abe2bd48e8d206f3df58e7628b269c9d6b5c1dbe3e50d77f578a4926210c88a79c78c701dac5b53d146e3555b31862671478cd1f6e08dd7427e23b1dfadbfd347c4ec49611f2bf878d2212fc55dc68e1174b1d863a30ad3aa391c2a09d9bc28ec1a5cb6c276e70731f85c162fb4e2f8fc23e50fcc11f463b8faf58359e461e4571b89686f089d93e6790eeca4fbb4f59c1b2563554fd7212e352b5a14a800001f966c0fbd3aa32c88752a0a7c909a0dfb7d735b9355b9ad841600276b44554dcc65ce653cd0d0344dd9d4ca39fa761b9f8d476e27465785d23ac150651aa940f7eef0b2bd261fd8301b44437953732baddf8a82806f192440c318fe648ea97217f830b912f1e38041b58a6e68bf7dbcd84ca3aaefdbcecf08102b85082ea000759f3a53f65f867d4d7f359e33763b28f26f4b2d3e449c230f5168534843bae6a0dd7e23f579a8cc6dad11f24631c63fc6615b4aa4d41d1310a43fc07d670f1849edcbf5529fac77408524e5da5a2fefa7773bb2ff487fe6fe378ecd256c1ed9342c1bfa91e49fe5adb183b68074c588c2293484ee5d7ef5214769b33b4a21bb6342c7416d78ee2c75199e82edf824cd8dde77bba2e09e628c2b4fe561e9fd929caa691203b39d71879f8c36580d422afc4ab4b84548fbf2d78e37d4914c422685251987445e9b7333224c75177f0f17ab1ec6bc3a7f016912850e8bda9871710befa39b4d74ac19dc931dbefd5151fe99a2a6d444873f9e87f4a6d9640fe28753107b2f1e1ac1939d267daa02a8d4a8abefbbbaa9b14aeda0e2863e1a38d4f7403feeffaa610f5c22d5f31e60bcc4dabc7c2b8816f05614e561b5081360dee0ede245d9c7d5334b08af2a6882e730e5de1bc9afda600791fff5278706a2e499b723e7596f5a9c413dd19cea0ebb929020c0fe02eb2fbbd253c173536430481d5dbe72a5a40a45e7c752772f0101d84320151b3ae4785c98659133a85c9a1100d7ea854a2299f7c05ae8317f9a44e2e9c681ba25240817567c8d22e62ac9f1994685b313b0d2ece26bd67aecc04641ee31ba987ec71b7fb9a85e8c511d278f1eae072e73f6ed9b99de4c8f8b2c74a67cee8f4b46f10712303fdcca8903529f2e645817d3a524bb7d685ccee0d3ea1b72149a7e926565a0a3de6e86d2b4bbe9dc97ac9278d0c9998b08e535ff818d6482d6dab26f6eb385402f4bd4579d1a2edcc2fd253e8a0a8097da6fd02db7812da73d919d35b596943b6b2434328722f7a675186fbfff50dd550125936b0d31dbd6f8f251259dfb8daba2a634e52db992337d9ef4e38c83fc198f65c3b9852a601e8ea8f91779b12d669c0712f496102a1230fc0a7dda80ff9d1d8a871e027c89c878139d8492a280e607e9b566ebb92e2705e27c5c09c3edb507f043a36af052b3b28b1a91712fd81e29d589b626f1f1a52108fbf5f7b547f4c346d16a4941f50cfd25c2c154955027b52e21f1651a07332757a14efa8e78a9cfcc132286457d9b6919006d2ca11782fba021502d1600a0a73e11b2e100e8e3d61ad3ae51b3d394eb5e68dcf7e222bc101771009802fe60628a760fd41acd51d33cfad1b8ef08c88f79d179c5b999088c8149342daa1870c7a8b0bb40873a3161d8de46db6bdba38630c319714a4e7e478753ad93e2392c16d7f1fb969d57a08195b49591f2944ebf99270be3e2a8d18b446dd71a641b5df0c482c0fcad0c2615b66f95dbc705f83dfa9be4ddd212ef8245119db0e70630fc6f6cfcdf3ef3beb7a4c3b4127e594ee7f3f5577bc5a641867b53b7d3a30da0723520ceabb707af70a1049ab7ff3521ca3c33e06e444dad8606ef3e046a52cce7827ff55b5c65ab0ff69dcc3657f3cdb4e17cc55701e4e526f2a23dec77dec4211c3cb13019837359768cf1a67ef4325b3fbcd8de60ca9132527bf0d5d0d2719c19c25fca937c00f8af92ad853e8fecefbdc16706f64b0d3eadb5fe24581d6d20975d869e813701554b621d1e492c2d0b464b2620f12b089fe8bb8302b548634028b9a3d30ac557637d76e52af8651ff6c93750af1bed86ec65fd51bfc0df673bd4d7a106647a83315b622568380b48ef9dfa385780e8774a49f8f6c8d37d8b109dba9b45bb372"], 0x10a0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) pivot_root(&(0x7f0000000280)='./file0\x00', &(0x7f00000000c0)='./file0\x00') sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0xec, 0x200, 0x80000a, 0x0, 0x1, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x18, 0x8, 0x1, 0x8, 0x2}}, {0x4}}]}]}, 0x68}}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010"], 0x44}}, 0x0) 715.278447ms ago: executing program 5 (id=3628): r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x541c, &(0x7f0000000000)) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = syz_init_net_socket$llc(0x1a, 0x802, 0x0) bind$llc(r2, &(0x7f0000000000)={0x1a, 0x0, 0x1, 0x0, 0x3, 0x4a}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x12, 0xc, &(0x7f0000000b80)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000007200000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b40)={&(0x7f0000000600)='kfree\x00', r3}, 0x10) close(r2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000740)={0x3c, r5, 0x1, 0x1000000, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x28, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'vlan0\x00'}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3a1}]}]}]}, 0x3c}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ac0)={&(0x7f0000000b00)='kmem_cache_free\x00', r1, 0x0, 0x1034}, 0x18) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x8) write$binfmt_format(r0, &(0x7f0000000800)='-1\x00', 0x3) 677.717687ms ago: executing program 2 (id=3629): prlimit64(0x0, 0x13, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x1018ed8, &(0x7f00000001c0)={[{@sysvgroups}, {@noload}, {@nobh}, {@noload}, {@journal_dev={'journal_dev', 0x3d, 0x4}}, {@norecovery}, {@journal_path={'journal_path', 0x3d, './file0'}}, {@quota}]}, 0x1, 0x644, &(0x7f00000006c0)="$eJzs3c9rHG0dAPDvzCZ5kzS+6SsiNigGPLQgTZNarHqxrQd7KFiwBxEPDU1SQ7c/SFKwtdAEPCgoiHgt0ov/gHfp3ZsI6s2zUEUqFrR0ZWZnm81mN7ttsrtJ5vOBzT7zzLN5nm9mn8wzM/vsBFBas9mPNOJUxNubScR007qpqK+cLcq9+teTW9kjiVrtu/9MIinyGuWT4vlEsTAeEX+8EvHpyu561x89vrNYrdU9jTi3cffBufVHj8+u3l28vXx7+d7C+a9duDj/9YULC00N/XAniuer177z+V/85IdfXflT9WwSl+LG6I+XoiWOgzIbs/G2CLE5fyQiLmaJNn+Xo+YYhFBqleL9OBoRn43pqORLddOx+vOhNg7oq1olora3pFsB4KjSvaGsGuOAxrF9b8fBN/o8Khmcl5frB0C74x8pTjmM58dGk6+SpiOj+rmNkwdQf1bHmyfjz948mXkWO85DvH63dUYOoJ5ONrci4nPt4k/ytp3MI83iT3cc6ycRMR8RY0X7vrWPNiRN6X6ch9lLj/FXsvibt0MaEZeK5yz/ygfW33paa9DxA1BOLy4XO/LNbGl7/5eNPRrjn9ge/zxtvG5q/5dkcsPe/3Ue/zX29+P5uCdtGYdlY5br7X/laGvG33529Ved6q+P/2aeNR5Z/Y2x4CC83IqYaYn/p1mwxfgniz9pM/7Nity81Fsd3/7zP652Wjfs+GvPI063Pf7ZHpVmqT2uT55bWa0uz9d/tq3j93/4wW871d8+/o/6EGl72faf7BB/0/ZPW1+X/U0etP+VW60Zv7v+/G6n+qe6bv/072NJ/XhzrMj50dbGxtpCxFhyrShS5C9ubKyd3zveepnXtfx5oR7/mS+17/873v8tUU00/mX24MH37rzqtO5D3v9NF5Pf1npsQydZ/Evdt/+u/p/l/bLHOv7z/Ydf6LSuffzJvmICAAAAAACAskrza7BJOvcunaZzc/X5sp+JybR6f33jyyv3H95bijiTfx5yNI00yT8yMl1fTlZWq8sLxedhG8vnW5a/EhGfRMSvKxP58tyt+9WlYQcPAAAAAAAAAAAAAAAAAAAAh8SJYv5/4z7V/67U5/8DJdH9BnO77v8AHBP9vMEkcLjl/X+vXfzHg2sLMFj2/1Be+j+Ul/4P5aX/Q3np/1Be+j+Ul/4P5aX/AwAAAMCx9MkXX/w1iYjNb0zkj8xYsc6kXzjeRt+rdKVv7QAGT4+G8np36d9gH0qnp/H/f4svB+x/c4AhSNpl5oOD2t6d/0XbV27b2n/bAAAAAAAAAAAAAIC606c6z/9/v7nBwFFj2h+U1z7m//vqADjifPU/lJdjfKDLLP4Y77Si2/x/AAAAAAAAAAAAAODATOWPJJ0r5gJPRZrOzUV8KiJOxmiyslpdno+IjyPiL5XRj7LlhWE3GgAAAAAAAAAAAAAAAAAAAI6Z9UeP7yxWq8trzYn/7co53onGXVC7F671UGbPxDfjPV8VyeD/LBMRMfSN0rfESFNOErGZbflD0bC19TgczcgTQ/7HBAAAAAAAAAAAAAAAAAAAJdQ097i9md8MuEUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMHjb9//vkliarL+gp8I7E8OOEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4mv4fAAD//6AzO/k=") mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) setrlimit(0x5, &(0x7f0000000240)={0x1, 0x3}) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000002540)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000140)={0x0, 0x2, 0x7fffffff, 0x7ec, 0x2000010000, 0x2000000000002, 0x3, 0x0, 0x7ffd}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x2, 0x15) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000001000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) setrlimit(0x40000000000008, &(0x7f0000000000)) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000600)={0x200000000000001, 0x3}, 0x8) sendto$inet6(r0, 0x0, 0x0, 0xc880, &(0x7f0000000540)={0xa, 0x4e20, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x8}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], 0x0, 0xfff, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xcb3a}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r2, 0x0, 0xfffffffffffffffc}, 0x18) sendmmsg$inet6(r0, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)='\x00', 0x1}], 0x1}}], 0x2, 0x404c484) 677.307047ms ago: executing program 4 (id=3630): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e00000004000000080000000f"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000640)={&(0x7f0000000740)='kfree\x00', r1}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a7c000000060a030400000000000000000a0000050900010073797a3100000000500004804c0001800b00010074617267657400003c00028024000300733900000455afb9fdd672bad09dfb78c7699c74e891a0c7000000000000000008000240000000000c00010052415445455354000900020073797a32"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20044840) 430.194252ms ago: executing program 3 (id=3631): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000f7ff0000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="09000000070000002a00000005"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f00000003c0)='mm_page_alloc\x00', r1, 0x0, 0xffffffffffffffff}, 0x18) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x9, 0x7, 0x0, 0x0, 0x0, 0x40008, 0x590, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x4c58, 0x4, 0x0, 0x0, 0x8, 0x4ac, 0xb, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000003, 0x13, r2, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000001440), 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000000400000008"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='kfree\x00', 0xffffffffffffffff, 0x0, 0xffffffffffffffff}, 0x18) ioctl$int_in(r3, 0x5421, &(0x7f0000000100)=0x100000001) setsockopt$inet_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e20, @dev}, 0x10) close(r3) 356.922863ms ago: executing program 4 (id=3632): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r6, 0x5411, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(r7, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r7, &(0x7f0000000180), 0x400008a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d100d6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe00000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b35a20af1752f3f2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e170000000000000e83e1300000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450fc21d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e80339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd52364600000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f7b5bf21ecd12357309e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a4de84ff1907140070000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba9b49254d8192124c20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000a5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f3390343c12aa51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c0"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) getsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000f80), &(0x7f0000000fc0)=0x4) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x5}, 0x48) socket$key(0xf, 0x3, 0x2) r8 = socket(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000013c0)=ANY=[@ANYBLOB="140000005304ec"], 0x28}, 0x1, 0x0, 0x0, 0x64841}, 0x40000) 228.462686ms ago: executing program 5 (id=3633): pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r1, 0x0, r0, 0x0, 0x6, 0x0) close(r0) r2 = io_uring_setup(0x12d6, &(0x7f0000000600)={0x0, 0x8944, 0x2000, 0x0, 0x133}) syz_io_uring_setup(0x10b, &(0x7f0000000580)={0x0, 0x93b1, 0x6, 0x3, 0xbffffffa, 0x0, r2}, &(0x7f00000003c0)=0x0, &(0x7f0000000340)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f00000002c0)=0x9, 0x0, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000800000008"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000400000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r6}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wg0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f0000000180)="0b03feff4f12021202004788aa96a13bb1000011000088ca1a00", 0x1fffc, 0x0, &(0x7f0000000140)={0x11, 0x0, r7}, 0x14) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f0000001140)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x16}, @in=@empty, 0x4e24, 0x1ff, 0x4e20, 0x81, 0x2, 0x0, 0x0, 0x3c}, {0x9, 0x9, 0x7, 0x3, 0xfff, 0x4, 0x100, 0x4}, {0x3ff, 0x2, 0xcc1, 0x5a83}, 0xc0, 0x0, 0x0, 0x1, 0x2, 0x3}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4d2, 0x6c}, 0x9, @in=@rand_addr=0x64010102, 0x3506, 0x4, 0x1, 0x7, 0x0, 0xda5, 0x1}}, 0xe8) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000700)=@newsa={0x154, 0x10, 0x1, 0x0, 0x0, {{@in=@broadcast, @in6=@empty}, {@in=@broadcast, 0x0, 0x33}, @in=@local, {0x800, 0x0, 0x4}, {0x0, 0x0, 0x100}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'sha256\x00'}}}, @encap={0x1c, 0x4, {0x3, 0x4e21, 0x4e24, @in=@dev={0xac, 0x14, 0x14, 0x14}}}]}, 0x154}}, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x4, &(0x7f0000000980)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='kfree\x00', r10, 0x0, 0x401}, 0x11) r11 = io_uring_setup(0x77da, &(0x7f0000000240)={0x0, 0xdb5e, 0x40, 0x0, 0x12f}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r11, 0xb, &(0x7f0000000480)=[@ioring_restriction_sqe_flags_allowed={0x2, 0x11}], 0x1) 228.085276ms ago: executing program 2 (id=3634): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="2d96cfa33b82dd120c43741cfade08959617294a1756e8ba9fd9f21107ff5dfac48b0206da9722ec40d105000394c9031960c355cb887906396dee59d27205814ec4a699e200b69714f805ea234f576b86d06805a1fc9c5c1b9544125dc8a387616c1a0c4795a555780600be", @ANYRES64=r0, @ANYRES16=r0, @ANYRES32=r1, @ANYRESOCT=r0, @ANYRES64=r1, @ANYRES8, @ANYRESDEC, @ANYBLOB="4a287e9d44774692501a151d8fdaed5bc311f91f972dfbae492bcbde1b4ac49bd7a761debd2dcb28bfd31ad2d79a134be5a37d2a8ff3959394495cd05d32d243b15a1ac83d87f43be0394fa42158cc"], 0x4, 0x127d, &(0x7f00000011c0)="$eJzs3U1rJMUfB/DfJJPH/SeTv66ruyAWelGEcZODJy9BdkEMKNEsqKdeM9EhkwcyQyAi7njyJPgyRD16E8Q3kIsXz4IgkovHPYgtyUw085BsYjIJyOdz6aK6vlXV6U5DD1303itfrK2u1MsrWSOGCoUobo5E8WGKFEMxHC3NeOHeTz8//dY7774+v7BwZzGlu/Nvz76cUpp+5vv3Pv7m2R8a1+59O/3dWOzODO39PvfL7o3dm3t/fh3VeqrW0/pGI2Xp/sZGI7tfq6Tlan21nNKbtUpWr6Tqer2y1bF/pbaxubmTsvXlqcnNrUq9nrL1nbRa2UmNQmps7aTsg6y6nsrlcpqaDM5j6auHeZ5H5PlIjEae5/lETMa1+F9MxXSUYib+H4/F43E9nogb8WQ8FTcPWl31vAEAAAAAAAAAAAAAAAAAAOC/5RHr/wvW/wMAAAAAAAAAAAAAAAAAAMDgda//L0b4/j8AAAAAAAAAAAAAAAAAAABcskd8/79r/f+L1v8DAAAAAAAAAAAAAAAAAADAIIy3NospjUesfba9tL3U2rbq51eiGrWoxO0oxR9xsPq/pVW++9rCndvpwEy8tPagnX+wvTTcmZ8dKcVMoW9+diIiUkqd+bGYPJqfi1Jc7z/+XGv8rvx4PP/cfv7TVr4cpfjx/diIWixHFNpHf5D/ZDalV99YmOjM39pvd6zhAZ8WAAAAuEjl9Lfe5/dmu1Hf/a1d7efz1G5ZOOH3ga7n82LcKl7VUXOovvPRalarVbb+ZWH0+H5Gz9dzT6EQEVkcrZme/HVxf/BT9nN4uV3QfI4Uhi+6wxMLIye3Occ5jeKp/5gDKkSzuyYvRZy1n9++PFIzfub4+QpD7cssqzVPfbFFM88HOrG+/4xjJ6WOv2cUBnxP4vL8c9KveiYAAAAAAAAAAACcRd+3/yYioud9wA97ag5fD++M9/Z8/OifX8IRAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB/sQPHAgAAAADC/K3T6NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgK8CAAD//w+Ty90=") r2 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x94) openat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0xcb40, 0x44) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000680)='./file0\x00', 0x20091e, &(0x7f0000000340), 0x3, 0x45e, &(0x7f0000000b80)="$eJzs28tvG8UfAPDvrpO++0t+pTz6AAIFEfFImrRADxwAgcQBJCQu5RictCp1G9QEiVYRBITKEVXijjgi8RdwggsCTkhc4Y4qVSiXFk5Ga6/jR+w0CXZc6s9HcjyzO87MN7PjzOzYAQyssexHErEvIn6LiJFqtrnAWPXp1spS8a+VpWIS5fJbfyaVcjdXloq1orXX7c0z42lE+mkSR9rUu3D5yvmZUmnuUp6fXLzw3uTC5SvPnLswc3bu7NzF6VOnTp6Yev656We7Euf/s7Ye/nD+6KHX3r72RvH0tXd++iapxd8SR5eMrXfy8XK5y9X11/6GdDLUx4awKYWIyLpruDL+R6IQ9c4biVc/6WvjgJ4q5zqcXi4Dd7Ek+t0CoD9q/+iz9e/NlaUs2e118B3txkvVBVAW/638UT0zFGlUF0bDLevbbhqLiNPLf3+ZPaI39yEAAJp8l81/nl6d/xXr84807mso9798b2g030s5EBH3RMTBiLg3olL2/oh4YJP1t26SrJ3/pNe3FNgGZfO/F/K9reb5X1orMlrIc/srmeHkzLnS3PH8bzIewzuz/NQ6dXz/yq+fdzrXOP/LHln9tblg3o7rQzubXzM7szjzb2JudOPjiMNDLfFX6ktWdwKSiDgUEYc3+bsL+fO5J78+2qlMa/zlyibi7g6lX2zOdmGfqfxVxBPV/l+Opv6v74Im6+9PTu6K0tzxydpVsdbPv1x9s1P9t+//3sr6f0/b6381/tGkcb92YfN1XP39s45rmoktXf/1Azvy5w9mFhcvTUXsSF6vNrrx+HT9tbV8rXwW//ix9uP/QNT/EkciIruIH4yIhyLi4bzvHomIRyPi2Drx//jyY+92Oncn9P9sS/+PNhdp6f96Yke0HmmfKJz/4dvm31hPbuz972QlNZ4f2cj730batbWrGQAAAP570ojYF0k6sZpO04mJ6mf4D8aetDS/sPjUmfn3L85WvyMwGsNp7U5X9X5w9X7oVL6sr+WnW/In8vvGXxR2V/ITxfnSbL+DhwG3t8P4z/xR6HfrgJ7zfS0YXMY/DC7jHwaX8Q+Dq8347/QJXOAu0+7//0f1ZHlkOxsDbKuW8W/bDwaI9T8MLuMfBlfj+E/62A5gWy3sjtt/SV5CYk0i0p5XsWvbwkl6PAr29b+/Npvo9zsTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAd/wTAAD//yI24nk=") r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x130) getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r5 = syz_open_dev$evdev(&(0x7f00000000c0), 0x7fc, 0x9fda41) ioctl$EVIOCSFF(r5, 0x40304580, &(0x7f0000000b40)={0x0, 0x5, 0x8001, {0xc, 0x1}, {0x3e, 0x2}, @ramp={0x5, 0xfb, {0x1, 0x3, 0x4, 0x7}}}) write$char_usb(r5, &(0x7f0000000040)="e2", 0x2250) write$P9_RVERSION(r4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x25, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0, 0x4}, 0x100b28, 0x6, 0x0, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0x2, 0xffffffffffffffff, 0x2) r6 = socket$key(0xf, 0x3, 0x2) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r7}, 0x10) sendmsg$key(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB="884b24b0a31daab6cc96e3049b3cc3596ca9e7e0b2db6518a552fcb8bd422d789fa1b212141cd6bbad9f797de0e5a0ba248476ec85f268784557e3f35a144207d1d56437795153c8d9e2d0811f2b9751f7a76b519b2efe50467be572f674b9614dc7f0db5e0308b17a9a63b902b0b87f218848d6bed1d75835e909f1de7f21cda76e7a982ff7ad8959ad52105da5927762108c210000000033efbc68c6fee2c0074faf93298cd4eada8e730bd438d5fe262e788af6b45b76a4cf939050fc6a9f4c51"], 0x88}}, 0x0) write$P9_RLERRORu(r4, &(0x7f0000000280)=ANY=[@ANYRES16=r5], 0x53) creat(&(0x7f00000000c0)='./file0\x00', 0xc9028ba210c11f8b) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000001300)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000c000000180001801400020076657468315f746f5f626174616476001800038014000380100001800c000200657451489e25b6a1"], 0x44}, 0x1, 0x0, 0x0, 0x801}, 0x0) fcntl$setlease(r8, 0x400, 0x0) ftruncate(r2, 0x2007ffc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000040)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x6c, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 213.208956ms ago: executing program 3 (id=3635): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r6, 0x5411, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(r7, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r7, &(0x7f0000000180), 0x400008a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d100d6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe00000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b35a20af1752f3f2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e170000000000000e83e1300000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450fc21d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e80339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd52364600000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f7b5bf21ecd12357309e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a4de84ff1907140070000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba9b49254d8192124c20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000a5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f3390343c12aa51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c0"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) getsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000f80), &(0x7f0000000fc0)=0x4) r8 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x2, 0xa, 0x0, 0x0, 0x2}, 0x10}}, 0x0) close(r8) 161.614028ms ago: executing program 1 (id=3636): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000010000000a00000008"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f0000000200), &(0x7f0000000240)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000002000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/ip_mr_vif\x00') lseek(r2, 0x47, 0x0) 104.888318ms ago: executing program 4 (id=3637): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f00000001c0)='./file0\x00', 0x800000, &(0x7f0000000b40)=ANY=[@ANYBLOB="616c6c6f775f7574696d653d30303030303030303030303030303030303136323134372c756e695f786c6174653d302c73686f72746e616d653d6d697865642c73686f72746e616d653d77696e6e742c696f636861727365743d6d61637475726b6973682c6e6f6e756d7461696c3d302c696f636861727365743d6b6f69382d72752c756e695f786c6174653d302c696f636861727365743d757466382c6572726f72733d636f6e74696e75652c73686f72746e616d653d6d697865642c73686f72746e616d653d77696e39352c7379735f696d6d757461626c652c757466383d302c002e39a45aa9edcfe08671a816cb673d99851079b41e699eacf742"], 0x1, 0x373, &(0x7f00000006c0)="$eJzs3U9rXFUUAPDTsfmr6WQhgop4qRvdDEn8Ag3SghhQYkeqC+HVTHTINBPmDZEpot259XMUl+4E8QtkoXt37rJx2UXpk8yfJpOOKSVOHtXfD8I9yT0nc+883uNuHufw1g93drbz2nbWjcq1FJWIqDyIWO5HA5eGY6Ufz8ZJ9+Kd6q0/3vj4088+WN/YuL6Z0o31m++upZSuvPnL19/8ePXX7ouf/HTl57k4WP788K+1Pw9eOXj18NHNr5p5auZpt91NWbrdbnez261G2mrmO7WUPmo1sryRmrt5ozM2v91q7+31Ura7tbS412nkecp2e2mn0Uvddup2ein7MmvuplqtlpYWg6ep39/czNYH8fwZedcuakFMQaeznh3dw3NPzNTvl7IgAKBU5z3/z/6r5/+ZcP6/SCfP//xXHZ3/Z4f37zjnfwAAAAAAAAAAAAAAeB48KIpqURTV0ViMXhIe/l7y8piyJ67/qZ+y18d0nXhxbz6i9f1+fb8+GAfz69vRjFY0YiWq8fDosTAyiG+8v3F9JfUtx9Kd7/r1V3+LqL8wXr8a1VieXL86qE+P6+NonInFk/VrUY2XJ9evTayfjbffOlFfi2r8/kW0oxVb/cfbcf23qym99+HGqfq5fh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/w+1NPJ6DPre79cjFmJ/2L+/dpywPN4ff1D/uL/+SlTj4eT+/CsT+/Nfjtcul7t3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjJe3d3slar0bmoYNTzv/+X2VHwz1WXBun3Tk0txHjy3NP+zzmDyjNVLQw3OWHqUVEU01rq/MVeyvMEMxFxRk4x/ALP/1kvRcQZOXMRMf0tV8r/wp85KONpBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOU6bvpd9koAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoU967u5O1Wo3OFIOy9wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA8+TsAAP//S+oM3w==") open(&(0x7f0000000200)='./file1\x00', 0x4827e, 0xdc) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x78f, &(0x7f00000007c0)="$eJzs3c9rXNUeAPDvnSRNk/a95MGD9/pWgQcaKJ2YGlsFF3ElgoWCrm3DZBpqJpmSmZQmZNEightBxYWgm679UXdu/bFwo/+FC2mpmhYrLiRy50czTWbSSZqZCeTzgZs55/7IOd8595577sxlbgCH1lj6JxNxIiLeSyJGavOTiBiopPojpqvrPVhfy6VTEhsbr/2aVNa5v76Wi4ZtUsdqmf9GxLdvR5zMbC+3tLI6P1Mo5Jdq+YnywpWJ0srqqcsLM3P5ufzimcmpqdNnnzt7Zv9i/f3H1eN33n/56S+m/3zrP7fe/S6J6TheW9YYx34Zi7HaezKQvoWbRva7pN5Lel0B9iQ9NPuqR3mciJHoq6RaGOpmzQCATtkAAA6hxBgAAA6Z+ucA99fXcvWpt59IdNfdlyLiaDX++veb1SX9MR2DlYUDETF8P3nkm5EkIkb3ofyxiPjkqzc+S6eotYPv0oBuuH4jIi6Ojm3v/5NH71nYg2d2WrgxWHkZ2zL7sJ1/oJe+Tsc/zzcb/2Vqx//Ryt+t45/BJsfuXjz++M/c3rrN96/vQ8E16fjvxYZ72x40xF8z2lfL/aMy5htILl0u5NO+7Z8RMR4Dg2l+srJq85Hb+L2/7rUqv3H899sHb36alp++bq6Rud0/+Og2szPlmSeNu+7ujYj/9TeLP3nY/kmL8e/5Nst45YV3Pm61LI0/jbc+bY+/szZuRjzVtP032zLZ8f7EicruMFHfKZr48qePhluV39j+6ZSWX78W6Ia0/Yd3jn80abxfs7T7Mn64OfJNq2WPj7/5/n8kqXYCR2rzrs2Uy0uTEUeSV7fPP725bT1fXz+Nf/z/zY//arHN9//0mvBim/H33/nl873H31lp/LO7av/dJ249mO9rVX577T9VSY3X5rTT/7VbwSd57wAAAAAAAAAAAAAAAAAAAAAAAACgXZmIOB5JJvswnclks9VneP87hjOFYql88lJxeXE2Ks/KHo2BTP2nLkcafg91svZ7+PX86S35ZyPiXxHx4eBQJZ/NFQuzvQ4eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGqOtXj+f+rnwV7XDgDomKO9rgAA0HXO/wBw+Ozu/D/UsXoAAN3j+h8ADp+2z/8XO1sPAKB7XP8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQYefPnUunjT/W13JpfvbqyvJ88eqp2XxpPruwnMvmiktXsnPF4lwhn80VF1r+o+vVl0KxeGUqFpevTZTzpfJEaWX1wkJxebF84fLCzFz+Qn6ga5EBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQPtKK6vzM4VCfklix8TQwajGgUn0x4GohkTHEo29xFDvOigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA+7vAAAA//9oei8M") r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000001180)=ANY=[@ANYBLOB="000000004c900200060000000300010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000ffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff"]) (async, rerun: 64) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async, rerun: 64) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) futex_waitv(&(0x7f0000004040)=[{0x0, &(0x7f0000000080), 0x2}], 0x1, 0x0, 0x0, 0x1) listen(r0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='\a'], 0x10) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r3, &(0x7f0000000240), &(0x7f0000000140)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000008c00)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)="50558c", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000a80)="fb24ba96", 0xc3fd}, {0x0, 0x11}], 0x2}}], 0x2, 0x20004810) (async, rerun: 64) r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r5 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000240)) (async) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0504279aab3a00000000000000", @ANYRES32, @ANYBLOB], 0x64}}, 0x44084) 60.175959ms ago: executing program 1 (id=3638): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x1, 0xc, 0x9}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) io_setup(0x3, &(0x7f0000000000)=0x0) io_cancel(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0xfff, r1, &(0x7f0000000080)="f5096a89ef83fb995b1c95d1361cf159456281183820ca8afd9c16db60a9a4a4e769ee834b1433ba797f5c9221f7", 0x2e, 0x1, 0x0, 0x1, r1}, &(0x7f00000001c0)) arch_prctl$ARCH_GET_XCOMP_SUPP(0x1021, &(0x7f0000000240)) 54.27649ms ago: executing program 3 (id=3639): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000d7dda410891193080000010203010902240002000000000904"], 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='.\x00', 0x0, 0xa00a, 0x0) socket$inet6(0xa, 0x3, 0xff) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0x5c, &(0x7f0000000440)=ANY=[], 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000540)='inet_sock_set_state\x00', r1}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000540)='inet_sock_set_state\x00'}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket(0xa, 0x3, 0xff) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @empty, 0x4000002}, 0x1c) syz_emit_ethernet(0x6e, &(0x7f0000000300)=ANY=[@ANYBLOB="bbbbbbbbbbbbffffffffffff86dd697a262d00383afefe8000000000000000000000000000aaff0200000000000000000000000000010200905b00000000620813313f6fff00ff01000005000000000000000000000100000000000000000000000000000001848ff8891330000a3865000000"], 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000000000100000000000000000850000007d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000400)='kmem_cache_free\x00', r5, 0x0, 0x8}, 0x18) r6 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0xc}, 0x5}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, 0x0, &(0x7f00000002c0)=r4}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a28000000000a0108000000000000000000020900010073797a310000000040000000030a01030000000000000000020000060900010073797a31000000000900030073797a300000000014000480080002400756d9f3080001400000ff00140000001100010000000000000000000000000a00eee5a3cb4243429fda1ffdd438b1931a"], 0x90}, 0x1, 0x0, 0x0, 0x24000144}, 0x2000) r8 = getuid() fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000400), &(0x7f0000000540)=@v3={0x3000000, [{0x9, 0x8f2e}, {0x1, 0x4}], r8}, 0x18, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r9, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 0s ago: executing program 2 (id=3640): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r2 = dup2(r1, r1) ioctl$BLKTRACESETUP(r2, 0x127f, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000640)='console\x00', r4}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) kernel console output (not intermixed with test programs): system 00000000-0000-0000-0000-000000000000. [ 164.592245][T13510] netlink: 180 bytes leftover after parsing attributes in process `syz.5.2732'. [ 164.608406][T13510] loop5: detected capacity change from 0 to 128 [ 164.873003][T13527] loop5: detected capacity change from 0 to 512 [ 164.896242][T13527] EXT4-fs (loop5): 1 orphan inode deleted [ 164.902669][T13527] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 164.915328][ T41] EXT4-fs error (device loop5): ext4_release_dquot:6973: comm kworker/u8:2: Failed to release dquot type 1 [ 164.925541][T13527] ext4 filesystem being mounted at /367/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 164.938978][T13527] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 164.976676][T13527] loop5: detected capacity change from 0 to 512 [ 165.009752][T13527] EXT4-fs: Ignoring removed oldalloc option [ 165.017388][T13527] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 165.029340][T13527] EXT4-fs (loop5): 1 truncate cleaned up [ 165.035574][T13527] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 165.069183][ T7261] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 165.079904][T13545] loop4: detected capacity change from 0 to 1024 [ 165.159922][T13545] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 165.194182][T13557] netlink: 180 bytes leftover after parsing attributes in process `syz.5.2745'. [ 165.207380][T13557] loop5: detected capacity change from 0 to 128 [ 165.242276][ T3307] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 165.617418][T13579] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13579 comm=syz.1.2751 [ 165.631230][T13579] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2751'. [ 165.785359][T13640] loop3: detected capacity change from 0 to 2048 [ 165.795602][T13640] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 166.150909][T12564] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 166.390446][T13663] loop4: detected capacity change from 0 to 512 [ 166.463390][T13663] EXT4-fs: Ignoring removed oldalloc option [ 166.482066][T13663] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 166.603884][T13663] EXT4-fs (loop4): 1 truncate cleaned up [ 166.610004][T13663] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 166.657368][ T3307] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 166.667361][T13678] vhci_hcd: invalid port number 77 [ 166.672621][T13678] vhci_hcd: default hub control req: 0017 v0001 i004d l0 [ 166.686702][T13678] loop3: detected capacity change from 0 to 164 [ 166.695269][T13678] /dev/loop3: Can't open blockdev [ 166.875235][T13708] loop3: detected capacity change from 0 to 1024 [ 166.921961][T13715] loop3: detected capacity change from 0 to 512 [ 166.956313][T13715] EXT4-fs: Ignoring removed oldalloc option [ 166.962643][T13715] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 166.973413][T12003] syz_tun (unregistering): left allmulticast mode [ 167.004800][T13715] EXT4-fs (loop3): 1 truncate cleaned up [ 167.011075][T13715] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 167.056477][T12564] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 167.130773][ T12] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.183020][ T12] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.300498][ T12] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.327954][T13716] chnl_net:caif_netlink_parms(): no params data found [ 167.371421][ T158] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 167.387790][ T12] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.418159][T13716] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.425401][T13716] bridge0: port 1(bridge_slave_0) entered disabled state [ 167.432957][T13716] bridge_slave_0: entered allmulticast mode [ 167.441562][T13716] bridge_slave_0: entered promiscuous mode [ 167.469927][T13716] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.477337][T13716] bridge0: port 2(bridge_slave_1) entered disabled state [ 167.502008][T13716] bridge_slave_1: entered allmulticast mode [ 167.510366][T13716] bridge_slave_1: entered promiscuous mode [ 167.797230][T13716] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 167.806631][ T12] tipc: Disabling bearer [ 167.813802][ T12] tipc: Left network mode [ 167.814954][T13716] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 167.829580][ T12] hsr_slave_0: left promiscuous mode [ 167.836279][ T12] hsr_slave_1: left promiscuous mode [ 167.844660][ T12] veth1_macvtap: left promiscuous mode [ 167.850197][ T12] veth0_macvtap: left promiscuous mode [ 167.967762][ T3390] infiniband syz1: ib_query_port failed (-19) [ 167.983735][T13716] team0: Port device team_slave_0 added [ 167.993868][T13716] team0: Port device team_slave_1 added [ 168.018463][T13716] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 168.025769][T13716] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 168.052631][T13716] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 168.085143][T13716] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 168.092147][T13716] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 168.118187][T13716] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 168.122922][T13855] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 168.163514][T13716] hsr_slave_0: entered promiscuous mode [ 168.170430][T13716] hsr_slave_1: entered promiscuous mode [ 168.232505][ T12] IPVS: stop unused estimator thread 0... [ 168.391070][T13706] syz.1.2773 (13706) used greatest stack depth: 6360 bytes left [ 168.432214][T14120] loop5: detected capacity change from 0 to 512 [ 168.439001][T14120] EXT4-fs: Ignoring removed nobh option [ 168.445592][T14120] EXT4-fs (loop5): #clusters per group too big: 360448 [ 168.523432][T13716] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 168.532268][T13716] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 168.541957][T13716] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 168.551405][T13716] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 168.801755][T14148] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 168.882221][T14148] program syz.3.2806 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 168.895568][T13716] 8021q: adding VLAN 0 to HW filter on device bond0 [ 168.917879][T13716] 8021q: adding VLAN 0 to HW filter on device team0 [ 168.952092][ T158] bridge0: port 1(bridge_slave_0) entered blocking state [ 168.959232][ T158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 169.006936][ T29] kauditd_printk_skb: 256 callbacks suppressed [ 169.006974][ T29] audit: type=1326 audit(1758320119.125:8050): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14159 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 169.008172][ T158] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.013192][ T29] audit: type=1326 audit(1758320119.125:8051): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14159 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 169.013227][ T29] audit: type=1326 audit(1758320119.125:8052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14159 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 169.036769][ T158] bridge0: port 2(bridge_slave_1) entered forwarding state [ 169.043852][ T29] audit: type=1326 audit(1758320119.125:8053): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14159 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 169.079847][T13716] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 169.090965][ T29] audit: type=1326 audit(1758320119.125:8054): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14159 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 169.098274][T13716] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 169.160421][T13716] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 169.166715][ T29] audit: type=1326 audit(1758320119.125:8055): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14159 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 169.197095][ T29] audit: type=1326 audit(1758320119.125:8056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14159 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 169.220576][ T29] audit: type=1326 audit(1758320119.125:8057): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14159 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 169.244174][ T29] audit: type=1326 audit(1758320119.125:8058): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14159 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 169.267577][ T29] audit: type=1326 audit(1758320119.125:8059): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14159 comm="syz.3.2808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 169.380071][T13716] veth0_vlan: entered promiscuous mode [ 169.400410][T13716] veth1_vlan: entered promiscuous mode [ 169.436191][T13716] veth0_macvtap: entered promiscuous mode [ 169.452633][T13716] veth1_macvtap: entered promiscuous mode [ 169.477585][T13716] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 169.496029][T13716] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 169.546460][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 169.558135][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 169.577435][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 169.590013][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 169.631767][T14190] loop4: detected capacity change from 0 to 1024 [ 169.649659][T14190] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 169.696217][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 169.855429][T14233] loop4: detected capacity change from 0 to 512 [ 169.882100][T14233] EXT4-fs (loop4): 1 orphan inode deleted [ 169.888807][T14233] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 169.901968][ T31] EXT4-fs error (device loop4): ext4_release_dquot:6973: comm kworker/u8:1: Failed to release dquot type 1 [ 169.902310][T14233] ext4 filesystem being mounted at /7/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 169.925721][T14233] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 169.959629][T14233] loop4: detected capacity change from 0 to 512 [ 169.966524][T14233] EXT4-fs: Ignoring removed oldalloc option [ 169.972801][T14233] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 169.985251][T14233] EXT4-fs (loop4): 1 truncate cleaned up [ 169.991325][T14233] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 170.035364][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 170.148521][T14260] FAULT_INJECTION: forcing a failure. [ 170.148521][T14260] name failslab, interval 1, probability 0, space 0, times 0 [ 170.161411][T14260] CPU: 0 UID: 0 PID: 14260 Comm: syz.1.2829 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 170.161475][T14260] Tainted: [W]=WARN [ 170.161481][T14260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 170.161491][T14260] Call Trace: [ 170.161498][T14260] [ 170.161505][T14260] __dump_stack+0x1d/0x30 [ 170.161531][T14260] dump_stack_lvl+0xe8/0x140 [ 170.161549][T14260] dump_stack+0x15/0x1b [ 170.161574][T14260] should_fail_ex+0x265/0x280 [ 170.161601][T14260] should_failslab+0x8c/0xb0 [ 170.161625][T14260] __kmalloc_node_track_caller_noprof+0xa4/0x410 [ 170.161656][T14260] ? __kthread_create_on_node+0xcb/0x230 [ 170.161719][T14260] kvasprintf+0x8a/0x110 [ 170.161788][T14260] ? __kmalloc_cache_noprof+0x189/0x320 [ 170.161812][T14260] ? __pfx_cpu_map_kthread_run+0x10/0x10 [ 170.161849][T14260] __kthread_create_on_node+0xcb/0x230 [ 170.161877][T14260] ? __pfx_cpu_map_kthread_run+0x10/0x10 [ 170.161920][T14260] kthread_create_on_node+0x89/0xc0 [ 170.161947][T14260] ? should_failslab+0x8c/0xb0 [ 170.162006][T14260] cpu_map_update_elem+0x685/0x800 [ 170.162037][T14260] bpf_map_update_value+0x199/0x3a0 [ 170.162051][T14260] map_update_elem+0x41a/0x520 [ 170.162069][T14260] __sys_bpf+0x571/0x7b0 [ 170.162121][T14260] __x64_sys_bpf+0x41/0x50 [ 170.162157][T14260] x64_sys_call+0x2aea/0x2ff0 [ 170.162170][T14260] do_syscall_64+0xd2/0x200 [ 170.162189][T14260] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 170.162203][T14260] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 170.162297][T14260] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.162310][T14260] RIP: 0033:0x7f4b284eec29 [ 170.162320][T14260] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 170.162330][T14260] RSP: 002b:00007f4b26f4f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 170.162346][T14260] RAX: ffffffffffffffda RBX: 00007f4b28735fa0 RCX: 00007f4b284eec29 [ 170.162362][T14260] RDX: 0000000000000020 RSI: 0000200000000a80 RDI: 0000000000000002 [ 170.162369][T14260] RBP: 00007f4b26f4f090 R08: 0000000000000000 R09: 0000000000000000 [ 170.162376][T14260] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 170.162383][T14260] R13: 00007f4b28736038 R14: 00007f4b28735fa0 R15: 00007ffd6f090788 [ 170.162393][T14260] [ 170.410926][T14264] netlink: 'syz.1.2831': attribute type 21 has an invalid length. [ 170.418975][T14264] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2831'. [ 170.428065][T14264] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2831'. [ 170.482191][T14272] loop5: detected capacity change from 0 to 512 [ 170.496375][T14275] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2836'. [ 170.508477][T14272] EXT4-fs (loop5): 1 orphan inode deleted [ 170.515150][T14272] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 170.528278][T14272] ext4 filesystem being mounted at /394/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 170.528645][ T31] EXT4-fs error (device loop5): ext4_release_dquot:6973: comm kworker/u8:1: Failed to release dquot type 1 [ 170.556071][T14272] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 170.590431][T14272] loop5: detected capacity change from 0 to 512 [ 170.638573][T14272] EXT4-fs: Ignoring removed oldalloc option [ 170.654677][T14272] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 170.685038][T14272] EXT4-fs (loop5): 1 truncate cleaned up [ 170.691080][T14272] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 170.720797][ T7261] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 170.773972][T14296] lo speed is unknown, defaulting to 1000 [ 170.781309][T14296] lo speed is unknown, defaulting to 1000 [ 170.785952][T14298] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 170.787975][T14296] lo speed is unknown, defaulting to 1000 [ 170.794601][T14298] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 170.828443][T14296] infiniband sy{2: set active [ 170.832777][T14302] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=14302 comm=syz.3.2844 [ 170.833186][T14296] infiniband sy{2: added lo [ 170.850399][ T23] lo speed is unknown, defaulting to 1000 [ 170.878800][T14296] RDS/IB: sy{2: added [ 170.882990][T14296] smc: adding ib device sy{2 with port count 1 [ 170.889679][T14306] loop5: detected capacity change from 0 to 1024 [ 170.890181][T14296] smc: ib device sy{2 port 1 has pnetid [ 170.902130][ T5354] lo speed is unknown, defaulting to 1000 [ 170.909310][T14296] lo speed is unknown, defaulting to 1000 [ 170.928636][T14306] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 170.946730][T14296] lo speed is unknown, defaulting to 1000 [ 170.976343][T14317] loop4: detected capacity change from 0 to 512 [ 170.984232][T14296] lo speed is unknown, defaulting to 1000 [ 170.996885][ T7261] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 171.018312][T14296] lo speed is unknown, defaulting to 1000 [ 171.030376][T14317] EXT4-fs (loop4): 1 orphan inode deleted [ 171.047167][T14317] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 171.055450][T14296] lo speed is unknown, defaulting to 1000 [ 171.085761][ T378] EXT4-fs error (device loop4): ext4_release_dquot:6973: comm kworker/u8:6: Failed to release dquot type 1 [ 171.105644][T14328] netlink: 4 bytes leftover after parsing attributes in process `,&#^%'. [ 171.132154][T14330] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2850'. [ 171.141650][T14317] ext4 filesystem being mounted at /9/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 171.163633][T14317] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 171.205346][T14317] loop4: detected capacity change from 0 to 512 [ 171.225733][T14317] EXT4-fs: Ignoring removed oldalloc option [ 171.233362][T14317] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 171.234416][T14335] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2853'. [ 171.264759][T14317] EXT4-fs (loop4): 1 truncate cleaned up [ 171.270942][T14317] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 171.332070][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 171.359673][T14348] loop4: detected capacity change from 0 to 2048 [ 171.367634][T14348] EXT4-fs: Ignoring removed oldalloc option [ 171.393386][T14348] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 171.455146][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 171.499495][T14373] sy{2: rxe_newlink: already configured on lo [ 171.519828][T14378] FAULT_INJECTION: forcing a failure. [ 171.519828][T14378] name failslab, interval 1, probability 0, space 0, times 0 [ 171.532516][T14378] CPU: 1 UID: 0 PID: 14378 Comm: syz.1.2868 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 171.532550][T14378] Tainted: [W]=WARN [ 171.532561][T14378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 171.532572][T14378] Call Trace: [ 171.532579][T14378] [ 171.532587][T14378] __dump_stack+0x1d/0x30 [ 171.532611][T14378] dump_stack_lvl+0xe8/0x140 [ 171.532631][T14378] dump_stack+0x15/0x1b [ 171.532648][T14378] should_fail_ex+0x265/0x280 [ 171.532724][T14378] ? tcf_block_get_ext+0x3dc/0xb30 [ 171.532746][T14378] should_failslab+0x8c/0xb0 [ 171.532773][T14378] __kmalloc_cache_noprof+0x4c/0x320 [ 171.532804][T14378] tcf_block_get_ext+0x3dc/0xb30 [ 171.532857][T14378] ? __nla_validate_parse+0x1652/0x1d00 [ 171.532884][T14378] tcf_block_get+0x67/0xa0 [ 171.532902][T14378] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 171.532966][T14378] sfq_init+0x7f/0x1290 [ 171.532986][T14378] ? __kmalloc_noprof+0x1dd/0x3e0 [ 171.533010][T14378] ? qdisc_get_stab+0x37b/0x4b0 [ 171.533101][T14378] ? __list_add_valid_or_report+0x38/0xe0 [ 171.533131][T14378] ? qdisc_get_stab+0x476/0x4b0 [ 171.533189][T14378] ? __pfx_sfq_init+0x10/0x10 [ 171.533207][T14378] qdisc_create+0x58e/0x9e0 [ 171.533237][T14378] tc_modify_qdisc+0xf2e/0x1420 [ 171.533285][T14378] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 171.533315][T14378] rtnetlink_rcv_msg+0x657/0x6d0 [ 171.533352][T14378] netlink_rcv_skb+0x123/0x220 [ 171.533414][T14378] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 171.533447][T14378] rtnetlink_rcv+0x1c/0x30 [ 171.533539][T14378] netlink_unicast+0x5bd/0x690 [ 171.533560][T14378] netlink_sendmsg+0x58b/0x6b0 [ 171.533652][T14378] ? __pfx_netlink_sendmsg+0x10/0x10 [ 171.533674][T14378] __sock_sendmsg+0x145/0x180 [ 171.533750][T14378] ____sys_sendmsg+0x31e/0x4e0 [ 171.533779][T14378] ___sys_sendmsg+0x17b/0x1d0 [ 171.533865][T14378] __x64_sys_sendmsg+0xd4/0x160 [ 171.533893][T14378] x64_sys_call+0x191e/0x2ff0 [ 171.533920][T14378] do_syscall_64+0xd2/0x200 [ 171.533994][T14378] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 171.534094][T14378] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 171.534123][T14378] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.534144][T14378] RIP: 0033:0x7f4b284eec29 [ 171.534158][T14378] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 171.534248][T14378] RSP: 002b:00007f4b26f4f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 171.534267][T14378] RAX: ffffffffffffffda RBX: 00007f4b28735fa0 RCX: 00007f4b284eec29 [ 171.534279][T14378] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 171.534291][T14378] RBP: 00007f4b26f4f090 R08: 0000000000000000 R09: 0000000000000000 [ 171.534304][T14378] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 171.534316][T14378] R13: 00007f4b28736038 R14: 00007f4b28735fa0 R15: 00007ffd6f090788 [ 171.534335][T14378] [ 171.819689][T14382] netlink: 180 bytes leftover after parsing attributes in process `syz.5.2866'. [ 171.846074][T14379] loop5: detected capacity change from 0 to 128 [ 171.855547][T14379] bio_check_eod: 102 callbacks suppressed [ 171.855564][T14379] syz.5.2866: attempt to access beyond end of device [ 171.855564][T14379] loop5: rw=2049, sector=154, nr_sectors = 8 limit=128 [ 171.878628][T14379] syz.5.2866: attempt to access beyond end of device [ 171.878628][T14379] loop5: rw=2049, sector=160, nr_sectors = 2 limit=128 [ 171.892522][T14379] buffer_io_error: 46 callbacks suppressed [ 171.892537][T14379] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 171.907777][T14379] syz.5.2866: attempt to access beyond end of device [ 171.907777][T14379] loop5: rw=2049, sector=162, nr_sectors = 8 limit=128 [ 171.922842][T14379] syz.5.2866: attempt to access beyond end of device [ 171.922842][T14379] loop5: rw=2049, sector=168, nr_sectors = 2 limit=128 [ 171.936362][T14379] Buffer I/O error on dev loop5, logical block 84, lost async page write [ 171.946397][T14379] syz.5.2866: attempt to access beyond end of device [ 171.946397][T14379] loop5: rw=2049, sector=186, nr_sectors = 8 limit=128 [ 171.960917][T14379] syz.5.2866: attempt to access beyond end of device [ 171.960917][T14379] loop5: rw=2049, sector=192, nr_sectors = 2 limit=128 [ 171.974472][T14379] Buffer I/O error on dev loop5, logical block 96, lost async page write [ 171.983765][T14387] 9pnet_fd: Insufficient options for proto=fd [ 171.985734][T14379] syz.5.2866: attempt to access beyond end of device [ 171.985734][T14379] loop5: rw=2049, sector=194, nr_sectors = 8 limit=128 [ 172.015710][T14379] syz.5.2866: attempt to access beyond end of device [ 172.015710][T14379] loop5: rw=2049, sector=200, nr_sectors = 2 limit=128 [ 172.029207][T14379] Buffer I/O error on dev loop5, logical block 100, lost async page write [ 172.062674][T14379] syz.5.2866: attempt to access beyond end of device [ 172.062674][T14379] loop5: rw=2049, sector=218, nr_sectors = 8 limit=128 [ 172.078963][T14392] loop4: detected capacity change from 0 to 2048 [ 172.096267][T14379] syz.5.2866: attempt to access beyond end of device [ 172.096267][T14379] loop5: rw=2049, sector=224, nr_sectors = 2 limit=128 [ 172.110056][T14379] Buffer I/O error on dev loop5, logical block 112, lost async page write [ 172.134909][T14379] Buffer I/O error on dev loop5, logical block 116, lost async page write [ 172.145862][T14379] Buffer I/O error on dev loop5, logical block 88, lost async page write [ 172.156024][T14379] Buffer I/O error on dev loop5, logical block 92, lost async page write [ 172.165664][T14379] Buffer I/O error on dev loop5, logical block 120, lost async page write [ 172.167796][T14390] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2871'. [ 172.175102][T14379] Buffer I/O error on dev loop5, logical block 124, lost async page write [ 172.199257][T14392] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 172.485167][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 172.505020][T14412] smc: net device bond0 applied user defined pnetid SYZ0 [ 172.518211][T14418] loop3: detected capacity change from 0 to 128 [ 172.527061][T14418] FAT-fs (loop3): Directory bread(block 162) failed [ 172.533742][T14418] FAT-fs (loop3): Directory bread(block 163) failed [ 172.551076][T14418] FAT-fs (loop3): Directory bread(block 164) failed [ 172.566273][T14412] hub 6-0:1.0: USB hub found [ 172.576376][T14412] hub 6-0:1.0: 8 ports detected [ 172.587936][T14418] FAT-fs (loop3): Directory bread(block 165) failed [ 172.601877][T14412] smc: net device bond0 erased user defined pnetid SYZ0 [ 172.616082][T14418] FAT-fs (loop3): Directory bread(block 166) failed [ 172.630987][T14418] FAT-fs (loop3): Directory bread(block 167) failed [ 172.637798][T14418] FAT-fs (loop3): Directory bread(block 168) failed [ 172.668136][T14418] FAT-fs (loop3): Directory bread(block 169) failed [ 172.677523][T14418] FAT-fs (loop3): Directory bread(block 162) failed [ 172.684320][T14418] FAT-fs (loop3): Directory bread(block 163) failed [ 172.691254][T14418] FAULT_INJECTION: forcing a failure. [ 172.691254][T14418] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 172.704476][T14418] CPU: 0 UID: 0 PID: 14418 Comm: syz.3.2881 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 172.704571][T14418] Tainted: [W]=WARN [ 172.704575][T14418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 172.704582][T14418] Call Trace: [ 172.704588][T14418] [ 172.704593][T14418] __dump_stack+0x1d/0x30 [ 172.704679][T14418] dump_stack_lvl+0xe8/0x140 [ 172.704690][T14418] dump_stack+0x15/0x1b [ 172.704699][T14418] should_fail_ex+0x265/0x280 [ 172.704714][T14418] should_fail+0xb/0x20 [ 172.704729][T14418] should_fail_usercopy+0x1a/0x20 [ 172.704743][T14418] _copy_to_user+0x20/0xa0 [ 172.704795][T14418] simple_read_from_buffer+0xb5/0x130 [ 172.704857][T14418] proc_fail_nth_read+0x10e/0x150 [ 172.704875][T14418] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 172.704889][T14418] vfs_read+0x1a5/0x770 [ 172.704964][T14418] ? __rcu_read_unlock+0x4f/0x70 [ 172.704976][T14418] ? __fget_files+0x184/0x1c0 [ 172.704992][T14418] ksys_read+0xda/0x1a0 [ 172.705065][T14418] __x64_sys_read+0x40/0x50 [ 172.705078][T14418] x64_sys_call+0x27bc/0x2ff0 [ 172.705090][T14418] do_syscall_64+0xd2/0x200 [ 172.705109][T14418] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 172.705134][T14418] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 172.705149][T14418] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.705162][T14418] RIP: 0033:0x7f0c5b24d63c [ 172.705173][T14418] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 172.705184][T14418] RSP: 002b:00007f0c59caf030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 172.705204][T14418] RAX: ffffffffffffffda RBX: 00007f0c5b495fa0 RCX: 00007f0c5b24d63c [ 172.705211][T14418] RDX: 000000000000000f RSI: 00007f0c59caf0a0 RDI: 0000000000000006 [ 172.705218][T14418] RBP: 00007f0c59caf090 R08: 0000000000000000 R09: 0000000000000000 [ 172.705225][T14418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 172.705232][T14418] R13: 00007f0c5b496038 R14: 00007f0c5b495fa0 R15: 00007ffe82d38b68 [ 172.705243][T14418] [ 172.928874][T14439] loop3: detected capacity change from 0 to 2048 [ 172.946183][T14439] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 172.956357][T14444] loop4: detected capacity change from 0 to 2048 [ 173.014876][T14444] loop4: p1 < > p4 [ 173.019713][T14444] loop4: p4 size 8388608 extends beyond EOD, truncated [ 173.029118][T14444] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 173.035800][T14444] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 173.043392][T14444] vhci_hcd vhci_hcd.0: Device attached [ 173.068715][T12564] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 173.123372][T14459] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=47 sclass=netlink_route_socket pid=14459 comm=syz.3.2888 [ 173.145353][T14450] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 0 [ 173.152648][ T2211] vhci_hcd: stop threads [ 173.157173][ T2211] vhci_hcd: release socket [ 173.162098][ T2211] vhci_hcd: disconnect device [ 173.168017][T14444] 9pnet_fd: Insufficient options for proto=fd [ 173.213846][T14469] loop3: detected capacity change from 0 to 512 [ 173.224233][ T5354] vhci_hcd: vhci_device speed not set [ 173.232068][T14469] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 173.245146][T14469] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 173.276040][T14469] EXT4-fs (loop3): 1 truncate cleaned up [ 173.282171][T14469] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 173.355873][T14479] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2891'. [ 173.365404][T14479] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2891'. [ 173.403120][T14482] loop5: detected capacity change from 0 to 512 [ 173.426252][T14482] EXT4-fs (loop5): 1 orphan inode deleted [ 173.433919][T14482] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 173.446424][ C1] vcan0: j1939_tp_rxtimer: 0xffff88811ad70600: rx timeout, send abort [ 173.446494][ C1] vcan0: j1939_tp_rxtimer: 0xffff88811ad70200: rx timeout, send abort [ 173.454811][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88811ad70600: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 173.454888][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88811ad70200: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 173.504200][ T378] EXT4-fs error (device loop5): ext4_release_dquot:6973: comm kworker/u8:6: Failed to release dquot type 1 [ 173.522573][T14482] ext4 filesystem being mounted at /411/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 173.549257][T14482] EXT4-fs (loop5): shut down requested (1) [ 173.601781][T14482] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop5 ino=12 [ 173.630740][T14482] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop5 ino=12 [ 173.648076][ T23] IPVS: starting estimator thread 0... [ 173.682332][ T7261] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 173.764743][T14495] IPVS: using max 2880 ests per chain, 144000 per kthread [ 173.826629][T14512] loop5: detected capacity change from 0 to 2048 [ 173.834290][T14512] EXT4-fs: inline encryption not supported [ 173.857005][T14512] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 174.218441][T14520] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 174.835812][ T7261] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 174.857557][T12564] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 174.871886][T14543] !: renamed from dummy0 (while UP) [ 174.916814][ T29] kauditd_printk_skb: 147 callbacks suppressed [ 174.916828][ T29] audit: type=1326 audit(1758320125.055:8203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14552 comm="syz.3.2917" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 174.955509][T14553] loop3: detected capacity change from 0 to 1024 [ 175.001366][ T29] audit: type=1326 audit(1758320125.085:8204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14552 comm="syz.3.2917" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 175.025442][ T29] audit: type=1326 audit(1758320125.085:8205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14552 comm="syz.3.2917" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 175.049905][ T29] audit: type=1326 audit(1758320125.085:8206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14552 comm="syz.3.2917" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 175.073315][ T29] audit: type=1326 audit(1758320125.085:8207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14552 comm="syz.3.2917" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 175.097303][ T29] audit: type=1326 audit(1758320125.085:8208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14552 comm="syz.3.2917" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 175.121916][ T29] audit: type=1326 audit(1758320125.085:8209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14552 comm="syz.3.2917" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f0c5b24ec63 code=0x7ffc0000 [ 175.145396][ T29] audit: type=1326 audit(1758320125.085:8210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14552 comm="syz.3.2917" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f0c5b24d6df code=0x7ffc0000 [ 175.168930][ T29] audit: type=1326 audit(1758320125.095:8211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14552 comm="syz.3.2917" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f0c5b24ecb7 code=0x7ffc0000 [ 175.192620][ T29] audit: type=1326 audit(1758320125.095:8212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14552 comm="syz.3.2917" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f0c5b24d590 code=0x7ffc0000 [ 175.237019][T14564] bridge0: entered promiscuous mode [ 175.242355][T14564] macsec1: entered promiscuous mode [ 175.250307][T14564] bridge0: port 3(macsec1) entered blocking state [ 175.257099][T14564] bridge0: port 3(macsec1) entered disabled state [ 175.270289][T14567] SELinux: Context @ is not valid (left unmapped). [ 175.277139][T14564] macsec1: entered allmulticast mode [ 175.282436][T14564] bridge0: entered allmulticast mode [ 175.288469][T14564] macsec1: left allmulticast mode [ 175.293606][T14564] bridge0: left allmulticast mode [ 175.299443][T14564] bridge0: left promiscuous mode [ 175.319497][T14553] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:4183: comm syz.3.2917: Allocating blocks 497-513 which overlap fs metadata [ 175.357869][T14580] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 175.367748][T14581] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 175.407276][T14587] loop4: detected capacity change from 0 to 2048 [ 175.499602][T14603] __nla_validate_parse: 1 callbacks suppressed [ 175.499616][T14603] netlink: 180 bytes leftover after parsing attributes in process `syz.1.2932'. [ 175.602286][T14612] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2936'. [ 175.733969][T14552] EXT4-fs (loop3): pa ffff888106e679a0: logic 256, phys. 401, len 7 [ 175.742545][T14552] EXT4-fs error (device loop3): ext4_mb_release_inode_pa:5434: group 0, free 0, pa_free 1 [ 175.786511][T14634] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2940'. [ 175.902323][T14650] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2949'. [ 175.912494][T14650] netdevsim0: renamed from gre0 (while UP) [ 175.922232][T14650] netdevsim0: entered promiscuous mode [ 176.595849][T14688] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2962'. [ 176.606713][T14688] veth1_macvtap: left promiscuous mode [ 176.692042][T14695] netlink: 830 bytes leftover after parsing attributes in process `syz.4.2965'. [ 176.701319][T14695] bond_slave_0: entered promiscuous mode [ 176.707231][T14695] bond_slave_1: entered promiscuous mode [ 176.743629][T14702] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2965'. [ 176.944592][T14731] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2979'. [ 176.953835][T14731] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2979'. [ 176.975560][T14731] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2979'. [ 177.041627][T14747] netlink: 'syz.1.2977': attribute type 1 has an invalid length. [ 177.050023][T14745] loop3: detected capacity change from 0 to 764 [ 177.059332][T14745] rock: directory entry would overflow storage [ 177.066017][T14745] rock: sig=0x5245, size=8, remaining=5 [ 177.438392][T14788] loop3: detected capacity change from 0 to 512 [ 177.456349][T14788] ext4 filesystem being mounted at /92/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 177.608247][T14788] EXT4-fs error (device loop3): ext4_lookup:1787: inode #12: comm gtp: iget: bad i_size value: 2533274857506816 [ 177.673986][T14793] EXT4-fs error (device loop3): ext4_lookup:1787: inode #12: comm syz.3.2995: iget: bad i_size value: 2533274857506816 [ 177.913098][T14809] lo speed is unknown, defaulting to 1000 [ 177.940997][T14817] net_ratelimit: 54 callbacks suppressed [ 177.941016][T14817] IPv4: Oversized IP packet from 127.202.26.0 [ 177.970998][T14820] sch_tbf: peakrate 64 is lower than or equals to rate 17038211371681383082 ! [ 177.999035][T14845] loop4: detected capacity change from 0 to 512 [ 178.019572][T14845] ext4 filesystem being mounted at /37/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 178.037226][T14845] loop4: detected capacity change from 0 to 512 [ 178.045978][T14845] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 178.054211][T14845] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -2 [ 178.062765][T14845] EXT4-fs (loop4): 1 truncate cleaned up [ 178.071539][T14845] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 178.338612][T14879] loop4: detected capacity change from 0 to 8192 [ 178.599705][T14902] lo speed is unknown, defaulting to 1000 [ 178.817199][T14900] loop3: detected capacity change from 0 to 8192 [ 179.165815][T14906] loop5: detected capacity change from 0 to 1764 [ 179.487964][T14900] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 179.749894][T14957] openvswitch: netlink: Message has 6 unknown bytes. [ 179.788191][T14962] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 179.795618][T14962] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 179.830543][ T5362] hid-generic 0000:0000:0000.0003: unknown main item tag 0x1 [ 179.838028][ T5362] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 179.845579][ T5362] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 179.853105][ T5362] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 179.860509][ T5362] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 179.867967][ T5362] hid-generic 0000:0000:0000.0003: collection stack underflow [ 179.875529][ T5362] hid-generic 0000:0000:0000.0003: item 0 0 0 12 parsing failed [ 179.898577][T14962] loop4: detected capacity change from 0 to 512 [ 179.915933][T14962] journal_path: Lookup failure for './file0/../file0' [ 179.922732][T14962] EXT4-fs: error: could not find journal device path [ 179.972362][ T5362] hid-generic 0000:0000:0000.0003: probe with driver hid-generic failed with error -22 [ 179.988571][T14971] rdma_rxe: rxe_newlink: failed to add lo [ 180.007523][ T29] kauditd_printk_skb: 221 callbacks suppressed [ 180.007599][ T29] audit: type=1326 audit(1758320130.145:8434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14956 comm="syz.5.3031" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 180.038220][ T29] audit: type=1326 audit(1758320130.145:8435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14956 comm="syz.5.3031" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 180.108606][T14974] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14974 comm=syz.5.3034 [ 180.163415][ T29] audit: type=1326 audit(1758320130.225:8436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14949 comm="syz.3.3030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 180.186986][ T29] audit: type=1326 audit(1758320130.225:8437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14949 comm="syz.3.3030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 180.212467][ T29] audit: type=1326 audit(1758320130.225:8438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14949 comm="syz.3.3030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 180.236209][ T29] audit: type=1326 audit(1758320130.245:8439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14949 comm="syz.3.3030" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 180.386533][ T29] audit: type=1326 audit(1758320130.515:8440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14949 comm="+}[@" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 180.409791][ T29] audit: type=1326 audit(1758320130.515:8441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14949 comm="+}[@" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c5b24ec29 code=0x7ffc0000 [ 180.412519][T14996] lo speed is unknown, defaulting to 1000 [ 180.613796][T15009] __nla_validate_parse: 9 callbacks suppressed [ 180.613809][T15009] netlink: 180 bytes leftover after parsing attributes in process `syz.3.3045'. [ 180.659279][T15024] erspan0 speed is unknown, defaulting to 1000 [ 180.665766][T15009] loop3: detected capacity change from 0 to 128 [ 180.677149][T15009] bio_check_eod: 20 callbacks suppressed [ 180.677164][T15009] syz.3.3045: attempt to access beyond end of device [ 180.677164][T15009] loop3: rw=2049, sector=154, nr_sectors = 8 limit=128 [ 180.678220][T15024] erspan0 speed is unknown, defaulting to 1000 [ 180.683421][T15009] syz.3.3045: attempt to access beyond end of device [ 180.683421][T15009] loop3: rw=2049, sector=160, nr_sectors = 2 limit=128 [ 180.716351][T15009] buffer_io_error: 4 callbacks suppressed [ 180.716366][T15009] Buffer I/O error on dev loop3, logical block 80, lost async page write [ 180.731404][T15024] erspan0 speed is unknown, defaulting to 1000 [ 180.738342][T15009] syz.3.3045: attempt to access beyond end of device [ 180.738342][T15009] loop3: rw=2049, sector=162, nr_sectors = 8 limit=128 [ 180.760851][T15009] syz.3.3045: attempt to access beyond end of device [ 180.760851][T15009] loop3: rw=2049, sector=168, nr_sectors = 2 limit=128 [ 180.774369][T15009] Buffer I/O error on dev loop3, logical block 84, lost async page write [ 180.783883][T15009] syz.3.3045: attempt to access beyond end of device [ 180.783883][T15009] loop3: rw=2049, sector=186, nr_sectors = 8 limit=128 [ 180.798996][T15009] syz.3.3045: attempt to access beyond end of device [ 180.798996][T15009] loop3: rw=2049, sector=192, nr_sectors = 2 limit=128 [ 180.812538][T15009] Buffer I/O error on dev loop3, logical block 96, lost async page write [ 180.823456][T15009] syz.3.3045: attempt to access beyond end of device [ 180.823456][T15009] loop3: rw=2049, sector=194, nr_sectors = 8 limit=128 [ 180.839385][T15009] syz.3.3045: attempt to access beyond end of device [ 180.839385][T15009] loop3: rw=2049, sector=200, nr_sectors = 2 limit=128 [ 180.853101][T15009] Buffer I/O error on dev loop3, logical block 100, lost async page write [ 180.863201][T15009] syz.3.3045: attempt to access beyond end of device [ 180.863201][T15009] loop3: rw=2049, sector=218, nr_sectors = 8 limit=128 [ 180.878433][T15009] syz.3.3045: attempt to access beyond end of device [ 180.878433][T15009] loop3: rw=2049, sector=224, nr_sectors = 2 limit=128 [ 180.891954][T15009] Buffer I/O error on dev loop3, logical block 112, lost async page write [ 180.944635][T15009] Buffer I/O error on dev loop3, logical block 116, lost async page write [ 180.998377][T15024] infiniband syz2: set down [ 181.002971][T15024] infiniband syz2: added erspan0 [ 181.008060][ T5354] erspan0 speed is unknown, defaulting to 1000 [ 181.072598][ T29] audit: type=1400 audit(1758320131.205:8442): avc: denied { map } for pid=15049 comm="syz.4.3053" path="socket:[36210]" dev="sockfs" ino=36210 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 181.096749][ T29] audit: type=1400 audit(1758320131.205:8443): avc: denied { accept } for pid=15049 comm="syz.4.3053" path="socket:[36210]" dev="sockfs" ino=36210 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 181.109944][T15024] RDS/IB: syz2: added [ 181.138969][T15009] Buffer I/O error on dev loop3, logical block 88, lost async page write [ 181.155770][T15009] Buffer I/O error on dev loop3, logical block 92, lost async page write [ 181.169131][T15024] smc: adding ib device syz2 with port count 1 [ 181.180530][T15009] Buffer I/O error on dev loop3, logical block 120, lost async page write [ 181.204247][T15024] smc: ib device syz2 port 1 has pnetid [ 181.210313][ T23] erspan0 speed is unknown, defaulting to 1000 [ 181.226898][T15009] Buffer I/O error on dev loop3, logical block 124, lost async page write [ 181.252908][T15024] erspan0 speed is unknown, defaulting to 1000 [ 181.289504][T15059] lo speed is unknown, defaulting to 1000 [ 181.409051][T15057] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 181.625528][T15063] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3054'. [ 181.634789][T15063] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3054'. [ 181.643817][T15063] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3054'. [ 181.734594][T15024] erspan0 speed is unknown, defaulting to 1000 [ 181.783153][T15059] erspan0 speed is unknown, defaulting to 1000 [ 181.849687][T15065] loop4: detected capacity change from 0 to 1024 [ 181.857271][T15024] erspan0 speed is unknown, defaulting to 1000 [ 181.933475][T15024] erspan0 speed is unknown, defaulting to 1000 [ 181.950791][T15065] ext4 filesystem being mounted at /47/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 181.998601][T15024] erspan0 speed is unknown, defaulting to 1000 [ 182.010752][T15097] tc_dump_action: action bad kind [ 182.218935][T15116] 9pnet: Could not find request transport: ÿÿ· [ 182.444941][T15132] netlink: 'syz.3.3072': attribute type 10 has an invalid length. [ 182.467810][T15132] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 182.480320][T15132] team0: Failed to send options change via netlink (err -105) [ 182.488064][T15132] team0: Port device dummy0 added [ 182.601710][T15152] loop3: detected capacity change from 0 to 512 [ 182.616965][T15152] ext4 filesystem being mounted at /105/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 182.795114][T15174] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3089'. [ 182.946429][T15189] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.953741][T15189] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.961558][T15189] bridge0: entered allmulticast mode [ 182.972045][T15189] bridge_slave_1: left allmulticast mode [ 182.977870][T15189] bridge_slave_1: left promiscuous mode [ 182.984657][T15189] bridge0: port 2(bridge_slave_1) entered disabled state [ 183.011923][T15189] bridge_slave_0: left allmulticast mode [ 183.017960][T15189] bridge_slave_0: left promiscuous mode [ 183.020926][T15191] FAULT_INJECTION: forcing a failure. [ 183.020926][T15191] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 183.023760][T15189] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.037135][T15191] CPU: 1 UID: 0 PID: 15191 Comm: syz.2.3094 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 183.037216][T15191] Tainted: [W]=WARN [ 183.037299][T15191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 183.037322][T15191] Call Trace: [ 183.037331][T15191] [ 183.037349][T15191] __dump_stack+0x1d/0x30 [ 183.037381][T15191] dump_stack_lvl+0xe8/0x140 [ 183.037423][T15191] dump_stack+0x15/0x1b [ 183.037439][T15191] should_fail_ex+0x265/0x280 [ 183.037463][T15191] should_fail+0xb/0x20 [ 183.037483][T15191] should_fail_usercopy+0x1a/0x20 [ 183.037527][T15191] _copy_from_user+0x1c/0xb0 [ 183.037556][T15191] ___sys_sendmsg+0xc1/0x1d0 [ 183.037631][T15191] __x64_sys_sendmsg+0xd4/0x160 [ 183.037659][T15191] x64_sys_call+0x191e/0x2ff0 [ 183.037680][T15191] do_syscall_64+0xd2/0x200 [ 183.037710][T15191] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 183.037766][T15191] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 183.037794][T15191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.037815][T15191] RIP: 0033:0x7fe1b045ec29 [ 183.037914][T15191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 183.037975][T15191] RSP: 002b:00007fe1aeec7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 183.037998][T15191] RAX: ffffffffffffffda RBX: 00007fe1b06a5fa0 RCX: 00007fe1b045ec29 [ 183.038011][T15191] RDX: 0000000000000800 RSI: 0000200000000040 RDI: 0000000000000003 [ 183.038023][T15191] RBP: 00007fe1aeec7090 R08: 0000000000000000 R09: 0000000000000000 [ 183.038035][T15191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 183.038047][T15191] R13: 00007fe1b06a6038 R14: 00007fe1b06a5fa0 R15: 00007ffcb9ec6e58 [ 183.038066][T15191] [ 183.240831][T15202] loop5: detected capacity change from 0 to 512 [ 183.270966][T15199] loop4: detected capacity change from 0 to 8192 [ 183.280679][T15202] EXT4-fs: inline encryption not supported [ 183.286885][T15202] EXT4-fs: Ignoring removed mblk_io_submit option [ 183.373329][T15202] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 183.400173][T15202] EXT4-fs (loop5): 1 truncate cleaned up [ 183.845674][T15222] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3100'. [ 183.854692][T15222] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3100'. [ 183.864841][T15222] random: crng reseeded on system resumption [ 184.210648][T15229] rdma_rxe: rxe_newlink: failed to add lo [ 184.288679][T15240] vlan2: entered allmulticast mode [ 184.293903][T15240] dummy0: entered allmulticast mode [ 184.304404][T15233] tipc: Enabled bearer , priority 10 [ 184.336355][T15240] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3107'. [ 184.360920][T15250] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3109'. [ 184.370049][T15250] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3109'. [ 184.412979][T15262] FAULT_INJECTION: forcing a failure. [ 184.412979][T15262] name failslab, interval 1, probability 0, space 0, times 0 [ 184.425742][T15262] CPU: 0 UID: 0 PID: 15262 Comm: syz.4.3111 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 184.425774][T15262] Tainted: [W]=WARN [ 184.425804][T15262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 184.425814][T15262] Call Trace: [ 184.425821][T15262] [ 184.425830][T15262] __dump_stack+0x1d/0x30 [ 184.425851][T15262] dump_stack_lvl+0xe8/0x140 [ 184.425872][T15262] dump_stack+0x15/0x1b [ 184.425897][T15262] should_fail_ex+0x265/0x280 [ 184.425922][T15262] should_failslab+0x8c/0xb0 [ 184.426020][T15262] kmem_cache_alloc_noprof+0x50/0x310 [ 184.426044][T15262] ? getname_flags+0x80/0x3b0 [ 184.426070][T15262] ? fput+0x8f/0xc0 [ 184.426165][T15262] getname_flags+0x80/0x3b0 [ 184.426192][T15262] __x64_sys_unlinkat+0x70/0xb0 [ 184.426217][T15262] x64_sys_call+0x2ede/0x2ff0 [ 184.426240][T15262] do_syscall_64+0xd2/0x200 [ 184.426349][T15262] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 184.426387][T15262] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 184.426442][T15262] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.426466][T15262] RIP: 0033:0x7fd22e34ec29 [ 184.426481][T15262] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 184.426495][T15262] RSP: 002b:00007fd22cdb7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 184.426515][T15262] RAX: ffffffffffffffda RBX: 00007fd22e595fa0 RCX: 00007fd22e34ec29 [ 184.426552][T15262] RDX: 0000000000000000 RSI: 0000200000000c40 RDI: ffffffffffffff9c [ 184.426565][T15262] RBP: 00007fd22cdb7090 R08: 0000000000000000 R09: 0000000000000000 [ 184.426579][T15262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 184.426590][T15262] R13: 00007fd22e596038 R14: 00007fd22e595fa0 R15: 00007ffd5e947498 [ 184.426613][T15262] [ 184.703546][T15274] sy{2: rxe_newlink: already configured on lo [ 184.925892][T15307] sy{2: rxe_newlink: already configured on lo [ 184.991010][T15312] 9pnet_fd: Insufficient options for proto=fd [ 185.087504][ T29] kauditd_printk_skb: 160 callbacks suppressed [ 185.087520][ T29] audit: type=1326 audit(1758320135.225:8604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15322 comm="syz.1.3134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b284eec29 code=0x7ffc0000 [ 185.134806][ T29] audit: type=1326 audit(1758320135.265:8605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15322 comm="syz.1.3134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4b284eec29 code=0x7ffc0000 [ 185.158548][ T29] audit: type=1326 audit(1758320135.265:8606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15322 comm="syz.1.3134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b284eec29 code=0x7ffc0000 [ 185.182284][ T29] audit: type=1326 audit(1758320135.265:8607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15322 comm="syz.1.3134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b284eec29 code=0x7ffc0000 [ 185.206304][ T29] audit: type=1326 audit(1758320135.265:8608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15322 comm="syz.1.3134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4b284eec29 code=0x7ffc0000 [ 185.230520][ T29] audit: type=1326 audit(1758320135.265:8609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15322 comm="syz.1.3134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b284eec29 code=0x7ffc0000 [ 185.254608][ T29] audit: type=1326 audit(1758320135.265:8610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15322 comm="syz.1.3134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b284eec29 code=0x7ffc0000 [ 185.278139][ T29] audit: type=1326 audit(1758320135.265:8611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15322 comm="syz.1.3134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4b284eec29 code=0x7ffc0000 [ 185.301896][ T29] audit: type=1326 audit(1758320135.265:8612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15322 comm="syz.1.3134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b284eec29 code=0x7ffc0000 [ 185.325603][ T29] audit: type=1326 audit(1758320135.265:8613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15322 comm="syz.1.3134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b284eec29 code=0x7ffc0000 [ 185.399213][T15334] lo: entered promiscuous mode [ 185.414916][T15334] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 185.566909][T15351] lo speed is unknown, defaulting to 1000 [ 185.601410][T15351] erspan0 speed is unknown, defaulting to 1000 [ 185.643974][T15357] rdma_rxe: rxe_newlink: failed to add lo [ 186.033116][T15406] loop4: detected capacity change from 0 to 2048 [ 186.040237][T15406] EXT4-fs: Ignoring removed i_version option [ 186.213003][T15406] ext4 filesystem being mounted at /59/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 186.249209][T15406] lo speed is unknown, defaulting to 1000 [ 186.302412][T15406] erspan0 speed is unknown, defaulting to 1000 [ 186.835442][T15436] rdma_rxe: rxe_newlink: failed to add lo [ 187.235443][T15453] loop3: detected capacity change from 0 to 512 [ 187.266492][T15453] EXT4-fs mount: 17 callbacks suppressed [ 187.266513][T15453] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 187.299587][T15453] ext4 filesystem being mounted at /122/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 187.356975][T12564] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 187.402082][T15460] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.816770][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 187.854169][T15460] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.921048][T15479] __nla_validate_parse: 4 callbacks suppressed [ 187.921067][T15479] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3164'. [ 187.940911][T15460] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.008020][T15460] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.041884][T15496] SELinux: Context system_u:object_r:iptables_unit_file_t:s0 is not valid (left unmapped). [ 188.064839][ T31] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 188.083459][ T31] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 188.101504][ T31] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 188.111159][ T31] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 188.240641][T15528] loop5: detected capacity change from 0 to 256 [ 188.271843][T15527] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(15) [ 188.278540][T15527] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 188.286081][T15527] vhci_hcd vhci_hcd.0: Device attached [ 188.316258][T15527] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(18) [ 188.322918][T15527] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 188.330475][T15527] vhci_hcd vhci_hcd.0: Device attached [ 188.376886][T15537] vhci_hcd: connection closed [ 188.377040][T15532] vhci_hcd: connection closed [ 188.382392][ T2211] vhci_hcd: stop threads [ 188.391498][ T2211] vhci_hcd: release socket [ 188.396040][ T2211] vhci_hcd: disconnect device [ 188.401886][ T2211] vhci_hcd: stop threads [ 188.406263][ T2211] vhci_hcd: release socket [ 188.410708][ T2211] vhci_hcd: disconnect device [ 188.464042][T15550] loop5: detected capacity change from 0 to 128 [ 188.485051][T15550] bio_check_eod: 18 callbacks suppressed [ 188.485068][T15550] syz.5.3184: attempt to access beyond end of device [ 188.485068][T15550] loop5: rw=2049, sector=154, nr_sectors = 8 limit=128 [ 188.507082][T15553] netlink: 180 bytes leftover after parsing attributes in process `syz.2.3185'. [ 188.514628][T15550] syz.5.3184: attempt to access beyond end of device [ 188.514628][T15550] loop5: rw=2049, sector=160, nr_sectors = 2 limit=128 [ 188.529860][T15550] buffer_io_error: 4 callbacks suppressed [ 188.529875][T15550] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 188.546183][T15550] syz.5.3184: attempt to access beyond end of device [ 188.546183][T15550] loop5: rw=2049, sector=162, nr_sectors = 8 limit=128 [ 188.563450][T15550] syz.5.3184: attempt to access beyond end of device [ 188.563450][T15550] loop5: rw=2049, sector=168, nr_sectors = 2 limit=128 [ 188.576992][T15550] Buffer I/O error on dev loop5, logical block 84, lost async page write [ 188.587091][T15550] syz.5.3184: attempt to access beyond end of device [ 188.587091][T15550] loop5: rw=2049, sector=186, nr_sectors = 8 limit=128 [ 188.601153][T15550] syz.5.3184: attempt to access beyond end of device [ 188.601153][T15550] loop5: rw=2049, sector=192, nr_sectors = 2 limit=128 [ 188.614691][T15550] Buffer I/O error on dev loop5, logical block 96, lost async page write [ 188.625330][T15550] syz.5.3184: attempt to access beyond end of device [ 188.625330][T15550] loop5: rw=2049, sector=194, nr_sectors = 8 limit=128 [ 188.641355][T15550] syz.5.3184: attempt to access beyond end of device [ 188.641355][T15550] loop5: rw=2049, sector=200, nr_sectors = 2 limit=128 [ 188.654845][T15550] Buffer I/O error on dev loop5, logical block 100, lost async page write [ 188.664901][T15550] syz.5.3184: attempt to access beyond end of device [ 188.664901][T15550] loop5: rw=2049, sector=218, nr_sectors = 8 limit=128 [ 188.671580][T15557] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3186'. [ 188.678956][T15550] syz.5.3184: attempt to access beyond end of device [ 188.678956][T15550] loop5: rw=2049, sector=224, nr_sectors = 2 limit=128 [ 188.700676][T15550] Buffer I/O error on dev loop5, logical block 112, lost async page write [ 188.710712][T15550] Buffer I/O error on dev loop5, logical block 116, lost async page write [ 188.722167][T15550] Buffer I/O error on dev loop5, logical block 88, lost async page write [ 188.729644][T15557] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3186'. [ 188.740050][T15550] Buffer I/O error on dev loop5, logical block 92, lost async page write [ 188.760075][T15550] Buffer I/O error on dev loop5, logical block 120, lost async page write [ 188.781456][T15550] Buffer I/O error on dev loop5, logical block 124, lost async page write [ 188.848668][T15568] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 649 [ 188.893983][T15577] netlink: 180 bytes leftover after parsing attributes in process `syz.1.3193'. [ 189.239648][T15604] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3201'. [ 189.844379][T15650] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3219'. [ 189.853443][T15650] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3219'. [ 190.273695][T15629] syz.5.3209 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), order=0, oom_score_adj=1000 [ 190.288416][T15629] CPU: 0 UID: 0 PID: 15629 Comm: syz.5.3209 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 190.288470][T15629] Tainted: [W]=WARN [ 190.288514][T15629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 190.288525][T15629] Call Trace: [ 190.288534][T15629] [ 190.288543][T15629] __dump_stack+0x1d/0x30 [ 190.288567][T15629] dump_stack_lvl+0xe8/0x140 [ 190.288585][T15629] dump_stack+0x15/0x1b [ 190.288599][T15629] dump_header+0x81/0x220 [ 190.288642][T15629] oom_kill_process+0x342/0x400 [ 190.288724][T15629] out_of_memory+0x979/0xb80 [ 190.288769][T15629] try_charge_memcg+0x5e6/0x9e0 [ 190.288808][T15629] obj_cgroup_charge_pages+0xa6/0x150 [ 190.288843][T15629] __memcg_kmem_charge_page+0x9f/0x170 [ 190.288956][T15629] __alloc_frozen_pages_noprof+0x188/0x360 [ 190.288993][T15629] alloc_pages_mpol+0xb3/0x250 [ 190.289023][T15629] alloc_pages_noprof+0x90/0x130 [ 190.289072][T15629] __vmalloc_node_range_noprof+0x6f2/0xe00 [ 190.289114][T15629] __kvmalloc_node_noprof+0x30f/0x4e0 [ 190.289143][T15629] ? ip_set_alloc+0x1f/0x30 [ 190.289223][T15629] ? ip_set_alloc+0x1f/0x30 [ 190.289306][T15629] ? __kmalloc_cache_noprof+0x189/0x320 [ 190.289332][T15629] ip_set_alloc+0x1f/0x30 [ 190.289352][T15629] hash_netiface_create+0x282/0x740 [ 190.289377][T15629] ? __pfx_hash_netiface_create+0x10/0x10 [ 190.289419][T15629] ip_set_create+0x3c9/0x960 [ 190.289451][T15629] ? __nla_parse+0x40/0x60 [ 190.289480][T15629] nfnetlink_rcv_msg+0x4c3/0x590 [ 190.289523][T15629] netlink_rcv_skb+0x123/0x220 [ 190.289548][T15629] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 190.289636][T15629] nfnetlink_rcv+0x16b/0x1690 [ 190.289656][T15629] ? nlmon_xmit+0x4f/0x60 [ 190.289684][T15629] ? consume_skb+0x49/0x150 [ 190.289705][T15629] ? nlmon_xmit+0x4f/0x60 [ 190.289758][T15629] ? dev_hard_start_xmit+0x3b0/0x3e0 [ 190.289789][T15629] ? __dev_queue_xmit+0x1200/0x2000 [ 190.289887][T15629] ? __dev_queue_xmit+0x182/0x2000 [ 190.289912][T15629] ? ref_tracker_free+0x37d/0x3e0 [ 190.289989][T15629] ? __netlink_deliver_tap+0x4dc/0x500 [ 190.290021][T15629] netlink_unicast+0x5bd/0x690 [ 190.290048][T15629] netlink_sendmsg+0x58b/0x6b0 [ 190.290073][T15629] ? __pfx_netlink_sendmsg+0x10/0x10 [ 190.290114][T15629] __sock_sendmsg+0x145/0x180 [ 190.290146][T15629] ____sys_sendmsg+0x31e/0x4e0 [ 190.290174][T15629] ___sys_sendmsg+0x17b/0x1d0 [ 190.290290][T15629] __x64_sys_sendmsg+0xd4/0x160 [ 190.290323][T15629] x64_sys_call+0x191e/0x2ff0 [ 190.290344][T15629] do_syscall_64+0xd2/0x200 [ 190.290423][T15629] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 190.290446][T15629] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 190.290474][T15629] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 190.290549][T15629] RIP: 0033:0x7fb24adaec29 [ 190.290567][T15629] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 190.290586][T15629] RSP: 002b:00007fb24980f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 190.290604][T15629] RAX: ffffffffffffffda RBX: 00007fb24aff5fa0 RCX: 00007fb24adaec29 [ 190.290616][T15629] RDX: 0000000000000800 RSI: 0000200000000040 RDI: 0000000000000003 [ 190.290658][T15629] RBP: 00007fb24ae31e41 R08: 0000000000000000 R09: 0000000000000000 [ 190.290672][T15629] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 190.290701][T15629] R13: 00007fb24aff6038 R14: 00007fb24aff5fa0 R15: 00007fff91530518 [ 190.290720][T15629] [ 190.290744][T15629] memory: usage 307200kB, limit 307200kB, failcnt 101 [ 190.388042][T15698] loop3: detected capacity change from 0 to 512 [ 190.388263][T15629] memory+swap: usage 307456kB, limit 9007199254740988kB, failcnt 0 [ 190.416895][T15698] EXT4-fs (loop3): 1 orphan inode deleted [ 190.418005][T15629] kmem: usage 307196kB, limit 9007199254740988kB, failcnt 0 [ 190.424565][T15698] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 190.428670][T15629] Memory cgroup stats for [ 190.433616][T15698] ext4 filesystem being mounted at /132/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 190.438364][T15629] /syz5: [ 190.692937][ T2211] __quota_error: 408 callbacks suppressed [ 190.692953][ T2211] Quota error (device loop3): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 190.693054][ T2211] EXT4-fs error (device loop3): ext4_release_dquot:6973: comm kworker/u8:7: Failed to release dquot type 1 [ 190.694177][T15629] cache 0 [ 190.694185][T15629] rss 0 [ 190.694193][T15629] shmem 0 [ 190.694200][T15629] mapped_file 0 [ 190.694282][T15629] dirty 0 [ 190.694296][T15629] writeback 0 [ 190.694304][T15629] workingset_refault_anon 67 [ 190.694313][T15629] workingset_refault_file 0 [ 190.694320][T15629] swap 262144 [ 190.694326][T15629] swapcached 0 [ 190.694332][T15629] pgpgin 86049 [ 190.694338][T15629] pgpgout 86048 [ 190.694385][T15629] pgfault 114727 [ 190.694397][T15629] pgmajfault 16 [ 190.694403][T15629] inactive_anon 0 [ 190.694409][T15629] active_anon 0 [ 190.694416][T15629] inactive_file 0 [ 190.694423][T15629] active_file 4096 [ 190.694430][T15629] unevictable 0 [ 190.694436][T15629] hierarchical_memory_limit 314572800 [ 190.694444][T15629] hierarchical_memsw_limit 9223372036854771712 [ 190.694451][T15629] total_cache 0 [ 190.694458][T15629] total_rss 0 [ 190.694466][T15629] total_shmem 0 [ 190.694473][T15629] total_mapped_file 0 [ 190.694516][T15629] total_dirty 0 [ 190.694524][T15629] total_writeback 0 [ 190.694532][T15629] total_workingset_refault_anon 67 [ 190.694542][T15629] total_workingset_refault_file 0 [ 190.694550][T15629] total_swap 262144 [ 190.694557][T15629] total_swapcached 0 [ 190.694565][T15629] total_pgpgin 86049 [ 190.694621][T15629] total_pgpgout 86048 [ 190.694661][T15629] total_pgfault 114727 [ 190.694667][T15629] total_pgmajfault 16 [ 190.694673][T15629] total_inactive_anon 0 [ 190.694681][T15629] total_active_anon 0 [ 190.694689][T15629] total_inactive_file 0 [ 190.694696][T15629] total_active_file 4096 [ 190.694703][T15629] total_unevictable 0 [ 190.694711][T15629] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz5,task_memcg=/syz5,task=syz.5.3209,pid=15628,uid=0 [ 190.694873][T15629] Memory cgroup out of memory: Killed process 15628 (syz.5.3209) total-vm:93760kB, anon-rss:1200kB, file-rss:22088kB, shmem-rss:0kB, UID:0 pgtables:120kB oom_score_adj:1000 [ 190.706982][T15698] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 190.947978][T15698] loop3: detected capacity change from 0 to 512 [ 190.955098][T15698] EXT4-fs: Ignoring removed oldalloc option [ 190.964070][T15698] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 190.992096][T15698] EXT4-fs (loop3): 1 truncate cleaned up [ 190.998606][T15698] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 191.028694][T12564] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 191.070470][ T29] audit: type=1326 audit(1758320141.205:9022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15723 comm="syz.3.3235" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0c5b24ec29 code=0x0 [ 191.106262][T15726] SELinux: syz.2.3234 (15726) wrote to /sys/fs/selinux/user! This will not be supported in the future; please update your userspace. [ 191.107721][T15727] loop4: detected capacity change from 0 to 2048 [ 191.138426][T15727] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 191.175078][T15739] netlink: 'syz.3.3235': attribute type 1 has an invalid length. [ 191.185686][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 191.223742][T15738] bridge_slave_0: left allmulticast mode [ 191.231947][T15738] bridge_slave_0: left promiscuous mode [ 191.243929][T15738] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.288264][T15738] bridge_slave_1: left allmulticast mode [ 191.297166][T15738] bridge_slave_1: left promiscuous mode [ 191.304724][T15738] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.486727][T15738] team0: Port device C removed [ 191.568459][T15738] team0: Port device team_slave_1 removed [ 191.646066][T15761] sy{2: rxe_newlink: already configured on lo [ 191.688113][ T29] audit: type=1400 audit(1758320141.825:9023): avc: denied { relabelto } for pid=15764 comm="syz.1.3252" name="568" dev="tmpfs" ino=3030 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:hwdata_t:s0" [ 191.714730][ T29] audit: type=1400 audit(1758320141.825:9024): avc: denied { associate } for pid=15764 comm="syz.1.3252" name="568" dev="tmpfs" ino=3030 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:hwdata_t:s0" [ 191.850800][T15771] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3255'. [ 191.912431][T15782] 9pnet_fd: Insufficient options for proto=fd [ 192.001706][T15784] loop3: detected capacity change from 0 to 512 [ 192.020863][T15784] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 192.042336][T15784] EXT4-fs (loop3): can't mount with data=, fs mounted w/o journal [ 192.062961][ T29] audit: type=1326 audit(1758320142.195:9025): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15792 comm="syz.5.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 192.088444][T15793] loop5: detected capacity change from 0 to 512 [ 192.098644][T15793] EXT4-fs: Ignoring removed bh option [ 192.116583][ T29] audit: type=1326 audit(1758320142.195:9026): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15792 comm="syz.5.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=238 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 192.140209][ T29] audit: type=1326 audit(1758320142.195:9027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15792 comm="syz.5.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 192.164062][ T29] audit: type=1326 audit(1758320142.195:9028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15792 comm="syz.5.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 192.175111][T15793] EXT4-fs error (device loop5): ext4_xattr_inode_iget:433: comm syz.5.3263: Parent and EA inode have the same ino 15 [ 192.187520][ T29] audit: type=1326 audit(1758320142.195:9029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15792 comm="syz.5.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 192.223475][ T29] audit: type=1326 audit(1758320142.195:9030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15792 comm="syz.5.3263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 192.254363][T15793] EXT4-fs (loop5): 1 orphan inode deleted [ 192.260705][T15793] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 192.303962][ T7261] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 192.334478][T15807] netem: incorrect ge model size [ 192.339480][T15807] netem: change failed [ 192.361203][T15784] lo speed is unknown, defaulting to 1000 [ 192.630902][T15784] erspan0 speed is unknown, defaulting to 1000 [ 192.766574][T15838] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3273'. [ 192.780174][T15838] binfmt_misc: register: failed to install interpreter file ./file2 [ 192.877209][T15840] loop5: detected capacity change from 0 to 512 [ 192.918306][T15840] ext4: Unknown parameter 'measure' [ 193.050963][T15847] loop4: detected capacity change from 0 to 512 [ 193.073220][T15847] EXT4-fs (loop4): bad block size 8192 [ 193.143189][T15854] loop4: detected capacity change from 0 to 512 [ 193.150351][T15854] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 193.164724][T15854] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 193.180802][T15854] EXT4-fs (loop4): 1 truncate cleaned up [ 193.189962][T15854] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 193.215212][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 193.382801][T15892] rdma_rxe: rxe_newlink: failed to add lo [ 193.443843][T15906] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3288'. [ 193.466020][T15908] loop5: detected capacity change from 0 to 512 [ 193.487996][T15911] rdma_rxe: rxe_newlink: failed to add lo [ 193.540485][T15906] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=46 sclass=netlink_xfrm_socket pid=15906 comm=syz.1.3288 [ 193.586890][T15926] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3294'. [ 193.611745][T15926] lo speed is unknown, defaulting to 1000 [ 193.646934][T15926] erspan0 speed is unknown, defaulting to 1000 [ 193.728645][T15940] sctp: [Deprecated]: syz.4.3297 (pid 15940) Use of struct sctp_assoc_value in delayed_ack socket option. [ 193.728645][T15940] Use struct sctp_sack_info instead [ 193.916592][T15979] ref_ctr increment failed for inode: 0xc1f offset: 0xb ref_ctr_offset: 0x82 of mm: 0xffff888103c6c500 [ 193.934495][T15979] ref_ctr increment failed for inode: 0xc1f offset: 0xf ref_ctr_offset: 0x82 of mm: 0xffff888103c6c500 [ 193.947317][T15978] uprobe: syz.1.3302:15978 failed to unregister, leaking uprobe [ 194.034559][T15978] uprobe: syz.1.3302:15978 failed to unregister, leaking uprobe [ 194.098287][T15986] vhci_hcd: invalid port number 96 [ 194.103492][T15986] vhci_hcd: default hub control req: 0300 vfffa i0060 l0 [ 194.115551][T15986] sch_tbf: peakrate 255 is lower than or equals to rate 17038211371681383082 ! [ 194.214613][T15991] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3306'. [ 194.223615][T15991] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3306'. [ 194.591465][T16022] gre1: entered promiscuous mode [ 194.727499][T16032] netlink: 'syz.3.3319': attribute type 1 has an invalid length. [ 194.735329][T16032] netlink: 198116 bytes leftover after parsing attributes in process `syz.3.3319'. [ 194.745638][T16033] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3318'. [ 194.762516][T16032] loop3: detected capacity change from 0 to 2048 [ 194.870639][T16046] rdma_rxe: rxe_newlink: failed to add lo [ 194.904164][T16042] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=16042 comm=syz.3.3322 [ 194.972119][T16063] loop5: detected capacity change from 0 to 512 [ 194.981122][T16063] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 194.999694][T16063] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 195.033143][T16063] EXT4-fs (loop5): 1 truncate cleaned up [ 195.041865][T16063] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 195.081886][ T7261] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 195.100093][T16081] syzkaller1: entered promiscuous mode [ 195.105771][T16081] syzkaller1: entered allmulticast mode [ 195.300613][T16107] lo speed is unknown, defaulting to 1000 [ 195.338544][T16107] erspan0 speed is unknown, defaulting to 1000 [ 195.601820][T16170] loop4: detected capacity change from 0 to 2048 [ 195.656767][T16170] Alternate GPT is invalid, using primary GPT. [ 195.663019][T16170] loop4: p1 p2 p3 [ 195.745557][ T29] kauditd_printk_skb: 258 callbacks suppressed [ 195.745572][ T29] audit: type=1326 audit(1758320145.885:9289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16192 comm="syz.5.3361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 195.788579][ T29] audit: type=1326 audit(1758320145.915:9290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16192 comm="syz.5.3361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 195.812258][ T29] audit: type=1326 audit(1758320145.915:9291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16192 comm="syz.5.3361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 195.836079][ T29] audit: type=1326 audit(1758320145.915:9292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16192 comm="syz.5.3361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 195.859666][ T29] audit: type=1326 audit(1758320145.915:9293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16192 comm="syz.5.3361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 195.883883][ T29] audit: type=1326 audit(1758320145.915:9294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16192 comm="syz.5.3361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 195.907555][ T29] audit: type=1326 audit(1758320145.915:9295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16192 comm="syz.5.3361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 195.911310][ T2211] nci: nci_rx_work: unknown MT 0x6 [ 195.931302][ T29] audit: type=1326 audit(1758320145.915:9296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16192 comm="syz.5.3361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 195.959992][ T29] audit: type=1326 audit(1758320145.915:9297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16192 comm="syz.5.3361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 195.983508][ T29] audit: type=1326 audit(1758320145.915:9298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16192 comm="syz.5.3361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 196.075457][T16227] FAULT_INJECTION: forcing a failure. [ 196.075457][T16227] name failslab, interval 1, probability 0, space 0, times 0 [ 196.088195][T16227] CPU: 0 UID: 0 PID: 16227 Comm: syz.1.3367 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 196.088228][T16227] Tainted: [W]=WARN [ 196.088235][T16227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 196.088248][T16227] Call Trace: [ 196.088255][T16227] [ 196.088263][T16227] __dump_stack+0x1d/0x30 [ 196.088364][T16227] dump_stack_lvl+0xe8/0x140 [ 196.088382][T16227] dump_stack+0x15/0x1b [ 196.088399][T16227] should_fail_ex+0x265/0x280 [ 196.088426][T16227] should_failslab+0x8c/0xb0 [ 196.088453][T16227] __kmalloc_node_track_caller_noprof+0xa4/0x410 [ 196.088541][T16227] ? sidtab_sid2str_get+0xa0/0x130 [ 196.088566][T16227] kmemdup_noprof+0x2b/0x70 [ 196.088636][T16227] sidtab_sid2str_get+0xa0/0x130 [ 196.088654][T16227] security_sid_to_context_core+0x1eb/0x2e0 [ 196.088675][T16227] security_sid_to_context+0x27/0x40 [ 196.088706][T16227] selinux_lsmprop_to_secctx+0x67/0xf0 [ 196.088726][T16227] security_lsmprop_to_secctx+0x43/0x80 [ 196.088749][T16227] audit_log_task_context+0x77/0x190 [ 196.088835][T16227] audit_log_task+0xf4/0x250 [ 196.088865][T16227] audit_seccomp+0x61/0x100 [ 196.088892][T16227] ? __seccomp_filter+0x68c/0x10d0 [ 196.088915][T16227] __seccomp_filter+0x69d/0x10d0 [ 196.089020][T16227] ? shmctl_stat+0x2bf/0x2f0 [ 196.089051][T16227] ? __se_sys_shmctl+0x21a/0x420 [ 196.089154][T16227] ? bpf_trace_run2+0x124/0x1c0 [ 196.089182][T16227] __secure_computing+0x82/0x150 [ 196.089204][T16227] syscall_trace_enter+0xcf/0x1e0 [ 196.089289][T16227] do_syscall_64+0xac/0x200 [ 196.089323][T16227] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 196.089346][T16227] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 196.089519][T16227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.089541][T16227] RIP: 0033:0x7f4b284ed63c [ 196.089561][T16227] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 196.089628][T16227] RSP: 002b:00007f4b26f4f030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 196.089648][T16227] RAX: ffffffffffffffda RBX: 00007f4b28735fa0 RCX: 00007f4b284ed63c [ 196.089677][T16227] RDX: 000000000000000f RSI: 00007f4b26f4f0a0 RDI: 0000000000000005 [ 196.089688][T16227] RBP: 00007f4b26f4f090 R08: 0000000000000000 R09: 0000000000000000 [ 196.089699][T16227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.089709][T16227] R13: 00007f4b28736038 R14: 00007f4b28735fa0 R15: 00007ffd6f090788 [ 196.089726][T16227] [ 196.089868][ T12] nci: nci_rx_work: unknown MT 0x6 [ 196.525570][T16231] lo speed is unknown, defaulting to 1000 [ 196.603166][T16231] erspan0 speed is unknown, defaulting to 1000 [ 196.698247][ T12] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 196.708119][ T12] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.779617][ T12] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 196.789656][ T12] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.832867][T16375] loop5: detected capacity change from 0 to 1024 [ 196.841512][T16231] chnl_net:caif_netlink_parms(): no params data found [ 196.855991][ T12] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 196.865891][ T12] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.877570][T16375] EXT4-fs (loop5): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 196.908507][T16375] ext4 filesystem being mounted at /530/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 196.948886][ T12] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 196.958764][ T12] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.009758][ T7261] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 197.052317][T16231] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.059461][T16231] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.091382][T16231] bridge_slave_0: entered allmulticast mode [ 197.098506][T16231] bridge_slave_0: entered promiscuous mode [ 197.159468][T16231] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.166644][T16231] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.178662][T16231] bridge_slave_1: entered allmulticast mode [ 197.195381][T16231] bridge_slave_1: entered promiscuous mode [ 197.236142][T16231] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 197.247248][T16231] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 197.256626][ T12] bridge_slave_1: left allmulticast mode [ 197.262339][ T12] bridge_slave_1: left promiscuous mode [ 197.268148][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.292978][ T12] bridge_slave_0: left allmulticast mode [ 197.298729][ T12] bridge_slave_0: left promiscuous mode [ 197.304483][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.526653][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 197.538140][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 197.547791][ T12] bond0 (unregistering): Released all slaves [ 197.558919][ T12] bond1 (unregistering): Released all slaves [ 197.574121][T16507] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3392'. [ 197.594688][ T12] tipc: Disabling bearer [ 197.599939][ T12] tipc: Disabling bearer [ 197.605105][ T12] tipc: Left network mode [ 197.609988][T16231] team0: Port device team_slave_0 added [ 197.626533][T16231] team0: Port device team_slave_1 added [ 197.668531][T16231] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 197.675604][T16231] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 197.701585][T16231] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 197.757649][ T12] hsr_slave_0: left promiscuous mode [ 197.763465][ T12] hsr_slave_1: left promiscuous mode [ 197.769432][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 197.777279][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 197.788357][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 197.795839][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 197.817084][ T12] veth1_macvtap: left promiscuous mode [ 197.822676][ T12] veth0_macvtap: left promiscuous mode [ 197.830061][ T12] veth1_vlan: left promiscuous mode [ 197.836440][ T12] veth0_vlan: left promiscuous mode [ 197.860163][T16574] rdma_rxe: rxe_newlink: failed to add lo [ 197.903785][T16576] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3401'. [ 197.934301][ T12] team0 (unregistering): Port device team_slave_1 removed [ 197.943881][ T12] team0 (unregistering): Port device team_slave_0 removed [ 197.973509][ T31] smc: removing ib device sy{2 [ 197.980145][T16231] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 197.987250][T16231] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 198.013343][T16231] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 198.067017][T16560] macsec1: entered promiscuous mode [ 198.072332][T16560] bridge0: entered promiscuous mode [ 198.079278][T16560] bridge0: port 3(macsec1) entered blocking state [ 198.085796][T16560] bridge0: port 3(macsec1) entered disabled state [ 198.092721][T16560] macsec1: entered allmulticast mode [ 198.098264][T16560] bridge0: entered allmulticast mode [ 198.104717][T16560] macsec1: left allmulticast mode [ 198.109791][T16560] bridge0: left allmulticast mode [ 198.116163][T16560] bridge0: left promiscuous mode [ 198.143207][ T5362] lo speed is unknown, defaulting to 1000 [ 198.149095][ T5362] sy{2: Port: 1 Link DOWN [ 198.162393][T16576] 8021q: adding VLAN 0 to HW filter on device bond1 [ 198.195374][T16231] hsr_slave_0: entered promiscuous mode [ 198.201398][T16231] hsr_slave_1: entered promiscuous mode [ 198.207477][T16231] debugfs: 'hsr0' already exists in 'hsr' [ 198.213221][T16231] Cannot create hsr debugfs directory [ 198.495906][ T12] IPVS: stop unused estimator thread 0... [ 198.561054][T16753] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 198.622392][T16754] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3410'. [ 198.675126][T16231] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 198.686727][T16231] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 198.710375][T16231] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 198.724367][T16231] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 198.818706][T16231] 8021q: adding VLAN 0 to HW filter on device bond0 [ 198.844521][T16231] 8021q: adding VLAN 0 to HW filter on device team0 [ 198.863168][ T378] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.870361][ T378] bridge0: port 1(bridge_slave_0) entered forwarding state [ 198.883514][ T378] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.890605][ T378] bridge0: port 2(bridge_slave_1) entered forwarding state [ 198.919434][T16231] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 198.970237][T16804] loop4: detected capacity change from 0 to 512 [ 198.985511][T16804] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 199.014971][T16231] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 199.025257][T16804] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 199.050686][T16804] EXT4-fs (loop4): 1 truncate cleaned up [ 199.065733][T16804] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 199.149407][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 199.172177][T16231] veth0_vlan: entered promiscuous mode [ 199.184304][T16231] veth1_vlan: entered promiscuous mode [ 199.214710][T16231] veth0_macvtap: entered promiscuous mode [ 199.360372][T16231] veth1_macvtap: entered promiscuous mode [ 199.380116][T16231] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 199.405740][T16231] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 199.415371][ T31] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.434222][ T31] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.453717][ T31] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.476255][ T31] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.545981][T16836] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3424'. [ 199.573270][T16836] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=16836 comm=syz.1.3424 [ 200.053701][T16851] loop5: detected capacity change from 0 to 128 [ 200.062435][T16851] bio_check_eod: 18 callbacks suppressed [ 200.062451][T16851] syz.5.3429: attempt to access beyond end of device [ 200.062451][T16851] loop5: rw=2049, sector=154, nr_sectors = 8 limit=128 [ 200.082178][T16851] syz.5.3429: attempt to access beyond end of device [ 200.082178][T16851] loop5: rw=2049, sector=160, nr_sectors = 2 limit=128 [ 200.095692][T16851] buffer_io_error: 4 callbacks suppressed [ 200.095738][T16851] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 200.110199][T16851] syz.5.3429: attempt to access beyond end of device [ 200.110199][T16851] loop5: rw=2049, sector=162, nr_sectors = 8 limit=128 [ 200.125268][T16851] syz.5.3429: attempt to access beyond end of device [ 200.125268][T16851] loop5: rw=2049, sector=168, nr_sectors = 2 limit=128 [ 200.139156][T16851] Buffer I/O error on dev loop5, logical block 84, lost async page write [ 200.148052][T16851] syz.5.3429: attempt to access beyond end of device [ 200.148052][T16851] loop5: rw=2049, sector=186, nr_sectors = 8 limit=128 [ 200.162349][T16851] syz.5.3429: attempt to access beyond end of device [ 200.162349][T16851] loop5: rw=2049, sector=192, nr_sectors = 2 limit=128 [ 200.175808][T16851] Buffer I/O error on dev loop5, logical block 96, lost async page write [ 200.185000][T16851] syz.5.3429: attempt to access beyond end of device [ 200.185000][T16851] loop5: rw=2049, sector=194, nr_sectors = 8 limit=128 [ 200.198979][T16851] syz.5.3429: attempt to access beyond end of device [ 200.198979][T16851] loop5: rw=2049, sector=200, nr_sectors = 2 limit=128 [ 200.212462][T16851] Buffer I/O error on dev loop5, logical block 100, lost async page write [ 200.221603][T16851] syz.5.3429: attempt to access beyond end of device [ 200.221603][T16851] loop5: rw=2049, sector=218, nr_sectors = 8 limit=128 [ 200.235446][T16851] syz.5.3429: attempt to access beyond end of device [ 200.235446][T16851] loop5: rw=2049, sector=224, nr_sectors = 2 limit=128 [ 200.248922][T16851] Buffer I/O error on dev loop5, logical block 112, lost async page write [ 200.258102][T16851] Buffer I/O error on dev loop5, logical block 116, lost async page write [ 200.271466][T16851] Buffer I/O error on dev loop5, logical block 88, lost async page write [ 200.276124][T16857] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3430'. [ 200.282238][T16851] Buffer I/O error on dev loop5, logical block 92, lost async page write [ 200.298247][T16851] Buffer I/O error on dev loop5, logical block 120, lost async page write [ 200.308327][T16851] Buffer I/O error on dev loop5, logical block 124, lost async page write [ 200.333210][T16859] loop4: detected capacity change from 0 to 512 [ 200.340407][T16859] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 200.351938][T16859] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 200.366963][T16859] EXT4-fs (loop4): 1 truncate cleaned up [ 200.372963][T16859] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 200.401917][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 200.560829][T16891] netlink: 'syz.4.3437': attribute type 1 has an invalid length. [ 200.819465][T16915] loop3: detected capacity change from 0 to 512 [ 200.847312][T16915] EXT4-fs (loop3): too many log groups per flexible block group [ 200.855228][T16915] EXT4-fs (loop3): failed to initialize mballoc (-12) [ 200.874096][T16915] EXT4-fs (loop3): mount failed [ 201.168983][T16888] +}[@ invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), order=0, oom_score_adj=1000 [ 201.182773][T16888] CPU: 0 UID: 0 PID: 16888 Comm: +}[@ Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 201.182804][T16888] Tainted: [W]=WARN [ 201.182811][T16888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 201.182903][T16888] Call Trace: [ 201.182911][T16888] [ 201.182919][T16888] __dump_stack+0x1d/0x30 [ 201.182940][T16888] dump_stack_lvl+0xe8/0x140 [ 201.182957][T16888] dump_stack+0x15/0x1b [ 201.182984][T16888] dump_header+0x81/0x220 [ 201.183027][T16888] oom_kill_process+0x342/0x400 [ 201.183088][T16888] out_of_memory+0x979/0xb80 [ 201.183194][T16888] try_charge_memcg+0x5e6/0x9e0 [ 201.183275][T16888] obj_cgroup_charge_pages+0xa6/0x150 [ 201.183337][T16888] __memcg_kmem_charge_page+0x9f/0x170 [ 201.183367][T16888] __alloc_frozen_pages_noprof+0x188/0x360 [ 201.183462][T16888] alloc_pages_mpol+0xb3/0x250 [ 201.183498][T16888] alloc_pages_noprof+0x90/0x130 [ 201.183537][T16888] __vmalloc_node_range_noprof+0x6f2/0xe00 [ 201.183613][T16888] __kvmalloc_node_noprof+0x30f/0x4e0 [ 201.183645][T16888] ? ip_set_alloc+0x1f/0x30 [ 201.183712][T16888] ? ip_set_alloc+0x1f/0x30 [ 201.183733][T16888] ? __kmalloc_cache_noprof+0x189/0x320 [ 201.183808][T16888] ip_set_alloc+0x1f/0x30 [ 201.183837][T16888] hash_netiface_create+0x282/0x740 [ 201.183864][T16888] ? __pfx_hash_netiface_create+0x10/0x10 [ 201.183890][T16888] ip_set_create+0x3c9/0x960 [ 201.183948][T16888] ? __nla_parse+0x40/0x60 [ 201.183977][T16888] nfnetlink_rcv_msg+0x4c3/0x590 [ 201.184022][T16888] netlink_rcv_skb+0x123/0x220 [ 201.184117][T16888] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 201.184164][T16888] nfnetlink_rcv+0x16b/0x1690 [ 201.184186][T16888] ? nlmon_xmit+0x4f/0x60 [ 201.184269][T16888] ? consume_skb+0x49/0x150 [ 201.184295][T16888] ? nlmon_xmit+0x4f/0x60 [ 201.184326][T16888] ? dev_hard_start_xmit+0x3b0/0x3e0 [ 201.184357][T16888] ? __dev_queue_xmit+0x1200/0x2000 [ 201.184463][T16888] ? __dev_queue_xmit+0x182/0x2000 [ 201.184491][T16888] ? ref_tracker_free+0x37d/0x3e0 [ 201.184529][T16888] ? __netlink_deliver_tap+0x4dc/0x500 [ 201.184555][T16888] netlink_unicast+0x5bd/0x690 [ 201.184590][T16888] netlink_sendmsg+0x58b/0x6b0 [ 201.184656][T16888] ? __pfx_netlink_sendmsg+0x10/0x10 [ 201.184721][T16888] __sock_sendmsg+0x145/0x180 [ 201.184752][T16888] ____sys_sendmsg+0x31e/0x4e0 [ 201.184780][T16888] ___sys_sendmsg+0x17b/0x1d0 [ 201.184816][T16888] __x64_sys_sendmsg+0xd4/0x160 [ 201.185048][T16888] x64_sys_call+0x191e/0x2ff0 [ 201.185068][T16888] do_syscall_64+0xd2/0x200 [ 201.185101][T16888] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 201.185126][T16888] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 201.185168][T16888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.185189][T16888] RIP: 0033:0x7fb24adaec29 [ 201.185206][T16888] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 201.185225][T16888] RSP: 002b:00007fb24980f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 201.185260][T16888] RAX: ffffffffffffffda RBX: 00007fb24aff5fa0 RCX: 00007fb24adaec29 [ 201.185274][T16888] RDX: 0000000000000800 RSI: 0000200000000040 RDI: 0000000000000005 [ 201.185288][T16888] RBP: 00007fb24ae31e41 R08: 0000000000000000 R09: 0000000000000000 [ 201.185301][T16888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 201.185314][T16888] R13: 00007fb24aff6038 R14: 00007fb24aff5fa0 R15: 00007fff91530518 [ 201.185335][T16888] [ 201.519876][T16888] memory: usage 307196kB, limit 307200kB, failcnt 407 [ 201.526874][T16888] memory+swap: usage 307452kB, limit 9007199254740988kB, failcnt 0 [ 201.534983][T16888] kmem: usage 307184kB, limit 9007199254740988kB, failcnt 0 [ 201.542292][T16888] Memory cgroup stats for /syz5: [ 201.542579][T16888] cache 0 [ 201.550526][T16888] rss 4096 [ 201.553559][T16888] shmem 0 [ 201.556543][T16888] mapped_file 0 [ 201.559994][T16888] dirty 0 [ 201.562923][T16888] writeback 0 [ 201.566318][T16888] workingset_refault_anon 142 [ 201.570984][T16888] workingset_refault_file 0 [ 201.575551][T16888] swap 262144 [ 201.578929][T16888] swapcached 4096 [ 201.582562][T16888] pgpgin 108831 [ 201.586108][T16888] pgpgout 108828 [ 201.589646][T16888] pgfault 125057 [ 201.593199][T16888] pgmajfault 47 [ 201.596726][T16888] inactive_anon 0 [ 201.600437][T16888] active_anon 0 [ 201.603887][T16888] inactive_file 8192 [ 201.607877][T16888] active_file 0 [ 201.611324][T16888] unevictable 0 [ 201.614995][T16888] hierarchical_memory_limit 314572800 [ 201.620355][T16888] hierarchical_memsw_limit 9223372036854771712 [ 201.626588][T16888] total_cache 0 [ 201.630038][T16888] total_rss 4096 [ 201.633609][T16888] total_shmem 0 [ 201.637103][T16888] total_mapped_file 0 [ 201.641094][T16888] total_dirty 0 [ 201.644615][T16888] total_writeback 0 [ 201.648433][T16888] total_workingset_refault_anon 142 [ 201.653670][T16888] total_workingset_refault_file 0 [ 201.658743][T16888] total_swap 262144 [ 201.662722][T16888] total_swapcached 4096 [ 201.666907][T16888] total_pgpgin 108831 [ 201.670909][T16888] total_pgpgout 108828 [ 201.675012][T16888] total_pgfault 125057 [ 201.679067][T16888] total_pgmajfault 47 [ 201.683046][T16888] total_inactive_anon 0 [ 201.687217][T16888] total_active_anon 0 [ 201.691212][T16888] total_inactive_file 8192 [ 201.695638][T16888] total_active_file 0 [ 201.699612][T16888] total_unevictable 0 [ 201.703603][T16888] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz5,task_memcg=/syz5,task=syz.5.3443,pid=16887,uid=0 [ 201.718470][T16888] Memory cgroup out of memory: Killed process 16887 (syz.5.3443) total-vm:93760kB, anon-rss:1072kB, file-rss:22220kB, shmem-rss:0kB, UID:0 pgtables:120kB oom_score_adj:1000 [ 201.826595][T16942] erspan0 speed is unknown, defaulting to 1000 [ 202.042397][T16980] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3463'. [ 202.175644][T16994] IPv6: NLM_F_CREATE should be specified when creating new route [ 202.373773][ T29] kauditd_printk_skb: 265 callbacks suppressed [ 202.373830][ T29] audit: type=1326 audit(1758320152.505:9563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17014 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaedb1ec29 code=0x7ffc0000 [ 202.428510][ T29] audit: type=1326 audit(1758320152.545:9564): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17014 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ffaedb1ec29 code=0x7ffc0000 [ 202.452164][ T29] audit: type=1326 audit(1758320152.545:9565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17014 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaedb1ec29 code=0x7ffc0000 [ 202.475888][ T29] audit: type=1326 audit(1758320152.545:9566): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17014 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ffaedb1ec29 code=0x7ffc0000 [ 202.499703][ T29] audit: type=1326 audit(1758320152.545:9567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17014 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaedb1ec29 code=0x7ffc0000 [ 202.523625][ T29] audit: type=1326 audit(1758320152.545:9568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17014 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ffaedb1ec29 code=0x7ffc0000 [ 202.547413][ T29] audit: type=1326 audit(1758320152.545:9569): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17014 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaedb1ec29 code=0x7ffc0000 [ 202.570977][ T29] audit: type=1326 audit(1758320152.545:9570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17014 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=c000003e syscall=48 compat=0 ip=0x7ffaedb1ec29 code=0x7ffc0000 [ 202.595281][ T29] audit: type=1326 audit(1758320152.545:9571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17014 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaedb1ec29 code=0x7ffc0000 [ 202.618862][ T29] audit: type=1326 audit(1758320152.545:9572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17014 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7ffaedb1ec29 code=0x7ffc0000 [ 202.700750][T17026] loop4: detected capacity change from 0 to 1024 [ 202.713233][T17026] EXT4-fs: Ignoring removed nobh option [ 202.720156][T17026] journal_path: Lookup failure for './file0' [ 202.726853][T17026] EXT4-fs: error: could not find journal device path [ 202.776372][T17034] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17034 comm=syz.1.3483 [ 202.789929][T17034] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3483'. [ 202.837534][T17041] loop4: detected capacity change from 0 to 512 [ 202.845097][T17041] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 202.861293][T17041] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002] [ 202.869818][T17041] System zones: 1-12 [ 202.873884][T17041] EXT4-fs (loop4): orphan cleanup on readonly fs [ 202.881142][T17041] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.3487: invalid indirect mapped block 12 (level 1) [ 202.895634][T17041] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.3487: invalid indirect mapped block 2 (level 2) [ 202.909677][T17041] EXT4-fs (loop4): 1 truncate cleaned up [ 202.924421][T17041] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 202.952929][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 203.018717][T17062] 9pnet_fd: Insufficient options for proto=fd [ 203.171154][T17089] lo speed is unknown, defaulting to 1000 [ 203.181826][T17089] lo speed is unknown, defaulting to 1000 [ 203.190273][T17089] lo speed is unknown, defaulting to 1000 [ 203.309476][T17089] infiniband sy{2: set down [ 203.314068][T17089] infiniband sy{2: added lo [ 203.318629][ T5363] lo speed is unknown, defaulting to 1000 [ 203.329013][T17089] RDS/IB: sy{2: added [ 203.329053][T17089] smc: adding ib device sy{2 with port count 1 [ 203.329067][T17089] smc: ib device sy{2 port 1 has pnetid [ 203.329100][ T5363] lo speed is unknown, defaulting to 1000 [ 203.329336][T17089] lo speed is unknown, defaulting to 1000 [ 203.384003][T17089] lo speed is unknown, defaulting to 1000 [ 203.399802][T17100] random: crng reseeded on system resumption [ 203.441790][T17089] lo speed is unknown, defaulting to 1000 [ 203.502087][T17089] lo speed is unknown, defaulting to 1000 [ 203.556771][T17089] lo speed is unknown, defaulting to 1000 [ 203.876844][T17116] netlink: 'syz.2.3506': attribute type 1 has an invalid length. [ 204.051927][T17122] loop5: detected capacity change from 0 to 128 [ 204.062895][T17122] EXT4-fs: Ignoring removed nobh option [ 204.063047][T17122] /dev/loop5: Can't open blockdev [ 204.443544][T17139] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3513'. [ 204.640679][T17143] Invalid ELF header magic: != ELF [ 205.013954][T17164] loop4: detected capacity change from 0 to 1024 [ 205.021438][T17166] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3525'. [ 205.053885][T17164] EXT4-fs: Ignoring removed nomblk_io_submit option [ 205.072210][T17171] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3523'. [ 205.115552][T17164] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a842c018, mo2=0002] [ 205.123720][T17164] System zones: 0-1, 3-12 [ 205.129358][T17164] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 205.205023][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 205.250353][T17187] loop4: detected capacity change from 0 to 512 [ 205.297233][T17187] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 205.324380][T17187] ext4 filesystem being mounted at /140/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 205.358508][T17187] EXT4-fs error (device loop4): ext4_xattr_block_get:593: inode #15: comm syz.4.3530: corrupted xattr block 19: overlapping e_value [ 205.386717][T17187] EXT4-fs (loop4): Remounting filesystem read-only [ 205.393257][T17187] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=15 [ 205.471390][T17200] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 205.478046][T17200] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 205.485771][T17200] vhci_hcd vhci_hcd.0: Device attached [ 205.493894][T17204] rdma_rxe: rxe_newlink: failed to add lo [ 205.500936][T17187] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=15 [ 205.535296][T17187] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=15 [ 205.536509][T17207] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=15 [ 205.578328][T17200] 9pnet_fd: Insufficient options for proto=fd [ 205.594105][T17205] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 2 [ 205.615488][T17207] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop4 ino=15 [ 205.652513][ T41] vhci_hcd: stop threads [ 205.656873][ T41] vhci_hcd: release socket [ 205.661347][ T41] vhci_hcd: disconnect device [ 205.674118][ T9] vhci_hcd: vhci_device speed not set [ 205.682547][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 205.728633][T17222] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 205.865307][T17234] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17234 comm=syz.2.3543 [ 205.879053][T17234] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3543'. [ 205.932640][T17239] loop5: detected capacity change from 0 to 512 [ 205.968935][T17239] EXT4-fs (loop5): 1 orphan inode deleted [ 205.985819][ T378] EXT4-fs error (device loop5): ext4_release_dquot:6973: comm kworker/u8:6: Failed to release dquot type 1 [ 206.000026][T17239] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 206.037859][T17239] ext4 filesystem being mounted at /557/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 206.074535][T17239] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 206.101263][T17245] rdma_rxe: rxe_newlink: failed to add lo [ 206.127887][T17239] loop5: detected capacity change from 0 to 512 [ 206.135615][T17239] EXT4-fs: Ignoring removed oldalloc option [ 206.141889][T17239] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 206.154001][T17239] EXT4-fs (loop5): 1 truncate cleaned up [ 206.162914][T17239] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 206.179504][T17253] FAULT_INJECTION: forcing a failure. [ 206.179504][T17253] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 206.192942][T17253] CPU: 1 UID: 0 PID: 17253 Comm: syz.4.3549 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 206.192978][T17253] Tainted: [W]=WARN [ 206.192984][T17253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 206.192995][T17253] Call Trace: [ 206.193000][T17253] [ 206.193007][T17253] __dump_stack+0x1d/0x30 [ 206.193070][T17253] dump_stack_lvl+0xe8/0x140 [ 206.193090][T17253] dump_stack+0x15/0x1b [ 206.193169][T17253] should_fail_ex+0x265/0x280 [ 206.193191][T17253] should_fail_alloc_page+0xf2/0x100 [ 206.193219][T17253] __alloc_frozen_pages_noprof+0xff/0x360 [ 206.193297][T17253] alloc_pages_mpol+0xb3/0x250 [ 206.193402][T17253] folio_alloc_noprof+0x97/0x150 [ 206.193483][T17253] filemap_alloc_folio_noprof+0x66/0x210 [ 206.193543][T17253] __filemap_get_folio+0x28f/0x6b0 [ 206.193583][T17253] ? aio_setup_ring+0x1e8/0x760 [ 206.193633][T17253] aio_setup_ring+0x26c/0x760 [ 206.193660][T17253] ioctx_alloc+0x2c4/0x4e0 [ 206.193682][T17253] __se_sys_io_setup+0x6b/0x1b0 [ 206.193704][T17253] __x64_sys_io_setup+0x31/0x40 [ 206.193728][T17253] x64_sys_call+0x2eff/0x2ff0 [ 206.193810][T17253] do_syscall_64+0xd2/0x200 [ 206.193891][T17253] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 206.193914][T17253] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 206.193977][T17253] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.193999][T17253] RIP: 0033:0x7fd22e34ec29 [ 206.194019][T17253] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 206.194048][T17253] RSP: 002b:00007fd22cdb7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 206.194066][T17253] RAX: ffffffffffffffda RBX: 00007fd22e595fa0 RCX: 00007fd22e34ec29 [ 206.194077][T17253] RDX: 0000000000000000 RSI: 0000200000000680 RDI: 0000000000002004 [ 206.194089][T17253] RBP: 00007fd22cdb7090 R08: 0000000000000000 R09: 0000000000000000 [ 206.194101][T17253] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 206.194112][T17253] R13: 00007fd22e596038 R14: 00007fd22e595fa0 R15: 00007ffd5e947498 [ 206.194131][T17253] [ 206.479087][ T7261] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 206.509190][T17272] loop5: detected capacity change from 0 to 128 [ 206.517117][T17269] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3553'. [ 206.559365][T17282] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17282 comm=syz.3.3560 [ 206.837958][T17307] IPVS: sed: SCTP 172.20.20.187:0 - no destination available [ 207.005955][T17318] loop4: detected capacity change from 0 to 512 [ 207.020609][T17321] cgroup: No subsys list or none specified [ 207.035052][T17318] EXT4-fs (loop4): 1 orphan inode deleted [ 207.042634][T17318] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 207.056035][T17318] ext4 filesystem being mounted at /155/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 207.067582][ T31] EXT4-fs error (device loop4): ext4_release_dquot:6973: comm kworker/u8:1: Failed to release dquot type 1 [ 207.093128][T17318] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.118804][T17318] loop4: detected capacity change from 0 to 512 [ 207.126031][T17318] EXT4-fs: Ignoring removed oldalloc option [ 207.132436][T17318] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 207.145322][T17318] EXT4-fs (loop4): 1 truncate cleaned up [ 207.151456][T17318] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 207.183417][T13716] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.209634][T17335] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3578'. [ 207.723353][ T29] kauditd_printk_skb: 425 callbacks suppressed [ 207.723372][ T29] audit: type=1400 audit(1758320157.855:9996): avc: denied { map } for pid=17350 comm="syz.1.3584" path="socket:[43303]" dev="sockfs" ino=43303 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 207.769602][T17357] FAULT_INJECTION: forcing a failure. [ 207.769602][T17357] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 207.782805][T17357] CPU: 0 UID: 0 PID: 17357 Comm: syz.3.3586 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 207.782916][T17357] Tainted: [W]=WARN [ 207.782922][T17357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 207.782933][T17357] Call Trace: [ 207.782939][T17357] [ 207.782946][T17357] __dump_stack+0x1d/0x30 [ 207.782966][T17357] dump_stack_lvl+0xe8/0x140 [ 207.782986][T17357] dump_stack+0x15/0x1b [ 207.783000][T17357] should_fail_ex+0x265/0x280 [ 207.783021][T17357] should_fail+0xb/0x20 [ 207.783038][T17357] should_fail_usercopy+0x1a/0x20 [ 207.783060][T17357] _copy_to_user+0x20/0xa0 [ 207.783116][T17357] simple_read_from_buffer+0xb5/0x130 [ 207.783140][T17357] proc_fail_nth_read+0x10e/0x150 [ 207.783238][T17357] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 207.783261][T17357] vfs_read+0x1a5/0x770 [ 207.783280][T17357] ? __rcu_read_unlock+0x4f/0x70 [ 207.783300][T17357] ? __fget_files+0x184/0x1c0 [ 207.783345][T17357] ksys_read+0xda/0x1a0 [ 207.783367][T17357] __x64_sys_read+0x40/0x50 [ 207.783445][T17357] x64_sys_call+0x27bc/0x2ff0 [ 207.783482][T17357] do_syscall_64+0xd2/0x200 [ 207.783565][T17357] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 207.783588][T17357] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 207.783694][T17357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.783716][T17357] RIP: 0033:0x7f0c5b24d63c [ 207.783732][T17357] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 207.783750][T17357] RSP: 002b:00007f0c59caf030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 207.783771][T17357] RAX: ffffffffffffffda RBX: 00007f0c5b495fa0 RCX: 00007f0c5b24d63c [ 207.783820][T17357] RDX: 000000000000000f RSI: 00007f0c59caf0a0 RDI: 0000000000000005 [ 207.783857][T17357] RBP: 00007f0c59caf090 R08: 0000000000000000 R09: 0000000000000000 [ 207.783869][T17357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 207.783881][T17357] R13: 00007f0c5b496038 R14: 00007f0c5b495fa0 R15: 00007ffe82d38b68 [ 207.783899][T17357] [ 208.021920][ T29] audit: type=1326 audit(1758320158.155:9997): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17358 comm="syz.3.3588" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0c5b24ec29 code=0x0 [ 208.068061][ T29] audit: type=1326 audit(1758320158.205:9998): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17362 comm="syz.2.3589" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe1b045ec29 code=0x0 [ 208.142541][T17370] netlink: 'syz.3.3588': attribute type 1 has an invalid length. [ 208.153861][T17371] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 208.175979][T17372] netlink: 'syz.2.3589': attribute type 1 has an invalid length. [ 208.280174][T17377] rdma_rxe: rxe_newlink: failed to add lo [ 208.946903][ T29] audit: type=1400 audit(1758320159.085:9999): avc: denied { setcurrent } for pid=17397 comm="syz.3.3599" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 208.966595][ T29] audit: type=1401 audit(1758320159.085:10000): op=security_bounded_transition seresult=denied oldcontext=root:sysadm_r:sysadm_t newcontext=system_u:object_r:hugetlbfs_t [ 208.992613][T17394] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 209.002883][T17394] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 209.020154][T17394] netlink: 'syz.2.3597': attribute type 21 has an invalid length. [ 209.024167][ T29] audit: type=1400 audit(1758320159.145:10001): avc: denied { lock } for pid=17399 comm="syz.1.3600" path="socket:[43374]" dev="sockfs" ino=43374 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 209.098625][T17415] IPv6: NLM_F_CREATE should be specified when creating new route [ 209.140562][T17417] loop5: detected capacity change from 0 to 1024 [ 209.189933][T17417] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 209.239816][ T29] audit: type=1326 audit(1758320159.375:10002): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17416 comm="syz.5.3605" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 209.263439][ T29] audit: type=1326 audit(1758320159.375:10003): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17416 comm="syz.5.3605" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7fb24adaec29 code=0x7ffc0000 [ 209.287048][ T29] audit: type=1326 audit(1758320159.375:10004): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17416 comm="syz.5.3605" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fb24adaec63 code=0x7ffc0000 [ 209.344119][ T29] audit: type=1326 audit(1758320159.375:10005): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17416 comm="syz.5.3605" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fb24adad6df code=0x7ffc0000 [ 209.505489][ T7261] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 209.596053][T17451] IPVS: sed: SCTP 172.20.20.187:0 - no destination available [ 209.741513][T17455] netlink: 'syz.2.3611': attribute type 12 has an invalid length. [ 209.817443][T17458] netlink: 'syz.2.3611': attribute type 12 has an invalid length. [ 210.052659][T17465] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3615'. [ 210.194679][T17490] SELinux: failed to load policy [ 210.421062][T17494] erspan0 speed is unknown, defaulting to 1000 [ 210.468948][T17494] lo speed is unknown, defaulting to 1000 [ 210.703069][T17536] erspan0 speed is unknown, defaulting to 1000 [ 210.757072][T17536] lo speed is unknown, defaulting to 1000 [ 211.194597][T17564] tipc: Enabling of bearer rejected, failed to enable media [ 211.812631][T17585] loop4: detected capacity change from 0 to 512 [ 211.822035][T17585] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 211.849020][T17590] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 211.855991][T17584] FAT-fs (loop4): error, fat_free_clusters: deleting FAT entry beyond EOF [ 211.859321][T17590] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 211.907188][ T378] ================================================================== [ 211.915305][ T378] BUG: KCSAN: data-race in copy_process / free_pid [ 211.921816][ T378] [ 211.924126][ T378] read-write to 0xffffffff8685fc48 of 4 bytes by task 17598 on cpu 0: [ 211.932265][ T378] free_pid+0x77/0x180 [ 211.936333][ T378] free_pids+0x7a/0xb0 [ 211.940391][ T378] release_task+0x9a9/0xb60 [ 211.944901][ T378] do_exit+0xd81/0x15c0 [ 211.949050][ T378] call_usermodehelper_exec_async+0x247/0x250 [ 211.955116][ T378] ret_from_fork+0x11f/0x1b0 [ 211.959695][ T378] ret_from_fork_asm+0x1a/0x30 [ 211.964450][ T378] [ 211.966763][ T378] read to 0xffffffff8685fc48 of 4 bytes by task 378 on cpu 1: [ 211.974205][ T378] copy_process+0x14a6/0x2000 [ 211.978880][ T378] kernel_clone+0x16c/0x5c0 [ 211.983379][ T378] user_mode_thread+0x7d/0xb0 [ 211.988052][ T378] call_usermodehelper_exec_work+0x41/0x160 [ 211.994032][ T378] process_scheduled_works+0x4cb/0x9d0 [ 211.999489][ T378] worker_thread+0x582/0x770 [ 212.004074][ T378] kthread+0x489/0x510 [ 212.008133][ T378] ret_from_fork+0x11f/0x1b0 [ 212.012712][ T378] ret_from_fork_asm+0x1a/0x30 [ 212.017469][ T378] [ 212.019779][ T378] value changed: 0x800000f6 -> 0x800000f5 [ 212.025477][ T378] [ 212.027783][ T378] Reported by Kernel Concurrency Sanitizer on: [ 212.033921][ T378] CPU: 1 UID: 0 PID: 378 Comm: kworker/u8:6 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 212.045278][ T378] Tainted: [W]=WARN [ 212.049075][ T378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 212.059205][ T378] Workqueue: events_unbound call_usermodehelper_exec_work [ 212.066326][ T378] ================================================================== [ 212.109047][T17590] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3639'. [ 212.127193][T17601] pim6reg1: entered promiscuous mode [ 212.132571][T17601] pim6reg1: entered allmulticast mode