Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 8.794327][ T22] audit: type=1400 audit(1581624082.308:10): avc: denied { watch } for pid=1797 comm="restorecond" path="/root/.ssh" dev="sda1" ino=16179 scontext=system_u:system_r:kernel_t:s0 tcontext=unconfined_u:object_r:ssh_home_t:s0 tclass=dir permissive=1 [ 8.805510][ T22] audit: type=1400 audit(1581624082.318:11): avc: denied { watch } for pid=1797 comm="restorecond" path="/etc/selinux/restorecond.conf" dev="sda1" ino=2280 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 13.624042][ T22] audit: type=1400 audit(1581624087.138:12): avc: denied { map } for pid=1868 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.10.25' (ECDSA) to the list of known hosts. 2020/02/13 20:01:33 fuzzer started [ 19.707193][ T22] audit: type=1400 audit(1581624093.218:13): avc: denied { map } for pid=1883 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2020/02/13 20:01:34 dialing manager at 10.128.0.105:45117 2020/02/13 20:01:34 syscalls: 1732 2020/02/13 20:01:34 code coverage: enabled 2020/02/13 20:01:34 comparison tracing: enabled 2020/02/13 20:01:34 extra coverage: enabled 2020/02/13 20:01:34 setuid sandbox: enabled 2020/02/13 20:01:34 namespace sandbox: enabled 2020/02/13 20:01:34 Android sandbox: /sys/fs/selinux/policy does not exist 2020/02/13 20:01:34 fault injection: enabled 2020/02/13 20:01:34 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/02/13 20:01:34 net packet injection: enabled 2020/02/13 20:01:34 net device setup: enabled 2020/02/13 20:01:34 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/02/13 20:01:34 devlink PCI setup: PCI device 0000:00:10.0 is not available 20:02:24 executing program 2: 20:02:24 executing program 5: 20:02:24 executing program 0: 20:02:24 executing program 1: 20:02:24 executing program 3: [ 70.632834][ T22] audit: type=1400 audit(1581624144.148:14): avc: denied { map } for pid=1883 comm="syz-fuzzer" path="/root/syzkaller-shm890184022" dev="sda1" ino=16461 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 20:02:24 executing program 4: [ 70.686082][ T22] audit: type=1400 audit(1581624144.198:15): avc: denied { map } for pid=1931 comm="syz-executor.5" path="/sys/kernel/debug/kcov" dev="debugfs" ino=36 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 70.824847][ T1936] cgroup1: Unknown subsys name 'perf_event' [ 70.842384][ T1936] cgroup1: Unknown subsys name 'net_cls' [ 70.862319][ T1937] cgroup1: Unknown subsys name 'perf_event' [ 70.868496][ T1937] cgroup1: Unknown subsys name 'net_cls' [ 70.886019][ T1938] cgroup1: Unknown subsys name 'perf_event' [ 70.905833][ T1938] cgroup1: Unknown subsys name 'net_cls' [ 70.916316][ T1942] cgroup1: Unknown subsys name 'perf_event' [ 70.926406][ T1941] cgroup1: Unknown subsys name 'perf_event' [ 70.942744][ T1948] cgroup1: Unknown subsys name 'perf_event' [ 70.949183][ T1942] cgroup1: Unknown subsys name 'net_cls' [ 70.955296][ T1941] cgroup1: Unknown subsys name 'net_cls' [ 70.968963][ T1948] cgroup1: Unknown subsys name 'net_cls' 20:02:28 executing program 3: [ 74.930558][ T22] audit: type=1400 audit(1581624148.438:16): avc: denied { associate } for pid=1941 comm="syz-executor.3" name="syz3" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 20:02:28 executing program 3: 20:02:28 executing program 3: 20:02:28 executing program 3: 20:02:28 executing program 3: 20:02:28 executing program 3: 20:02:28 executing program 2: 20:02:28 executing program 5: 20:02:28 executing program 4: 20:02:28 executing program 3: 20:02:28 executing program 2: 20:02:28 executing program 1: 20:02:28 executing program 0: 20:02:28 executing program 4: 20:02:28 executing program 1: 20:02:28 executing program 4: 20:02:28 executing program 0: 20:02:28 executing program 3: 20:02:28 executing program 2: 20:02:28 executing program 5: 20:02:28 executing program 3: 20:02:28 executing program 1: 20:02:28 executing program 2: 20:02:28 executing program 0: 20:02:28 executing program 4: 20:02:28 executing program 0: 20:02:28 executing program 5: 20:02:28 executing program 3: 20:02:28 executing program 1: 20:02:29 executing program 4: 20:02:29 executing program 2: 20:02:29 executing program 4: 20:02:29 executing program 2: 20:02:29 executing program 1: 20:02:29 executing program 0: 20:02:29 executing program 5: 20:02:29 executing program 3: 20:02:29 executing program 4: 20:02:29 executing program 0: 20:02:29 executing program 5: 20:02:29 executing program 3: 20:02:29 executing program 1: 20:02:29 executing program 0: 20:02:29 executing program 3: 20:02:29 executing program 2: 20:02:29 executing program 1: 20:02:29 executing program 5: 20:02:29 executing program 4: 20:02:29 executing program 0: 20:02:29 executing program 2: 20:02:29 executing program 1: 20:02:29 executing program 0: 20:02:29 executing program 5: 20:02:29 executing program 4: 20:02:29 executing program 2: 20:02:29 executing program 3: 20:02:29 executing program 0: 20:02:29 executing program 5: 20:02:29 executing program 4: 20:02:29 executing program 1: 20:02:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}, 0x0, 0x0, 0x3a5, 0x0, 0x40000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_int(r0, 0x6, 0x17, 0x0, &(0x7f0000000140)) getpeername(r0, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f0000000180)=0x80) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x32, 0x7}, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) link(&(0x7f0000000140)='./file0\x00', 0x0) socket(0x1e, 0x1, 0x0) accept4$unix(0xffffffffffffffff, &(0x7f00000005c0), &(0x7f0000000640)=0x6e, 0x80000) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000300)='.\x00', 0xfe) pipe(&(0x7f0000000200)={0xffffffffffffffff}) pipe(&(0x7f0000000200)) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000007c0)='/selinux/load\x00', 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r3, 0x0) ftruncate(r3, 0x3) ioctl$KDGKBSENT(r3, 0x4b48, &(0x7f0000000340)={0x20, "21c046db809d43d263fca8da2b740657d426f08aad15a417f21c78d2c036d05e84bc2146826d27fc148e99811b0b7a91fee16e10bb0eb50603a731ace0724f1df78d1ca2f7e40375f3368a8ed530cf1db847badc50e4b45a3abc0ecb70e57310c0833d27c9e95ddd11785849af9c2f900ad82026b7819ce2157b641614b5c9fa371920387ca55a3f41a6ceed46f373b141453a857d2c052cc47a04cd1f8ba15c1b1004851ec946e34b8e9300df780c7fd19ff4d0fcf384b9a91d6256d354860189e028e7677e4dee9c810629c6195932650da9a0392882f882356e4b5fcce9659ba49396f8a41001877bd07ddcc7559f83b22b4bc785127fceb8a40f561a5042b7e912ccfbeec1d90d36d17c9f4e635207d98f7e16318c0a40eca498eea66ed143f9a479e1e71dc7316e51c158f6efbff1d452e6e9406ea6b6daa59c80fe8d4862da57dfa5088bfcc5f4266d37fddd4b3f073573d55b3f1c082acd84be55f09a832e583b8a689e4f4347d6ae47599a66abc8de177e1db708fd002deb740dd9c358b1fb4e709abe7a401d87903b158a039fc8e544f6de2960a5c44d534c63d0f1979c9d6ed27a8342576fbb2c3df7cbc8db93e9f3efb2428d6c1e747bcd1ccd1c3c60ca3a1c8a0d940e6f991be9094377aba85645e00432c3f7e2f563e117ac8f72dc1ec4beaf1b5c4d9c30831faf80f6521d6de32c92eb9105afb775a51205eb"}) r4 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) write$nbd(r4, &(0x7f0000000980)=ANY=[@ANYBLOB="674c66980000000000000000000000236517a42ac4cb7a63d1a97a7e5a31524e892eac4023b714a3202f99f16d06589e03469637ffe2009efd65c31a381587acd88cff757a9ca8fd6deaad0c8d6ff6e8121dbd4a8e9fb3ea6790e5bf9c31b43a66e24bb0bac2655fc4c3ad39091e6eadca412d6c3f0ab3cd47963734058d10e7244d817c90d6550d8999879836031a7976955320c7104975edbb0c0579044144f106fb16689098efdd633b511d9e72a46c5222f81a258158d2318b0000f14dfebdd701e082dcd83009fadd4602edc2cbbecb61f9ec5f990cdd828096514a6b593b3af8b500000000000000000000000000e516cf44bec7dc2d1a6e554e2fa311e5610b1811939894c54fe199d3b2ed84eb475b7bd086a63c36c9267659a446292425207caf0a27ab73fb0ce4a23a2e9635a6579fcd0bba4a8f9351af1ed1becb0aaf8b9ea25b7481e696f57cfc6817aea080ec9e263b797528f0e35f652ad8b7985a1cb787b8ba014b33453edebbbe9b7b192cb2165cd87d7bac2fa08acf7b75e11da08083e6c7e469edcd872ca51a45142ffcd77566af0f57a8663d7066b5256f48eadb07e1ad416aa4bd466fa505cce3a1b64ac78d1661b6aea02d621ed9ea21623c8e275ea2245b2779789623d436f9537f32eef87f63f24511c749967f6ba488ce982ec4058d20ae9e345c1e1c504d5fc18d3add0f3c4d8f58523a6d4a40b6bf3dbb1ee891598b1a15859d510bbd0e330d58f67ebf5e4f57d50baea4cf3c741b205f9589111a16cdca4084fd0cf6656405326597a1eff89021256ed38a65159bb483ca5504a3007355ec89def23de80c47797b7255c5135cab48890623369ab34940f6dd6b301329211777392b8dcb000869d68bb8ef972531df4ddc1f1edbb95e2f47b7b7986ed7ad46ebb423387cd4a13ac608bc4d8faa1aa7fb73b33d831d9903ff636eaba7988ea843f4f119e2191224515f37a49ef8694f2a1792a73f2f1ff6d44b2edabd188441b17bae1b8a8912af1efc2a9590cbb56b6eda61b176645c358de582f596174252cccb4828464d103c918ed3347650ffa67c436f42bad389d363a76e"], 0x4b) sendfile(r4, r4, &(0x7f0000000200), 0xa198) openat$tun(0xffffffffffffff9c, &(0x7f0000000800)='/dev/net/tun\x00', 0x400, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000e00)='/dev/rfkill\x00', 0x2000, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000200), 0xa198) accept$unix(0xffffffffffffffff, &(0x7f0000000e40)=@abs, &(0x7f0000000ec0)=0x6e) r5 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r5, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r5, 0x800c6613, &(0x7f00000001c0)=@v1={0x0, @aes256, 0x8, "ae92469ac72ec73c"}) inotify_init() inotify_add_watch(0xffffffffffffffff, &(0x7f0000000300)='.\x00', 0x40000fb) accept(r2, 0x0, &(0x7f0000000080)) 20:02:29 executing program 3: clone(0x8100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000020000000300000020040000a0000000000000008803000000000000a00000008803000088030000880300008803000088030000feffff070000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000a00000000000000002060000000000000000000000003000434f4e4e4d41524b000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001e80200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002766c616e3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50f000000000000000000000000000000000000030000000300000000000000000000000000000028015345434d41524b0000000000000000000000000000000000000000000000000000000000000073797374656d5f753a6f626a6563745f723a68756765746c6266735f743a73300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000fefffffff081c8b89a6e2f4ef468616fee3c12b196c83999bb2ce0a4c4c12330e3a1cdb86ee378aafcf862f5b8dd517d71aec63d1ee7ea35"], 0x1) 20:02:29 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x17, 0x0, 0x40002, 0x2, 0x0, 0x1}, 0x2c) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000fe6000)={0x3, 0x4, 0x4, 0x100000009}, 0x2c) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001300)={0x3, 0x7, &(0x7f0000000000)=@framed={{}, [@map={0x18, 0x0, 0x1, 0x0, r0}, @map={0x18, 0x0, 0x1, 0x0, r1}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x1000, &(0x7f0000000280)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000001c0)={r2, 0xc0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0xc0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0), &(0x7f0000000400), 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)}}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x17, 0x0, 0x40002, 0x2, 0x0, 0x1}, 0x2c) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000fe6000)={0x3, 0x4, 0x4, 0x100000009}, 0x2c) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001300)={0x3, 0x7, &(0x7f0000000000)=@framed={{}, [@map={0x18, 0x0, 0x1, 0x0, r3}, @map={0x18, 0x0, 0x1, 0x0, r4}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x1000, &(0x7f0000000280)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = fcntl$dupfd(r6, 0x0, r6) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000200)={0x0}, &(0x7f0000000240)=0xc) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r9, 0x0) ftruncate(r9, 0x3) perf_event_open(&(0x7f0000000140)={0x3, 0x70, 0x63, 0x3f, 0x9, 0x6, 0x0, 0x29, 0x600a8, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x5, 0x0, @perf_bp={&(0x7f0000000040), 0xf}, 0x22440, 0x2d1, 0x1, 0x8, 0x400, 0x80, 0x2}, r8, 0xc, r9, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000001c0)={r5, 0x66, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 20:02:29 executing program 0: r0 = socket$inet6(0xa, 0x2000000080803, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x6}}, 0xe8) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000200)="5b30f61e00756f8d25035fe42ef6d475ecd985844d1130173f0c60455153aa4e2d98a653e9b52b19781b629aaf314703abe223d6ba848bb92a943ca2fa300795ce5e3d97581f0caf94914b0543be506bb7d34967c3b0ac21957049b2babdd97e74532a1267a19dcd5a51a2fa0a7696f5c624ce181dddb40bbd54e0ab0302e2512160e575966e2347c0849814e476506d9046a24004d1041abcbcc79f72d589248ffdc733e130c0d5a3d5b9934b9313f87545a8f5e5da88c988582516ea9be9376e8b5471c11be265b1e0fe4fbef40eda51dec3", 0xd3) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) [ 75.815578][ T22] audit: type=1400 audit(1581624149.328:17): avc: denied { map_create } for pid=4559 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 75.855765][ T22] audit: type=1400 audit(1581624149.328:18): avc: denied { map_read map_write } for pid=4559 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 75.859039][ T4561] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' 20:02:29 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f00000000c0)='bdevGPLppp1\x00', 0x0) fsetxattr$security_capability(r2, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v2, 0x14, 0x0) pwrite64(r2, &(0x7f0000000000)="d8", 0x1, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r3, 0x0, 0x0) tkill(r3, 0x16) 20:02:29 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(0x0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0x0, 0x0, 0x0, 0x0, 0x0, "000000f20a000000572501000000170100"}) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000040)={0x0, 0xffffffff}) r2 = syz_open_pts(r1, 0x1) write(r2, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r2, r1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x80400, 0x0) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000100), &(0x7f0000000140)=0x4) 20:02:29 executing program 3: clone(0x8100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000020000000300000020040000a0000000000000008803000000000000a00000008803000088030000880300008803000088030000feffff070000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000a00000000000000002060000000000000000000000003000434f4e4e4d41524b000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001e80200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002766c616e3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50f000000000000000000000000000000000000030000000300000000000000000000000000000028015345434d41524b0000000000000000000000000000000000000000000000000000000000000073797374656d5f753a6f626a6563745f723a68756765746c6266735f743a73300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000fefffffff081c8b89a6e2f4ef468616fee3c12b196c83999bb2ce0a4c4c12330e3a1cdb86ee378aafcf862f5b8dd517d71aec63d1ee7ea35"], 0x1) 20:02:29 executing program 0: request_key(0x0, 0x0, &(0x7f0000000140)='system{em0/&vboxnet1^\x00', 0xfffffffffffffffa) creat(0x0, 0x10) r0 = gettid() perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000402) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, 0x0}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$9p(0xffffffffffffffff, 0x0, 0x0) unshare(0x40000000) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) write$evdev(0xffffffffffffffff, &(0x7f0000057fa0)=[{}, {}], 0x10000007c) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x492000, 0x0) write$FUSE_INTERRUPT(r3, &(0x7f0000000180)={0x10, 0x0, 0x8}, 0x10) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000003ac0)) r4 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x124) ioctl$USBDEVFS_REAPURB(r4, 0x4008550c, &(0x7f00000000c0)) [ 75.880522][ T22] audit: type=1400 audit(1581624149.328:19): avc: denied { prog_load } for pid=4559 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 75.904690][ T4562] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 75.928623][ T22] audit: type=1400 audit(1581624149.358:20): avc: denied { prog_run } for pid=4559 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 75.969611][ T22] audit: type=1400 audit(1581624149.368:21): avc: denied { open } for pid=4559 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 20:02:29 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) r4 = accept(0xffffffffffffffff, &(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x0) r5 = openat$cgroup_int(0xffffffffffffff9c, 0x0, 0x2, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000140)}], 0x1, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x80000000a) fcntl$getownex(r5, 0x10, &(0x7f0000000540)) r6 = creat(0x0, 0x0) r7 = fcntl$getown(r6, 0x9) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0xfffffffffffffffe}, r7, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000740)='./file0\x00', 0x1a7) io_submit(0x0, 0x1, &(0x7f0000000040)=[0x0]) r8 = socket$inet(0x2, 0x803, 0xa0) connect$inet(0xffffffffffffffff, 0x0, 0x0) connect(r8, 0x0, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000000)={{}, {}, 0x8, {0x2, 0x0, @broadcast}, 'veth0_to_bond\x00'}) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f0000000100)={{0x2, 0x4e20}, {0x0, @local}, 0x0, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) stat(&(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) setresgid(0x0, 0x0, 0x0) stat(0x0, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) lchown(&(0x7f00000000c0)='./file0\x00', 0x0, r10) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) getgroups(0x8, &(0x7f0000000340)=[r10, 0xffffffffffffffff, 0xffffffffffffffff, r11, 0x0, 0x0, 0xffffffffffffffff, 0x0]) newfstatat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) lchown(&(0x7f00000000c0)='./file0\x00', 0x0, r12) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) getgroups(0x9, &(0x7f0000000340)=[0xee00, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, r12, r13, 0x0, 0x0]) getegid() io_setup(0x1ff, &(0x7f00000004c0)) r14 = socket$inet6(0xa, 0x2000000080803, 0x1) connect$inet6(r14, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) fstat(r14, &(0x7f00000004c0)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) setuid(0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) lchown(&(0x7f00000000c0)='./file0\x00', 0x0, r15) getgroups(0x9, &(0x7f0000000340)=[0xee00, r15, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0]) setreuid(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240), 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x800) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./bus/file0\x00', &(0x7f00000002c0), 0x4000) newfstatat(0xffffffffffffff9c, &(0x7f0000000200)='./bus/file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) r17 = getegid() fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0200000001005e59c5d9000002000000", @ANYRES32, @ANYBLOB, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r16, @ANYBLOB='\b\x00', @ANYRES32=r17, @ANYBLOB="fb688af8614ef3736767a7ffcd0acbe2705c80d136baea971e000000000000000000d3d31abe3fc3d17b2e09bb6a0fe864cf0c953c4d617684b46ffbd63cec6b434d3da988dbcb0d46513fae2f93b4c107603c978deb2a2b2cf2d98bc779adb075d7e94869e8cd045b34bd08b14c4d2de85d03566994393659c4e124ff4869bf3f12a211c0254355312f4c56daabfd7f081dc11885db6f310503097607a9498b96b532274d65e37b97ad853cd17d6ec340766f8c614462cc530cabb9f38433b8c4f52d5b701b6494aaa4b037182525d59f23b5863b423bd99ed6eeb8affa48b1632bc782e3c816eebb2ff540c611d2ca5d79083ca52f"], 0xa, 0x1) setuid(0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./bus/file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) getgroups(0x9, &(0x7f0000000340)=[0xee00, r18, 0xffffffffffffffff, r19, 0xffffffffffffffff, r20, 0x0, 0x0, 0x0]) setresgid(r9, r19, r9) setresgid(0x0, 0x0, 0x0) r21 = syz_open_procfs(0x0, &(0x7f0000000000)='clear_refs\x00') r22 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='stat\x00') sendfile(r21, r22, 0x0, 0x1) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r23 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fsetxattr$system_posix_acl(r4, &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000001000)=ANY=[@ANYRESHEX, @ANYRESOCT, @ANYPTR64=&(0x7f0000000780)=ANY=[@ANYPTR, @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYRES64=0x0, @ANYRES16], @ANYRES32=r23, @ANYRESHEX, @ANYBLOB="5e8dcad504a843d24ba0f2133dbba1e0d306c0030079c2e4f7ed08b1f87b9b5713d2370f79f90200000000000000bdf90500aff7ff192526ee4726b721000000000000000000000000100000"], @ANYBLOB="b83f3c0251a582edc523176f4267bbc18dac6bf2d60fc307ca48feb28f873ed3d3aa760000ea3ca28d4aabb75ed8191516226826d888c3ee1fe3b62e4ebd0ac0d50c75bab516ba51042595c09f483e99a4b5fe0e5d0b0cc983c361448896c767a0afb0bbdb93c4cc57673ba945e4d97e496cddf982d540e3e5e133b6a1c3c04a8582e618f5e379cb00e51a9634535083f3d9a53b06ac233c403830c8cf7b82bbba86c3bc42727998218153de91e900f5059c3f6a0037b04d1ed6fb55d0272ec574d6091db7dd22a463f7c257cad08b8e673c7254057b6e80fe677ad4ef6de56e5ec837a1b6c3ff1da00a5857b015f93b931cb5dd2c120e567364954305dba4e7a294baeb27b89d8a902e213c7d4b26b229831837e2ce8b9c24413ed7aeab252386f44c7f0e32a1c4ec3afa2609a765e34c95cfbb65fda9d95c1354a2fe55a6d0f06cbaff56ebc9b4a8b5140001787f7491821fd6fce8cc37567953703ff645467b56a3a2e1d4795c5f67efddee0e83cbc303b04212e52e68421b93c2b3a0e8fe53b29d94462ba1d331d5b66b92c63e5574004eda187d04e8231d218c57a0578bab82796da52bd3fad2c2451a2e1e7a0d1b7bb7e6364cb1dfafff7dfcd4f1b011988f4af21c650f37a949d27a70369d8fa84f430155f8c7b867d47c995530eb2428176803fb0ddb0b3a"], 0x4, 0x3) [ 76.005580][ T22] audit: type=1400 audit(1581624149.368:22): avc: denied { kernel } for pid=4559 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 [ 76.033925][ T4581] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' 20:02:29 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='autogroup\x00') preadv(r0, &(0x7f00000013c0), 0x0, 0x10001) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x98, r1, 0x10, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x70, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x1b}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bridge\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'caif0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x27}}]}, @IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4000000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}]}, 0x98}, 0x1, 0x0, 0x0, 0x44006}, 0x800) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240)='batadv\x00') sendmsg$BATADV_CMD_TP_METER_CANCEL(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r2, 0x2, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}]}, 0x1c}}, 0x20044001) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000380)='ethtool\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) getsockname$packet(r5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r6}, 0x3c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) getsockname$packet(r8, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r9}, 0x3c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = dup(r10) getsockname$packet(r11, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r12}, 0x3c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r14 = dup(r13) getsockname$packet(r14, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r15}, 0x3c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r17 = dup(r16) getsockname$packet(r17, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r18}, 0x3c) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000016c0)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000001780)={'team0\x00', 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r22 = dup(r21) getsockname$packet(r22, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r23}, 0x3c) r24 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r24, 0x0) ftruncate(r24, 0x3) getsockname$packet(r24, &(0x7f00000017c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001800)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001840)={'batadv_slave_1\x00', 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r28 = dup(r27) getsockname$packet(r28, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r29}, 0x3c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r31 = dup(r30) getsockname$packet(r31, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r32}, 0x3c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r34 = dup(r33) getsockname$packet(r34, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r35}, 0x3c) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000001880)={@empty, @empty, 0x0}, &(0x7f00000018c0)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r38 = dup(r37) getsockname$packet(r38, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r39}, 0x3c) r40 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r40, 0x0) ftruncate(r40, 0x3) getsockopt$inet_mreqn(r40, 0x0, 0x20, &(0x7f00000019c0)={@local, @empty, 0x0}, &(0x7f0000001a00)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r43 = dup(r42) getsockname$packet(r43, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r44}, 0x3c) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000001a40)={{{@in6=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@empty}}, &(0x7f0000001b40)=0xe8) ioctl$sock_SIOCADDRT(r0, 0x890b, &(0x7f0000001bc0)={0x0, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x1, 0x2, 0x4}}, @xdp={0x2c, 0xd1dc9d7492212252, 0x0, 0x1e}, @nl=@unspec, 0x1, 0x0, 0x0, 0x0, 0x5, &(0x7f0000001b80)='ip6tnl0\x00', 0x1fbdd375, 0x81, 0x3f}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r48 = dup(r47) getsockname$packet(r48, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], r49}, 0x3c) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r0, &(0x7f0000001f40)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001f00)={&(0x7f0000001c40)={0x294, r3, 0x2, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}, @ETHTOOL_A_LINKINFO_HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r18}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r19}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}]}, @ETHTOOL_A_LINKINFO_HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r20}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r23}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r25}]}, @ETHTOOL_A_LINKINFO_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @ETHTOOL_A_LINKINFO_HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r26}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xb24f5ba555484191}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r29}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r32}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_LINKINFO_HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r35}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r36}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r39}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r41}]}, @ETHTOOL_A_LINKINFO_HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r44}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r45}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r46}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r49}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x294}, 0x1, 0x0, 0x0, 0x41}, 0x20000004) 20:02:29 executing program 3: clone(0x8100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000020000000300000020040000a0000000000000008803000000000000a00000008803000088030000880300008803000088030000feffff070000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000a00000000000000002060000000000000000000000003000434f4e4e4d41524b000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001e80200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002766c616e3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50f000000000000000000000000000000000000030000000300000000000000000000000000000028015345434d41524b0000000000000000000000000000000000000000000000000000000000000073797374656d5f753a6f626a6563745f723a68756765746c6266735f743a73300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000fefffffff081c8b89a6e2f4ef468616fee3c12b196c83999bb2ce0a4c4c12330e3a1cdb86ee378aafcf862f5b8dd517d71aec63d1ee7ea35"], 0x1) [ 76.057095][ T22] audit: type=1400 audit(1581624149.518:23): avc: denied { watch watch_reads } for pid=4557 comm="syz-executor.2" path="/root/syzkaller-testdir340964818/syzkaller.wGVhjm/10" dev="sda1" ino=16519 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir permissive=1 [ 76.090549][ C0] hrtimer: interrupt took 18540 ns [ 76.091370][ T22] audit: type=1400 audit(1581624149.598:24): avc: denied { create } for pid=4592 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 76.137270][ T22] audit: type=1400 audit(1581624149.598:25): avc: denied { write } for pid=4592 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 76.153787][ T4602] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' 20:02:29 executing program 3: clone(0x8100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000020000000300000020040000a0000000000000008803000000000000a00000008803000088030000880300008803000088030000feffff070000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000a00000000000000002060000000000000000000000003000434f4e4e4d41524b000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001e80200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002766c616e3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50f000000000000000000000000000000000000030000000300000000000000000000000000000028015345434d41524b0000000000000000000000000000000000000000000000000000000000000073797374656d5f753a6f626a6563745f723a68756765746c6266735f743a73300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000fefffffff081c8b89a6e2f4ef468616fee3c12b196c83999bb2ce0a4c4c12330e3a1cdb86ee378aafcf862f5b8dd517d71aec63d1ee7ea35"], 0x1) [ 76.168794][ T22] audit: type=1400 audit(1581624149.648:26): avc: denied { read } for pid=4592 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 76.270586][ T4612] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' 20:02:29 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000001c0)={0x2, 0x2d, 0x0, 0xffffffffffffffff}) r2 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000940)='/selinux/user\x00', 0x2, 0x0) fchdir(r2) r3 = dup(r1) mmap(&(0x7f0000002000/0x1000)=nil, 0x106c, 0x0, 0x30051, r3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, r5, 0x405, 0x0, 0x0, {0x7e}, [@NL80211_ATTR_IFTYPE={0x8, 0x7e}]}, 0x1c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r10, 0x0) ftruncate(r10, 0x3) ioctl$KDGETKEYCODE(r10, 0x4b4c, &(0x7f00000003c0)={0x4, 0x8}) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="340000001000050d00"/20, @ANYRES32=r11, @ANYBLOB="000000000000000014001280090001007663616e0000000004000280"], 0x34}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="20000000140001000000000000000000021f0000", @ANYRES32=r11, @ANYBLOB], 0x3}, 0x1, 0xf0ffffff}, 0x0) r12 = io_uring_setup(0xba7, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x3, 0x391}) ioctl$FS_IOC_GETFLAGS(r12, 0x80086601, &(0x7f0000000280)) sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x300, &(0x7f00000002c0)={&(0x7f0000000380)=@ipv4_newaddr={0x20, 0x11, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r11}, [@IFA_LOCAL={0x8, 0x2, @multicast1}]}, 0x20}, 0x1, 0xf0ffffff}, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4ebb6caa9442fe6c}, 0xc, &(0x7f0000000080), 0x1, 0x0, 0x0, 0x10}, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array]}}, &(0x7f0000003580)=""/4096, 0x32, 0x1000, 0x1041}, 0x20) 20:02:29 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="28000000105c3b15a997c7a0005fba0000000000d1f2a4aa8efffb52f458d9fba844d0236b2eb16bdaff74691ab62019f57cc9b060f2da32a9eacfd25208e886ea9cf587a6890ae80204916c57c98762e4031204396eac1126db9ce3ae2b83d94925b3975df5e7ce", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = fcntl$dupfd(r2, 0x0, r3) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000500)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980200009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002726f73653000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000003000000070000000000000000000000000000004800435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000400000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000040000000000000000000000000000000000000000000000000000000feffffff"], 0x1) write$tun(r0, &(0x7f0000000180)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @dev, @dev}, @redirect={0x5, 0x0, 0x0, @dev, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, @loopback}}}}}, 0x3a) 20:02:29 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) r4 = accept(0xffffffffffffffff, &(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x0) r5 = openat$cgroup_int(0xffffffffffffff9c, 0x0, 0x2, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000140)}], 0x1, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x80000000a) fcntl$getownex(r5, 0x10, &(0x7f0000000540)) r6 = creat(0x0, 0x0) r7 = fcntl$getown(r6, 0x9) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0xfffffffffffffffe}, r7, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000740)='./file0\x00', 0x1a7) io_submit(0x0, 0x1, &(0x7f0000000040)=[0x0]) r8 = socket$inet(0x2, 0x803, 0xa0) connect$inet(0xffffffffffffffff, 0x0, 0x0) connect(r8, 0x0, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000000)={{}, {}, 0x8, {0x2, 0x0, @broadcast}, 'veth0_to_bond\x00'}) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f0000000100)={{0x2, 0x4e20}, {0x0, @local}, 0x0, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) stat(&(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) setresgid(0x0, 0x0, 0x0) stat(0x0, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) lchown(&(0x7f00000000c0)='./file0\x00', 0x0, r10) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) getgroups(0x8, &(0x7f0000000340)=[r10, 0xffffffffffffffff, 0xffffffffffffffff, r11, 0x0, 0x0, 0xffffffffffffffff, 0x0]) newfstatat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) lchown(&(0x7f00000000c0)='./file0\x00', 0x0, r12) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) getgroups(0x9, &(0x7f0000000340)=[0xee00, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, r12, r13, 0x0, 0x0]) getegid() io_setup(0x1ff, &(0x7f00000004c0)) r14 = socket$inet6(0xa, 0x2000000080803, 0x1) connect$inet6(r14, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) fstat(r14, &(0x7f00000004c0)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) setuid(0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) lchown(&(0x7f00000000c0)='./file0\x00', 0x0, r15) getgroups(0x9, &(0x7f0000000340)=[0xee00, r15, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0]) setreuid(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240), 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x800) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./bus/file0\x00', &(0x7f00000002c0), 0x4000) newfstatat(0xffffffffffffff9c, &(0x7f0000000200)='./bus/file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) r17 = getegid() fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0200000001005e59c5d9000002000000", @ANYRES32, @ANYBLOB, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r16, @ANYBLOB='\b\x00', @ANYRES32=r17, @ANYBLOB="fb688af8614ef3736767a7ffcd0acbe2705c80d136baea971e000000000000000000d3d31abe3fc3d17b2e09bb6a0fe864cf0c953c4d617684b46ffbd63cec6b434d3da988dbcb0d46513fae2f93b4c107603c978deb2a2b2cf2d98bc779adb075d7e94869e8cd045b34bd08b14c4d2de85d03566994393659c4e124ff4869bf3f12a211c0254355312f4c56daabfd7f081dc11885db6f310503097607a9498b96b532274d65e37b97ad853cd17d6ec340766f8c614462cc530cabb9f38433b8c4f52d5b701b6494aaa4b037182525d59f23b5863b423bd99ed6eeb8affa48b1632bc782e3c816eebb2ff540c611d2ca5d79083ca52f"], 0xa, 0x1) setuid(0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./bus/file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) getgroups(0x9, &(0x7f0000000340)=[0xee00, r18, 0xffffffffffffffff, r19, 0xffffffffffffffff, r20, 0x0, 0x0, 0x0]) setresgid(r9, r19, r9) setresgid(0x0, 0x0, 0x0) r21 = syz_open_procfs(0x0, &(0x7f0000000000)='clear_refs\x00') r22 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='stat\x00') sendfile(r21, r22, 0x0, 0x1) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r23 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fsetxattr$system_posix_acl(r4, &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000001000)=ANY=[@ANYRESHEX, @ANYRESOCT, @ANYPTR64=&(0x7f0000000780)=ANY=[@ANYPTR, @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYRES64=0x0, @ANYRES16], @ANYRES32=r23, @ANYRESHEX, @ANYBLOB="5e8dcad504a843d24ba0f2133dbba1e0d306c0030079c2e4f7ed08b1f87b9b5713d2370f79f90200000000000000bdf90500aff7ff192526ee4726b721000000000000000000000000100000"], @ANYBLOB="b83f3c0251a582edc523176f4267bbc18dac6bf2d60fc307ca48feb28f873ed3d3aa760000ea3ca28d4aabb75ed8191516226826d888c3ee1fe3b62e4ebd0ac0d50c75bab516ba51042595c09f483e99a4b5fe0e5d0b0cc983c361448896c767a0afb0bbdb93c4cc57673ba945e4d97e496cddf982d540e3e5e133b6a1c3c04a8582e618f5e379cb00e51a9634535083f3d9a53b06ac233c403830c8cf7b82bbba86c3bc42727998218153de91e900f5059c3f6a0037b04d1ed6fb55d0272ec574d6091db7dd22a463f7c257cad08b8e673c7254057b6e80fe677ad4ef6de56e5ec837a1b6c3ff1da00a5857b015f93b931cb5dd2c120e567364954305dba4e7a294baeb27b89d8a902e213c7d4b26b229831837e2ce8b9c24413ed7aeab252386f44c7f0e32a1c4ec3afa2609a765e34c95cfbb65fda9d95c1354a2fe55a6d0f06cbaff56ebc9b4a8b5140001787f7491821fd6fce8cc37567953703ff645467b56a3a2e1d4795c5f67efddee0e83cbc303b04212e52e68421b93c2b3a0e8fe53b29d94462ba1d331d5b66b92c63e5574004eda187d04e8231d218c57a0578bab82796da52bd3fad2c2451a2e1e7a0d1b7bb7e6364cb1dfafff7dfcd4f1b011988f4af21c650f37a949d27a70369d8fa84f430155f8c7b867d47c995530eb2428176803fb0ddb0b3a"], 0x4, 0x3) 20:02:29 executing program 0: request_key(0x0, 0x0, &(0x7f0000000140)='system{em0/&vboxnet1^\x00', 0xfffffffffffffffa) creat(0x0, 0x10) r0 = gettid() perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000402) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, 0x0}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$9p(0xffffffffffffffff, 0x0, 0x0) unshare(0x40000000) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) write$evdev(0xffffffffffffffff, &(0x7f0000057fa0)=[{}, {}], 0x10000007c) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x492000, 0x0) write$FUSE_INTERRUPT(r3, &(0x7f0000000180)={0x10, 0x0, 0x8}, 0x10) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000003ac0)) r4 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x124) ioctl$USBDEVFS_REAPURB(r4, 0x4008550c, &(0x7f00000000c0)) 20:02:29 executing program 2: r0 = socket$inet(0x2, 0x0, 0x42) getsockopt(r0, 0x0, 0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xfffffffffffff001}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x2000) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000540)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000013900cd98c6000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150600000fff07003506000002000000070600000ee60000bf050000000000001f650000000000006507000002000000070700004c0000001f75000000000000bf540000000000000704000004004fffad43010000000000950000000000000005000000000000009500000000000000d05bd98c13cc172c48fb42b9e1e603f862b5173514f8f7494a564babf363654191aadbd61d7d0bdc18ebc296e1085dcbdf299b20712872a269cb051b233ea0bdb6a80b4c05f80b408a2dfafe5f7ace236861a8e3cbde7b9acd782bea026f25e26ab2430243f2155491072ae8b2385b5e31ddc38cffed7409bfd712b24ffed61e78648f791c1abe4604b7e0fea0953f7d8f92037261dbe8791ea01c826916563a5488dfb605d26dbfb74289975594b56e4a9c7163e7bce1672ef356d20d6693e7810341fae4aa0116bba4f4d5a77d2f4f9220f79dc91775ed60e953800ea5578f97c793baaac7ff54c6678563f482ed32fadccb750786e530342a5d28baecb97d49dd0a9ee56174fb251bd26941ebdceed7741f567bb887181c9c559085407ff5c279707f3d758a4453"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1}, 0x48) exit(0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r2, 0x0) ftruncate(r2, 0x3) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x202) openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x841, 0x0) [ 76.392050][ T4625] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 76.401001][ T4628] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=23568 sclass=netlink_route_socket pig=4628 comm=syz-executor.1 [ 76.409073][ T4625] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 76.418201][ T4628] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables 20:02:30 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(0x0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0x0, 0x0, 0x0, 0x0, 0x0, "000000f20a000000572501000000170100"}) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000040)={0x0, 0xffffffff}) r2 = syz_open_pts(r1, 0x1) write(r2, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r2, r1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x80400, 0x0) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000100), &(0x7f0000000140)=0x4) 20:02:30 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PIO_SCRNMAP(r5, 0x4b41, &(0x7f00000001c0)="208154d2e0af9e08596ded7288c222ade65d9cdd821a9ff0785ce47fb4decb3164b87985837b68937a52be33a3b338025e9f6c6fdd5e1ca915aeb65bc1c17211b61edff4644c66bd26695b4df770d172a259c9f99d958a977424858e216992ac3da4438bf9a47ff53228a966ca6f1967b4c1c36f4c6b7cf0b391feb6238e93f1098bcb2c85c12d5e882bd29b0071bd70483fea351698293ef292d71ff68d7e6419d478") splice(r4, 0x0, r2, 0x0, 0x420000a77, 0x0) write$binfmt_elf64(r5, &(0x7f0000000000)=ANY=[], 0xfffffd88) fcntl$setstatus(r4, 0x407, 0x8000000000) fcntl$setpipe(r4, 0x407, 0x0) close(r3) r6 = syz_open_dev$ptys(0xc, 0x3, 0x1) fsetxattr$security_capability(r6, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v2={0x2000000, [{0x8, 0x4}, {0x2, 0x5}]}, 0x14, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) readv(r8, &(0x7f00000000c0)=[{&(0x7f00000002c0)=""/89, 0x59}], 0x1) write$binfmt_elf64(r7, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x9, 0x0, 0x6, 0x2, 0x0, 0x2, 0x3e, 0xa4d, 0xa7, 0x40, 0x2ed, 0x6e62, 0x7, 0x38, 0x1, 0x5882, 0xffff, 0x8}, [{0x1, 0x6, 0x9cea, 0x1, 0x9, 0xe66, 0xfffffffffffffffd, 0xac}, {0x70000000, 0x1, 0x80, 0x6, 0x8, 0x2, 0x10001, 0x100}], "229da1720e9b80334c05fd593cdc5744aad874454450561b912ce2573f8d97b42c637a17cefbbb5a194af3b5527d679c7f73f5815a92e0ce47cc86afe598fc69ee8596efeb3fca36915f2551b11fb20c7dd1cb2921c5846c03a19de6fb3391a4b1c17914f142402cbf6658c92ff0b82d7a4c144f2b72caa651ef9d6dd304da"}, 0x12f) 20:02:30 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x6c, 0x0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x4, 0x1, @in6={0xa, 0x0, 0x0, @local}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast1}}}}]}]}, 0x6c}}, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0xf9f, 0x4, 0x7}) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x6c, r3, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x4, 0x1, @in6={0xa, 0x0, 0x0, @local}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast1}}}}]}]}, 0x6c}}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000180)='batadv\x00') getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000140)) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x2, &(0x7f0000000080)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) setxattr$trusted_overlay_opaque(&(0x7f0000000240)='./bus\x00', &(0x7f0000000280)='trusted.overlay.opaque\x00', &(0x7f00000002c0)='y\x00', 0x2, 0x1) ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) write$binfmt_script(r6, &(0x7f0000000740)={'#! ', './bus', [], 0xa, "5501dd6475f5a910b8aa3e66a797f3b7e862135b1ca98cdb3f5ff46993f56be9348931034ac521e91dbb7115c4511892b3aa894b97ab3cdd6de6765a3a7af38bc7f1f8c8bd293a4a660acac305955f36ee4cd9df1bac5fac5cb8a7418fa9a125307feca3e248bce81bc3eab5140ff08b3b045e2e6b49e88def0da70e0a8e76e52545f877a1e03229a693911dab93d55ad1c6076b247551c8e972262800d62039cc1bcd099133ee62b3b5af4807ed5e03dca2166bf8ee03bc93394c433b68539d6a433b4bf671c15e684b5df021b0716db00008000000000000d81dedf10637d687906db45e2485da0996052e070a5599664a5a6a38a3141db94cb224002082caf9deaf8670a3967e03606e014d077ca97a88ef561f7fb6d24bfdb8ca69f7f1266bc29b06f70d9d8cf0bb99c39bbcaf516917031ed4d1be5a45b6428f4814f6fbaac5bb5239f2a1b69d7d0eac96d28aa21b56239b06acbbfa0aaab82619657bad82f3c0ca1ee25af37f627930a0ee3690f40cb2a335ef6dfffcc319"}, 0x184) mount$overlay(0x400002, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000000c0)={[{@default_permissions='default_permissions'}], [{@rootcontext={'rootcontext', 0x3d, 'staff_u'}, 0x22}]}) r7 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x404802, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS(r7, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x5, 0x1, 0x101, 0x0, 0x0, {0x7, 0x0, 0x6}, ["", "", "", "", "", "", ""]}, 0x14}}, 0x800) 20:02:30 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) ftruncate(r0, 0x3) openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) syz_mount_image$vfat(&(0x7f00000000c0)='vfat\x00', &(0x7f0000000040)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000300)=[{&(0x7f00000001c0)="eb2c906d5466732e66617400020401ed01edbfeccefd", 0x16}], 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000000000/0x2000)=nil) 20:02:30 executing program 3: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="ff3e6808e92b7abafc47d822996f60e4"}, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) ftruncate(r1, 0x3) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f00000000c0)={0x1, 0xe6, 0x1}) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000180)={'raw\x00', 0x48, "58de709df00040ccd10d4f7c4477710e0a68a331bd6f5ceebff960acc433fb9a4b18439145d614be4dd9af2b9e15d78be9cfb6eef9937e7fcf39fc4c16138b70937af92e06e13c2e"}, &(0x7f0000000000)=0x6c) sendmmsg$inet(r0, &(0x7f0000003e40)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000040)={0x2, 0x4e23}, 0x10, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000001000100000000000000890804ac1414aabe11bad78e8240153700ab278526dae1dc854b04dc5d40c6375aaf146455060000008e3946eb4b6fa7bf8a"], 0x18}}], 0x2, 0x0) [ 76.762378][ T4641] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=23568 sclass=netlink_route_socket pig=4641 comm=syz-executor.1 20:02:30 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000540)='/selinux/member\x00', 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x406, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000001800800000030000000200000000000400000000000000ffffffff000700"/51], &(0x7f0000000380)=""/143, 0x33, 0x8f, 0x1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x0, &(0x7f0000000080)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, r3, 0x8, &(0x7f0000000000)={0xfffffffe, 0x3}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0xc0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=0xe3de, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x6, 0x1}, 0x0, 0x0, &(0x7f0000000180)={0x0, 0x6, 0x7, 0x800}, &(0x7f00000001c0)=0x3, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=0x80}}, 0x10) getsockopt$inet6_tcp_int(r4, 0x6, 0x17, 0x0, &(0x7f0000000140)) setsockopt$inet6_tcp_int(r4, 0x6, 0xa, &(0x7f0000000040)=0x8001, 0x4) 20:02:30 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7302}) ioctl$TUNGETIFF(r0, 0x400454e2, &(0x7f0000000040)) ioctl$TUNSETCARRIER(r0, 0x400454e2, &(0x7f0000000240)=0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='gid_map\x00') setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x5, 0x4) r3 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) r4 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) r5 = dup2(r0, r1) sendmsg$NLBL_MGMT_C_PROTOCOLS(r5, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x88, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @ipv4={[], [], @loopback}}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x1a}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x10}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_CV4DOI={0x8}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr="f5ee347b3f77b050e59d5a1920525c30"}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000804) r6 = fcntl$dupfd(r4, 0x406, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) close(r0) [ 76.835597][ T4669] netlink: 48 bytes leftover after parsing attributes in process `syz-executor.0'. [ 76.859315][ T4669] tipc: Invalid UDP bearer configuration [ 76.859331][ T4669] tipc: Enabling of bearer rejected, failed to enable media 20:02:30 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffd}, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, 0x0) pipe(&(0x7f0000000000)) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="3000000014000100000000000000000002000000", @ANYRES32, @ANYBLOB="08000800ac14140008000200ac260c7ebc000400e0000002"], 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'batadv0\x00'}) remap_file_pages(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0) r4 = socket(0x40000000002, 0x3, 0x2) setsockopt$inet_int(r4, 0x0, 0x17, &(0x7f0000000000)=0x5, 0x4) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000012c0)='syz_tun\x00', 0x10) sendto$unix(r4, 0x0, 0x0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) setsockopt$inet_int(r4, 0x0, 0x12, &(0x7f0000000140)=0xffffffff, 0x4) recvmmsg(r4, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000000)=0x5, 0x4) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x12, &(0x7f0000000140)=0xffffffff, 0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r5) connect(0xffffffffffffffff, &(0x7f0000000000)=@nfc_llcp={0x27, 0x0, 0x0, 0x5, 0x27, 0xfd, "fc5f1e4bf6361cc12cf476a326c35d79048457a5e3ebfe8ef2c9f1f054ae317c001a65bbad83d05efcaf9e8803b3555ba4bddacf50fb44dae8f7e4dfbcda5a", 0x6}, 0x80) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x11, 0x800000003, 0x0) getsockname$packet(r6, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) socket(0x10, 0x803, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x4000010000000013, &(0x7f0000000040)=0x1, 0x4) connect$inet(r7, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) r8 = socket$inet(0x2, 0x80001, 0x0) bind$inet(r8, &(0x7f00000000c0)={0x2, 0x4e21, @multicast2}, 0x10) sendto$inet(r8, &(0x7f0000000200)="f9", 0x1, 0x0, 0x0, 0x0) 20:02:30 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r2 = socket$unix(0x1, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newlink={0x40, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x3, r1}, @IFLA_IPTUN_FWMARK={0x8}]}}}]}, 0x40}}, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000000)={0x100, 0x400, 0xca}) [ 76.888339][ T4669] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 76.917021][ T4669] overlayfs: missing 'lowerdir' 20:02:30 executing program 1: pipe(&(0x7f0000000040)) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$vsock_dgram(0x28, 0x2, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000280)=""/87, 0x57) getdents64(0xffffffffffffffff, &(0x7f0000000080)=""/167, 0xa7) clock_gettime(0x0, 0x0) setitimer(0x0, &(0x7f0000000240)={{0x0, 0x2710}}, 0x0) sched_setattr(0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x16040, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300)='nl80211\x00') sendmsg$NL80211_CMD_SET_KEY(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x248304e}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x80, r3, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x1c, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "2318b5a817b1beaebeb8b5bdb3"}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "c5e2f4dd7d"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "06d0fcf5df"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "04a77f2c6731bb9990794925e5"}]}, 0x80}, 0x1, 0x0, 0x0, 0x40001}, 0x2400c8d1) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, 0x0, 0x20000910) creat(0x0, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x4000) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x10, 0x4000000000000002, 0xc) write(0xffffffffffffffff, &(0x7f0000000940)="1f0000000104ff00fd4c54c007110000f30503000a000100010423dcffdf00", 0x1f) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x8002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x100000003, 0xfb7d, 0x28120001) r4 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) dup(r1) bind(0xffffffffffffffff, 0x0, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x182) r6 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) pwritev(r7, &(0x7f0000000340), 0xde3, 0x5) ioctl$LOOP_CHANGE_FD(r5, 0x4c00, r6) sendfile(r5, r5, 0x0, 0x24000000) [ 76.938006][ T4690] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 76.947665][ T4690] mmap: syz-executor.2 (4690) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 76.960792][ T4690] raw_sendmsg: syz-executor.2 forgot to set AF_INET. Fix it! 20:02:30 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x800, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x1739, 0x8}) r1 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r2, 0x0) ftruncate(r2, 0x3) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f0000000240)={0x34, 0x0, &(0x7f0000000200)}) fcntl$getownex(r1, 0x10, &(0x7f00000000c0)={0x0, 0x0}) ptrace$getregs(0xc, r3, 0x364e, &(0x7f0000000100)=""/52) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000140)={0x7, 'veth1_vlan\x00', {0x7ff}, 0x4164}) bpf$BPF_PROG_TEST_RUN(0x5, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x7f, 0x0, &(0x7f0000000180)="9ffa42a4d8f86f5570c28ee33a470b10ef6e4d1ee4c4caf9ddd8b90665a7585a899a5d0f6b9da6440772f567844ace6cf8b5e6736d68b667c841c5fc5c0916bdfccb41fdd783c702aa5d02f9bf2687a6e6ae12c1b05869530d05a28b8311a6be63c1cd4864812e02ee4f2c86d9ef53a2a2c1023e996b557458e061884e5916", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) [ 76.987842][ T4702] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 20:02:30 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x3}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000580)="9445244b7f8b8356c126e485529a207aac1930ea8450e01b86a7e5d6abc3062cf49dc37207115d076a7f9e03efeb915cf6e9a9a3efe84a05f8c531a114a79556f224832215def4a0c01626af28ad07fa177dad27bf4587051d5ba2d2da3845cdebcfeb283a18e13608c1d33a5f35f2bece8591855020b3cb3c1714973ab6bf364d19fbb4a1c8b4f362de30ddab556cda3c5879b03542678bdb5d7e7ee27d189a57bc48fe5edc54a7baf390", 0xab, 0xfffffffffffffffc) keyctl$read(0xb, r4, &(0x7f0000000240)=""/27, 0x1b) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r5 = dup(0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000007", @ANYRES32=0x0, @ANYBLOB="02f600000000000008001b000000000001020000000d2cd505890a0c8969019f5bce2f495225ee37fe11156e0921cc51212f21d2c01f62b249b50cd5645ca4bca13260"], 0x3}}, 0x0) sendmsg$nl_route(r5, 0x0, 0x40014) pivot_root(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00') openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/checkreqprot\x00', 0x80000, 0x0) r7 = socket(0x11, 0x0, 0x0) bind(r7, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r7, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x11, 0x800000003, 0x0) bind(r9, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r9, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000002400e977a885887298fb82f24186cf2b", @ANYRES32=r10, @ANYBLOB="00000001f1ffffff0000000008000100687462001c00020018000200030000001afaffffff0000000000"], 0x48}}, 0x0) [ 77.039763][ T4697] overlayfs: missing 'lowerdir' 20:02:31 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(0x0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0x0, 0x0, 0x0, 0x0, 0x0, "000000f20a000000572501000000170100"}) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000040)={0x0, 0xffffffff}) r2 = syz_open_pts(r1, 0x1) write(r2, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r2, r1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x80400, 0x0) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000100), &(0x7f0000000140)=0x4) 20:02:31 executing program 3: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x4102, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x4, &(0x7f00000001c0)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x49f2, 0x0, 0x0, 0x0, 0x1}, @exit, @call={0x85, 0x0, 0x0, 0xb}], &(0x7f0000000100)='GPL\x00', 0x3, 0xffa, &(0x7f000062b000)=""/4090, 0x0, 0x0, [], 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001280)={r1, 0x0, 0xe, 0x0, &(0x7f0000000140)="917b38622c82cd626df641c1d95f", 0x0, 0xffff, 0x0, 0x2d, 0x141, &(0x7f0000000000)="77001000008c9c1831a410b3f93b680c332e84fbe6011a176ac612a8da5098214620e9ea8eb6a0a74a2024844d", &(0x7f0000000380)="e465ddc118470d80bf09ca53b6a25034c49ab11ad0c9fb49d77cfcff8c0d268d3cdaebd6c2ede47611f4c5e69fe92d9828d51249210c4e7090e4b00b6a6a57b1ca3fe908994aac87276fccc8b13840ad5df7722c243d443ac5e3f355c0ef141557341f91a6343d7823b8bbcadeccd2335f1d338e621fb705cde971afe28897818f688a63ff2d512a5c61ed2d9193b500efe85380759a6b1b90e4a2f6ce83a76c6584a8302af8e41aa71d75a4e9c25995695d5e4e6a3692ad93e4ad009eba1f2e61879796198867a44517613281a9e441fb4d08cd5569f14cf0708f90344cba459509d5a7384dbf0df509e66167a3eab9d8595011e2ce27096868469b5fc49cb079935aeaf8e4658d78272b431bd0a9b7386047f95bc39b5d6c32e1c43ba57eaa044db1e95bca1a8a9516cdbaa2fb4b7a96fad2fd85c49039518afd6e496e8cb355"}, 0x40) 20:02:31 executing program 1: pipe(&(0x7f0000000040)) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$vsock_dgram(0x28, 0x2, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000280)=""/87, 0x57) getdents64(0xffffffffffffffff, &(0x7f0000000080)=""/167, 0xa7) clock_gettime(0x0, 0x0) setitimer(0x0, &(0x7f0000000240)={{0x0, 0x2710}}, 0x0) sched_setattr(0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x16040, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300)='nl80211\x00') sendmsg$NL80211_CMD_SET_KEY(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x248304e}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x80, r3, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x1c, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "2318b5a817b1beaebeb8b5bdb3"}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "c5e2f4dd7d"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "06d0fcf5df"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "04a77f2c6731bb9990794925e5"}]}, 0x80}, 0x1, 0x0, 0x0, 0x40001}, 0x2400c8d1) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, 0x0, 0x20000910) creat(0x0, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x4000) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x10, 0x4000000000000002, 0xc) write(0xffffffffffffffff, &(0x7f0000000940)="1f0000000104ff00fd4c54c007110000f30503000a000100010423dcffdf00", 0x1f) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x8002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x100000003, 0xfb7d, 0x28120001) r4 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) dup(r1) bind(0xffffffffffffffff, 0x0, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x182) r6 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) pwritev(r7, &(0x7f0000000340), 0xde3, 0x5) ioctl$LOOP_CHANGE_FD(r5, 0x4c00, r6) sendfile(r5, r5, 0x0, 0x24000000) 20:02:31 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='projid_map\x00') r1 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2a8600, 0x0) r3 = pidfd_open(0x0, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r3, 0x40806685, &(0x7f0000000080)={0x1, 0x2, 0x1000, 0xd4, &(0x7f00000001c0)="1ea9075add66f42145083f789f83cb641dd7b05a8add92a58993d248d468ceba6f120f45a084bc4c3d2ce745a5a7276aa86b931016c6a851b404fb9e6cafb373f77c206d34d622d0f95e208c91905d403b70d2fb334abfb22e9a1b8d6d9a4562ead43c1ceaff265aacf6d825071d6d4f014e5b005916326093b50e6f648ed321ca8e45eb48e1f14bbdee63092ae89e5c3bc14ce322d7a4b66f5bb1b63817ed86e9dd4c12b785b0102403a70b89722af54d90d4798a3e8f08552563f7f0c63dad26f2ad651b27df2d1fcdb2a7fdfd9c31c00f8de2", 0xdf, 0x0, &(0x7f00000002c0)="fbb9add9a75f6842323dfcf8bf139b143caa62a167c8049e0d74f6da96204227c9cfd532032d38438b82d539ced9cee5d8d04be8f441720bbf883175e8bc3758d453b8b620d2e455a36e82f199000b7e19fea6c5e5e5c9195f39d209f009a923cb6b5ff27b0c0dfae71d4a4b606c2428ad37cf2a0923a2e6c40c5a7352fe2cd40d4c6783ccb0496566596277554aa876110a4af8d5e8bbce06a20ebef3eaf8af81e36aa002a100f7e6f616ffdc72430d6146ada715c74a45de81a4b57b3c28ef88751c63e77a4f9c12dd6fd4341aec0262df3856f93986de69a2bbce8c30a4"}) sendfile(r2, r0, 0x0, 0x1) lseek(r0, 0x1f, 0x0) r4 = openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x208082, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r5, 0x0) ftruncate(r5, 0x3) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000000100)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r6, 0x10, &(0x7f00000003c0)={0x9b}) ioctl$void(r4, 0x5451) 20:02:31 executing program 3: pipe(&(0x7f0000000040)) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$vsock_dgram(0x28, 0x2, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000280)=""/87, 0x57) getdents64(0xffffffffffffffff, &(0x7f0000000080)=""/167, 0xa7) clock_gettime(0x0, 0x0) setitimer(0x0, &(0x7f0000000240)={{0x0, 0x2710}}, 0x0) sched_setattr(0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x16040, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300)='nl80211\x00') sendmsg$NL80211_CMD_SET_KEY(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x248304e}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x80, r3, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x1c, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "2318b5a817b1beaebeb8b5bdb3"}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "c5e2f4dd7d"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "06d0fcf5df"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "04a77f2c6731bb9990794925e5"}]}, 0x80}, 0x1, 0x0, 0x0, 0x40001}, 0x2400c8d1) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, 0x0, 0x20000910) creat(0x0, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x4000) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x10, 0x4000000000000002, 0xc) write(0xffffffffffffffff, &(0x7f0000000940)="1f0000000104ff00fd4c54c007110000f30503000a000100010423dcffdf00", 0x1f) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x8002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x100000003, 0xfb7d, 0x28120001) r4 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) dup(r1) bind(0xffffffffffffffff, 0x0, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x182) r6 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) pwritev(r7, &(0x7f0000000340), 0xde3, 0x5) ioctl$LOOP_CHANGE_FD(r5, 0x4c00, r6) sendfile(r5, r5, 0x0, 0x24000000) 20:02:31 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="8500000007000000350000000000000085000000050000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x0, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffc1a}, 0x15) r1 = socket(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8698071") r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000080)={0x54, 0x200, 0x5, {0x101, 0x7}, {0x80, 0x7f}, @rumble={0x5}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0x0, 0xe, 0x0, &(0x7f00000000c0)="61df712bc884fed5722780b6c2a7", 0x0, 0x8000}, 0x28) 20:02:31 executing program 0: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ftruncate(r1, 0x12081ff) fcntl$setstatus(r0, 0x4, 0x6100) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0xf642e7e) r2 = open(&(0x7f0000000180)='./bus\x00', 0x149d42, 0x0) r3 = creat(&(0x7f0000000340)='./file0\x00', 0x0) r4 = getpid() syz_open_procfs(r4, &(0x7f0000000140)='net/netfilter\x00') r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r6, 0x0) ftruncate(r6, 0x3) sendmsg$NFQNL_MSG_VERDICT(r6, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10011020}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x1, 0x3, 0x5, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x7f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20000010) fallocate(r5, 0x0, 0x0, 0x4003fe) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000100)={0x0, r3}) r7 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) sendfile(r7, r7, 0x0, 0x8080fffffffe) creat(&(0x7f00000001c0)='./bus\x00', 0x2) 20:02:31 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x2, 0x21, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) socket$packet(0x11, 0x0, 0x300) accept4(0xffffffffffffffff, &(0x7f00000002c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) r4 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r4, 0x800) lseek(r4, 0x0, 0x2) r5 = open(&(0x7f0000001840)='./bus\x00', 0x84002, 0x0) sendfile(r4, r5, 0x0, 0x8400fffffffa) dup(0xffffffffffffffff) syz_genetlink_get_family_id$nbd(0x0) ftruncate(0xffffffffffffffff, 0x800) lseek(0xffffffffffffffff, 0x0, 0x2) r6 = open(&(0x7f0000001840)='./bus\x00', 0xa4042, 0x20) sendfile(0xffffffffffffffff, r6, 0x0, 0x0) r7 = creat(&(0x7f0000000680)='./bus\x00', 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) lseek(r7, 0x0, 0x0) r8 = creat(&(0x7f0000000180)='./file0\x00', 0x10) ftruncate(r8, 0x0) socket(0x10, 0x0, 0x0) r9 = open(0x0, 0x141042, 0x0) lseek(0xffffffffffffffff, 0x6, 0x0) sendfile(0xffffffffffffffff, r4, 0x0, 0x8400fffffffa) sendmsg$NBD_CMD_DISCONNECT(r9, 0x0, 0x4000810) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r10, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) recvmsg(r10, &(0x7f0000000240)={0x0, 0x4, &(0x7f0000002540)=[{0x0}, {0x0, 0xfffffffffffffe7e}, {&(0x7f0000003800)=""/4100, 0xffffff5f}], 0x3, 0x0, 0x1c6, 0x3e8}, 0x180) r11 = getpid() sched_setattr(r11, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3}, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000740)=ANY=[@ANYRESHEX, @ANYRES32, @ANYPTR64=&(0x7f0000000480)=ANY=[], @ANYPTR64=&(0x7f0000000700)=ANY=[@ANYRES32, @ANYRES32], @ANYRES64, @ANYRES32, @ANYBLOB="da9191a0e7d50931ff67a36a2b0a4538d83761b40fa899b14158a6e13222b4368cbf268793e32f561879e9a9990061ff3b43bb7365ee216f5ee11947b1081d9570cb7a99c8c0280b81a5b334c9d726cf933d9365fae704b66d82fd415d51e52ceb15eeb7ba2a150000000000000003ae665a558750f99fbc27893a21fd3a2cef3a2b9b1ed13f6da70fc2e08651e47b2c3ffa96a269d0fe779986133c9a7da85645d8c3397e99", @ANYBLOB="3d483beb6f8ee2ac6416956cf25e7ea9172f6e0c9d5f58cca3f716e5d79bfd7b089056691907d42c4566b4f51dee02492769a2249fc20ace3a92ee4b9fd04167a298ab7256bace21c52f10b1dcaaa788ddd3439472b01e00141f6394def5a6008414a1f11cac70a6f55541c33c35dd104ed5e3aecc64a96a3b6f54f2adb2c6d5b9580f2a0cfb7b11cde15cef99c9b0721e46e2b626b9926f0bceca144d20737335ddda9f7540dcf4ecd8251b60a93f372daec25c44f4a3935134aae19b8902ab8fc34d182a00000000000000000000000000000000000d784b64e6f3cad072fbe90d18a1e738884ebcf41ba7041903a463eb9b696374a4f7c0623d1467ae89b4ffca7a5ef35434c4c7c0c299b7600f22ff51363527034579471082ed0bd1e165a9e086169ac0d57d05bc629ab8d695646dc2a6e54d37bdacf7ff7e7c509f1e0e2e4dca291d011345def500ef93bba6a1e1db519b79ed6d391f0cb109fd18b62b9ccb48c208e39fdd0a46e60f0a54ba6b8a8bb0db70a19f01dfd5c169bc4169854834a170e70d"], 0x25b) pipe(0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfd53) r12 = getpid() sched_setaffinity(r12, 0x0, 0x0) pipe2(&(0x7f00000001c0), 0x0) pivot_root(0x0, &(0x7f0000000340)='./file0\x00') 20:02:31 executing program 3: pipe(&(0x7f0000000040)) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$vsock_dgram(0x28, 0x2, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000280)=""/87, 0x57) getdents64(0xffffffffffffffff, &(0x7f0000000080)=""/167, 0xa7) clock_gettime(0x0, 0x0) setitimer(0x0, &(0x7f0000000240)={{0x0, 0x2710}}, 0x0) sched_setattr(0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x16040, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300)='nl80211\x00') sendmsg$NL80211_CMD_SET_KEY(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x248304e}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x80, r3, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x1c, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "2318b5a817b1beaebeb8b5bdb3"}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "c5e2f4dd7d"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "06d0fcf5df"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "04a77f2c6731bb9990794925e5"}]}, 0x80}, 0x1, 0x0, 0x0, 0x40001}, 0x2400c8d1) sendmsg$NLBL_MGMT_C_REMOVEDEF(0xffffffffffffffff, 0x0, 0x20000910) creat(0x0, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x4000) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x10, 0x4000000000000002, 0xc) write(0xffffffffffffffff, &(0x7f0000000940)="1f0000000104ff00fd4c54c007110000f30503000a000100010423dcffdf00", 0x1f) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x8002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(0xffffffffffffffff, 0x100000003, 0xfb7d, 0x28120001) r4 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) dup(r1) bind(0xffffffffffffffff, 0x0, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x182) r6 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) pwritev(r7, &(0x7f0000000340), 0xde3, 0x5) ioctl$LOOP_CHANGE_FD(r5, 0x4c00, r6) sendfile(r5, r5, 0x0, 0x24000000) 20:02:31 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x3}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000580)="9445244b7f8b8356c126e485529a207aac1930ea8450e01b86a7e5d6abc3062cf49dc37207115d076a7f9e03efeb915cf6e9a9a3efe84a05f8c531a114a79556f224832215def4a0c01626af28ad07fa177dad27bf4587051d5ba2d2da3845cdebcfeb283a18e13608c1d33a5f35f2bece8591855020b3cb3c1714973ab6bf364d19fbb4a1c8b4f362de30ddab556cda3c5879b03542678bdb5d7e7ee27d189a57bc48fe5edc54a7baf390", 0xab, 0xfffffffffffffffc) keyctl$read(0xb, r4, &(0x7f0000000240)=""/27, 0x1b) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r5 = dup(0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000007", @ANYRES32=0x0, @ANYBLOB="02f600000000000008001b000000000001020000000d2cd505890a0c8969019f5bce2f495225ee37fe11156e0921cc51212f21d2c01f62b249b50cd5645ca4bca13260"], 0x3}}, 0x0) sendmsg$nl_route(r5, 0x0, 0x40014) pivot_root(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00') openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/checkreqprot\x00', 0x80000, 0x0) r7 = socket(0x11, 0x0, 0x0) bind(r7, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r7, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x11, 0x800000003, 0x0) bind(r9, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r9, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000002400e977a885887298fb82f24186cf2b", @ANYRES32=r10, @ANYBLOB="00000001f1ffffff0000000008000100687462001c00020018000200030000001afaffffff0000000000"], 0x48}}, 0x0) 20:02:31 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) ftruncate(r0, 0x3) r1 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) write$binfmt_misc(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="73797a31caac6ab2388da2b056b286491d1cfa8e56a122a2e301651a4d7d79f05cdcde9a62a668bc6a48abd136e08b273eb856705cc547936e42c05e987a87efd61c5a3e131c333a4cbcdad179b17da76da9307ec4937df59f77b8637fe23242562325087cab07304db11fb6f9311ea9d92c19bdd905dc91db3f103261e5f3fc6df5f0cd7fde12d98cbfcad165ed8ba538e1ef6d4258c551c6a448e402e9155062dd2884761d707820063e4f9c82320fa8b584c08854dab62c6a072b400ff00a450efe5f14d55d3ed8c845edebbb31756f142b0e7deaaf62964bb3b41e4c634bf78437cc347cc856290ba0f6e72f0a5d3ab16d0c6496988fef"], 0xf9) accept$unix(r0, &(0x7f0000000100), &(0x7f0000000180)=0x6e) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') lseek(r2, 0x8b0, 0x0) preadv(r2, &(0x7f0000001480)=[{&(0x7f0000000040)=""/178, 0xb2}], 0x1, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000002c0)={'syzkaller1\x00', 0x1000}) 20:02:31 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x3}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000580)="9445244b7f8b8356c126e485529a207aac1930ea8450e01b86a7e5d6abc3062cf49dc37207115d076a7f9e03efeb915cf6e9a9a3efe84a05f8c531a114a79556f224832215def4a0c01626af28ad07fa177dad27bf4587051d5ba2d2da3845cdebcfeb283a18e13608c1d33a5f35f2bece8591855020b3cb3c1714973ab6bf364d19fbb4a1c8b4f362de30ddab556cda3c5879b03542678bdb5d7e7ee27d189a57bc48fe5edc54a7baf390", 0xab, 0xfffffffffffffffc) keyctl$read(0xb, r4, &(0x7f0000000240)=""/27, 0x1b) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r5 = dup(0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000007", @ANYRES32=0x0, @ANYBLOB="02f600000000000008001b000000000001020000000d2cd505890a0c8969019f5bce2f495225ee37fe11156e0921cc51212f21d2c01f62b249b50cd5645ca4bca13260"], 0x3}}, 0x0) sendmsg$nl_route(r5, 0x0, 0x40014) pivot_root(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00') openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/checkreqprot\x00', 0x80000, 0x0) r7 = socket(0x11, 0x0, 0x0) bind(r7, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r7, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x11, 0x800000003, 0x0) bind(r9, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r9, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000002400e977a885887298fb82f24186cf2b", @ANYRES32=r10, @ANYBLOB="00000001f1ffffff0000000008000100687462001c00020018000200030000001afaffffff0000000000"], 0x48}}, 0x0) 20:02:31 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(0x0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0x0, 0x0, 0x0, 0x0, 0x0, "000000f20a000000572501000000170100"}) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000040)={0x0, 0xffffffff}) r2 = syz_open_pts(r1, 0x1) write(r2, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r2, r1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x80400, 0x0) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000100), &(0x7f0000000140)=0x4) 20:02:31 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000040)=ANY=[@ANYBLOB="72617700000000000000000000000000000000000000000000000000000000000800000003000000700200000001000000018900000100000001000000000000d8010000d8010000d8010000d8010000d8010000030000000000000000000000e0000001e0000001000000000000000076657468305f746f5f7465616d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000d80000010000000000000000000000000000000000000000280069636d70000000000000000000000000000000000000000000000000000000a7a900000000004000636f6e6e6c696d6974000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000028004d41524b0000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000019c300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000007000d800000000000000000000000000000000000000000068004354000000000000000000000000000000000000000000000000000000020000000000000000000000006e657462696f732d6e7300000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r3, 0x0) ftruncate(r3, 0x3) r4 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r4, &(0x7f0000000340)={0x40002016}) 20:02:31 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000021c0)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/route\x00') preadv(r0, &(0x7f00000017c0), 0x1b4, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000040)={0x0, 0x0}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x4, 0xffffffff, 0x4, 0x0, r1}) 20:02:31 executing program 2: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x514}, 0x0, 0x0, 0xffffffffffffffff, 0xa) syz_genetlink_get_family_id$batadv(&(0x7f0000000300)='batadv\x00') sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000854}, 0x0) mkdir(0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) socket$packet(0x11, 0x0, 0x300) socket$packet(0x11, 0x0, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB="c4b5c493ffa16322d1146f44a616eafc68cbc3255d93f8bfc7fc059a"], 0x2}}, 0x40) ioctl$KDGKBDIACR(0xffffffffffffffff, 0x4b4a, &(0x7f0000000180)=""/44) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r5, 0x0) ftruncate(r5, 0x3) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100)='wireguard\x00') sendmsg$WG_CMD_SET_DEVICE(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="0100000000000000000001000000140002007767300000000000000000000000000004000880"], 0x3}}, 0x0) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x28, r7, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x840}, 0x800005c) ioctl$EVIOCREVOKE(r2, 0x40044591, 0x0) pivot_root(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00') 20:02:31 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x3}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000580)="9445244b7f8b8356c126e485529a207aac1930ea8450e01b86a7e5d6abc3062cf49dc37207115d076a7f9e03efeb915cf6e9a9a3efe84a05f8c531a114a79556f224832215def4a0c01626af28ad07fa177dad27bf4587051d5ba2d2da3845cdebcfeb283a18e13608c1d33a5f35f2bece8591855020b3cb3c1714973ab6bf364d19fbb4a1c8b4f362de30ddab556cda3c5879b03542678bdb5d7e7ee27d189a57bc48fe5edc54a7baf390", 0xab, 0xfffffffffffffffc) keyctl$read(0xb, r4, &(0x7f0000000240)=""/27, 0x1b) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r5 = dup(0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000007", @ANYRES32=0x0, @ANYBLOB="02f600000000000008001b000000000001020000000d2cd505890a0c8969019f5bce2f495225ee37fe11156e0921cc51212f21d2c01f62b249b50cd5645ca4bca13260"], 0x3}}, 0x0) sendmsg$nl_route(r5, 0x0, 0x40014) pivot_root(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00') openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/checkreqprot\x00', 0x80000, 0x0) r7 = socket(0x11, 0x0, 0x0) bind(r7, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r7, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x11, 0x800000003, 0x0) bind(r9, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r9, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000002400e977a885887298fb82f24186cf2b", @ANYRES32=r10, @ANYBLOB="00000001f1ffffff0000000008000100687462001c00020018000200030000001afaffffff0000000000"], 0x48}}, 0x0) 20:02:32 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f, {0x0, 0x0, 0x9947}}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$selinux_context(r1, &(0x7f00000000c0)='system_u:object_r:auditd_initrc_exec_t:s0\x00', 0x2a) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000000)={{0x1000}, 'syz0\x00'}) ioctl$UI_DEV_CREATE(r0, 0x5501) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$P9_RLINK(r2, &(0x7f0000000140)={0x7, 0x47, 0x1}, 0x7) 20:02:32 executing program 0: socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e25, 0x0, @ipv4={[], [], @remote}, 0xffffffff}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000001b40)=[{{&(0x7f00000001c0)=@sco, 0x80, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000001d40)={0xffffffffffffffff, 0xffffffffffffffff}) fremovexattr(0xffffffffffffffff, 0x0) fcntl$setpipe(r4, 0x407, 0x0) r5 = add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r5, 0x0) r6 = request_key(&(0x7f0000000480)='pkcs7_test\x00', 0x0, &(0x7f0000000500)='vboxnet1louser*em1\x00', 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r5, 0x0, r6, 0x0) r7 = add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r7, 0x0) r8 = request_key(&(0x7f0000000480)='pkcs7_test\x00', 0x0, &(0x7f0000000500)='vboxnet1louser*em1\x00', 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r7, 0x0, r8, 0x0) r9 = request_key(&(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='/sys/kernel/debug/binder/failed_transaction_log\x00', r7) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, &(0x7f0000000180)=@chain={'key_or_keyring:', r9, ':chain\x00'}) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7f}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r10, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto(r10, &(0x7f00000001c0)="fb", 0x1, 0x200008c5, 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1a2, 0x0) clone(0x40000139, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000000), 0x4) sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x5}, 0x0) r11 = syz_open_procfs(0x0, &(0x7f0000000200)='net/igmp\x00') preadv(r11, &(0x7f00000017c0), 0x315, 0x79) syz_open_procfs(0x0, &(0x7f0000000200)='net/igmp\x00') [ 78.502715][ T4786] xt_CT: You must specify a L4 protocol and not use inversions on it [ 78.557056][ T4793] input: syz0 as /devices/virtual/input/input4 [ 78.639440][ T4800] input: syz0 as /devices/virtual/input/input5 20:02:32 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000040)=""/11, 0xb) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x5c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r5 = epoll_create1(0x0) r6 = epoll_create1(0x0) r7 = dup3(r4, r6, 0x0) r8 = openat(0xffffffffffffffff, &(0x7f0000000640)='./file0\x00', 0x400, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r9, 0x0) ftruncate(r9, 0x3) accept4$packet(r9, &(0x7f00000006c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000700)=0x14, 0x80000) sendmsg$NL80211_CMD_LEAVE_MESH(r8, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x3c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x3}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x7f, 0x2}}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r10}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x5, 0xffffffffffffffff}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000804}, 0x20000800) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r7, &(0x7f00000001c0)={0x0, 0x3f00}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) sched_setattr(0x0, &(0x7f0000000400)={0x38, 0x1, 0x0, 0x4, 0x1}, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4}, &(0x7f0000000080)={0x0, r11+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 20:02:32 executing program 0: socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e25, 0x0, @ipv4={[], [], @remote}, 0xffffffff}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000001b40)=[{{&(0x7f00000001c0)=@sco, 0x80, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000001d40)={0xffffffffffffffff, 0xffffffffffffffff}) fremovexattr(0xffffffffffffffff, 0x0) fcntl$setpipe(r4, 0x407, 0x0) r5 = add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r5, 0x0) r6 = request_key(&(0x7f0000000480)='pkcs7_test\x00', 0x0, &(0x7f0000000500)='vboxnet1louser*em1\x00', 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r5, 0x0, r6, 0x0) r7 = add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r7, 0x0) r8 = request_key(&(0x7f0000000480)='pkcs7_test\x00', 0x0, &(0x7f0000000500)='vboxnet1louser*em1\x00', 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r7, 0x0, r8, 0x0) r9 = request_key(&(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='/sys/kernel/debug/binder/failed_transaction_log\x00', r7) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, &(0x7f0000000180)=@chain={'key_or_keyring:', r9, ':chain\x00'}) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7f}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r10, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto(r10, &(0x7f00000001c0)="fb", 0x1, 0x200008c5, 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1a2, 0x0) clone(0x40000139, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000000), 0x4) sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x5}, 0x0) r11 = syz_open_procfs(0x0, &(0x7f0000000200)='net/igmp\x00') preadv(r11, &(0x7f00000017c0), 0x315, 0x79) syz_open_procfs(0x0, &(0x7f0000000200)='net/igmp\x00') 20:02:32 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) syz_mount_image$tmpfs(&(0x7f0000000000)='tmpfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYPTR]) setxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000100)={'L+', 0x2}, 0x16, 0x0) 20:02:32 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) syz_mount_image$tmpfs(&(0x7f0000000000)='tmpfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYPTR]) setxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000100)={'L+', 0x2}, 0x16, 0x0) 20:02:32 executing program 0: socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e25, 0x0, @ipv4={[], [], @remote}, 0xffffffff}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000001b40)=[{{&(0x7f00000001c0)=@sco, 0x80, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000001d40)={0xffffffffffffffff, 0xffffffffffffffff}) fremovexattr(0xffffffffffffffff, 0x0) fcntl$setpipe(r4, 0x407, 0x0) r5 = add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r5, 0x0) r6 = request_key(&(0x7f0000000480)='pkcs7_test\x00', 0x0, &(0x7f0000000500)='vboxnet1louser*em1\x00', 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r5, 0x0, r6, 0x0) r7 = add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r7, 0x0) r8 = request_key(&(0x7f0000000480)='pkcs7_test\x00', 0x0, &(0x7f0000000500)='vboxnet1louser*em1\x00', 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r7, 0x0, r8, 0x0) r9 = request_key(&(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='/sys/kernel/debug/binder/failed_transaction_log\x00', r7) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, &(0x7f0000000180)=@chain={'key_or_keyring:', r9, ':chain\x00'}) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7f}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r10, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto(r10, &(0x7f00000001c0)="fb", 0x1, 0x200008c5, 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1a2, 0x0) clone(0x40000139, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000000), 0x4) sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x5}, 0x0) r11 = syz_open_procfs(0x0, &(0x7f0000000200)='net/igmp\x00') preadv(r11, &(0x7f00000017c0), 0x315, 0x79) syz_open_procfs(0x0, &(0x7f0000000200)='net/igmp\x00') 20:02:32 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) syz_mount_image$tmpfs(&(0x7f0000000000)='tmpfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYPTR]) setxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000100)={'L+', 0x2}, 0x16, 0x0) 20:02:32 executing program 4: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000140)="24000000200003041dfffd946f6105000a00000a1f0000031410080008000a0012000000140000001a00ffffba16a0aa1c09000000000000", 0x38}, {&(0x7f0000000180)="071bfe5a459d97828dbe9a9e327c71579b71c264cebeef211feedcf388fc4c45abf2e71dc0a905b01a1382c2e1c5facf126b544e920c50c716fe5939e3f7e2795480f48bbfb65a82d01e9e0c4e1a6665fa6bb89cc18668ccefb91e2d7af2300a6e530ec1375167168a66664bf105f0677aa15c264c0052ed48fb708bb99b8e7f3560169d0689810c1c95a5b809539f4e8fb82a9934d79374", 0x98}, {&(0x7f0000000240)="2fabf7715eeb44209b11768414e10f7e8f82c6258e0b80538c13fd7602ac39e82a6459eaea7c2ed203a0c95e756255eacb15057de1c55df15dd63578e13869d4dd7c8c08265519d0737a1bf67126be9ac0095e11e91355b65c7b1489079357725b9903d22c5cc9de3d174b8973d06767f235eda9f2cb671f94bb3a734fb93274af5ff4ea84ea0f0511c0ba44f962d64b818a49e141a6a12f037fd7ab553c2952d85f3632d7dc4f1e6b2990eacff9e7f8ebe9633705e060278afe179828cabc984c1b3879c40d8794f9", 0xc9}], 0x3}, 0x4004040) setitimer(0x0, &(0x7f0000000040)={{}, {0x0, 0x2710}}, &(0x7f00000000c0)) 20:02:32 executing program 0: socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e25, 0x0, @ipv4={[], [], @remote}, 0xffffffff}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000001b40)=[{{&(0x7f00000001c0)=@sco, 0x80, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000001d40)={0xffffffffffffffff, 0xffffffffffffffff}) fremovexattr(0xffffffffffffffff, 0x0) fcntl$setpipe(r4, 0x407, 0x0) r5 = add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r5, 0x0) r6 = request_key(&(0x7f0000000480)='pkcs7_test\x00', 0x0, &(0x7f0000000500)='vboxnet1louser*em1\x00', 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r5, 0x0, r6, 0x0) r7 = add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r7, 0x0) r8 = request_key(&(0x7f0000000480)='pkcs7_test\x00', 0x0, &(0x7f0000000500)='vboxnet1louser*em1\x00', 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r7, 0x0, r8, 0x0) r9 = request_key(&(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)='/sys/kernel/debug/binder/failed_transaction_log\x00', r7) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, &(0x7f0000000180)=@chain={'key_or_keyring:', r9, ':chain\x00'}) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7f}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r10, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto(r10, &(0x7f00000001c0)="fb", 0x1, 0x200008c5, 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1a2, 0x0) clone(0x40000139, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000000), 0x4) sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x5}, 0x0) r11 = syz_open_procfs(0x0, &(0x7f0000000200)='net/igmp\x00') preadv(r11, &(0x7f00000017c0), 0x315, 0x79) syz_open_procfs(0x0, &(0x7f0000000200)='net/igmp\x00') 20:02:32 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @multicast1}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_int(r1, 0x6, 0x17, 0x0, &(0x7f0000000140)) setsockopt$inet6_tcp_int(r1, 0x6, 0xc, &(0x7f0000000080)=0x2, 0x4) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x5) sendto$inet(r0, &(0x7f0000000200), 0xffffffffffffff97, 0x2000808a, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback}, 0x10) r2 = socket$unix(0x1, 0x2, 0x0) r3 = socket$inet6(0xa, 0x6, 0x7) fcntl$setsig(r3, 0xa, 0x3b) r4 = socket$unix(0x1, 0x1, 0x0) r5 = dup2(r4, r2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) recvfrom(r0, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739e53, 0x120, 0x0, 0x4f) [ 79.391732][ T4790] syz-executor.2 (4790) used greatest stack depth: 20640 bytes left [ 80.378481][ T4882] cgroup1: Unknown subsys name 'perf_event' [ 80.384635][ T4882] cgroup1: Unknown subsys name 'net_cls' 20:02:35 executing program 5: r0 = socket$inet6(0xa, 0x3, 0xfd) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000180)=0x4, 0x4) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 20:02:35 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0)=0x200, 0x4) connect$inet(r0, &(0x7f0000000780)={0x2, 0x4e23}, 0x10) sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f0000000280)={0x0, 0xfffffffffffffff8, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$NFT_MSG_GETGEN(r4, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, 0x10, 0xa, 0x801, 0x0, 0x0, {0xc, 0x0, 0x1}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x80b4) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES16=r5, @ANYBLOB="000426bd7000fddbdf25010000000000000009410000004c0018000004b875647000"/98], 0x68}, 0x1, 0x0, 0x0, 0x20000084}, 0x1) recvfrom(r0, 0x0, 0x0, 0x2000, 0x0, 0x0) 20:02:35 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) syz_mount_image$tmpfs(&(0x7f0000000000)='tmpfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYPTR]) setxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000100)={'L+', 0x2}, 0x16, 0x0) 20:02:35 executing program 0: syz_emit_ethernet(0xf6, &(0x7f0000000480)={@dev={[], 0x15}, @remote, @void, {@generic={0x86dd, "21c6b309615ef3d64d24eb3c8e5784c845531ec872034efb77cecb545602e9d6e48afe83882b8464e815aaf917bd56078fb4eae734dfb8e2ff28d24c40c7cafa1e6d559c33b12ac0d0d110152d578f0a96320a3b5da0a8289d9fefdc62f6ec5bab34041390f57cd38af09365f7f3b20db10705e2d70495bbb7146df865812902ae730b84e7fcf601fb0d97d96e3c5bf576c2de7f6b2f1d97bd6a6d68636ac36c33d58552402c343a96be1ce0dcbfb612c6034822a9fd9aa7f4de75ef2ffa99772730a92904d61dc8ec11ca4c8a31c89e5a236bfd7ea28ab07a794cea4e94facf41a7438e857a66a0"}}}, &(0x7f0000000580)={0x0, 0x2, [0x2e0, 0x780, 0x215, 0x2d0]}) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) symlink(&(0x7f0000000200)='./file0\x00', 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/net/tun\x00', 0x248c00, 0x0) fstat(r1, &(0x7f0000000400)) sched_setattr(r0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x12}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r2, 0x0) ftruncate(r2, 0x3) ioctl$BLKROTATIONAL(r2, 0x127e, &(0x7f00000005c0)) clock_gettime(0x0, &(0x7f00000000c0)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x6, 0x0, &(0x7f0000000000)={r3, r4+30000000}, &(0x7f0000000080)) r5 = gettid() write$cgroup_pid(r2, &(0x7f0000000600)=r0, 0x12) ptrace$setopts(0x4206, r5, 0x0, 0x0) r6 = syz_open_dev$evdev(&(0x7f0000000340)='/dev/input/event#\x00', 0xff, 0xac502) ioctl$EVIOCSKEYCODE_V2(r6, 0x40284504, &(0x7f0000000380)={0x20, 0x17, 0x6, 0x3, "c868157ccbeb7aaeb079c4b8502ecf6a70e722cf3a766ff1db6cefa19705f511"}) tkill(r5, 0x3c) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r5, 0x0, 0x0) timer_create(0x2, &(0x7f0000000140)={0x0, 0x3f, 0x4, @tid=r5}, &(0x7f0000000180)=0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) timer_settime(r7, 0x1, &(0x7f00000002c0)={{r8, r9+10000000}, {0x77359400}}, &(0x7f0000000300)) tkill(0x0, 0x1000000000016) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r10, 0x0) ftruncate(r10, 0x3) sendmsg$NFQNL_MSG_VERDICT_BATCH(r10, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="5c1700000003b16900000000000000000a000008080003400100010000000000fffffffb0000000508000340000000000c000200fffffffd0000002709000000ffffffff0cfffd0a0000000c000200fffffffc000000a1"], 0x5c}, 0x1, 0x0, 0x0, 0x8044}, 0x8000) 20:02:35 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setxattr$security_capability(&(0x7f0000000300)='\x00', &(0x7f0000000340)='security.capability\x00', &(0x7f0000000440)=@v1={0x1000000, [{0x0, 0x4}]}, 0xc, 0x2) recvmmsg(r1, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f00000002c0)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000013000)) write$P9_ROPEN(0xffffffffffffffff, &(0x7f00000004c0)={0x18, 0x71, 0x2, {{}, 0x10001}}, 0x18) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r4, &(0x7f0000000280)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040), 0xa808) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000080), 0xc, &(0x7f0000000380)={0x0}}, 0x804) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000600)=0xda6, 0x4) writev(r4, &(0x7f0000000780)=[{&(0x7f0000000100)="dff548771d77ce8786aca76dda6fb054ab8ea73799d7293eda90ba41a2db81fab55b5415692300a8e64bca2f60e1717f85f06a6bbca90f392b04f34940db7ffccc33ed6ea82296de9683c9e360cd1c477304bd8f9bd74d44a4c7d1c7e625a86cd54b72c5745f475a772b84977a6b05381dbe6259bc510f0f70c3e9946a78c7b5a19e97447799d930f9623b", 0x8b}, {&(0x7f00000001c0)="96431fb1cb119741590ad657dc5e5ce3e5fe9f1f639e6a18bc7b6c1d0b424eb306f34cf2429c62c0fdefbae36740a7169721af852826d7f14b6cae8af86507ff78a1dda991aea5952f43e7e0146a3c035f0113d617240e8940c60cdf3400193bbe3a0c0b1eae5799db27b4ee9c13475210defa4dac9d784e0c89135b82b321f8e43d7a5db9ab1bfd319f472a94", 0x8d}, {&(0x7f0000001340)="f15c93cb35c215fe339d1e9060c5b23e77cb58a87329a00288504db389cc6e395885fa906ac30eeae99fa388c31b5717e641e1586a90961b5f99b26c939d944f6cb1cf6817b7e51402a8459f9db642e97d3c05db56250a665d3ff188eb47e5b036d508aa5a5796fb8806b6a41487e0bfc3df087c18269bd7d2f477104c5d5db497ceaf3e1b11a5d63a2b7035dc69fa701f3b46fe701880800a7d38dccd4b3e8014aa15c96968359533ce2c5ffdd5f0d3297018bd7c6b5150940cdead92eb1e6bc6ba45eecf067b32425b6000b2f376ef9172426ae7fa97e5a84ef4dc540bbf5dd458ffcb75724135bd32fa04db6d6a75aedda7ab6e8501fc94e209dc3b2525ae24c954255d3247ca9c1b9525ce68179a52a87333aa2b0a8c1baa6ba6160c6d2018e67bac5402d0d89c5f798b8d1a87b0dc3306f546c61724530d9f4b6f0ee68677c7b261de5afa02d708a8ec979791de8f4831cc354ba453bc253e2435207f25494a594d4e5be39902358d362cb318ad965b7e7480a5ca5b6fe74e101c400c77392ee4419ad788f494230487811046f21f0f9665dfbaa9e94ed305a02e3fa47039e67dde19f89c8f1741aad752cdfe458ddf54e8fc10ff79b5", 0x1b9}], 0x3) sendto$inet(r4, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba78600f53f65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="00000000106f70f357ac8a1d0001b48cd4c2a1cbbe9448bc9bff090000000001000000000056"]}}, 0x0) gettid() socket$inet6(0xa, 0x80000, 0x40) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) 20:02:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) socket$pppl2tp(0x18, 0x1, 0x1) r0 = socket$inet6(0xa, 0x803, 0x2) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@multicast2, @in6=@dev={0xfe, 0x80, [], 0xd}, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x80000000000001}, {{@in=@dev, 0x0, 0x3c}, 0x0, @in6=@ipv4={[], [], @multicast1}, 0x20, 0x0, 0x1, 0x1}}, 0xe8) sendmmsg(r0, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0) [ 82.103768][ T5307] ================================================================== [ 82.111998][ T5307] BUG: KASAN: use-after-free in do_xdp_generic+0x612/0x1500 [ 82.119305][ T5307] Read of size 8 at addr ffff888098f187ff by task syz-executor.0/5307 [ 82.127430][ T5307] [ 82.129742][ T5307] CPU: 0 PID: 5307 Comm: syz-executor.0 Not tainted 5.4.19-syzkaller-00486-ga6e4656398da #0 [ 82.139880][ T5307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 82.149925][ T5307] Call Trace: [ 82.153201][ T5307] dump_stack+0x1b0/0x228 [ 82.157528][ T5307] ? show_regs_print_info+0x18/0x18 [ 82.162712][ T5307] ? vprintk_func+0x105/0x110 [ 82.167537][ T5307] ? printk+0xc0/0x109 [ 82.171598][ T5307] print_address_description+0x96/0x5d0 [ 82.177141][ T5307] ? devkmsg_release+0x127/0x127 [ 82.182067][ T5307] ? kasan_slab_alloc+0xe/0x10 [ 82.186810][ T5307] ? pskb_expand_head+0x256/0x10f0 [ 82.191915][ T5307] __kasan_report+0x14b/0x1c0 [ 82.196584][ T5307] ? do_xdp_generic+0x612/0x1500 [ 82.201518][ T5307] kasan_report+0x26/0x50 [ 82.205835][ T5307] __asan_report_load8_noabort+0x14/0x20 [ 82.211556][ T5307] do_xdp_generic+0x612/0x1500 [ 82.216302][ T5307] ? virtio_net_hdr_to_skb+0x481/0xae0 [ 82.221752][ T5307] ? generic_xdp_tx+0x4f0/0x4f0 [ 82.226608][ T5307] ? tun_get_user+0x3d10/0x3d10 [ 82.231441][ T5307] tun_get_user+0x2498/0x3d10 [ 82.236116][ T5307] ? tun_do_read+0x1f10/0x1f10 [ 82.240891][ T5307] ? __rcu_read_lock+0x50/0x50 [ 82.245651][ T5307] ? avc_has_extended_perms+0xb27/0x10d0 [ 82.251279][ T5307] ? __rcu_read_lock+0x50/0x50 [ 82.256041][ T5307] tun_chr_write_iter+0x134/0x1c0 [ 82.261059][ T5307] do_iter_readv_writev+0x5fa/0x890 [ 82.266239][ T5307] ? vfs_dedupe_file_range+0xa00/0xa00 [ 82.271698][ T5307] ? security_file_permission+0x157/0x350 [ 82.277419][ T5307] ? rw_verify_area+0x1c2/0x360 [ 82.282256][ T5307] do_iter_write+0x180/0x590 [ 82.286845][ T5307] ? do_writev+0x9e/0x560 [ 82.291163][ T5307] do_writev+0x2cd/0x560 [ 82.295386][ T5307] ? do_readv+0x400/0x400 [ 82.299797][ T5307] ? __kasan_check_read+0x11/0x20 [ 82.304923][ T5307] ? _copy_to_user+0x92/0xb0 [ 82.309517][ T5307] ? put_timespec64+0x106/0x150 [ 82.314379][ T5307] ? ktime_get_raw+0x130/0x130 [ 82.319139][ T5307] ? get_timespec64+0x1c0/0x1c0 [ 82.324004][ T5307] ? __kasan_check_read+0x11/0x20 [ 82.329030][ T5307] ? __ia32_sys_clock_settime+0x230/0x230 [ 82.334745][ T5307] __x64_sys_writev+0x7d/0x90 [ 82.339404][ T5307] do_syscall_64+0xc0/0x100 [ 82.344028][ T5307] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 82.349914][ T5307] RIP: 0033:0x45b271 [ 82.353801][ T5307] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b7 fb ff c3 48 83 ec 08 e8 fa 2c 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 43 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 82.373414][ T5307] RSP: 002b:00007f779f511ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 82.382025][ T5307] RAX: ffffffffffffffda RBX: 0000000020000576 RCX: 000000000045b271 [ 82.390007][ T5307] RDX: 0000000000000001 RSI: 00007f779f511c00 RDI: 00000000000000f0 [ 82.397992][ T5307] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 82.406044][ T5307] R10: 00007f779f5129d0 R11: 0000000000000293 R12: 00000000ffffffff [ 82.413999][ T5307] R13: 0000000000000b7c R14: 00000000004cc5e6 R15: 000000000075bf2c [ 82.421976][ T5307] [ 82.424289][ T5307] The buggy address belongs to the page: [ 82.429914][ T5307] page:ffffea000263c600 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 82.439006][ T5307] raw: 4000000000000000 ffffea000263c608 ffffea000263c608 0000000000000000 [ 82.447597][ T5307] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 82.456269][ T5307] page dumped because: kasan: bad access detected [ 82.462683][ T5307] [ 82.464994][ T5307] Memory state around the buggy address: [ 82.470603][ T5307] ffff888098f18680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 82.478658][ T5307] ffff888098f18700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 82.486717][ T5307] >ffff888098f18780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 82.494785][ T5307] ^ [ 82.502757][ T5307] ffff888098f18800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 82.510818][ T5307] ffff888098f18880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 82.518915][ T5307] ================================================================== [ 82.526972][ T5307] Disabling lock debugging due to kernel taint [ 82.535728][ T5307] ------------[ cut here ]------------ [ 82.541315][ T5307] Illegal XDP return value 4294967274, expect packet loss! [ 82.548612][ T5307] WARNING: CPU: 0 PID: 5307 at net/core/filter.c:6907 bpf_warn_invalid_xdp_action+0x5a/0x60 [ 82.558659][ T5307] Modules linked in: [ 82.562545][ T5307] CPU: 0 PID: 5307 Comm: syz-executor.0 Tainted: G B 5.4.19-syzkaller-00486-ga6e4656398da #0 [ 82.573977][ T5307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 82.584149][ T5307] RIP: 0010:bpf_warn_invalid_xdp_action+0x5a/0x60 [ 82.590553][ T5307] Code: e8 db 7b 5e fe 83 fb 04 48 c7 c0 eb 6d 56 84 48 c7 c6 f3 6d 56 84 48 0f 47 f0 48 c7 c7 be 6d 56 84 89 da 31 c0 e8 76 51 35 fe <0f> 0b eb bc 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 50 4c 89 [ 82.610667][ T5307] RSP: 0018:ffff888198f07668 EFLAGS: 00010246 [ 82.617035][ T5307] RAX: 358fa7bd010c6a00 RBX: 00000000ffffffea RCX: 0000000000040000 [ 82.624996][ T5307] RDX: ffffc90005998000 RSI: 000000000003fb9b RDI: 000000000003fb9c [ 82.632951][ T5307] RBP: ffff888198f07670 R08: ffffffff812d0560 R09: 0000000000000003 [ 82.640915][ T5307] R10: ffffed10331e0e39 R11: 0000000000000004 R12: dffffc0000000000 [ 82.649140][ T5307] R13: 00000000ffffffea R14: dffffc0000000000 R15: ffff8881c451a8c0 [ 82.657214][ T5307] FS: 00007f779f512700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000 [ 82.666126][ T5307] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 82.672834][ T5307] CR2: 0000000000b60004 CR3: 00000001c59d7006 CR4: 00000000001606f0 [ 82.680826][ T5307] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 82.688927][ T5307] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 82.696889][ T5307] Call Trace: [ 82.700176][ T5307] do_xdp_generic+0xd2d/0x1500 [ 82.704920][ T5307] ? generic_xdp_tx+0x4f0/0x4f0 [ 82.709888][ T5307] ? tun_get_user+0x3d10/0x3d10 [ 82.714722][ T5307] tun_get_user+0x2498/0x3d10 [ 82.719396][ T5307] ? tun_do_read+0x1f10/0x1f10 [ 82.724155][ T5307] ? __rcu_read_lock+0x50/0x50 [ 82.728913][ T5307] ? avc_has_extended_perms+0xb27/0x10d0 [ 82.734541][ T5307] ? __rcu_read_lock+0x50/0x50 [ 82.739299][ T5307] tun_chr_write_iter+0x134/0x1c0 [ 82.744308][ T5307] do_iter_readv_writev+0x5fa/0x890 [ 82.749502][ T5307] ? vfs_dedupe_file_range+0xa00/0xa00 [ 82.754954][ T5307] ? security_file_permission+0x157/0x350 [ 82.760666][ T5307] ? rw_verify_area+0x1c2/0x360 [ 82.765513][ T5307] do_iter_write+0x180/0x590 [ 82.770704][ T5307] ? do_writev+0x9e/0x560 [ 82.775038][ T5307] do_writev+0x2cd/0x560 [ 82.779273][ T5307] ? do_readv+0x400/0x400 [ 82.783592][ T5307] ? __kasan_check_read+0x11/0x20 [ 82.788715][ T5307] ? _copy_to_user+0x92/0xb0 [ 82.793321][ T5307] ? put_timespec64+0x106/0x150 [ 82.798161][ T5307] ? ktime_get_raw+0x130/0x130 [ 82.803023][ T5307] ? get_timespec64+0x1c0/0x1c0 [ 82.807867][ T5307] ? __kasan_check_read+0x11/0x20 [ 82.812885][ T5307] ? __ia32_sys_clock_settime+0x230/0x230 [ 82.818610][ T5307] __x64_sys_writev+0x7d/0x90 [ 82.823285][ T5307] do_syscall_64+0xc0/0x100 [ 82.827784][ T5307] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 82.833664][ T5307] RIP: 0033:0x45b271 [ 82.837546][ T5307] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b7 fb ff c3 48 83 ec 08 e8 fa 2c 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 43 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 82.857139][ T5307] RSP: 002b:00007f779f511ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 82.865823][ T5307] RAX: ffffffffffffffda RBX: 0000000020000576 RCX: 000000000045b271 [ 82.873808][ T5307] RDX: 0000000000000001 RSI: 00007f779f511c00 RDI: 00000000000000f0 [ 82.881769][ T5307] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 82.889820][ T5307] R10: 00007f779f5129d0 R11: 0000000000000293 R12: 00000000ffffffff [ 82.898147][ T5307] R13: 0000000000000b7c R14: 00000000004cc5e6 R15: 000000000075bf2c 20:02:36 executing program 0: syz_emit_ethernet(0xf6, &(0x7f0000000480)={@dev={[], 0x15}, @remote, @void, {@generic={0x86dd, "21c6b309615ef3d64d24eb3c8e5784c845531ec872034efb77cecb545602e9d6e48afe83882b8464e815aaf917bd56078fb4eae734dfb8e2ff28d24c40c7cafa1e6d559c33b12ac0d0d110152d578f0a96320a3b5da0a8289d9fefdc62f6ec5bab34041390f57cd38af09365f7f3b20db10705e2d70495bbb7146df865812902ae730b84e7fcf601fb0d97d96e3c5bf576c2de7f6b2f1d97bd6a6d68636ac36c33d58552402c343a96be1ce0dcbfb612c6034822a9fd9aa7f4de75ef2ffa99772730a92904d61dc8ec11ca4c8a31c89e5a236bfd7ea28ab07a794cea4e94facf41a7438e857a66a0"}}}, &(0x7f0000000580)={0x0, 0x2, [0x2e0, 0x780, 0x215, 0x2d0]}) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) symlink(&(0x7f0000000200)='./file0\x00', 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/net/tun\x00', 0x248c00, 0x0) fstat(r1, &(0x7f0000000400)) sched_setattr(r0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x12}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r2, 0x0) ftruncate(r2, 0x3) ioctl$BLKROTATIONAL(r2, 0x127e, &(0x7f00000005c0)) clock_gettime(0x0, &(0x7f00000000c0)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x6, 0x0, &(0x7f0000000000)={r3, r4+30000000}, &(0x7f0000000080)) r5 = gettid() write$cgroup_pid(r2, &(0x7f0000000600)=r0, 0x12) ptrace$setopts(0x4206, r5, 0x0, 0x0) r6 = syz_open_dev$evdev(&(0x7f0000000340)='/dev/input/event#\x00', 0xff, 0xac502) ioctl$EVIOCSKEYCODE_V2(r6, 0x40284504, &(0x7f0000000380)={0x20, 0x17, 0x6, 0x3, "c868157ccbeb7aaeb079c4b8502ecf6a70e722cf3a766ff1db6cefa19705f511"}) tkill(r5, 0x3c) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r5, 0x0, 0x0) timer_create(0x2, &(0x7f0000000140)={0x0, 0x3f, 0x4, @tid=r5}, &(0x7f0000000180)=0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) timer_settime(r7, 0x1, &(0x7f00000002c0)={{r8, r9+10000000}, {0x77359400}}, &(0x7f0000000300)) tkill(0x0, 0x1000000000016) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r10, 0x0) ftruncate(r10, 0x3) sendmsg$NFQNL_MSG_VERDICT_BATCH(r10, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB="5c1700000003b16900000000000000000a000008080003400100010000000000fffffffb0000000508000340000000000c000200fffffffd0000002709000000ffffffff0cfffd0a0000000c000200fffffffc000000a1"], 0x5c}, 0x1, 0x0, 0x0, 0x8044}, 0x8000) 20:02:36 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, 0x0) pipe(&(0x7f0000000000)) r4 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00') bind$unix(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@ipv4_newaddr={0x28, 0x14, 0x1, 0x0, 0x0, {}, [@IFA_ADDRESS={0x8, 0x8, @dev}, @IFA_ADDRESS={0x8, 0x4, @multicast2}]}, 0x28}}, 0x0) getpeername$packet(r4, &(0x7f0000000500)={0x11, 0x0, 0x0}, &(0x7f0000000540)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'batadv0\x00', r7}) sendmsg$TIPC_NL_BEARER_ENABLE(r2, 0x0, 0x4) remap_file_pages(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r9, 0x6611) fcntl$dupfd(r8, 0x0, r9) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r10) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket(0x11, 0x800000003, 0x0) bind(r12, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r12, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r14 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r14, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=r13, @ANYBLOB="000000000080000008000400", @ANYRES32=0x0, @ANYBLOB="b666aaff176d155d7808f7ceea5cca5337fbc83b1ff7fa2235cf2a0653f6bed4f044d5d946", @ANYRES32=0x0, @ANYBLOB="71f72dc582c032770b831acdf60c8b07e715e078b910a19847206ab656b86e65edcde638f0282e82f0e9be7cba054131c42d8379d5331cbd9ca325c3f8825f528dd688b02be30301ddf6f26793d4ca090fe252c684b62f36fa821b04b330a1410b751f2d61f7a14b5ca04ed86c0eb89b63d9b8d9d0f3b5c650635b002bd7343ee1d97f66735ce02661e8328c1f047c4af05fb7bf6979822456a0a33ddfc8437dbcf6ed6c5121b830c2b93f047e760ca13a4d10315bd3ab1374993dea10c568907a839231bfb813c9c1aba6a0380520e61588f26be99992"], 0x30}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@mpls_getnetconf={0x3c, 0x52, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r13}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x6}, @NETCONFA_IFINDEX={0x8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7fffffff}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8}]}, 0x3c}}, 0x21dbf90800faa7b6) pivot_root(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00') 20:02:36 executing program 5: r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000080)={0x2, 0x4, 0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x3c) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x6, 0x7, &(0x7f0000000000)=@framed={{}, [@func, @map={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x73000000}, @exit]}, &(0x7f0000f6bffb)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) ioctl$BLKFRASET(r1, 0x1264, &(0x7f0000000040)=0x6aab921c) [ 82.906124][ T5307] ---[ end trace 5e9e0542b4e7002f ]--- 20:02:36 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6f, 0x181046) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x301, 0x0, 0xf, 0x0, 0x0}) syz_mount_image$tmpfs(&(0x7f0000000000)='tmpfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYPTR]) 20:02:36 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f0000000100)='./file1\x00', 0x400000000010800, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010a0200027400f801", 0x17, 0xffd}], 0x0, &(0x7f0000000080)={[], [{@seclabel='seclabel'}, {@subj_role={'subj_role', 0x3d, '\x00'}}, {@audit='audit'}, {@fscontext={'fscontext', 0x3d, 'unconfined_u'}}, {@appraise='appraise'}]}) [ 83.028553][ T5324] BUG: unable to handle page fault for address: ffffed1018bec1ff [ 83.036309][ T5324] #PF: supervisor read access in kernel mode [ 83.042464][ T5324] #PF: error_code(0x0000) - not-present page [ 83.048434][ T5324] PGD 21fff7067 P4D 21fff7067 PUD 21fff6067 PMD 0 [ 83.055072][ T5324] Oops: 0000 [#1] PREEMPT SMP KASAN [ 83.060357][ T5324] CPU: 0 PID: 5324 Comm: syz-executor.0 Tainted: G B W 5.4.19-syzkaller-00486-ga6e4656398da #0 [ 83.071981][ T5324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 83.082057][ T5324] RIP: 0010:do_xdp_generic+0x603/0x1500 [ 83.087614][ T5324] Code: 00 00 00 00 fc ff df 42 80 3c 30 00 74 05 e8 f4 e4 95 fe 4c 89 a4 24 d8 00 00 00 4c 89 ac 24 18 01 00 00 4c 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 08 4c 89 ff e8 2e e4 95 fe 49 8b 37 83 e6 01 31 [ 83.107219][ T5324] RSP: 0018:ffff8881c6307680 EFLAGS: 00010a07 [ 83.113288][ T5324] RAX: 1ffff11018bec1ff RBX: ffff8881c6307788 RCX: 1ffff11038c60ef1 [ 83.121272][ T5324] RDX: ffff888193d50434 RSI: 00000000000000cb RDI: ffff8881c6307798 [ 83.129261][ T5324] RBP: ffff8881c6307830 R08: ffffffff82db065b R09: ffffed1038bea25d [ 83.137368][ T5324] R10: ffffed1038bea25d R11: 0000000000000000 R12: ffff8880c5f511f6 [ 83.145472][ T5324] R13: ffff8881c5f51000 R14: dffffc0000000000 R15: ffff8880c5f60fff [ 83.153466][ T5324] FS: 00007f779f512700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000 [ 83.162510][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.169185][ T5324] CR2: ffffed1018bec1ff CR3: 00000001d39fa001 CR4: 00000000001606f0 [ 83.177271][ T5324] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 83.185247][ T5324] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 83.193398][ T5324] Call Trace: [ 83.196706][ T5324] ? __kasan_check_write+0x14/0x20 [ 83.201825][ T5324] ? _copy_from_iter+0x886/0xaa0 [ 83.206769][ T5324] ? generic_xdp_tx+0x4f0/0x4f0 [ 83.211627][ T5324] ? tun_get_user+0x3d10/0x3d10 [ 83.216491][ T5324] tun_get_user+0x2498/0x3d10 [ 83.221179][ T5324] ? __kasan_check_read+0x11/0x20 [ 83.226210][ T5324] ? __perf_event_task_sched_in+0x4ed/0x550 [ 83.232125][ T5324] ? tun_do_read+0x1f10/0x1f10 [ 83.236892][ T5324] ? __kasan_check_read+0x11/0x20 [ 83.241921][ T5324] ? perf_pmu_sched_task+0x370/0x370 [ 83.247207][ T5324] ? __kasan_check_read+0x11/0x20 [ 83.252256][ T5324] ? __rcu_read_lock+0x50/0x50 [ 83.257027][ T5324] ? __schedule+0xea0/0x1700 [ 83.261762][ T5324] tun_chr_write_iter+0x134/0x1c0 [ 83.266797][ T5324] do_iter_readv_writev+0x5fa/0x890 [ 83.272609][ T5324] ? vfs_dedupe_file_range+0xa00/0xa00 [ 83.278077][ T5324] ? security_file_permission+0x157/0x350 [ 83.283806][ T5324] ? rw_verify_area+0x1c2/0x360 [ 83.288662][ T5324] do_iter_write+0x180/0x590 [ 83.293264][ T5324] ? do_writev+0x9e/0x560 [ 83.297732][ T5324] do_writev+0x2cd/0x560 [ 83.302107][ T5324] ? do_readv+0x400/0x400 [ 83.306438][ T5324] ? __kasan_check_read+0x11/0x20 [ 83.311466][ T5324] ? _copy_to_user+0x92/0xb0 [ 83.316056][ T5324] ? put_timespec64+0x106/0x150 [ 83.320906][ T5324] ? ktime_get_raw+0x130/0x130 [ 83.325676][ T5324] ? get_timespec64+0x1c0/0x1c0 [ 83.330534][ T5324] ? __kasan_check_read+0x11/0x20 [ 83.335597][ T5324] ? __ia32_sys_clock_settime+0x230/0x230 [ 83.341401][ T5324] __x64_sys_writev+0x7d/0x90 [ 83.346197][ T5324] do_syscall_64+0xc0/0x100 [ 83.350794][ T5324] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 83.356685][ T5324] RIP: 0033:0x45b271 [ 83.360580][ T5324] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b7 fb ff c3 48 83 ec 08 e8 fa 2c 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 43 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 83.380302][ T5324] RSP: 002b:00007f779f511ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 83.388741][ T5324] RAX: ffffffffffffffda RBX: 0000000020000576 RCX: 000000000045b271 [ 83.396712][ T5324] RDX: 0000000000000001 RSI: 00007f779f511c00 RDI: 00000000000000f0 [ 83.404697][ T5324] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 83.412695][ T5324] R10: 00007f779f5129d0 R11: 0000000000000293 R12: 00000000ffffffff [ 83.420671][ T5324] R13: 0000000000000b7c R14: 00000000004cc5e6 R15: 000000000075bf2c [ 83.428644][ T5324] Modules linked in: [ 83.432539][ T5324] CR2: ffffed1018bec1ff [ 83.436696][ T5324] ---[ end trace 5e9e0542b4e70030 ]--- [ 83.442157][ T5324] RIP: 0010:do_xdp_generic+0x603/0x1500 [ 83.447703][ T5324] Code: 00 00 00 00 fc ff df 42 80 3c 30 00 74 05 e8 f4 e4 95 fe 4c 89 a4 24 d8 00 00 00 4c 89 ac 24 18 01 00 00 4c 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 08 4c 89 ff e8 2e e4 95 fe 49 8b 37 83 e6 01 31 [ 83.467511][ T5324] RSP: 0018:ffff8881c6307680 EFLAGS: 00010a07 [ 83.473576][ T5324] RAX: 1ffff11018bec1ff RBX: ffff8881c6307788 RCX: 1ffff11038c60ef1 [ 83.481554][ T5324] RDX: ffff888193d50434 RSI: 00000000000000cb RDI: ffff8881c6307798 [ 83.489534][ T5324] RBP: ffff8881c6307830 R08: ffffffff82db065b R09: ffffed1038bea25d [ 83.497512][ T5324] R10: ffffed1038bea25d R11: 0000000000000000 R12: ffff8880c5f511f6 [ 83.505487][ T5324] R13: ffff8881c5f51000 R14: dffffc0000000000 R15: ffff8880c5f60fff [ 83.513551][ T5324] FS: 00007f779f512700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000 [ 83.522481][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.529170][ T5324] CR2: ffffed1018bec1ff CR3: 00000001d39fa001 CR4: 00000000001606f0 [ 83.537142][ T5324] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 83.545225][ T5324] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 83.554154][ T5324] Kernel panic - not syncing: Fatal exception in interrupt [ 83.562124][ T5324] Kernel Offset: disabled [ 83.566448][ T5324] Rebooting in 86400 seconds..