last executing test programs: 2.12715657s ago: executing program 1 (id=1390): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f00000009c0)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2], 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x42, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r3}, 0x10) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000004c0)={0x5c, 0x12, 0x0, 0x70bd26, 0x25dfdbfc, {0x8, 0x6, 0xa, 0x1, {0x4e24, 0x4e23, [0xfffffff8, 0x3, 0x6], [0x400, 0x9, 0x8, 0x9], 0x0, [0x1, 0x3]}, 0x4, 0xb}, [@INET_DIAG_REQ_BYTECODE={0xd, 0x1, "f102dcf29effae15cd"}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x6, &(0x7f0000000b00)=ANY=[@ANYBLOB="180000000010000000000000000000001800000004000000000000000700000085100000fbffffff186400000300000000000000020000009500000000000000dd5e03ec005856153c3a7d50f940abc8bb98a571217f1636e0a755482f4d54802ec3d12c0587a8cfd4182d9a22de65feb9fb0ce8b5bc44821e73e3df6bb70c7d3358e04209461aaf3f60d50c58af6341631854fa71088ab38dfc216390adbab34942d1731b34f383e7303544a34ee3723e85bb59ee37d8037c0f116b2c2708a623c09961ece3b5bdd0c84a276c2d682a33e5159f14f2443294e625dfeb6a83654e562ca288ca0450ec365d0356baea99ee6130fafebf00efe6072237645b9d461b7b678762afc76de0e124d44bd326b7c62d05f69a5bb494af1c12d4be6f252f3b2c3b1b8bd99145376a0ef42d53d2da1a7087948679db1793ea84a30e76429462d10b68e10f4979c37b15515788ac5f45eda89e68754093987d8a67d395d6729b7fd1282723a06fcb029577eb18a80e0d4b8b267f6d770a154c82b74794afaae3f40371ba9359a3922eba5f35e61d15ec5a797f8c3861eb0f2241c3fc691a7785e6dad762aa0dc7f4d2a57d7cecaf032e1a3a655e3e41a30a63994ffeb175fa4973f9114c74d92b370c011b4783804538c84adb59c0666113017282fd4349f7fd6ef81cb8392e2c1f7cd3a51de6616960d4309eb62871bfdf11ae7c76dc9a6d52ef00fbca160285c4a690ae0b92db1c6d1a990a192f4f166f9c8c95f8215e8f8365f1f94e445153e845decd54de2bbeae4d7673dfde8b66d889d0cd9ce118747aa69545a4aa8f7991a16dc664d1f0885090a47769909bed8cde1a2c95152e1d15f557dea81b5f57995dd1e38a42c4ebf18fdbe14ccd3ecb7b65de0af024f3b397e34d5986f6cdd7f38b6f6527f17ec2870d6cdfb7333f6f96432a2ceca38b6e83a737c33b6116b10a7c35e8bbece3d67ee77db22583751aa5cc3109563c53ba14c08bd5ae3790bc645dab9bd440a9d0"], &(0x7f0000000080)='syzkaller\x00', 0x3, 0x27, &(0x7f0000000000)=""/114}, 0xa8) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000080)={0x0, 0x200}, &(0x7f00000000c0)=0x8) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x29, 0xf4, 0x40, 0xce, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @loopback, 0x787, 0x40, 0x5, 0x9}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000180)={'syztnl1\x00', &(0x7f0000000100)={'ip6_vti0\x00', r5, 0x2f, 0xf, 0x9, 0x6, 0x1, @local, @private2, 0x1, 0x20, 0x9, 0x7}}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000010000000a000000"], 0x48) getpeername$inet(r4, 0x0, &(0x7f0000000580)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000070000000850000000f00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000500)='rxrpc_notify_socket\x00', r7, 0x0, 0x1}, 0x18) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r1, 0x40189429, &(0x7f00000005c0)={0x1, 0x3c, 0x9955}) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x3}, 0x8) sendto$inet6(r6, &(0x7f0000000400)="aa", 0x1, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x3f66400, @dev={0xfe, 0x80, '\x00', 0x6}, 0x3}, 0x1c) shutdown(r6, 0x1) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r8, 0x5607, 0x2c) ioctl$VT_RESIZE(r8, 0x5609, &(0x7f0000000200)={0x6, 0x6, 0x1}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x300000c, 0x50032, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="6c0000000206030000000000000000000700000705000100070000000900020073797a31000000000c00078005001500030000000500050002000000050004000100000011000300686173683a6970"], 0x6c}, 0x1, 0x0, 0x0, 0x4000}, 0x20004012) openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x20) 1.62842718s ago: executing program 3 (id=1402): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000300), 0x20c0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) r3 = syz_io_uring_setup(0x400014fe, &(0x7f0000000640)={0x0, 0x100cf74, 0x0, 0x103, 0x4f}, &(0x7f0000000380)=0x0, &(0x7f0000000340)=0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELOBJ={0x110, 0x14, 0xa, 0x401, 0x0, 0x0, {0x3, 0x0, 0x8}, [@NFTA_OBJ_USERDATA={0xf0, 0x8, "a7f0b3e72c962503c235f70aba1c3096f590fea08026678baeeb4de6cc39c93117b398496b49a257fe6381e105444fdc19019501db5d0379dbfc02d734f24bf78c4c256ac2d62ce6d948bb5338484c81d5be29b798c69fe21815bc58f59bb71c576b83c117fbd5d1c370b72139fd565aa13ecbda4cefa70356ff81dc996cce1ffa60c4827c5c5c7d7b3dba8ce081ceeb19996d183ba4cdcf787a7d0da0438e125de122b4df7b8d6f45feed8707d572b04679f7fea8bc39b021431ed5a92758871cb24b162965b02d5f067da4861fdc78f461a638a85071b8a76413d7b462f7199720221fa843ea8d1913a8cb"}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELSET={0x28, 0xb, 0xa, 0x201, 0x0, 0x0, {0x5}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xe8}]}, @NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x4}, [@NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_COMPAT={0x34, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x84}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x32}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0xf4}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x32}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x2e}]}]}, @NFT_MSG_DELFLOWTABLE={0x1b8, 0x18, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0x170, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ip_vti0\x00'}, {0x14, 0x1, 'wg1\x00'}, {0x14, 0x1, 'vlan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6f7}, @NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve1\x00'}, {0x14, 0x1, 'wlan0\x00'}, {0x14, 0x1, 'nicvf0\x00'}, {0x14, 0x1, 'macvlan0\x00'}, {0x14, 0x1, 'vlan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_FLOWTABLE_HOOK_DEVS={0xa4, 0x3, 0x0, 0x1, [{0x14, 0x1, 'bond0\x00'}, {0x14, 0x1, 'ip6gretap0\x00'}, {0x14, 0x1, 'lo\x00'}, {0x14, 0x1, 'wg0\x00'}, {0x14, 0x1, 'lo\x00'}, {0x14, 0x1, 'veth1_vlan\x00'}, {0x14, 0x1, 'dvmrp1\x00'}, {0x14, 0x1, 'veth1_to_team\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}, @NFT_MSG_DELRULE={0x1c, 0x8, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x398}, 0x1, 0x0, 0x0, 0x400a004}, 0x24000814) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x6, &(0x7f0000000400)=0xd, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000280)=@IORING_OP_OPENAT={0x12, 0xc, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000440)='./file0\x00', 0x1, 0x2, 0x12345}) io_uring_enter(r3, 0x1c3a, 0x106a, 0x22, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000004c0)='mm_page_free\x00', r1}, 0x10) r6 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) ioctl$EVIOCGBITSND(r6, 0x40044591, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000340)='.\x00', &(0x7f0000000040), 0x800000, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r6}}) listen(r7, 0xe3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x4008032, 0xffffffffffffffff, 0xd06d000) r8 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r8, 0x400, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r9, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r10, 0x0, 0x10007ffffffff}, 0x18) close(r8) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) 1.332629529s ago: executing program 3 (id=1404): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r0, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000540)='fib6_table_lookup\x00', r1}, 0x10) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r2, 0x0, 0x5c4, 0x404c844, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @local}, 0x1c) 1.288667583s ago: executing program 3 (id=1406): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0700000004000000000100000100000028"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0x8, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ec0)={&(0x7f0000000bc0)='kfree\x00', r2, 0x0, 0xfffffffffffffff4}, 0x18) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x4e8, 0x0, 0x11, 0x148, 0x340, 0x0, 0x450, 0x2a8, 0x2a8, 0x450, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x81}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x4f, 0x7, "72f6daeff0a9c6294e211d2d88fe6dcff5d0e552201da3b7a1fdb30dcb59"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x548) 1.258665936s ago: executing program 1 (id=1407): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{}, &(0x7f0000000380), &(0x7f00000003c0)=r1}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="180100000100a7d9000000000020b200850000007b00000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=ANY=[@ANYBLOB="12000000030000000400000002"], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[], 0x78}, 0x1, 0x0, 0x0, 0x4008850}, 0x24000000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="80678199080200e104000008008447e7"], 0x28}}, 0x0) 1.238175448s ago: executing program 3 (id=1408): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000840)=ANY=[@ANYBLOB, @ANYRES32], 0x0}, 0x94) r2 = syz_io_uring_setup(0x503f, 0x0, 0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000300)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x2, 0xa3d8, &(0x7f00000005c0)=[{&(0x7f0000000240)="5db5bd", 0x3}], 0x81, 0x8, 0x1, {0x2}}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x94) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0xa, [@volatile={0xe, 0x0, 0x0, 0x9, 0x4}, @const={0x3, 0x0, 0x0, 0xa, 0x4}]}, {0x0, [0x0, 0x0, 0x30, 0x2e, 0x61, 0x61, 0x4da2a92e79c23c2a, 0x5f]}}, &(0x7f00000002c0)=""/4, 0x3a, 0x4, 0x1, 0xfffffff9, 0x10000}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0xc, 0x2, 0x187, 0x4, 0x20000, r5, 0x1, '\x00', 0x0, r6, 0x5, 0x4, 0x3}, 0x50) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000080)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x6, 0x492f, 0x7f, 0x1, 0x1}, 0x50) socket$kcm(0x10, 0x2, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x22, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x1}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x5}}}}]}]}, 0x70}}, 0x4) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32=r9], 0x90}}, 0x0) io_uring_enter(r2, 0x47f8, 0x0, 0x0, 0x0, 0x0) 1.231958139s ago: executing program 1 (id=1409): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000040)=ANY=[@ANYRESDEC=r1], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00'}, 0x94) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x33, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) statx(0xffffffffffffffff, &(0x7f0000002340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000, 0x10, 0x0) perf_event_open(&(0x7f00000005c0)={0x1, 0x80, 0x64, 0x44, 0x7, 0x0, 0x0, 0x8, 0x36a02, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_config_ext={0x8, 0x8000000000001006}, 0x8029, 0x0, 0x800000, 0x5, 0x1, 0xd, 0x0, 0x0, 0x40, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r5) close(r5) r6 = socket$unix(0x1, 0x1, 0x0) bind$unix(r6, &(0x7f0000000540)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) shutdown(r5, 0x0) listen(r6, 0x0) connect$unix(r6, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={0x0}, 0x18) sendmsg$kcm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="d8000000190081054e81f782db4cb9040220080000000000000000070a000a000900142603600e1208001e0000050401d559e0e0df7fc07963acc3038ebba8000400027c035c0461c1d67f6f94007134cf6efb6601a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c3f5aeb4edbb57a5025ccca9e008026f6e6ddba61f5fad95667e006dcdf639500bfeb789d00000000000000d5e1cace81ed6c117ab5d6d69bda4039e81f86f60f0bffece0b42a9ecbee5de6ccd40dd6e4ed", 0xd8}], 0x1}, 0x14) r7 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r7, 0x402, 0x8000003d) 1.146931687s ago: executing program 4 (id=1412): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[], 0x78}, 0x1, 0x0, 0x0, 0x4008850}, 0x24000000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="80678199080200e104000008008447e7"], 0x28}}, 0x0) 1.128022479s ago: executing program 4 (id=1413): r0 = socket(0x10, 0x803, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000440), 0x10) listen(r1, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req={0x7a, 0x8, 0x8, 0x4}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d}, 0x94) r2 = socket(0x1, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="340000001400b59500000000000000000a400000", @ANYRES32, @ANYBLOB="14000200000000000000000000ff"], 0x34}}, 0x0) r3 = dup(r2) setsockopt$inet6_IPV6_HOPOPTS(r3, 0x29, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000"], 0x8) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000600)={'syztnl0\x00', 0x0, 0x10, 0x40, 0xa, 0x5, {{0x3a, 0x4, 0x2, 0x7, 0xe8, 0x65, 0x0, 0x5, 0x4, 0x0, @private=0xa010100, @empty, {[@timestamp={0x44, 0x10, 0x1c, 0x0, 0x0, [0xfffffffc, 0x1000, 0x40]}, @cipso={0x86, 0x50, 0x0, [{0x6, 0x12, "c7f9c31c127b66f26e0a49e8b3e30771"}, {0x7, 0x3, '.'}, {0x0, 0x2}, {0x5, 0xa, "e60249d3c82abc54"}, {0x7, 0x12, "d161a45f65c413a8ccbe5c64ea2d3dfd"}, {0x7, 0x11, "0a17a8058cd54c7fd5dfb9eeb18215"}, {0x5, 0x6, "c602a187"}]}, @cipso={0x86, 0x74, 0x2, [{0x2, 0x11, "b1c7ca88b76f82b4e2fc94d48e20d1"}, {0x2, 0xc, "ba300dbbfff1f74da7f6"}, {0x1, 0xd, "250e4c8c66ab02d4a58ba3"}, {0x2, 0x10, "4fd9e01cbd050ddc765368b1957d"}, {0x7, 0x12, "3213941437f84d3623b2da2d0ea918e9"}, {0x2, 0x10, "2181f977eec82b0b4a8912e30d3a"}, {0x1, 0x12, "6474112aa2a948f47176195d1fc9aa1f"}]}]}}}}}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7dc470d00281f324, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="140088e762d0fc6a38dca22153aa6634950010", @ANYRES16=0x0, @ANYBLOB="000127bd7000fedbdf250a000000"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40080) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r5, 0x0, 0x7fff}, 0x18) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x40082406, &(0x7f00000002c0)='GPL\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a31000000001400078005001500070000000800124000000000050005000200000005000400000000000d000300686173683a6e6574"], 0x5c}}, 0x0) 1.091080642s ago: executing program 1 (id=1414): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000003}) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES8=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x6c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x800000, 0x0, 0x0, 0x0, 0x4, '\x00', r4, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x666}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000540)='fib6_table_lookup\x00', r5}, 0x10) sendto$inet6(r1, &(0x7f00000001c0)='O', 0x1, 0x80, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) 1.01845631s ago: executing program 3 (id=1415): r0 = socket(0x1e, 0x4, 0x0) socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8000}, 0x8) socket$inet6_sctp(0xa, 0x801, 0x84) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000070000000000000000000000850000000500000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007b00000095"], &(0x7f0000000680)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00'}, 0x94) mount$tmpfs(0x0, &(0x7f0000000000)='./cgroup\x00', 0x0, 0x3200841, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f0000000180)=ANY=[@ANYBLOB="8510000004000000950000000000000018000000000000000000000000000000950000000000000085100000fcffffff95"], &(0x7f00000000c0)='GPL\x00'}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r2, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe4e, 0x0, 0x0, 0x0, 0x4000000, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00"/12], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014800000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r4, 0xffffffffffffffff, 0x10, 0x0, @void}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='kmem_cache_free\x00', r5}, 0x18) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x6, &(0x7f0000000200)=[{0x7, 0x7, 0x2, 0x4}, {0x6, 0xfd, 0x9b, 0x3}, {0xd2a, 0x6, 0xa, 0x7}, {0x5, 0x6, 0x40, 0x7}, {0x8000, 0xb, 0x7, 0x7fffffff}, {0x3, 0xf, 0x1, 0x6}]}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a09000000000000000000020000000900020073794f310000000008000440080000000900010073797a3000000000080003400000000114000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x814}, 0x0) sendmsg$NFT_MSG_GETOBJ(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="34000000150a03f5"], 0x34}, 0x1, 0x0, 0x0, 0x66df5cfbe53006d1}, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r7, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_setup(0x2, &(0x7f0000000000)) eventfd(0x74c) 977.177724ms ago: executing program 4 (id=1416): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000000906010600000000ffff0000000000000900020073797a310000000005000100070000001c0007800c00018008000140ffffffff0c"], 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) 934.430418ms ago: executing program 4 (id=1417): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r2}}, 0x24}, 0x1, 0x0, 0x0, 0x8080}, 0x0) 920.461289ms ago: executing program 2 (id=1419): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0700000004000000000100000100000028"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0x8, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ec0)={&(0x7f0000000bc0)='kfree\x00', r2, 0x0, 0xfffffffffffffff4}, 0x18) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x4e8, 0x0, 0x11, 0x148, 0x340, 0x0, 0x450, 0x2a8, 0x2a8, 0x450, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x81}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x4f, 0x7, "72f6daeff0a9c6294e211d2d88fe6dcff5d0e552201da3b7a1fdb30dcb59"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x548) 855.789726ms ago: executing program 2 (id=1420): socket$packet(0x11, 0x3, 0x300) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000200)='kmem_cache_free\x00', r0, 0x0, 0xfffffffffffffffe}, 0x18) r1 = socket(0x1e, 0x4, 0x0) r2 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) 828.148749ms ago: executing program 2 (id=1421): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDSETLED(r0, 0x4b32, 0x91) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="070000000400000000010000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x8, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000bb00551a000000000000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r2 = socket$netlink(0x10, 0x3, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4880) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000400000000000000000000180100002020702500000000002020207b1af8ff00000000bf", @ANYRESOCT=r3, @ANYRES64=r3, @ANYBLOB, @ANYRES16=r3, @ANYRESHEX=r4, @ANYRES8=r3], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x7, 0x8604, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x8, 0x6}, 0x0, 0x10000, 0x0, 0x6, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2014c08, &(0x7f0000000540)=ANY=[], 0xfe, 0x6bd, &(0x7f0000000cc0)="$eJzs3V1rG9kdx/HfyLIlOyWEbgkhZJOTpAsOTZ2RvHEwKXTV0cieVtKIGbnYUFjSjb2EyGmbpLTxTdY3fYDtG+jd3vSiL6LQ630XvWthae8KpaAyT7JsaWQ7Uby76fdjdj2e859zzpyj6M/YmjMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACynLptVyw1vfbGpsnn1AO/NaE8qW1Wt5KNW2MbmxtqV7Ki/1Qu61Ky69K3DoovRv+7oSvJT1dUjr6VtXfu4oX77xQL2fETOvQqdNoKn73Ye/yg19t+eoLYGY2pvpSM2rRPZApUOEHQmtv2Qt9r1dZc44W+WV1Zse+sN0LT8JpuuBV23ZZxArfQ9QOz6NwyldXVZeMubflz7bV6relmO+99t2rbK+aHpeLwS8VrNr32WhwTFUcx98ynP4mKL8ittYzZedTbXp7Qv0I05lFQ5bgziYKqxwVV7Wq1UqlWKyt3V+/es+3iyA47YtkDGomY+osWXzPTfQMHXkMhyv9/s6SmymprQ5syY78c1RXIVyunPJXl//fuuPFGMafd4fyfZflL0vfT4suK8//V5Kerefk/py9Zb8aVWDn7T/c1G/fI6JleaE+P9UA99bStp1Oo28hcm0otZ/C1JldteQrly4snO9pj0j1Gq1rRimx9qHU1FMqoIU9NuQq1pVBdufErylEgVzV15SuQ0aIc3ZJRRata1bKMXC1pS7421Naa6qrp3/1+f0eP4nFfntBHpUEX8ia+NBSk6oSa8vL/T18mr7c0/9tH8v9++nIk/7/1kokuJd8+nxQDfAX00+v/U7r2ZnoDAAAAAADeBCv+7bsV/xX6XUl9Nbyma3/Z3QIAAAAAAFNkqV/SFVnxp9Cld2Vx/Q8AAAAAwNvGiu+xsyQtxB/qtw7uhDrJLwFmzqCLAAAAAADgNcV3/l+dk/rxohXXZJ3q+h8AAAAAAHwN/G5ojf1itsZuP/uzfkFS2ClZf/lnScGstd/Z/La1W4tKartpzMgnALr9dDXU++8U4/V65yTFy/Y67hUrbS1dBHOw7uAXO8et9W8FRzowNzNcwXAHGpet8+nRVtTySjH9SZ/qenLI9XIS+3CvoLgkaWWh4TXdJcdv3q+oVjtf6Lqb3V8+efRrKRic586j3ieSeg/jvsRru+7vRpW+PNSdwkhf4m8HfXker7cQ33Mx7ozn1cia/H27tWBF7W7b2fnPqLZbGG4o5/yPtPkb3Ujm7MZCEruwp3Qk4vMvR+dfWYqn7NDZB7PWQS8qR8983ETk9KIc9+JmEnNz8aZ+9VGyPZiFglX+zoxUXcrmIFs+90gvqp1NfZIU7J9gLKx/jYzFUC/ib1nJ0FgsR734a1RRzlgsD4/FK8wIAHxZdg6yUJy2R/Julh6yN7VXyjvHZ/cPDmf353/s9+MDZqRi+reJia2UFb2jL1pxHppLHjtQvDzmHd1O80pZOe/o9mtkt6itPw+egZBmJ4304j/9fv9+JW73D0ey6mfRAZ/lths2qzPREN55vvvzeAH8yMfbH28/qVaXV+z3bftuVbPxaWhW/+1t2zMi9wAARhz/jJ1jI6z3dT2JuP7wH+8lW4cy3jcHHylY0kf6mXp6qNvZIwSuja91YehjCLeTq1YNXbWaixfuz0tHYyu6nXtVF+fSodjqIHZW2SGHM/VB7PK4oVs4N92pAADgzNw4Jg+Pz//lQ/n/thaTiMXLY6+7D+fy9Op4cEmfF1s5vvMfTHs0AAD4/+AGX1gL3d9aQeB1PqysrlZq3XXXBL7zIxN49TXXeO2uGzjrtfaaazqB3/Udv2k6gUpe3Q1NuNHp+EHXNPzAdPzQ24yf/G7SR7+HbqvW7npO2Gm6tdA1jt/u1pyuqXuhYzobP2h64bobxAeHHdfxGp5T63p+24T+RuC4S8aErjsU6NXddtdreNFm23QCr1ULtsyP/eZGyzV1N3QCr9P1kwqztrx2ww9acbVL6p/6QYcAALyNnr3Ye/yg19t+enRjPro0T/bsKydmdGNuTIWsEQQAwFfMQbo+xUHlN9ghAAAAAAAAAAAAAAAAAAAAAAAw4vhb+k65MTvuZkFpsOcX59M9yeLtefVYmnbHTrNROO1R2S0Re48/nxA8P9iTDf9wzP6ZneDfvyGdi/co2VM88eH9l9KJgucnTO6JN+ZPHvy9nWREc2OiwrFFpcFcFKf/zyHaePKnvMHs9/uTDy8lYzif7pmbdIKHN4qSns6ddAqydTGGis72fQjA2ftfAAAA//8V4Sul") open_by_handle_at(0xffffffffffffff9c, &(0x7f0000000080)=ANY=[@ANYBLOB="16000000020000001d"], 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x3a) sendmmsg$inet6(r5, &(0x7f0000000800)=[{{&(0x7f00000000c0)={0xa, 0x4e21, 0xffff, @loopback, 0x4}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000100)="8000102e7577d401", 0x8}], 0x1, &(0x7f0000000280)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}}], 0x1, 0x4c0c0) prctl$PR_SET_NAME(0xf, &(0x7f0000000200)='gtp\x00\xe4\xaa\xae\xdf~2\xa6X\x14\x92\xdarV\xf4U\xf7\xa2\xc3l\x1b@\xaf\xf9\xc9\xa9#\xf0S\xd9=q\xd6\x14\xedt\xc8!W\xe9@\xeb\x7f~\tB0EE\x9a:\xb7\xff\xc1\xfc\x9a\x1f\xf2\xfb\x19\xda#x\xc5F\x1c~\x8c\xe1\xdf\xdc\x01k\f\xde0~\x95\r\xa2\x80\b4M\x14\xe7\xd0\t`n!g\x14\xe6\xd1\xc2\xd3\x88\xf8cVtd\xbeY\xa5\xe7\x16sD\x96}7\n\x88e\x00\xf0\xff\xff\xf0\xcb\x94\xb4S\x00\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f00000015c0)='kmem_cache_free\x00'}, 0x10) r6 = syz_io_uring_setup(0xa3d, &(0x7f00000000c0)={0x0, 0x43e7, 0x0, 0x2000003, 0x8002ab}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x109880}) io_uring_enter(r6, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x3}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4000c00) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r9, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r10}, 0x10) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={0x0}}, 0xc0) 785.613273ms ago: executing program 4 (id=1422): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000003}) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES8=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x6c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='kfree\x00', r3}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x800000, 0x0, 0x0, 0x0, 0x4, '\x00', r5, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x666}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000540)='fib6_table_lookup\x00', r6}, 0x10) sendto$inet6(r1, &(0x7f00000001c0)='O', 0x1, 0x80, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) 635.133727ms ago: executing program 1 (id=1423): set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) socket(0x10, 0x3, 0x0) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x1018ed8, &(0x7f0000000180)={[{@sysvgroups}, {@noload}, {@nobh}, {@noload}, {@journal_dev={'journal_dev', 0x3d, 0x4}}, {@norecovery}, {@errors_continue}, {@quota}]}, 0x1, 0x655, &(0x7f0000000d40)="$eJzs3c9rJFkdAPBvVef3xM2siLhBMeBhF2Qzybi46sXZ9eAcFlxwQREPGzbJGqZnZ0iy4IwDm4AHBQUR8TbIXvwHvMvcvYmg3jwLq8iICzpMS/3oSafTv2aS7k66Ph/o9KtXVXnv29Wv61V1va4AKmsl+5NGvBDx+O0kYqll3mIUM1fK5R7+69472SOJRuPb/0wiKfOayyfl86VyYi4i/vh6xCdrJ8vdu3P3xka9Ufgg4sr+zdtX9u7cfXnn5sa7W+9uvbd+9SuvvLr21fVX1lsq+uwulc/X3/jWZ3/+4x98eftP9ZeTuBZvTf9oM9riOCsrsRKPyxBb86ci4tUs0eF1uWgmIIRKq5Xvx+mI+HQsRS2fKizFzs/GWjlgqBq1iEZvSb8FgItK84aqavYDmsf2gx0HvzXkXsnofPRacQB0Mv6p8pTDXH5stPAwaTkyKs5tXD6D8rMyHt2bu//o3vL9OHYe4uMnW2fqDMrp5uAwIj7TKf4kr9vlPNIs/vTYsX4SEWsRMVPW7xunqEPSkh7GeZheDg7jOyu/ns2SveKvZfG3boc0Iq6Vz1n+689YfvtprVHHD0A1PXit3JEfZFNH+7+s79Hs/8RR/+eD5nqLp/9KJjfu/V/3/l9zfz+X93vStn5Y1md5s/O/nG7P+NtPr/+yW/lF/2/5fvORld/sC47CR4cRy23x/yQLtuz/ZPEnHfq/2SJvXxusjG/++R/Xu80bd/yNDyNe7Hj8c9QrzVI9vp+8sr1T31or/nYs4/d/+P5vu5XfOf7ZIUTaWbb9F7rE37L90/b1stfkdud/edie8bs3P7zZrfzFvts//ftMUhxvzpQ5Pzzc399dj5hJ3igXKfM39vd3r/aOt1jm40b+vF7E/9IXOrf/Y+//tqjmmx+ZA7j93RsPu817lvd/y5fJjxsD1qGbLP7N/tv/RPvP8n4xYBn/+d77n+s2r3P8yaliAgAAAAAAgKpK8+9gk3T1STpNV1eL8bKfioW0fmtv/4vbt95/bzPipfx6yOk00iS/ZGSpmE62d+pb6+X1sM3pq23TX4qI5yPiV7X5fHr1nVv1zXEHDwAAAAAAAAAAAAAAAAAAAOfEpXL8f/M+1f+uFeP/gYrof4O5E/d/ACbEMG8wCZxvefvvtYt/bnR1AUbL/h+qS/uH6tL+obq6tf8TdzIHJo79P1SX9g/Vpf1DdWn/AAAAADCRnv/8g78mEXHwtfn8kZkp5xn0C5Pt6S7xqw2tHsDoadFQXVOu8ofKGqjx/7f8ccDhVwcYg6RTZn5dYKN343/Qcc0jh6evGwAAAAAAAAAAAABQePGFDuP/Z4t5BgbBZPMbH1Bdpxj/76cD4ILz0/9QXY7xgT6j+GOu24x+4/8BAAAAAAAAAAAAgDOzmD+SdLUcC7wYabq6GvGJiLgc08n2Tn1rLSKei4i/1KZns+n1cVcaAAAAAAAAAAAAAAAAAAAAJszenbs3Nur1rd3WxP9O5Ex2onkX1P4LNwZYpmfi6/GUa0Uy+pdlPiLGvlGGlphqyUkiDrItfy4qtrsX56MaeWLMH0wAAAAAAAAAAAAAAAAAAFBBLWOPO1v+zYhrBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACjd3T//z6JzYVihYEWPp4Yd4wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMX0/wAAAP//nRs6pA==") mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000002540)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000140)={0x0, 0x2, 0x7ffffffc, 0x7ec, 0x200000fffe, 0xfffffffffffffffe, 0x3, 0x0, 0x7ffd}) syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x2b1245d, 0x0, 0xfc, 0x0, &(0x7f00000000c0)) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = epoll_create1(0x80000) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) read$char_usb(0xffffffffffffffff, &(0x7f0000000100)=""/177, 0x39) epoll_pwait(r1, &(0x7f0000000280)=[{}], 0x1, 0x7, 0x0, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x1, 0x6}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, 0x0, {0x7, 0xa}, {0xd, 0xc}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) 615.752459ms ago: executing program 2 (id=1424): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="07000000040000000001000001"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0x8, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32=r1, @ANYBLOB], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ec0)={&(0x7f0000000bc0)='kfree\x00', r2, 0x0, 0xfffffffffffffff4}, 0x18) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x4e8, 0x0, 0x11, 0x148, 0x340, 0x0, 0x450, 0x2a8, 0x2a8, 0x450, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x81}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x4f, 0x7, "72f6daeff0a9c6294e211d2d88fe6dcff5d0e552201da3b7a1fdb30dcb59"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x548) 565.832044ms ago: executing program 2 (id=1425): syz_emit_ethernet(0x7e, &(0x7f0000000000)={@broadcast, @random="6c7621d7cc94", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "fec000", 0x48, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "98a350", 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x2}, @private1, [@hopopts={0x11}], "fafb17c103001c193eb4c625f48ce6b9"}}}}}}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r2, 0x4008240b, &(0x7f00000001c0)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x3, 0xda7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d}) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000060000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kmem_cache_free\x00', r5}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="ffff27bd7000fbdbdf2505000000140001800d0001007564703a73797a3200000000"], 0x28}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) r7 = syz_open_procfs(0x0, 0x0) readlinkat(r7, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000540)=""/76, 0x4c) write$P9_RGETLOCK(r7, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000600)={'wlan1\x00'}) socket$inet6(0xa, 0x3, 0x3c) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r8, 0x1, 0x3, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) 546.439976ms ago: executing program 0 (id=1426): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000040)=ANY=[@ANYRESDEC=r1], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00'}, 0x94) statx(0xffffffffffffffff, &(0x7f0000002340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000, 0x10, 0x0) 457.691555ms ago: executing program 0 (id=1427): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000000906010600000000ffff0000000000000900020073797a310000000005000100070000001c0007800c00018008000140ffffffff0c0002"], 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) 457.347525ms ago: executing program 0 (id=1428): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000000906010600000000ffff0000000000000900020073797a310000000005000100070000001c0007800c00018008000140ffffffff0c000280"], 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) 413.925599ms ago: executing program 4 (id=1429): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0xfff, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xcb3a}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1, 0x0, 0x7098}, 0x18) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000940)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={0x0, r3, 0x0, 0x4}, 0x18) r4 = socket$igmp6(0xa, 0x3, 0x2) socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x3e}, @remote, @remote, 0x3, 0x2, 0x0, 0x0, 0xb7, 0x2000213}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x0, &(0x7f0000000040), 0x1, 0xba6, &(0x7f0000000c00)="$eJzs3M1rXFUUAPDzXj7bRicVEeumEZEWxGlaSbFFsJWKGxeCboWGdFJCph8kkZo0i4n+A6KuBTeCWpQu7LobBbdutG4tLoQisVEQ0cibjyQ2M0naTvJq8vvBzbt3zpvcc/KYeffCTALYsQayH2nEvog4nUQU6o+nEdFd7fVGVGrnLczPjvwxPzuSxOLi678mkUTE7fnZkcbvSurHPfVBb0R891ISj7y7et7J6Znx4XK5NFEfH5o6d/HQ5PTMs2Pnhs+WzpbOHz76/NCRoaODx4baVuufP5249vuTr/xc+euzv6/89sEnSZyIvnpsZR3tMhADS3+TlTojYrjdk+Wko17PyjqTznWelG5yUgAAtJSuWMM9FoXoiOXFWyG+/j7X5AAAAIC2WOyIWAQAAAC2ucT+HwAAALa5xucAbs/PjjRavp9I2Fq3TkZEf63+hXqrRTqjUj32RldE7L6dxMqvtSa1p923gYi4+eOxL7MWm/Q95LVU5iLi8WbXP6nW31/9Fvfq+tOIGGzD/AN3jP9P9Z9ow/x51w/AznT9ZO1Gtvr+ly6tf6LJ/a+zyb3rXuR9/2us/xZWrf+W6+9osf57bYNzXP70o0utYln9L1x7+YtGy+bPjvdV1F24NRfxRGez+pOl+pMW9Z/e4ByFfy6VWsXyrn/x44gD0bz+hmTt/090aHSsXBqs/Ww6x9y3Q5+3mj/v+rPrv7tF/etd/4sbnOPNU6eutoqtX3/6S3fyRrXXXX/k7eGpqYnDEd3Jq6sfP7J2Lo1zGr8jq//gU2u//pvVn70nVOp/h2wvMFc/ZuN37pjzxSuXv1qr/mzvl+f1P3OP1/+9Dc7x9DfvH2wVW7n/zVo2/82kthcGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIY0IvoiSYtL/TQtFiP2RMSjsTstX5icemb0wlvnz2SxiP7oSkfHyqXBiCjUxkk2PlztL4+P3DF+LiL2RsSHhV3VcXHkQvlM3sUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwZE9E9EWSFiMijYiFQpoWi3lnBQAAALRdf94JAAAAAJvO/h8AAAC2P/t/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANtne/ddvJBFROb6r2jLd9VhXrpkBmy3NOwEgNx15JwDkpjPvBIDc3OUe33IBtqFknXhvy0hP23MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4MF1YN/1G0lEVI7vqrZMdz3W1fQZ+7cwO2AzpXknAOSmY61g59blAWw9L3HYuZrv8YGdJFkn3rt8TuW/kZ5NywkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB09ftSVpMSLSaj9Ni8WIhyKiP7qS0bFyaTAiHo6IHwpdPdm4J++kAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaLvJ6Znx4XK5NKGjo5NvJ3kw0qh18n5nAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD5PTM+PD5XJpYjLvTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC8TU7PjA+Xy6WJDXSu3s3JKzp51wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQH7+DQAA//+LYA3r") lsetxattr$system_posix_acl(0x0, &(0x7f0000000440)='system.posix_acl_default\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32=0xee01, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="040000000000800008000000", @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB], 0x5c, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000400)='.\x00', &(0x7f0000000440)='system.posix_acl_default\x00', &(0x7f0000000540)=ANY=[@ANYRES64=r0, @ANYRESOCT, @ANYRES64, @ANYRES64=r5], 0x5c, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000880)=0x0) capget(&(0x7f00000008c0)={0x19980330, r6}, &(0x7f0000000900)={0x115, 0xc5f, 0x0, 0x5, 0x100, 0x9}) pwritev(0xffffffffffffffff, &(0x7f0000001a00)=[{&(0x7f0000000ac0)="37fe984c26016db58b12ae0f318d36cfa5a6918e70183fd13438811edb6a15f0c71e38752c5121dfa4197271c34a70eca5263fb335", 0x35}, {&(0x7f00000017c0)="24e2584fb9e1b525415f6e31e977b51cb525284b0921a9ad8d5b749748ace38f60d1605ff3e513132c999ad1dfc7475980ccc0f3835c2fbca980c23784a2dacc4c8d20e06b97f0f94beefd0375d447792f5a49e4ee86cdeb1ea326c320726bb2c23a1cfc1c8a823f24478023e0f1ed2940cd699f", 0x74}, {&(0x7f0000000bc0)="86b4fbd964124f858ab3dbaa87ab597656b08f3668cf41641bbf0989187428cea0441b867f1a88d97bdd69b368c33be0a6ae191222a03c3c3dc1bb", 0x3b}, {&(0x7f0000001840)="8f45fb3cd4882fad50e07fd1a057b6969490ea2266d32a697d6f4f3cd557fe72e0b78e96b075869b45a582e3014e9ea2d7481c693c88d4589f70d87a72f6db6a705041e1640119f264", 0x49}, {&(0x7f00000018c0)}, {&(0x7f0000001900)="b2c8114ed7b5076c8dc722474975b38de169d17e584e39ae0c6b02fce3e6e770", 0x20}, {&(0x7f0000001940)="f6c90e40d29aefdf0308c5eeb6dd7ac47bb947bca23d76d4bcfa42d816397fc957f9437b4ba9b3bc932afcaf95912549ee0c35cc215338e4018a38cba57e6449a0eb13c79afd755c2417c53230d4c8210a573b758e5b52020c58202d3d2df941678dc1c171ae08fb0bf20092880849ee193a4cbd0a41672d84d9468db4b835fd0e9d16f2b642a7eadf6d625f169a569c48c0918fb9879630b75c8bfef3cff87eefc290b1a8a6bd00333ffd2d0f98505bb08beaa4692243fd9598", 0xba}], 0x7, 0x7fffffff, 0x0) 334.886397ms ago: executing program 0 (id=1430): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r1}, 0x18) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}}, 0x20000000) r4 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x0, &(0x7f00000002c0), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='mnt', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r5, 0xc0506617, &(0x7f0000000580)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x1c0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r6, 0x800c6613, &(0x7f00000006c0)=@v2={0x2, @aes256, 0x0, '\x00', @a}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000700)='mnt/encrypted_dir/file\x00', 0x42, 0x180) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x9}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000080)={r8, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x3a}}}, 0x7, 0x0, 0x14e, 0x8, 0x6c, 0x1367bbf7, 0xf}, &(0x7f0000000140)=0x9c) write(r7, &(0x7f0000000740)='foo', 0x3) 115.043429ms ago: executing program 0 (id=1431): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDSETLED(r0, 0x4b32, 0x91) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="070000000400000000010000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x8, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000bb00551a000000000000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) socket$netlink(0x10, 0x3, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4880) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000400000000000000000000180100002020702500000000002020207b1af8ff00000000bf", @ANYRESOCT=r2, @ANYRES64=r2, @ANYBLOB, @ANYRES16=r2, @ANYRESHEX=r3, @ANYRES8=r2], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2014c08, &(0x7f0000000540)=ANY=[], 0xfe, 0x6bd, &(0x7f0000000cc0)="$eJzs3V1rG9kdx/HfyLIlOyWEbgkhZJOTpAsOTZ2RvHEwKXTV0cieVtKIGbnYUFjSjb2EyGmbpLTxTdY3fYDtG+jd3vSiL6LQ630XvWthae8KpaAyT7JsaWQ7Uby76fdjdj2e859zzpyj6M/YmjMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACynLptVyw1vfbGpsnn1AO/NaE8qW1Wt5KNW2MbmxtqV7Ki/1Qu61Ky69K3DoovRv+7oSvJT1dUjr6VtXfu4oX77xQL2fETOvQqdNoKn73Ye/yg19t+eoLYGY2pvpSM2rRPZApUOEHQmtv2Qt9r1dZc44W+WV1Zse+sN0LT8JpuuBV23ZZxArfQ9QOz6NwyldXVZeMubflz7bV6relmO+99t2rbK+aHpeLwS8VrNr32WhwTFUcx98ynP4mKL8ittYzZedTbXp7Qv0I05lFQ5bgziYKqxwVV7Wq1UqlWKyt3V+/es+3iyA47YtkDGomY+osWXzPTfQMHXkMhyv9/s6SmymprQ5syY78c1RXIVyunPJXl//fuuPFGMafd4fyfZflL0vfT4suK8//V5Kerefk/py9Zb8aVWDn7T/c1G/fI6JleaE+P9UA99bStp1Oo28hcm0otZ/C1JldteQrly4snO9pj0j1Gq1rRimx9qHU1FMqoIU9NuQq1pVBdufErylEgVzV15SuQ0aIc3ZJRRata1bKMXC1pS7421Naa6qrp3/1+f0eP4nFfntBHpUEX8ia+NBSk6oSa8vL/T18mr7c0/9tH8v9++nIk/7/1kokuJd8+nxQDfAX00+v/U7r2ZnoDAAAAAADeBCv+7bsV/xX6XUl9Nbyma3/Z3QIAAAAAAFNkqV/SFVnxp9Cld2Vx/Q8AAAAAwNvGiu+xsyQtxB/qtw7uhDrJLwFmzqCLAAAAAADgNcV3/l+dk/rxohXXZJ3q+h8AAAAAAHwN/G5ojf1itsZuP/uzfkFS2ClZf/lnScGstd/Z/La1W4tKartpzMgnALr9dDXU++8U4/V65yTFy/Y67hUrbS1dBHOw7uAXO8et9W8FRzowNzNcwXAHGpet8+nRVtTySjH9SZ/qenLI9XIS+3CvoLgkaWWh4TXdJcdv3q+oVjtf6Lqb3V8+efRrKRic586j3ieSeg/jvsRru+7vRpW+PNSdwkhf4m8HfXker7cQ33Mx7ozn1cia/H27tWBF7W7b2fnPqLZbGG4o5/yPtPkb3Ujm7MZCEruwp3Qk4vMvR+dfWYqn7NDZB7PWQS8qR8983ETk9KIc9+JmEnNz8aZ+9VGyPZiFglX+zoxUXcrmIFs+90gvqp1NfZIU7J9gLKx/jYzFUC/ib1nJ0FgsR734a1RRzlgsD4/FK8wIAHxZdg6yUJy2R/Julh6yN7VXyjvHZ/cPDmf353/s9+MDZqRi+reJia2UFb2jL1pxHppLHjtQvDzmHd1O80pZOe/o9mtkt6itPw+egZBmJ4304j/9fv9+JW73D0ey6mfRAZ/lths2qzPREN55vvvzeAH8yMfbH28/qVaXV+z3bftuVbPxaWhW/+1t2zMi9wAARhz/jJ1jI6z3dT2JuP7wH+8lW4cy3jcHHylY0kf6mXp6qNvZIwSuja91YehjCLeTq1YNXbWaixfuz0tHYyu6nXtVF+fSodjqIHZW2SGHM/VB7PK4oVs4N92pAADgzNw4Jg+Pz//lQ/n/thaTiMXLY6+7D+fy9Op4cEmfF1s5vvMfTHs0AAD4/+AGX1gL3d9aQeB1PqysrlZq3XXXBL7zIxN49TXXeO2uGzjrtfaaazqB3/Udv2k6gUpe3Q1NuNHp+EHXNPzAdPzQ24yf/G7SR7+HbqvW7npO2Gm6tdA1jt/u1pyuqXuhYzobP2h64bobxAeHHdfxGp5T63p+24T+RuC4S8aErjsU6NXddtdreNFm23QCr1ULtsyP/eZGyzV1N3QCr9P1kwqztrx2ww9acbVL6p/6QYcAALyNnr3Ye/yg19t+enRjPro0T/bsKydmdGNuTIWsEQQAwFfMQbo+xUHlN9ghAAAAAAAAAAAAAAAAAAAAAAAw4vhb+k65MTvuZkFpsOcX59M9yeLtefVYmnbHTrNROO1R2S0Re48/nxA8P9iTDf9wzP6ZneDfvyGdi/co2VM88eH9l9KJgucnTO6JN+ZPHvy9nWREc2OiwrFFpcFcFKf/zyHaePKnvMHs9/uTDy8lYzif7pmbdIKHN4qSns6ddAqydTGGis72fQjA2ftfAAAA//8V4Sul") open_by_handle_at(0xffffffffffffff9c, &(0x7f0000000080)=ANY=[@ANYBLOB="16000000020000001d"], 0x0) 107.58189ms ago: executing program 2 (id=1432): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000340)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x9, 0x4, 0x7ffc0002}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000181100005749873eeffb3ebd99338b8d0f877f2300009a2fc286535cb50b34175709", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$netlink(0xffffffffffffffff, &(0x7f0000000380)={0x10, 0x0, 0x25dfdbfe, 0x500}, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = inotify_init1(0x0) r3 = inotify_add_watch(r2, &(0x7f0000000200)='.\x00', 0x10000a0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={0xffffffffffffffff}, 0x4) r4 = dup(0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) bind$can_raw(r6, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='sys_enter\x00', r8}, 0x10) rt_sigqueueinfo(0x0, 0x21, 0x0) lsetxattr$security_selinux(&(0x7f0000000900)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000940), &(0x7f0000000980)='system_u:object_r:netutils_exec_t:s0\x00', 0xf, 0x0) r9 = socket$can_raw(0x1d, 0x3, 0x1) recvmsg$can_raw(r9, &(0x7f0000001540)={&(0x7f0000000100)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, 0x80, 0x0}, 0x100) bind$can_raw(r9, &(0x7f0000000000)={0x1d, r7}, 0x10) setsockopt$CAN_RAW_FILTER(r9, 0x65, 0x1, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=@newtfilter={0x64, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r12, {0x8, 0xfff3}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_flower={{0x40}, {0x34, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x10000003}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x20, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x1c, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x2}]}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r7, {0xb, 0x6}, {0xffff, 0xfff9}, {0x1}}}, 0x24}}, 0x4) inotify_rm_watch(r4, r3) 76.644953ms ago: executing program 1 (id=1433): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r0, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000540)='fib6_table_lookup\x00', r1}, 0x10) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r2, 0x0, 0x5c4, 0x404c844, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @local}, 0x1c) 60.922634ms ago: executing program 3 (id=1434): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x9}, 0x2400, 0x0, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001cc0)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000008385000000710000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000340)='kmem_cache_free\x00', r1}, 0x18) fsopen(0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) pipe2$9p(&(0x7f00000001c0), 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x18) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x7], 0x0, 0x0, 0x1}}, 0x3c) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000080)='kfree\x00', r4}, 0x18) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2042, 0x0) ioctl$AUTOFS_IOC_FAIL(r5, 0x4c80, 0xffffffe4) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000040)=ANY=[], &(0x7f0000000200)='GPL\x00', 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57dc}, 0x94) syz_usb_connect(0x0, 0x24, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0}, 0x18) 0s ago: executing program 0 (id=1435): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000840)=ANY=[@ANYBLOB, @ANYRES32], 0x0}, 0x94) r2 = syz_io_uring_setup(0x503f, 0x0, 0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000300)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x2, 0xa3d8, &(0x7f00000005c0)=[{&(0x7f0000000240)="5db5bd", 0x3}], 0x81, 0x8, 0x1, {0x2}}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x94) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0xa, [@volatile={0xe, 0x0, 0x0, 0x9, 0x4}, @const={0x3, 0x0, 0x0, 0xa, 0x4}]}, {0x0, [0x0, 0x0, 0x30, 0x2e, 0x61, 0x61, 0x4da2a92e79c23c2a, 0x5f]}}, &(0x7f00000002c0)=""/4, 0x3a, 0x4, 0x1, 0xfffffff9, 0x10000}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0xc, 0x2, 0x187, 0x4, 0x20000, r5, 0x1, '\x00', 0x0, r6, 0x5, 0x4, 0x3}, 0x50) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000080)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x6, 0x492f, 0x7f, 0x1, 0x1}, 0x50) socket$kcm(0x10, 0x2, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x22, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x1}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x3, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x5}}}}]}]}, 0x70}}, 0x4) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32=r9], 0x90}}, 0x0) io_uring_enter(r2, 0x47f8, 0x0, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): code=0x7ffc0000 [ 49.405855][ T29] audit: type=1326 audit(1760747252.022:2187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4021 comm="syz.4.199" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 49.460126][ T29] audit: type=1326 audit(1760747252.022:2188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4021 comm="syz.4.199" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 49.483904][ T29] audit: type=1326 audit(1760747252.022:2189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4021 comm="syz.4.199" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 49.507524][ T29] audit: type=1326 audit(1760747252.022:2190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4021 comm="syz.4.199" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 49.531825][ T29] audit: type=1326 audit(1760747252.052:2191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4021 comm="syz.4.199" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 49.556403][ T29] audit: type=1326 audit(1760747252.052:2192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4021 comm="syz.4.199" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 49.619630][ T4022] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.790735][ T3316] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.938394][ T4033] bridge0: entered promiscuous mode [ 49.947343][ T4033] macsec1: entered promiscuous mode [ 49.959541][ T4033] bridge0: port 3(macsec1) entered blocking state [ 49.966065][ T4033] bridge0: port 3(macsec1) entered disabled state [ 49.982597][ T4033] macsec1: entered allmulticast mode [ 49.988220][ T4033] bridge0: entered allmulticast mode [ 50.021014][ T4033] macsec1: left allmulticast mode [ 50.026232][ T4033] bridge0: left allmulticast mode [ 50.043800][ T4035] IPv6: NLM_F_CREATE should be specified when creating new route [ 50.057223][ T3995] Set syz1 is full, maxelem 65536 reached [ 50.063559][ T4033] bridge0: left promiscuous mode [ 50.127287][ T4039] loop4: detected capacity change from 0 to 4096 [ 50.161491][ T4039] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 50.199263][ T3316] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.413799][ T4054] --map-set only usable from mangle table [ 50.441760][ T4052] netlink: 28 bytes leftover after parsing attributes in process `syz.4.210'. [ 50.451004][ T4052] netlink: 'syz.4.210': attribute type 7 has an invalid length. [ 50.458906][ T4052] netlink: 'syz.4.210': attribute type 8 has an invalid length. [ 50.466729][ T4052] netlink: 4 bytes leftover after parsing attributes in process `syz.4.210'. [ 50.478306][ T4052] dummy0: entered promiscuous mode [ 50.484530][ T4052] team0: entered promiscuous mode [ 50.489583][ T4052] team_slave_0: entered promiscuous mode [ 50.495507][ T4052] team_slave_1: entered promiscuous mode [ 50.503574][ T4052] erspan0: entered promiscuous mode [ 50.509787][ T4052] debugfs: 'hsr1' already exists in 'hsr' [ 50.515610][ T4052] Cannot create hsr debugfs directory [ 50.565357][ T4057] xt_hashlimit: max too large, truncated to 1048576 [ 50.731351][ T4069] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=4069 comm=syz.3.215 [ 50.787069][ T4069] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.868825][ T4069] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.932503][ T4069] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.992812][ T4069] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.048893][ T270] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.060569][ T270] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.072847][ T270] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.086520][ T270] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.184745][ T4074] loop4: detected capacity change from 0 to 4096 [ 51.195187][ T4074] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 51.231460][ T3316] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.279862][ T4079] loop4: detected capacity change from 0 to 164 [ 51.491814][ T4084] netlink: 28 bytes leftover after parsing attributes in process `syz.4.223'. [ 51.501383][ T4084] netlink: 'syz.4.223': attribute type 7 has an invalid length. [ 51.509439][ T4084] netlink: 'syz.4.223': attribute type 8 has an invalid length. [ 51.517153][ T4084] netlink: 4 bytes leftover after parsing attributes in process `syz.4.223'. [ 51.527732][ T4086] xt_hashlimit: max too large, truncated to 1048576 [ 51.584827][ T4094] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 51.591439][ T4094] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 51.599177][ T4094] vhci_hcd vhci_hcd.0: Device attached [ 51.609763][ T4094] Invalid ELF header type: 2 != 1 [ 51.624930][ T4095] vhci_hcd: connection closed [ 51.625160][ T390] vhci_hcd: stop threads [ 51.634351][ T390] vhci_hcd: release socket [ 51.638848][ T390] vhci_hcd: disconnect device [ 52.352099][ T4124] bridge0: entered promiscuous mode [ 52.360223][ T4124] macsec1: entered promiscuous mode [ 52.369442][ T4124] bridge0: port 3(macsec1) entered blocking state [ 52.376237][ T4124] bridge0: port 3(macsec1) entered disabled state [ 52.391405][ T4124] macsec1: entered allmulticast mode [ 52.396852][ T4124] bridge0: entered allmulticast mode [ 52.405144][ T4124] macsec1: left allmulticast mode [ 52.410305][ T4124] bridge0: left allmulticast mode [ 52.427915][ T4124] bridge0: left promiscuous mode [ 52.627656][ T3000] udevd[3000]: worker [3492] terminated by signal 33 (Unknown signal 33) [ 52.653621][ T3000] udevd[3000]: worker [3492] failed while handling '/devices/virtual/block/loop1' [ 52.740184][ T4131] loop4: detected capacity change from 0 to 4096 [ 52.760998][ T4133] loop1: detected capacity change from 0 to 4096 [ 52.773339][ T4131] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 52.809457][ T4133] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 52.933183][ T3316] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.960276][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.982276][ T4143] loop2: detected capacity change from 0 to 1024 [ 52.989294][ T4143] EXT4-fs: Ignoring removed nobh option [ 53.001123][ T4147] loop3: detected capacity change from 0 to 512 [ 53.023385][ T4143] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 53.042223][ T4147] EXT4-fs: Ignoring removed mblk_io_submit option [ 53.054804][ T4149] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.068562][ T4147] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 53.079518][ T4143] EXT4-fs error (device loop2): ext4_ext_check_inode:523: inode #11: comm syz.2.242: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 53.102451][ T4154] loop4: detected capacity change from 0 to 164 [ 53.106043][ T4143] EXT4-fs error (device loop2): ext4_orphan_get:1397: comm syz.2.242: couldn't read orphan inode 11 (err -117) [ 53.124184][ T4153] loop1: detected capacity change from 0 to 4096 [ 53.132017][ T4147] EXT4-fs (loop3): 1 truncate cleaned up [ 53.139302][ T4143] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 53.153430][ T4147] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 53.168032][ T4147] EXT4-fs (loop3): shut down requested (2) [ 53.177137][ T4149] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.191815][ T4147] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop3 ino=12 [ 53.201791][ T4153] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 53.215805][ T4143] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:483: comm syz.2.242: Invalid block bitmap block 0 in block_group 0 [ 53.229274][ T4147] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop3 ino=12 [ 53.235697][ T4143] EXT4-fs error (device loop2): ext4_acquire_dquot:6945: comm syz.2.242: Failed to acquire dquot type 0 [ 53.261588][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.280327][ T3000] udevd[3000]: worker [4151] terminated by signal 33 (Unknown signal 33) [ 53.289188][ T3000] udevd[3000]: worker [4151] failed while handling '/devices/virtual/block/loop4' [ 53.300511][ T4143] EXT4-fs error (device loop2): ext4_read_inode_bitmap:139: comm syz.2.242: Invalid inode bitmap blk 137438953472 in block_group 0 [ 53.319769][ T4149] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.346340][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.375782][ T4143] veth0: entered promiscuous mode [ 53.382046][ T4143] netlink: 4 bytes leftover after parsing attributes in process `syz.2.242'. [ 53.395130][ T4149] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.419760][ T4168] loop1: detected capacity change from 0 to 2048 [ 53.444743][ T4168] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 53.458217][ T4168] ext4 filesystem being mounted at /38/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 53.469918][ T4168] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.494618][ T31] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.510759][ T31] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.532128][ T31] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.540695][ T31] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.572058][ T3459] EXT4-fs error (device loop2): __ext4_get_inode_loc:4832: comm kworker/u8:7: Invalid inode table block 18446744065119617025 in block_group 0 [ 53.577583][ T4176] loop1: detected capacity change from 0 to 4096 [ 53.601601][ T4176] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 53.615139][ T3319] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.666566][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.676838][ T4181] netlink: 4 bytes leftover after parsing attributes in process `syz.0.259'. [ 53.686704][ C0] vcan0: j1939_session_tx_dat: 0xffff88811aba0e00: queue data error: -100 [ 53.733733][ T4184] loop2: detected capacity change from 0 to 2048 [ 53.792265][ T4191] loop2: detected capacity change from 0 to 2048 [ 53.815540][ T4191] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 53.828183][ T4191] ext4 filesystem being mounted at /59/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 53.839702][ T4191] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.990724][ T4202] loop2: detected capacity change from 0 to 512 [ 54.007929][ T4202] EXT4-fs: Ignoring removed mblk_io_submit option [ 54.022494][ T4202] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 54.045367][ T4202] EXT4-fs (loop2): 1 truncate cleaned up [ 54.060143][ T4202] EXT4-fs (loop2): shut down requested (2) [ 54.070056][ T4202] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 54.079491][ T4202] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop2 ino=12 [ 54.150155][ T4208] xt_hashlimit: max too large, truncated to 1048576 [ 54.205562][ T4211] loop1: detected capacity change from 0 to 4096 [ 54.360877][ T4227] xt_hashlimit: max too large, truncated to 1048576 [ 54.396549][ T4229] loop3: detected capacity change from 0 to 1024 [ 54.424840][ T29] kauditd_printk_skb: 959 callbacks suppressed [ 54.424858][ T29] audit: type=1400 audit(1760747257.122:3150): avc: denied { getopt } for pid=4228 comm="syz.3.278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 54.497564][ T4232] netlink: 28 bytes leftover after parsing attributes in process `syz.4.275'. [ 54.506654][ T4232] netlink: 'syz.4.275': attribute type 7 has an invalid length. [ 54.514350][ T4232] netlink: 'syz.4.275': attribute type 8 has an invalid length. [ 54.522115][ T4232] netlink: 4 bytes leftover after parsing attributes in process `syz.4.275'. [ 54.771249][ T29] audit: type=1400 audit(1760747257.352:3151): avc: denied { connect } for pid=4228 comm="syz.3.278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 55.360150][ T4260] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=4260 comm=+}[@ [ 55.372509][ T4260] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=4260 comm=+}[@ [ 55.498696][ T29] audit: type=1326 audit(1760747258.192:3152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4266 comm="syz.4.291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 55.522467][ T29] audit: type=1326 audit(1760747258.192:3153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4266 comm="syz.4.291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 55.531507][ T4268] netlink: 120 bytes leftover after parsing attributes in process `syz.1.290'. [ 55.546325][ T29] audit: type=1326 audit(1760747258.192:3154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4266 comm="syz.4.291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 55.557312][ T4268] netlink: 8 bytes leftover after parsing attributes in process `syz.1.290'. [ 55.579525][ T29] audit: type=1326 audit(1760747258.192:3155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4266 comm="syz.4.291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 55.579567][ T29] audit: type=1326 audit(1760747258.192:3156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4266 comm="syz.4.291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 55.579598][ T29] audit: type=1326 audit(1760747258.192:3157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4266 comm="syz.4.291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 55.579683][ T29] audit: type=1326 audit(1760747258.222:3158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4266 comm="syz.4.291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 55.686168][ T29] audit: type=1326 audit(1760747258.222:3159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4266 comm="syz.4.291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 55.737890][ T4271] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 55.793344][ T4271] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 55.816205][ T4276] macsec1: entered promiscuous mode [ 55.821503][ T4276] bridge0: entered promiscuous mode [ 55.827339][ T4276] bridge0: port 3(macsec1) entered blocking state [ 55.833953][ T4276] bridge0: port 3(macsec1) entered disabled state [ 55.840654][ T4276] macsec1: entered allmulticast mode [ 55.846352][ T4276] bridge0: entered allmulticast mode [ 55.852330][ T4276] macsec1: left allmulticast mode [ 55.857397][ T4276] bridge0: left allmulticast mode [ 55.877084][ T4276] bridge0: left promiscuous mode [ 55.895873][ T4271] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 55.914031][ T4278] xt_hashlimit: max too large, truncated to 1048576 [ 55.946017][ T4280] netlink: 4 bytes leftover after parsing attributes in process `syz.2.296'. [ 55.988190][ T4271] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.035687][ T4286] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14385 sclass=netlink_route_socket pid=4286 comm=syz.1.299 [ 56.066044][ T3459] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.095824][ T37] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.119065][ T37] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.149787][ T37] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.169362][ T4292] loop2: detected capacity change from 0 to 4096 [ 56.232410][ T4301] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 56.238670][ T4302] bridge0: entered promiscuous mode [ 56.239001][ T4301] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 56.251962][ T4301] vhci_hcd vhci_hcd.0: Device attached [ 56.252433][ T4302] macsec1: entered promiscuous mode [ 56.267138][ T4302] bridge0: port 3(macsec1) entered blocking state [ 56.273930][ T4302] bridge0: port 3(macsec1) entered disabled state [ 56.284773][ T4302] macsec1: entered allmulticast mode [ 56.290332][ T4302] bridge0: entered allmulticast mode [ 56.312277][ T4301] Invalid ELF header type: 2 != 1 [ 56.318207][ T4303] vhci_hcd: connection closed [ 56.318368][ T37] vhci_hcd: stop threads [ 56.323947][ T4307] loop4: detected capacity change from 0 to 2048 [ 56.327814][ T37] vhci_hcd: release socket [ 56.338604][ T37] vhci_hcd: disconnect device [ 56.345679][ T4302] macsec1: left allmulticast mode [ 56.350914][ T4302] bridge0: left allmulticast mode [ 56.367194][ T4302] bridge0: left promiscuous mode [ 56.370165][ T4311] loop2: detected capacity change from 0 to 164 [ 56.379835][ T4307] ext4 filesystem being mounted at /70/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 56.455017][ T4311] netlink: 'gtp': attribute type 13 has an invalid length. [ 56.513787][ T4320] netlink: 'syz.3.311': attribute type 21 has an invalid length. [ 56.522616][ T4319] netlink: 32 bytes leftover after parsing attributes in process `syz.4.310'. [ 56.745752][ T4311] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.753262][ T4311] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.907698][ T4311] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 56.984364][ T4311] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 57.127259][ T4335] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.183887][ T37] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.211452][ T37] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.221667][ T37] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.231083][ T37] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.246863][ T4335] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.286091][ T4359] --map-set only usable from mangle table [ 57.328141][ T4365] xt_hashlimit: max too large, truncated to 1048576 [ 57.344397][ T4335] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.383018][ T4367] loop2: detected capacity change from 0 to 164 [ 57.424446][ T4335] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.441962][ C0] hrtimer: interrupt took 47114 ns [ 57.451198][ T4371] loop1: detected capacity change from 0 to 8192 [ 57.532322][ T3459] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.548382][ T3326] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.565155][ T390] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.585954][ T390] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.622856][ T4381] netlink: 4 bytes leftover after parsing attributes in process `syz.2.327'. [ 57.643005][ T4383] loop3: detected capacity change from 0 to 512 [ 57.652843][ T4383] EXT4-fs: Ignoring removed mblk_io_submit option [ 57.686670][ T4383] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 57.749030][ T4383] EXT4-fs (loop3): 1 truncate cleaned up [ 57.794438][ T4394] --map-set only usable from mangle table [ 57.806235][ T4383] EXT4-fs (loop3): shut down requested (2) [ 57.873953][ T4396] loop0: detected capacity change from 0 to 164 [ 58.005358][ T4404] SELinux: Context system_u:object_r:unconfined_exec_t:s0 is not valid (left unmapped). [ 58.072573][ T4406] loop3: detected capacity change from 0 to 1024 [ 58.083855][ T4406] EXT4-fs: Ignoring removed nobh option [ 58.120021][ T4416] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=4416 comm=+}[@ [ 58.132220][ T4416] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=4416 comm=+}[@ [ 58.145129][ T4406] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 58.157184][ T4406] EXT4-fs error (device loop3): ext4_ext_check_inode:523: inode #11: comm syz.3.337: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 58.177106][ T4406] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.337: couldn't read orphan inode 11 (err -117) [ 58.196578][ T4406] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:483: comm syz.3.337: Invalid block bitmap block 0 in block_group 0 [ 58.215209][ T4406] EXT4-fs error (device loop3): ext4_acquire_dquot:6945: comm syz.3.337: Failed to acquire dquot type 0 [ 58.230490][ T4406] EXT4-fs error (device loop3): ext4_read_inode_bitmap:139: comm syz.3.337: Invalid inode bitmap blk 137438953472 in block_group 0 [ 58.314831][ T4406] veth0: entered promiscuous mode [ 58.320917][ T4406] netlink: 4 bytes leftover after parsing attributes in process `syz.3.337'. [ 58.457656][ T4425] loop1: detected capacity change from 0 to 4096 [ 58.525871][ T4430] loop1: detected capacity change from 0 to 164 [ 58.570132][ T4430] netlink: 'gtp': attribute type 13 has an invalid length. [ 58.577664][ T4430] batman_adv: batadv0: Interface deactivated: veth1_vlan [ 58.674756][ T4435] Invalid ELF header type: 2 != 1 [ 58.750591][ T4441] loop1: detected capacity change from 0 to 2048 [ 58.773867][ T4441] ext4 filesystem being mounted at /68/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 59.012875][ T4470] xt_hashlimit: max too large, truncated to 1048576 [ 59.156830][ T4480] loop2: detected capacity change from 0 to 4096 [ 59.176511][ T4484] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.253745][ T4484] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.281062][ T4491] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=4491 comm=+}[@ [ 59.294007][ T4491] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=4491 comm=+}[@ [ 59.343553][ T4484] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.367938][ T4494] netlink: 8 bytes leftover after parsing attributes in process `syz.1.374'. [ 59.376974][ T4494] netlink: 4 bytes leftover after parsing attributes in process `syz.1.374'. [ 59.464005][ T4484] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.492073][ T4503] netlink: 'syz.0.375': attribute type 21 has an invalid length. [ 59.587935][ T4508] lo speed is unknown, defaulting to 1000 [ 59.594055][ T4507] netlink: 28 bytes leftover after parsing attributes in process `syz.0.379'. [ 59.594208][ T4508] lo speed is unknown, defaulting to 1000 [ 59.609390][ T4508] lo speed is unknown, defaulting to 1000 [ 59.616004][ T4508] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 59.624512][ T4508] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 59.636492][ T4508] lo speed is unknown, defaulting to 1000 [ 59.643658][ T4508] lo speed is unknown, defaulting to 1000 [ 59.649766][ T4508] lo speed is unknown, defaulting to 1000 [ 59.656624][ T4508] lo speed is unknown, defaulting to 1000 [ 59.663382][ T4508] lo speed is unknown, defaulting to 1000 [ 59.848450][ T270] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.860709][ T270] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.872867][ T270] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.884633][ T270] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.972029][ T4510] bridge0: entered promiscuous mode [ 59.977729][ T4510] macsec1: entered promiscuous mode [ 59.984508][ T4510] bridge0: port 3(macsec1) entered blocking state [ 59.991056][ T4510] bridge0: port 3(macsec1) entered disabled state [ 59.998076][ T4510] macsec1: entered allmulticast mode [ 60.003754][ T4510] bridge0: entered allmulticast mode [ 60.010013][ T4510] macsec1: left allmulticast mode [ 60.015555][ T4510] bridge0: left allmulticast mode [ 60.021767][ T4510] bridge0: left promiscuous mode [ 60.130648][ T4514] macsec1: entered promiscuous mode [ 60.136122][ T4514] bridge0: entered promiscuous mode [ 60.142134][ T4514] bridge0: port 3(macsec1) entered blocking state [ 60.148820][ T4514] bridge0: port 3(macsec1) entered disabled state [ 60.155751][ T4514] macsec1: entered allmulticast mode [ 60.161409][ T4514] bridge0: entered allmulticast mode [ 60.167797][ T4514] macsec1: left allmulticast mode [ 60.173761][ T4514] bridge0: left allmulticast mode [ 60.179938][ T4514] bridge0: left promiscuous mode [ 60.261965][ T4298] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:483: comm ext4lazyinit: Invalid block bitmap block 281466386776064 in block_group 0 [ 60.309054][ T4520] loop2: detected capacity change from 0 to 2048 [ 60.323675][ T4520] ext4 filesystem being mounted at /91/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 60.343922][ T4518] netlink: 28 bytes leftover after parsing attributes in process `syz.4.383'. [ 60.353125][ T4518] netlink: 'syz.4.383': attribute type 7 has an invalid length. [ 60.360863][ T4518] netlink: 'syz.4.383': attribute type 8 has an invalid length. [ 60.368592][ T4518] netlink: 4 bytes leftover after parsing attributes in process `syz.4.383'. [ 60.623484][ T4529] loop2: detected capacity change from 0 to 512 [ 60.631480][ T4529] ext4: Unknown parameter 'oldalloc"data' [ 60.651367][ T29] kauditd_printk_skb: 919 callbacks suppressed [ 60.651384][ T29] audit: type=1400 audit(1760747263.342:4077): avc: denied { write } for pid=4528 comm="syz.2.386" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 60.678476][ T29] audit: type=1400 audit(1760747263.342:4078): avc: denied { nlmsg_write } for pid=4528 comm="syz.2.386" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 60.950393][ T29] audit: type=1326 audit(1760747263.642:4079): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4559 comm="syz.2.392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 60.975966][ T29] audit: type=1326 audit(1760747263.642:4080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4559 comm="syz.2.392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 61.001307][ T29] audit: type=1326 audit(1760747263.642:4081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4559 comm="syz.2.392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 61.026044][ T29] audit: type=1326 audit(1760747263.642:4082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4559 comm="syz.2.392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 61.026481][ T4560] loop2: detected capacity change from 0 to 4096 [ 61.050560][ T29] audit: type=1326 audit(1760747263.642:4083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4559 comm="syz.2.392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 61.081257][ T29] audit: type=1326 audit(1760747263.642:4084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4559 comm="syz.2.392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 61.114546][ T29] audit: type=1326 audit(1760747263.642:4085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4559 comm="syz.2.392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 61.138773][ T29] audit: type=1326 audit(1760747263.642:4086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4559 comm="syz.2.392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 61.310594][ T4573] netlink: 'syz.4.395': attribute type 13 has an invalid length. [ 61.484484][ T4581] loop2: detected capacity change from 0 to 164 [ 61.629395][ T4573] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.636941][ T4573] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.726593][ T4573] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 61.739575][ T4573] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 61.796700][ T3459] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.811923][ T3459] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.820535][ T3459] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.861112][ T3326] EXT4-fs error (device loop3): __ext4_get_inode_loc:4832: comm kworker/u8:6: Invalid inode table block 18446744065119617025 in block_group 0 [ 61.869005][ T3459] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.957193][ T4595] macvlan1: entered promiscuous mode [ 61.968089][ T4595] ipvlan0: entered promiscuous mode [ 61.983311][ T4595] ipvlan0: left promiscuous mode [ 61.997869][ T4595] macvlan1: left promiscuous mode [ 62.031713][ T4601] --map-set only usable from mangle table [ 62.086739][ T4607] netlink: 8 bytes leftover after parsing attributes in process `syz.2.409'. [ 62.167586][ T4613] FAULT_INJECTION: forcing a failure. [ 62.167586][ T4613] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 62.182028][ T4613] CPU: 0 UID: 0 PID: 4613 Comm: syz.2.412 Not tainted syzkaller #0 PREEMPT(voluntary) [ 62.182115][ T4613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 62.182132][ T4613] Call Trace: [ 62.182141][ T4613] [ 62.182151][ T4613] __dump_stack+0x1d/0x30 [ 62.182190][ T4613] dump_stack_lvl+0xe8/0x140 [ 62.182214][ T4613] dump_stack+0x15/0x1b [ 62.182241][ T4613] should_fail_ex+0x265/0x280 [ 62.182342][ T4613] should_fail+0xb/0x20 [ 62.182373][ T4613] should_fail_usercopy+0x1a/0x20 [ 62.182464][ T4613] _copy_from_user+0x1c/0xb0 [ 62.182497][ T4613] get_timespec64+0x4c/0x100 [ 62.182589][ T4613] __x64_sys_clock_settime+0x116/0x190 [ 62.182634][ T4613] x64_sys_call+0x1e7d/0x3000 [ 62.182708][ T4613] do_syscall_64+0xd2/0x200 [ 62.182740][ T4613] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 62.182768][ T4613] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 62.182862][ T4613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.182892][ T4613] RIP: 0033:0x7ff7db18efc9 [ 62.182912][ T4613] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 62.182943][ T4613] RSP: 002b:00007ff7d9bef038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e3 [ 62.182973][ T4613] RAX: ffffffffffffffda RBX: 00007ff7db3e5fa0 RCX: 00007ff7db18efc9 [ 62.182990][ T4613] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 62.183004][ T4613] RBP: 00007ff7d9bef090 R08: 0000000000000000 R09: 0000000000000000 [ 62.183020][ T4613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 62.183035][ T4613] R13: 00007ff7db3e6038 R14: 00007ff7db3e5fa0 R15: 00007ffc95c154e8 [ 62.183059][ T4613] [ 62.485854][ T4625] loop3: detected capacity change from 0 to 2048 [ 62.508612][ T4625] ext4 filesystem being mounted at /78/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 62.562219][ T4628] --map-set only usable from mangle table [ 62.612450][ T4615] serio: Serial port ptm0 [ 62.639524][ T4640] loop3: detected capacity change from 0 to 164 [ 62.712753][ T4646] loop1: detected capacity change from 0 to 164 [ 62.835700][ T4660] loop1: detected capacity change from 0 to 164 [ 62.852169][ T4661] netlink: 20 bytes leftover after parsing attributes in process `syz.0.430'. [ 62.921071][ T4660] netlink: 'gtp': attribute type 13 has an invalid length. [ 62.953587][ T4665] --map-set only usable from mangle table [ 62.986977][ T4669] netlink: 168 bytes leftover after parsing attributes in process `syz.1.436'. [ 63.100092][ T4682] loop1: detected capacity change from 0 to 512 [ 63.107229][ T4682] EXT4-fs: Ignoring removed mblk_io_submit option [ 63.114736][ T4682] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 63.137615][ T4682] EXT4-fs (loop1): 1 truncate cleaned up [ 63.148219][ T4682] EXT4-fs (loop1): shut down requested (2) [ 63.154831][ T4682] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 63.164233][ T4682] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 63.174951][ T4683] netlink: 20 bytes leftover after parsing attributes in process `syz.2.437'. [ 63.226878][ T4686] loop1: detected capacity change from 0 to 4096 [ 63.332427][ T4691] loop3: detected capacity change from 0 to 164 [ 63.365938][ T4693] loop3: detected capacity change from 0 to 164 [ 63.406997][ T4696] loop1: detected capacity change from 0 to 164 [ 63.477511][ T4696] netlink: 'gtp': attribute type 13 has an invalid length. [ 63.490436][ T4703] xt_hashlimit: max too large, truncated to 1048576 [ 63.595961][ T4709] loop3: detected capacity change from 0 to 4096 [ 63.713288][ T4714] loop3: detected capacity change from 0 to 4096 [ 63.791979][ T4717] binfmt_misc: register: failed to install interpreter file ./file0 [ 63.803858][ T4717] netlink: 'syz.3.454': attribute type 4 has an invalid length. [ 63.874560][ T4717] loop3: detected capacity change from 0 to 1024 [ 63.890320][ T4719] loop2: detected capacity change from 0 to 512 [ 63.926884][ T4719] lo speed is unknown, defaulting to 1000 [ 64.439859][ T4736] loop1: detected capacity change from 0 to 4096 [ 64.517204][ T4739] netlink: 8 bytes leftover after parsing attributes in process `syz.1.461'. [ 64.664891][ T4741] loop1: detected capacity change from 0 to 1024 [ 64.683986][ T4741] EXT4-fs: Ignoring removed nobh option [ 64.690432][ T4741] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 64.706600][ T4741] EXT4-fs error (device loop1): ext4_ext_check_inode:523: inode #11: comm syz.1.462: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 64.728584][ T4746] netlink: 'syz.2.463': attribute type 13 has an invalid length. [ 64.746873][ T4741] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.462: couldn't read orphan inode 11 (err -117) [ 64.765680][ T4741] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:483: comm syz.1.462: Invalid block bitmap block 0 in block_group 0 [ 64.780084][ T4741] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.462: Failed to acquire dquot type 0 [ 64.792885][ T4741] EXT4-fs error (device loop1): ext4_read_inode_bitmap:139: comm syz.1.462: Invalid inode bitmap blk 137438953472 in block_group 0 [ 64.820477][ T4750] xt_hashlimit: max too large, truncated to 1048576 [ 64.886516][ T270] EXT4-fs error (device loop1): __ext4_get_inode_loc:4832: comm kworker/u8:4: Invalid inode table block 18446744065119617025 in block_group 0 [ 64.920612][ T4752] netlink: 20 bytes leftover after parsing attributes in process `syz.2.466'. [ 65.045140][ T4763] --map-set only usable from mangle table [ 65.164700][ T4773] loop1: detected capacity change from 0 to 164 [ 65.188115][ T4769] --map-set only usable from mangle table [ 65.250566][ T4771] netlink: 28 bytes leftover after parsing attributes in process `syz.3.473'. [ 65.260137][ T4771] netlink: 'syz.3.473': attribute type 7 has an invalid length. [ 65.267956][ T4771] netlink: 'syz.3.473': attribute type 8 has an invalid length. [ 65.271486][ T4778] netlink: 'syz.1.474': attribute type 13 has an invalid length. [ 65.276017][ T4771] netlink: 4 bytes leftover after parsing attributes in process `syz.3.473'. [ 65.295561][ T4771] bond0: entered promiscuous mode [ 65.295655][ T4771] bond_slave_0: entered promiscuous mode [ 65.295784][ T4771] bond_slave_1: entered promiscuous mode [ 65.302928][ T4771] bond0: left promiscuous mode [ 65.302948][ T4771] bond_slave_0: left promiscuous mode [ 65.303172][ T4771] bond_slave_1: left promiscuous mode [ 65.462909][ T4782] loop1: detected capacity change from 0 to 4096 [ 65.486349][ T4788] loop3: detected capacity change from 0 to 512 [ 65.494076][ T4788] EXT4-fs: Ignoring removed mblk_io_submit option [ 65.504388][ T4788] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 65.521616][ T4788] EXT4-fs (loop3): 1 truncate cleaned up [ 65.530327][ T4784] netlink: 20 bytes leftover after parsing attributes in process `syz.2.478'. [ 65.536665][ T4788] EXT4-fs (loop3): shut down requested (2) [ 65.547660][ T4788] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop3 ino=12 [ 65.556710][ T4788] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop3 ino=12 [ 65.588901][ T4796] netlink: 4 bytes leftover after parsing attributes in process `syz.1.480'. [ 65.657199][ T4803] loop1: detected capacity change from 0 to 2048 [ 65.682638][ T4803] ext4 filesystem being mounted at /100/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 65.747964][ T29] kauditd_printk_skb: 1118 callbacks suppressed [ 65.747983][ T29] audit: type=1326 audit(1760747268.442:5203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4812 comm="syz.3.487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30389aefc9 code=0x7ffc0000 [ 65.788138][ T4813] loop3: detected capacity change from 0 to 4096 [ 65.803612][ T29] audit: type=1326 audit(1760747268.442:5204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4812 comm="syz.3.487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30389aefc9 code=0x7ffc0000 [ 65.827635][ T29] audit: type=1326 audit(1760747268.442:5205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4812 comm="syz.3.487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30389aefc9 code=0x7ffc0000 [ 65.851265][ T29] audit: type=1326 audit(1760747268.442:5206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4812 comm="syz.3.487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f30389aefc9 code=0x7ffc0000 [ 65.875483][ T29] audit: type=1326 audit(1760747268.452:5207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4812 comm="syz.3.487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30389aefc9 code=0x7ffc0000 [ 65.899690][ T29] audit: type=1326 audit(1760747268.452:5208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4812 comm="syz.3.487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30389aefc9 code=0x7ffc0000 [ 65.923662][ T29] audit: type=1326 audit(1760747268.452:5209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4812 comm="syz.3.487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30389aefc9 code=0x7ffc0000 [ 65.947414][ T29] audit: type=1326 audit(1760747268.452:5210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4812 comm="syz.3.487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f30389aefc9 code=0x7ffc0000 [ 65.968379][ T4817] netlink: 4 bytes leftover after parsing attributes in process `syz.2.490'. [ 65.971357][ T29] audit: type=1326 audit(1760747268.452:5211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4812 comm="syz.3.487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30389aefc9 code=0x7ffc0000 [ 66.004633][ T29] audit: type=1326 audit(1760747268.452:5212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4812 comm="syz.3.487" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30389aefc9 code=0x7ffc0000 [ 66.063809][ T4824] netlink: 12 bytes leftover after parsing attributes in process `syz.2.492'. [ 66.125144][ T4830] netlink: 4 bytes leftover after parsing attributes in process `syz.3.494'. [ 66.160934][ T4831] loop0: detected capacity change from 0 to 4096 [ 66.195718][ T4834] netlink: 20 bytes leftover after parsing attributes in process `syz.1.491'. [ 66.249041][ T4842] loop3: detected capacity change from 0 to 164 [ 66.308225][ T4842] netlink: 'gtp': attribute type 13 has an invalid length. [ 66.383166][ T4846] netlink: 28 bytes leftover after parsing attributes in process `syz.2.501'. [ 66.392372][ T4846] netlink: 'syz.2.501': attribute type 7 has an invalid length. [ 66.400208][ T4846] netlink: 'syz.2.501': attribute type 8 has an invalid length. [ 66.422963][ T4842] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.430315][ T4842] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.500128][ T4851] xt_hashlimit: max too large, truncated to 1048576 [ 66.533636][ T4842] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 66.555906][ T4842] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 66.651597][ T4846] dummy0: entered promiscuous mode [ 66.657772][ T4846] team0: entered promiscuous mode [ 66.663048][ T4846] team_slave_0: entered promiscuous mode [ 66.668963][ T4846] team_slave_1: entered promiscuous mode [ 66.675669][ T4846] erspan0: entered promiscuous mode [ 66.681718][ T4846] debugfs: 'hsr1' already exists in 'hsr' [ 66.687886][ T4846] Cannot create hsr debugfs directory [ 66.693622][ T4846] hsr1: Slave A (dummy0) is not up; please bring it up to get a fully working HSR network [ 66.703964][ T4846] hsr1: Slave B (team0) is not up; please bring it up to get a fully working HSR network [ 66.714186][ T4846] hsr1: Interlink (erspan0) is not up; please bring it up to get a fully working HSR network [ 66.779471][ T52] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.824466][ T52] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.848976][ T4858] --map-set only usable from mangle table [ 66.877391][ T52] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.899877][ T4860] loop3: detected capacity change from 0 to 4096 [ 66.904223][ T52] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.045582][ T4871] loop3: detected capacity change from 0 to 4096 [ 67.178133][ T4887] --map-set only usable from mangle table [ 67.335679][ T4906] loop1: detected capacity change from 0 to 164 [ 67.423909][ T4916] --map-set only usable from mangle table [ 67.471730][ T4923] loop3: detected capacity change from 0 to 1024 [ 67.479902][ T4923] EXT4-fs: Ignoring removed nobh option [ 67.487116][ T4925] loop1: detected capacity change from 0 to 2048 [ 67.487191][ T4923] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 67.505185][ T4923] EXT4-fs error (device loop3): ext4_ext_check_inode:523: inode #11: comm syz.3.534: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 67.524677][ T4923] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.534: couldn't read orphan inode 11 (err -117) [ 67.540873][ T4923] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:483: comm syz.3.534: Invalid block bitmap block 0 in block_group 0 [ 67.543683][ T4925] ext4 filesystem being mounted at /113/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 67.565405][ T4923] EXT4-fs error (device loop3): ext4_acquire_dquot:6945: comm syz.3.534: Failed to acquire dquot type 0 [ 67.596303][ T4923] EXT4-fs error (device loop3): ext4_read_inode_bitmap:139: comm syz.3.534: Invalid inode bitmap blk 137438953472 in block_group 0 [ 67.705971][ T4855] EXT4-fs error (device loop3): __ext4_get_inode_loc:4832: comm kworker/u8:8: Invalid inode table block 18446744065119617025 in block_group 0 [ 67.976544][ T4968] loop3: detected capacity change from 0 to 1024 [ 68.011871][ T4968] EXT4-fs: Ignoring removed orlov option [ 68.019608][ T4968] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 68.046809][ T4968] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c840e018, mo2=0000] [ 68.056414][ T4968] EXT4-fs error (device loop3): ext4_map_blocks:778: inode #3: block 2: comm syz.3.549: lblock 2 mapped to illegal pblock 2 (length 1) [ 68.072893][ T4968] EXT4-fs error (device loop3): ext4_map_blocks:778: inode #3: block 48: comm syz.3.549: lblock 0 mapped to illegal pblock 48 (length 1) [ 68.132080][ T4968] EXT4-fs error (device loop3): ext4_acquire_dquot:6945: comm syz.3.549: Failed to acquire dquot type 0 [ 68.143963][ T4968] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6313: Corrupt filesystem [ 68.154915][ T4968] EXT4-fs error (device loop3): ext4_evict_inode:254: inode #11: comm syz.3.549: mark_inode_dirty error [ 68.166814][ T4968] EXT4-fs warning (device loop3): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 68.178479][ T4968] EXT4-fs (loop3): 1 orphan inode deleted [ 68.191879][ T37] EXT4-fs error (device loop3): ext4_map_blocks:778: inode #3: block 1: comm kworker/u8:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 68.255371][ T37] EXT4-fs error (device loop3): ext4_release_dquot:6981: comm kworker/u8:2: Failed to release dquot type 0 [ 68.305487][ T3311] EXT4-fs error (device loop3): __ext4_get_inode_loc:4832: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 68.323984][ T3311] EXT4-fs error (device loop3) in ext4_reserve_inode_write:6313: Corrupt filesystem [ 68.344305][ T3311] EXT4-fs error (device loop3): ext4_quota_off:7229: inode #3: comm syz-executor: mark_inode_dirty error [ 68.347850][ T4986] Invalid ELF header type: 2 != 1 [ 68.442088][ T4994] xt_hashlimit: max too large, truncated to 1048576 [ 68.471175][ T4990] loop1: detected capacity change from 0 to 4096 [ 68.561998][ T5000] loop1: detected capacity change from 0 to 164 [ 68.644713][ T5000] netlink: 'gtp': attribute type 13 has an invalid length. [ 68.724137][ T5008] loop1: detected capacity change from 0 to 512 [ 68.756617][ T5008] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 68.789364][ T5014] xt_hashlimit: max too large, truncated to 1048576 [ 68.812105][ T5008] EXT4-fs error (device loop1): ext4_orphan_get:1418: comm syz.1.566: bad orphan inode 16 [ 68.823595][ T5008] ext4_test_bit(bit=15, block=4) = 0 [ 68.829166][ T5008] EXT4-fs (loop1): 1 orphan inode deleted [ 68.837502][ T5008] FAULT_INJECTION: forcing a failure. [ 68.837502][ T5008] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 68.850928][ T5008] CPU: 1 UID: 0 PID: 5008 Comm: syz.1.566 Not tainted syzkaller #0 PREEMPT(voluntary) [ 68.850965][ T5008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 68.850983][ T5008] Call Trace: [ 68.850992][ T5008] [ 68.851002][ T5008] __dump_stack+0x1d/0x30 [ 68.851029][ T5008] dump_stack_lvl+0xe8/0x140 [ 68.851055][ T5008] dump_stack+0x15/0x1b [ 68.851117][ T5008] should_fail_ex+0x265/0x280 [ 68.851163][ T5008] should_fail+0xb/0x20 [ 68.851209][ T5008] should_fail_usercopy+0x1a/0x20 [ 68.851307][ T5008] _copy_from_user+0x1c/0xb0 [ 68.851454][ T5008] ___sys_sendmsg+0xc1/0x1d0 [ 68.851512][ T5008] __x64_sys_sendmsg+0xd4/0x160 [ 68.851616][ T5008] x64_sys_call+0x191e/0x3000 [ 68.851640][ T5008] do_syscall_64+0xd2/0x200 [ 68.851663][ T5008] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 68.851750][ T5008] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 68.851780][ T5008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.851871][ T5008] RIP: 0033:0x7fd95bc7efc9 [ 68.851887][ T5008] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 68.851922][ T5008] RSP: 002b:00007fd95a6df038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 68.851947][ T5008] RAX: ffffffffffffffda RBX: 00007fd95bed5fa0 RCX: 00007fd95bc7efc9 [ 68.852030][ T5008] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000007 [ 68.852044][ T5008] RBP: 00007fd95a6df090 R08: 0000000000000000 R09: 0000000000000000 [ 68.852060][ T5008] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 68.852076][ T5008] R13: 00007fd95bed6038 R14: 00007fd95bed5fa0 R15: 00007ffcfb6084d8 [ 68.852102][ T5008] [ 69.074573][ T5017] loop3: detected capacity change from 0 to 4096 [ 69.160727][ T5024] xt_hashlimit: max too large, truncated to 1048576 [ 69.296643][ T5031] loop1: detected capacity change from 0 to 164 [ 69.387414][ T5031] netlink: 'gtp': attribute type 13 has an invalid length. [ 69.424595][ T5044] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 69.464638][ T5047] loop1: detected capacity change from 0 to 512 [ 69.487429][ T5047] EXT4-fs: Ignoring removed mblk_io_submit option [ 69.500840][ T5047] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 69.515876][ T5047] EXT4-fs (loop1): 1 truncate cleaned up [ 69.564566][ T5047] EXT4-fs (loop1): shut down requested (2) [ 69.593972][ T5050] loop3: detected capacity change from 0 to 4096 [ 69.709397][ T5066] loop0: detected capacity change from 0 to 4096 [ 69.720153][ T5064] --map-set only usable from mangle table [ 69.807538][ T5076] loop3: detected capacity change from 0 to 2048 [ 69.836443][ T5080] bridge0: entered promiscuous mode [ 69.844228][ T5076] ext4 filesystem being mounted at /128/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 69.848930][ T5080] macsec1: entered promiscuous mode [ 69.998657][ T5099] xt_hashlimit: max too large, truncated to 1048576 [ 70.012354][ T5093] loop0: detected capacity change from 0 to 4096 [ 70.032631][ T5093] EXT4-fs mount: 76 callbacks suppressed [ 70.032652][ T5093] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 70.065527][ T5102] __nla_validate_parse: 14 callbacks suppressed [ 70.065548][ T5102] netlink: 20 bytes leftover after parsing attributes in process `syz.1.601'. [ 70.105570][ T5104] netlink: 4 bytes leftover after parsing attributes in process `syz.2.605'. [ 70.153338][ T5106] loop3: detected capacity change from 0 to 4096 [ 70.161693][ T3315] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 70.175368][ T5106] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 70.274321][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 70.395378][ T5119] loop3: detected capacity change from 0 to 2048 [ 70.436900][ T5119] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 70.464469][ T5119] ext4 filesystem being mounted at /133/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 70.476136][ T5119] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 70.647622][ T5135] netlink: 12 bytes leftover after parsing attributes in process `syz.2.617'. [ 70.651022][ T5137] netlink: 28 bytes leftover after parsing attributes in process `syz.0.612'. [ 70.665842][ T5137] netlink: 28 bytes leftover after parsing attributes in process `syz.0.612'. [ 70.695963][ T5136] netlink: 20 bytes leftover after parsing attributes in process `syz.3.615'. [ 70.891917][ T5139] netlink: 12 bytes leftover after parsing attributes in process `syz.2.619'. [ 70.934700][ T5147] netlink: 'syz.4.620': attribute type 13 has an invalid length. [ 71.316830][ T29] kauditd_printk_skb: 1475 callbacks suppressed [ 71.316848][ T29] audit: type=1326 audit(1760747274.012:6683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5156 comm="syz.4.625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 71.340476][ T5159] Invalid ELF header type: 2 != 1 [ 71.381440][ T5157] --map-set only usable from mangle table [ 71.409546][ T29] audit: type=1326 audit(1760747274.032:6684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5158 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 71.433128][ T29] audit: type=1326 audit(1760747274.032:6685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5158 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 71.456609][ T29] audit: type=1326 audit(1760747274.032:6686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5158 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 71.480567][ T29] audit: type=1326 audit(1760747274.032:6687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5158 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 71.504080][ T29] audit: type=1326 audit(1760747274.032:6688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5158 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 71.527783][ T29] audit: type=1326 audit(1760747274.032:6689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5158 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 71.551329][ T29] audit: type=1326 audit(1760747274.032:6690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5158 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 71.575676][ T29] audit: type=1326 audit(1760747274.032:6691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5158 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=175 compat=0 ip=0x7ff7db18efc9 code=0x7ffc0000 [ 71.599291][ T29] audit: type=1326 audit(1760747274.062:6692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5156 comm="syz.4.625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 71.734228][ T5164] netlink: 28 bytes leftover after parsing attributes in process `syz.2.629'. [ 71.743374][ T5164] netlink: 'syz.2.629': attribute type 7 has an invalid length. [ 71.751516][ T5164] netlink: 'syz.2.629': attribute type 8 has an invalid length. [ 71.759349][ T5164] netlink: 4 bytes leftover after parsing attributes in process `syz.2.629'. [ 71.770469][ T5172] netlink: 168 bytes leftover after parsing attributes in process `syz.3.630'. [ 72.062778][ T5183] xt_hashlimit: max too large, truncated to 1048576 [ 72.148081][ T5194] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.170897][ T5190] loop3: detected capacity change from 0 to 4096 [ 72.233199][ T5190] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 72.290312][ T5197] netlink: 'syz.4.644': attribute type 7 has an invalid length. [ 72.298491][ T5197] netlink: 'syz.4.644': attribute type 8 has an invalid length. [ 72.312476][ T5194] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.328978][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.454399][ T5194] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.552204][ T5218] xt_hashlimit: max too large, truncated to 1048576 [ 72.584985][ T5194] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.645722][ T37] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.664556][ T37] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.780690][ T5231] loop3: detected capacity change from 0 to 4096 [ 72.790305][ T5234] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=5234 comm=+}[@ [ 72.802702][ T5234] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=5234 comm=+}[@ [ 72.831624][ T5231] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 72.887781][ T37] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.899670][ T37] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.909862][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.023677][ T5247] loop0: detected capacity change from 0 to 512 [ 73.030448][ T5247] EXT4-fs: Ignoring removed mblk_io_submit option [ 73.039158][ T5247] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 73.061800][ T5247] EXT4-fs (loop0): 1 truncate cleaned up [ 73.068185][ T5247] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 73.107560][ T3315] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.327904][ T5267] loop0: detected capacity change from 0 to 4096 [ 73.348435][ T5267] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 73.416062][ T5276] loop1: detected capacity change from 0 to 512 [ 73.429202][ T5276] EXT4-fs: Ignoring removed mblk_io_submit option [ 73.440529][ T5276] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 73.443253][ T3315] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.459018][ T5276] EXT4-fs (loop1): 1 truncate cleaned up [ 73.466520][ T5276] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 73.505296][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.638075][ T5297] loop0: detected capacity change from 0 to 2048 [ 73.714842][ T5297] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 73.734295][ T5297] ext4 filesystem being mounted at /80/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 73.747281][ T5297] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.929272][ T5312] netlink: 'syz.2.691': attribute type 7 has an invalid length. [ 73.937332][ T5312] netlink: 'syz.2.691': attribute type 8 has an invalid length. [ 74.182648][ T5327] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=5327 comm=+}[@ [ 74.194880][ T5327] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=5327 comm=+}[@ [ 74.330757][ T5346] loop1: detected capacity change from 0 to 164 [ 74.412738][ T5351] netlink: 'syz.1.703': attribute type 13 has an invalid length. [ 74.640736][ T5364] Invalid ELF header type: 2 != 1 [ 74.810603][ T5389] Invalid ELF header type: 2 != 1 [ 74.883009][ T5396] --map-set only usable from mangle table [ 75.070889][ T5416] Invalid ELF header type: 2 != 1 [ 75.228604][ T5420] __nla_validate_parse: 23 callbacks suppressed [ 75.228621][ T5420] netlink: 28 bytes leftover after parsing attributes in process `syz.0.734'. [ 75.244186][ T5420] netlink: 'syz.0.734': attribute type 7 has an invalid length. [ 75.251871][ T5420] netlink: 'syz.0.734': attribute type 8 has an invalid length. [ 75.259618][ T5420] netlink: 4 bytes leftover after parsing attributes in process `syz.0.734'. [ 75.271143][ T5420] dummy0: entered promiscuous mode [ 75.277421][ T5420] team0: entered promiscuous mode [ 75.283417][ T5420] erspan0: entered promiscuous mode [ 75.289755][ T5420] debugfs: 'hsr1' already exists in 'hsr' [ 75.295708][ T5420] Cannot create hsr debugfs directory [ 75.301195][ T5420] hsr1: Slave B (team0) is not up; please bring it up to get a fully working HSR network [ 75.342850][ T5438] netlink: 4 bytes leftover after parsing attributes in process `syz.2.742'. [ 75.372238][ T5440] Invalid ELF header type: 2 != 1 [ 75.442632][ T5446] netlink: 8 bytes leftover after parsing attributes in process `syz.2.746'. [ 75.571911][ T5461] netlink: 4 bytes leftover after parsing attributes in process `syz.2.751'. [ 75.596634][ T5459] netlink: 20 bytes leftover after parsing attributes in process `syz.0.747'. [ 75.599700][ T5465] xt_hashlimit: max too large, truncated to 1048576 [ 75.648284][ T5469] loop1: detected capacity change from 0 to 164 [ 75.701763][ T5469] netlink: 'gtp': attribute type 13 has an invalid length. [ 75.709972][ T5474] netlink: 20 bytes leftover after parsing attributes in process `syz.2.756'. [ 75.754958][ T5476] netlink: 12 bytes leftover after parsing attributes in process `syz.1.757'. [ 75.802277][ T5480] loop1: detected capacity change from 0 to 2048 [ 75.831048][ T5480] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 75.849242][ T5480] ext4 filesystem being mounted at /150/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 75.862157][ T5489] xt_hashlimit: max too large, truncated to 1048576 [ 75.882166][ T5480] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 75.990119][ T5503] loop3: detected capacity change from 0 to 4096 [ 76.001133][ T5503] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 76.077082][ T5514] netlink: 12 bytes leftover after parsing attributes in process `syz.4.773'. [ 76.090294][ T5515] --map-set only usable from mangle table [ 76.122304][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 76.163723][ T5521] xt_hashlimit: max too large, truncated to 1048576 [ 76.317815][ T5530] netlink: 28 bytes leftover after parsing attributes in process `syz.2.782'. [ 76.327598][ T5530] netlink: 'syz.2.782': attribute type 7 has an invalid length. [ 76.335599][ T5530] netlink: 'syz.2.782': attribute type 8 has an invalid length. [ 76.464541][ T5544] loop0: detected capacity change from 0 to 1024 [ 76.502985][ T5544] EXT4-fs: Ignoring removed nobh option [ 76.534764][ T5544] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 76.547872][ T29] kauditd_printk_skb: 850 callbacks suppressed [ 76.547890][ T29] audit: type=1326 audit(1760747279.242:7543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5553 comm="syz.4.792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 76.567498][ T5544] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #11: comm syz.0.788: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 76.596977][ T29] audit: type=1326 audit(1760747279.242:7544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5553 comm="syz.4.792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 76.621376][ T29] audit: type=1326 audit(1760747279.242:7545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5553 comm="syz.4.792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 76.646145][ T29] audit: type=1326 audit(1760747279.242:7546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5553 comm="syz.4.792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 76.671242][ T29] audit: type=1326 audit(1760747279.242:7547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5553 comm="syz.4.792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 76.695087][ T29] audit: type=1326 audit(1760747279.242:7548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5553 comm="syz.4.792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 76.718600][ T29] audit: type=1326 audit(1760747279.242:7549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5553 comm="syz.4.792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 76.742216][ T29] audit: type=1326 audit(1760747279.242:7550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5553 comm="syz.4.792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 76.777036][ T29] audit: type=1326 audit(1760747279.242:7551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5553 comm="syz.4.792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 76.786630][ T5544] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.788: couldn't read orphan inode 11 (err -117) [ 76.800554][ T29] audit: type=1326 audit(1760747279.242:7552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5553 comm="syz.4.792" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 76.839294][ T5544] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 76.870646][ T5544] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:483: comm syz.0.788: Invalid block bitmap block 0 in block_group 0 [ 76.887135][ T5544] EXT4-fs error (device loop0): ext4_acquire_dquot:6945: comm syz.0.788: Failed to acquire dquot type 0 [ 76.905614][ T5544] EXT4-fs error (device loop0): ext4_read_inode_bitmap:139: comm syz.0.788: Invalid inode bitmap blk 137438953472 in block_group 0 [ 76.992656][ T5544] veth0: entered promiscuous mode [ 77.058798][ T5578] netlink: 'syz.3.802': attribute type 7 has an invalid length. [ 77.066827][ T5578] netlink: 'syz.3.802': attribute type 8 has an invalid length. [ 77.076763][ T5578] dummy0: entered promiscuous mode [ 77.082784][ T5578] team0: entered promiscuous mode [ 77.087846][ T5578] team_slave_0: entered promiscuous mode [ 77.093632][ T5578] team_slave_1: entered promiscuous mode [ 77.099835][ T5578] erspan0: entered promiscuous mode [ 77.105633][ T5578] debugfs: 'hsr1' already exists in 'hsr' [ 77.111592][ T5578] Cannot create hsr debugfs directory [ 77.117241][ T5578] hsr1: Slave A (dummy0) is not up; please bring it up to get a fully working HSR network [ 77.127445][ T5578] hsr1: Slave B (team0) is not up; please bring it up to get a fully working HSR network [ 77.137400][ T5578] hsr1: Interlink (erspan0) is not up; please bring it up to get a fully working HSR network [ 77.304613][ T5590] lo speed is unknown, defaulting to 1000 [ 77.369108][ T12] EXT4-fs error (device loop0): __ext4_get_inode_loc:4832: comm kworker/u8:0: Invalid inode table block 18446744065119617025 in block_group 0 [ 77.386122][ T3315] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.636003][ T5616] loop1: detected capacity change from 0 to 512 [ 77.659793][ T5616] EXT4-fs: Ignoring removed mblk_io_submit option [ 77.671826][ T5616] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 77.692009][ T5616] EXT4-fs (loop1): 1 truncate cleaned up [ 77.698330][ T5616] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 77.790309][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.863857][ T5630] loop1: detected capacity change from 0 to 512 [ 77.882635][ T5630] EXT4-fs: Ignoring removed mblk_io_submit option [ 77.890144][ T5630] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 77.909499][ T5630] EXT4-fs (loop1): 1 truncate cleaned up [ 77.946121][ T5630] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 77.986154][ T5630] EXT4-fs (loop1): shut down requested (2) [ 78.010811][ T5630] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 78.067795][ T5630] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 78.127430][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.463160][ T5677] loop3: detected capacity change from 0 to 4096 [ 78.516874][ T5677] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 78.640736][ T5687] lo speed is unknown, defaulting to 1000 [ 78.655027][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.777453][ T5701] loop3: detected capacity change from 0 to 164 [ 78.789241][ T5705] xt_hashlimit: max too large, truncated to 1048576 [ 78.970427][ T5717] --map-set only usable from mangle table [ 79.234535][ T5707] Set syz1 is full, maxelem 65536 reached [ 79.468430][ T5739] validate_nla: 3 callbacks suppressed [ 79.468446][ T5739] netlink: 'syz.1.866': attribute type 7 has an invalid length. [ 79.482105][ T5739] netlink: 'syz.1.866': attribute type 8 has an invalid length. [ 79.597202][ T5752] loop1: detected capacity change from 0 to 512 [ 79.604284][ T5752] EXT4-fs: Ignoring removed mblk_io_submit option [ 79.613820][ T5752] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 79.624853][ T5752] EXT4-fs (loop1): 1 truncate cleaned up [ 79.631679][ T5752] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 79.645062][ T5752] EXT4-fs (loop1): shut down requested (2) [ 79.651176][ T5752] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 79.660592][ T5752] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 79.681565][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 79.739864][ T5757] loop1: detected capacity change from 0 to 4096 [ 79.755663][ T5757] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 79.791262][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 79.877160][ T5771] loop1: detected capacity change from 0 to 164 [ 79.924009][ T5775] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=5775 comm=+}[@ [ 79.936215][ T5775] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=5775 comm=+}[@ [ 79.961624][ T5776] netlink: 'syz.1.877': attribute type 13 has an invalid length. [ 80.028090][ T5781] lo speed is unknown, defaulting to 1000 [ 80.081453][ T5785] loop1: detected capacity change from 0 to 512 [ 80.088518][ T5785] EXT4-fs: Ignoring removed mblk_io_submit option [ 80.103581][ T5785] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 80.123491][ T5785] EXT4-fs (loop1): 1 truncate cleaned up [ 80.131720][ T5785] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 80.145646][ T5785] EXT4-fs (loop1): shut down requested (2) [ 80.151967][ T5785] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 80.161564][ T5785] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 80.191129][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 80.240107][ T5791] xt_hashlimit: max too large, truncated to 1048576 [ 80.253508][ T5792] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.284748][ T5792] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.354773][ T5801] xt_hashlimit: max too large, truncated to 1048576 [ 80.373000][ T5792] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.453394][ T5792] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.482498][ T5808] __nla_validate_parse: 17 callbacks suppressed [ 80.482520][ T5808] netlink: 4 bytes leftover after parsing attributes in process `syz.2.891'. [ 80.560729][ T270] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.572450][ T270] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.584592][ T31] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.598166][ T31] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.869920][ T5828] xt_hashlimit: max too large, truncated to 1048576 [ 80.888390][ T5830] netlink: 8 bytes leftover after parsing attributes in process `syz.4.900'. [ 80.964743][ T5836] loop0: detected capacity change from 0 to 4096 [ 81.000664][ T5836] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 81.065238][ T3315] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 81.107369][ T5840] netlink: 4 bytes leftover after parsing attributes in process `syz.0.903'. [ 81.139659][ T5842] loop0: detected capacity change from 0 to 164 [ 81.399295][ T5846] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=5846 comm=+}[@ [ 81.411584][ T5846] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=5846 comm=+}[@ [ 81.512164][ T5830] Set syz1 is full, maxelem 65536 reached [ 81.577843][ T29] kauditd_printk_skb: 572 callbacks suppressed [ 81.577920][ T29] audit: type=1326 audit(1760747284.272:8123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5851 comm="syz.4.908" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 81.637499][ T5852] --map-set only usable from mangle table [ 81.643335][ T29] audit: type=1326 audit(1760747284.292:8124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5851 comm="syz.4.908" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 81.667677][ T29] audit: type=1326 audit(1760747284.292:8125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5851 comm="syz.4.908" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 81.692093][ T29] audit: type=1326 audit(1760747284.292:8126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5851 comm="syz.4.908" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 81.715721][ T29] audit: type=1326 audit(1760747284.292:8127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5851 comm="syz.4.908" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 81.740104][ T29] audit: type=1326 audit(1760747284.302:8128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5851 comm="syz.4.908" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 81.763848][ T29] audit: type=1326 audit(1760747284.302:8129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5851 comm="syz.4.908" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 81.787834][ T29] audit: type=1326 audit(1760747284.302:8130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5851 comm="syz.4.908" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 81.812002][ T29] audit: type=1326 audit(1760747284.302:8131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5851 comm="syz.4.908" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 81.836397][ T29] audit: type=1326 audit(1760747284.302:8132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5851 comm="syz.4.908" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 81.938062][ T5862] netlink: 8 bytes leftover after parsing attributes in process `syz.3.913'. [ 82.038020][ T5860] netlink: 28 bytes leftover after parsing attributes in process `syz.0.910'. [ 82.047114][ T5860] netlink: 'syz.0.910': attribute type 7 has an invalid length. [ 82.054915][ T5860] netlink: 'syz.0.910': attribute type 8 has an invalid length. [ 82.062855][ T5860] netlink: 4 bytes leftover after parsing attributes in process `syz.0.910'. [ 82.065636][ T5871] loop3: detected capacity change from 0 to 1024 [ 82.084283][ T5871] EXT4-fs: Ignoring removed nobh option [ 82.098196][ T5871] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 82.109530][ T5871] EXT4-fs error (device loop3): ext4_ext_check_inode:523: inode #11: comm syz.3.916: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 82.109788][ T5873] netlink: 8 bytes leftover after parsing attributes in process `syz.4.917'. [ 82.129198][ T5871] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.916: couldn't read orphan inode 11 (err -117) [ 82.150361][ T5871] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 82.171052][ T5871] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:483: comm syz.3.916: Invalid block bitmap block 0 in block_group 0 [ 82.186316][ T5871] EXT4-fs error (device loop3): ext4_acquire_dquot:6945: comm syz.3.916: Failed to acquire dquot type 0 [ 82.199577][ T5871] EXT4-fs error (device loop3): ext4_read_inode_bitmap:139: comm syz.3.916: Invalid inode bitmap blk 137438953472 in block_group 0 [ 82.304349][ T5888] --map-set only usable from mangle table [ 82.311162][ T5871] netlink: 4 bytes leftover after parsing attributes in process `syz.3.916'. [ 82.334744][ T5883] netlink: 4 bytes leftover after parsing attributes in process `syz.2.919'. [ 82.347766][ T5893] loop0: detected capacity change from 0 to 2048 [ 82.364636][ T4855] EXT4-fs error (device loop3): __ext4_get_inode_loc:4832: comm kworker/u8:8: Invalid inode table block 18446744065119617025 in block_group 0 [ 82.382868][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 82.408758][ T5893] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 82.439802][ T5893] ext4 filesystem being mounted at /121/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 82.481033][ T5893] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 82.494626][ T5907] netlink: 'syz.4.925': attribute type 13 has an invalid length. [ 82.569064][ T5911] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=5911 comm=+}[@ [ 82.581093][ T5911] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=5911 comm=+}[@ [ 82.717318][ T5918] xt_hashlimit: max too large, truncated to 1048576 [ 82.763280][ T5920] --map-set only usable from mangle table [ 82.786798][ T5922] netlink: 8 bytes leftover after parsing attributes in process `syz.2.932'. [ 82.968267][ T5944] netlink: 'syz.2.942': attribute type 13 has an invalid length. [ 83.080463][ T5950] --map-set only usable from mangle table [ 83.252524][ T5972] xt_hashlimit: max too large, truncated to 1048576 [ 83.322983][ T5979] netlink: 'syz.4.956': attribute type 13 has an invalid length. [ 83.415897][ T5986] loop3: detected capacity change from 0 to 4096 [ 83.448062][ T5986] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 83.519722][ T6002] xt_hashlimit: max too large, truncated to 1048576 [ 83.527500][ T3311] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 83.648341][ T6015] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=6015 comm=+}[@ [ 83.661328][ T6015] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=6015 comm=+}[@ [ 83.727186][ T6022] loop1: detected capacity change from 0 to 4096 [ 83.743014][ T6022] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 83.796950][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.275248][ T6058] netlink: 'syz.2.991': attribute type 7 has an invalid length. [ 84.283045][ T6058] netlink: 'syz.2.991': attribute type 8 has an invalid length. [ 84.414708][ T6071] loop1: detected capacity change from 0 to 1024 [ 84.422586][ T6071] EXT4-fs: Ignoring removed nobh option [ 84.434335][ T6071] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 84.447940][ T6071] EXT4-fs error (device loop1): ext4_ext_check_inode:523: inode #11: comm syz.1.995: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 84.467732][ T6071] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.995: couldn't read orphan inode 11 (err -117) [ 84.480190][ T6071] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 84.507440][ T6071] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:483: comm syz.1.995: Invalid block bitmap block 0 in block_group 0 [ 84.536932][ T6071] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.995: Failed to acquire dquot type 0 [ 84.553045][ T6071] EXT4-fs error (device loop1): ext4_read_inode_bitmap:139: comm syz.1.995: Invalid inode bitmap blk 137438953472 in block_group 0 [ 84.592265][ T12] EXT4-fs error (device loop1): __ext4_get_inode_loc:4832: comm kworker/u8:0: Invalid inode table block 18446744065119617025 in block_group 0 [ 84.608552][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.633024][ T6090] xt_hashlimit: max too large, truncated to 1048576 [ 84.835828][ T6086] syz.3.1001 (6086) used greatest stack depth: 9824 bytes left [ 84.889141][ T6110] --map-set only usable from mangle table [ 84.923766][ T6112] loop1: detected capacity change from 0 to 4096 [ 84.936535][ T6112] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 85.010163][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 85.107466][ T6130] loop1: detected capacity change from 0 to 512 [ 85.114636][ T6130] EXT4-fs: Ignoring removed mblk_io_submit option [ 85.124957][ T6130] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 85.137793][ T6130] EXT4-fs (loop1): 1 truncate cleaned up [ 85.152025][ T6130] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 85.174469][ T6130] EXT4-fs (loop1): shut down requested (2) [ 85.180839][ T6130] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 85.192952][ T6130] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop1 ino=12 [ 85.283752][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 85.417282][ T6148] loop1: detected capacity change from 0 to 164 [ 85.551980][ T6154] __nla_validate_parse: 13 callbacks suppressed [ 85.552032][ T6154] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1032'. [ 85.567966][ T6154] netlink: 'syz.4.1032': attribute type 7 has an invalid length. [ 85.576110][ T6154] netlink: 'syz.4.1032': attribute type 8 has an invalid length. [ 85.584179][ T6154] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1032'. [ 85.746231][ T6169] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1038'. [ 85.895331][ T6189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1045'. [ 86.046041][ T6194] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1048'. [ 86.055216][ T6194] netlink: 'syz.1.1048': attribute type 7 has an invalid length. [ 86.061090][ T6197] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1046'. [ 86.063197][ T6194] netlink: 'syz.1.1048': attribute type 8 has an invalid length. [ 86.072557][ T6197] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1046'. [ 86.080623][ T6194] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1048'. [ 86.533261][ T6215] FAULT_INJECTION: forcing a failure. [ 86.533261][ T6215] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 86.546448][ T6215] CPU: 0 UID: 0 PID: 6215 Comm: syz.1.1055 Not tainted syzkaller #0 PREEMPT(voluntary) [ 86.546481][ T6215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 86.546498][ T6215] Call Trace: [ 86.546507][ T6215] [ 86.546517][ T6215] __dump_stack+0x1d/0x30 [ 86.546573][ T6215] dump_stack_lvl+0xe8/0x140 [ 86.546687][ T6215] dump_stack+0x15/0x1b [ 86.546710][ T6215] should_fail_ex+0x265/0x280 [ 86.546798][ T6215] should_fail+0xb/0x20 [ 86.546840][ T6215] should_fail_usercopy+0x1a/0x20 [ 86.546898][ T6215] _copy_to_user+0x20/0xa0 [ 86.546933][ T6215] simple_read_from_buffer+0xb5/0x130 [ 86.546957][ T6215] proc_fail_nth_read+0x10e/0x150 [ 86.546986][ T6215] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 86.547055][ T6215] vfs_read+0x1a8/0x770 [ 86.547083][ T6215] ? __rcu_read_unlock+0x4f/0x70 [ 86.547108][ T6215] ? __fget_files+0x184/0x1c0 [ 86.547138][ T6215] ? finish_task_switch+0xad/0x2b0 [ 86.547227][ T6215] ksys_read+0xda/0x1a0 [ 86.547252][ T6215] __x64_sys_read+0x40/0x50 [ 86.547274][ T6215] x64_sys_call+0x27c0/0x3000 [ 86.547365][ T6215] do_syscall_64+0xd2/0x200 [ 86.547398][ T6215] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 86.547435][ T6215] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 86.547457][ T6215] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.547524][ T6215] RIP: 0033:0x7fd95bc7d9dc [ 86.547542][ T6215] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 86.547566][ T6215] RSP: 002b:00007fd95a6be030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 86.547585][ T6215] RAX: ffffffffffffffda RBX: 00007fd95bed6090 RCX: 00007fd95bc7d9dc [ 86.547599][ T6215] RDX: 000000000000000f RSI: 00007fd95a6be0a0 RDI: 0000000000000003 [ 86.547611][ T6215] RBP: 00007fd95a6be090 R08: 0000000000000000 R09: 0000000000000000 [ 86.547624][ T6215] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 86.547653][ T6215] R13: 00007fd95bed6128 R14: 00007fd95bed6090 R15: 00007ffcfb6084d8 [ 86.547672][ T6215] [ 86.823258][ T29] kauditd_printk_skb: 789 callbacks suppressed [ 86.823275][ T29] audit: type=1326 audit(1760747289.472:8918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6211 comm="syz.1.1055" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd95bc7efc9 code=0x7ffc0000 [ 86.921475][ T6223] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1058'. [ 87.035492][ T6227] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1056'. [ 87.065409][ T6231] xt_hashlimit: max too large, truncated to 1048576 [ 87.208574][ T6243] loop0: detected capacity change from 0 to 2048 [ 87.326764][ T29] audit: type=1326 audit(1760747290.012:8919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6253 comm="syz.4.1065" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 87.350985][ T29] audit: type=1326 audit(1760747290.012:8920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6253 comm="syz.4.1065" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 87.375455][ T29] audit: type=1326 audit(1760747290.012:8921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6253 comm="syz.4.1065" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 87.400735][ T29] audit: type=1326 audit(1760747290.012:8922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6253 comm="syz.4.1065" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 87.424713][ T29] audit: type=1326 audit(1760747290.012:8923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6253 comm="syz.4.1065" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 87.448683][ T29] audit: type=1326 audit(1760747290.012:8924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6253 comm="syz.4.1065" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 87.463855][ T6260] loop0: detected capacity change from 0 to 1024 [ 87.472468][ T29] audit: type=1326 audit(1760747290.012:8925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6253 comm="syz.4.1065" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 87.472520][ T29] audit: type=1326 audit(1760747290.012:8926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6253 comm="syz.4.1065" exe="/root/syz-executor" sig=0 arch=c000003e syscall=65 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 87.472553][ T29] audit: type=1326 audit(1760747290.012:8927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6253 comm="syz.4.1065" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 87.479897][ T6260] EXT4-fs: Ignoring removed nobh option [ 87.506983][ T6262] xt_hashlimit: max too large, truncated to 1048576 [ 87.559777][ T6260] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 87.590785][ T6260] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #11: comm syz.0.1074: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 87.617579][ T6260] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.1074: couldn't read orphan inode 11 (err -117) [ 87.630275][ T6260] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 87.661428][ T6260] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:483: comm syz.0.1074: Invalid block bitmap block 0 in block_group 0 [ 87.675600][ T6260] EXT4-fs error (device loop0): ext4_acquire_dquot:6945: comm syz.0.1074: Failed to acquire dquot type 0 [ 87.688417][ T6260] EXT4-fs error (device loop0): ext4_read_inode_bitmap:139: comm syz.0.1074: Invalid inode bitmap blk 137438953472 in block_group 0 [ 87.853199][ T6279] netlink: 'syz.1.1080': attribute type 7 has an invalid length. [ 87.861323][ T6279] netlink: 'syz.1.1080': attribute type 8 has an invalid length. [ 87.874725][ T31] EXT4-fs error (device loop0): __ext4_get_inode_loc:4832: comm kworker/u8:1: Invalid inode table block 18446744065119617025 in block_group 0 [ 87.897140][ T3315] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 88.030711][ T6287] loop1: detected capacity change from 0 to 164 [ 88.068799][ T6293] xt_hashlimit: max too large, truncated to 1048576 [ 88.150843][ T6297] --map-set only usable from mangle table [ 88.173107][ T6299] loop1: detected capacity change from 0 to 1024 [ 88.180282][ T6299] EXT4-fs: Ignoring removed orlov option [ 88.217284][ T6299] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 88.264597][ T6314] loop0: detected capacity change from 0 to 1024 [ 88.272825][ T6314] EXT4-fs: Ignoring removed nobh option [ 88.281748][ T6314] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 88.298839][ T6314] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #11: comm syz.0.1093: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 88.323417][ T6314] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.1093: couldn't read orphan inode 11 (err -117) [ 88.341899][ T6314] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 88.357917][ T6318] xt_hashlimit: max too large, truncated to 1048576 [ 88.372722][ T6314] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:483: comm syz.0.1093: Invalid block bitmap block 0 in block_group 0 [ 88.386763][ T6314] EXT4-fs error (device loop0): ext4_acquire_dquot:6945: comm syz.0.1093: Failed to acquire dquot type 0 [ 88.421763][ T52] EXT4-fs error (device loop0): __ext4_get_inode_loc:4832: comm kworker/u8:3: Invalid inode table block 18446744065119617025 in block_group 0 [ 88.442757][ T6299] syz.1.1089 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 88.464595][ T3315] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 88.476856][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 88.544661][ T6327] loop0: detected capacity change from 0 to 164 [ 88.556930][ T6330] netlink: 'syz.4.1098': attribute type 13 has an invalid length. [ 88.636141][ T6343] loop1: detected capacity change from 0 to 1024 [ 88.643972][ T6343] EXT4-fs: Ignoring removed nobh option [ 88.653193][ T6341] --map-set only usable from mangle table [ 88.657993][ T6343] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 88.686734][ T6343] EXT4-fs error (device loop1): ext4_ext_check_inode:523: inode #11: comm syz.1.1104: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 88.711597][ T6343] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.1104: couldn't read orphan inode 11 (err -117) [ 88.718535][ T6349] loop0: detected capacity change from 0 to 1024 [ 88.728531][ T6343] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 88.735432][ T6349] EXT4-fs: Ignoring removed nobh option [ 88.749339][ T6343] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:483: comm syz.1.1104: Invalid block bitmap block 0 in block_group 0 [ 88.749502][ T6349] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 88.763874][ T6343] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.1104: Failed to acquire dquot type 0 [ 88.787128][ T6343] EXT4-fs error (device loop1): ext4_read_inode_bitmap:139: comm syz.1.1104: Invalid inode bitmap blk 137438953472 in block_group 0 [ 88.787108][ T6349] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #11: comm syz.0.1106: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 88.787235][ T6349] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.1106: couldn't read orphan inode 11 (err -117) [ 88.832483][ T6349] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 88.849242][ T6349] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:483: comm syz.0.1106: Invalid block bitmap block 0 in block_group 0 [ 88.862108][ T6343] veth0: entered promiscuous mode [ 88.863405][ T6349] EXT4-fs error (device loop0): ext4_acquire_dquot:6945: comm syz.0.1106: Failed to acquire dquot type 0 [ 88.880495][ T6343] veth0 (unregistering): left promiscuous mode [ 88.899784][ T3315] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 88.909326][ T31] EXT4-fs error (device loop0): ext4_release_dquot:6981: comm kworker/u8:1: Failed to release dquot type 0 [ 88.940702][ T31] EXT4-fs error (device loop1): __ext4_get_inode_loc:4832: comm kworker/u8:1: Invalid inode table block 18446744065119617025 in block_group 0 [ 88.968262][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.037133][ T6359] loop1: detected capacity change from 0 to 4096 [ 89.047686][ T6363] loop3: detected capacity change from 0 to 164 [ 89.057343][ T6359] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 89.097350][ T6367] loop0: detected capacity change from 0 to 164 [ 89.120503][ T6363] netlink: 'gtp': attribute type 13 has an invalid length. [ 89.142529][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.259795][ T6376] loop3: detected capacity change from 0 to 1024 [ 89.268642][ T6376] EXT4-fs: Ignoring removed nobh option [ 89.276186][ T6372] --map-set only usable from mangle table [ 89.286230][ T6376] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 89.311714][ T6376] EXT4-fs error (device loop3): ext4_ext_check_inode:523: inode #11: comm syz.3.1117: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 89.324098][ T6382] loop0: detected capacity change from 0 to 1024 [ 89.333809][ T6383] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=6383 comm=+}[@ [ 89.339523][ T6382] EXT4-fs: Ignoring removed nobh option [ 89.349058][ T6383] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=6383 comm=+}[@ [ 89.367660][ T6376] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.1117: couldn't read orphan inode 11 (err -117) [ 89.379654][ T6382] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 89.392307][ T6382] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #11: comm syz.0.1119: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 89.403817][ T6376] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:483: comm syz.3.1117: Invalid block bitmap block 0 in block_group 0 [ 89.412169][ T6382] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.1119: couldn't read orphan inode 11 (err -117) [ 89.425729][ T6376] EXT4-fs error (device loop3): ext4_acquire_dquot:6945: comm syz.3.1117: Failed to acquire dquot type 0 [ 89.443683][ T6382] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:483: comm syz.0.1119: Invalid block bitmap block 0 in block_group 0 [ 89.462460][ T6382] EXT4-fs error (device loop0): ext4_acquire_dquot:6945: comm syz.0.1119: Failed to acquire dquot type 0 [ 89.476117][ T6382] EXT4-fs error (device loop0): ext4_read_inode_bitmap:139: comm syz.0.1119: Invalid inode bitmap blk 137438953472 in block_group 0 [ 89.491444][ T31] EXT4-fs error (device loop3): ext4_release_dquot:6981: comm kworker/u8:1: Failed to release dquot type 0 [ 89.572674][ T6391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 89.582083][ T6391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 89.604315][ T31] EXT4-fs error (device loop0): __ext4_get_inode_loc:4832: comm kworker/u8:1: Invalid inode table block 18446744065119617025 in block_group 0 [ 89.678513][ T6399] loop0: detected capacity change from 0 to 4096 [ 89.770755][ T6406] loop0: detected capacity change from 0 to 164 [ 89.825278][ T6408] loop0: detected capacity change from 0 to 164 [ 89.885931][ T6408] netlink: 'gtp': attribute type 13 has an invalid length. [ 90.038865][ T6414] --map-set only usable from mangle table [ 90.319261][ T6427] loop3: detected capacity change from 0 to 4096 [ 90.419332][ T6441] loop3: detected capacity change from 0 to 164 [ 90.560488][ T6408] batman_adv: batadv0: Interface deactivated: veth1_vlan [ 90.621415][ T31] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.639888][ T31] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.654450][ T31] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.666518][ T6446] __nla_validate_parse: 13 callbacks suppressed [ 90.666540][ T6446] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1139'. [ 90.683959][ T31] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.747281][ T6448] --map-set only usable from mangle table [ 90.914717][ T6461] loop1: detected capacity change from 0 to 1024 [ 90.944349][ T6470] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1150'. [ 90.971960][ T6461] ext4 filesystem being mounted at /235/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 90.989906][ T6476] loop3: detected capacity change from 0 to 164 [ 91.050727][ T6486] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1153'. [ 91.054256][ T6476] netlink: 'gtp': attribute type 13 has an invalid length. [ 91.062345][ T6478] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1151'. [ 91.260675][ T6505] loop1: detected capacity change from 0 to 4096 [ 91.363281][ T6521] loop1: detected capacity change from 0 to 1024 [ 91.372994][ T6521] EXT4-fs: Ignoring removed nobh option [ 91.381675][ T6521] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 91.382474][ T6514] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1165'. [ 91.403327][ T6521] EXT4-fs error (device loop1): ext4_ext_check_inode:523: inode #11: comm syz.1.1166: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 91.422834][ T6521] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.1166: couldn't read orphan inode 11 (err -117) [ 91.437257][ T6521] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:483: comm syz.1.1166: Invalid block bitmap block 0 in block_group 0 [ 91.451063][ T6521] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.1166: Failed to acquire dquot type 0 [ 91.488130][ T6525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1163'. [ 91.497187][ T6525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1163'. [ 91.511338][ T52] EXT4-fs error (device loop1): ext4_release_dquot:6981: comm kworker/u8:3: Failed to release dquot type 0 [ 91.591260][ T6531] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1167'. [ 91.634606][ T6529] netlink: 'syz.2.1168': attribute type 13 has an invalid length. [ 91.682147][ T6535] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1170'. [ 91.846571][ T29] kauditd_printk_skb: 1465 callbacks suppressed [ 91.846588][ T29] audit: type=1326 audit(1760747294.542:10376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6545 comm="syz.4.1176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 91.868568][ T6548] xt_hashlimit: max too large, truncated to 1048576 [ 91.901569][ T29] audit: type=1326 audit(1760747294.542:10377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6545 comm="syz.4.1176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 91.925374][ T29] audit: type=1326 audit(1760747294.542:10378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6545 comm="syz.4.1176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 91.949358][ T29] audit: type=1326 audit(1760747294.542:10379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6545 comm="syz.4.1176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 91.973384][ T29] audit: type=1326 audit(1760747294.542:10380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6545 comm="syz.4.1176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 91.997216][ T29] audit: type=1326 audit(1760747294.542:10381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6545 comm="syz.4.1176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 92.021653][ T29] audit: type=1326 audit(1760747294.542:10382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6545 comm="syz.4.1176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 92.045665][ T29] audit: type=1326 audit(1760747294.542:10383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6545 comm="syz.4.1176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 92.069210][ T29] audit: type=1326 audit(1760747294.542:10384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6545 comm="syz.4.1176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 92.093177][ T29] audit: type=1326 audit(1760747294.542:10385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6545 comm="syz.4.1176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 92.161596][ T6555] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1179'. [ 92.192426][ T6560] loop1: detected capacity change from 0 to 128 [ 92.211726][ T6560] syz.1.1180: attempt to access beyond end of device [ 92.211726][ T6560] loop1: rw=2049, sector=145, nr_sectors = 3 limit=128 [ 92.370060][ T6580] xt_hashlimit: max too large, truncated to 1048576 [ 92.376506][ T6575] 9pnet_fd: Insufficient options for proto=fd [ 92.427169][ T6586] FAULT_INJECTION: forcing a failure. [ 92.427169][ T6586] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 92.440342][ T6586] CPU: 0 UID: 0 PID: 6586 Comm: syz.3.1191 Not tainted syzkaller #0 PREEMPT(voluntary) [ 92.440448][ T6586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 92.440546][ T6586] Call Trace: [ 92.440553][ T6586] [ 92.440560][ T6586] __dump_stack+0x1d/0x30 [ 92.440585][ T6586] dump_stack_lvl+0xe8/0x140 [ 92.440612][ T6586] dump_stack+0x15/0x1b [ 92.440635][ T6586] should_fail_ex+0x265/0x280 [ 92.440709][ T6586] should_fail+0xb/0x20 [ 92.440747][ T6586] should_fail_usercopy+0x1a/0x20 [ 92.440775][ T6586] _copy_from_user+0x1c/0xb0 [ 92.440809][ T6586] ___sys_sendmsg+0xc1/0x1d0 [ 92.440905][ T6586] __x64_sys_sendmsg+0xd4/0x160 [ 92.440986][ T6586] x64_sys_call+0x191e/0x3000 [ 92.441024][ T6586] do_syscall_64+0xd2/0x200 [ 92.441049][ T6586] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 92.441079][ T6586] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 92.441164][ T6586] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.441198][ T6586] RIP: 0033:0x7f30389aefc9 [ 92.441218][ T6586] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 92.441240][ T6586] RSP: 002b:00007f3037417038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 92.441264][ T6586] RAX: ffffffffffffffda RBX: 00007f3038c05fa0 RCX: 00007f30389aefc9 [ 92.441301][ T6586] RDX: 00000000000080c1 RSI: 0000200000000200 RDI: 0000000000000003 [ 92.441317][ T6586] RBP: 00007f3037417090 R08: 0000000000000000 R09: 0000000000000000 [ 92.441332][ T6586] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 92.441348][ T6586] R13: 00007f3038c06038 R14: 00007f3038c05fa0 R15: 00007fffed426818 [ 92.441372][ T6586] [ 92.791782][ T6600] netlink: 'syz.1.1197': attribute type 7 has an invalid length. [ 92.799966][ T6600] netlink: 'syz.1.1197': attribute type 8 has an invalid length. [ 92.960342][ T6620] xt_hashlimit: max too large, truncated to 1048576 [ 92.970858][ T6623] 9pnet_fd: Insufficient options for proto=fd [ 93.009478][ T6624] bond1: entered allmulticast mode [ 93.015043][ T6624] 8021q: adding VLAN 0 to HW filter on device bond1 [ 93.037783][ T6631] xt_hashlimit: max too large, truncated to 1048576 [ 93.194517][ T6652] xt_hashlimit: max too large, truncated to 1048576 [ 93.305873][ T6659] xt_hashlimit: max too large, truncated to 1048576 [ 93.635014][ T6687] loop0: detected capacity change from 0 to 1024 [ 93.642837][ T6687] EXT4-fs: Ignoring removed nobh option [ 93.657887][ T6687] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 93.674468][ T6687] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #11: comm syz.0.1234: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 93.695950][ T6687] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.1234: couldn't read orphan inode 11 (err -117) [ 93.716359][ T6687] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:483: comm syz.0.1234: Invalid block bitmap block 0 in block_group 0 [ 93.736328][ T6687] EXT4-fs error (device loop0): ext4_acquire_dquot:6945: comm syz.0.1234: Failed to acquire dquot type 0 [ 93.776426][ T6687] EXT4-fs error (device loop0): ext4_read_inode_bitmap:139: comm syz.0.1234: Invalid inode bitmap blk 137438953472 in block_group 0 [ 93.853439][ T4855] EXT4-fs error (device loop0): __ext4_get_inode_loc:4832: comm kworker/u8:8: Invalid inode table block 18446744065119617025 in block_group 0 [ 93.909906][ T6714] xt_hashlimit: max too large, truncated to 1048576 [ 93.976918][ T6716] loop0: detected capacity change from 0 to 164 [ 93.985751][ T6718] netlink: 'syz.4.1248': attribute type 10 has an invalid length. [ 93.994138][ T6718] ipvlan0: entered allmulticast mode [ 93.999542][ T6718] veth0_vlan: entered allmulticast mode [ 94.006372][ T6718] team0: Device ipvlan0 failed to register rx_handler [ 94.069515][ T6724] xt_hashlimit: max too large, truncated to 1048576 [ 94.156302][ T6727] --map-set only usable from mangle table [ 94.236268][ T6734] netlink: 'syz.3.1254': attribute type 7 has an invalid length. [ 94.244205][ T6734] netlink: 'syz.3.1254': attribute type 8 has an invalid length. [ 94.317153][ T6746] loop0: detected capacity change from 0 to 4096 [ 94.386518][ T6754] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=6754 comm=+}[@ [ 94.398709][ T6754] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=6754 comm=+}[@ [ 94.448825][ T6762] netlink: 'syz.0.1265': attribute type 10 has an invalid length. [ 94.457998][ T6762] netlink: 'syz.0.1265': attribute type 10 has an invalid length. [ 94.514205][ T6769] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 94.525993][ T6769] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.024001][ T6779] netlink: 'syz.1.1272': attribute type 7 has an invalid length. [ 95.237614][ T6798] loop3: detected capacity change from 0 to 512 [ 95.247388][ T6798] EXT4-fs: Ignoring removed nobh option [ 95.274114][ T6798] ext4 filesystem being mounted at /232/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 95.344662][ T6808] loop3: detected capacity change from 0 to 164 [ 95.588910][ T6826] 9pnet_fd: Insufficient options for proto=fd [ 95.674361][ T6835] __nla_validate_parse: 36 callbacks suppressed [ 95.674380][ T6835] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1294'. [ 95.745807][ T6836] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1292'. [ 95.887874][ T6846] loop3: detected capacity change from 0 to 512 [ 95.951089][ T6842] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1296'. [ 95.978172][ T6855] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1301'. [ 96.023549][ T6857] loop3: detected capacity change from 0 to 1024 [ 96.030567][ T6857] EXT4-fs: Ignoring removed nobh option [ 96.040705][ T6857] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 96.074679][ T6857] EXT4-fs error (device loop3): ext4_ext_check_inode:523: inode #11: comm syz.3.1302: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 96.076159][ T6864] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1304'. [ 96.096239][ T6867] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1305'. [ 96.129864][ T6857] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.1302: couldn't read orphan inode 11 (err -117) [ 96.156089][ T6857] EXT4-fs error (device loop3): ext4_read_block_bitmap_nowait:483: comm syz.3.1302: Invalid block bitmap block 0 in block_group 0 [ 96.171469][ T6857] EXT4-fs error (device loop3): ext4_acquire_dquot:6945: comm syz.3.1302: Failed to acquire dquot type 0 [ 96.191391][ T6874] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1308'. [ 96.202193][ T6857] EXT4-fs error (device loop3): ext4_read_inode_bitmap:139: comm syz.3.1302: Invalid inode bitmap blk 137438953472 in block_group 0 [ 96.262312][ T37] EXT4-fs error (device loop3): __ext4_get_inode_loc:4832: comm kworker/u8:2: Invalid inode table block 18446744065119617025 in block_group 0 [ 96.299555][ T6886] validate_nla: 2 callbacks suppressed [ 96.299573][ T6886] netlink: 'syz.4.1310': attribute type 13 has an invalid length. [ 96.322342][ T6880] --map-set only usable from mangle table [ 96.384169][ T6891] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1316'. [ 96.403172][ T6893] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1317'. [ 96.421763][ T6896] netlink: 'syz.2.1312': attribute type 13 has an invalid length. [ 96.444744][ T6898] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1318'. [ 96.627733][ T6913] loop0: detected capacity change from 0 to 4096 [ 96.640066][ T6916] --map-set only usable from mangle table [ 96.668204][ T6931] xt_hashlimit: max too large, truncated to 1048576 [ 96.760470][ T6939] loop0: detected capacity change from 0 to 164 [ 96.876144][ T29] kauditd_printk_skb: 847 callbacks suppressed [ 96.876165][ T29] audit: type=1326 audit(1760747299.562:11229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6959 comm="syz.4.1343" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 96.906283][ T29] audit: type=1326 audit(1760747299.562:11230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6959 comm="syz.4.1343" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 96.930005][ T29] audit: type=1326 audit(1760747299.562:11231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6959 comm="syz.4.1343" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 96.953622][ T29] audit: type=1326 audit(1760747299.562:11232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6959 comm="syz.4.1343" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 96.977406][ T29] audit: type=1326 audit(1760747299.562:11233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6959 comm="syz.4.1343" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 96.977457][ T6939] netlink: 'gtp': attribute type 13 has an invalid length. [ 97.008364][ T29] audit: type=1326 audit(1760747299.562:11234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6959 comm="syz.4.1343" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 97.032075][ T29] audit: type=1326 audit(1760747299.562:11235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6959 comm="syz.4.1343" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 97.056158][ T29] audit: type=1326 audit(1760747299.562:11236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6959 comm="syz.4.1343" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 97.079887][ T29] audit: type=1326 audit(1760747299.562:11237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6959 comm="syz.4.1343" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 97.104166][ T29] audit: type=1326 audit(1760747299.562:11238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6959 comm="syz.4.1343" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4be9c6efc9 code=0x7ffc0000 [ 97.113049][ T6967] xt_hashlimit: max too large, truncated to 1048576 [ 97.217225][ T6973] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 97.241303][ T6973] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 97.284588][ T6975] xt_hashlimit: max too large, truncated to 1048576 [ 97.333869][ T6977] --map-set only usable from mangle table [ 97.400826][ T6987] xt_hashlimit: max too large, truncated to 1048576 [ 97.444976][ T6989] loop0: detected capacity change from 0 to 4096 [ 97.547542][ T7002] netlink: 'syz.4.1358': attribute type 13 has an invalid length. [ 97.662510][ T7011] 9pnet_fd: Insufficient options for proto=fd [ 97.815499][ T7028] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=7028 comm=+}[@ [ 97.827882][ T7028] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=7028 comm=+}[@ [ 97.853256][ T7022] batman_adv: batadv0: Removing interface: veth1_vlan [ 98.014241][ T7043] loop3: detected capacity change from 0 to 164 [ 98.113530][ T7056] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 98.151367][ T7056] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 98.246645][ T7062] loop3: detected capacity change from 0 to 4096 [ 98.260612][ T7066] 9pnet_fd: Insufficient options for proto=fd [ 98.317820][ T7069] loop0: detected capacity change from 0 to 1024 [ 98.333780][ T7069] EXT4-fs: Ignoring removed nobh option [ 98.342616][ T7069] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 98.354801][ T7069] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #11: comm syz.0.1385: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 98.394407][ T7074] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=7074 comm=syz.3.1386 [ 98.407082][ T7074] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=7074 comm=syz.3.1386 [ 98.420543][ T7069] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.1385: couldn't read orphan inode 11 (err -117) [ 98.452263][ T7069] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:483: comm syz.0.1385: Invalid block bitmap block 0 in block_group 0 [ 98.475255][ T7069] EXT4-fs error (device loop0): ext4_acquire_dquot:6945: comm syz.0.1385: Failed to acquire dquot type 0 [ 98.508005][ T7075] EXT4-fs error (device loop0): ext4_read_inode_bitmap:139: comm syz.0.1385: Invalid inode bitmap blk 137438953472 in block_group 0 [ 98.756185][ T37] EXT4-fs error (device loop0): __ext4_get_inode_loc:4832: comm kworker/u8:2: Invalid inode table block 18446744065119617025 in block_group 0 [ 98.876459][ T7088] netlink: 'syz.3.1392': attribute type 7 has an invalid length. [ 98.884270][ T7088] netlink: 'syz.3.1392': attribute type 8 has an invalid length. [ 98.915579][ T7100] xt_hashlimit: max too large, truncated to 1048576 [ 98.922989][ T7098] xt_hashlimit: max too large, truncated to 1048576 [ 99.043307][ T7104] loop0: detected capacity change from 0 to 4096 [ 99.146856][ T7115] loop0: detected capacity change from 0 to 1024 [ 99.163082][ T7115] EXT4-fs: Ignoring removed nobh option [ 99.185133][ T7115] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 99.198769][ T7115] EXT4-fs error (device loop0): ext4_ext_check_inode:523: inode #11: comm syz.0.1400: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 99.246352][ T7115] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.1400: couldn't read orphan inode 11 (err -117) [ 99.264104][ T7120] 9pnet_fd: Insufficient options for proto=fd [ 99.283521][ T7115] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:483: comm syz.0.1400: Invalid block bitmap block 0 in block_group 0 [ 99.308132][ T7115] EXT4-fs error (device loop0): ext4_acquire_dquot:6945: comm syz.0.1400: Failed to acquire dquot type 0 [ 99.342577][ T7115] EXT4-fs error (device loop0): ext4_read_inode_bitmap:139: comm syz.0.1400: Invalid inode bitmap blk 137438953472 in block_group 0 [ 99.475346][ T4855] EXT4-fs error (device loop0): __ext4_get_inode_loc:4832: comm kworker/u8:8: Invalid inode table block 18446744065119617025 in block_group 0 [ 99.586330][ T7131] xt_hashlimit: max too large, truncated to 1048576 [ 99.747748][ T7138] netlink: 'syz.3.1408': attribute type 7 has an invalid length. [ 99.755609][ T7138] netlink: 'syz.3.1408': attribute type 8 has an invalid length. [ 99.802226][ T7148] loop0: detected capacity change from 0 to 4096 [ 99.962733][ T7164] xt_hashlimit: max too large, truncated to 1048576 [ 100.117308][ T7174] netlink: 'syz.2.1421': attribute type 13 has an invalid length. [ 100.251877][ T7177] xt_hashlimit: max too large, truncated to 1048576 [ 100.435814][ T7187] loop1: detected capacity change from 0 to 1024 [ 100.451844][ T7187] EXT4-fs: Ignoring removed nobh option [ 100.464380][ T7187] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 100.495021][ T7187] EXT4-fs error (device loop1): ext4_ext_check_inode:523: inode #11: comm syz.1.1423: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 32512(32512) [ 100.543778][ T7191] loop0: detected capacity change from 0 to 128 [ 100.568721][ T7191] EXT4-fs mount: 36 callbacks suppressed [ 100.568756][ T7191] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 100.591329][ T7187] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.1423: couldn't read orphan inode 11 (err -117) [ 100.606239][ T7187] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 100.620789][ T7191] ext4 filesystem being mounted at /229/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 100.636909][ T7187] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:483: comm syz.1.1423: Invalid block bitmap block 0 in block_group 0 [ 100.682549][ T7187] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.1423: Failed to acquire dquot type 0 [ 100.703258][ T3315] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 100.736951][ T7193] EXT4-fs error (device loop1): ext4_read_inode_bitmap:139: comm syz.1.1423: Invalid inode bitmap blk 137438953472 in block_group 0 [ 100.773689][ T7199] loop0: detected capacity change from 0 to 164 [ 100.784584][ T270] EXT4-fs error (device loop1): __ext4_get_inode_loc:4832: comm kworker/u8:4: Invalid inode table block 18446744065119617025 in block_group 0 [ 100.815357][ T3309] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 100.863935][ T3000] ================================================================== [ 100.873301][ T3000] BUG: KCSAN: data-race in set_nlink / set_nlink [ 100.880009][ T3000] [ 100.882525][ T3000] read to 0xffff888106d4ac50 of 4 bytes by task 3805 on cpu 0: [ 100.890637][ T3000] set_nlink+0x29/0xb0 [ 100.894910][ T3000] kernfs_iop_permission+0x1e2/0x220 [ 100.900345][ T3000] inode_permission+0x1ca/0x310 [ 100.905235][ T3000] link_path_walk+0x162/0x900 [ 100.909970][ T3000] path_openat+0x1de/0x2170 [ 100.914671][ T3000] do_filp_open+0x109/0x230 [ 100.919328][ T3000] do_sys_openat2+0xa6/0x110 [ 100.924139][ T3000] __x64_sys_openat+0xf2/0x120 [ 100.929034][ T3000] x64_sys_call+0x2eab/0x3000 [ 100.933741][ T3000] do_syscall_64+0xd2/0x200 [ 100.938289][ T3000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.944390][ T3000] [ 100.946738][ T3000] write to 0xffff888106d4ac50 of 4 bytes by task 3000 on cpu 1: [ 100.954508][ T3000] set_nlink+0x99/0xb0 [ 100.958629][ T3000] kernfs_iop_permission+0x1e2/0x220 [ 100.964090][ T3000] inode_permission+0x1ca/0x310 [ 100.968962][ T3000] link_path_walk+0x162/0x900 [ 100.973768][ T3000] path_lookupat+0x63/0x2a0 [ 100.978295][ T3000] filename_lookup+0x147/0x340 [ 100.983102][ T3000] vfs_statx+0x9d/0x390 [ 100.987538][ T3000] vfs_fstatat+0x115/0x170 [ 100.992165][ T3000] __se_sys_newfstatat+0x55/0x260 [ 100.997390][ T3000] __x64_sys_newfstatat+0x55/0x70 [ 101.002615][ T3000] x64_sys_call+0x135a/0x3000 [ 101.007320][ T3000] do_syscall_64+0xd2/0x200 [ 101.012034][ T3000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.017940][ T3000] [ 101.020293][ T3000] value changed: 0x00000009 -> 0x00000008 [ 101.026012][ T3000] [ 101.028338][ T3000] Reported by Kernel Concurrency Sanitizer on: [ 101.034533][ T3000] CPU: 1 UID: 0 PID: 3000 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) [ 101.044005][ T3000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 101.054073][ T3000] ================================================================== [ 101.110375][ T7198] __nla_validate_parse: 36 callbacks suppressed [ 101.110391][ T7198] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1432'. [ 101.186251][ T7206] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1435'. [ 101.196035][ T7206] netlink: 'syz.0.1435': attribute type 7 has an invalid length. [ 101.204463][ T7206] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1435'.