last executing test programs: 5.814268436s ago: executing program 1 (id=38): mkdir(&(0x7f0000000140)='./control\x00', 0x8) prctl$PR_MCE_KILL(0x21, 0x1, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1, 0x1, 0xa, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000002000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) r4 = dup(r1) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) prctl$PR_GET_SPECULATION_CTRL(0x22, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001868000000000000000000080000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000001800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./control\x00', 0x80, 0x80) linkat(r5, &(0x7f00000001c0)='./control\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./control\x00', 0x600) r6 = inotify_init1(0x0) inotify_add_watch(r6, &(0x7f0000000180)='./control\x00', 0xa4000960) r7 = inotify_init1(0x0) inotify_add_watch(r7, &(0x7f0000000000)='./control\x00', 0x40000000) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r9 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x54c, 0xce6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x2}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x20, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r9, 0x0, 0x0) syz_usb_control_io$hid(r9, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000001200)={0x0, 0x22, 0x2, {[@local=@item_012={0x1, 0x2, 0x0, '@'}]}}, 0x0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r8}, 0x10) rmdir(&(0x7f0000000100)='./control\x00') 3.346272102s ago: executing program 1 (id=87): creat(&(0x7f0000000000)='./file0\x00', 0x108) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006340)={0x2020}, 0x2020) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.197714343s ago: executing program 3 (id=94): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES64], 0x0) syz_usb_control_io(r0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) syz_usb_control_io(r0, &(0x7f0000000780)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0) ioctl$HIDIOCSREPORT(r1, 0xc018480b, &(0x7f0000000080)={0x2, 0x100}) 2.494036474s ago: executing program 1 (id=99): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x2, 0x7, 0x10, 0x7, 0x2, 0x0, 0x70bd28, 0x25dfdbfc}, 0x10}}, 0x4400c0b0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@broadcast, @in6=@loopback, 0x4e23, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xfffffffffffffffc, 0x8}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x4d2, 0x32}, 0x2, @in6=@private0, 0x0, 0x4}}, 0xe8) sendmmsg$inet6(r1, &(0x7f0000000a80)=[{{&(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}, {{&(0x7f0000000040)={0xa, 0x4e21, 0x0, @dev}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0xe00}}], 0x2, 0x0) 2.434547285s ago: executing program 1 (id=101): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'gretap0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14615, 0xa1}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}}, 0x4000) 2.326781676s ago: executing program 1 (id=106): ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000340)={{0x2, 0x4e23, @broadcast}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x30}}, 0xa, {0x2, 0x0, @broadcast}, 'lo\x00'}) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r1, &(0x7f00000008c0)=[{&(0x7f0000000580)='`', 0x1}], 0x1) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000080)=0x6, 0x26) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000000c0)=0x3f9, 0x4) recvmmsg(r0, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) 2.326416396s ago: executing program 1 (id=108): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = epoll_create(0x101) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, 0x0) socket(0x10, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x4000, 0x4) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) dup(r3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x6c}}, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r4 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f0002"], 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000001b80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000640)={{{@in=@multicast1, @in=@loopback, 0x100, 0x0, 0xfffe, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x2, 0x1ff, 0x0, 0xf, 0x0, 0x4, 0x1}, {0x1, 0x40000000, 0x0, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x1}, {{@in=@private=0xa010101, 0x0, 0x32}, 0x0, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5}}, 0xe8) sendmmsg$inet6(r5, &(0x7f0000000300), 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) 2.316798836s ago: executing program 0 (id=109): socketpair(0x29, 0x100000005, 0x0, &(0x7f0000000000)) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, &(0x7f00000001c0)=ANY=[@ANYRES32=r0]) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4048aecb, &(0x7f0000000000)) 2.295992176s ago: executing program 0 (id=110): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x3) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x42, &(0x7f00000002c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x65, 0x0, 0xf, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x2, 0xffff, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x10009, 0x52}]}}}}}}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000140)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0x0, 0x0, 0x1000}}}}}}, 0x0) 2.242921628s ago: executing program 0 (id=111): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000680)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x290) close_range(r0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="18000000000000000000000000000000181100", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 2.242514408s ago: executing program 0 (id=112): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="dc1000003e000701feffffff00000000017c00000800428004000800b810018006000600800a000038102080b3f5502e3f49bbd161b96d3e3f351635030c6a8e6ec97e54fe89e00c3d869057340f8b8470cf9c041092005610a059d34c8c220d1d0b4867978f622f795279382db86fed00b3a59a5e3118d0073db5696b61ed9bcc52b8eb3e5dca837128e3ee5157d166f323b6ba2fdc6f5489f4df0fb50854fca9adb67c0be007cc3b637559909adf81403d36acfc547b13deb8f100edb9eb828b7ea2bab9945fe24b60429ec2548b5c273d3c9b34977ad6765603a76996aa236dca3f15b09b6ffb85712c444ac49c50d1c5d740d7087c609e732a15d8455598825162b5b79c9391e89f40db3bf165bf4c0583aed81026b2d0fa7d7961cd97acca6d7a81f4af44781676718ac2c09a5c9266733928e1beebbaef4932337218d82aec9e8b039688c99ca844b48e0f2c70744eb7785c6a93c4d9849c1530d56c93c277b97bb31368635a6210217522dc0bcc3b03597ecdffd073653aba43676bca30c717d0e951b7871a4246404ff29718bd4fcb6d4753f5871d1c1cef0a04f205199137440c1d23c3d3d54e0f56d188e7d3b79019523bee9585a345f937295d7c9430fa2712520110d70a406a52053dfe026b6cf8e2327296d8f3af0a98af0313367c4f5c5fc6ef8d22d3325f2712f491ad8451cdc8d4258fe8b4013200d3f971bcbd9e0ec39df690d4dd5a43efa182f1fd8b9b563ecc67ed1e0ba845a2daca527bc363797a59b89b97a69d4895cff8f7360e1f61c05ed730d769ab57fedc4869a17e6d36f71181975233f3fdc3b20b02dfc55f20724636f566d381667a56926f3d4fad3aae32f87d3b8cb68afcbc48ddd3f8358343672196f6851e7864ccc790093c62b64ecffb3e192e369b73b1a5abff47fc1bdd53e02551999644c930ffd59f4da7ff7dd2d76556b99108aa03edd4bbae92f802ac7434642ca89a9b79dea5f31b1f28a9b56b67e7fedb73b2a6165e2f39ca58592a22084e8c74accb3fa10a51ba57aa56acb6e3bebce201626a16f637ed367f38cf1a798202e2e8687b0e9d3e63015daed0a161f25d0e91cce0543aaef26a9b623fb0d549c5dd47fddb230d709f4655ea9eafb24d61aa6a9a2d36f290b75e9810f5302ff29b4d07de40f265c17523d0fc305a5ca203aef61c9b2c1a2e78bf453e74721f0a7c48cb43194b8e53427b17bc06d71e94a7aebc58e015de75c1fd864ad5e5c877b80517579368124a4e792a3287e0380d6710e138fe2959f67c768a970cbab62e6361690e8c89d0989ed200b1651d7cce964e2454f6a0732457c5036a1097b1eaf2cfc2de1696af4b742a450b6a0fcf97754e1dbc7884abe0f7759ef5a985decc21b91eda1e714725470ab4a911b23d4b94ccc49f63585e591c289efe4b33d4ffdbabec06546f30886e31429d5c93ed4ed01139b9f063e255ce7d53999c662704375745bb2a5ce96aa81a7ced635088df89302f4d3ada2679dd9828885c3487a6fd6c431a9d416d6ee013be5e0082530225fa7519d2d1a0ea1343eca421bf4311a435afc9150ce9d7cd8783e2340547fc64c0386cc50b481aef98b9e324f3f62a3ced5097223391a1d93a78e003707d6f15019be64f8a9f206aaf3a880ab8b7a2b9bf0ebd8168cad864b36d9c18a30dea2161251c198e6996f7bf4446e75a844f4ffcc97be666dec2d1917335628dd33da07dcb7f26f36aa881f76dad2d010654b5edb2ea83088de742adc36ef1e79f0d03bd2dcf7fc9718f2263e7088a3703d6e1d996f49e38f7ab001ca571d5b0898d91e456f0f3292ade1a6634ef1290f81af76aacb2979656fe74f7260804044d26e0aa0aecd1888c22350074a70f6c9e145435fc6fef442be1d087eed43f40f34488fecfad3094785ba45f4c8e78790455e50d63f028700f03eb71f1bc4682b1a11f35028f1e50badc4168eac2930a4e0cdaabbd1490d37be86045835792d74158d4a7877ece14c34900714b6d10326318bd1ddfdcd9b54c15443aac6be3665bbb51afdbaaea9b964397a9f1e20f38ad8932eca43e67a8e2ac110e7b4b1e06ef2bfe0c54a991c4db9fc057dc481b2b058b43b7d45ee8393eb922ab2af58d660e6e659726b114ddff0a5ecd45d029a815026e6dcbb9594f61106122144d2506059925062e8c95125c4f710486b608869b7c5c54c26c87a3749e095f729fffe1276d681527243742764d7313edcf8ee3d16fdfff84295d19aed32ceaaa855a4db733e118d45fc74e9e48096f8639081340cff07405241d611ce78ce7fda92166c7d4661ec753540ac5de803e0a8e226d87e9f865f02cec07ba62f6be554d121bead73d09f9f8eeb64c588089cddf8c1a7d3fc418c124c03b82a45dbfd04bf0643488133236b2ad7aa05f5830dfce2a2678fff10178f0b6d37264ca1a8c26e75635124a6b596949afc2d244caf1a03e14302c184fa477dc2266b4da3837dfb9989a1b8ddf9e24e9875aa8695d3434ae4409c82d7455a719dfb564becc6a5e74369237639389e548c3e559cfa669fca8a9565596ee8214f373d42ee0e43ae944dbc43bf927d3e960f14bf696770ca0a00636dd5b1b00aa2dc42ab9fb3781deb72df0d42c0cce04f2cfa8d13714f234bc5d24990c780c7398bffa9e64afe05bea92a1d1b34665f84d473f364dc1d60f3a1980be3f13d05fe9ab083ad6a7470f92709367930351c2b57829f0636a6665bab0303e0d3979e83c1a971de06f5d0c207f5e053e94c5f2b939962704a94d49c4f4b9199676235e22bd7d8bd149ed2551dcc79834f391964070afb4ccb4dc1f3035630fbd077fe93cc5982217c8228477806c05d4a0cd728ca06b672625a648111db157386cbb78da359c9fe216c8179b09ff5a77091e3f42b0224d0eb0ae7a9722bfc42308d2f08d2b6ff6684bf1870398d55462eb9713d9ce139585bd2d55144a6708f3ce86bc239eab6ea1c06c9a06af749b7581cd14882dcf89874108aa86cd305f41f8c6285454df09f34c61183bc1f7499f3a05a185f40e6ba3eb65e9e1850efe2676b2ec9cc2e64996bf60d6f16287e9d4663808a260f87c4dc377d6f263df7266182caedb644c56da0ef0c0b271e31256e1994037db62a18d66a96620604f4e7a43b8e353d520230e01536faf8cc920385eca7769e89bfecadbd71093d8c5c0fd25207d9efbd3a6722202ee3b1a0da019b7006da0891d18abe4a8af9ef4bf311d95c48ead0f44c826f67096ad46a6c48a6f1f69f27a95f5cfc2e4f23e1408f15ceff9d413b514ed679bd695d0cc340a2f7d711ba050fdb4c159eb309b34c4eea3066373354083edcebd9ce7edae65f4e792f26f447d4615cbd5f51ade0f77a210ca29e6f33d928d55f1a07ce0180494f3cbdd0feb39aeaeb05d480ac291178d37224ff8155922ef50ddd4a9c4a6c10726fa6012dee7b87cc0a25f01dc273fe205d41166cccd1af4b3cfa12f03e3380c7f351d1f7d8435836acc43ac1ed60bf08a635431ff317ac6506dc293f8c2320294df3c062a930c6de4e5118d89304b093308bdb422722371a612ea6a80273f59c34ee7d5f5c8eb3711d888bc9f6b591ada92a03d8738a7fe8709f1c82efdfafdc5e3887ec744374872743f358b66603c3badce42267006663fbde835ce05ac3ce4ed863a45c269e1a244ba07cb34dcf212ae67aee03873157ce4de62b10839988e7178ef13a1a7a9137406ae049f069e61a30ac9a5e01c292b93ec9124de6aefab2e0a6b96168ba03e036c379ea0dd289cc5bb6b3a5a3016f9a2e44ca297e57978ce3528c728efa8ac7d33e8f32caeb4d5acb683b08955593d2c3c66b151c3b564d2e89a949c56a136bc7a28fd34427a04455e71735c8e29cfcce47e6e1520ab2b8f05da260e9c1db2b657a31907c0587947ccd8c811dca22d45bc02f010191f706c105f151bee70351ee8ddce609aa672effdc339421ec64501993b2e837daffc73d3d718eada3465317012287d4b75417dc6db53e7674549c5e4eec25486989a0625372ac26fd04217cd7b0d93c6aa62046b25361969db04a433f622d8d5f5a9121c0737fe511ff924937c577039572e53ff26ff5769cea0830bb3f5aa64900e800cfd473ad6eceb0f852aa52ccfc6dfa5031d21ab04f23b15983c04d2aa0da50de15cbb380ef270e4d280806786897fdc426b694a16bd664965219759209646c81cfa01f79f202f33471b7628f3d47f8db9dcd7262aab93d6385a4001c83645e25449ab220b3e8618d6a70f85a357cd7a881a3449fdecfa86601c49da0ee652d95aaac0808e9c458d46982a30f21ff381d2dd2c2f10a240d64decc0066c19dc8f0e7b476fc5899388adb7123973081351a5d20892b12aa227c568d45b80e0557d83f16e5f554c2b5a536d1f0d5ebaa158bb47a94d3415e22c814ea34dec89f949da60ed22507ab48c61d2617bf2af88494fa440defdd928ebecc27a516efe3bb6d1c66a369fdc43dfb9961a55e79f3edcc2336e4ea115a9d34453305269b4b465e049df8a8ca637f61c6371e0c5bdbc0cbcc2942f4d8bd74e478388b90015faf8cb560d10f429326cf869c09ef881395195c1db1e20cab41cc46bfae1189f0289f94ff363c768afff0ed7fb1e2a65fb014e8fa4dc3805e06b64783ef5fe1c2603a34f4323f2a96a2d6f5448f88fe493095c0b3416dacbc981f4f7e9ede557f1dc1b667a82d1475ebaff4b200381715f3a0082d8d598955678071bcc32e49e97182bcbe0a4af63e1f9cbde7095b3f92721554c024b018392e75d447d382cce26b2b7d06398be6934cb094fae3df45f79f60d14a30ce8967b4dc79056df2bee235b20678e1a13620a99fe1540c5c7b07c029225aed27ce9a227ce7beba1ee82a66314edf5dd1ee32c774f52e7f6fccbb81f8b16624966914b6aed3f3c46d56ecfd814f4c0e54e47af6bcb9ef4c2112e68fa1ecbad76df94ad3d20ed14242f0602464fddfcb10a0bda39466a98caa7f74406a61afbf756037d473c12aaa62bd073dd5e0ac7b3cea8e9b3ece5dfc57f7ef8686e0c995ae058f3cf4e06ad698ed6acaf035d02d3370aff119d6a20ddc164e4aab9f38da52e641e9615404de939c753b383aca4e3141fae2c1f17a17089b21920325f15de91aae9411515b97e7b06d281cb16cd90e74610d880877470572050f990e400733afe4082b7ca561a56d0ee8871548369957c1f2904d9cac9e73f3fc82e28fa4045b58acf02d371c1a51c2dfff30184031fa744f594ed88495c8fda61abbe3a29f20110adc5f3a0d480f61593807839b3c31b1dad3d4fbb2ef55eb71e7d54d3bebe77339c2d45f063c14ce53ac089014d53227467d43a43fbc36de3c57abd2b9ec6b4df1e8d77bc017e5c5d255086a5889e8df99aabadf26f63e7dc2f9ff239153ea6f73137759fdfda7976c3be7b1d8e8413c5eb390fa5a6ebc7284271df7b229deb26c37c984b387cc4eeddfaac57540edd642c6e115e774e35c9a2432888dde8f48a13a55e0d9f8cafb5bc6f76820787fcd859965e0d49630f0f2f8dff2ca75cb1c805d06a7559c749fd6c600a67d1ba99b93fcdd8cdd88bb50aef0a4a2a1cfeebf42645d10baf687f576a940fcdaaa326ae55ae726824bacd3d834bf64c8687b18fa13a1126b518824191320e56f99226cc1afd73309433f9ed22a72384224a3f68e53d932ee71d18b9d8860b6ee621c91031b26e0bb7133d4f775f6f5c7d37f54943e2c0dc317d6ad1f7b26f9a4a82f32b2f71756db9cc377be83bb2cf0b19e9f8e7dae8f3c8dd33c0f12360d8875cee11c2cf2b37b00e4273948e6cf2fc233150e5d84d33d4aced0e77206e90862e77246d2d1562f32fc1cb94f7f6a3ad578b25a03e18b78947c11227ac0bdb5786d2a876f885238cd063607acc276044c77300c880f14737bdabf4b65fedb09536d82fce7f1ac1069fdf698e9baf2d3e3bad18133ee6419561819f8acaa9ed5f548d68c46a67f0e42b8d4f0999198734cd978a1029ae827ed6687cd175338291f8d2a883e4548e876421815f762b8c1a9e6a696dbf075d16265de1e801804bb49bab981200080002"], 0x10dc}, 0x1, 0x0, 0x0, 0x4000c000}, 0xc000) 2.242388677s ago: executing program 0 (id=113): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x1}, 0x80000000}, {{0x0, 0x0, &(0x7f0000003c80)=[{&(0x7f0000000340)=""/248, 0xf8}, {&(0x7f0000000500)=""/162, 0xa2}, {&(0x7f00000005c0)=""/129, 0x81}, {&(0x7f0000000680)=""/169, 0xa9}, {&(0x7f0000000740)=""/97, 0x61}, {&(0x7f0000002200)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/33, 0x21}], 0x7}, 0x9}, {{0x0, 0x0, 0x0}, 0xe}], 0x4, 0x2020, 0x0) 1.422470239s ago: executing program 0 (id=126): syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r0, 0xffffffffffffffff, 0x0) 1.074975684s ago: executing program 4 (id=136): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0xbfa35000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 919.639217ms ago: executing program 4 (id=140): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2b64ba39c481d4ee) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x4) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x80101) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10) chroot(&(0x7f0000000780)='./file0\x00') umount2(&(0x7f0000000500)='./file0\x00', 0x1) 919.464537ms ago: executing program 4 (id=141): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={@dev={0xfe, 0x80, '\x00', 0x40}, @remote, @remote, 0x3, 0x2, 0x5, 0x400, 0xb7, 0x2080001, r2}) syz_emit_ethernet(0x82, &(0x7f0000000040)={@link_local, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x48, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @private2, [@hopopts={0x3a, 0x1, '\x00', [@calipso={0x7, 0x8, {0x0, 0x0, 0x0, 0x80}}]}]}}}}}}}, 0x0) 919.306557ms ago: executing program 2 (id=142): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000180)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x50}, {0x6}]}, 0x10) syz_emit_ethernet(0x26a, &(0x7f0000000200)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa0086dd60003a0402343a"], 0x0) 919.134766ms ago: executing program 4 (id=143): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x703, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x54, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x28, 0x3, 0x0, 0x1, [{0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x18, 0xb, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd8}}, 0x0) 918.811846ms ago: executing program 2 (id=144): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendto$packet(r0, &(0x7f0000000080)='?', 0x1, 0x4048011, &(0x7f0000000540)={0xc9, 0xf5, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 872.959737ms ago: executing program 2 (id=145): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001080)={0xffffffffffffffff}) writev(r0, &(0x7f0000001600)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9) 872.569127ms ago: executing program 4 (id=146): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000d40)="b1f56ee29c433328d3b2a83bd97e37007087acae7568edff43ed556d76770122635aea1dc48755381c71590cd542e796cc2669e2af442a03760c5cdfc691b3da35ad6a8d2ef9c2baa53a8dec36a2e434d46e643a1277b1dd932f3ef2cf46c257d6a19523b8b789ef34b46e461725b5e437323385b88c368f8bb5b933aa9169f5f7b51dd5319b8016623d1863d70581691a79a6678db1e5e7fa1c98c5b9e4a87272e9c4a1bd98dbb2ab76919ba5c1020e80bd0659e82d861dc6fe4c62639134c504aa438689", 0xc5}], 0x1}}], 0x1, 0xc0) sendto$inet(r0, &(0x7f00000012c0)="09268a927f1f6588b967481241ba7860fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0x20c8, 0x11, 0x0, 0x27) 872.456837ms ago: executing program 2 (id=147): socketpair$unix(0x1, 0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@ipv4_delroute={0x40, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @private=0xa010102}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @LWTUNNEL_IP_TTL={0x5, 0x4, 0xe}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x6}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 872.393817ms ago: executing program 2 (id=148): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002f40)=ANY=[@ANYBLOB="500000001000370400"/20, @ANYRES32=r0, @ANYBLOB="8b04040000000000300012800b00010065727370616e0000200002800400120006001800000800000500160002000000050017"], 0x50}, 0x1, 0x0, 0x0, 0x840}, 0x40000) 872.200417ms ago: executing program 2 (id=149): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) pselect6(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xa}, 0x0, &(0x7f0000000100)={0x8}, 0x0, 0x0) listen(r0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) connect$unix(r1, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 155.124278ms ago: executing program 3 (id=150): mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x0, &(0x7f0000000000)) 154.387938ms ago: executing program 3 (id=151): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x30, 0x10, 0x801, 0xfffffffd, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x8, 0x1a, 0x0, 0x1, [@AF_INET6={0x4, 0x2d}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x44000}, 0x0) 3.36837ms ago: executing program 3 (id=152): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fc010000190001000000000000000000fc0200000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000ffffffffffffffff0001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000044010500ac1414bb000000000000000000000000000000006c0000000000000000000000000000000000ffff7f0000010000000000000000000000000000000000000000fc0200000000000000000000000000000000000032"], 0x1fc}, 0x1, 0x0, 0x0, 0x5593ee2f0bddd481}, 0x0) 1.85698ms ago: executing program 3 (id=153): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x1e, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000004c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xf001}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000140)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0180f2", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x3}}}}}}}, 0x0) 804.11µs ago: executing program 3 (id=154): pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet6(0x10, 0x3, 0x0) read(r3, &(0x7f0000000340)=""/254, 0xfe) sendto$inet6(r3, &(0x7f0000000140)="1ba0000016001d0d89fdc5cbdd045798707bed4dca141a780f0f8e", 0xff3b, 0x0, 0x0, 0x0) recvfrom$inet6(r3, &(0x7f0000000000)=""/45, 0x44, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000000)="48050000150019", 0x7}], 0x1) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x200000000622c, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'ovf\x00', 0x28, 0x40085, 0x13}, 0x2c) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, 0x0, 0x0) setsockopt$inet6_int(r4, 0x29, 0x3, &(0x7f0000004240)=0x40000006, 0x4) recvmmsg(r4, &(0x7f0000003180)=[{{&(0x7f0000000080)=@l2tp={0x2, 0x0, @dev}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000000100)=""/40, 0x28}, {&(0x7f0000000140)=""/36, 0x24}, {&(0x7f0000000180)=""/144, 0x90}], 0x4, &(0x7f0000001340)=""/207, 0xcf}, 0xc57c}, {{&(0x7f0000000280)=@ieee802154, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)=""/234, 0xea}], 0x1}, 0x7}, {{&(0x7f0000001680)=@un=@abs, 0x80, &(0x7f00000018c0)=[{&(0x7f0000001700)=""/139, 0x8b}, {&(0x7f00000017c0)=""/14, 0xe}, {&(0x7f0000003300)=""/168, 0xa8}], 0x3, &(0x7f0000001900)=""/23, 0x17}, 0xb}, {{&(0x7f0000001940)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, 0x0, 0x0, &(0x7f0000001b80)=""/131, 0x83}, 0x3}, {{&(0x7f0000001c40)=@l2tp6={0xa, 0x0, 0x0, @mcast2}, 0x80, 0x0, 0x0, &(0x7f0000002f00)=""/139, 0x8b}, 0xdc}, {{0x0, 0x0, &(0x7f0000003040), 0x0, &(0x7f0000003080)=""/234, 0xea}}], 0x6, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000d190000f1000000000000063000000000000009500050000000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xba, &(0x7f000000cf3d)=""/186, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x8, &(0x7f0000000000)=0x7f, 0x4) 0s ago: executing program 4 (id=155): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xe}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x9, 0x5, 0x80000001}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xe}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x9, 0x3, 0x80000001}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.10.6' (ED25519) to the list of known hosts. [ 18.639798][ T24] audit: type=1400 audit(1747009033.570:80): avc: denied { mounton } for pid=260 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.640846][ T260] cgroup: Unknown subsys name 'net' [ 18.643306][ T24] audit: type=1400 audit(1747009033.570:81): avc: denied { mount } for pid=260 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.648395][ T24] audit: type=1400 audit(1747009033.570:82): avc: denied { unmount } for pid=260 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.648544][ T260] cgroup: Unknown subsys name 'devices' [ 18.651898][ T24] audit: type=1400 audit(1747009033.590:83): avc: denied { read } for pid=76 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 18.741083][ T260] cgroup: Unknown subsys name 'hugetlb' [ 18.746749][ T260] cgroup: Unknown subsys name 'rlimit' [ 19.005814][ T24] audit: type=1400 audit(1747009033.930:84): avc: denied { setattr } for pid=260 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.029083][ T24] audit: type=1400 audit(1747009033.930:85): avc: denied { mounton } for pid=260 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.053855][ T24] audit: type=1400 audit(1747009033.930:86): avc: denied { mount } for pid=260 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.078185][ T262] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 19.087031][ T24] audit: type=1400 audit(1747009034.010:87): avc: denied { relabelto } for pid=262 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.112449][ T260] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.112521][ T24] audit: type=1400 audit(1747009034.010:88): avc: denied { write } for pid=262 comm="mkswap" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.146855][ T24] audit: type=1400 audit(1747009034.040:89): avc: denied { read } for pid=260 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.300624][ T268] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.307659][ T268] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.315087][ T268] device bridge_slave_0 entered promiscuous mode [ 20.322567][ T268] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.329591][ T268] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.336865][ T268] device bridge_slave_1 entered promiscuous mode [ 20.346806][ T270] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.353896][ T270] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.361234][ T270] device bridge_slave_0 entered promiscuous mode [ 20.368708][ T270] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.375863][ T270] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.383250][ T270] device bridge_slave_1 entered promiscuous mode [ 20.420809][ T269] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.427832][ T269] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.435260][ T269] device bridge_slave_0 entered promiscuous mode [ 20.443877][ T269] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.450926][ T269] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.458210][ T269] device bridge_slave_1 entered promiscuous mode [ 20.478739][ T271] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.485830][ T271] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.493438][ T271] device bridge_slave_0 entered promiscuous mode [ 20.502022][ T271] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.509060][ T271] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.516313][ T271] device bridge_slave_1 entered promiscuous mode [ 20.614552][ T272] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.621692][ T272] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.628987][ T272] device bridge_slave_0 entered promiscuous mode [ 20.637914][ T272] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.645097][ T272] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.652486][ T272] device bridge_slave_1 entered promiscuous mode [ 20.677587][ T270] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.684626][ T270] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.691892][ T270] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.698898][ T270] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.738443][ T269] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.745485][ T269] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.752741][ T269] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.759756][ T269] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.768046][ T268] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.775069][ T268] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.782310][ T268] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.789330][ T268] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.803436][ T272] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.810471][ T272] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.817714][ T272] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.824745][ T272] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.834559][ T271] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.841595][ T271] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.848801][ T271] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.855813][ T271] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.891074][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.898270][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.905821][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.913624][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.920865][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.927968][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.935158][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.942301][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.950091][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.957502][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.964687][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.979654][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.987047][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.994514][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.002735][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.009760][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.017324][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.025457][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.032466][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.060325][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.068150][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.076170][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.083554][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.090920][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.098976][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.105993][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.113628][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.121787][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.128781][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.136139][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.144265][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.151282][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.158557][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.166669][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.173679][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.180976][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.189085][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.196102][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.203493][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.211721][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.218715][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.226007][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.233949][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.245267][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.262225][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.271040][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.279508][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.286513][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.294015][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.302187][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.310309][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.317310][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.324636][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.339285][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.347282][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.355261][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.363408][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.380738][ T269] device veth0_vlan entered promiscuous mode [ 21.387371][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.395669][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.404144][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.412518][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.420720][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.428081][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.439633][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.447910][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.456282][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.464863][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.475773][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.484223][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.495954][ T272] device veth0_vlan entered promiscuous mode [ 21.506185][ T270] device veth0_vlan entered promiscuous mode [ 21.512647][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.520780][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.528665][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.536679][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.544850][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.552441][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.559812][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.567092][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.576653][ T268] device veth0_vlan entered promiscuous mode [ 21.586242][ T272] device veth1_macvtap entered promiscuous mode [ 21.592923][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.600973][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.608844][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.617389][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.625730][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.633588][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.641245][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.659619][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.667910][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.676161][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.684612][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.692945][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.701116][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.708979][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.717451][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.725735][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.734027][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.743675][ T270] device veth1_macvtap entered promiscuous mode [ 21.755173][ T268] device veth1_macvtap entered promiscuous mode [ 21.761964][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.769596][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.777634][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.785939][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.794103][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.802171][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.810812][ T269] device veth1_macvtap entered promiscuous mode [ 21.821411][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.828999][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.837324][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.848209][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.856503][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.871975][ T272] request_module fs-gadgetfs succeeded, but still no fs? [ 21.882335][ T272] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.895243][ T271] device veth0_vlan entered promiscuous mode [ 21.904296][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.912637][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.921105][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.929502][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.937679][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.946120][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.954554][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.962797][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.984860][ T271] device veth1_macvtap entered promiscuous mode [ 21.997600][ T293] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 22.008698][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.016664][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.024558][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.033713][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.042264][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.051035][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.069385][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.099372][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.107515][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.135367][ T111] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.146166][ T111] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.159397][ T111] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.168091][ T111] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.179962][ T304] EXT4-fs error (device loop0): ext4_orphan_get:1395: inode #15: comm syz.0.1: casefold flag without casefold feature [ 22.226702][ T304] EXT4-fs error (device loop0): ext4_orphan_get:1400: comm syz.0.1: couldn't read orphan inode 15 (err -117) [ 22.239191][ T304] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 22.263077][ T289] syzkaller0: tun_net_xmit 76 [ 22.269227][ T289] syzkaller0: tun_net_xmit 48 [ 22.277132][ T319] netlink: 'syz.3.4': attribute type 4 has an invalid length. [ 22.289138][ C0] syzkaller0: tun_net_xmit 76 [ 22.296209][ T319] netlink: 'syz.3.4': attribute type 4 has an invalid length. [ 22.306921][ T316] EXT4-fs (loop1): Ignoring removed bh option [ 22.309091][ C0] syzkaller0: tun_net_xmit 76 [ 22.325338][ T316] EXT4-fs error (device loop1): __ext4_iget:5007: inode #15: block 1803188595: comm syz.1.6: invalid block [ 22.337099][ T316] EXT4-fs error (device loop1): ext4_orphan_get:1400: comm syz.1.6: couldn't read orphan inode 15 (err -117) [ 22.348933][ T316] EXT4-fs (loop1): mounted filesystem without journal. Opts: jqfmt=vfsold,resgid=0x000000000000ee00,bh,noload,abort,usrjquota=,,errors=continue [ 22.398556][ T314] EXT4-fs (loop4): dax option not supported [ 22.489110][ C0] syzkaller0: tun_net_xmit 76 [ 22.549732][ T314] ====================================================== [ 22.549732][ T314] WARNING: the mand mount option is being deprecated and [ 22.549732][ T314] will be removed in v5.15! [ 22.549732][ T314] ====================================================== [ 22.575890][ T314] exfat: Deprecated parameter 'namecase' [ 22.638613][ T334] exFAT-fs (loop2): failed to load upcase table (idx : 0x00011bf5, chksum : 0xcea91b8a, utbl_chksum : 0xe619d30d) [ 22.656257][ T342] syz.0.12 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 22.661115][ T334] exFAT-fs (loop2): bogus allocation bitmap size(need : 2, cur : 17179869186) [ 22.667963][ T314] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xe3f33698, utbl_chksum : 0xe619d30d) [ 23.174540][ T344] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 23.187680][ T344] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 23.326708][ T352] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables [ 23.342134][ T344] EXT4-fs (loop1): 1 truncate cleaned up [ 23.347808][ T344] EXT4-fs (loop1): mounted filesystem without journal. Opts: noauto_da_alloc,errors=remount-ro, [ 23.507494][ T352] xt_CT: You must specify a L4 protocol and not use inversions on it [ 23.649238][ T24] kauditd_printk_skb: 87 callbacks suppressed [ 23.649250][ T24] audit: type=1326 audit(1747009038.540:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=350 comm="syz.2.14" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7686142969 code=0x7ffc0000 [ 23.719222][ T24] audit: type=1326 audit(1747009038.540:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=350 comm="syz.2.14" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7686142969 code=0x7ffc0000 [ 23.751978][ T24] audit: type=1326 audit(1747009038.540:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=350 comm="syz.2.14" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f7686142969 code=0x7ffc0000 [ 23.809114][ T24] audit: type=1326 audit(1747009038.580:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=350 comm="syz.2.14" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7686142969 code=0x7ffc0000 [ 23.858379][ T24] audit: type=1326 audit(1747009038.580:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=350 comm="syz.2.14" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7686142969 code=0x7ffc0000 [ 23.883086][ T24] audit: type=1326 audit(1747009038.700:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=350 comm="syz.2.14" exe="/root/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7f7686142969 code=0x7ffc0000 [ 23.906429][ T24] audit: type=1400 audit(1747009038.770:183): avc: denied { create } for pid=350 comm="syz.2.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 23.927257][ T24] audit: type=1400 audit(1747009038.770:184): avc: denied { setopt } for pid=350 comm="syz.2.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 23.956408][ T24] audit: type=1400 audit(1747009038.770:185): avc: denied { write } for pid=350 comm="syz.2.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 23.976667][ T24] audit: type=1400 audit(1747009038.770:186): avc: denied { nlmsg_write } for pid=350 comm="syz.2.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 24.001725][ T353] EXT4-fs (loop0): 1 orphan inode deleted [ 24.007484][ T353] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 24.017003][ T353] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 24.447964][ T399] netlink: 96 bytes leftover after parsing attributes in process `syz.4.25'. [ 24.536101][ T396] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpjquota=,stripe=0x0000000000000002,,errors=continue [ 24.548335][ T396] ext4 filesystem being mounted at /5/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 24.728402][ T403] erofs: Unknown parameter 'ÿÿÿÿÿÿ01777777777777777777777ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ' [ 24.740007][ T399] FAT-fs (loop4): Directory bread(block 64) failed [ 24.746592][ T399] FAT-fs (loop4): Directory bread(block 65) failed [ 24.753209][ T399] FAT-fs (loop4): Directory bread(block 66) failed [ 24.759765][ T399] FAT-fs (loop4): Directory bread(block 67) failed [ 24.766273][ T399] FAT-fs (loop4): Directory bread(block 68) failed [ 24.775122][ T399] FAT-fs (loop4): Directory bread(block 69) failed [ 24.781787][ T399] FAT-fs (loop4): Directory bread(block 70) failed [ 24.788369][ T399] FAT-fs (loop4): Directory bread(block 71) failed [ 24.795064][ T399] FAT-fs (loop4): Directory bread(block 72) failed [ 24.803145][ T399] FAT-fs (loop4): Directory bread(block 73) failed [ 24.813981][ T385] F2FS-fs (loop1): invalid crc value [ 24.820966][ T385] F2FS-fs (loop1): Found nat_bits in checkpoint [ 24.856296][ T385] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 24.865526][ T385] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.882226][ T383] attempt to access beyond end of device [ 24.882226][ T383] loop1: rw=2049, want=45104, limit=40427 [ 25.158858][ T270] attempt to access beyond end of device [ 25.158858][ T270] loop1: rw=2049, want=45112, limit=40427 [ 25.178837][ T416] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=416 comm=syz.2.26 [ 25.192687][ T416] netlink: 24 bytes leftover after parsing attributes in process `syz.2.26'. [ 25.243134][ T418] netlink: 4 bytes leftover after parsing attributes in process `syz.4.28'. [ 25.280090][ T420] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=420 comm=syz.3.29 [ 25.450350][ T416] EXT4-fs (loop2): Test dummy encryption mode enabled [ 25.522777][ T416] EXT4-fs error (device loop2): ext4_fill_super:4955: inode #2: comm syz.2.26: casefold flag without casefold feature [ 25.557001][ T416] EXT4-fs (loop2): get root inode failed [ 25.563165][ T416] EXT4-fs (loop2): mount failed [ 26.371578][ T434] netlink: 96 bytes leftover after parsing attributes in process `syz.4.32'. [ 26.425148][ T443] EXT4-fs (loop3): Ignoring removed nomblk_io_submit option [ 26.480421][ T443] EXT4-fs (loop3): Mount option "data_err=ignore" incompatible with ext2 [ 26.700451][ T416] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 26.961081][ T456] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 26.968935][ T456] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 26.978245][ T456] F2FS-fs (loop0): invalid crc value [ 27.004125][ T456] F2FS-fs (loop0): Found nat_bits in checkpoint [ 27.081284][ T456] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 27.091148][ T456] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 27.115027][ T456] netlink: 44 bytes leftover after parsing attributes in process `syz.0.35'. [ 27.421746][ T15] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.429973][ T482] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpjquota=,stripe=0x0000000000000002,,errors=continue [ 27.448178][ T482] ext4 filesystem being mounted at /10/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 27.502538][ T473] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 27.515347][ T473] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 27.524445][ T473] F2FS-fs (loop3): invalid crc value [ 27.568530][ T493] capability: warning: `syz.0.42' uses deprecated v2 capabilities in a way that may be insecure [ 27.570088][ T473] F2FS-fs (loop3): Found nat_bits in checkpoint [ 27.613637][ T473] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 27.616897][ T499] x_tables: ip6_tables: tcp match: only valid for protocol 6 [ 27.620953][ T473] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 27.685332][ T499] EXT4-fs (loop0): Ignoring removed orlov option [ 27.692358][ T499] EXT4-fs (loop0): Ignoring removed nomblk_io_submit option [ 27.776407][ T499] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,bsddf,sysvgroups,norecovery,debug_want_extra_isize=0x0000000000000080,orlov,nogrpid,noauto_da_alloc,nomblk_io_submit,,errors=continue [ 27.909085][ T15] usb 2-1: Using ep0 maxpacket: 16 [ 28.039153][ T15] usb 2-1: config 0 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 32, changing to 9 [ 28.052999][ T15] usb 2-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.069583][ T15] usb 2-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 28.082806][ T15] usb 2-1: config 0 interface 0 has no altsetting 0 [ 28.089828][ T15] usb 2-1: New USB device found, idVendor=054c, idProduct=0ce6, bcdDevice= 0.00 [ 28.100258][ T15] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.108968][ T15] usb 2-1: config 0 descriptor?? [ 28.590787][ T15] playstation 0003:054C:0CE6.0001: hidraw0: USB HID v0.00 Device [HID 054c:0ce6] on usb-dummy_hcd.1-1/input0 [ 28.739079][ T5] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 28.809111][ T15] playstation 0003:054C:0CE6.0001: Failed to retrieve feature with reportID 9: -71 [ 28.818462][ T15] playstation 0003:054C:0CE6.0001: Failed to retrieve DualSense pairing info: -71 [ 28.827781][ T15] playstation 0003:054C:0CE6.0001: Failed to get MAC address from DualSense [ 28.836497][ T15] playstation 0003:054C:0CE6.0001: Failed to create dualsense. [ 28.844972][ T15] playstation: probe of 0003:054C:0CE6.0001 failed with error -71 [ 28.854371][ T15] usb 2-1: USB disconnect, device number 2 [ 29.017924][ T24] kauditd_printk_skb: 64 callbacks suppressed [ 29.017937][ T24] audit: type=1400 audit(1747009043.940:251): avc: denied { write } for pid=571 comm="syz.3.71" name="ip6_flowlabel" dev="proc" ino=4026532461 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 29.081523][ T580] netlink: 'syz.2.75': attribute type 11 has an invalid length. [ 29.099161][ T5] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 29.113663][ T5] usb 1-1: config 0 has no interface number 0 [ 29.124476][ T5] usb 1-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 29.136308][ T24] audit: type=1400 audit(1747009044.060:252): avc: denied { read } for pid=585 comm="syz.2.79" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 29.156322][ T5] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 29.167251][ T5] usb 1-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 29.178340][ T5] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 29.199170][ T5] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 29.218214][ T5] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.231078][ T24] audit: type=1400 audit(1747009044.160:253): avc: denied { audit_write } for pid=594 comm="syz.2.82" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 29.254257][ T5] usb 1-1: config 0 descriptor?? [ 29.259987][ T24] audit: type=1107 audit(1747009044.180:254): pid=594 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 29.279134][ T561] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 29.292205][ T561] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 29.314762][ T24] audit: type=1400 audit(1747009044.180:255): avc: denied { read } for pid=594 comm="syz.2.82" name="usbmon0" dev="devtmpfs" ino=154 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 29.342317][ T24] audit: type=1400 audit(1747009044.180:256): avc: denied { open } for pid=594 comm="syz.2.82" path="/dev/usbmon0" dev="devtmpfs" ino=154 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 29.366136][ T24] audit: type=1400 audit(1747009044.180:257): avc: denied { write } for pid=594 comm="syz.2.82" name="event2" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 29.389407][ T24] audit: type=1400 audit(1747009044.180:258): avc: denied { open } for pid=594 comm="syz.2.82" path="/dev/input/event2" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 29.414816][ T613] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 29.428840][ T24] audit: type=1400 audit(1747009044.270:259): avc: denied { sys_module } for pid=608 comm="syz.4.90" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 29.460372][ T24] audit: type=1400 audit(1747009044.340:260): avc: denied { read } for pid=612 comm="syz.3.91" name="event2" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 29.543290][ T357] usb 1-1: USB disconnect, device number 2 [ 29.558844][ T622] netlink: 8 bytes leftover after parsing attributes in process `syz.4.95'. [ 29.729081][ T5] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 29.769069][ T273] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 30.009058][ T273] usb 3-1: Using ep0 maxpacket: 16 [ 30.099144][ T5] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 30.109966][ T5] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 30.123277][ T5] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 30.129118][ T273] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.132615][ T5] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.157245][ T273] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.167374][ T5] usb 4-1: config 0 descriptor?? [ 30.172573][ T273] usb 3-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 30.187938][ T633] netlink: 8 bytes leftover after parsing attributes in process `syz.0.100'. [ 30.190406][ T273] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.197690][ T619] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 30.208810][ T273] usb 3-1: config 0 descriptor?? [ 30.229548][ T5] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 30.240088][ T650] device gretap0 entered promiscuous mode [ 30.246462][ T650] device gretap0 left promiscuous mode [ 30.299194][ T656] netlink: 4 bytes leftover after parsing attributes in process `syz.0.104'. [ 30.549138][ T273] usbhid 3-1:0.0: can't add hid device: -71 [ 30.555127][ T273] usbhid: probe of 3-1:0.0 failed with error -71 [ 30.563826][ T273] usb 3-1: USB disconnect, device number 2 [ 30.709044][ T5] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 30.949059][ T5] usb 2-1: Using ep0 maxpacket: 8 [ 30.984176][ T696] input: syz0 as /devices/virtual/input/input4 [ 31.069036][ T702] capability: warning: `syz.2.124' uses 32-bit capabilities (legacy support in use) [ 31.069149][ T5] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 31.088667][ T5] usb 2-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 31.101957][ T5] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 31.111237][ T5] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.519136][ T5] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 31.889220][ T5] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 31.897892][ T5] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 31.908089][ T5] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 31.917047][ T5] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 31.928026][ T5] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 32.079103][ T5] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 32.088178][ T5] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 32.096177][ T5] usb 1-1: Product: syz [ 32.100375][ T5] usb 1-1: Manufacturer: syz [ 32.139443][ T5] cdc_wdm 1-1:1.0: skipping garbage [ 32.144686][ T5] cdc_wdm 1-1:1.0: skipping garbage [ 32.150454][ T5] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 32.341722][ T273] usb 1-1: USB disconnect, device number 3 [ 32.462618][ T5] usb 4-1: USB disconnect, device number 2 [ 32.611191][ T773] ================================================================== [ 32.619381][ T773] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x842/0x3280 [ 32.627507][ T773] Read of size 8 at addr ffff8881165e70c0 by task syz.4.155/773 [ 32.635101][ T773] [ 32.637433][ T773] CPU: 0 PID: 773 Comm: syz.4.155 Not tainted 5.10.237-syzkaller-00309-g7e2543346ff7 #0 [ 32.647112][ T773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 32.657146][ T773] Call Trace: [ 32.660451][ T773] __dump_stack+0x21/0x24 [ 32.664776][ T773] dump_stack_lvl+0x169/0x1d8 [ 32.669430][ T773] ? show_regs_print_info+0x18/0x18 [ 32.674601][ T773] ? thaw_kernel_threads+0x220/0x220 [ 32.679863][ T773] print_address_description+0x7f/0x2c0 [ 32.685382][ T773] ? tc_setup_flow_action+0x842/0x3280 [ 32.690815][ T773] kasan_report+0xe2/0x130 [ 32.695216][ T773] ? flow_action_cookie_create+0x28/0x90 [ 32.700834][ T773] ? tc_setup_flow_action+0x842/0x3280 [ 32.706267][ T773] __asan_report_load8_noabort+0x14/0x20 [ 32.711872][ T773] tc_setup_flow_action+0x842/0x3280 [ 32.717129][ T773] ? __kmalloc+0x1a7/0x330 [ 32.721526][ T773] ? flow_rule_alloc+0x32/0x2c0 [ 32.726362][ T773] mall_replace_hw_filter+0x293/0x810 [ 32.731724][ T773] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 32.737775][ T773] ? mall_set_parms+0x410/0x410 [ 32.742598][ T773] ? tcf_exts_destroy+0xb0/0xb0 [ 32.747424][ T773] ? pcpu_alloc+0xf8a/0x16b0 [ 32.751987][ T773] ? mall_set_parms+0x19d/0x410 [ 32.756812][ T773] mall_change+0x528/0x750 [ 32.761203][ T773] ? __kasan_check_write+0x14/0x20 [ 32.766286][ T773] ? mall_get+0xa0/0xa0 [ 32.770418][ T773] ? tcf_chain_tp_insert_unique+0xac1/0xc10 [ 32.776283][ T773] ? nla_strcmp+0xf4/0x140 [ 32.780672][ T773] tc_new_tfilter+0x13f6/0x1a10 [ 32.785502][ T773] ? mall_get+0xa0/0xa0 [ 32.789639][ T773] ? tcf_gate_entry_destructor+0x20/0x20 [ 32.795253][ T773] ? security_capable+0x87/0xb0 [ 32.800084][ T773] ? ns_capable+0x8c/0xf0 [ 32.804391][ T773] ? netlink_net_capable+0x125/0x160 [ 32.809654][ T773] ? tcf_gate_entry_destructor+0x20/0x20 [ 32.815260][ T773] rtnetlink_rcv_msg+0x800/0xb90 [ 32.820170][ T773] ? rtnetlink_bind+0x80/0x80 [ 32.825264][ T773] ? arch_stack_walk+0xee/0x140 [ 32.830151][ T773] ? stack_trace_save+0x98/0xe0 [ 32.834982][ T773] ? stack_trace_snprint+0xf0/0xf0 [ 32.840068][ T773] ? memcpy+0x56/0x70 [ 32.844029][ T773] ? avc_has_perm+0x234/0x360 [ 32.848681][ T773] ? __kasan_slab_alloc+0xbd/0xf0 [ 32.853688][ T773] ? slab_post_alloc_hook+0x5d/0x2f0 [ 32.859096][ T773] ? ___sys_sendmsg+0x1f0/0x260 [ 32.863928][ T773] ? avc_has_perm_noaudit+0x240/0x240 [ 32.869279][ T773] ? selinux_nlmsg_lookup+0x3fb/0x4a0 [ 32.874640][ T773] netlink_rcv_skb+0x1e0/0x430 [ 32.879379][ T773] ? rtnetlink_bind+0x80/0x80 [ 32.884034][ T773] ? netlink_ack+0xb80/0xb80 [ 32.888603][ T773] ? __netlink_lookup+0x387/0x3b0 [ 32.893605][ T773] rtnetlink_rcv+0x1c/0x20 [ 32.897999][ T773] netlink_unicast+0x87c/0xa40 [ 32.902737][ T773] netlink_sendmsg+0x88d/0xb30 [ 32.907476][ T773] ? netlink_getsockopt+0x530/0x530 [ 32.912649][ T773] ? security_socket_sendmsg+0x82/0xa0 [ 32.918081][ T773] ? netlink_getsockopt+0x530/0x530 [ 32.923695][ T773] ____sys_sendmsg+0x5a2/0x8c0 [ 32.928438][ T773] ? __sys_sendmsg_sock+0x40/0x40 [ 32.933445][ T773] ? import_iovec+0x7c/0xb0 [ 32.937926][ T773] ___sys_sendmsg+0x1f0/0x260 [ 32.942576][ T773] ? __sys_sendmsg+0x250/0x250 [ 32.947428][ T773] ? __fdget+0x1a1/0x230 [ 32.951655][ T773] __x64_sys_sendmsg+0x1e2/0x2a0 [ 32.956574][ T773] ? ___sys_sendmsg+0x260/0x260 [ 32.961395][ T773] ? switch_fpu_return+0x197/0x340 [ 32.966481][ T773] do_syscall_64+0x31/0x40 [ 32.970872][ T773] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.976738][ T773] RIP: 0033:0x7f11640ba969 [ 32.981150][ T773] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 33.000749][ T773] RSP: 002b:00007f1162723038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 33.009149][ T773] RAX: ffffffffffffffda RBX: 00007f11642e1fa0 RCX: 00007f11640ba969 [ 33.017102][ T773] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000006 [ 33.025047][ T773] RBP: 00007f116413cab1 R08: 0000000000000000 R09: 0000000000000000 [ 33.032991][ T773] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 33.040940][ T773] R13: 0000000000000000 R14: 00007f11642e1fa0 R15: 00007ffd3c0dbb98 [ 33.048889][ T773] [ 33.051194][ T773] Allocated by task 773: [ 33.055413][ T773] __kasan_kmalloc+0xda/0x110 [ 33.060092][ T773] __kmalloc+0x1a7/0x330 [ 33.064320][ T773] tcf_idr_create+0x5f/0x790 [ 33.068890][ T773] tcf_idr_create_from_flags+0x61/0x70 [ 33.074328][ T773] tcf_gact_init+0x2b4/0x520 [ 33.078898][ T773] tcf_action_init_1+0x3e1/0x670 [ 33.083816][ T773] tcf_action_init+0x1e6/0x700 [ 33.088558][ T773] tcf_exts_validate+0x215/0x510 [ 33.093475][ T773] mall_set_parms+0x4b/0x410 [ 33.098046][ T773] mall_change+0x45c/0x750 [ 33.102438][ T773] tc_new_tfilter+0x13f6/0x1a10 [ 33.107295][ T773] rtnetlink_rcv_msg+0x800/0xb90 [ 33.112215][ T773] netlink_rcv_skb+0x1e0/0x430 [ 33.116958][ T773] rtnetlink_rcv+0x1c/0x20 [ 33.121356][ T773] netlink_unicast+0x87c/0xa40 [ 33.126091][ T773] netlink_sendmsg+0x88d/0xb30 [ 33.130829][ T773] ____sys_sendmsg+0x5a2/0x8c0 [ 33.135567][ T773] ___sys_sendmsg+0x1f0/0x260 [ 33.140220][ T773] __x64_sys_sendmsg+0x1e2/0x2a0 [ 33.145134][ T773] do_syscall_64+0x31/0x40 [ 33.149531][ T773] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 33.155394][ T773] [ 33.157701][ T773] The buggy address belongs to the object at ffff8881165e7000 [ 33.157701][ T773] which belongs to the cache kmalloc-192 of size 192 [ 33.171728][ T773] The buggy address is located 0 bytes to the right of [ 33.171728][ T773] 192-byte region [ffff8881165e7000, ffff8881165e70c0) [ 33.185317][ T773] The buggy address belongs to the page: [ 33.190934][ T773] page:ffffea00045979c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1165e7 [ 33.201141][ T773] flags: 0x4000000000000200(slab) [ 33.206145][ T773] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100043380 [ 33.214704][ T773] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 33.223263][ T773] page dumped because: kasan: bad access detected [ 33.229654][ T773] page_owner tracks the page as allocated [ 33.235352][ T773] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 107, ts 4516334114, free_ts 0 [ 33.250360][ T773] prep_new_page+0x179/0x180 [ 33.254933][ T773] get_page_from_freelist+0x2235/0x23d0 [ 33.260452][ T773] __alloc_pages_nodemask+0x268/0x5f0 [ 33.265796][ T773] new_slab+0x84/0x3f0 [ 33.269840][ T773] ___slab_alloc+0x2a6/0x450 [ 33.274409][ T773] __slab_alloc+0x63/0xa0 [ 33.278730][ T773] kmem_cache_alloc_trace+0x1b3/0x2e0 [ 33.284080][ T773] kernfs_fop_open+0x343/0xb30 [ 33.288823][ T773] do_dentry_open+0x793/0x1090 [ 33.293562][ T773] vfs_open+0x73/0x80 [ 33.297524][ T773] path_openat+0x27ad/0x3160 [ 33.302110][ T773] do_filp_open+0x1b3/0x3e0 [ 33.306588][ T773] do_sys_openat2+0x14c/0x6d0 [ 33.311241][ T773] __x64_sys_openat+0x136/0x160 [ 33.316067][ T773] do_syscall_64+0x31/0x40 [ 33.320466][ T773] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 33.326336][ T773] page_owner free stack trace missing [ 33.331682][ T773] [ 33.333986][ T773] Memory state around the buggy address: [ 33.339597][ T773] ffff8881165e6f80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 33.347635][ T773] ffff8881165e7000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.355671][ T773] >ffff8881165e7080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 33.363715][ T773] ^ [ 33.369856][ T773] ffff8881165e7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.377898][ T773] ffff8881165e7180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 33.385936][ T773] ================================================================== [ 33.393977][ T773] Disabling lock debugging due to kernel taint [ 33.402115][ T771] netlink: 1280 bytes leftover after parsing attributes in process `syz.3.154'. [ 33.420394][ T357] usb 2-1: USB disconnect, device number 3