last executing test programs: 4.300538522s ago: executing program 4 (id=82): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r0, &(0x7f0000000400)=ANY=[], 0xff2e) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000000)={0x1, 0x6, 0x7fff, 0xa99, 0x1b, "88dc2fce0c62a8ea"}) 3.310515101s ago: executing program 4 (id=89): r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0b0000008b00000005000000090000000100"], 0x50) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000cc0)=[r0, 0xffffffffffffffff, 0xffffffffffffffff, r0, r0], 0x5) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r1}, &(0x7f0000000000), &(0x7f00000005c0)}, 0x20) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="020300030f0000002cbd7040fcdbdf2503000900800000001cdc0dca1d9f68846960e56de42944af030006000000000002004e22ac1414bb000000000000000002000100000000000000070c00000080030005000000000002004e22ac14140a00000000000000000200130002"], 0x78}, 0x1, 0x7}, 0x0) 2.839433918s ago: executing program 0 (id=96): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0b00000007000000d7c900000900000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000650000000800000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000a40)={&(0x7f0000000980)='sys_enter\x00', r2}, 0x10) clock_gettime(0x6, &(0x7f0000001c40)) 2.803056732s ago: executing program 3 (id=97): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000008500", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b7030000e8ffff05850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000a00)={&(0x7f0000000d00)='sched_switch\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) write(r1, &(0x7f0000000280)="e8bd8a4c56281ba2ba42cfa5b9fe5fc6dcde2ee431f5595ceadb9a2c95e57f15ee4a83f9e7d78ea996f78bd588bedcdbc730d6d15df6d2a26ca4e55e97ed0522a190ce241a37bad3317fba7e4be3dbbfec5e2f401b5658cc8fda", 0xffffffe5) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000440)={0x8, 0x9, 0x4, 0x9, 0x7, "efc64a26a83c8ffa332b3a5419e8ab2543c4ec"}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r2}, 0x18) r3 = socket$pptp(0x18, 0x1, 0x2) r4 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) io_uring_setup(0x1de0, &(0x7f00000000c0)={0x0, 0x45d6}) ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000c40)={0x0, 0xfe72}) ioctl$MON_IOCX_GETX(r4, 0x80089203, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a03000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000180003801400020000007468305f746f5f68737200000000080002"], 0xe8}}, 0x0) 2.759718655s ago: executing program 4 (id=99): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000003580)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000380)="a1", 0x1}], 0x1, &(0x7f0000000800)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r0, @ANYBLOB="0000000014"], 0x30, 0x40400d1}}], 0x1, 0x810) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0xa85, 0xf) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x2, 0x7fff8000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 2.750333737s ago: executing program 0 (id=100): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00'}, 0x18) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x3e8, 0x0, 0xc8, 0x8, 0x1b8, 0x5803, 0x318, 0x2e8, 0x2e8, 0x318, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x190, 0x1b8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1}}, @common=@inet=@socket3={{0x28}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x7d30}}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x13}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x448) 2.660415326s ago: executing program 4 (id=101): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x408, 0x230, 0x12, 0x60a, 0x0, 0x202, 0x338, 0x2e8, 0x2e8, 0x338, 0x2c0, 0x4, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @dev}, @mcast2, [], [], 'veth1_to_bond\x00', 'xfrm0\x00'}, 0x0, 0x108, 0x230, 0x0, {}, [@common=@unspec=@statistic={{0x38}}, @common=@inet=@socket2={{0x28}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x57c, 'system_u:object_r:file_context_t:s0\x00'}}}, {{@ipv6={@private2, @loopback, [], [], 'vxcan1\x00', 'geneve0\x00'}, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@empty, [], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x39e}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x468) 1.850630446s ago: executing program 1 (id=105): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000080000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000021440011800a0001006d617463680000003400028008000240000000001c0003000afe6cbf96caa5debdad61b67ddb2fb68fcf19f7807076430a00010071756f7461"], 0xc8}, 0x1, 0x0, 0x0, 0x4000005}, 0x20000004) 1.782250733s ago: executing program 2 (id=106): bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[], 0x50) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f0000000000000000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f00000000c0)='netlink_extack\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)=@newtaction={0x48, 0x30, 0x1, 0x0, 0x0, {}, [{0x34, 0x1, [@m_mpls={0x30, 0x1, 0x0, 0x0, {{0x9}, {0xfffffffffffffe7e}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4004004) 1.775552204s ago: executing program 0 (id=107): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee4, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x8001}}) io_uring_enter(r2, 0x2b93, 0xf9d0, 0x22, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) 1.679883233s ago: executing program 1 (id=108): mq_open(&(0x7f0000000a00)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!T\xeeux\x00\xbf@\xf4\x1c\xbce\xca\x97\xd5pkv\x88L\xe8$\xef\xfeI\xdaW1\xfcg\xa1\xdb$,0y$\xcd{zl.\xae\x805\xa8\xd6\x85\x15\xd2\x0e~\xcc\x90\x97\xe8h\v\x1a9X\a\xca{\x11#\x95m{U\xe5-\xabRw\xcafy\xe6\aNhX4Ll[\x14\x150x0}) bind$can_raw(r0, &(0x7f0000000000)={0x1d, r2}, 0x10) bind$can_raw(r0, &(0x7f0000000080)={0x1d, 0x0, 0x0, 0x1000000}, 0x10) 1.391694682s ago: executing program 3 (id=116): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}, @call={0x85, 0x0, 0x0, 0x50}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000208500000004"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a5df"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x29) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001f40)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='kfree\x00', r0}, 0x18) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000004c0)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[], [{@rootcontext={'rootcontext', 0x3d, 'root'}}], 0x6b}}) 1.372697394s ago: executing program 2 (id=117): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x100000a, 0x4082172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) 1.349956086s ago: executing program 0 (id=118): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x3e8, 0x0, 0xc8, 0x8, 0x1b8, 0x5803, 0x318, 0x2e8, 0x2e8, 0x318, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x190, 0x1b8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1}}, @common=@inet=@socket3={{0x28}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x7d30}}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x13}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x448) 1.30397058s ago: executing program 1 (id=119): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000001b80)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x800718, &(0x7f0000000200)={[{@nodioread_nolock}, {@journal_dev={'journal_dev', 0x3d, 0x40000ff}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x5c}}, {@nouid32}, {@resgid}, {@acl}, {@init_itable_val={'init_itable', 0x3d, 0x8d55}}]}, 0x0, 0x46f, &(0x7f0000001040)="$eJzs281rHOUfAPDvTF7a/vqS/Gp9aa0aLUJQTJq0ag9eFAWRioIe6jEm2xK6baSJYmuxqYgnQQp6Fo+if4E3EUQ9CV49eZJC0V7aeorM7Ey62WYTazaZ2P18YLPPM/PszvebeXv2eXYD6FpD2Z8kYkdE/BoRA43q0gZDjafrV89P3rh6fjKJhYXX/kjydteunp8sm5av215UhtOI9MOk2MhSs2fPnZyo12tnivro3Km3RmfPnnvinVMTJ2onaqfHjxw5fGjs6afGn+xInlle1/a9P7N/74tvXHp58tilN3/8Oot3R7G+OY9OGcoS/3Mh17ru0U5vrGI7m8pJb4WBcFt6IiLbXX35+T8QPXFz5w3ECx9UGhywrrJ705b2q+cXgDtYElVHAFSjvNFnn3/LxwZ1PTaFK882PgBleV8vHo01vZEWbfpaPt920lBEHJv/6/PsEes0DgEA0Ozjyc+O9kfEeze+einrewwsrknjnvz5t/zvrmIOZTAi/h8RuyPirojYExF3R+Rt742I+9YYz639n/TyGt9yRVn/75libmtp/6/s/cVgT1HbmefflxyfrtcOFv+T4ejbktXHVtjGt8//8km7dc39v+yRbb/sCxZxXO5tGaCbmpibyDulHXDlYsS+3uXyTxZnApKI2BsR+27vrXeVhenHvtzfrtHq+a+gA/NMC19k6c1n+c9HS/6lpHl+cvqW+cnRrVGvHRwtj4pb/fTzR6+22/6a8u+AK7XGc9P+b20ymDTP1852dvv/8vhP+5PX83nm/mLZuxNzc2fGIvqTo3l9yfLxm68t62X77PgfPrD8+b+7eE2W//0RkR3ED0TEgxHxUBH7wxHxSEQcWCHHH55bPf9IK9r/FyOmlr3+LR7/Lfv/9gs9J7//pt32/9n+P5yXhosl+fVvFcuFk10uWgNcy/8OAAAA/ivS/DvwSTqyWE7TkZHGd/j3xP/S+szs3OPHZ94+PdX4rvxg9KXlSNdAMR5an67XxpL54h0b46PjxVhxOV56qBg3/rRnW14fmZypT1WcO3S77W3O/8zvPVVHB6yzbcsuHe/f8ECACrTOo6dLqxdeCRcDuFP5vTZ0r1XO/3Sj4gA2nvs/dK/lzv8LLXVzAXBncv+H7uX8hy6Vfld1BECF3P+hK63ld/3rWNi6OcKoprBZd0peiCgL6aaIR2GdClVfmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADrj7wAAAP//KFzmgQ==") 1.265199174s ago: executing program 3 (id=120): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0xd9, 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r1}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000030000850000001b000000b700000000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x7, 0x0, 0x0, 0x200, 0x0, 0x1}) io_uring_enter(0xffffffffffffffff, 0x471b, 0xfffffffe, 0x20, 0x0, 0xffffffffffffff68) connect$vsock_stream(r2, &(0x7f0000000400)={0x28, 0x0, 0x2710, @host}, 0x10) 1.252389406s ago: executing program 4 (id=121): mq_open(&(0x7f0000000a00)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!T\xeeux\x00\xbf@\xf4\x1c\xbce\xca\x97\xd5pkv\x88L\xe8$\xef\xfeI\xdaW1\xfcg\xa1\xdb$,0y$\xcd{zl.\xae\x805\xa8\xd6\x85\x15\xd2\x0e~\xcc\x90\x97\xe8h\v\x1a9X\a\xca{\x11#\x95m{U\xe5-\xabRw\xcafy\xe6\aNhX4Ll[\x14\x15, priority 10 [ 57.626032][ T3094] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.654382][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 57.671825][ T3094] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.693764][ T3094] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 57.865505][ T4328] usb usb8: usbfs: process 4328 (syz.0.12) did not claim interface 0 before use [ 57.894363][ T21] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 58.004557][ T4337] loop4: detected capacity change from 0 to 128 [ 58.096262][ T4341] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 58.143596][ T21] usb 3-1: Using ep0 maxpacket: 8 [ 58.229824][ T4323] mmap: syz.1.11 (4323) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 58.268776][ T21] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 58.283906][ T21] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 58.437840][ T4349] tipc: Started in network mode [ 58.457562][ T4349] tipc: Node identity ac14140f, cluster identity 4711 [ 58.472789][ T4349] tipc: New replicast peer: 255.255.255.32 [ 58.475660][ T21] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 58.480097][ T4349] tipc: Enabled bearer , priority 10 [ 58.501892][ T4351] capability: warning: `syz.3.22' uses deprecated v2 capabilities in a way that may be insecure [ 58.533045][ T21] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.556531][ T21] usb 3-1: Product: syz [ 58.560734][ T21] usb 3-1: Manufacturer: syz [ 58.594847][ T21] usb 3-1: SerialNumber: syz [ 58.704922][ T4251] Bluetooth: hci0: command 0x0419 tx timeout [ 58.720156][ T4251] Bluetooth: hci3: command 0x0419 tx timeout [ 58.734655][ T4313] tipc: Node number set to 2886997007 [ 58.775253][ T4306] Bluetooth: hci4: command 0x0419 tx timeout [ 58.783495][ T4306] Bluetooth: hci1: command 0x0419 tx timeout [ 58.817254][ T4306] Bluetooth: hci2: command 0x0419 tx timeout [ 58.921956][ T26] audit: type=1326 audit(1763026884.381:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4365 comm="syz.3.29" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 58.934035][ T21] cdc_ncm 3-1:1.0: bind() failure [ 58.968156][ T21] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 59.006427][ T26] audit: type=1326 audit(1763026884.421:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4365 comm="syz.3.29" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 59.015266][ T21] cdc_ncm 3-1:1.1: bind() failure [ 59.104356][ T21] usb 3-1: USB disconnect, device number 2 [ 59.106714][ T26] audit: type=1326 audit(1763026884.421:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4365 comm="syz.3.29" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 59.215292][ T26] audit: type=1326 audit(1763026884.421:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4365 comm="syz.3.29" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 59.300328][ T4379] netlink: 24 bytes leftover after parsing attributes in process `syz.4.34'. [ 59.305573][ T26] audit: type=1326 audit(1763026884.421:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4365 comm="syz.3.29" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 59.316114][ T4381] tipc: Started in network mode [ 59.331634][ T26] audit: type=1326 audit(1763026884.421:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4365 comm="syz.3.29" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 59.362620][ T26] audit: type=1326 audit(1763026884.421:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4365 comm="syz.3.29" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 59.385126][ T26] audit: type=1326 audit(1763026884.421:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4365 comm="syz.3.29" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 59.418080][ T26] audit: type=1326 audit(1763026884.421:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4365 comm="syz.3.29" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 59.440882][ T26] audit: type=1326 audit(1763026884.421:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4365 comm="syz.3.29" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 59.463679][ T4381] tipc: Node identity ac14140f, cluster identity 4711 [ 59.472545][ T4381] tipc: New replicast peer: 255.255.255.32 [ 59.491174][ T4381] tipc: Enabled bearer , priority 10 [ 59.528485][ T4306] tipc: Node number set to 2886997007 [ 59.596188][ T4385] sctp: [Deprecated]: syz.1.37 (pid 4385) Use of int in max_burst socket option deprecated. [ 59.596188][ T4385] Use struct sctp_assoc_value instead [ 59.740494][ T4394] loop4: detected capacity change from 0 to 128 [ 59.840157][ T4394] FAT-fs (loop4): Directory bread(block 162) failed [ 59.870743][ T4394] FAT-fs (loop4): Directory bread(block 163) failed [ 59.883784][ T4394] FAT-fs (loop4): Directory bread(block 164) failed [ 59.897269][ T4394] FAT-fs (loop4): Directory bread(block 165) failed [ 59.938843][ T4394] FAT-fs (loop4): Directory bread(block 166) failed [ 59.964731][ T4394] FAT-fs (loop4): Directory bread(block 167) failed [ 59.991717][ T4408] tipc: Started in network mode [ 59.996785][ T4394] FAT-fs (loop4): Directory bread(block 168) failed [ 59.997007][ T4408] tipc: Node identity ac14140f, cluster identity 4711 [ 60.011917][ T4408] tipc: New replicast peer: 255.255.255.32 [ 60.021289][ T4408] tipc: Enabled bearer , priority 10 [ 60.024742][ T4394] FAT-fs (loop4): Directory bread(block 169) failed [ 60.071230][ T4394] FAT-fs (loop4): Directory bread(block 162) failed [ 60.108509][ T4394] FAT-fs (loop4): Directory bread(block 163) failed [ 60.158423][ T4394] attempt to access beyond end of device [ 60.158423][ T4394] loop4: rw=3, want=232, limit=128 [ 60.172790][ T4394] attempt to access beyond end of device [ 60.172790][ T4394] loop4: rw=2051, want=234, limit=128 [ 60.397359][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 60.406117][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 60.413627][ T4426] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 60.422847][ T4426] device bridge_slave_0 left promiscuous mode [ 60.438580][ T4426] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.498009][ T4428] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 60.577762][ T4426] device bridge_slave_1 left promiscuous mode [ 60.605807][ T2388] tipc: Node number set to 2886997007 [ 60.734583][ T4426] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.134605][ T23] tipc: Node number set to 2886997007 [ 61.172670][ T4426] bond0: (slave bond_slave_0): Releasing backup interface [ 61.234427][ T4426] bond0: (slave bond_slave_1): Releasing backup interface [ 61.315130][ T4434] netlink: 4 bytes leftover after parsing attributes in process `syz.0.58'. [ 61.315507][ T4426] team0: Port device team_slave_0 removed [ 61.327149][ T4434] netlink: 32 bytes leftover after parsing attributes in process `syz.0.58'. [ 61.376863][ T4426] team0: Port device team_slave_1 removed [ 61.378045][ T4434] Zero length message leads to an empty skb [ 61.390706][ T4446] syz.2.60 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 61.396869][ T4426] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 61.427159][ T4426] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 61.437408][ T4426] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 61.445152][ T4426] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 61.517438][ T4438] 8021q: adding VLAN 0 to HW filter on device bond1 [ 61.528217][ T4445] tipc: Enabling of bearer rejected, already enabled [ 61.747335][ T4462] netlink: 8 bytes leftover after parsing attributes in process `syz.3.66'. [ 62.064860][ T4473] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 62.760064][ T4483] netlink: 19 bytes leftover after parsing attributes in process `syz.0.74'. [ 62.845666][ T4485] tipc: Started in network mode [ 62.850582][ T4485] tipc: Node identity ac14140f, cluster identity 4711 [ 62.870665][ T4485] tipc: New replicast peer: 255.255.255.32 [ 62.883787][ T4485] tipc: Enabled bearer , priority 10 [ 62.915784][ T4493] loop3: detected capacity change from 0 to 512 [ 62.948448][ T4495] netlink: 7 bytes leftover after parsing attributes in process `syz.1.80'. [ 62.954022][ T4491] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.995111][ T4493] EXT4-fs (loop3): Ignoring removed oldalloc option [ 63.070969][ T4493] EXT4-fs (loop3): too many log groups per flexible block group [ 63.089044][ T4493] EXT4-fs (loop3): failed to initialize mballoc (-12) [ 63.108900][ T4505] IPv6: Can't replace route, no match found [ 63.118463][ T4493] EXT4-fs (loop3): mount failed [ 63.168804][ T4491] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.398677][ T4516] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 63.983597][ T21] tipc: Node number set to 2886997007 [ 64.010611][ T4491] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.098478][ T26] kauditd_printk_skb: 239 callbacks suppressed [ 64.098492][ T26] audit: type=1326 audit(1763026889.561:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4522 comm="syz.3.92" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 64.223122][ T26] audit: type=1326 audit(1763026889.561:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4522 comm="syz.3.92" exe="/root/syz-executor" sig=0 arch=c000003e syscall=240 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 64.258064][ T4491] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.299706][ T26] audit: type=1326 audit(1763026889.561:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4522 comm="syz.3.92" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 64.322895][ T26] audit: type=1326 audit(1763026889.601:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4522 comm="syz.3.92" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6549de6c9 code=0x7ffc0000 [ 64.419297][ T4491] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.440211][ T4491] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.459128][ T4491] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.474870][ T4491] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.594833][ T26] audit: type=1326 audit(1763026890.061:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4559 comm="syz.1.98" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7197db6c9 code=0x7ffc0000 [ 64.672087][ T26] audit: type=1326 audit(1763026890.061:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4559 comm="syz.1.98" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7197db6c9 code=0x7ffc0000 [ 64.672126][ T26] audit: type=1326 audit(1763026890.101:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4559 comm="syz.1.98" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa7197db6c9 code=0x7ffc0000 [ 64.672156][ T26] audit: type=1326 audit(1763026890.101:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4559 comm="syz.1.98" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7197db6c9 code=0x7ffc0000 [ 64.672186][ T26] audit: type=1326 audit(1763026890.101:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4559 comm="syz.1.98" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7197db6c9 code=0x7ffc0000 [ 64.672215][ T26] audit: type=1326 audit(1763026890.101:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4559 comm="syz.1.98" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa7197db6c9 code=0x7ffc0000 [ 64.740468][ T4569] netlink: 'syz.1.103': attribute type 1 has an invalid length. [ 64.900870][ T4575] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 65.585479][ T4580] netlink: 32 bytes leftover after parsing attributes in process `syz.2.106'. [ 65.613308][ T4580] netlink: 32 bytes leftover after parsing attributes in process `syz.2.106'. [ 65.644945][ T4585] tipc: Enabling of bearer rejected, already enabled [ 65.708424][ T4588] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 65.768753][ T4571] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 66.014551][ T4603] 9pnet: Insufficient options for proto=fd [ 66.147185][ T4608] loop1: detected capacity change from 0 to 512 [ 66.587827][ T4617] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 67.205954][ T4613] tipc: Enabling of bearer rejected, already enabled [ 67.301787][ T4608] ------------[ cut here ]------------ [ 67.313823][ T4608] EA inode 11 i_nlink=2 [ 67.314033][ T4608] WARNING: CPU: 0 PID: 4608 at fs/ext4/xattr.c:1022 ext4_xattr_inode_update_ref+0x4be/0x520 [ 67.367424][ T4608] Modules linked in: [ 67.371571][ T4608] CPU: 1 PID: 4608 Comm: syz.1.119 Not tainted syzkaller #0 [ 67.379331][ T4608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 67.395983][ T4608] RIP: 0010:ext4_xattr_inode_update_ref+0x4be/0x520 [ 67.402756][ T4635] netlink: 'syz.4.126': attribute type 16 has an invalid length. [ 67.411324][ T4608] Code: 8d 7d 40 4c 89 f8 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 ff e8 13 e0 a2 ff 49 8b 37 48 c7 c7 80 8d 1d 8a 89 da e8 c2 53 85 07 <0f> 0b 49 be 00 00 00 00 00 fc ff df 4c 8b 6c 24 10 4c 8b 7c 24 08 [ 67.431423][ T4635] netlink: 156 bytes leftover after parsing attributes in process `syz.4.126'. [ 67.446802][ T4608] RSP: 0018:ffffc900030cf140 EFLAGS: 00010246 [ 67.453271][ T4608] RAX: 93333ae0610abe00 RBX: 0000000000000002 RCX: 0000000000080000 [ 67.461573][ T4637] netlink: 4 bytes leftover after parsing attributes in process `syz.4.126'. [ 67.474726][ T4608] RDX: ffffc90003d93000 RSI: 000000000002621b RDI: 000000000002621c [ 67.484591][ T4608] RBP: ffffc900030cf230 R08: dffffc0000000000 R09: ffffed1017204f2c [ 67.499322][ T4608] R10: ffffed1017204f2c R11: 1ffff11017204f2b R12: ffffc900030cf1a0 [ 67.508034][ T4608] R13: ffff88805f483478 R14: dffffc0000000000 R15: ffff88805f4834b8 [ 67.524831][ T4608] FS: 00007fa717a426c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 [ 67.540787][ T4608] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 67.553159][ T4608] CR2: 000000110c37e4cc CR3: 000000005efff000 CR4: 00000000003506e0 [ 67.566025][ T4608] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 67.574777][ T4608] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 67.582765][ T4608] Call Trace: [ 67.586554][ T4608] [ 67.589533][ T4608] ? ext4_xattr_block_csum+0x500/0x500 [ 67.595374][ T4608] ? ext4_xattr_inode_iget+0x3f0/0x600 [ 67.600968][ T4608] ? mb_cache_entry_create+0x62e/0x890 [ 67.606629][ T4608] ext4_xattr_set_entry+0xed0/0x3d30 [ 67.611935][ T4608] ? rcu_is_watching+0x11/0xa0 [ 67.616834][ T4608] ? mb_cache_entry_create+0x676/0x890 [ 67.622319][ T4608] ? ext4_xattr_block_set+0xd9a/0x2d30 [ 67.627996][ T4608] ? ext4_xattr_ibody_set+0x330/0x330 [ 67.633934][ T4608] ? __ext4_xattr_check_block+0x7d8/0x8d0 [ 67.639707][ T4608] ? ext4_xattr_block_find+0x500/0x500 [ 67.645276][ T4608] ext4_xattr_ibody_set+0x112/0x330 [ 67.650499][ T4608] ext4_expand_extra_isize_ea+0xf9a/0x19a0 [ 67.656600][ T4608] __ext4_expand_extra_isize+0x301/0x3e0 [ 67.662409][ T4608] __ext4_mark_inode_dirty+0x469/0x700 [ 67.668081][ T4608] ext4_evict_inode+0xa81/0x1080 [ 67.673150][ T4608] ? _raw_spin_unlock+0x24/0x40 [ 67.678774][ T4608] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 67.684954][ T4608] ? do_raw_spin_unlock+0x11d/0x230 [ 67.690274][ T4608] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 67.696327][ T4608] evict+0x485/0x870 [ 67.700384][ T4608] ? __lock_acquire+0x7c60/0x7c60 [ 67.706938][ T4608] ? proc_nr_inodes+0x320/0x320 [ 67.712005][ T4608] ? do_raw_spin_unlock+0x11d/0x230 [ 67.717413][ T4608] ? _raw_spin_unlock+0x24/0x40 [ 67.722326][ T4608] ? iput+0x706/0x8a0 [ 67.726475][ T4608] ext4_orphan_cleanup+0xaa9/0x12e0 [ 67.731730][ T4608] ? ext4_orphan_del+0xb90/0xb90 [ 67.737346][ T4608] ? errseq_check_and_advance+0x62/0x120 [ 67.743008][ T4608] ext4_fill_super+0x92f0/0x9a60 [ 67.748166][ T4608] ? ext4_mount+0x40/0x40 [ 67.752539][ T4608] ? set_blocksize+0x1f1/0x370 [ 67.757384][ T4608] ? sb_set_blocksize+0xa5/0xe0 [ 67.762247][ T4608] mount_bdev+0x287/0x3c0 [ 67.766712][ T4608] ? ext4_mount+0x40/0x40 [ 67.771058][ T4608] legacy_get_tree+0xe6/0x180 [ 67.775883][ T4608] ? ext4_errno_to_code+0x160/0x160 [ 67.781119][ T4608] vfs_get_tree+0x88/0x270 [ 67.785696][ T4608] do_new_mount+0x24a/0xa40 [ 67.790231][ T4608] __se_sys_mount+0x2d6/0x3c0 [ 67.795032][ T4608] ? __x64_sys_mount+0xc0/0xc0 [ 67.799812][ T4608] ? lockdep_hardirqs_on+0x94/0x140 [ 67.805884][ T4608] ? __x64_sys_mount+0x1c/0xc0 [ 67.810702][ T4608] do_syscall_64+0x4c/0xa0 [ 67.815649][ T4608] ? clear_bhb_loop+0x30/0x80 [ 67.820380][ T4608] ? clear_bhb_loop+0x30/0x80 [ 67.825534][ T4608] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 67.831469][ T4608] RIP: 0033:0x7fa7197dce6a [ 67.839879][ T4608] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 67.859848][ T4608] RSP: 002b:00007fa717a41e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 67.868410][ T4608] RAX: ffffffffffffffda RBX: 00007fa717a41ef0 RCX: 00007fa7197dce6a [ 67.876574][ T4608] RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007fa717a41eb0 [ 67.884640][ T4608] RBP: 0000200000000180 R08: 00007fa717a41ef0 R09: 0000000000800718 [ 67.892659][ T4608] R10: 0000000000800718 R11: 0000000000000246 R12: 00002000000001c0 [ 67.900950][ T4608] R13: 00007fa717a41eb0 R14: 000000000000046f R15: 0000200000000200 [ 67.910026][ T4608] [ 67.913078][ T4608] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 67.920342][ T4608] CPU: 0 PID: 4608 Comm: syz.1.119 Not tainted syzkaller #0 [ 67.927601][ T4608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 67.937636][ T4608] Call Trace: [ 67.940904][ T4608] [ 67.943822][ T4608] dump_stack_lvl+0x168/0x230 [ 67.948512][ T4608] ? show_regs_print_info+0x20/0x20 [ 67.953697][ T4608] ? load_image+0x3b0/0x3b0 [ 67.958218][ T4608] panic+0x2c9/0x7f0 [ 67.962108][ T4608] ? bpf_jit_dump+0xd0/0xd0 [ 67.966598][ T4608] ? ext4_xattr_inode_update_ref+0x4be/0x520 [ 67.972568][ T4608] __warn+0x248/0x2b0 [ 67.976548][ T4608] ? ext4_xattr_inode_update_ref+0x4be/0x520 [ 67.982512][ T4608] report_bug+0x1b7/0x2e0 [ 67.986847][ T4608] handle_bug+0x3a/0x70 [ 67.990985][ T4608] exc_invalid_op+0x16/0x40 [ 67.995467][ T4608] asm_exc_invalid_op+0x16/0x20 [ 68.000302][ T4608] RIP: 0010:ext4_xattr_inode_update_ref+0x4be/0x520 [ 68.006875][ T4608] Code: 8d 7d 40 4c 89 f8 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 ff e8 13 e0 a2 ff 49 8b 37 48 c7 c7 80 8d 1d 8a 89 da e8 c2 53 85 07 <0f> 0b 49 be 00 00 00 00 00 fc ff df 4c 8b 6c 24 10 4c 8b 7c 24 08 [ 68.026577][ T4608] RSP: 0018:ffffc900030cf140 EFLAGS: 00010246 [ 68.032716][ T4608] RAX: 93333ae0610abe00 RBX: 0000000000000002 RCX: 0000000000080000 [ 68.040673][ T4608] RDX: ffffc90003d93000 RSI: 000000000002621b RDI: 000000000002621c [ 68.048626][ T4608] RBP: ffffc900030cf230 R08: dffffc0000000000 R09: ffffed1017204f2c [ 68.056579][ T4608] R10: ffffed1017204f2c R11: 1ffff11017204f2b R12: ffffc900030cf1a0 [ 68.064549][ T4608] R13: ffff88805f483478 R14: dffffc0000000000 R15: ffff88805f4834b8 [ 68.072535][ T4608] ? ext4_xattr_block_csum+0x500/0x500 [ 68.077984][ T4608] ? ext4_xattr_inode_iget+0x3f0/0x600 [ 68.083435][ T4608] ? mb_cache_entry_create+0x62e/0x890 [ 68.088900][ T4608] ext4_xattr_set_entry+0xed0/0x3d30 [ 68.094166][ T4608] ? rcu_is_watching+0x11/0xa0 [ 68.098914][ T4608] ? mb_cache_entry_create+0x676/0x890 [ 68.104377][ T4608] ? ext4_xattr_block_set+0xd9a/0x2d30 [ 68.109846][ T4608] ? ext4_xattr_ibody_set+0x330/0x330 [ 68.115215][ T4608] ? __ext4_xattr_check_block+0x7d8/0x8d0 [ 68.120923][ T4608] ? ext4_xattr_block_find+0x500/0x500 [ 68.126369][ T4608] ext4_xattr_ibody_set+0x112/0x330 [ 68.131557][ T4608] ext4_expand_extra_isize_ea+0xf9a/0x19a0 [ 68.137366][ T4608] __ext4_expand_extra_isize+0x301/0x3e0 [ 68.142993][ T4608] __ext4_mark_inode_dirty+0x469/0x700 [ 68.148447][ T4608] ext4_evict_inode+0xa81/0x1080 [ 68.153366][ T4608] ? _raw_spin_unlock+0x24/0x40 [ 68.158216][ T4608] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 68.164114][ T4608] ? do_raw_spin_unlock+0x11d/0x230 [ 68.169302][ T4608] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 68.175181][ T4608] evict+0x485/0x870 [ 68.179067][ T4608] ? __lock_acquire+0x7c60/0x7c60 [ 68.184086][ T4608] ? proc_nr_inodes+0x320/0x320 [ 68.189020][ T4608] ? do_raw_spin_unlock+0x11d/0x230 [ 68.194202][ T4608] ? _raw_spin_unlock+0x24/0x40 [ 68.199033][ T4608] ? iput+0x706/0x8a0 [ 68.203004][ T4608] ext4_orphan_cleanup+0xaa9/0x12e0 [ 68.208193][ T4608] ? ext4_orphan_del+0xb90/0xb90 [ 68.213118][ T4608] ? errseq_check_and_advance+0x62/0x120 [ 68.218741][ T4608] ext4_fill_super+0x92f0/0x9a60 [ 68.223692][ T4608] ? ext4_mount+0x40/0x40 [ 68.228006][ T4608] ? set_blocksize+0x1f1/0x370 [ 68.232764][ T4608] ? sb_set_blocksize+0xa5/0xe0 [ 68.237596][ T4608] mount_bdev+0x287/0x3c0 [ 68.241908][ T4608] ? ext4_mount+0x40/0x40 [ 68.246224][ T4608] legacy_get_tree+0xe6/0x180 [ 68.250882][ T4608] ? ext4_errno_to_code+0x160/0x160 [ 68.256068][ T4608] vfs_get_tree+0x88/0x270 [ 68.260471][ T4608] do_new_mount+0x24a/0xa40 [ 68.264957][ T4608] __se_sys_mount+0x2d6/0x3c0 [ 68.269621][ T4608] ? __x64_sys_mount+0xc0/0xc0 [ 68.274374][ T4608] ? lockdep_hardirqs_on+0x94/0x140 [ 68.279560][ T4608] ? __x64_sys_mount+0x1c/0xc0 [ 68.284314][ T4608] do_syscall_64+0x4c/0xa0 [ 68.288717][ T4608] ? clear_bhb_loop+0x30/0x80 [ 68.293383][ T4608] ? clear_bhb_loop+0x30/0x80 [ 68.298051][ T4608] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 68.303955][ T4608] RIP: 0033:0x7fa7197dce6a [ 68.308369][ T4608] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 68.328035][ T4608] RSP: 002b:00007fa717a41e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 68.336434][ T4608] RAX: ffffffffffffffda RBX: 00007fa717a41ef0 RCX: 00007fa7197dce6a [ 68.344393][ T4608] RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007fa717a41eb0 [ 68.352354][ T4608] RBP: 0000200000000180 R08: 00007fa717a41ef0 R09: 0000000000800718 [ 68.360427][ T4608] R10: 0000000000800718 R11: 0000000000000246 R12: 00002000000001c0 [ 68.368493][ T4608] R13: 00007fa717a41eb0 R14: 000000000000046f R15: 0000200000000200 [ 68.376469][ T4608] [ 68.379712][ T4608] Kernel Offset: disabled [ 68.384164][ T4608] Rebooting in 86400 seconds..