last executing test programs: 2.313304734s ago: executing program 1 (id=199): syz_emit_ethernet(0x66, &(0x7f0000000f80)={@broadcast, @random="6487a2bed3d6", @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x6c, 0x0, @private}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0xfffc}}}}}}, 0x0) 2.311676144s ago: executing program 1 (id=201): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x3}, 0x8) sendto$inet6(r0, &(0x7f0000000400)="aa", 0x1, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x3f66400, @dev={0xfe, 0x80, '\x00', 0x6}, 0x3}, 0x1c) shutdown(r0, 0x1) 2.237497626s ago: executing program 0 (id=203): socket(0x2, 0x80805, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x1018ed8, &(0x7f0000000180)={[{@sysvgroups}, {@noload}, {@nobh}, {@noload}, {@journal_dev={'journal_dev', 0x3d, 0x4}}, {@norecovery}, {@errors_continue}, {@quota}]}, 0x1, 0x644, &(0x7f00000006c0)="$eJzs3c9rHG0dAPDvzCZ5kzS+6SsiNigGPLQgTZNarHqxrQd7KFiwBxEPDU1SQ7c/SFKwtdAEPCgoiHgt0ov/gHfp3ZsI6s2zUEUqFrR0ZWZnm81mN7ttsrtJ5vOBzT7zzLN5nm9mn8wzM/vsBFBas9mPNOJUxNubScR007qpqK+cLcq9+teTW9kjiVrtu/9MIinyGuWT4vlEsTAeEX+8EvHpyu561x89vrNYrdU9jTi3cffBufVHj8+u3l28vXx7+d7C+a9duDj/9YULC00N/XAniuer177z+V/85IdfXflT9WwSl+LG6I+XoiWOgzIbs/G2CLE5fyQiLmaJNn+Xo+YYhFBqleL9OBoRn43pqORLddOx+vOhNg7oq1olora3pFsB4KjSvaGsGuOAxrF9b8fBN/o8Khmcl5frB0C74x8pTjmM58dGk6+SpiOj+rmNkwdQf1bHmyfjz948mXkWO85DvH63dUYOoJ5ONrci4nPt4k/ytp3MI83iT3cc6ycRMR8RY0X7vrWPNiRN6X6ch9lLj/FXsvibt0MaEZeK5yz/ygfW33paa9DxA1BOLy4XO/LNbGl7/5eNPRrjn9ge/zxtvG5q/5dkcsPe/3Ue/zX29+P5uCdtGYdlY5br7X/laGvG33529Ved6q+P/2aeNR5Z/Y2x4CC83IqYaYn/p1mwxfgniz9pM/7Nity81Fsd3/7zP652Wjfs+GvPI063Pf7ZHpVmqT2uT55bWa0uz9d/tq3j93/4wW871d8+/o/6EGl72faf7BB/0/ZPW1+X/U0etP+VW60Zv7v+/G6n+qe6bv/072NJ/XhzrMj50dbGxtpCxFhyrShS5C9ubKyd3zveepnXtfx5oR7/mS+17/873v8tUU00/mX24MH37rzqtO5D3v9NF5Pf1npsQydZ/Evdt/+u/p/l/bLHOv7z/Ydf6LSuffzJvmICAAAAAACAskrza7BJOvcunaZzc/X5sp+JybR6f33jyyv3H95bijiTfx5yNI00yT8yMl1fTlZWq8sLxedhG8vnW5a/EhGfRMSvKxP58tyt+9WlYQcPAAAAAAAAAAAAAAAAAAAAh8SJYv5/4z7V/67U5/8DJdH9BnO77v8AHBP9vMEkcLjl/X+vXfzHg2sLMFj2/1Be+j+Ul/4P5aX/Q3np/1Be+j+Ul/4P5aX/AwAAAMCx9MkXX/w1iYjNb0zkj8xYsc6kXzjeRt+rdKVv7QAGT4+G8np36d9gH0qnp/H/f4svB+x/c4AhSNpl5oOD2t6d/0XbV27b2n/bAAAAAAAAAAAAAIC606c6z/9/v7nBwFFj2h+U1z7m//vqADjifPU/lJdjfKDLLP4Y77Si2/x/AAAAAAAAAAAAAODATOWPJJ0r5gJPRZrOzUV8KiJOxmiyslpdno+IjyPiL5XRj7LlhWE3GgAAAAAAAAAAAAAAAAAAAI6Z9UeP7yxWq8trzYn/7co53onGXVC7F671UGbPxDfjPV8VyeD/LBMRMfSN0rfESFNOErGZbflD0bC19TgczcgTQ/7HBAAAAAAAAAAAAAAAAAAAJdQ097i9md8MuEUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMHjb9//vkliarL+gp8I7E8OOEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4mv4fAAD//6AzO/k=") bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400"], 0x48) preadv(0xffffffffffffffff, 0x0, 0x0, 0x202, 0x0) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000f3000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000700000008500000005000000950e000000000000beaa8a62169cc4f5ddc1970352577fe47f3f672ca889525f9f5ba97a100796b61dcd89dfe5876322a7d44009924f0c7215f77d67045f319f506fff523d3f813bcc36685ca92be6566cdd963dc51dd00de8e9887f28cd362a7b7047db9f3082333b"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000100), 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x74, 0x101301) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200)) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT(r5, &(0x7f0000001400)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001380)={0x0, 0xf8}, 0x1, 0x0, 0x0, 0x20040000}, 0x4008894) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r8, {0x0, 0x10}, {}, {0x8, 0x6}}, [@filter_kind_options=@f_route={{0xa}, {0x18, 0x2, [@TCA_ROUTE4_ACT={0x4}, @TCA_ROUTE4_FROM={0x8, 0x3, 0xec}, @TCA_ROUTE4_TO={0x8, 0x2, 0x56}]}}]}, 0x48}}, 0x0) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000540)=ANY=[@ANYBLOB="2b637075208332cfdb5626cc405709dfcda8b5d99bdf39fe4c08b7659b053611c8136d7feb76d6479454733c1e7965f08e23e937a4720de0c7e943e6378bac12adad382dd7e1f75cfa74c3c3081c7c475c1963753d8d2a51e5bb8eb49c276ab5472e12d4da7f1215f61691a24d4b71aa199296864c"], 0x5) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRES8=0x0], 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r10}, 0x18) r11 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r11, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) 2.197506457s ago: executing program 1 (id=205): r0 = syz_open_dev$tty1(0xc, 0x4, 0x4) dup(r0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x12, 0xc, &(0x7f0000000940)=ANY=[@ANYBLOB="1818110b47ad0abc231e582c8ce0d60a8ca99c3f7ba58bd845870f61053d564b5ddb3804bc983136c6c1c39052994a32fe469c000000f723af1c5e12f056074f66d2f934b5163bc194cc7aeed668c8add041d0b48c853722de79c6f0e86d85895909eacd3dd3e06c9ec13d2bdd1ee36c53cee4a873579800e305910cf526a9e3dc5f75f71247b18913e51b0055a60e97d99a3e6dec97eb39a3febc916e08639dd03db8038281f6665161da93f1a6479201b7cf98a6d2cc782e4f222e298cb57f9019c7437da0a8a4cf24d3ecb8b4199d3869f83c82adb2c23f0e0f9da7e0c4b8078814cd1a56357f4ebffae396342ab07ab9b09938e8c8adc4ed578a6e862f99c0bce5aa3f2e98a74bd0530fe8", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r1, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000340)={&(0x7f0000000d40)={0x2cc, r2, 0x200, 0x70bd25, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x6}, {0x6, 0x16, 0x2b3}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x91d8}, {0x8, 0xb, 0x7}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x91}, {0x6, 0x16, 0x8000}, {0x5}, {0x6, 0x11, 0x2}, {0x8, 0xb, 0xffff}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0xab}, {0x6, 0x16, 0xb177}, {0x5}, {0x6, 0x11, 0x4}, {0x8, 0xb, 0x9}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x80010000}, {0x6, 0x16, 0x7}, {0x5}, {0x6, 0x11, 0x81}, {0x8, 0xb, 0x400}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x3cfb}, {0x6, 0x16, 0x7343}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x59e}, {0x8, 0xb, 0x2}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x8}, {0x6, 0x16, 0x40}, {0x5}, {0x6, 0x11, 0x4}, {0x8, 0xb, 0x7}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x8}, {0x6, 0x16, 0x2}, {0x5, 0x12, 0xfd}, {0x6, 0x11, 0x5}, {0x8, 0xb, 0xffff}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x16, 0x1}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x7}, {0x8, 0xb, 0xe}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7dc5}, {0x6, 0x16, 0x8}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0xc}, {0x8, 0xb, 0x5edb441}}]}, 0x2cc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000002300)={&(0x7f0000000040)=@id={0x1e, 0x3, 0x0, {0x4e22, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x44}, 0x4) sendmsg$tipc(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x2, 0x0, {0x41}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x480c0}, 0x0) r3 = accept4(r1, 0x0, 0x0, 0x400000000000000) r4 = socket$inet_udp(0x2, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x714f, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYRES32], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) socket$kcm(0x10, 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=@newtaction={0x68, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x54, 0x1, [@m_sample={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0xfffffffc, 0x0, 0x10000000, 0x1000000}}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x6b}]}, {0x4}, {0xc}, {0xc, 0x4, {0x2}}}}]}]}, 0x68}}, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) syz_emit_ethernet(0x86, &(0x7f00000004c0)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x3, 0x78, 0x68, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x19, 0x10, 0x6071, 0x0, 0xe7, {[@exp_fastopen={0xfe, 0xf, 0xf989, "bffe6b8f9370e6ec44db58"}, @sack={0x5, 0xa, [0x5, 0x9]}, @timestamp={0x8, 0xa, 0x4, 0x98}, @sack={0x5, 0x1a, [0x0, 0x17bff99f, 0x3ff, 0x6, 0x3, 0x5]}, @sack_perm={0x4, 0x2}, @mptcp=@synack={0x1e, 0x10, 0x8, 0x2, 0x9, 0x1a8}]}}}}}}}, 0x0) 2.001222621s ago: executing program 2 (id=210): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x1, 0x10000000000009, &(0x7f0000000100)="0100ddff", 0x507b420f2d51f971) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e1d, 0x80000003, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x1c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r1, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000bc0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'syztnl2\x00', &(0x7f0000000300)={'syztnl2\x00', 0x0, 0x2f, 0x7, 0xde, 0x43, 0x24, @private2, @remote, 0x1, 0x700, 0xa11d, 0x4}}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x12, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3, 0x0, 0x7fff}, 0x18) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x5031, 0xffffffffffffffff, 0xc2dcc000) r4 = socket(0x10, 0x80003, 0x0) write(r4, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe0000000000000008000f00fd000000", 0x85) close_range(r4, 0xffffffffffffffff, 0x1000000000000000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a9998500000004000000951c8d759c84112f41fdc283b3274a3b85a685cd7fa311e05243310456ccd7f16dee01e8dba9e9ed4aebd46c41c478bf317a8fa85ba7e0cac2ccde98d39b394727036d6d29030dc59ef343727b4df726bcfe6aeca1c5d8d155b6fae7c02754e762015b3d7d36a1c8b4b1a1af518626a8761b8d1e328e7761529a05303c4ff0e4c66a"], &(0x7f0000000040)='GPL\x00', 0x6ff4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r5, 0x89fa, &(0x7f0000000040)={'sit0\x00', 0x0}) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'}) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000600)=ANY=[@ANYBLOB="7f454c4604030106000000000000000000003e0002000000a40200000000000040000000000000004e0000000000000005000000ff0f3800010004000200090003000000000040020600000000000000010000000000008007000000000000000400000000000000680000000000000092f30000000000005253b664459eb0353f3b79e6598a25283411001eeb0ca6c5b356b727a68311872ba483d8bd9c9609a1a33392af71567828cfa99438cd25c04f4384573f876c0f301c7ff2c285fa7d5372e38a26996767d5b3b8fcad7bca21ffd3851e4a04521e360b6c1de80ed145af8dcde013479f7018aab0e774e0b9459191ea00e9c2a4107380656615f1e7d3ab0eea01be027614361b2e3c200883c2c78804d4f5eae35e9de6728a4ac37236a42e2e9285ffadeeee6be815a466e0c10735c283cad200"/1846], 0x736) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x20001) write$sndseq(r7, &(0x7f0000000280)=[{0xff, 0x80, 0x71, 0x9, @tick=0x4, {0xe, 0x1}, {0x4, 0x80}, @queue={0x0, {0xb8f, 0x7}}}, {0x5, 0x5, 0xfd, 0x2, @tick=0x9, {0x9, 0x2b}, {0x3, 0x9}, @note={0x8, 0x5, 0x7, 0xa, 0x9}}], 0x38) socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) socket(0x840000000002, 0x3, 0xff) socket$igmp(0x2, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="07000000040000000802000021"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) r8 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000140)={0x4200, 0x3, 0x5}, 0x10) 1.936658711s ago: executing program 2 (id=211): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0xa7, &(0x7f0000000200)={&(0x7f0000000400)={0x5c, r1, 0x917, 0xa7, 0x1000000, {0x1, 0x0, 0xe4ff}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3f}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @remote}}, @L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x5c}}, 0x0) 1.931706612s ago: executing program 2 (id=212): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b702000000000000850000009b000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x10, 0x10, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x51}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000300)=ANY=[@ANYRES64=r0], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x24, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r3}, 0x18) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x6, &(0x7f0000000680)=0x0) io_submit(r5, 0x2, &(0x7f00000001c0)=[&(0x7f0000000000)={0x180a, 0x0, 0x3, 0x1, 0x80, r4, 0x0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x3, r4, &(0x7f00000006c0)="5810235a8c132d765b", 0x9, 0x1}]) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000940), 0x81000, 0x0) r7 = bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001000000000000000640000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b70800000e0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r8}, 0x10) syz_clone(0x26801000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PTP_SYS_OFFSET(r6, 0x43403d05, 0x0) 1.616695308s ago: executing program 0 (id=214): socket$nl_xfrm(0x10, 0x3, 0x6) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x24, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffbfffffff, 0xffffffffffffffff, 0x2) r0 = syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x0, &(0x7f0000000600), 0x1, 0x555, &(0x7f0000000640)="$eJzs3U9oHNUfAPDvzDb59U9+JhURWxQDHipIt9lYrHpqezGHggU9iHhoaDY1ZNOEJAUTemjBi1BB1KuHXgTP3iV3byKoN48iVJGIJyEyu7NJTHaTELJOmvl8YHbfn03e++7wMu/t7CMBlNZw9pBGnImIG0nE4Ka6Y5FXDrdet/rH3ZvZkcTa2lu/J5HkZe3XJ/nzqTxzPCK+uxrxZGV7uwtLy9PjjUZ9Ps9fWJyZu7CwtHx+amb8Vv1W/XZt9NWLl0Zeq12sHVisD7767Jexa28++/GH778y+X3jfBKXYyCv2xzHQRmO4fX3ZLPsfb100I0VpJLH0ylODr/2+euLiKdjMCr5qM8MxtSDQjsH9NRaJWINKKnE+IeSas8D2mv7XqyDD7NHV1oLoO3xH2t9NhLHm2ujk6vJppVRa707dADtZ238fffsF9kRPfocYif37kfEM53iT5p9G2p+ipPFn/4r/jQiRvL+Z+Wj+2x/eEv+cYr/cv6clV/dZ/tFxw9AOa1caV3It1//0vX5T3SY/wx0uHbtR9HXv+7zv434K13mf9f32MbPH4192q1u8/wvO7L223PB/8Kj+xFnO8afrMefdIg/m/fc2GMbb/zw21i3uqLjX3sYca7j+mfjjlay8/3JC5NTjfpI67FjG998+96X3dovOv7s/J/sEv9O5z8rm9tjG19ffzjTrW73+NNf+5O3m6n+vOSD8cXF+VpEf3Jte/kuC5H2a9q/I4v/xRd2Hv+d4j+RrR32GP/cO9Or+4+/t7L4J/Z5/j/ZYxt/vXvnuW51RccPAAAAAAAAR0na/C5HklbX02larbb28D4VJ9PG7MLiS5Ozd25PtL7zMRR9aftO92Arn2T5Wv592HZ+dEv+5Yg4HRGfV04089Wbs42JooMHAAAAAAAAAAAAAAAAAACAQ+LUlv3/f1Za+/+BkjhWdAeAwhj/UF7GP5SX8Q/lZfxDeRn/UF7GP5SX8Q/lZfxDeRn/UF7GPwAAAAAcSaefX/kpiYh7r59oHpn+vK6v0J4BvZYW3QGgMJWiOwAUxq1/KC9rfCDZpf54t4qV3X4SAAAAAAAAAAAAADgo587Y/w9lZf8/lJf9/1Be9v9DeVnjA/b/AwAAAAAAAAAAAMDhN9A8krSa7wUeiDStViP+HxFD0ZdMTjXqIxHxRET8WOn7X5avFd1pAAAAAAAAAAAAAAAAAAAAOGIWlpanxxuN+ryEhITEeqLov0wAAAAAAAAAAAAAAAAAAFA+G5t+i+4JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABRn4///9y5RdIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOPpnwAAAP//bKsggw==") quotactl$Q_SETQUOTA(0xffffffff80000801, 0x0, 0x0, &(0x7f0000000040)={0x80000005, 0x8000000000000000, 0x9d45, 0x47, 0x0, 0x7, 0x4f1d, 0x6, 0xffffffff}) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, 0x0, &(0x7f0000000d80)='syzkaller\x00', 0x10, 0x0, 0x0, 0x0, 0x66, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x5, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) open_tree(r0, &(0x7f0000000340)='./file0\x00', 0x8000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x64, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB], 0xfc}, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x20040040}, 0x0) close(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="a88d8d00", @ANYRES16=0x0, @ANYBLOB="000425bd7000fbdbdf25130000000c0009800800010007000000880004803c0007800800030000000000080003000d29da41080001000900000008000100060000000800030009000000080004000008000008000200070000001c000780080001000c000000080003000101000008000200090000000900010073797a31000000001300010062726f6164636173742d6c696e6b00000900010073797a3000000000"], 0xa8}, 0x1, 0x0, 0x0, 0x4008815}, 0x1c045) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000180)="441f08d600270bcf724ef54e91e6ffbe002a5f89000000000000000000", 0x1d) 1.52118564s ago: executing program 2 (id=217): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) read$msr(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) r2 = getpid() r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18080000000000000000000000000002850000000f000000850000002a00000095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) r4 = open_tree(0xffffffffffffff9c, 0x0, 0x0) faccessat(r4, 0x0, 0x5) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r6, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r2}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='fib_table_lookup\x00', r7}, 0x10) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000004f4b000000000000000000180100002020702000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000fdffffff850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r9}, 0x10) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000540)="d8000000190081054e81f782db4cb9040220080000000000000000070a000a000900142603600e1208001e0000050401d559e0e0dd7fc07963acc3038ebba8000400027c035c0461c1d67f6f94007134cf6efb8001a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c3f5aeb4edbb57a5025ccca9e008026f6e6ddba61f5fad95667e006dcdf639500bfeb789d00000000000007d5e1cace81ed6c117ab5d6d69bda651297f9583b89965f52df514039e81f86f60f0bffece0b4", 0xd8}], 0x1}, 0x14) sendmsg(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000140)="5500000018007f5f00fe01b2a4a2809302060000ff41fd01020400000a00120002002800000019002d007fffffff0022de1330d54400009b84136ef75afb83de066a5900e1baac968300000000f2ff000001000000", 0x55}], 0x1, 0x0, 0x0, 0x7a000000}, 0x0) 1.476603671s ago: executing program 0 (id=218): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0xa7, &(0x7f0000000200)={&(0x7f0000000400)={0x5c, r1, 0x917, 0xa7, 0x1000000, {0x1, 0x0, 0xe4ff}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3f}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @remote}}, @L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x5c}}, 0x0) 1.408209342s ago: executing program 0 (id=219): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b70400000000000085000000570000"], 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r2) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000fedbdf2531000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c800) 1.385111132s ago: executing program 0 (id=220): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x11, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000840)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x5, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r2}, 0x10) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000840)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000040)='ceph\x00', 0x0, &(0x7f0000000bc0)="0100000200373a4541062101a59ea940d2cb0b36b8f5020000a00000050000000000eb000000a5e5be21c44e328e68f3922af831e4e51bfb30f7788fd57e51bc464355bd646d037ccc16ddb08a7b3a697aedb66ddd793acf37119e61f502d8bbb016f701890700000068d945af468c1c9090c76906b94e0f27761c75e58c82da54d010078660684a4106855beaf5e813ed18aa4acabb5bee7f082d24a16b01fc91471eba59152e716af8776ab90ac48bcbee6570df22513808ecab7a9680aa613a56aa11bfa73af4c4e94b5cfc855f0e910186d7e68ac24f8b125140ac5f7f4819168ce1c25550c6773b41011999d8d9827757d96c5e8aa4617cc54c5e67060a92661f84e698d1fe3cee10a85882cbecb29f2a22535ac50e64d95ecbab66f54373b94475e05b79a0a61bc2ae1e", 0x12d, r3) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r4 = openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x0) r5 = syz_io_uring_setup(0xbdc, &(0x7f0000000080)={0x0, 0xec21, 0x80, 0x1, 0x40000333}, &(0x7f0000000380)=0x0, &(0x7f0000000040)=0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'wg1\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r9}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f00000004c0)={@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @loopback, 0x300000, 0x0, 0x9, 0x500, 0x3, 0x20000, r9}) umount2(&(0x7f00000000c0)='./file0\x00', 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1, 0x0, 0x1}) io_uring_enter(r5, 0x847ba, 0x2000, 0xe, 0x0, 0x0) 1.382654013s ago: executing program 4 (id=221): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000280)='selinux_audited\x00', r1, 0x0, 0x4}, 0x18) pipe2(&(0x7f00000006c0)={0xffffffffffffffff}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000940)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000002000000e00000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000064010102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x310) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) close_range(r2, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) mmap$perf(&(0x7f0000ff3000/0xc000)=nil, 0xc000, 0x2000001, 0x100010, r5, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf0800000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r6}, 0x10) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7020000111e6ca5b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7ffc1ffb}]}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = openat$cgroup_int(r8, &(0x7f0000000040)='hugetlb.2MB.rsvd.max_usage_in_bytes\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x100000000) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYRES32], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r10}, 0x10) mq_open(&(0x7f0000000080)='eth0\x00#~\x02\x00\x00\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfd\x05\x00\x00\x00\x00\x00\x80\x00\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94uu_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18A\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x05\x00\x00\x000\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xce\x00\x00\x00\xe8\vq+\xbb\xc7\xaf\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000240)=0xc) ptrace(0x4208, r11) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x400000000000006, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000600)="5a6c7706d64c18431d8ceac775ee5efd4843cd0e1913a99a1132172b2c5e4dffbedfc927b6dd897a5976de0e8bc06bf22cf5e3af41fc5c8eb29996fc4955bde2bf27e61b090cbb2059e3efdb967e3f8ccfb16af18ddc4130da02f26b57bf022986e80036b6b80025ec56a929a44f0968ac4b99e4b29c2ccf930db28317281361abc42b", 0x83, 0x20000000, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0100000004000000080000000b"], 0x48) 1.345996844s ago: executing program 1 (id=222): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x74, 0x101301) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000)=0x20) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wg1\x00', 0x0}) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x6c, r2, 0x200, 0x70bd25, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x10}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0xb}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r3}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x200, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000400)='kfree\x00', r5}, 0x18) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) 1.255456305s ago: executing program 4 (id=223): r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000340), 0x101800, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000380)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x32) connect(r0, &(0x7f0000000080)=@un=@abs={0x1, 0x0, 0x4e23}, 0x80) r2 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1022, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, @perf_config_ext={0x1, 0x8}, 0x0, 0x10000, 0xc, 0x2, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="1700000000000000", @ANYRES32, @ANYBLOB="8b8cab25"], 0x20) mmap$perf(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xa, 0x4000011, r2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000040), 0x4) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0e000000040000000800000006"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r5}, 0x10) syz_emit_ethernet(0x36, 0x0, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) bind$unix(r6, &(0x7f0000000180)=@file={0x1, './file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) r7 = socket$can_raw(0x1d, 0x3, 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) getsockopt$CAN_RAW_JOIN_FILTERS(r7, 0x65, 0x6, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.254939115s ago: executing program 1 (id=224): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40, 0x0) r2 = syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x800700, &(0x7f0000000680)={[{@nodioread_nolock}, {@journal_dev={'journal_dev', 0x3d, 0xff}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x5c}}, {@nouid32}, {@resgid}, {@acl}, {@init_itable_val={'init_itable', 0x3d, 0x8d55}}]}, 0x0, 0x473, &(0x7f0000000bc0)="$eJzs281rHGUYAPBnJh9t7UdirR+tVaNFCIpJk1btwYuiIFJR0EM9xiQtodtGmii2FpuK1IsgBT2LR9G/wJsIop4Er3rxJIWivbT1FJnZmXSzzabGbDKx+/vBZt93592d58l8vfO+uwF0rIHsTxKxLSJ+jYi+enVxg4H607UrZ8evXzk7nsT8/Gt/Jnm7q1fOjpdNy/dtLSqDaUT6YVKsZLGZ02eOj9Vqk6eK+vDsibeGZ06feeKdE2PHJo9Nnhw9dOjggZGnnxp9si15Znld3fP+9N7dL75x8eXxIxff/PHrLN5txfLGPNplIEv8r/lc87JH272yim1vKCfdFQbCinRFRLa5evLjvy+64sbG64sXPqg0OGBNZdemTa0Xz80Dt7Ekqo4AqEZ5oc/uf8vHOnU9NoTLz9ZvgLK8rxWP+pLuSIs2PU33t+00EBFH5v7+PHvEGo1DAAA0+nj8s8O9EfHe9a9eyvoefQtL0rgnf/49/7ujmEPpj4g7I2JnRNwVEbsi4u6IvO29EXHfKuO5uf+TXlrlRy4r6/89U8xtLe7/lb2/6O8qatvz/HuSo1O1yf3F/2QwejZl9ZFl1vHt87980mpZY/8ve2TrL/uCRRyXupsG6CbGZsfyTmkbXD4fsad7qfyThZmAJCJ2R8SelX30jrIw9diXe1s1unX+y2jDPNP8F1l6c1n+c9GUfylpnJ+cuml+cnhz1Cb3D5d7xc1++vnCq63Wv6r82+DyZP25Yfs3N+lPGudrZ1a+jgu/fdTynuY/7v9pb/J6Ps/cW7z27tjs7KmRiN7kcF5f9ProjfeW9bJ9tv8P7lv6+N9ZvCfL//6IyHbiByLiwYh4qIj94Yh4JCL2LZP/D8+1XlbmH2lF2/98xMSS57+F/b9p+6+80HX8+29arf/fbf+DeWmweCU//93CUuFkp4vmAFfzvwMAAID/izT/DnySDi2U03RoqP4d/l1xR1qbnpl9/Oj02ycn6t+V74+etBzp6ivGQ2tTtcmRZK74xPr46GgxVlyOlx4oxo0/7dqS14fGp2sTFecOnW5ri+M/80dX1dEBa2zLkq+O9q57IEAFmufR08XVc6+EkwHcrvxeGzrXLY7/dL3iANaf6z90rqWO/3NNdXMBcHty/YfO5fiHDpV+V3UEQIVc/6EjreZ3/WtY2LwxwqimsFE3Sl6IKAvphohHYY0KVZ+ZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2uOfAAAA//+Kn+jO") ioctl$AUTOFS_DEV_IOCTL_READY(r1, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {0x5}}, './file0\x00'}) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000002f40)={[{@nodelalloc}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000c5000018110000", @ANYRES32], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000c00)='sys_enter\x00', r3}, 0x10) io_pgetevents(0x0, 0x2, 0x0, 0x0, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000000), 0x4) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r6}, 0x10) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x500, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB], 0x78}}, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080), &(0x7f0000000140)=@v1={0x1000000, [{0x3}]}, 0xc, 0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000010000000a00000008"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c30000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r8}, 0x10) r9 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r9, 0x2285, &(0x7f00000000c0)={0x53, 0xfffffffe, 0x6, 0x2, @scatter={0x0, 0x40000, 0x0}, &(0x7f0000000080)="0000501effd4", 0x0, 0x800004, 0x10030, 0x1, 0x0}) 1.195958956s ago: executing program 4 (id=226): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x23, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x10, 0xffffffffffffff80}, 0x0, 0x6, 0xfffffffd, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) r2 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r2, 0x0) write$selinux_load(r1, &(0x7f0000000000)=ANY=[], 0xffa8) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) openat(r4, &(0x7f0000000100)='./file0\x00', 0x42400, 0x4) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0x7, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000180)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x80, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r7}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee8, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) syz_clone(0x6a000000, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) 1.177360667s ago: executing program 3 (id=227): r0 = fsopen(&(0x7f0000000240)='gadgetfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x87) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc9ffb}]}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000005000000005e002200850000006d00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000340)='kmem_cache_free\x00', r2}, 0x18) fchdir(r1) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007d000000180100002020732600000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r3, 0x0, 0x4}, 0x18) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000200000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000006000000850000005000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f00000001c0)='kfree\x00', r5}, 0x18) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r6}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a00000001010000ff7f0000cc00000000000000", @ANYRES32, @ANYBLOB="00c1bcfb8c"], 0x50) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f0000000940)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000002000000e00000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000064010102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x310) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r7, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) 920.485882ms ago: executing program 3 (id=228): socket$nl_xfrm(0x10, 0x3, 0x6) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x24, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffbfffffff, 0xffffffffffffffff, 0x2) r0 = syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x0, &(0x7f0000000600), 0x1, 0x555, &(0x7f0000000640)="$eJzs3U9oHNUfAPDvzDb59U9+JhURWxQDHipIt9lYrHpqezGHggU9iHhoaDY1ZNOEJAUTemjBi1BB1KuHXgTP3iV3byKoN48iVJGIJyEyu7NJTHaTELJOmvl8YHbfn03e++7wMu/t7CMBlNZw9pBGnImIG0nE4Ka6Y5FXDrdet/rH3ZvZkcTa2lu/J5HkZe3XJ/nzqTxzPCK+uxrxZGV7uwtLy9PjjUZ9Ps9fWJyZu7CwtHx+amb8Vv1W/XZt9NWLl0Zeq12sHVisD7767Jexa28++/GH778y+X3jfBKXYyCv2xzHQRmO4fX3ZLPsfb100I0VpJLH0ylODr/2+euLiKdjMCr5qM8MxtSDQjsH9NRaJWINKKnE+IeSas8D2mv7XqyDD7NHV1oLoO3xH2t9NhLHm2ujk6vJppVRa707dADtZ238fffsF9kRPfocYif37kfEM53iT5p9G2p+ipPFn/4r/jQiRvL+Z+Wj+2x/eEv+cYr/cv6clV/dZ/tFxw9AOa1caV3It1//0vX5T3SY/wx0uHbtR9HXv+7zv434K13mf9f32MbPH4192q1u8/wvO7L223PB/8Kj+xFnO8afrMefdIg/m/fc2GMbb/zw21i3uqLjX3sYca7j+mfjjlay8/3JC5NTjfpI67FjG998+96X3dovOv7s/J/sEv9O5z8rm9tjG19ffzjTrW73+NNf+5O3m6n+vOSD8cXF+VpEf3Jte/kuC5H2a9q/I4v/xRd2Hv+d4j+RrR32GP/cO9Or+4+/t7L4J/Z5/j/ZYxt/vXvnuW51RccPAAAAAAAAR0na/C5HklbX02larbb28D4VJ9PG7MLiS5Ozd25PtL7zMRR9aftO92Arn2T5Wv592HZ+dEv+5Yg4HRGfV04089Wbs42JooMHAAAAAAAAAAAAAAAAAACAQ+LUlv3/f1Za+/+BkjhWdAeAwhj/UF7GP5SX8Q/lZfxDeRn/UF7GP5SX8Q/lZfxDeRn/UF7GPwAAAAAcSaefX/kpiYh7r59oHpn+vK6v0J4BvZYW3QGgMJWiOwAUxq1/KC9rfCDZpf54t4qV3X4SAAAAAAAAAAAAADgo587Y/w9lZf8/lJf9/1Be9v9DeVnjA/b/AwAAAAAAAAAAAMDhN9A8krSa7wUeiDStViP+HxFD0ZdMTjXqIxHxRET8WOn7X5avFd1pAAAAAAAAAAAAAAAAAAAAOGIWlpanxxuN+ryEhITEeqLov0wAAAAAAAAAAAAAAAAAAFA+G5t+i+4JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABRn4///9y5RdIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOPpnwAAAP//bKsggw==") quotactl$Q_SETQUOTA(0xffffffff80000801, 0x0, 0x0, &(0x7f0000000040)={0x80000005, 0x8000000000000000, 0x9d45, 0x47, 0x0, 0x7, 0x4f1d, 0x6, 0xffffffff}) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, 0x0, &(0x7f0000000d80)='syzkaller\x00', 0x10, 0x0, 0x0, 0x0, 0x66, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x5, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) open_tree(r0, &(0x7f0000000340)='./file0\x00', 0x8000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x64, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB], 0xfc}, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x20040040}, 0x0) close(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="a88d8d00", @ANYRES16=0x0, @ANYBLOB="000425bd7000fbdbdf25130000000c0009800800010007000000880004803c0007800800030000000000080003000d29da41080001000900000008000100060000000800030009000000080004000008000008000200070000001c000780080001000c000000080003000101000008000200090000000900010073797a31000000001300010062726f6164636173742d6c696e6b00000900010073797a3000000000"], 0xa8}, 0x1, 0x0, 0x0, 0x4008815}, 0x1c045) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000180)="441f08d600270bcf724ef54e91e6ffbe002a5f89000000000000000000", 0x1d) 899.094782ms ago: executing program 4 (id=229): unshare(0x2c020400) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, 0x0) 876.173383ms ago: executing program 0 (id=230): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xae, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) syz_clone(0x400, &(0x7f0000000800)="f98f88e93f876202f41eeb7515edbd560bb5ba03481cbf81f951aa51ee4ab1c73dc8953f6c6e4f83176b6ddee34456691036106134e5299501a062b70e88ea1a84ab70237ae067445808ddca7251c7f04cb486e76c5ae32527c11c689f9b99fbb00320c6ebde3259161736bd43b623d633e846afc4a066bbb3824d5c6a23dbcb5434d660886693e0d4ce06833e38c36a9a20e68192d54d959d13db687c0511c68570243adbfc7b39ddfd7af561c3db198d435309ff11b3fa3da81a635f8b1a184735a245ace5aa983239c691311f4c1b5848c97d0c8d114f709069d902efa58f21062cae04ae519fc932ef93fa1900f2e51c9018fa8297ad8d83a6b2339ee86df6538a903a41ffd624925ce962af1ba16a9b3690ab2406305c1c03f17a743ff447e1f2f274dd04b8777a0746a9a53e0075c1e67ba07a6bccc98e4958986d412c9810037e28b7efb738e9b081441cb0ec65f4154e3d599f6ffafcb5595d6bf722886a60d6c2e4eac04f45e43c8f5991682c1d75a834fda56367755c82e563a12789e752aec64819caf36d6e71a4d34be4e21a6b5ce7aa04f720b4d2f080ed1b9bd45a6c59734dd37171ef8599e67dda8341b99ef41c12cb5a2f920ab12dc1d68378ce620cb54da191592f905113dd330d6a5618597bf45647ada6b3f994db5e10b5b42997223c461dfdf19b0f969407c76aec07ccbc6be8912c17d5aeaaddbcd29a8e77b1b282c29265448d8f571c86d1dee3c3bca3d6b8a6bc8859a68181e99ed903b7d8961c8382b9119193c4c73d2537d0d6ae020113e26d37f47140043c2a19bb8c2a9bd98ce5edddce974ead5e0bfe55b1dc5a7794238fa312bb8a0a36aa7ceede55d6a05b948de671ca471ac202d8436ea9f38165e411fa97d3874020cf30c15de1168480bdcfd4533fc73bccb15e9a498794efde1a6b55257dfa8feecf90523de63d4fee5dfffd7f454147dd68505a41d8b35772fb328d5824357f798b86618089d24e6ce27265504d6851970a6bbf7e27ad1c095414a78bfa74efa9874240b6a0c00fd52b15b32af1325846f9319c36bc6d6fd1e331d8591814a85a8d378e26e3c937a4c68fa60c367286f74916ee9776c3667cff3a7fa8ed1b7235cd0681286fa14e6eeae083198ac6cd9c41e6a380c465a86bf41222eb938269565e2b637edb5c54a0dc155dcaef8b41f72246aad387ad32871a69938f0236371b555f89e6ec1e594eb9b6ec8d746aa5aba046b27e8a79dcd0b7b191d7ec3e860f09e4cb35e286f73adc5e19414078c6419690173cfd5c81514a4c182cecad086865c26119713e83a616041bd76a99ab7c54c4a6a07b3fdcbee959b457dcb1396a66d3b13104bc9e17c14116cae77ec7e7a5a8fc09b48678b1d357cee835b0097921f2be6e4470c6e6fcc2821830cec0d48ba2ae9d9e4bc406f5e0e8a4abde4df41a539df5aa0940e143d3b6723f95ee2b9b46d68242f59492d35899573af84809701779fa4dc464f7d52ecbd0bcca4e80a0231fdaa464f8961b91937dae6524de52f6103aa300abc569e5ae3181278a31c04b332f3b4745e6cdf3ea0c75cc471391b0bd5b85096fc5ec5ef723e71ebc08fa3923458ac2d6000b420f920ef6534385a4fd8a15a6fd5e89c942249cb47cac46dabb7938e499daa814538a8245b5f05a511d42d8d7e8673e271aaf7b990c1466bb733e73e9d3a736b916d76174cf56f842a2fb771b9b714ccfcb7f9ef7733c43aa415a2486218229bcd8ea52289f96186605dd2038063580a7ab0eaf717cbad7bc3b4502334ee15152e7ff13bfbc9065dedf94daed392106f35f2de6f2bcb644759575a8027b3b14d12bdaa7bf0e79b2fdc65f559061760539a9e6c08b9053752f95a1a769cdb90b7cbac545ab74d6c2e1dabf9ab33923abcfbc84af06ab1d0fee2dcca712d18ff6413fc645298217684f7116f872ec0b757300217efbc4902a8048341feb856e006c07e43e59548a0f7b6292e7d830c1e08e5c9958dc92952a2824c1f0bd12f170acb5d6a6060adbd7aa5996d58c8576ef05de4216c33dd7370524a4ef0a5e02d1d2b71ce6b3b56174efa15f5ccd388d5e22468b410720709cabc12c7553ec5322dda7b8be25077d200edf24e01cc1fee142fd1962196a352630a30339a189508198d497bbb8d9e27c39d5ad8486da65e56d295298bf3c10540b7f5bd4b7ac237bbb4a3bde1f5d2389f5a6993147193d7c2b9c13586ea7b321ae077be5ce4234cdd422de97c904b245339ed9116e50c97b8d95eb93057f0078707e790a5fba2f0393746763fdfac571ace3d7d5e7f41462acb47f5b34551d5e3ed2b30b8c05bf630ecb3b19c70435a8a47a95f884e25b9dcb3dc3af8cd9f4ad2e5606f6df6f4c52740b0aff7dbae58b3a63c8c29c837bd71edd36fd3037cb260bd994de1b72526ada11530f5dd7cf88f460aaad5ed04b61c8f59e3ba2bbaf9b97352c2233ce43cf6db55582954aa6149a36d6d372b2751d6502436c3ad14e58db8717087af7691334cd805f1809c58644727bda2209c8789c485031c8cd409df0774997572e111ffc448bc767153553f707f6766f28f9f2463ae833525ca0cdcb4fcb2053ca42f95515ee3bf704bf1a278c27b4ec03c3dc79e2d2501484dc6e8179a00d5f4fa21b638ca9ab5095e5de580559674481c02262c15a5a1fb33e3a06228cd9502308e68e875c3e69ad071b259e28446d030bf90cf58bc7a91a7a643d4521ffc63deed75890836e23629cd588eef1ba30031a1c0ef9ba10ab9bc9d3b8060bdb932b79bd17e423607f48a01a9821d207ca26e8c66afc904ed4ed024fd029809633cdd0b868ac33f78f2dcb2bfd291c0553f4afd22b070e31152a74cf395c2793e5642321d23ba8497616a9f8b1725da48df0e76ff177e3439cf041caabe862863925da9a2fb82f03e62942303f50d416cfe58c3466878692e7d8b1e014247c4a62c34ad79afef80d3acf7caeacef2fe8e152ab85f76e7707a62d2befbe2ac6c93d3d855cb1109e8b2af60115442efd27e7c5340f45b52568e761eaf05db3d9101467fc7b6c9e9f7ab7433c33e1a053d4f38d9f3382a2e0cae61dcfb622a084f687a2d1df1beb8c55cc5b5fae031757905090b87b6d432489ee23db0d5401f850745f06ae90765cb80b700d76b790dbf2cfa88e2671964057b69da6deed4b2d5e0d8a89f791a61557530996a6c9662104798e6b9cf52c5bbfd184dbf9810420fc749f4723dd36068cecfab6ae32011ec316613c42ff0938d981423db4d245507817e05ac1804586401a6b78352a5596c0568487a28fcdf3d2bf96c5d9666b7307e413b4fae9bb0a1bdd8eed4c17eaf7effcd8e0afd9dd6a33df88275836c4f8aadf4a65e05278cd90116bb470623a05e8d206b521a5014266586a94f28d8dc55455f9e43054d17c8d7d1cb4e1f8542a48380d5a42b655d1f1d657100783adc0a79e3687f44870ded8cfa538f642495470fa4b7f4ac2ed3ba0d9a8cae027a324b7dff2ab1b0816ef741fd3013312ae683dd23581696febd07c6b4aab1398446a2b16d78f1daecdd5a905beb8cb7d15909b62188496ec1d6dbf72ce6ed3eceb66e8416766c32c799b7e226d5a63e772be51ff8fbc561c9847b128b5ce6fb53ddcb2ef901f5326226ab821215dd5d6a44d1b9effa6c5bd11945a2e1cba495eaaecc98e273cf04fc2c583ff8ac1c2038271c6fc93e5e001f8ec1f46515d26a83e7edd5320fab3ea8227e14a8880d9ca9369869ac6ba575735bb6a8152355f58c4c03e0dada0e4dad40529909a9bd34261a49539e22d4ab8da6464652ffdc805759e8d0c83e4f441af630bc15306bcf7b395a2fa4abb7e63c0788405fb95f721081392ad7fa7305b61786697dabe0f0f24cb0c7c1301f1d02d7ed6d509c45fe6ebbe7ca5ceb1ee080f6587bfa87e8db4ec185db8b60b11bf8e98bbc7d574db6c010b183d33f89f827972391bd17c71eb447bb678f9e3d30751028aa2fd7aae65e0c333b0063d4ccc79505222352c86009030ac5b7db791e9677a2056c8004a2103035aa528f6376cd368e864c4c384b080ae6558f9c3321caa829607da8442c6247ee56544b7c2160884d819fc008f28c701953f8f62f9bc235ca823873d521f1b0c8066f5873a9dde76d5d5fa8860b5ef8517c3954f2fb2cda6c5bf5574013fb56888a8eedc1705c2f541f2527b15b3fd649b65ec33bed2ace34294e9ab3c81f05d74ed602a0ef631518aefb96bf73127f1e69863a14c329ec8d1d02bcc4b9cd5792105604356c24dbafbf38aebbcb41134f78aff116744d9003bdfcfb0013a7594b6933fab54829d67686100ccb625c1720563bc7eba8dbe1a4ce2e6b2a41510fb5aa82414ebe9f6c6215da4308c5dce1d96693270ad379df5bc9cce49c4ca6abb4684ea9a655fbf1180de0f947d5fb29f657329bfe355d993dab6d298b0701668f0ccbebdf0abb729a504613e6bb585757e74229ad35b5ebaac", 0xc6c, 0x0, 0x0, &(0x7f00000003c0)="5cbacbd181f2ed21cca6f4f4862323baf158a6ee6d9a9a8ed58cb6b0fde396c9be290d0c643eddbff64f42cf64eaf7418efc0f5bf04d05c6ba0f48ec") bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb2570000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000480)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000100)={0x1d, r4, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000380)="000101000040000000", 0x9}], 0x1}, 0x4004) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, &(0x7f0000000000)={0x2, [0xb0b, 0x9]}, &(0x7f0000000300)=0x8) readv(r3, &(0x7f0000001840)=[{&(0x7f00000004c0)=""/154, 0x9a}], 0x1) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_setup(0x8, &(0x7f0000001e00)) unshare(0x62040200) 805.845034ms ago: executing program 2 (id=231): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b7040000000000008500000057000000"], 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r2) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000fedbdf2531000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c800) 763.179395ms ago: executing program 2 (id=232): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000095980000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f0ffffffb702000005000000b703000000000000850000007300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x3, 0x0, 0x3, 0xc, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x9}, @sadb_address={0x3, 0x6, 0x6c}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x2, 0x6, 0xb}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @empty}}, @sadb_x_sec_ctx={0x1, 0x18, 0x3, 0x6}]}, 0x60}, 0x1, 0x7}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x68001, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000640)='console\x00', r4}, 0x10) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/freeze_filesystems', 0x101a02, 0xc8) sendfile(r5, r5, 0x0, 0x101) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) 728.615855ms ago: executing program 4 (id=233): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b702000000000000850000009b000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x10, 0x10, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x51}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000300)=ANY=[@ANYRES64=r0], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x24, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r3}, 0x18) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x6, &(0x7f0000000680)=0x0) io_submit(r5, 0x2, &(0x7f00000001c0)=[&(0x7f0000000000)={0x180a, 0x0, 0x3, 0x1, 0x80, r4, 0x0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x3, r4, &(0x7f00000006c0)="5810235a8c132d765b", 0x9, 0x1}]) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000940), 0x81000, 0x0) r7 = bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001000000000000000640000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b70800000e0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r8}, 0x10) syz_clone(0x26801000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f00000001c0), 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") creat(&(0x7f00000000c0)='./bus\x00', 0x182) ioctl$PTP_SYS_OFFSET(r6, 0x43403d05, 0x0) 660.486277ms ago: executing program 1 (id=234): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xf, &(0x7f0000000440)=ANY=[], &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe5b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00', r0}, 0x10) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000540)={'syztnl0\x00', &(0x7f0000000600)={'ip6tnl0\x00', 0x0, 0x29, 0xc, 0x2, 0x6, 0x49, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, 0x1, 0x8, 0xfff, 0x3}}) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000004000000080000030000400080000000", @ANYRES32, @ANYBLOB="008000"/20, @ANYRES32=r1, @ANYRES32, @ANYBLOB="00000000000000000300"/28], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r2, 0xffffffffffffffff}, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8923, &(0x7f00000000c0)={'bond_slave_1\x00', @random="0134014030d9"}) r6 = open(&(0x7f0000000000)='./file0\x00', 0x8840c0, 0x39) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000500), r6) connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000580)=ANY=[@ANYRESDEC=0x0], 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f00000001c0)='kmem_cache_free\x00'}, 0x10) statfs(0x0, 0x0) sendto$inet(r7, &(0x7f0000000000), 0xffffffffffffffe5, 0x0, 0x0, 0x11) recvfrom$inet(r7, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25) ioctl$BTRFS_IOC_BALANCE(r3, 0x5000940c, 0x0) fcntl$setlease(r6, 0x400, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) fcntl$setlease(r6, 0x400, 0x2) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000300)=ANY=[@ANYBLOB="1802000067f9bfff0000000001000000180c00ad6c6802e832e1e800009500"/40, @ANYRESHEX=r8], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x18, '\x00', r1, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) socket(0x10, 0x3, 0x0) syz_open_dev$usbfs(&(0x7f0000000200), 0x7, 0x8000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x8, &(0x7f0000000340)=[{0xe, 0xd, 0x6, 0xe920}, {0x402, 0x1, 0x9, 0x100000}, {0x0, 0x0, 0x0, 0x3cd}, {0x9, 0x3, 0x40, 0x4}, {0xf72d, 0xd, 0x1, 0x6}, {0x0, 0x6, 0x4, 0x9}, {0x9, 0x4, 0xe, 0x7}, {0xfff, 0xa, 0x1, 0x180}]}) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 466.916511ms ago: executing program 3 (id=235): syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="71756965742c646f74732c6572726f72733d636f6e74696e75652c6e6f646f74732c636865636b3d72656c617865642c646f733178666c6f7070792c6e66732c646f74732c6e6f646f74732c0052bbde30ad1b84bbd4c68ac5df60afc617ca0829fb9a153080d7fe1db0f2c220c8"], 0xfd, 0x255, &(0x7f0000000580)="$eJzs3TFrE2EYB/DHNG1DHexcHA5cnII6uQapIAaESAadPKgurQjX5XS6j+Fn8CP5MTp1O7EXmrSNFrHXt8n9fhDugX8Cz5tA3gzPm/vw8PPhwZfjT/XP7zEYZNGPqOo6Yjd6sRGNe7Nr76zeikVVAACrZjLJR6l7oF1FMco3I2L7SjL9kaQhAAAAAAAAAAAA/tuy+f84Nf8PAOtscf5/L20rtKQoRvnO7PfbReb/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHRO6/pB/ZdH6v4AgJtn/weA7rH/A0D32P8BoHvevnv/ejQe70+ybBBxUpXTctpcm/zlq/H+k+zM7vxVJ2U53TjPnzZ5djHfjJ1Z/mxpvhWPHzX57+zFm/GlfDsOrrbba+EtAAAAAAAAAAAAAAAAAAAAgOSG2bml5/uHwz/lTbXw/wCXzu/3Y69/a8sAAAAAAAAAAAAAAAAAAACAlXb89dthfnT0sVBcX9yPO9HGdUU8vxNt3HYRq/HpJCz6//Lk1N9MAAAAAAAAAAAAAAAAAADQPfNDv6k7AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB05vf/b6+IiKpupF4uAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsMZ+BQAA//8E/pnA") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) r0 = socket(0x2, 0x80805, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) sendmmsg$inet(r0, &(0x7f0000000f80)=[{{&(0x7f0000000080)={0x2, 0x4, @rand_addr=0xac1414bb}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}, {{&(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f0000001180)="6cb76def2c36dab0f366cf47ad785ed2fb5e1fa5fb56d566acdc377060c4ba50a58104620df72c3004bfbc77173110e163f7d8ad60c34cdb064852353438fea809e390e392afbf35311690cd8286a6c49668aee29b7537078dba77963d15c085d7343c1012135d361ac15c082b7ac8db87cc10fe3ffc374c8be18fc53437100a11dddb9981072ec036d513870a5bbf62ce9e39f790f61ef997af390b9f5fc8a699e001c59077c459eb40ee80a3ffeb35737da668ef974592faf129325cd9ad0dc5663950a329804c9f5d261f71165b05dac212cc2afc40f980ddef8773f1045e75de4ec606aef87052e9ac784bb0f5a43f9cac5e44ae1a6dd575ce17a4749dc7cd4d7f76a40676e792e5b31a25703b1f35b48a89ed84582ef8f4ac046695f402c25da1fa6bc732a7016edf093b4c31193130b3bc143702e2b1d23743ca797b24495dc4979b81413701c0597dcd5e3bcc9c2050c18cfe03814d358e0f795e990dc44d2c1b9890514bd5ea94a3f3a1e25a8cdc67133e9176d76dc54c31274cff0101d8a42c103bad1b8b57362446f2c2ed8a69daf3d7306ef3fa2015e4ee1ef3392120b82671d73b07f3082ea69ffa0ebc7b53c78862a3e1ece518c1f0abbe4053b4dfafe815c1fe4b0d079446e80d13af972e00644a0188605d7309812e24cd1158677f94a16a5eb0c5d48b60329fc522026efa596ac913540f2a9b0345f279329bfba29a7dfc8894e6a08eeee3dd974c3de9e0602cfd1e3e584b10dd26cd13f7fb432e72ea85fd1d3a872061bc967d7a67a3a7f09f34cc825db5d9ef3ce0ff9873f8eff342eb30fa970007e2f591f07dc9bc5141a9679a2f7c69aa50894353a7830a0f7cf766aff6e81d7c3b88d730946ce3f327716ef6fd270d5bf467aef288db903f740b6ac27b962a3c6462372e63f8da8505f05d17b364dd8c6b5d449af0704899ff7c2cba9f098bee986b95e389a2d003539ca9dec8c26b9f6bbb5f7fe6f0b764d99bc0dafcad4121ed6a749ac71fc5deeee54d0e8a2d9dccc87df818258d73c8816b78c1be3670fb14dded879caf925e0f8abf63f55ffee02bbffb465f0303338bd12e22fe94fdaa3f033127ecaf41649232c38e83850fd3ebc890ea5db2763a8389ac49bd9b7f6b81f381d3eeb90d0f596e2b7f7dfa2a0e9453c1f5f359b56aae9e9708d938092d25a031843e351f5733a25c5905706618ab569359bdca4932f6471f4f2d152f84cfc0c563885b0d93fd015095a8eb9422e3d17ddaf3f20dde5eeea415f76c0617964198c824b98f4d53ab0d4d734dcd6d07dddd5b77c1bd71208632941973bd5b5aca981137ec21dcd86ba518b3d4979b68f704a2a7d7cfeb9be3edf4b4b3560e930d9dba0bc358cba36a129748c1fa73483a69759ba0c4f2ee2a936899e163c213bb3fe5a28e68669fb2da6bbcdf4c55e933d127a8bc68b8d0e6c6c757fe8ea47f26ceb7c1b3ca8b962eb31a081756ed56fe4385dccc5e2a7a53300e9c8a1a55bcf8db3f828cb3db8485110da631a50199a5c1932b5538a2b1c3cddb4429bd171d7dd60df6fd11ce970de251868a413418e3f761530fd477b2ebb449070c73171964203ad7bad4302af13fa6fe55fb88ede096a7aba95ef3665da778250daa9dd4bd5ecb8a807d83fe6dcf2f0cf5de7a4ef742979afd7d93bb2672ad45f6537640313b1ca8838f3fdc08e57455af6398ce5b253312fe1a88206210831e0de59d1e3f9442fb9dd43f1b9c00d151d3234028990f8bcaf65c0ad9ea1bc20e4b7641ff26969b02ccd60d2d8d2d72fe5fd58068cd6d7525c9e24c4246cd776ecf1f57550bb6bddad5093618797547cde5c07e165bc979bfbb5479c58e89c29efa5fdfa5b4a87917a4275609afc849384458ca980ba5a2aa4d10c761bb3b3a57e3d3b41001cdf661fbc6042327c4676e3043723c701cf1937d7a2791636eda525c28536451ba3e0925afb2a798f84862764eff30dbaeaa0074128e86cdecd1208614fe31aa12494ce30fc5735eadeb0c4c64d7d18dbcd3e7da1d17b1a283c8fef452015f76b3b41c496a4bec6e79a375d754895da360c22e23253fda2685cdd0e87bd39c138e045a0af751fbe44b4448fb2ece4ba8154ddf0699da5ed256ec111268337ddd7888dde956bf0af8bf40adea", 0x5f9}], 0x1}}, {{&(0x7f0000000b80)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000000e00)=[{0x0}], 0x1}}], 0x3, 0x8000080) 145.993197ms ago: executing program 3 (id=236): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000005740)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000070000000850000005000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_DYNSET_SREG_KEY={0x8}, @NFTA_DYNSET_FLAGS={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_DYNSET_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x90}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r1}, 0x10) rt_sigaction(0x14, 0x0, 0x0, 0x8, &(0x7f0000000280)) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001f0000), 0x1002002, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={r7, r6, 0x25, 0x2, @val=@tcx}, 0x1c) r8 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040), 0x4) r9 = getpgrp(0x0) r10 = syz_pidfd_open(r9, 0x0) r11 = pidfd_getfd(r10, r10, 0x0) setns(r11, 0x14020000) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@bloom_filter={0x1e, 0x454, 0x5, 0x7, 0x10025, r0, 0x401, '\x00', r6, r8, 0x3, 0x0, 0x4, 0x4, @void, @value, @value=r11}, 0x50) r12 = dup(r4) r13 = open(&(0x7f0000000000)='./bus\x00', 0x40542, 0x0) ftruncate(r13, 0xee72) getsockopt$WPAN_WANTACK(r13, 0x0, 0x0, &(0x7f0000000200), &(0x7f00000002c0)=0x4) sendfile(r12, r13, 0x0, 0x8000fffffffe) ioctl$TIOCSETD(r12, 0x5423, &(0x7f0000000180)=0x19) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=@framed={{0x5e, 0xa, 0xa, 0x0, 0x0, 0x71, 0x10, 0x10}}, &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffdb}, 0x94) 91.701258ms ago: executing program 4 (id=237): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000400)='locks_get_lock_context\x00', r1}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000002000000000000000100000d030000000000000003000000000000000000000105000000080000000000000000000003000000000200000002"], 0x0, 0x56}, 0x28) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x5, 0x3}, 0x0, 0x0, 0x40000, 0x0, 0x21, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000084ffffffff000000000300000000000000000000000200000000000000000000000000000a03000000000000000000001302"], 0x0, 0x56}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000001850000000000020000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffff0, 0x0, 0x0, 0x0, &(0x7f0000000080)}, 0x9a) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) kexec_load(0x0, 0x10, &(0x7f00000001c0)=[{0x0}], 0x0) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f00000005c0)={0x2, 0x14, 0x7d57, 0x8, 0x7b, 0x2, &(0x7f0000000740)="4b5bb496a62d2011370fc813eff56ddf64ec1116bfab2a2e93ebe448b0710d1a6ca04700d96e27b944a5d98ace7b11198e0c4123c5e3ffcb0d7396f181f19355ab74ef9d2819e3b31b7d9818104ba3dfad080e645b318f64b997bad6552b5e45992602dbb5a6b2dbb0639b7be78aeee04006936b0a1a490b96696b"}) r5 = accept$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000280)=0x1c) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000300)=0x14) statx(r4, &(0x7f0000000340)='./file0\x00', 0x100, 0x2, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000000640)={{{@in=@local, @in=@rand_addr=0x64010101, 0xff, 0x0, 0x4e24, 0x7fff, 0xa, 0x80, 0x20, 0x2b, r6, r7}, {0x7, 0x81, 0xf3, 0x3, 0x10001, 0x10000, 0x5, 0xfff}, {0x8000, 0x0, 0x3a}, 0x3, 0x6e6bb4, 0x0, 0x0, 0x1, 0x3}, {{@in=@multicast1, 0x4d4, 0x32}, 0xa, @in=@private=0xa010101, 0x3504, 0x1, 0x1, 0xc, 0x0, 0x9, 0xab}}, 0xe8) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x18, 0x140c, 0x300, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) fcntl$lock(r4, 0x26, &(0x7f0000000000)) 645.01µs ago: executing program 3 (id=238): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000002000000000000000200008d"], 0x0, 0x36, 0x0, 0x1}, 0x28) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x4, &(0x7f00000001c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xa8}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf32(r1, &(0x7f0000000900)={{0x7f, 0x45, 0x4c, 0x46, 0x4, 0x7, 0x0, 0x3, 0x5, 0x2, 0x3, 0x3, 0x309, 0x38, 0xfffffffc, 0xe, 0x0, 0x20, 0x1, 0x5}, [{0x3, 0x8, 0xf3, 0x7f, 0x4, 0x200004, 0x7, 0x400}]}, 0x58) close(r1) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7020000111e6ca5b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3, 0x0, 0x2}, 0x18) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffd}, 0x39) 0s ago: executing program 3 (id=239): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xf, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x280002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'dvmrp0\x00', 0x4000}) syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f00000002c0)='./bus\x00', 0x404, &(0x7f0000000580)={[{@orlov}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}]}, 0x1, 0x5d8, &(0x7f0000000c00)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x4040, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1202, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(r4, r3, 0x0, 0x3ffff) sendfile(r4, r3, 0x0, 0x7ffff000) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 16.855052][ T29] kauditd_printk_skb: 44 callbacks suppressed [ 16.855066][ T29] audit: type=1400 audit(1758465763.534:57): avc: denied { transition } for pid=3182 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.858933][ T29] audit: type=1400 audit(1758465763.534:58): avc: denied { noatsecure } for pid=3182 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.861574][ T29] audit: type=1400 audit(1758465763.534:59): avc: denied { write } for pid=3182 comm="sh" path="pipe:[2288]" dev="pipefs" ino=2288 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 16.864600][ T29] audit: type=1400 audit(1758465763.534:60): avc: denied { rlimitinh } for pid=3182 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.867235][ T29] audit: type=1400 audit(1758465763.534:61): avc: denied { siginh } for pid=3182 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.145' (ED25519) to the list of known hosts. [ 24.301656][ T29] audit: type=1400 audit(1758465770.984:62): avc: denied { mounton } for pid=3293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.302583][ T3293] cgroup: Unknown subsys name 'net' [ 24.324363][ T29] audit: type=1400 audit(1758465770.984:63): avc: denied { mount } for pid=3293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.351711][ T29] audit: type=1400 audit(1758465771.014:64): avc: denied { unmount } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.549955][ T3293] cgroup: Unknown subsys name 'cpuset' [ 24.556205][ T3293] cgroup: Unknown subsys name 'rlimit' [ 24.685095][ T29] audit: type=1400 audit(1758465771.364:65): avc: denied { setattr } for pid=3293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.708512][ T29] audit: type=1400 audit(1758465771.364:66): avc: denied { create } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.728966][ T29] audit: type=1400 audit(1758465771.364:67): avc: denied { write } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.749315][ T29] audit: type=1400 audit(1758465771.364:68): avc: denied { read } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.769640][ T29] audit: type=1400 audit(1758465771.394:69): avc: denied { mounton } for pid=3293 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.776549][ T3296] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.794456][ T29] audit: type=1400 audit(1758465771.394:70): avc: denied { mount } for pid=3293 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.826324][ T29] audit: type=1400 audit(1758465771.494:71): avc: denied { relabelto } for pid=3296 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.862292][ T3293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.927607][ T3304] chnl_net:caif_netlink_parms(): no params data found [ 27.023805][ T3306] chnl_net:caif_netlink_parms(): no params data found [ 27.046959][ T3304] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.054060][ T3304] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.061406][ T3304] bridge_slave_0: entered allmulticast mode [ 27.067753][ T3304] bridge_slave_0: entered promiscuous mode [ 27.074474][ T3304] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.081585][ T3304] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.088764][ T3304] bridge_slave_1: entered allmulticast mode [ 27.095395][ T3304] bridge_slave_1: entered promiscuous mode [ 27.125097][ T3304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.135395][ T3304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.185239][ T3304] team0: Port device team_slave_0 added [ 27.196059][ T3304] team0: Port device team_slave_1 added [ 27.213327][ T3306] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.220510][ T3306] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.227661][ T3306] bridge_slave_0: entered allmulticast mode [ 27.234170][ T3306] bridge_slave_0: entered promiscuous mode [ 27.261019][ T3306] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.268106][ T3306] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.275395][ T3306] bridge_slave_1: entered allmulticast mode [ 27.281679][ T3306] bridge_slave_1: entered promiscuous mode [ 27.295810][ T3309] chnl_net:caif_netlink_parms(): no params data found [ 27.304690][ T3312] chnl_net:caif_netlink_parms(): no params data found [ 27.318278][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.325264][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.351158][ T3304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.364382][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.371350][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.397313][ T3304] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.418259][ T3311] chnl_net:caif_netlink_parms(): no params data found [ 27.442123][ T3306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.455254][ T3306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.492749][ T3304] hsr_slave_0: entered promiscuous mode [ 27.498799][ T3304] hsr_slave_1: entered promiscuous mode [ 27.527256][ T3306] team0: Port device team_slave_0 added [ 27.533666][ T3306] team0: Port device team_slave_1 added [ 27.566316][ T3312] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.573427][ T3312] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.580594][ T3312] bridge_slave_0: entered allmulticast mode [ 27.586980][ T3312] bridge_slave_0: entered promiscuous mode [ 27.602830][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.609804][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.635773][ T3306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.651713][ T3309] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.658839][ T3309] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.666039][ T3309] bridge_slave_0: entered allmulticast mode [ 27.672496][ T3309] bridge_slave_0: entered promiscuous mode [ 27.683915][ T3312] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.691035][ T3312] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.698241][ T3312] bridge_slave_1: entered allmulticast mode [ 27.704737][ T3312] bridge_slave_1: entered promiscuous mode [ 27.716410][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.723406][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.749330][ T3306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.760167][ T3309] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.767201][ T3309] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.774398][ T3309] bridge_slave_1: entered allmulticast mode [ 27.780775][ T3309] bridge_slave_1: entered promiscuous mode [ 27.803819][ T3311] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.810954][ T3311] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.818064][ T3311] bridge_slave_0: entered allmulticast mode [ 27.824530][ T3311] bridge_slave_0: entered promiscuous mode [ 27.830902][ T3311] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.838032][ T3311] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.845239][ T3311] bridge_slave_1: entered allmulticast mode [ 27.851522][ T3311] bridge_slave_1: entered promiscuous mode [ 27.864394][ T3309] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.892256][ T3309] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.902646][ T3311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.915194][ T3312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.930070][ T3311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.951714][ T3312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.970000][ T3306] hsr_slave_0: entered promiscuous mode [ 27.976101][ T3306] hsr_slave_1: entered promiscuous mode [ 27.982205][ T3306] debugfs: 'hsr0' already exists in 'hsr' [ 27.987917][ T3306] Cannot create hsr debugfs directory [ 28.015334][ T3311] team0: Port device team_slave_0 added [ 28.021957][ T3311] team0: Port device team_slave_1 added [ 28.028234][ T3309] team0: Port device team_slave_0 added [ 28.034837][ T3309] team0: Port device team_slave_1 added [ 28.075960][ T3312] team0: Port device team_slave_0 added [ 28.091393][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.098376][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.124282][ T3311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.140455][ T3312] team0: Port device team_slave_1 added [ 28.153108][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.160098][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.186049][ T3311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.196911][ T3309] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.203959][ T3309] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.229990][ T3309] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.241197][ T3309] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.248135][ T3309] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.274072][ T3309] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.301258][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.308226][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.334142][ T3312] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.345365][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.352353][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.378245][ T3312] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.416361][ T3311] hsr_slave_0: entered promiscuous mode [ 28.422539][ T3311] hsr_slave_1: entered promiscuous mode [ 28.428393][ T3311] debugfs: 'hsr0' already exists in 'hsr' [ 28.434131][ T3311] Cannot create hsr debugfs directory [ 28.461802][ T3312] hsr_slave_0: entered promiscuous mode [ 28.467714][ T3312] hsr_slave_1: entered promiscuous mode [ 28.473572][ T3312] debugfs: 'hsr0' already exists in 'hsr' [ 28.479359][ T3312] Cannot create hsr debugfs directory [ 28.496409][ T3309] hsr_slave_0: entered promiscuous mode [ 28.502548][ T3309] hsr_slave_1: entered promiscuous mode [ 28.508320][ T3309] debugfs: 'hsr0' already exists in 'hsr' [ 28.514070][ T3309] Cannot create hsr debugfs directory [ 28.519610][ T3304] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 28.536092][ T3304] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 28.559378][ T3304] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 28.584420][ T3304] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 28.650477][ T3306] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 28.665427][ T3306] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 28.690535][ T3306] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 28.710911][ T3306] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 28.751611][ T3311] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 28.762773][ T3311] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 28.771416][ T3311] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 28.783052][ T3311] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 28.815077][ T3309] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 28.829626][ T3309] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 28.838240][ T3309] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 28.851023][ T3309] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 28.861907][ T3304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.893053][ T3304] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.906821][ T3312] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 28.916678][ T3312] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 28.927507][ T3312] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 28.936932][ T3312] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 28.950144][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.957269][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.966499][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.973593][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.990162][ T3304] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 29.000665][ T3304] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 29.050618][ T3306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.068219][ T3306] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.083360][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.090456][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.106506][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.113583][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.125555][ T3304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.159844][ T3311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.178044][ T3312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.200462][ T3309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.213724][ T3312] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.232558][ T152] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.239639][ T152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.251349][ T3311] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.263745][ T1886] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.270894][ T1886] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.294027][ T1886] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.301176][ T1886] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.311057][ T1886] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.318104][ T1886] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.331935][ T3309] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.347414][ T1973] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.354558][ T1973] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.367905][ T3306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.390813][ T3304] veth0_vlan: entered promiscuous mode [ 29.400865][ T1886] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.408091][ T1886] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.436033][ T3304] veth1_vlan: entered promiscuous mode [ 29.467604][ T3309] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 29.495813][ T3304] veth0_macvtap: entered promiscuous mode [ 29.510237][ T3304] veth1_macvtap: entered promiscuous mode [ 29.528586][ T3306] veth0_vlan: entered promiscuous mode [ 29.549601][ T3306] veth1_vlan: entered promiscuous mode [ 29.558104][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.576230][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.585274][ T3312] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.597634][ T1886] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.616741][ T3311] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.625051][ T1886] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.635510][ T1886] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.646845][ T1886] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.663383][ T3306] veth0_macvtap: entered promiscuous mode [ 29.675815][ T3306] veth1_macvtap: entered promiscuous mode [ 29.684800][ T3309] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.698225][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 29.698239][ T29] audit: type=1400 audit(1758465776.374:81): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/root/syzkaller.kDMpOv/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 29.740909][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.749436][ T29] audit: type=1400 audit(1758465776.384:82): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 29.753872][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.771568][ T29] audit: type=1400 audit(1758465776.384:83): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/root/syzkaller.kDMpOv/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 29.803793][ T29] audit: type=1400 audit(1758465776.384:84): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 29.806520][ T51] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.825599][ T29] audit: type=1400 audit(1758465776.384:85): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/root/syzkaller.kDMpOv/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 29.860820][ T29] audit: type=1400 audit(1758465776.384:86): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/root/syzkaller.kDMpOv/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 29.888182][ T29] audit: type=1400 audit(1758465776.384:87): avc: denied { unmount } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 29.908429][ T29] audit: type=1400 audit(1758465776.464:88): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 29.912737][ T51] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.931242][ T29] audit: type=1400 audit(1758465776.464:89): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="gadgetfs" ino=3749 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 29.971528][ T3304] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 29.988894][ T51] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.007222][ T3312] veth0_vlan: entered promiscuous mode [ 30.032977][ T51] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.041405][ T29] audit: type=1400 audit(1758465776.714:90): avc: denied { read write } for pid=3304 comm="syz-executor" name="loop0" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 30.056756][ T3309] veth0_vlan: entered promiscuous mode [ 30.086832][ T3311] veth0_vlan: entered promiscuous mode [ 30.099020][ T3312] veth1_vlan: entered promiscuous mode [ 30.110425][ T3309] veth1_vlan: entered promiscuous mode [ 30.127727][ T3311] veth1_vlan: entered promiscuous mode [ 30.141489][ T3309] veth0_macvtap: entered promiscuous mode [ 30.149373][ T3309] veth1_macvtap: entered promiscuous mode [ 30.160517][ T3309] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.169400][ T3309] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.199441][ T1973] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.215757][ T3311] veth0_macvtap: entered promiscuous mode [ 30.227581][ T1886] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.237236][ T3311] veth1_macvtap: entered promiscuous mode [ 30.246144][ T3312] veth0_macvtap: entered promiscuous mode [ 30.257271][ T1886] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.266719][ T3312] veth1_macvtap: entered promiscuous mode [ 30.277403][ T1886] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.287416][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.296975][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.528800][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.555656][ T1886] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.620166][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.635438][ T1886] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.756859][ T1886] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.868134][ T1886] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.965219][ T1886] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.981651][ T1886] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.991339][ T1886] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.036577][ T1886] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.064403][ T3499] FAULT_INJECTION: forcing a failure. [ 31.064403][ T3499] name failslab, interval 1, probability 0, space 0, times 1 [ 31.077181][ T3499] CPU: 1 UID: 0 PID: 3499 Comm: syz.4.5 Not tainted syzkaller #0 PREEMPT(voluntary) [ 31.077223][ T3499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 31.077235][ T3499] Call Trace: [ 31.077242][ T3499] [ 31.077250][ T3499] __dump_stack+0x1d/0x30 [ 31.077279][ T3499] dump_stack_lvl+0xe8/0x140 [ 31.077299][ T3499] dump_stack+0x15/0x1b [ 31.077317][ T3499] should_fail_ex+0x265/0x280 [ 31.077364][ T3499] ? fsnotify_alloc_group+0x5a/0x170 [ 31.077384][ T3499] should_failslab+0x8c/0xb0 [ 31.077479][ T3499] __kmalloc_cache_noprof+0x4c/0x320 [ 31.077556][ T3499] fsnotify_alloc_group+0x5a/0x170 [ 31.077578][ T3499] do_inotify_init+0x59/0x270 [ 31.077604][ T3499] __ia32_sys_inotify_init+0x10/0x20 [ 31.077706][ T3499] x64_sys_call+0x2e70/0x2ff0 [ 31.077728][ T3499] do_syscall_64+0xd2/0x200 [ 31.077760][ T3499] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 31.077786][ T3499] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 31.077857][ T3499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 31.077876][ T3499] RIP: 0033:0x7fe09fe1ec29 [ 31.077943][ T3499] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 31.077960][ T3499] RSP: 002b:00007fe09e887038 EFLAGS: 00000246 ORIG_RAX: 00000000000000fd [ 31.077984][ T3499] RAX: ffffffffffffffda RBX: 00007fe0a0065fa0 RCX: 00007fe09fe1ec29 [ 31.077998][ T3499] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 31.078010][ T3499] RBP: 00007fe09e887090 R08: 0000000000000000 R09: 0000000000000000 [ 31.078023][ T3499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 31.078091][ T3499] R13: 00007fe0a0066038 R14: 00007fe0a0065fa0 R15: 00007ffed47a3dc8 [ 31.078107][ T3499] [ 31.335471][ T3408] IPVS: starting estimator thread 0... [ 31.519262][ T3507] IPVS: using max 2784 ests per chain, 139200 per kthread [ 31.529443][ T3505] netlink: 28 bytes leftover after parsing attributes in process `+}[@'. [ 31.595196][ T3518] loop3: detected capacity change from 0 to 128 [ 31.601834][ T3518] ======================================================= [ 31.601834][ T3518] WARNING: The mand mount option has been deprecated and [ 31.601834][ T3518] and is ignored by this kernel. Remove the mand [ 31.601834][ T3518] option from the mount to silence this warning. [ 31.601834][ T3518] ======================================================= [ 32.415588][ T3506] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10'. [ 32.436271][ T3500] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8'. [ 32.862065][ C1] hrtimer: interrupt took 35495 ns [ 32.881368][ T3532] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 32.954586][ T3536] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 33.106848][ T3540] loop4: detected capacity change from 0 to 512 [ 33.207077][ T3555] loop2: detected capacity change from 0 to 1024 [ 33.230275][ T3555] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.244505][ T3540] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.257498][ T3540] ext4 filesystem being mounted at /4/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.273982][ T3547] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.289228][ T3547] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.324765][ T3557] random: crng reseeded on system resumption [ 33.432851][ T3555] syz.2.22 (3555) used greatest stack depth: 10552 bytes left [ 33.705668][ T3312] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.716768][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.767326][ T3566] loop4: detected capacity change from 0 to 512 [ 33.777606][ T3566] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 33.789906][ T3566] EXT4-fs (loop4): orphan cleanup on readonly fs [ 33.802368][ T3566] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:517: comm syz.4.25: Block bitmap for bg 0 marked uninitialized [ 33.818544][ T3566] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 33.878856][ T3566] EXT4-fs (loop4): 1 orphan inode deleted [ 33.886245][ T3566] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 33.964954][ T3312] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.976607][ T3575] netlink: 92 bytes leftover after parsing attributes in process `syz.0.29'. [ 33.986017][ T3575] netem: unknown loss type 0 [ 33.990676][ T3575] netem: change failed [ 34.005960][ T3579] loop3: detected capacity change from 0 to 512 [ 34.019438][ T3579] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 34.082643][ T3579] EXT4-fs (loop3): orphan cleanup on readonly fs [ 34.089418][ T3579] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:517: comm syz.3.32: Block bitmap for bg 0 marked uninitialized [ 34.104146][ T3579] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 34.117862][ T3579] EXT4-fs (loop3): 1 orphan inode deleted [ 34.126517][ T3579] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 34.151978][ T3577] hub 6-0:1.0: USB hub found [ 34.156677][ T3577] hub 6-0:1.0: 8 ports detected [ 34.621852][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.766072][ T29] kauditd_printk_skb: 713 callbacks suppressed [ 34.766087][ T29] audit: type=1400 audit(1758465781.444:804): avc: denied { create } for pid=3615 comm="syz.2.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 34.804181][ T3618] loop2: detected capacity change from 0 to 512 [ 34.840578][ T3618] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 34.852487][ T3618] EXT4-fs (loop2): orphan cleanup on readonly fs [ 34.861257][ T29] audit: type=1326 audit(1758465781.474:805): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3617 comm="syz.2.41" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 34.885127][ T29] audit: type=1326 audit(1758465781.474:806): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3617 comm="syz.2.41" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 34.909160][ T29] audit: type=1326 audit(1758465781.474:807): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3617 comm="syz.2.41" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 34.932334][ T29] audit: type=1326 audit(1758465781.474:808): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3617 comm="syz.2.41" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 34.938120][ T3618] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:517: comm syz.2.41: Block bitmap for bg 0 marked uninitialized [ 34.955623][ T29] audit: type=1326 audit(1758465781.474:809): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3617 comm="syz.2.41" exe="/root/syz-executor" sig=0 arch=c000003e syscall=269 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 34.955652][ T29] audit: type=1326 audit(1758465781.474:810): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3617 comm="syz.2.41" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 34.955671][ T29] audit: type=1326 audit(1758465781.474:811): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3617 comm="syz.2.41" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 34.955690][ T29] audit: type=1326 audit(1758465781.474:812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3617 comm="syz.2.41" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f0fdfc0ec63 code=0x7ffc0000 [ 35.062697][ T29] audit: type=1326 audit(1758465781.474:813): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3617 comm="syz.2.41" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f0fdfc0d6df code=0x7ffc0000 [ 35.090410][ T3618] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 35.110723][ T3618] EXT4-fs (loop2): 1 orphan inode deleted [ 35.129971][ T3623] netlink: 24 bytes leftover after parsing attributes in process `syz.1.42'. [ 35.142623][ T3618] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 35.160324][ T3623] loop1: detected capacity change from 0 to 164 [ 35.191300][ T3623] iso9660: Unknown parameter '' [ 35.218278][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.247417][ T3623] lo speed is unknown, defaulting to 1000 [ 35.330079][ T3623] lo speed is unknown, defaulting to 1000 [ 35.336368][ T3623] lo speed is unknown, defaulting to 1000 [ 35.342525][ T3623] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 35.351933][ T3623] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 35.383100][ T3627] netlink: 'syz.2.43': attribute type 3 has an invalid length. [ 35.452019][ T3623] lo speed is unknown, defaulting to 1000 [ 35.465114][ T3623] lo speed is unknown, defaulting to 1000 [ 35.491700][ T3623] lo speed is unknown, defaulting to 1000 [ 35.508775][ T3623] lo speed is unknown, defaulting to 1000 [ 35.523150][ T3629] netlink: 4 bytes leftover after parsing attributes in process `'. [ 35.527334][ T3631] loop2: detected capacity change from 0 to 1024 [ 35.539382][ T3629] loop4: detected capacity change from 0 to 128 [ 35.548156][ T3623] lo speed is unknown, defaulting to 1000 [ 35.567191][ T3631] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.578296][ T3629] vfat: Unknown parameter 's(ortname' [ 35.583230][ T3623] lo speed is unknown, defaulting to 1000 [ 35.591230][ T3623] lo speed is unknown, defaulting to 1000 [ 35.647877][ T3629] random: crng reseeded on system resumption [ 35.674899][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.689835][ T3629] loop4: detected capacity change from 0 to 512 [ 35.713724][ T3629] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.779263][ T3629] ext4 filesystem being mounted at /7/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 35.791319][ T3629] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.820691][ T3638] loop2: detected capacity change from 0 to 512 [ 35.853416][ T3638] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 35.873875][ T3638] EXT4-fs (loop2): orphan cleanup on readonly fs [ 35.921222][ T3638] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:517: comm syz.2.46: Block bitmap for bg 0 marked uninitialized [ 35.923994][ T3644] netlink: 'syz.3.49': attribute type 1 has an invalid length. [ 35.949526][ T3638] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 35.967509][ T3644] netlink: 480 bytes leftover after parsing attributes in process `syz.3.49'. [ 35.977761][ T3638] EXT4-fs (loop2): 1 orphan inode deleted [ 35.985438][ T3642] loop4: detected capacity change from 0 to 8192 [ 36.004603][ T3638] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 36.039189][ T3651] netlink: 8 bytes leftover after parsing attributes in process `syz.3.51'. [ 36.059474][ T3594] loop4: p1 p2 < > p3 p4 < p5 > [ 36.059485][ T3594] loop4: partition table partially beyond EOD, truncated [ 36.059543][ T3594] loop4: p1 size 100663296 extends beyond EOD, truncated [ 36.065150][ T3594] loop4: p2 start 591104 is beyond EOD, truncated [ 36.065174][ T3594] loop4: p3 start 33572980 is beyond EOD, truncated [ 36.073439][ T3594] loop4: p5 size 100663296 extends beyond EOD, truncated [ 36.098762][ T3642] loop4: p1 p2 < > p3 p4 < p5 > [ 36.098773][ T3642] loop4: partition table partially beyond EOD, truncated [ 36.098910][ T3642] loop4: p1 size 100663296 extends beyond EOD, truncated [ 36.103174][ T3642] loop4: p2 start 591104 is beyond EOD, truncated [ 36.103194][ T3642] loop4: p3 start 33572980 is beyond EOD, truncated [ 36.104024][ T3642] loop4: p5 size 100663296 extends beyond EOD, truncated [ 36.119618][ T3656] loop0: detected capacity change from 0 to 512 [ 36.130773][ T3656] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 36.135481][ T3656] EXT4-fs (loop0): orphan cleanup on readonly fs [ 36.135705][ T3656] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:517: comm syz.0.53: Block bitmap for bg 0 marked uninitialized [ 36.135830][ T3656] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 36.136121][ T3656] EXT4-fs (loop0): 1 orphan inode deleted [ 36.136523][ T3656] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 36.309170][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.328963][ T3664] loop4: detected capacity change from 0 to 128 [ 36.382412][ T3669] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 36.390843][ T3594] udevd[3594]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 36.392463][ T3297] udevd[3297]: inotify_add_watch(7, /dev/loop4p5, 10) failed: No such file or directory [ 36.394013][ T3298] udevd[3298]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 36.405680][ T3592] udevd[3592]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 36.448554][ T3298] udevd[3298]: inotify_add_watch(7, /dev/loop4p5, 10) failed: No such file or directory [ 36.449907][ T3594] udevd[3594]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 36.487831][ T3675] loop2: detected capacity change from 0 to 512 [ 36.500298][ T3675] EXT4-fs (loop2): too many log groups per flexible block group [ 36.500341][ T3675] EXT4-fs (loop2): failed to initialize mballoc (-12) [ 36.500360][ T3675] EXT4-fs (loop2): mount failed [ 36.545131][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.660270][ T3671] netlink: 24 bytes leftover after parsing attributes in process `syz.2.57'. [ 36.714420][ T3691] loop1: detected capacity change from 0 to 1024 [ 36.724639][ T3691] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 36.767007][ T3694] loop2: detected capacity change from 0 to 512 [ 36.784486][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.803788][ T3694] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 36.805542][ T3697] syz.0.66 uses obsolete (PF_INET,SOCK_PACKET) [ 36.818337][ T3694] ext4 filesystem being mounted at /14/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 36.831274][ T3701] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 36.839394][ T3701] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 36.846991][ T3701] vhci_hcd vhci_hcd.0: Device attached [ 36.860452][ T3701] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(5) [ 36.867076][ T3701] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 36.874634][ T3701] vhci_hcd vhci_hcd.0: Device attached [ 36.916744][ T3701] vhci_hcd vhci_hcd.0: pdev(1) rhport(2) sockfd(8) [ 36.923353][ T3701] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 36.930873][ T3701] vhci_hcd vhci_hcd.0: Device attached [ 36.937167][ T3701] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 36.958245][ T3701] vhci_hcd vhci_hcd.0: pdev(1) rhport(4) sockfd(12) [ 36.964878][ T3701] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 36.972601][ T3701] vhci_hcd vhci_hcd.0: Device attached [ 37.006576][ T3716] vhci_hcd vhci_hcd.0: pdev(1) rhport(5) sockfd(15) [ 37.007022][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.013214][ T3716] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 37.013307][ T3716] vhci_hcd vhci_hcd.0: Device attached [ 37.031788][ T3715] loop0: detected capacity change from 0 to 512 [ 37.054039][ T3715] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 37.064957][ T3715] EXT4-fs (loop0): orphan cleanup on readonly fs [ 37.073098][ T3715] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:517: comm syz.0.69: Block bitmap for bg 0 marked uninitialized [ 37.093250][ T3715] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 37.102475][ T3701] vhci_hcd vhci_hcd.0: pdev(1) rhport(6) sockfd(14) [ 37.102713][ T3715] EXT4-fs (loop0): 1 orphan inode deleted [ 37.109082][ T3701] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 37.109279][ T3701] vhci_hcd vhci_hcd.0: Device attached [ 37.116678][ T3715] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 37.149302][ T3716] vhci_hcd vhci_hcd.0: pdev(1) rhport(7) sockfd(18) [ 37.155959][ T3716] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 37.163634][ T3716] vhci_hcd vhci_hcd.0: Device attached [ 37.190443][ T3717] vhci_hcd: connection closed [ 37.190452][ T3711] vhci_hcd: connection closed [ 37.190740][ T51] vhci_hcd: stop threads [ 37.195345][ T3725] vhci_hcd: connection closed [ 37.199864][ T51] vhci_hcd: release socket [ 37.199881][ T51] vhci_hcd: disconnect device [ 37.200305][ T3702] vhci_hcd: connection closed [ 37.205366][ T3709] vhci_hcd: connection closed [ 37.209909][ T2958] usb 3-1: new low-speed USB device number 2 using vhci_hcd [ 37.214272][ T3704] vhci_hcd: connection closed [ 37.218266][ T3703] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 37.247535][ T3722] vhci_hcd: connection closed [ 37.248420][ T51] vhci_hcd: stop threads [ 37.257422][ T51] vhci_hcd: release socket [ 37.261888][ T51] vhci_hcd: disconnect device [ 37.268576][ T51] vhci_hcd: stop threads [ 37.272847][ T51] vhci_hcd: release socket [ 37.277293][ T51] vhci_hcd: disconnect device [ 37.283381][ T51] vhci_hcd: stop threads [ 37.283390][ T51] vhci_hcd: release socket [ 37.283401][ T51] vhci_hcd: disconnect device [ 37.283501][ T51] vhci_hcd: stop threads [ 37.283507][ T51] vhci_hcd: release socket [ 37.283516][ T51] vhci_hcd: disconnect device [ 37.283612][ T51] vhci_hcd: stop threads [ 37.283618][ T51] vhci_hcd: release socket [ 37.283626][ T51] vhci_hcd: disconnect device [ 37.283896][ T51] vhci_hcd: stop threads [ 37.327447][ T3730] pimreg: entered allmulticast mode [ 37.328546][ T51] vhci_hcd: release socket [ 37.328561][ T51] vhci_hcd: disconnect device [ 37.335603][ T3730] pimreg: left allmulticast mode [ 37.339696][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.391364][ T3736] netlink: 24 bytes leftover after parsing attributes in process `syz.4.72'. [ 37.400559][ T3736] netlink: 48 bytes leftover after parsing attributes in process `syz.4.72'. [ 37.522870][ T3741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.75'. [ 37.546039][ T3744] netlink: 4 bytes leftover after parsing attributes in process `syz.0.76'. [ 37.554918][ T3744] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 37.562384][ T3744] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 37.570113][ T3744] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 37.577545][ T3744] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 37.631304][ T3747] netlink: 24 bytes leftover after parsing attributes in process `syz.4.77'. [ 37.644277][ T3747] loop4: detected capacity change from 0 to 164 [ 37.653323][ T3747] iso9660: Unknown parameter '' [ 37.671260][ T3747] siw: device registration error -23 [ 37.705943][ T3750] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 37.863668][ T3758] lo speed is unknown, defaulting to 1000 [ 37.890864][ T3761] loop3: detected capacity change from 0 to 512 [ 38.043900][ T3765] lo speed is unknown, defaulting to 1000 [ 38.094259][ T3761] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 38.178503][ T3761] EXT4-fs (loop3): orphan cleanup on readonly fs [ 38.218906][ T3761] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:517: comm syz.3.82: Block bitmap for bg 0 marked uninitialized [ 38.288321][ T3770] loop2: detected capacity change from 0 to 512 [ 38.297273][ T3761] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 38.306545][ T3761] EXT4-fs (loop3): 1 orphan inode deleted [ 38.313600][ T3761] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 38.323006][ T3770] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.338230][ T3770] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 38.434945][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.476705][ T3783] netlink: 'syz.3.86': attribute type 3 has an invalid length. [ 38.513090][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.523981][ T3787] SELinux: security_context_str_to_sid (Eá…) failed with errno=-22 [ 38.572217][ T3789] loop4: detected capacity change from 0 to 128 [ 38.624285][ T3791] loop2: detected capacity change from 0 to 1024 [ 38.650664][ T3791] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.733607][ T3800] FAULT_INJECTION: forcing a failure. [ 38.733607][ T3800] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 38.746804][ T3800] CPU: 0 UID: 0 PID: 3800 Comm: syz.1.95 Not tainted syzkaller #0 PREEMPT(voluntary) [ 38.746831][ T3800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 38.746895][ T3800] Call Trace: [ 38.746911][ T3800] [ 38.746918][ T3800] __dump_stack+0x1d/0x30 [ 38.746941][ T3800] dump_stack_lvl+0xe8/0x140 [ 38.746959][ T3800] dump_stack+0x15/0x1b [ 38.746977][ T3800] should_fail_ex+0x265/0x280 [ 38.747063][ T3800] should_fail+0xb/0x20 [ 38.747079][ T3800] should_fail_usercopy+0x1a/0x20 [ 38.747100][ T3800] _copy_from_user+0x1c/0xb0 [ 38.747148][ T3800] memdup_user_nul+0x5f/0xe0 [ 38.747197][ T3800] sel_write_checkreqprot+0x13d/0x2d0 [ 38.747228][ T3800] ? __pfx_sel_write_checkreqprot+0x10/0x10 [ 38.747257][ T3800] vfs_write+0x266/0x960 [ 38.747329][ T3800] ? __rcu_read_unlock+0x4f/0x70 [ 38.747347][ T3800] ? __fget_files+0x184/0x1c0 [ 38.747368][ T3800] ksys_write+0xda/0x1a0 [ 38.747387][ T3800] __x64_sys_write+0x40/0x50 [ 38.747410][ T3800] x64_sys_call+0x27fe/0x2ff0 [ 38.747438][ T3800] do_syscall_64+0xd2/0x200 [ 38.747465][ T3800] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 38.747490][ T3800] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 38.747548][ T3800] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 38.747565][ T3800] RIP: 0033:0x7f67c230ec29 [ 38.747579][ T3800] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 38.747593][ T3800] RSP: 002b:00007f67c0d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 38.747614][ T3800] RAX: ffffffffffffffda RBX: 00007f67c2555fa0 RCX: 00007f67c230ec29 [ 38.747625][ T3800] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000006 [ 38.747664][ T3800] RBP: 00007f67c0d77090 R08: 0000000000000000 R09: 0000000000000000 [ 38.747677][ T3800] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 38.747689][ T3800] R13: 00007f67c2556038 R14: 00007f67c2555fa0 R15: 00007ffe49d03d78 [ 38.747709][ T3800] [ 38.952422][ T3799] lo speed is unknown, defaulting to 1000 [ 39.002522][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.022440][ T3807] loop1: detected capacity change from 0 to 128 [ 39.083931][ T3813] loop2: detected capacity change from 0 to 512 [ 39.113819][ T3813] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 39.189385][ T3808] lo speed is unknown, defaulting to 1000 [ 39.189576][ T3813] EXT4-fs (loop2): orphan cleanup on readonly fs [ 39.201836][ T3813] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:517: comm syz.2.97: Block bitmap for bg 0 marked uninitialized [ 39.215796][ T3813] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 39.225130][ T3813] EXT4-fs (loop2): 1 orphan inode deleted [ 39.231296][ T3813] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 39.358609][ T3823] lo speed is unknown, defaulting to 1000 [ 39.586553][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.675343][ T3827] loop4: detected capacity change from 0 to 128 [ 39.703759][ T3827] netlink: 76 bytes leftover after parsing attributes in process `syz.4.102'. [ 39.724250][ T3829] netlink: 24 bytes leftover after parsing attributes in process `syz.2.101'. [ 39.780216][ T29] kauditd_printk_skb: 1292 callbacks suppressed [ 39.780230][ T29] audit: type=1326 audit(1758465786.464:2106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3832 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f67c230ec29 code=0x7ffc0000 [ 39.814075][ T3312] FAT-fs (loop4): error, invalid access to FAT (entry 0x00000100) [ 39.818320][ T29] audit: type=1326 audit(1758465786.464:2107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3832 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f67c230ec29 code=0x7ffc0000 [ 39.821979][ T3312] FAT-fs (loop4): Filesystem has been set read-only [ 39.845252][ T29] audit: type=1326 audit(1758465786.464:2108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3832 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f67c230ec29 code=0x7ffc0000 [ 39.875244][ T29] audit: type=1326 audit(1758465786.464:2109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3832 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f67c230ec29 code=0x7ffc0000 [ 39.898585][ T29] audit: type=1326 audit(1758465786.464:2110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3832 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f67c230ec29 code=0x7ffc0000 [ 39.921916][ T29] audit: type=1326 audit(1758465786.464:2111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3832 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f67c230ec29 code=0x7ffc0000 [ 39.979262][ T3835] netlink: 'syz.2.106': attribute type 3 has an invalid length. [ 40.002738][ T29] audit: type=1326 audit(1758465786.584:2112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3832 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f67c230ec29 code=0x7ffc0000 [ 40.026196][ T29] audit: type=1326 audit(1758465786.604:2113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3832 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f67c230ec29 code=0x7ffc0000 [ 40.049673][ T29] audit: type=1326 audit(1758465786.604:2114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3832 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f67c230ec29 code=0x7ffc0000 [ 40.073198][ T29] audit: type=1326 audit(1758465786.604:2115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3832 comm="syz.1.105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f67c230ec29 code=0x7ffc0000 [ 40.129070][ T3841] loop4: detected capacity change from 0 to 1024 [ 40.162137][ T3845] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 40.175308][ T3841] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.202113][ T3833] netlink: 8 bytes leftover after parsing attributes in process `syz.1.105'. [ 40.248625][ T3312] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.272745][ T3851] loop0: detected capacity change from 0 to 512 [ 40.280973][ T3851] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 40.305523][ T3851] EXT4-fs (loop0): orphan cleanup on readonly fs [ 40.332675][ T3853] loop4: detected capacity change from 0 to 1024 [ 40.341745][ T3851] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:517: comm syz.0.111: Block bitmap for bg 0 marked uninitialized [ 40.376311][ T3853] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.396229][ T3851] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 40.405622][ T3851] EXT4-fs (loop0): 1 orphan inode deleted [ 40.416062][ T3858] process 'syz.3.113' launched '/dev/fd/4' with NULL argv: empty string added [ 40.426679][ T3851] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 40.428328][ T3858] netlink: 44 bytes leftover after parsing attributes in process `syz.3.113'. [ 40.461678][ T3858] loop3: detected capacity change from 0 to 164 [ 40.469968][ T3858] Unable to read rock-ridge attributes [ 40.472375][ T3858] veth0: entered promiscuous mode [ 40.486426][ T3857] veth0: left promiscuous mode [ 40.520376][ T3312] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.539722][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.630155][ T3875] netlink: 'syz.1.117': attribute type 3 has an invalid length. [ 40.682685][ T3873] loop0: detected capacity change from 0 to 512 [ 40.701125][ T3873] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.713873][ T3873] ext4 filesystem being mounted at /28/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 40.802468][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.841154][ T3891] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 40.875097][ T3887] ref_ctr increment failed for inode: 0x7b offset: 0x5 ref_ctr_offset: 0x1000 of mm: 0xffff88810a594ac0 [ 41.157425][ T3899] lo speed is unknown, defaulting to 1000 [ 41.458044][ T3901] loop3: detected capacity change from 0 to 164 [ 41.466607][ T3901] iso9660: Unknown parameter '' [ 41.514574][ T3901] siw: device registration error -23 [ 41.707312][ T3905] loop3: detected capacity change from 0 to 1764 [ 41.748056][ T3907] random: crng reseeded on system resumption [ 41.761292][ T3911] Zero length message leads to an empty skb [ 41.845325][ T3914] netlink: 'syz.1.129': attribute type 3 has an invalid length. [ 41.900280][ T3926] loop1: detected capacity change from 0 to 512 [ 41.924188][ T3926] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 41.970305][ T3926] EXT4-fs (loop1): orphan cleanup on readonly fs [ 41.976985][ T3926] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:517: comm syz.1.131: Block bitmap for bg 0 marked uninitialized [ 41.991335][ T3926] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 42.000690][ T3926] EXT4-fs (loop1): 1 orphan inode deleted [ 42.006833][ T3926] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 42.051460][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.074866][ T3937] loop1: detected capacity change from 0 to 1024 [ 42.182460][ T3937] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.210372][ T3941] lo speed is unknown, defaulting to 1000 [ 42.352831][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.518403][ T2958] usb 3-1: enqueue for inactive port 0 [ 42.523942][ T2958] usb 3-1: enqueue for inactive port 0 [ 42.564694][ T3943] loop1: detected capacity change from 0 to 512 [ 42.583098][ T3943] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.599342][ T3943] ext4 filesystem being mounted at /25/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.601892][ T2958] vhci_hcd: vhci_device speed not set [ 42.618724][ T3948] loop4: detected capacity change from 0 to 512 [ 42.637259][ T3948] netlink: 'wg1': attribute type 4 has an invalid length. [ 42.733108][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.807630][ T3964] loop4: detected capacity change from 0 to 512 [ 42.815828][ T3964] EXT4-fs: Ignoring removed mblk_io_submit option [ 42.823734][ T3964] EXT4-fs: Ignoring removed nomblk_io_submit option [ 42.867661][ T3970] loop0: detected capacity change from 0 to 512 [ 42.875294][ T3970] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 42.886022][ T3969] __nla_validate_parse: 2 callbacks suppressed [ 42.886036][ T3969] netlink: 8 bytes leftover after parsing attributes in process `syz.3.145'. [ 42.912483][ T3964] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 42.918659][ T3970] EXT4-fs (loop0): orphan cleanup on readonly fs [ 42.920994][ T3964] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 42.937730][ T3970] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:517: comm syz.0.144: Block bitmap for bg 0 marked uninitialized [ 42.951696][ T3970] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 42.952507][ T3964] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4183: comm syz.4.142: Allocating blocks 41-42 which overlap fs metadata [ 42.975413][ T3964] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4183: comm syz.4.142: Allocating blocks 41-42 which overlap fs metadata [ 42.976449][ T3970] EXT4-fs (loop0): 1 orphan inode deleted [ 42.997154][ T3970] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 43.006621][ T3977] netlink: 24 bytes leftover after parsing attributes in process `syz.3.147'. [ 43.010210][ T3964] EXT4-fs error (device loop4): ext4_acquire_dquot:6937: comm syz.4.142: Failed to acquire dquot type 1 [ 43.030228][ T3964] EXT4-fs error (device loop4): mb_free_blocks:2017: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 43.052962][ T3964] EXT4-fs error (device loop4): ext4_do_update_inode:5653: inode #12: comm syz.4.142: corrupted inode contents [ 43.065340][ T3964] EXT4-fs error (device loop4): ext4_dirty_inode:6538: inode #12: comm syz.4.142: mark_inode_dirty error [ 43.079339][ T3964] EXT4-fs error (device loop4): ext4_do_update_inode:5653: inode #12: comm syz.4.142: corrupted inode contents [ 43.102227][ T3964] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #12: comm syz.4.142: mark_inode_dirty error [ 43.113734][ T3964] EXT4-fs error (device loop4): ext4_do_update_inode:5653: inode #12: comm syz.4.142: corrupted inode contents [ 43.165489][ T3964] EXT4-fs error (device loop4) in ext4_orphan_del:305: Corrupt filesystem [ 43.188201][ T3964] EXT4-fs error (device loop4): ext4_do_update_inode:5653: inode #12: comm syz.4.142: corrupted inode contents [ 43.190506][ T3984] netlink: 'syz.2.150': attribute type 3 has an invalid length. [ 43.208117][ T3964] EXT4-fs error (device loop4): ext4_truncate:4666: inode #12: comm syz.4.142: mark_inode_dirty error [ 43.219560][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.235146][ T3986] loop3: detected capacity change from 0 to 512 [ 43.241648][ T3964] EXT4-fs error (device loop4) in ext4_process_orphan:347: Corrupt filesystem [ 43.259529][ T3988] FAULT_INJECTION: forcing a failure. [ 43.259529][ T3988] name failslab, interval 1, probability 0, space 0, times 0 [ 43.272251][ T3988] CPU: 1 UID: 0 PID: 3988 Comm: syz.0.151 Not tainted syzkaller #0 PREEMPT(voluntary) [ 43.272346][ T3988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 43.272358][ T3988] Call Trace: [ 43.272366][ T3988] [ 43.272374][ T3988] __dump_stack+0x1d/0x30 [ 43.272448][ T3988] dump_stack_lvl+0xe8/0x140 [ 43.272464][ T3988] dump_stack+0x15/0x1b [ 43.272479][ T3988] should_fail_ex+0x265/0x280 [ 43.272500][ T3988] should_failslab+0x8c/0xb0 [ 43.272521][ T3988] __kmalloc_node_track_caller_noprof+0xa4/0x410 [ 43.272591][ T3988] ? sidtab_sid2str_get+0xa0/0x130 [ 43.272614][ T3988] kmemdup_noprof+0x2b/0x70 [ 43.272639][ T3988] sidtab_sid2str_get+0xa0/0x130 [ 43.272706][ T3988] security_sid_to_context_core+0x1eb/0x2e0 [ 43.272725][ T3988] security_sid_to_context+0x27/0x40 [ 43.272742][ T3988] selinux_lsmprop_to_secctx+0x67/0xf0 [ 43.272762][ T3988] security_lsmprop_to_secctx+0x43/0x80 [ 43.272838][ T3988] audit_log_task_context+0x77/0x190 [ 43.272868][ T3988] audit_log_task+0xf4/0x250 [ 43.272892][ T3988] audit_seccomp+0x61/0x100 [ 43.272977][ T3988] ? __seccomp_filter+0x68c/0x10d0 [ 43.272996][ T3988] __seccomp_filter+0x69d/0x10d0 [ 43.273016][ T3988] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 43.273098][ T3988] ? vfs_write+0x7e8/0x960 [ 43.273116][ T3988] ? bpf_trace_run2+0x124/0x1c0 [ 43.273199][ T3988] __secure_computing+0x82/0x150 [ 43.273224][ T3988] syscall_trace_enter+0xcf/0x1e0 [ 43.273296][ T3988] do_syscall_64+0xac/0x200 [ 43.273324][ T3988] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 43.273346][ T3988] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 43.273432][ T3988] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 43.273453][ T3988] RIP: 0033:0x7f5e32fbec29 [ 43.273469][ T3988] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 43.273486][ T3988] RSP: 002b:00007f5e31a27038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 43.273535][ T3988] RAX: ffffffffffffffda RBX: 00007f5e33205fa0 RCX: 00007f5e32fbec29 [ 43.273559][ T3988] RDX: 0000200000000000 RSI: 00000000c08c5336 RDI: 0000000000000004 [ 43.273572][ T3988] RBP: 00007f5e31a27090 R08: 0000000000000000 R09: 0000000000000000 [ 43.273584][ T3988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 43.273596][ T3988] R13: 00007f5e33206038 R14: 00007f5e33205fa0 R15: 00007ffd8382cd08 [ 43.273613][ T3988] [ 43.274399][ T3964] EXT4-fs (loop4): 1 truncate cleaned up [ 43.298791][ T3986] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.301284][ T3964] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.305046][ T3986] ext4 filesystem being mounted at /26/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 43.344660][ T3964] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 43.354707][ T3986] FAULT_INJECTION: forcing a failure. [ 43.354707][ T3986] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 43.576683][ T3986] CPU: 1 UID: 0 PID: 3986 Comm: syz.3.152 Not tainted syzkaller #0 PREEMPT(voluntary) [ 43.576763][ T3986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 43.576771][ T3986] Call Trace: [ 43.576775][ T3986] [ 43.576781][ T3986] __dump_stack+0x1d/0x30 [ 43.576848][ T3986] dump_stack_lvl+0xe8/0x140 [ 43.576859][ T3986] dump_stack+0x15/0x1b [ 43.576895][ T3986] should_fail_ex+0x265/0x280 [ 43.576910][ T3986] should_fail+0xb/0x20 [ 43.576920][ T3986] should_fail_usercopy+0x1a/0x20 [ 43.576967][ T3986] _copy_from_iter+0xd2/0xe80 [ 43.576993][ T3986] ? __build_skb_around+0x1a0/0x200 [ 43.577015][ T3986] ? __alloc_skb+0x223/0x320 [ 43.577036][ T3986] netlink_sendmsg+0x471/0x6b0 [ 43.577064][ T3986] ? __pfx_netlink_sendmsg+0x10/0x10 [ 43.577163][ T3986] __sock_sendmsg+0x142/0x180 [ 43.577209][ T3986] ____sys_sendmsg+0x31e/0x4e0 [ 43.577225][ T3986] ___sys_sendmsg+0x17b/0x1d0 [ 43.577272][ T3986] __x64_sys_sendmsg+0xd4/0x160 [ 43.577289][ T3986] x64_sys_call+0x191e/0x2ff0 [ 43.577370][ T3986] do_syscall_64+0xd2/0x200 [ 43.577389][ T3986] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 43.577402][ T3986] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 43.577485][ T3986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 43.577497][ T3986] RIP: 0033:0x7f7dccc7ec29 [ 43.577507][ T3986] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 43.577517][ T3986] RSP: 002b:00007f7dcb6e7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 43.577594][ T3986] RAX: ffffffffffffffda RBX: 00007f7dccec5fa0 RCX: 00007f7dccc7ec29 [ 43.577601][ T3986] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 43.577608][ T3986] RBP: 00007f7dcb6e7090 R08: 0000000000000000 R09: 0000000000000000 [ 43.577615][ T3986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 43.577660][ T3986] R13: 00007f7dccec6038 R14: 00007f7dccec5fa0 R15: 00007ffdaa524be8 [ 43.577671][ T3986] [ 43.577834][ T3964] EXT4-fs (loop4): changing journal_checksum during remount not supported; ignoring [ 43.786857][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.796307][ T3964] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 43.905216][ T4007] netlink: 24 bytes leftover after parsing attributes in process `syz.2.158'. [ 43.940775][ T4002] usb usb8: usbfs: process 4002 (syz.0.157) did not claim interface 0 before use [ 44.814483][ T3964] syz.4.142 (3964) used greatest stack depth: 10304 bytes left [ 44.840722][ T3312] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.881166][ T29] kauditd_printk_skb: 522 callbacks suppressed [ 44.881182][ T29] audit: type=1326 audit(1758465791.564:2633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4017 comm="syz.2.160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 44.910888][ T29] audit: type=1326 audit(1758465791.564:2634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4017 comm="syz.2.160" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 45.076851][ T29] audit: type=1326 audit(1758465791.734:2635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4035 comm="syz.0.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e32fbec29 code=0x7ffc0000 [ 45.100216][ T29] audit: type=1326 audit(1758465791.744:2636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4037 comm="syz.2.167" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 45.123512][ T29] audit: type=1326 audit(1758465791.744:2637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4037 comm="syz.2.167" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 45.146804][ T29] audit: type=1326 audit(1758465791.744:2638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4035 comm="syz.0.166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=271 compat=0 ip=0x7f5e32fbec29 code=0x7ffc0000 [ 45.170124][ T29] audit: type=1326 audit(1758465791.744:2639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4037 comm="syz.2.167" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 45.193458][ T29] audit: type=1326 audit(1758465791.744:2640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4037 comm="syz.2.167" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 45.216787][ T29] audit: type=1326 audit(1758465791.744:2641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4037 comm="syz.2.167" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 45.240142][ T29] audit: type=1326 audit(1758465791.744:2642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4037 comm="syz.2.167" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7f0fdfc0ec29 code=0x7ffc0000 [ 45.297079][ T4041] netlink: 'syz.4.164': attribute type 3 has an invalid length. [ 45.365177][ T4046] FAULT_INJECTION: forcing a failure. [ 45.365177][ T4046] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 45.378419][ T4046] CPU: 0 UID: 0 PID: 4046 Comm: syz.4.169 Not tainted syzkaller #0 PREEMPT(voluntary) [ 45.378448][ T4046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 45.378460][ T4046] Call Trace: [ 45.378467][ T4046] [ 45.378475][ T4046] __dump_stack+0x1d/0x30 [ 45.378507][ T4046] dump_stack_lvl+0xe8/0x140 [ 45.378526][ T4046] dump_stack+0x15/0x1b [ 45.378540][ T4046] should_fail_ex+0x265/0x280 [ 45.378560][ T4046] should_fail+0xb/0x20 [ 45.378577][ T4046] should_fail_usercopy+0x1a/0x20 [ 45.378648][ T4046] _copy_from_user+0x1c/0xb0 [ 45.378673][ T4046] simple_transaction_get+0xe2/0x130 [ 45.378697][ T4046] selinux_transaction_write+0x9d/0x110 [ 45.378720][ T4046] ? __pfx_selinux_transaction_write+0x10/0x10 [ 45.378819][ T4046] vfs_write+0x266/0x960 [ 45.378841][ T4046] ? __rcu_read_unlock+0x4f/0x70 [ 45.378863][ T4046] ? __fget_files+0x184/0x1c0 [ 45.378954][ T4046] ksys_write+0xda/0x1a0 [ 45.379194][ T4046] __x64_sys_write+0x40/0x50 [ 45.379217][ T4046] x64_sys_call+0x27fe/0x2ff0 [ 45.379239][ T4046] do_syscall_64+0xd2/0x200 [ 45.379309][ T4046] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 45.379333][ T4046] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 45.379408][ T4046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.379427][ T4046] RIP: 0033:0x7fe09fe1ec29 [ 45.379512][ T4046] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 45.379525][ T4046] RSP: 002b:00007fe09e887038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 45.379545][ T4046] RAX: ffffffffffffffda RBX: 00007fe0a0065fa0 RCX: 00007fe09fe1ec29 [ 45.379558][ T4046] RDX: 000000000000004a RSI: 0000200000000540 RDI: 0000000000000003 [ 45.379571][ T4046] RBP: 00007fe09e887090 R08: 0000000000000000 R09: 0000000000000000 [ 45.379583][ T4046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 45.379638][ T4046] R13: 00007fe0a0066038 R14: 00007fe0a0065fa0 R15: 00007ffed47a3dc8 [ 45.379653][ T4046] [ 45.765458][ T4049] loop4: detected capacity change from 0 to 512 [ 45.796068][ T4054] FAULT_INJECTION: forcing a failure. [ 45.796068][ T4054] name failslab, interval 1, probability 0, space 0, times 0 [ 45.808792][ T4054] CPU: 1 UID: 0 PID: 4054 Comm: syz.1.172 Not tainted syzkaller #0 PREEMPT(voluntary) [ 45.808819][ T4054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 45.808829][ T4054] Call Trace: [ 45.808849][ T4054] [ 45.808857][ T4054] __dump_stack+0x1d/0x30 [ 45.808877][ T4054] dump_stack_lvl+0xe8/0x140 [ 45.808893][ T4054] dump_stack+0x15/0x1b [ 45.808942][ T4054] should_fail_ex+0x265/0x280 [ 45.808972][ T4054] should_failslab+0x8c/0xb0 [ 45.808993][ T4054] kmem_cache_alloc_node_noprof+0x57/0x320 [ 45.809092][ T4054] ? __alloc_skb+0x101/0x320 [ 45.809111][ T4054] __alloc_skb+0x101/0x320 [ 45.809133][ T4054] netlink_alloc_large_skb+0xba/0xf0 [ 45.809154][ T4054] netlink_sendmsg+0x3cf/0x6b0 [ 45.809229][ T4054] ? __pfx_netlink_sendmsg+0x10/0x10 [ 45.809254][ T4054] __sock_sendmsg+0x142/0x180 [ 45.809285][ T4054] ____sys_sendmsg+0x31e/0x4e0 [ 45.809311][ T4054] ___sys_sendmsg+0x17b/0x1d0 [ 45.809407][ T4054] __x64_sys_sendmsg+0xd4/0x160 [ 45.809433][ T4054] x64_sys_call+0x191e/0x2ff0 [ 45.809451][ T4054] do_syscall_64+0xd2/0x200 [ 45.809477][ T4054] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 45.809500][ T4054] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 45.809528][ T4054] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.809557][ T4054] RIP: 0033:0x7f67c230ec29 [ 45.809570][ T4054] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 45.809584][ T4054] RSP: 002b:00007f67c0d77038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 45.809601][ T4054] RAX: ffffffffffffffda RBX: 00007f67c2555fa0 RCX: 00007f67c230ec29 [ 45.809614][ T4054] RDX: 0000000004040000 RSI: 0000200000000100 RDI: 0000000000000007 [ 45.809627][ T4054] RBP: 00007f67c0d77090 R08: 0000000000000000 R09: 0000000000000000 [ 45.809682][ T4054] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 45.809692][ T4054] R13: 00007f67c2556038 R14: 00007f67c2555fa0 R15: 00007ffe49d03d78 [ 45.809708][ T4054] [ 46.077707][ T4056] lo speed is unknown, defaulting to 1000 [ 46.271803][ T4060] loop3: detected capacity change from 0 to 1024 [ 46.291904][ T4062] loop0: detected capacity change from 0 to 512 [ 46.307032][ T4062] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 46.319734][ T4062] EXT4-fs (loop0): orphan cleanup on readonly fs [ 46.331470][ T4062] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:517: comm syz.0.175: Block bitmap for bg 0 marked uninitialized [ 46.344853][ T4062] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 46.360216][ T4060] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.372731][ T4049] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.395169][ T4062] EXT4-fs (loop0): 1 orphan inode deleted [ 46.409030][ T4071] loop2: detected capacity change from 0 to 512 [ 46.418959][ T4049] ext4 filesystem being mounted at /39/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 46.431540][ T4062] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 46.444101][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.464126][ T4071] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 46.495534][ T4075] netlink: 'syz.3.179': attribute type 3 has an invalid length. [ 46.499566][ T4071] EXT4-fs (loop2): orphan cleanup on readonly fs [ 46.499678][ T4071] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:517: comm syz.2.177: Block bitmap for bg 0 marked uninitialized [ 46.502612][ T4071] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6657: Corrupt filesystem [ 46.560255][ T4071] EXT4-fs (loop2): 1 orphan inode deleted [ 46.566471][ T4071] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 46.592560][ T3312] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.614604][ T4086] netlink: 24 bytes leftover after parsing attributes in process `syz.1.184'. [ 46.661209][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.694185][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.717084][ T4095] loop3: detected capacity change from 0 to 512 [ 46.724219][ T4097] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 46.737755][ T4095] EXT4-fs: Ignoring removed nobh option [ 46.759988][ T4100] loop1: detected capacity change from 0 to 512 [ 46.775953][ T4095] EXT4-fs (loop3): orphan cleanup on readonly fs [ 46.796375][ T4095] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 46.804688][ T4095] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 46.819263][ T4095] EXT4-fs error (device loop3): ext4_clear_blocks:876: inode #13: comm syz.3.188: attempt to clear invalid blocks 2 len 1 [ 46.832216][ T4100] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 46.845349][ T4100] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 46.863479][ T4095] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #13: comm syz.3.188: invalid indirect mapped block 1819239214 (level 0) [ 46.893300][ T4100] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2848: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 46.913464][ T4100] EXT4-fs (loop1): 1 truncate cleaned up [ 46.916411][ T4095] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #13: comm syz.3.188: invalid indirect mapped block 1819239214 (level 1) [ 46.921439][ T4100] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.962102][ T4095] EXT4-fs (loop3): 1 truncate cleaned up [ 46.968099][ T4095] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 46.999044][ T4100] netlink: 48 bytes leftover after parsing attributes in process `syz.1.190'. [ 47.017431][ T4100] netlink: 4 bytes leftover after parsing attributes in process `syz.1.190'. [ 47.050066][ T4095] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 47.070607][ T4095] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 47.089546][ T4100] hsr_slave_1 (unregistering): left promiscuous mode [ 47.101911][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.125707][ T4121] netlink: 'syz.0.194': attribute type 13 has an invalid length. [ 47.229735][ T4124] lo speed is unknown, defaulting to 1000 [ 47.378268][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.575871][ T4133] loop3: detected capacity change from 0 to 1024 [ 47.604397][ T4133] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.663001][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.673358][ T4143] loop0: detected capacity change from 0 to 1024 [ 47.680312][ T4143] EXT4-fs: Ignoring removed nobh option [ 47.734367][ T4143] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 47.781303][ T4143] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #11: comm syz.0.203: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 47.802226][ T4143] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.203: couldn't read orphan inode 11 (err -117) [ 47.847816][ T4158] netlink: 24 bytes leftover after parsing attributes in process `syz.2.208'. [ 47.856344][ T4143] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 48.021086][ T4167] lo speed is unknown, defaulting to 1000 [ 48.251185][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.317595][ T4179] loop0: detected capacity change from 0 to 1024 [ 48.333429][ T4179] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 48.393652][ T4190] pim6reg1: entered promiscuous mode [ 48.399013][ T4190] pim6reg1: entered allmulticast mode [ 48.408155][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.419463][ T4189] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.455024][ T4196] netlink: 24 bytes leftover after parsing attributes in process `syz.0.219'. [ 48.467342][ T4197] netlink: 168 bytes leftover after parsing attributes in process `syz.2.217'. [ 48.477705][ T4189] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.557241][ T4189] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.579515][ T4209] netlink: 4 bytes leftover after parsing attributes in process `syz.0.220'. [ 48.590454][ T4211] hub 6-0:1.0: USB hub found [ 48.595145][ T4211] hub 6-0:1.0: 8 ports detected [ 48.642487][ T4218] loop1: detected capacity change from 0 to 512 [ 48.674392][ T4189] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 48.778357][ T4218] EXT4-fs warning (device loop1): ext4_xattr_inode_get:556: inode #11: comm syz.1.224: EA inode hash validation failed [ 48.805801][ T4222] SELinux: failed to load policy [ 48.812168][ T4218] EXT4-fs error (device loop1): ext4_do_update_inode:5653: inode #15: comm syz.1.224: corrupted inode contents [ 48.829000][ T4218] EXT4-fs error (device loop1): ext4_dirty_inode:6538: inode #15: comm syz.1.224: mark_inode_dirty error [ 48.842152][ T4218] EXT4-fs error (device loop1): ext4_do_update_inode:5653: inode #15: comm syz.1.224: corrupted inode contents [ 48.854311][ T4218] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2991: inode #15: comm syz.1.224: mark_inode_dirty error [ 48.868748][ T4218] EXT4-fs error (device loop1): ext4_xattr_delete_inode:2994: inode #15: comm syz.1.224: mark inode dirty (error -117) [ 48.882308][ T4218] EXT4-fs warning (device loop1): ext4_evict_inode:274: xattr delete (err -117) [ 48.893065][ T1973] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.906786][ T1973] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.917605][ T4222] lo speed is unknown, defaulting to 1000 [ 48.925653][ T1973] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.936136][ T4218] EXT4-fs (loop1): 1 orphan inode deleted [ 48.942556][ T4218] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 48.964773][ T3490] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.987222][ T4229] loop3: detected capacity change from 0 to 1024 [ 49.003219][ T4218] netlink: 'syz.1.224': attribute type 10 has an invalid length. [ 49.024993][ T4229] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.063254][ T4218] team0: Port device dummy0 added [ 49.091122][ T4238] netlink: 24 bytes leftover after parsing attributes in process `syz.2.231'. [ 49.183541][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.235343][ T4252] pim6reg1: entered promiscuous mode [ 49.240742][ T4252] pim6reg1: entered allmulticast mode [ 49.272794][ T4255] @0Ù: renamed from bond_slave_1 (while UP) [ 49.320710][ T4257] lo speed is unknown, defaulting to 1000 [ 49.425104][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.534119][ T4246] loop4: detected capacity change from 0 to 512 [ 49.605955][ T4246] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.658944][ T4246] ext4 filesystem being mounted at /50/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 49.702116][ T4265] loop3: detected capacity change from 0 to 512 [ 49.861914][ T2995] ================================================================== [ 49.870071][ T2995] BUG: KCSAN: data-race in d_delete / step_into [ 49.876347][ T2995] [ 49.878669][ T2995] read-write to 0xffff88810729b000 of 4 bytes by task 3594 on cpu 0: [ 49.886719][ T2995] d_delete+0x15a/0x180 [ 49.890905][ T2995] d_delete_notify+0x32/0x100 [ 49.895571][ T2995] vfs_unlink+0x30b/0x420 [ 49.899903][ T2995] do_unlinkat+0x24e/0x480 [ 49.904323][ T2995] __x64_sys_unlink+0x2e/0x40 [ 49.909012][ T2995] x64_sys_call+0x2dc0/0x2ff0 [ 49.913712][ T2995] do_syscall_64+0xd2/0x200 [ 49.918272][ T2995] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 49.924165][ T2995] [ 49.926488][ T2995] read to 0xffff88810729b000 of 4 bytes by task 2995 on cpu 1: [ 49.934020][ T2995] step_into+0xe3/0x820 [ 49.938192][ T2995] walk_component+0x162/0x220 [ 49.942873][ T2995] path_lookupat+0xfe/0x2a0 [ 49.947382][ T2995] filename_lookup+0x147/0x340 [ 49.952136][ T2995] do_readlinkat+0x7d/0x320 [ 49.956623][ T2995] __x64_sys_readlink+0x47/0x60 [ 49.961566][ T2995] x64_sys_call+0x28da/0x2ff0 [ 49.966242][ T2995] do_syscall_64+0xd2/0x200 [ 49.970742][ T2995] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 49.976627][ T2995] [ 49.978937][ T2995] value changed: 0x00300180 -> 0x00004080 [ 49.984632][ T2995] [ 49.986934][ T2995] Reported by Kernel Concurrency Sanitizer on: [ 49.993063][ T2995] CPU: 1 UID: 0 PID: 2995 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) [ 50.002331][ T2995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 50.012370][ T2995] ================================================================== [ 50.032421][ T4274] loop3: detected capacity change from 0 to 1024 [ 50.039319][ T4274] EXT4-fs: Ignoring removed orlov option