last executing test programs: 3.405110786s ago: executing program 4 (id=3905): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1}}, 0x80001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f000000e0c0), 0x10010) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000003c0)=@gcm_256={{0x304}, "b54b55c9b691706d", "b5421a989404d5c952ba74f879bed1a5bfadabb985e5681803932ccc7beb0f83", "cba83b41", "ef3c6c588e3360e2"}, 0x38) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x18) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x408, 0x2a8, 0x98, 0x2a8, 0x130, 0x1f0, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x69}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@ttl={{0x28}, {0x2, 0xa}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'dvmrp1\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x3, {0x5}}}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) r4 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r4, 0x2285, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x3c, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) writev(r4, &(0x7f0000000080)=[{&(0x7f00000000c0)="aefdda9d240300005a90f57f07703aeff0f64ebbee07022c2277ae11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000040)="aa1d484ea0000000f7fc08fcd111fbdf23ea32db0e8f21d5bc27bd49eb067a0689fff2a41cfbf0e9d85e44", 0x2b}], 0x2) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r7}, 0x10) epoll_create(0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r6, 0x0, 0xffffffffffffffff}, 0x18) sendfile(r0, r1, &(0x7f0000000100)=0x1010, 0x10001) 3.279091387s ago: executing program 1 (id=3908): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) syz_emit_ethernet(0x72, &(0x7f0000000680)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd60cb0000003c3a00fc020000000000000000000000000000ff020000000000000000000000000001020090780000000060000000000011000000000000000000000000000000140000000000000000000000ffffe000000117c17f079171000700840000b48711b1b6e95ad1e42c516a32857af2a722cefe300b6223ea6dfa66b912c2b1855d32202c6c276f47c6e5c97ca7e924df64620d059fc61870c096a0299850ad08feccc345274b040d8ce4fdf2aa"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x14, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x42, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000b40)={'wpan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), 0xffffffffffffffff) r4 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x3, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8080}, 0x0, 0x32, 0x43a1bd76, 0x0, 0x9, 0x30, 0x4, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r5 = gettid() timer_create(0x8, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)=0x0) timer_settime(r6, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r7 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0) readv(r7, &(0x7f00000000c0)=[{&(0x7f0000000240)=""/40, 0x54}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r9 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x80600) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r9, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x72, 0x11cfa, 0x0, 0x8000008, 0x3, 0x4, 0x1, 0x0, 0x2}) readv(r9, &(0x7f0000001900)=[{&(0x7f0000000400)=""/152, 0x98}], 0x1) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r9, 0x40505330, &(0x7f00000001c0)={0x800100, 0xffffffff, 0x22, 0xe1d9, 0x1101, 0xff}) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r8) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000140), r10) sendmsg$NLBL_MGMT_C_ADDDEF(r10, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="01000003000000000000040000000800020005"], 0x24}}, 0x0) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r1, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=ANY=[@ANYBLOB="4022359f100000fe83c7d78e978fd86beec802b6fb5313d8841083f3fd8ad7710c8f7c8e179fc4d8621a3672be2bbe55fcf92c70a76d0e6f007c8ae28b205184f0c5536d46438636094805dab8f9fa3beef043e3204e4c82483b593f", @ANYRES16=r3, @ANYBLOB="01002dbd7000fbdbdf252000000008000300", @ANYRES32=r2, @ANYBLOB="24002d800800030005000000050004000100000005000100300000000800020003000000"], 0x40}}, 0x4c014) bpf$MAP_CREATE(0x0, &(0x7f0000001780)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_int(r12, 0x29, 0x4b, 0x0, &(0x7f00000023c0)) syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) 2.392351595s ago: executing program 4 (id=3915): setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, 0x0, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x3c, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r3}, 0x10) syz_clone(0x40042700, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000002, 0x0, {0x0, 0x0, 0x0, r6, {0xffff}, {}, {0xfff3}}}, 0x24}}, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2f, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) 1.995671934s ago: executing program 1 (id=3917): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) syz_mount_image$ext4(&(0x7f0000000440)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x800002, &(0x7f0000000380)={[], [], 0x22}, 0x84, 0x471, &(0x7f0000000a00)="$eJzs3MtvG1UXAPAzk6TvfslXyqMPIFAQEY+kSQt0wQYEUjdISLAoy5CmVWnaoCagtopoilBZom7ZAEsk/gJWsEHACsQW9gipQtkQWKBBY8+kxo6N83Dd4t9PmubemTueczy+9p25dgPoWcP5P0nEroj4KSIGI6KvvsFw9c/y0sLUH0sLU0lk2au/Jflu8fvSwlTZNCn+7iwqI2lE+n4SB1Y57tyly2cnZ2amLxT1sflzb43NXbr81Jlzk6enT0+fnzh27OiR8WefmXh6U/Lcnce6/93Zg/uOv3795akT19/49vM83l3F9to8qoY2fMzhGF55Tuo9uuFHv73srikn/V0MhDXJ+3p+ugYq/X8w+uLmyRuMl97ranBAR2VZlm1tWLsyAljMgP+wJLodAdAd5Qd9fv1bLrdw+NF1N56vXgDleS8XS3VLf6RFm4G669vNNBwRJxb//DhfYtX7EAAAm+vLfPzz5GrjvzTuqWn3v2JuaCgi/h8ReyLirojYGxF3R1Ta3hsR963x+MN19cbxzw/b15VYm/Lx33MRHy03jP/K0V8M9RW13ZX8B5JTZ2amDxfPyUgMbM3r4y2O8dWLP37YbFvt+C9flgdiqhwLFnH82l93g+7k5PzkRnKudeNq5R7glcb8k5WZgCQi9kXE/nU8/raIOPP4ZwebbW/If2mhLv8WNmGeKfs04rHq3OZi1OVfSlrPT45ti5npw2Plq6LRd99fe6XZ8TeU/ybIz/+OYm63/vwXhpLa+dq5tR/j2s8fNL2m+ff8V3/9b0leq5S3FOsuTs7PXxiP2JIsNq6fuLlvWS/b5/mPHFot/zR/j/vrk2K/AxGRv4jvj4gHIuLBIvaHIuLhiDjUIv9vXnjkzfXn31l5/ifXdP7XXug7+/UXzY7f3vk/WimNFGvaef9rN8CNPHcAAABwp0gr34FP0tGVcpqOjla/w783dqQzs3PzT5yaffv8yep35YdiIC3vdA3W3A8dL+4Nl/WJuvqRyn3jLMuy7ZX66NTsTKfm1IH27GzS/3O/9HU7OqDj1jSP1uwXbcAdye81oXfp/9C79H/oXfo/9K7V+v+ViOWWO13tWDjALeTzH3qX/g+9S/+HntWv/0NP2sjv+lsV9hxvr3H5HxB2KIw7oNB3e4TRonDxneo5+uemSLse2PoL6e0RRrWwNSLabXzllvWUbr4rAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbJ6/AwAA//8g++b5") sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="540000001000ddff26bd70008000000062000000", @ANYRES16=r4, @ANYBLOB="2c001291fa4109665bfc36736689d8800b0062f1035484a75b01fd67726574617000010400028006000e000200000008000700e0000001060010000100000008000a000000000000000000", @ANYRES32=r3, @ANYBLOB], 0x54}}, 0x40880) openat$random(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) 1.917405481s ago: executing program 4 (id=3918): bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffefc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x10000}, 0x18) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = dup(r1) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="640000000206030000000000fffff0000000000016000300686173683a6e65742c706f72742c6e6574000000050004000000000005000500020000000900020073797a3200000000050001000700000014000780080013400000000008001240"], 0x64}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000000306010200040000000000000200000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x4) syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) 1.862106767s ago: executing program 4 (id=3919): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='sys_enter\x00', r0}, 0x10) execve(0x0, 0x0, 0x0) (fail_nth: 1) 1.540747028s ago: executing program 1 (id=3920): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[], 0x48) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x400) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000040000000800000001", @ANYBLOB, @ANYRES32=0x0], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r4}, 0x10) syz_io_uring_setup(0x1104, &(0x7f0000000300)={0x0, 0x1, 0x80, 0x8000000, 0x8000021e}, 0x0, 0x0) 1.539423889s ago: executing program 4 (id=3921): ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000280)={'syztnl2\x00', &(0x7f00000001c0)={'gretap0\x00', 0x0, 0x20, 0x10, 0xffffffff, 0x641, {{0x19, 0x4, 0x2, 0x2, 0x64, 0x66, 0x0, 0x4, 0x2d, 0x0, @multicast1, @empty, {[@timestamp_addr={0x44, 0xc, 0xa6, 0x1, 0x0, [{@multicast2, 0x9}]}, @timestamp_addr={0x44, 0x44, 0x11, 0x1, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}, {@broadcast, 0x5}, {@private=0xa010100, 0x5}, {@local, 0xf9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}, {@broadcast, 0x8f6f}, {@empty, 0x5}, {@multicast2, 0x8}]}]}}}}}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0x20, &(0x7f0000000440)={&(0x7f00000003c0)=""/84, 0x54, 0x0, &(0x7f0000000580)=""/146, 0x92}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000640)={0x0, 0x101}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{0x1, 0xffffffffffffffff}, &(0x7f0000000680), &(0x7f00000006c0)}, 0x20) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r4, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x39) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000800)={0x1, 0xffffffffffffffff}, 0x4) r8 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000840), 0x202081, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x7, 0x1, &(0x7f0000000080)=@raw=[@alu={0x7, 0x3, 0x0, 0x5, 0x8, 0x40, 0xfffffffffffffffc}], &(0x7f0000000140)='syzkaller\x00', 0x8, 0x3, &(0x7f0000000180)=""/3, 0x41100, 0x5, '\x00', r0, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0x4, 0x0, 0x2}, 0x10, r1, 0xffffffffffffffff, 0x7, &(0x7f0000000880)=[r2, r3, r4, r5, r6, r7, r8, 0x1], &(0x7f00000008c0)=[{0x4, 0x4, 0x6, 0x9}, {0x3, 0x2, 0xd, 0x9}, {0x1, 0x1, 0x0, 0x1d}, {0x4, 0x2, 0xe, 0x8}, {0x4, 0x4, 0x6, 0x7}, {0x1, 0x2, 0x0, 0x8}, {0x3, 0x1, 0xa, 0xb}], 0x10, 0x1}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2e, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r9, 0x0, 0x4}, 0x18) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x8000004) syz_clone3(&(0x7f0000000740)={0x8180080, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, 0x0}, 0x58) 1.484094054s ago: executing program 4 (id=3922): futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x1, 0x800001, 0x0, 0x0, 0x0) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mlock2(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000340), &(0x7f0000000340), 0x619}, 0x38) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r0}, 0x18) move_pages(0x0, 0x0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000dd0000000000003b"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x84, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f0000000040)='./file1\x00', 0x6000840) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="280000001c00010029bd7000fedbdf2507000000", @ANYRES32=r3, @ANYBLOB="000300000000040000aaaaaaaa1c0000"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000000)) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r4, 0xc400941d, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r4, 0x50009418, &(0x7f0000000b40)={{r5}, 0x0, 0x0, @unused=[0x13, 0xa, 0x0, 0x4], @devid}) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r6, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r6, &(0x7f00000002c0)="9e", 0xffda, 0x41, &(0x7f0000000200)={0xa, 0x4e23, 0x10001, @loopback, 0xe}, 0x1c) socket$netlink(0x10, 0x3, 0x0) 1.362300836s ago: executing program 3 (id=3923): pipe(&(0x7f0000005880)) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)=ANY=[@ANYBLOB="240000003f000500000000000000df25047c0000040000000c0001"], 0x24}, 0x1, 0x0, 0x0, 0x48800}, 0x0) 1.335131339s ago: executing program 3 (id=3924): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1}}, 0x80001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f000000e0c0), 0x10010) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000003c0)=@gcm_256={{0x304}, "b54b55c9b691706d", "b5421a989404d5c952ba74f879bed1a5bfadabb985e5681803932ccc7beb0f83", "cba83b41", "ef3c6c588e3360e2"}, 0x38) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x18) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x408, 0x2a8, 0x98, 0x2a8, 0x130, 0x1f0, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x69}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@ttl={{0x28}, {0x2, 0xa}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'dvmrp1\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x3, {0x5}}}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) r5 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r5, 0x2285, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x3c, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x60, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(r5, &(0x7f0000000080)=[{&(0x7f00000000c0)="aefdda9d240300005a90f57f07703aeff0f64ebbee07022c2277ae11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000040)="aa1d484ea0000000f7fc08fcd111fbdf23ea32db0e8f21d5bc27bd49eb067a0689fff2a41cfbf0e9d85e44", 0x2b}], 0x2) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r8}, 0x10) epoll_create(0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r7, 0x0, 0xffffffffffffffff}, 0x18) sendfile(r0, r1, &(0x7f0000000100)=0x1010, 0x10001) 1.200581442s ago: executing program 2 (id=3926): unshare(0x20040600) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x8, 0xf9, 0x7ffc1ffb}]}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000000000)="dbac4c47eb4fa815a661764923e68bda", 0x10) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) pipe(&(0x7f0000000000)) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r5}, 0x10) fsetxattr$security_selinux(r5, &(0x7f0000000180), &(0x7f0000000200)='system_u:object_r:hald_sonypic_exec_t:s0\x00', 0x29, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f00000004c0)=ANY=[@ANYBLOB="1809000000000000000000000001000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000540), &(0x7f0000000580)=r6}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r7, &(0x7f0000000600)}, 0x20) 1.173917325s ago: executing program 2 (id=3927): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000820004000000000000000c00850000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x65) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="160000000000000004000000"], 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="400000000203010100000000000000ffffff7f000800034000000000080004400000000008000540000000000900020000000000020000000800010001"], 0x40}, 0x1, 0x0, 0x0, 0x20000840}, 0x400c000) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5, &(0x7f0000000080)=[0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x16, &(0x7f00000001c0)=[{}, {}], 0x10, 0x10, &(0x7f0000000200), &(0x7f0000000280), 0x8, 0x1c, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000b40)={0x0, 0x0}) ptrace(0x4207, r5) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000b80)=ANY=[@ANYRES32=r2], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000400)="d8000000180081054e81f782db4cb904021d080406038609e8fe55a10a0015400400142603600e122f00160006000600a800060b200006400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb50bb6d08034cb4cac034eb27a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f2146b45465578151be43d55ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0xb, &(0x7f00000009c0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r7}, 0x10) r8 = socket$netlink(0x10, 0x3, 0x10) syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./file2\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x6, 0x376, &(0x7f0000000f00)="$eJzs3U9oI1UcwPFf0iRNsu4mB1EUpA8XQS9DGz2LQXZBCLh0N+BWEKbtREPGpGRCNSKmPXlUvHsSPJTeFDwUtGehF296EcFbL4KCFdSR+ZdMkkmTxqRh2+8HSl7ee7+Z9zIv5TdpJ3P6xqfv1iqWVtFbEk8riYmInInkJS6BmP8Yd8spkU++77btyQs3fv/xmfsPy2mvQt0tPnixoJS6tfLtex9m/G5Hy3KSf+v0t8KvJ0+cPHX674N3qpaqWqreaCldbTZ+bumbpqG2q1ZNU+qeaeiWoap1y2h67V/52zEbOzttpde3b2Z3moZlKb3eVjWjrVoN1Wq2lf62Xq0rTdPUzaxgnPLB+rpenDJ4a8aDwZw0m0V9SUQyQy3lg4UMCAAALNRg/h93Uvpx+X9IN//fkFul0p115XTu5f+Hzx63bti23fHy/6NUVP7/0k/etvryf+d0opf/N7zzg8r4/P9zuUD+P5wRXS9T5//5OQwG01lJDVXF+p45+X/Wf/+69t88XHUL5P8AAAAAAAAAAAAAAAAAAAAAADwKzmw7Z9t2LngMfnqXEPjPcSWNOv7LIpJ2jr7N8b/K7j/ckLR74Z5zjM2Pd8u7Ze/R73AsIqYY/9iDnLURXHmkHHn5zuz48Z3d8pLbUqxI1YmXNclJ3l1PoXjbvvta6c6a8vjx3cuUsuH4guTk8XD8N+7qdOIL/fH+/lPy/O1QvCY5+WFLGmLKthvZ2/9Ha0q9+nppID7j9hORXy79oAAAAAAAMGOa6oo8f9e0Ue3et4wUK+7HRIasSk7+jj6/X408P0/knk4sevYAAAAAAFwPVvuDmi5xo+kWTDOqkJGRTTMoJPpqkiIS2Tk1UJM8b8tLoRlOOp6UeHcw+b/z+iJ4VS8SFfwjhTPwbpN/RxXx+zzmP51wy8H83ZpY4rk//Ka/Ljqv2J64C2Av3BSfZBiJ3uC9mhWnQkV2vj1yO/v+RLo1wcdGqRGvs9wb3k78nJWQHKqxY9MtgCc/+/LP2b1BXv7aXwHvj++8bxp2Z+K1ESqkI1dUcq6/dAAAAAAsRC/pD2peCTeHbyQSvlkOf7kHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCG5vKVfgOF0XtfvsypAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAv3XwAAAP//Qv70DQ==") r9 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x105142, 0x2c) preadv(r9, &(0x7f0000000700)=[{0x0}, {0x0}, {&(0x7f0000000500)=""/175, 0xaf}], 0x3, 0x5, 0x2) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f0000000000), 0x4) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000900)="2e00000010008188e6b62aa73772cc9f1ba15e140602000000000a000a001000000002900000121f000085a407ff4fe06a7612e752399a89bac842d3899cb20ab19599ab6f024ddfc8024f54cfae0fb45b37a38965ce2d9c3b8898afc3d87d361aa9a40e9c9bd2838615467afbc37c44cfcbe8224c362f0adeffaf61c5c01f9b1fde5c016969682882983f33759d63089cc0df39", 0x94}], 0x1}, 0x24040041) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x8000) 1.000808062s ago: executing program 0 (id=3928): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x1, 0x4) vmsplice(r2, &(0x7f0000000880)=[{&(0x7f0000000180)='\x00', 0x1}, {&(0x7f0000000200)}, {0x0}, {&(0x7f0000000440)="15", 0x1}, {&(0x7f0000003040)="162dd3cad75f87b473622140aca9f6be4377caaba76f08daaad767f134c2ffc2ba9c92a5971b01b71a225dababc99832633ea975d465532309695b29d56eb9befec5159067bffa2d17b24093b372ebaf5589d18a8905982d01ee2870aa096647d6afabca77e0f36a01481b10ed8f0a585ceb41bf50f0515c259bbbbee74db0e045a9fde3614d35c6f2dfa1e71dace811a410bdfb395dd7c54fa733c6f8111f24df309ad928c6462d0a53a3824f9af07b11cb0c05724c33acfad1f5f16bffaf6c58ab2b8c4626bd9d4d1cc4ab67c9838b1fc53fb4ce46d304a12fffc2110043381d08160f056e8d3908497a402dcc156ff69bbf5cb5e5443c06bc4e3c6e4f231aab0eb6fdd2bb0740ae88095360d8b247daa6628fc10edbf048d800625134022e1d5d0bcb5c50e567f50c1990b1a434caa57d210b6084c9424d37c7a71479613b69b67670baab82f13b0923a73786655cfceb0c70d511b94f992391cad9ce57c5c76675cae6a2712cb9ce6dc07bdd0118001f062a22943ca72742a0fe97c48b9b895515fc71145fac9dfd27118a70b71dd564f27e31e1112292864a7be45459524ad8fb03c1f4388bdba3d9e3882a9be894133b0deea92885d0276f268bad0396635036192da1a9788e7525b08de07b0f351147e0f2aaa239e197924a5fc6961dbfcc96ad4cae4cf59f7a812d0c7f8506216dfb7658f8f8545477f4b6c1a606554ee19621d85438014d5e569b0c467e67cf0bb046284f4145ee9f9601b950b0217d183d0266da78f83ed2cf8a83f1374295853d52cdd561a756f247598126cddc98416c42c47a5ad4fda1c419b6ce04f4b57efd2cecf7bfe1589aab05c33e397c8acfb5e4d05cc62db2ba633e74d08c9a3c92111d39ef7d1c0321bfa1827b9fbbb592c49d46244b57c985ee4cc830f7eeda32cae961c4386916f927fc7f442eb6e2eaf45a3d2b0f28d4d319fdedd003aedc1c6384085921397a041384edee7172973fddb3eee2132acdec385cb596055f82a41087097ffece144a340cfe3ec0c0b833f4a92d28709419827eb0f747d73a2e7cc7d00a24749b9dd340793e2ca36536bc47233c9e2602a7f7f94450b22117215be6086d0c0132d24350c19abcb3d713fa97f76ce6ec8f61b24bfecb3ddcd0e7bccd0c4839de19283e95e08bc629554aac9543c15b0f69f1d03374269796c477579d212708b760914bde3269d9e9b0036c7cd0e8f3376d6a62ed0cde76861423ec5f76f2ab4d0f05b21db57277feaaf8475e6e6d1e5672281db17046b7464439d69e25210f67998e912d02c5296c60a450a38495e3b6737339a05f83e5a02aa1ee5bca6bf67ba84c659ef3cc4495cb1551e749277a86db07e7c48f61ee0672919d6a00472a893b6c6eead02140318fb497a1819b692b9bcb3b5cbe7cb55b9524abb1268b3f4a031a64fe6305519a2212298089c443b0503e77b7c8a3da14387872ca35cd6524f629161d85f253498568587513aa16848fa8f8f3dea115cbe8e85bdb8aa20f20ce26f3fcaac4615a9b9d7d6919ba952f7e93a96ba26010cc4bc24622ed3bb9b063e0e686f41b2cece5a50d787676600a04bfe7e6eb78e740b8bcb4b3a51f2a39250d0163a75d8f97032c60efc5516ba48ce2d53da0a7aab99330369a2c44cfc6ac65707733971493de86a519629f7be4643a52abe3d0ca1e22dfa27d8f7c54c50e0e1f3f639dbc622afa56d22b2732232d62b0a312c359dfd25e266f2138a49689fcc789470b01aabc05563ab025938153c15abbb300192e0bc27f810246d4d24295f337db02aa6b3e801905ee519a681fd73462eb330800763f75ae88e3e57c2a5552fba4b6154cab775625b817e18ff1e26273d21bf8b3cb2a79df7e92a8e498dadc04f11c62d6841bdd0408b212a43951a4a4f4f29c9b8918644e743e2f30cc52d422a9ce03750307096a5f8b61bb585ada2ad7a63d440e418c16e6827792dd470fa980a72cbe53b354ab208b0cb99ad858ff2ee4395f7fbff96c38fe2f84ccca78b6c867d1ff0440c5795b875339b87d98e59dca2dd80b3624c7406b56dc76b0198514bdb97b228e5b726683b3c12f71fb2b1dda24d085175acdc5d7744129df8065168ac103d819bc95dd408e17bfa7ae37d0ff5145e393a37b5cc08c2c10e5ef5d80dd6c79d35c650417e6fc47467c3552bbc1a3d50d2cdce471e5cd43b48475272e30c9d415c826bed60369c1841219e15d93bd87de49e2566de3a01dfc60cd3295134c876863cbfb7be8be44b0d4369b81a778f8fb2fcd039048fd16bf9d4f08a9458dbeadb298ee12b7ee7f6f43099dc684e33bee75d23f37c5b058e56f785f1c2af0c2ad66b69fc1fc06073bd53bed4a967314a6af8ede4d2facdae08ed503c4903fd5fdfd291327cd2ead1876361a16d9341cc24a63b2b51538b7199e048c00cab7127d19ae9a3ea0755b9b5d9604fefcfe7237d641019291bcd9ce30d5a388ad7127fde6061f1e307c0024ff1c200dc04354340eb4e8daac073b7c2f1fe1cee49330cc89ac061bd8a5f1676391d22d4afc8e5875daf4806bac0b5565bb99f07723cdd063ff070ba409fba6642888ea88109b333c3748f77b99f3bd4b9b61ec5e3d798d3584937c0165f4df571b8132ae425849e7e5ce414fbb00d9a30c129e2c13b6791435bb552bb01cedf3003b3bb24503fe226121d1f83419d5c23fad54dbd08fb3449b8a561954a23b47e34b7b14ddbcec2745353269e19fe218da2d0aad6df73083b3979160d4e52c8532c9f6602bc8ee624b9d5157fefbffec98e0e91a4f3824ccb4c33e17d19011f4c8db333d0fc5530930951cb63353a3aa0617ab2aba52268b81628d9f4a56b227300488c10df1e7f7533e1e4db449cb9cb6e588debf4795f98810702de5bfb81414bdacfcbd9e66f051ec7272b41ba281e8a68fe7c61e1cb4e74077342ddb7c5191d9731448a9e42a30c4df80e533db26ca3e12ab8ce8b5f0d114888692589b6c836c603ea4210c31b0e053092d75d9ceb49c5e9e2815b5aeebfcb53e97017d0ff6c7d3410120e355f9a6a1226e64a1621a2e6c04865acb25e137243ab9b82beea39c411163afd8969b086df73751020879785ec79c451fb822c11df1ae927318b35bd583a56827fd8744df8e7693837b8ddb0e831fd97b87505d5540d76d3e09895e64cc563dadf60bec88ee70b6008a53e50523ffbd2c0aa9f19123bd6f28de9851ae1f3f6101b46acf9139792be4872bf494c8970aee100a7a0c4dfbccbf01b6ccbebdfa8291f8ab3e25a9e4ff5dbda11488630e3bb8158b8f8de8cd4f793885e7a28e5afdf45eb57ad1330dfc0c51f51986e53c458feb4a4ef55b810a32f847d7ff5500c0f769d9abc090c10f87ba4e5250f36e70abb838ccb8f9fa95d96ba1e2e75a2d808a8fa26b686149ed6738a8e63ef70ed284e25d044aaa1e14c8caea04b77c9fba96036dd8b3be2e7704c65090fa7e8bf0e45c291709d3eb16a81e8aac27a120e52c05866310d8f288367f2b5187e83a1f7d5cb9dc6f8faa648683b7c88d54871dfcdca822568959ac2f7eb7dd3a345b0a8149806105dc90abfee3d5cefae3dfece4723fdc5a73c3a087020ca2fe1b166fe5b54cfb2f661fa5b017502155bf91856c3aae5cd20a48fbb958e1a0e70df51e4e46bbea56f639f6f32698d45297296244e8aaa845c13b70fa7f4f31115de0808975c143191c89c0233c557ddb93d6233ce22a699ca9a54ca6e8ddcfb5bf9d95b9807a49d9a64f7a239c77fa4e0d92d561fca5aa3e6c149c16c11131c9ad78493572cf1a9f953cc63ef8121cfa86a0f3fdb5a73c8530ddf93a9308fcaf436455aa6817f65e4616c9e38733b1cf9fa09822953d7d203748c5e45cbbe84a4fb7d59318013ba2a7da6f972c47ff9289091d7476035affddf44cc7a0b223cd14af5243dd14cd5d0f42849bd31af8ef9de434a01c52ee583c2d93b4785c34969629ffa406335ccd090637b83a5ee126a4833e6d6cf92b8aa6f9a2213df25fa575980c0cbd98039ca978860442b7466c3d4aa215593243d9c7ad3980470c9ef85154566ceed93ccb0330634f92d1fe5050bfe135f345527c93476e474f31ea45729ec534475d36b69876644e5db59c8cb0412f8d65be9ff2bea5ac37c5b1ff5d5d484aebed8b33920bbc8ed59ba9b3bf24ab6da8ebeda14dad9148183411980136cc2fde47049c98063b0ff1816a0852af035cbe8313d88620559e8331d983a43e0f4b515a61f5761bcd2130853ea24377d042643684699ceb9441a73f1285f6a15c8e00d17b4e051df2bd16b1a5699f6dce4556b0b6c88b8b86464beb6415777a8ec890c9335cc14452d6b23e2483d5b77b56042a694435bf913cb6e48ce6ca60c3009b274869bb350a8026d80680b32c9394e9b5dfee8df555a705bb1ff17ac848ccec95bb37206a72ab1d56160682d83e38c8acca34b08fa3b8665b35d01967c0a49681ef74b89b39f785977187a9d6f70affe2a32f41fe942fbd30fd9da981cf8f75485015962cb598d3d09a039787bf8d339695d0f5cd7cb60d25cdba119fa435e3692e06bdd76db5856eb2ed2cd85a081209b0a1453d52e1f8cf5120c7f044bddc38cded7ed59a793bfb2b289137137147f704a0628bb8e3e342b6084fbcc105b5345023fed9b2d339b95b0d0c97945943a70e007fe2172c501fae54ad04c279ae6da7150ea25469ce7e9c33b51713b05dcd4753930a0a37326d276fd28c8c0f6e06660beb102e2868fee31f70d37d38769e824846b081d120d8fcd394627fd672fe823cfdcf7af07b20b40e8e5efce8e93e8414744efd2723798aad9dabd8e23efc08983db6c65cf3c43d5b759ca52d118fad7a1bb23e5b3578f616fc42e304c797e640d8b985987274766adbf424e4e9a78c29dc436636e0df6e9255ebdd2c7c0cd261d42631cc49df231d0bd080da2928bcab9a0546b404b658f75fca9d8e506f3f6639bca2a13eae6bded0081fd2239bd8c0ab2382d23eecfb8985da82fe5ed32a96ac1e198d7f8cf5752cfb296af0a2d59ed19022cb084b525d44d8c773a14743a706baf209aebb270104b16181fdc2462d356341d89ba8024171c462640abfc3bd6f602c3bbd710f6ae6a2cef146f27002f78051d6687b83dac0cc627e0af1ed8765396d9783c6429b4063a8d58728c60ec88416c5dbdf362b891d278db21c9a4558c724b06547fc5f641801dd0da8403e57cff37d407fab07bb389c40555af869af263265333bf8aa4290d7cdb9a78573362d608a549165f13323c0107aa4dfac934fef838cf6e5f06b9324a5d8474183f077de97287eaf3c85cb74165b189d7547d3fccc4c763d02ce57d59c70f39e8065cdeb5fd13c4c14609f98941b73b16fed60bc55a2d8ef92104568b595f4a31f6428d527b34c470715d1300cd41ea992763f46a739ba387f359ee1d97c51e889e5599cebd800dbeef1496e3dbacaafc403d0dc7cd3c7d193788536aa5b0f5f25482744107d74795f27a8a8832596166fdcaa548b90c48890715526a52518f16d697d65beb6321befa003dc56432e3dd4b01cede5447813eb429dce845bf9702e5063fe571d8cb6cfecf12870e373b42c4f86f75b7b249f1bdb397113dfd7a23f1930f8533e300e8d0dc1674acb3ce3", 0xfa2}, {&(0x7f00000001c0)="37c2", 0x2}], 0x6, 0x0) ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000500)=ANY=[@ANYRESDEC=r0], 0x0) write(r0, 0x0, 0x0) 957.941526ms ago: executing program 2 (id=3929): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffefc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1, 0x0, 0x10000}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = dup(r2) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="640000000206030000000000fffff0000000000016000300686173683a6e65742c706f72742c6e6574000000050004000000000005000500020000000900020073797a3200000000050001000700000014000780080013400000000008001240"], 0x64}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000000306010200040000000000000200000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x4) syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) 833.984538ms ago: executing program 2 (id=3930): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b0000000700000008000000a6ad6a1a05"], 0x48) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f0000001480), r2) ioctl$EXT4_IOC_SETFSUUID(r2, 0x4008662c, &(0x7f0000000300)={0x0, 0x0, "6c02fc6fb7f724c50cfba55e785e1978"}) sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000001c40)={0x14, r3, 0x1, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x84) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000ebff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r6, &(0x7f0000000100), &(0x7f0000000000), 0x2}, 0x20) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r4}, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r0) sendmsg$IEEE802154_LIST_PHY(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x14, r7, 0x30b, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4851}, 0x20000004) 828.909759ms ago: executing program 0 (id=3931): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'veth1_to_batadv\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe2$9p(0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="070000000400000020010000"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r4}, 0x18) socket$key(0xf, 0x3, 0x2) memfd_secret(0x80000) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) kexec_load(0x3e00, 0x1, &(0x7f00000002c0)=[{0x0, 0x0, 0xff600000, 0x1000000}], 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c00000010000305000000000000000000006dc408bf7466d7c2048ee07f97af3543fec29c916011bd9b84f82b0cb93892f8982476243e8639de917c4d40aa98648b0261b4e0e2e32351221ae84fb9610b6e3b4552f1f9bd4247c56800afbc9512e3a519c70ebdded5f75be40ec8", @ANYRES32=0x0, @ANYRES16=r5, @ANYRES32=r2], 0x4c}}, 0x0) 779.635104ms ago: executing program 2 (id=3932): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2400, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000080)=0x7e5a, 0x4) recvfrom(r4, 0x0, 0x0, 0x2, 0x0, 0x0) syz_emit_ethernet(0x82, &(0x7f00000000c0)={@broadcast, @empty, @val, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "43ea56", 0x44, 0x2f, 0x0, @private2, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x22eb}, {0x0, 0x0, 0x0, 0x0, 0x100}, {}, {0x8, 0x88be, 0x86ddffff, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4}, 0x2, {0x0, 0x4}}}}}}}}}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000240)='kfree\x00', r5, 0x0, 0x4ab}, 0x18) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x24044801}, 0x20010814) close(r0) 662.056595ms ago: executing program 0 (id=3933): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000200180000000000000000000850000007b000000"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = socket$caif_stream(0x25, 0x1, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000040)=0x7) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) r4 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x3}, 0x0, 0x0, r3, 0x0) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x30046, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r4) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r5 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r6 = open(0x0, 0x4001410c2, 0x766c618eb221465a) write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={r6, 0xe0, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, &(0x7f0000000340)=[0x0, 0x0, 0x0], &(0x7f0000000380)=[0x0], 0x0, 0x54, &(0x7f00000003c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000400), &(0x7f0000000440), 0x8, 0xce, 0x8, 0x8, &(0x7f0000000480)}}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={0x0, r8}, 0x18) r9 = epoll_create1(0x80000) fsconfig$FSCONFIG_SET_PATH(r5, 0x3, &(0x7f0000000680)='%--[$.\'^\'{\xdf/+\x00', &(0x7f00000006c0)='./file0\x00', r6) syz_emit_ethernet(0xe, &(0x7f0000000640)=ANY=[@ANYBLOB="aaaaaaaaaafd235daaaa1e2af500"/28], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r10, &(0x7f0000000100)={0x20000014}) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r11, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x4a0, 0x0, 0x1170, 0x1170, 0x0, 0x1170, 0x3d0, 0x1398, 0x1398, 0x3d0, 0x1398, 0x3, 0x0, {[{{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [0xffffffff, 0xff000000, 0x0, 0xffffffff], [0x0, 0x0, 0x0, 0xffffff00], 'veth0_vlan\x00', 'veth0_to_hsr\x00', {}, {}, 0x2e, 0x0, 0x0, 0x46}, 0x0, 0x2b8, 0x2e0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x8, 0x7c7, 0x5d, 0x2, 0x4, 0x2, 0x99, 0x0, 0x80, 0x78}, {0x8000000000000001}}}, @common=@unspec=@conntrack1={{0xb8}, {{@ipv4=@loopback, [0x0, 0xff000000, 0xffffff00, 0xff], @ipv6=@private1, [0xffffff00, 0xff000000, 0xffffffff, 0xffffff00], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xffffff00], @ipv4=@local, [0xffffffff, 0xffffff00, 0xff000000, 0xffff00], 0x0, 0x8, 0x89, 0x4e22, 0x4e21, 0x4e23, 0x4e20, 0x100, 0x1240}, 0x81, 0x41}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x8, 0x3}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x500) close_range(r9, r10, 0x0) flistxattr(r1, &(0x7f0000000700)=""/109, 0x6d) getuid() 660.450695ms ago: executing program 1 (id=3934): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_io_uring_setup(0x1239, &(0x7f0000000380)={0x0, 0x3c3, 0x80, 0x3, 0x2b9}, &(0x7f0000000040)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r0, 0x80, &(0x7f0000000080)=@l2tp={0x2, 0x0, @local, 0x3}}) io_uring_enter(r1, 0x47bc, 0x0, 0x0, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) r4 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000640)=0x1802, 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0xfd, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}, {0x0}], 0x2}, 0x4008084) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r5}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000340)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)={0x114, 0x29, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x103, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac0b}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @loopback}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8", @typed={0x8, 0x145, 0x0, 0x0, @ipv4=@remote}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 524.782198ms ago: executing program 2 (id=3935): r0 = socket(0x80000000000000a, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) 429.603838ms ago: executing program 0 (id=3936): pipe(&(0x7f0000005880)) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)=ANY=[@ANYBLOB="240000003f000500000000000000df25047c0000040000000c0001"], 0x24}, 0x1, 0x0, 0x0, 0x48800}, 0x0) 425.826348ms ago: executing program 3 (id=3937): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r1}, &(0x7f0000000840), &(0x7f0000000880)=r0}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB], 0x48) r2 = socket(0x10, 0x803, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x40f00}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r5}, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xe5}}}]}, 0x38}}, 0x4080) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ac0)=@newtfilter={0x114, 0x2c, 0xd2b, 0x70bd2b, 0x35dfdbfb, {0x0, 0x0, 0x0, r6, {0xf}, {}, {0xe, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0xe8, 0x2, [@TCA_U32_SEL={0xe4, 0x5, {0x3, 0x8, 0xd, 0x4, 0x7ff, 0x365, 0x7, 0x6, [{0x1, 0xffff, 0x7706, 0x18}, {0x7fffffff, 0x8, 0xd7, 0x3}, {0x3, 0x2, 0xea9a, 0x6}, {0x7, 0x9, 0x1, 0x9}, {0x40, 0x2, 0x1000}, {0xf, 0x3a1, 0x8, 0x405}, {0x10000, 0x9, 0x6, 0x7fffffff}, {0x4, 0x0, 0x80, 0x40}, {0x43, 0x5, 0x5, 0x4}, {0xfffffffb, 0x5, 0xff, 0x9}, {0x11, 0x7f, 0x1, 0x8}, {0x5, 0x6, 0x80, 0x3000}, {0x6, 0xc25a0, 0x3, 0x1000}]}}]}}]}, 0x114}}, 0x24040084) 422.211649ms ago: executing program 1 (id=3938): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000380)={0x0, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x0, @remote}, {0x2, 0x4e21, @multicast1}, 0x167, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000}) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB], 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000004c0)={0x0, r1}, 0x8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x16, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x98, 0x0, 0x0, 0x41000, 0x68, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000300)='kfree\x00', r2, 0x0, 0x8}, 0x18) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="040004000000000008000400f903000008001b000000000036ebfec5ac8ca7b562602ca721e1924010a57a12d9f160f5034f20696b85547fbdcc420365e195017b16d4fbd82feb55e27c2869d8827dabeb84d304507753f12bd70f98d3fd615603dc3a537b43570201e4f5599f519d18c4a411c921d8b9ea53315eb7a475aaa9935b6954d74a8b011acbb5bc5e14c8fe0b68"], 0x30}}, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfb, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6_vti0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8840}, 0x4000) socket$inet6_tcp(0xa, 0x1, 0x0) syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000280)='./bus\x00', 0x1200040, &(0x7f0000000100)=ANY=[@ANYBLOB="757466383d312c636865636b3d7374726963742c73686f72746e616d653d6d697865642c6e6f6e756d7461696c3d302c73686f72746e616d653d6d697865642c73686f72746e616d653d77696e39352c696f636861727365743d73703836322c696f636861727365743d63703433372c73686f72746e616d653d77696e39352c756e695f786c6174653d312c756e695f786c6174653d302c757466383d302c756e695f786c6174653d302c003c24d06816418f4be78ed4fbfe47efc82f966a602a8db43ad053c978bbd3501706515140ef63c2a58653ced497550b22917b09702604bc162c57e05beec5bb0c11fc2f9238b25e4527e24bab534e9ba458d92a597c3fee89f57053a4a1535771c9877b3ab101fb26937779cff75a95a296fafddf11280fafeb9bd5f2da4a88b43f3e4d5b1a9aed1f659d88f914548fba990603b0d4f14adda86d459c62701d3d6f007c7e50da9608a03eff5843f6739a8ec5ff33791394a5c075018b5d92bbd7d9874589f3561fbdfc44653bb6c56b522a3413"], 0x3, 0x37c, &(0x7f0000000ec0)="$eJzs3TGIW2UcAPB/7uUud9J6NwiiIEQ3QY+2CqKLV8oVilmqhKqDGGyr5XIWehhsh6bnIo6Co05uDjo4dHMRFOnm4GoFqYqDditY+uTlvSQvl+Q8Kmkt/n5D+Pf7/v/vfS/5aL7Lke9eX4uNk/Nx+vr1a7G4WInq2pG1uFGJlUii71KMW5jQBgDcG26kafyZ5iK+2ktJZfazAgBmqff+/+b+Ust73+yWn+bv/vOznhcAMDvFz/9L5bZkR87itOKzM5sWADBDo5//R8RjYymlX/VXx/YGAMC956VXXn3hcCPixXp9MWLz/U6z04znhv2HT8eZaMepOBDLcTMi3yhkD5Xe49FjjfUD9Xq9G7+sRDOr6DQjNrudZr5TOJz06mtxMJZjpagvdhtpmiZHv2ysH6z3RMSlbu/6sVnpNOdjKatfijM/3hen4lDU44Gx+ohjjfXBnqS52a+fj9gefm6RzX81luP7N+JstONkZLX9bU1j/eLBev1I2thXGdZ3O81aLy839RMQAAAAAAAAAAAAAAAAAAAAAAC4Lav1gZXB+Tnp8Pye1dUJ/b3zcfL64nyg7fx8oLSWRpr+8e6TzQ+SGDkfqHfAz0h9Nebu7q0DAAAAAAAAAAAAAAAAAADAf8bW+YVotdunzm2dv7BRDrrnts7PRUTW8vZ3n3+9FKM5S8UAo1UjQbVIKXXVh1Vp0k9Ok5GcIkiyi1eqectnlwczLufUBncxcRq16V3t9v5Hf/74wkZ/1EeS/si3hjlJTLyvC8mOaZSDzfvzAac/LbsEh/4h52qaptPKL742XhWViOrUqd5mkGbBt9feeuiprf4iSHOPP7F84upHn/620WpnV8602wvntm6mG63i35MX2/QgKa2fSrHYKuWVUG09fev4vikjb4+2tJIffn/54Q+vFC1zu79M6Ykrw5Z3JuQk+UW/2Nm1kAfZNAddz2dB9hyNjzM/YfFPCp6Jf/XCPfjJWuvyxZ9+3WtV6T8JB3UAAAAAAAAAAAAAAAAAAMAdUfqueKH4su/8blXPHp/9zAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgzhn+/f9BEHPbO1r2FvzVjX7Lieh31bIBY6F0xZW7eLcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPxf/R0AAP//KWlfjg==") perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x4030, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x3a, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, 0x2}, 0x94) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r5}, 0x18) r7 = syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000280)='./bus\x00', 0x1004010, &(0x7f00000009c0)=ANY=[@ANYBLOB="6e6f6e756d7461696c2c6e66732c73686f72746e616d653d6c6f7765722c757466383d312c64656275672c696f636861727365743d757466382c73686f72746e616d653d6d697865642c757466383d312c004845160000000000", @ANYRES64, @ANYRES16=r5, @ANYRES64=r6, @ANYRESDEC], 0x1, 0x2cb, &(0x7f0000000ac0)="$eJzs3U9LW1kYx/GfJmNiHE0Ww8AMDHOY2cxsgpN5ATNhUBgmMMUaabsoXOtNG3KbyL3BEik1m9JtX4d02V2h7RtwU7rpvjspFLpxUXqL9yaaaJLGkD9avx+Q8yTPeXKO5ihPLiTuX3t8t1Tw0gWrqum40bRU14GUOowaphrjdBDPqFVdv899ePPT1es3/svmcksrxixnV//MGGMWfn5+7/6TX15W59aeLjyLaS91c/995u3ezN4P+59W7xQ9U/RMuVI1llmvVKrWumObjaJXShtzxbEtzzbFsme7bfmCU9ncrBmrvDGf2HRtzzNWuWZKds1UK6bq1ox12yqWTTqdNvMJXW7RPubkd1dWrGzXtB8Z6o4wcrOd7nTdbL1zMr87hj0BAIBzpnf/H/b63fv/3Fo4nqX///7L/b9E/z8i9bZbXfr/b8e4IYyc62atROP3tx39PwAAAAAAAAAAAAAAAAAAAAAAF8GB7yd9308ejo27gtsxSXFJfiN/VNDP28pxYbQ+/37LV9fnP/TXhLaLIWt5415cch5t5bfy4RjmswUV5cjWopL6GJyHhjBe/je3tGgCKb1wdhr1O1v5iGLN+qZUp/qpqBQ+QHv9N0q0rp9RUt91Xj9jOtXP6LdfW+rTSurVLVXkaCM418f1D/4w5p//cyfqZ4N5AAAAAAB8DdLmyKnX70E+mBDX6XxY33J9wPf9nV7XB068vo7qR64lAgAAAAAwFl5tu2Q5ju0OEMQkDVYuDbxor8D3paE+4EBBRJNcvVvwt6RzsI1xBXE1z5gZpPydznRE/T7mRCVN/MdyhmDSf5kAAAAADJtX2z7+Bz/9ev1wRLsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBy6vfzwJrzT6WaiZ6f9nckMvZvEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADhHPgcAAP//ps0YVA==") mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYRESOCT=r7], &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r8, 0x0, 0x2}, 0x18) unshare(0x20000400) syz_io_uring_setup(0x10f, &(0x7f0000000300)={0x0, 0x8d2dc, 0x0, 0xffffffff}, &(0x7f00000003c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_LINKAT={0x27, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000740)='./file0\x00', &(0x7f0000000280)='./file0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x10, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18020000ffffffff00000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000004000000850000007d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0xc2f00, 0x4d, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000980)='mm_page_free\x00', r11}, 0x18) 383.258042ms ago: executing program 3 (id=3939): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b0000000700000008000000a6ad6a1a05"], 0x48) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f0000001480), r2) ioctl$EXT4_IOC_SETFSUUID(r2, 0x4008662c, &(0x7f0000000300)={0x0, 0x0, "6c02fc6fb7f724c50cfba55e785e1978"}) sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000001c40)={0x14, r3, 0x1, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x84) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000ebff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r6, &(0x7f0000000100), &(0x7f0000000000), 0x2}, 0x20) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r4}, 0x10) sendmsg$IEEE802154_LIST_PHY(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x14, 0x0, 0x30b, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4851}, 0x20000004) 349.841646ms ago: executing program 0 (id=3940): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffefc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1, 0x0, 0x10000}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = dup(r2) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="640000000206030000000000fffff0000000000016000300686173683a6e65742c706f72742c6e6574000000050004000000000005000500020000000900020073797a3200000000050001000700000014000780080013400000000008001240"], 0x64}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000000306010200040000000000000200000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x4) syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) 299.426111ms ago: executing program 0 (id=3941): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x1, 0x4) vmsplice(r2, &(0x7f0000000880)=[{&(0x7f0000000180)='\x00', 0x1}, {&(0x7f0000000200)}, {&(0x7f0000001300)}, {&(0x7f0000000440)="15", 0x1}, {&(0x7f0000003040)="162dd3cad75f87b473622140aca9f6be4377caaba76f08daaad767f134c2ffc2ba9c92a5971b01b71a225dababc99832633ea975d465532309695b29d56eb9befec5159067bffa2d17b24093b372ebaf5589d18a8905982d01ee2870aa096647d6afabca77e0f36a01481b10ed8f0a585ceb41bf50f0515c259bbbbee74db0e045a9fde3614d35c6f2dfa1e71dace811a410bdfb395dd7c54fa733c6f8111f24df309ad928c6462d0a53a3824f9af07b11cb0c05724c33acfad1f5f16bffaf6c58ab2b8c4626bd9d4d1cc4ab67c9838b1fc53fb4ce46d304a12fffc2110043381d08160f056e8d3908497a402dcc156ff69bbf5cb5e5443c06bc4e3c6e4f231aab0eb6fdd2bb0740ae88095360d8b247daa6628fc10edbf048d800625134022e1d5d0bcb5c50e567f50c1990b1a434caa57d210b6084c9424d37c7a71479613b69b67670baab82f13b0923a73786655cfceb0c70d511b94f992391cad9ce57c5c76675cae6a2712cb9ce6dc07bdd0118001f062a22943ca72742a0fe97c48b9b895515fc71145fac9dfd27118a70b71dd564f27e31e1112292864a7be45459524ad8fb03c1f4388bdba3d9e3882a9be894133b0deea92885d0276f268bad0396635036192da1a9788e7525b08de07b0f351147e0f2aaa239e197924a5fc6961dbfcc96ad4cae4cf59f7a812d0c7f8506216dfb7658f8f8545477f4b6c1a606554ee19621d85438014d5e569b0c467e67cf0bb046284f4145ee9f9601b950b0217d183d0266da78f83ed2cf8a83f1374295853d52cdd561a756f247598126cddc98416c42c47a5ad4fda1c419b6ce04f4b57efd2cecf7bfe1589aab05c33e397c8acfb5e4d05cc62db2ba633e74d08c9a3c92111d39ef7d1c0321bfa1827b9fbbb592c49d46244b57c985ee4cc830f7eeda32cae961c4386916f927fc7f442eb6e2eaf45a3d2b0f28d4d319fdedd003aedc1c6384085921397a041384edee7172973fddb3eee2132acdec385cb596055f82a41087097ffece144a340cfe3ec0c0b833f4a92d28709419827eb0f747d73a2e7cc7d00a24749b9dd340793e2ca36536bc47233c9e2602a7f7f94450b22117215be6086d0c0132d24350c19abcb3d713fa97f76ce6ec8f61b24bfecb3ddcd0e7bccd0c4839de19283e95e08bc629554aac9543c15b0f69f1d03374269796c477579d212708b760914bde3269d9e9b0036c7cd0e8f3376d6a62ed0cde76861423ec5f76f2ab4d0f05b21db57277feaaf8475e6e6d1e5672281db17046b7464439d69e25210f67998e912d02c5296c60a450a38495e3b6737339a05f83e5a02aa1ee5bca6bf67ba84c659ef3cc4495cb1551e749277a86db07e7c48f61ee0672919d6a00472a893b6c6eead02140318fb497a1819b692b9bcb3b5cbe7cb55b9524abb1268b3f4a031a64fe6305519a2212298089c443b0503e77b7c8a3da14387872ca35cd6524f629161d85f253498568587513aa16848fa8f8f3dea115cbe8e85bdb8aa20f20ce26f3fcaac4615a9b9d7d6919ba952f7e93a96ba26010cc4bc24622ed3bb9b063e0e686f41b2cece5a50d787676600a04bfe7e6eb78e740b8bcb4b3a51f2a39250d0163a75d8f97032c60efc5516ba48ce2d53da0a7aab99330369a2c44cfc6ac65707733971493de86a519629f7be4643a52abe3d0ca1e22dfa27d8f7c54c50e0e1f3f639dbc622afa56d22b2732232d62b0a312c359dfd25e266f2138a49689fcc789470b01aabc05563ab025938153c15abbb300192e0bc27f810246d4d24295f337db02aa6b3e801905ee519a681fd73462eb330800763f75ae88e3e57c2a5552fba4b6154cab775625b817e18ff1e26273d21bf8b3cb2a79df7e92a8e498dadc04f11c62d6841bdd0408b212a43951a4a4f4f29c9b8918644e743e2f30cc52d422a9ce03750307096a5f8b61bb585ada2ad7a63d440e418c16e6827792dd470fa980a72cbe53b354ab208b0cb99ad858ff2ee4395f7fbff96c38fe2f84ccca78b6c867d1ff0440c5795b875339b87d98e59dca2dd80b3624c7406b56dc76b0198514bdb97b228e5b726683b3c12f71fb2b1dda24d085175acdc5d7744129df8065168ac103d819bc95dd408e17bfa7ae37d0ff5145e393a37b5cc08c2c10e5ef5d80dd6c79d35c650417e6fc47467c3552bbc1a3d50d2cdce471e5cd43b48475272e30c9d415c826bed60369c1841219e15d93bd87de49e2566de3a01dfc60cd3295134c876863cbfb7be8be44b0d4369b81a778f8fb2fcd039048fd16bf9d4f08a9458dbeadb298ee12b7ee7f6f43099dc684e33bee75d23f37c5b058e56f785f1c2af0c2ad66b69fc1fc06073bd53bed4a967314a6af8ede4d2facdae08ed503c4903fd5fdfd291327cd2ead1876361a16d9341cc24a63b2b51538b7199e048c00cab7127d19ae9a3ea0755b9b5d9604fefcfe7237d641019291bcd9ce30d5a388ad7127fde6061f1e307c0024ff1c200dc04354340eb4e8daac073b7c2f1fe1cee49330cc89ac061bd8a5f1676391d22d4afc8e5875daf4806bac0b5565bb99f07723cdd063ff070ba409fba6642888ea88109b333c3748f77b99f3bd4b9b61ec5e3d798d3584937c0165f4df571b8132ae425849e7e5ce414fbb00d9a30c129e2c13b6791435bb552bb01cedf3003b3bb24503fe226121d1f83419d5c23fad54dbd08fb3449b8a561954a23b47e34b7b14ddbcec2745353269e19fe218da2d0aad6df73083b3979160d4e52c8532c9f6602bc8ee624b9d5157fefbffec98e0e91a4f3824ccb4c33e17d19011f4c8db333d0fc5530930951cb63353a3aa0617ab2aba52268b81628d9f4a56b227300488c10df1e7f7533e1e4db449cb9cb6e588debf4795f98810702de5bfb81414bdacfcbd9e66f051ec7272b41ba281e8a68fe7c61e1cb4e74077342ddb7c5191d9731448a9e42a30c4df80e533db26ca3e12ab8ce8b5f0d114888692589b6c836c603ea4210c31b0e053092d75d9ceb49c5e9e2815b5aeebfcb53e97017d0ff6c7d3410120e355f9a6a1226e64a1621a2e6c04865acb25e137243ab9b82beea39c411163afd8969b086df73751020879785ec79c451fb822c11df1ae927318b35bd583a56827fd8744df8e7693837b8ddb0e831fd97b87505d5540d76d3e09895e64cc563dadf60bec88ee70b6008a53e50523ffbd2c0aa9f19123bd6f28de9851ae1f3f6101b46acf9139792be4872bf494c8970aee100a7a0c4dfbccbf01b6ccbebdfa8291f8ab3e25a9e4ff5dbda11488630e3bb8158b8f8de8cd4f793885e7a28e5afdf45eb57ad1330dfc0c51f51986e53c458feb4a4ef55b810a32f847d7ff5500c0f769d9abc090c10f87ba4e5250f36e70abb838ccb8f9fa95d96ba1e2e75a2d808a8fa26b686149ed6738a8e63ef70ed284e25d044aaa1e14c8caea04b77c9fba96036dd8b3be2e7704c65090fa7e8bf0e45c291709d3eb16a81e8aac27a120e52c05866310d8f288367f2b5187e83a1f7d5cb9dc6f8faa648683b7c88d54871dfcdca822568959ac2f7eb7dd3a345b0a8149806105dc90abfee3d5cefae3dfece4723fdc5a73c3a087020ca2fe1b166fe5b54cfb2f661fa5b017502155bf91856c3aae5cd20a48fbb958e1a0e70df51e4e46bbea56f639f6f32698d45297296244e8aaa845c13b70fa7f4f31115de0808975c143191c89c0233c557ddb93d6233ce22a699ca9a54ca6e8ddcfb5bf9d95b9807a49d9a64f7a239c77fa4e0d92d561fca5aa3e6c149c16c11131c9ad78493572cf1a9f953cc63ef8121cfa86a0f3fdb5a73c8530ddf93a9308fcaf436455aa6817f65e4616c9e38733b1cf9fa09822953d7d203748c5e45cbbe84a4fb7d59318013ba2a7da6f972c47ff9289091d7476035affddf44cc7a0b223cd14af5243dd14cd5d0f42849bd31af8ef9de434a01c52ee583c2d93b4785c34969629ffa406335ccd090637b83a5ee126a4833e6d6cf92b8aa6f9a2213df25fa575980c0cbd98039ca978860442b7466c3d4aa215593243d9c7ad3980470c9ef85154566ceed93ccb0330634f92d1fe5050bfe135f345527c93476e474f31ea45729ec534475d36b69876644e5db59c8cb0412f8d65be9ff2bea5ac37c5b1ff5d5d484aebed8b33920bbc8ed59ba9b3bf24ab6da8ebeda14dad9148183411980136cc2fde47049c98063b0ff1816a0852af035cbe8313d88620559e8331d983a43e0f4b515a61f5761bcd2130853ea24377d042643684699ceb9441a73f1285f6a15c8e00d17b4e051df2bd16b1a5699f6dce4556b0b6c88b8b86464beb6415777a8ec890c9335cc14452d6b23e2483d5b77b56042a694435bf913cb6e48ce6ca60c3009b274869bb350a8026d80680b32c9394e9b5dfee8df555a705bb1ff17ac848ccec95bb37206a72ab1d56160682d83e38c8acca34b08fa3b8665b35d01967c0a49681ef74b89b39f785977187a9d6f70affe2a32f41fe942fbd30fd9da981cf8f75485015962cb598d3d09a039787bf8d339695d0f5cd7cb60d25cdba119fa435e3692e06bdd76db5856eb2ed2cd85a081209b0a1453d52e1f8cf5120c7f044bddc38cded7ed59a793bfb2b289137137147f704a0628bb8e3e342b6084fbcc105b5345023fed9b2d339b95b0d0c97945943a70e007fe2172c501fae54ad04c279ae6da7150ea25469ce7e9c33b51713b05dcd4753930a0a37326d276fd28c8c0f6e06660beb102e2868fee31f70d37d38769e824846b081d120d8fcd394627fd672fe823cfdcf7af07b20b40e8e5efce8e93e8414744efd2723798aad9dabd8e23efc08983db6c65cf3c43d5b759ca52d118fad7a1bb23e5b3578f616fc42e304c797e640d8b985987274766adbf424e4e9a78c29dc436636e0df6e9255ebdd2c7c0cd261d42631cc49df231d0bd080da2928bcab9a0546b404b658f75fca9d8e506f3f6639bca2a13eae6bded0081fd2239bd8c0ab2382d23eecfb8985da82fe5ed32a96ac1e198d7f8cf5752cfb296af0a2d59ed19022cb084b525d44d8c773a14743a706baf209aebb270104b16181fdc2462d356341d89ba8024171c462640abfc3bd6f602c3bbd710f6ae6a2cef146f27002f78051d6687b83dac0cc627e0af1ed8765396d9783c6429b4063a8d58728c60ec88416c5dbdf362b891d278db21c9a4558c724b06547fc5f641801dd0da8403e57cff37d407fab07bb389c40555af869af263265333bf8aa4290d7cdb9a78573362d608a549165f13323c0107aa4dfac934fef838cf6e5f06b9324a5d8474183f077de97287eaf3c85cb74165b189d7547d3fccc4c763d02ce57d59c70f39e8065cdeb5fd13c4c14609f98941b73b16fed60bc55a2d8ef92104568b595f4a31f6428d527b34c470715d1300cd41ea992763f46a739ba387f359ee1d97c51e889e5599cebd800dbeef1496e3dbacaafc403d0dc7cd3c7d193788536aa5b0f5f25482744107d74795f27a8a8832596166fdcaa548b90c48890715526a52518f16d697d65beb6321befa003dc56432e3dd4b01cede5447813eb429dce845bf9702e5063fe571d8cb6cfecf12870e373b42c4f86f75b7b249f1bdb397113dfd7a23f1930f8533e300e8d0dc1674acb3ce3", 0xfa2}, {&(0x7f00000001c0)="37c2", 0x2}], 0x6, 0x0) ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000500)=ANY=[@ANYRESDEC=r0], 0x0) write(r0, 0x0, 0x0) 272.388584ms ago: executing program 3 (id=3942): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000820004000000000000000c00850000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x65) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="160000000000000004000000"], 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="400000000203010100000000000000ffffff7f000800034000000000080004400000000008000540000000000900020000000000020000000800010001"], 0x40}, 0x1, 0x0, 0x0, 0x20000840}, 0x400c000) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5, &(0x7f0000000080)=[0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x16, &(0x7f00000001c0)=[{}, {}], 0x10, 0x10, &(0x7f0000000200), &(0x7f0000000280), 0x8, 0x1c, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000b40)={0x0, 0x0}) ptrace(0x4207, r5) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000b80)=ANY=[@ANYRES32=r2], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000400)="d8000000180081054e81f782db4cb904021d080406038609e8fe55a10a0015400400142603600e122f00160006000600a800060b200006400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb50bb6d08034cb4cac034eb27a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f2146b45465578151be43d55ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0xb, &(0x7f00000009c0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r7}, 0x10) r8 = socket$netlink(0x10, 0x3, 0x10) syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./file2\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x6, 0x376, &(0x7f0000000f00)="$eJzs3U9oI1UcwPFf0iRNsu4mB1EUpA8XQS9DGz2LQXZBCLh0N+BWEKbtREPGpGRCNSKmPXlUvHsSPJTeFDwUtGehF296EcFbL4KCFdSR+ZdMkkmTxqRh2+8HSl7ee7+Z9zIv5TdpJ3P6xqfv1iqWVtFbEk8riYmInInkJS6BmP8Yd8spkU++77btyQs3fv/xmfsPy2mvQt0tPnixoJS6tfLtex9m/G5Hy3KSf+v0t8KvJ0+cPHX674N3qpaqWqreaCldbTZ+bumbpqG2q1ZNU+qeaeiWoap1y2h67V/52zEbOzttpde3b2Z3moZlKb3eVjWjrVoN1Wq2lf62Xq0rTdPUzaxgnPLB+rpenDJ4a8aDwZw0m0V9SUQyQy3lg4UMCAAALNRg/h93Uvpx+X9IN//fkFul0p115XTu5f+Hzx63bti23fHy/6NUVP7/0k/etvryf+d0opf/N7zzg8r4/P9zuUD+P5wRXS9T5//5OQwG01lJDVXF+p45+X/Wf/+69t88XHUL5P8AAAAAAAAAAAAAAAAAAAAAADwKzmw7Z9t2LngMfnqXEPjPcSWNOv7LIpJ2jr7N8b/K7j/ckLR74Z5zjM2Pd8u7Ze/R73AsIqYY/9iDnLURXHmkHHn5zuz48Z3d8pLbUqxI1YmXNclJ3l1PoXjbvvta6c6a8vjx3cuUsuH4guTk8XD8N+7qdOIL/fH+/lPy/O1QvCY5+WFLGmLKthvZ2/9Ha0q9+nppID7j9hORXy79oAAAAAAAMGOa6oo8f9e0Ue3et4wUK+7HRIasSk7+jj6/X408P0/knk4sevYAAAAAAFwPVvuDmi5xo+kWTDOqkJGRTTMoJPpqkiIS2Tk1UJM8b8tLoRlOOp6UeHcw+b/z+iJ4VS8SFfwjhTPwbpN/RxXx+zzmP51wy8H83ZpY4rk//Ka/Ljqv2J64C2Av3BSfZBiJ3uC9mhWnQkV2vj1yO/v+RLo1wcdGqRGvs9wb3k78nJWQHKqxY9MtgCc/+/LP2b1BXv7aXwHvj++8bxp2Z+K1ESqkI1dUcq6/dAAAAAAsRC/pD2peCTeHbyQSvlkOf7kHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCG5vKVfgOF0XtfvsypAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAv3XwAAAP//Qv70DQ==") r9 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x105142, 0x2c) preadv(r9, &(0x7f0000000700)=[{0x0}, {0x0}, {&(0x7f0000000500)=""/175, 0xaf}], 0x3, 0x5, 0x2) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f0000000000), 0x4) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000900)="2e00000010008188e6b62aa73772cc9f1ba15e140602000000000a000a001000000002900000121f000085a407ff4fe06a7612e752399a89bac842d3899cb20ab19599ab6f024ddfc8024f54cfae0fb45b37a38965ce2d9c3b8898afc3d87d361aa9a40e9c9bd2838615467afbc37c44cfcbe8224c362f0adeffaf61c5c01f9b1fde5c016969682882983f33759d63089cc0df39", 0x94}], 0x1}, 0x24040041) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x8000) 38.075696ms ago: executing program 1 (id=3943): syz_mount_image$ext4(0x0, &(0x7f0000000140)='./file0\x00', 0x2000000, 0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'syztnl2\x00', &(0x7f00000001c0)={'gretap0\x00', 0x0, 0x7, 0x20, 0x40, 0xfd47, {{0x7, 0x4, 0x1, 0x5, 0x1c, 0x66, 0x0, 0xf, 0x4, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@lsrr={0x83, 0x7, 0xd7, [@multicast2]}]}}}}}) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={&(0x7f0000000f80)=@deltfilter={0x1280, 0x2d, 0x4, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x7}, {0x8, 0x2}, {0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x34, 0x2, [@TCA_FLOWER_KEY_ENC_KEY_ID={0x8, 0x1a, 0x5b33}, @TCA_FLOWER_KEY_TCP_FLAGS_MASK={0x6, 0x48, 0x4}, @TCA_FLOWER_KEY_ARP_TIP_MASK={0x8, 0x3c, 0xff000000}, @TCA_FLOWER_KEY_MPLS_TTL={0x5, 0x43, 0x2}, @TCA_FLOWER_KEY_TCP_DST={0x6}, @TCA_FLOWER_KEY_IP_TTL={0x5, 0x4b, 0x4b}]}}, @TCA_RATE={0x6, 0x5, {0x7, 0xc}}, @TCA_CHAIN={0x8, 0xb, 0x8}, @TCA_RATE={0x6, 0x5, {0x5, 0xff}}, @TCA_CHAIN={0x8, 0xb, 0x80000000}, @filter_kind_options=@f_u32={{0x8}, {0x11f4, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x3}, @TCA_U32_ACT={0x11e0, 0x7, [@m_tunnel_key={0x94, 0x11, 0x0, 0x0, {{0xf}, {0x34, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @multicast2}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x10000, 0x8, 0x3, 0x0, 0x5}, 0x1}}]}, {0x33, 0x6, "5864b482003f365d5b0320e2a7c9c3718551a5371ff14821b4ba296afa13134b6dd4cb1478ddc769cc6bf162ac7dc0"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_skbmod={0x108, 0xd, 0x0, 0x0, {{0xb}, {0x7c, 0x2, 0x0, 0x1, [@TCA_SKBMOD_SMAC={0xa, 0x4, @broadcast}, @TCA_SKBMOD_DMAC={0xa, 0x3, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2f}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @broadcast}, @TCA_SKBMOD_SMAC={0xa, 0x4, @random="21f2085ec0d9"}, @TCA_SKBMOD_DMAC={0xa, 0x3, @broadcast}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x8000}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0xa}, @TCA_SKBMOD_ETYPE={0x6}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x2c6f, 0x6, 0x2, 0xdad2, 0x10000}, 0x9}}]}, {0x64, 0x6, "90ae7e0a185706f215479c3fa89067a832a82cbdfa1e38fbd260c5284155b177531c687b1e6ed3d6110a9240d6099f0b8245aaa0f4a64e1118e19f78036e383db66542e237cfaf09aa72724844d805d07d32daa683bf4801c89552261a021392"}, {0xc}, {0xc, 0x8, {0x2}}}}, @m_ctinfo={0x1040, 0xc, 0x0, 0x0, {{0xb}, {0x14, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6, 0x4, 0x1d}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0xea9}]}, {0x1004, 0x6, "709aa86d4501a6a00b7130051999abbba9e691eea90f963d8e152de5ccdbeaaa8bec35e7a33b5c2898255e9540052a08be055371dd88251491a7ddd6c23f62ef6515fa21f3610dabdf577d4675c6160b9cc6410a110bca2fb792e77f1cc60adafd0532c7383713755567a2aa860554ab6e6d834c214cdf973084706f06fbb31c280adafe51c9fa58e033e5dc35d2c3c41f8318155cbd4a3b1c3bee4242a9227fcbe3090f7ac46abe7113d31e404971a4c241ff4759b70bde6a0d78c59aef41e5896acddb2d72ffbd82fadc999964d657206358f0a669d6938a44cb79e3c0704e94903bdcc7cdb671639bf9e58c59a8e0e01c9ece2d0181bee6df46822af0d6f5fd00ffadb7ce1ff9c2ba1925cc0f1051504d621139b0f2084d8831b51ccadb2cea251db12eda9a549f3ada87a50d04c113619b8776922b9240eaf154cc34c06563582f10cd632016560c378f0b357e76fa9c1119b970afb2cbe47a4ac0c4be64edbdb84a69d2e4fdfcc5282446dec87e057f1f249461da3ee4b8bfe3c3f5f8b023ab826f2f176f0a710c330ffc01ffa5d8f4145a351a380fab6559aee61a9a0687d2ad0532a905dc3c447d21ea6d63613e716e6a26a47e451e02c1512859a07797d7889b86014873869db5a482940d7ae15bca93046ec8b134d5174415b7d3aa2e316eeb317c72759e0d8a7519d866bf60ad71db54ca3ceeae1a013bc8c32957e98a8f111772d9878e64122129adaf1ef6c59651d3d1d0328c3ad5b36b87e6bc4c99a973ecfc17b8da3c92a83dca01b89a92fe768d7743f965556fcf7a02ede12985349ae852d14115508f90858a12cf1cef5b43055c2bc81c306c72d5480cef11a209561a5f10ba23fcea93e36c80684b7eac625a000f73122aabf4ff3188546b3b67c35ff08a7264424effe8edfdb6b5771d5ff8542b01b14ee3f64f5ff165bbd21508bb42c5186628accf75fc2636ccc9ddbe10fdd8bc6e24c499e7f44860667138a7a2391ad4adc1ac48577d040ee41a23aae8669878f7f70dbba035b13584bc5a1c5cffc7a8e519b24c17d87bf32d4746caa87cb88fb18d50cd1e3c5831a269bceb9fbf89ad02823841853968eb98e9d2e8c8235044940629ac106a933888c4a1c4c4d38e522d69d36f1742df0620a48950ddc290a2fca5b67669ae189648d66ec64444e9a7955f3bfb2822e3cdfdc753629b6a10b8215bd2b9815b7f10cf1c9c12112456ed8236553881e6995c3d73b342070c675d4255b1065dbe986a8d6830da3cf454aeaeedb1500103f29cb507c3de558b82cb5c55961b34a953610fe487ebc3196b820ee9ddef2bcdd6eb01ccebce796af591fce1726d93336113f484134791f5fad58296480b77b0734ddf8595cc097c77fe8d6ca56f3d4f2e27ba668a53c2577009842b0609bca0db892a99168f36950f720e3ec89867b1de03c5da4c7974ad58f5d42eae3a3b819d96a311d4e3901e04a8b0c4d3619a25b0ffc3218458ea1196d7e14aabab411de575945258a6338c85c22844aee826ebed0e378e8fbbcc50382fb0871acf4ed06d7943b9b1c391803297c2969a04bf517acc588dd96bd474f19e1c337cfb66307975d5656d70e3e157e22758e9c1c067a2e5f5e7e79f3f1fc4429ad4feeed05f7733fd8cdfbe527feeba041dbc2b52efe41b21eaa1ac3027cc981bebe61ca547786f506a278d48eee187b27a5cb33737bde78d0a23052d8925188de67456d9149bac92a0e66d47a0690cff2d8b473c0004de894748f5bd94efdb40dc6c8d5d3a05e39ed7c682a7ee58225868215669ad05965b3fa2d2d2fcad759bba0e3d958ee7aacca3995d764d6ac61998c8952e83e10307dcb8771caaf3b26a5c0c2bdf9e339419e6cc6dbe82898eceee064ce1f2536931ef6fb5a5fa356adcda91c5c1a2de1a557e59383785dfeabc0054390ba60210e300a551821a2e3519fad81f3e273d13b52a75a18e25b886a546e08d66fa69023a772a32437134844cfbc701049f6ec2897f37c462d0c1c1e7504b679ce9f6bf0a6b5223023b2783194019e54e36bce2e3754c3c1640e0edf3eea467772457478bed7c38b29fdc64bd08b2dd99d094fa5b404d2b1295e7676e3fedd215727f2915c37a22629c4f17f9b07d8c4b2e9db9e54c259e80405f4b31d7f7a037b09c15c826c3899b1270670b36574c233f990663470e1b3dc88daa560e27a170f7a2db2fe0ea2a537022ec5d62a43f45a2d1c1899ca9c2f394a9801e0fcc497a0ec6edfba4398ec52f8c0eb9d5f8c3ecbc7b7d03487fa54ab46d43a9a473f9779fa6a4f5a2f7cde68f7ab4186a3a8fbaa83da521b8e3357086c3dff9ed5c7245ee2700353a8360b225fc9ad151f121aa4b6ffe54921d5dbfc8345cc8fae4eeecf1aea551193a04149aff7148021f99370a633979bb2fe3a435d3e919b444d837c902156fbce020b008dffd2170ea0b98f19a2dadf95e5f1a098204bca6c973453cb689e142e08c4ad6d7813c6c2ebe318ca67cb5f481cda250565435b6dcd07b2f4abea486f855c64dd87a3718f49ce7af20ed7ff0b40b787c9a22e167e98e83e0272611864d3ca462e11b91cb6401b50ca3357c164e31cbbc7d211ae8aae04049815a08d2926656e270ea5d8a9d298480f265c5c226e17d1e51e476da2b6171f252d7bda51b52a2f82a09feb7e108875f4a72478e006d1a5056944de10069139cac4482da2f00e063392d3b05183c11788340e701a742e23cb4cb89d79dd213feb5a1edc448c257f533103759c0a591cb0c0324aa517289f485bc729d3c2b40391a463a1e0db1fdd26aede4f2d4820074dcb840e55e6f45698e844302fd500601f3d4a4d72ca1d14f8dceff84a8ce13b4ff3f091907425c0c98bfd287d3cba8274cb0e807178409c9d470944e9b2a0638112e34f0c30e96a63bcc69dc7f6cc13ff7abdafc2966aa55e0572b9345835f18db83665eb25fd18cca4f5a7f9d7a743535b9f8f639b1ce1ad377d19775f50fdd0367a62e7012a7b52ea2c2542bd4d92195ba8c894bc2f3ed855c1bce274fa10af9b51fccc0581a30a38117255952ff2a3b795331b953de3d3db4f6f121460ce45e35e12b9c22958ae4573c084f934ad8667fe521906d716f4a6da1819a8a8f8f7cb9ea6c699377c538dcb4aa523745376f01a61c78370204a89e26ad2df7d47ddf3cfe1e547d38c0b164db41641971277511f3c345119542035fd53523a89c75ff4867c235ec6a05ac56c8e37394bfc1595059441d1bdd5c7ee1c1f2210bd50b61c56b17eabbb9ddb3ee24d926d2f3094e81ea1511731775a35c3d53e8175d5b6ca5a5385b43702c599dfef5078bbf15a1bdc646ebfc36a80d06bb883dcf061ab1eaad7ac4db02246f082dad68f1245a9ca8ed9f833760803066bab6f11284fa0e14aa4094c43e8d1066c4045cab30c9300b3c6c0865bbfb4c354c7c270f5ea35fb78fa163850f5b5e579ca1d261908d3e67077492f305067441e2d931d4133c3d2c410b030d8bc254c148cce30b7de1673a5e05be0c8ca1ce379496b3da968faab790a68993885898f57f2716409381c261172e1f35e171eeed69f47d7692f5685d139b05284d490e8d37730737a75217ed0cb0858de19e16e3b08889045fccc57efbaab6a70f6218f07ffd1d6244f0529ce479c8e88e24ca97e0f95c2747cfc28e66498556dda6fae65e3ba4ee195130117dd2da2d92fefb5922a6c31a3fbe55abd6cd894808ce68e08e8e54e5f753ca99f2c4fecea5d6950357c9d86f293688d198b0ae1add9b4d99423a23b2527ba5e810d3a63f1a1fe53bfa0987bcc30b4c9769eeccdaf2854aa6b4e9f69b44935c58aec85231a0e2d22fef1196e23f94f4e595788639a834a936960dae0bf5a8f7c9b58dcdf7fa101f6f8f6f1c8515769786061f5dd93d2f22e65dede8b304d208fee94af967d0c60c8fe6a06e2224f2b6a48cb451b4bfc5c82af5b987c84ef9744d7ea308779797b7af0fd1fd97c7230b01597643fc521a7aca8e03c0ce3ccfcd6b9a73e2b8abb7003f9dacf4f2e0242c51ba38f600a94088a5d84512ce4ebce1b551ac5a1a99e006d01b82e44164189998d3b2be45323e54c33d953b83db990faeeff4e866a486b029d2b09929f1581836b0dc80b8ab58c5badd7e9bcb7877b773e6a924c59081f78aed2b51800dbe214b216c17176c73bde430019547d164c912de54eb0283ff8c052ff2b8fdb5f57e09d272a455560feb00dd5802bb3cdb3ce28418afe6bad89a63ed8820320503bda20a4a520c850b76e374ec1a4d4e4682d4f20f8519d489646e6284fd46566489989f4ccf08c32e1da930b802feb06359bd181fa756bb3407ab04278e9a058c26b65881b09339ec58007cf2dd7b782e5e6a061883cf9d21510f6041dd575ee7865d1224066b1144ac7f67b4ed8873a285447fd96ed772972ef29a56bca5c3b619f45057d4a764a86e3d4323ba8b937b05a648583f9fe34822044cc69a9a4fa1170a59a59bf8c8bd772f27f012de1943f5fcaf79c50fdc76efa5b339a5e29b3a061ebc6b00016b8a6856c691196bd23ecf9e1dfc99aa1567cce08bf41bd40526109fdf679df4d1ebe01a9483d8af507f8f71ced0414a2bec1243c9b5c72cf2c5add59332338c810772dd9e103a72aeabecce76b08a6c2c6a4670edfba8de589bddebc3bfe9779e1f2f1858591f41dab3bc3761f27e6feb965e0dbbc79a4192a548ee359f584f8b646b9eb8b2328342fc56dc432678aba3595be8709978f2f210b5648a64f2c0ffbf07aefd49f4e22966e56fa70b8bd7311ed39320d5d7117a2a4712f8d08e2d9d3bc124ab211e0a9e3803989759ce6c3f1c577d0e41ba82af9e7c5f1d8c5492b95e13b0080c95d7691d0cb17e3c5e47b0c9fd14db1ce2f3024694af35a5796e4f641cc8eac607f39f7df057ca17869ae2715a84d9aad27d836cd6a351db41cce9692b0975c677f76d15d5ff93c8ce427b8115b2cb2eadc90869b6404e4f89eca2f0a6efc1648140a4a938937eb7f8c30e79915f08ef914830cff60e3a8dc8f7e0ea4f77728242794322adbc40aec26d772a255f0b1157d53759bd8eaa0548d57ed7963b66be82d71dcf87cc07e586132826c85826d9e43887009f60269633fdb61a3dcfd48be6c73874e5a7740f7dc649632e6a32fa8f4b46b2ff85bc77144f054fc8034c22d38775d4e760319f274961a5e6c64b3abb2497c4ef5c1a48ec0858981cd46febbc33b00d088378a05bf2b40b6d74f1e563f3beef7b1ed585a76f8c5d4964c9c9a55696888a1388a37dec057e57b61ea66bcbaab87141af9ebeea4250ae9da7933566f989121ffb917b25150b6e77d01060c79884202fa42fc197fff2b13da2de0dc70dfd6565b9135e65629296592966471d7baac8f5ff7fb9634d76d057f1225b6387006e140ad438dd5eadcada6c8e5748a053c18d23dda393585745b9e3e3c1a755c7ca8c5feb5073c1911a5ff12dea749ccaa41aff3a71081a9b046669614b93e373ce1511b1025f68fd8b2bcb7c693f62165fa9675e871ce6797c87c4523c6afe02ea60783ae6ffe5635c83cae664662cbdc21dff8aefb2aecc439f787ebdfe21eda0328392f49062b3808c6de8deae44657292e76a605ab2bcb96bbde6c78c5aa35f232a615cd88e5ff06939a0da2080dd9a82e417d01a27c7a203d73db10903ad50099a7d0bfd069acdbdde6216e50476e92fab5024358428bc768365e7cae4a5369e6b03777160fc078c5985d10f0ea1ad9a0b3381aeca7e5a811f305ae69a6c0292"}, {0xc}, {0xc, 0x8, {0x2}}}}]}, @TCA_U32_HASH={0x8, 0x2, 0xa}]}}]}, 0x1280}, 0x1, 0x0, 0x0, 0x44040}, 0x40) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000000), 0xfd, 0x477, &(0x7f0000000880)="$eJzs3M9vVEUcAPDv2/7gt62IP0CUKhobjS0tqBw8gNHEgyYmesBjbQsiCzW0GiFEVw94NCTejUcT/wJPejHqycSr3g0JMVxAvTzzdt9rd5fddSlbF9zPJ1k68+YtM9+dN7szb7oNYGBNZP8kEdsj4teIGKtlG0+YqP24fvXC/J9XL8wnkaav/5FUz7t29cJ8cWrxvG1FptJ4vN7yufOn5srlxbN5fnrl9LvTy+fOP33y9NyJxROLZ2YPHz50cOa5Z2ef6UmcWZuu7flwae/ul9+89Or8sUtv/fh1UsTfEMf73f+nmzuWTrQ4NlQkHu++ljvCjrp0MtzHhnBT3o6IrLtGquN/LIZirfPG4qVP+to4YEOlaZpual9cSYH/sST63QKgP/LP+SSiMp+tgevX84PgytHaAiiL+3r+qJUMRyk/Z6RpfdtL2WrrWOWvL7JHNN1PAQDYCN8erf0s5n5r849Sw138I/ne0HhE3B0ROyPinojYFRH3RsR9EXF/RDxQ95xW+z7NmjdJbpz/lC6vK7AuZfO/5/O9rcb5XzH7i/GhPLejGv9IcvxkefFARNwVEZMxsinLz3So47sXf/msXdlE3fwve2T1F3PBvB2Xh5tu0C3MrczdSsz1rnwcsWe4VfzJ6k5A1o+7I2LPvvXVcfLJr/a2K/v3+DvowT5T+mXEE7X+r0RT/IWk8/7k9OYoLx6YLq6KG/3088XX2tV/S/H3QNb/W1te/6vxjyf1+7XLN1/Hxd8+bbum6fL6H61/Tnb9jyZvVNNFwQdzKytnZyJGk1fy40fy4431Vc+bXTs/i39yf+vxvzPWXokHIyK7iB+KiIcjYl/e9kci4tGI2N8h/h9eeOyd9ce/sbL4F26q/9smir3tG4qGTn3/TbWk6KzxDvEn0aL/D1VTk/mRbt7/Orb07K1czQAAAHDnKUXE9khKU6vpUmlqqvb78rtia6m8tLzy1PGl984s1L4jMB4jpeJO19jq/dCozOTL+uL+6GxT/mB+3/jzoS3V/NT8Unmh38HDgNvWZvxnfh/qd+uADef7WjC41jv+0zT9qMdNAf5jPv9hcBn/MLhajP8tTfkOfyMAuJO1+vy3sIfBYP4Pg8v4h8Fl/MPgMv5hIOXfhB/u5gv+G5bI3n/6V3s3iWhoYZr2qRmjt8erUU1EqW+1xzqfPtmnV+zv/I9t3h4d12Wi3+9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvfFPAAAA//89VeJz") r5 = syz_io_uring_setup(0x110, &(0x7f0000000380)={0x0, 0x10, 0x0, 0x5, 0x80}, &(0x7f0000000180)=0x0, &(0x7f0000000280)=0x0) io_uring_register$IORING_REGISTER_FILES(r5, 0x2, &(0x7f0000000300)=[0xffffffffffffffff], 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_register$IORING_UNREGISTER_NAPI(r5, 0x1c, &(0x7f0000000340), 0x1) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r4, 0x942e, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000)=[0xffffffffffffffff], 0x1}) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0xb, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000080850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x2e, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='kmem_cache_free\x00', r8, 0x0, 0x5}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001000000004d00000600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000e0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/17], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r10}, 0x10) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_FLUSH(r11, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="01002bbd7000fcdbdf2518"], 0x60}}, 0x4024000) get_mempolicy(0x0, 0xfffffffffffffffe, 0x8, &(0x7f0000ffe000/0x2000)=nil, 0x2) io_uring_enter(r5, 0x47f6, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) bind$unix(r13, &(0x7f0000000080)=@file={0x1, './file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) 0s ago: executing program 3 (id=3944): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/notes', 0x2, 0x1a2) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x111, 0x9}}, 0x20) pipe2$9p(0x0, 0x80800) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000007000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000003c0)='qdisc_create\x00', 0xffffffffffffffff, 0x0, 0x5bf8f9c2}, 0x4f) sendmsg$TIPC_CMD_SHOW_PORTS(0xffffffffffffffff, 0x0, 0x4800) socket$nl_rdma(0x10, 0x3, 0x14) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={0x0}, 0x18) r4 = socket$kcm(0x2, 0x0, 0x84) sendmsg$inet(r4, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, 0x0}, 0x240448c4) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file0\x00') acct(&(0x7f00000001c0)='./file0\x00') r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$SNDRV_TIMER_IOCTL_CREATE(r1, 0xc02054a5, &(0x7f00000002c0)={0x10000, r3, 'id1\x00'}) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$PIO_CMAP(r7, 0x4b71, &(0x7f0000000240)={0x1ff, 0x2, 0x1543, 0x7fffffffffffffff, 0x2, 0x2}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x2, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r6, &(0x7f0000000d00)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x15}}, 0x10) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000200)={0x0, 'batadv_slave_1\x00', {0x2}, 0x2}) ioctl$PPPIOCGIDLE(r0, 0x8010743f, &(0x7f0000000140)) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x4e22, 0x0, @loopback, 0x7196}, {0xa, 0x4, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x10}, r2, 0x9}}, 0x48) syz_emit_ethernet(0xfffffffffffffec1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000480)='host1x_cdma_push\x00', r8, 0x0, 0x4}, 0x18) socket$inet6_sctp(0xa, 0x1, 0x84) kernel console output (not intermixed with test programs): 13456 comm="syz.2.3429" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=39591 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 218.277467][ T29] audit: type=1400 audit(2000000080.150:22348): avc: denied { write } for pid=13456 comm="syz.2.3429" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 218.304109][T13464] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 218.315848][T13464] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 218.315848][T13464] program syz.2.3431 not setting count and/or reply_len properly [ 218.504009][ T29] audit: type=1400 audit(2000000080.410:22349): avc: denied { create } for pid=13476 comm="+}[@" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 218.557111][ T29] audit: type=1400 audit(2000000080.450:22350): avc: denied { setopt } for pid=13476 comm="+}[@" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 218.602809][ T29] audit: type=1400 audit(2000000080.490:22351): avc: denied { write } for pid=13476 comm="+}[@" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 218.607875][T13485] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 218.660401][T13485] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 218.660401][T13485] program syz.3.3437 not setting count and/or reply_len properly [ 218.720576][T13494] loop0: detected capacity change from 0 to 512 [ 218.735966][T13494] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 218.743981][T13494] EXT4-fs (loop0): orphan cleanup on readonly fs [ 218.750609][T13494] Quota error (device loop0): v2_read_file_info: Block with free entry 1 out of range (1, 6). [ 218.761027][T13494] EXT4-fs warning (device loop0): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 218.777183][T13494] EXT4-fs (loop0): Cannot turn on quotas: error -117 [ 218.784432][T13494] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.3439: bg 0: block 40: padding at end of block bitmap is not set [ 218.790621][T13500] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 218.799105][T13494] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 218.818859][T13494] EXT4-fs (loop0): 1 truncate cleaned up [ 218.824884][T13494] EXT4-fs mount: 6 callbacks suppressed [ 218.824898][T13494] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 219.349807][ T29] audit: type=1400 audit(2000000081.260:22352): avc: denied { watch watch_reads } for pid=13503 comm="syz.4.3444" path="/25/file0" dev="tmpfs" ino=150 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 219.494385][T11382] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.658819][ T29] audit: type=1400 audit(2000000081.550:22353): avc: denied { create } for pid=13517 comm="syz.1.3448" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 219.784096][T13531] loop0: detected capacity change from 0 to 512 [ 219.798649][T13531] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 219.806957][T13531] EXT4-fs (loop0): orphan cleanup on readonly fs [ 219.814168][T13531] Quota error (device loop0): v2_read_file_info: Block with free entry 1 out of range (1, 6). [ 219.825573][T13531] EXT4-fs warning (device loop0): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 219.840699][T13531] EXT4-fs (loop0): Cannot turn on quotas: error -117 [ 219.848169][T13531] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.3452: bg 0: block 40: padding at end of block bitmap is not set [ 219.863453][T13531] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 219.873871][T13531] EXT4-fs (loop0): 1 truncate cleaned up [ 219.880222][T13531] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 219.911786][T13536] netlink: 'syz.1.3453': attribute type 10 has an invalid length. [ 219.923642][T13536] team0: Port device dummy0 added [ 219.930451][T13536] netlink: 'syz.1.3453': attribute type 10 has an invalid length. [ 219.939167][T13536] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 219.950752][T13536] team0: Failed to send options change via netlink (err -105) [ 219.958491][T13536] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 219.967525][T13536] team0: Port device dummy0 removed [ 219.975875][T13536] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 220.004076][T13541] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 220.017479][T13541] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 220.017479][T13541] program syz.2.3454 not setting count and/or reply_len properly [ 220.042330][T13543] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 220.054621][T13543] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 220.054621][T13543] program syz.1.3455 not setting count and/or reply_len properly [ 220.268566][T13548] loop4: detected capacity change from 0 to 512 [ 220.285712][T13548] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 220.293744][T13548] EXT4-fs (loop4): orphan cleanup on readonly fs [ 220.300412][T13548] EXT4-fs warning (device loop4): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 220.316063][T13548] EXT4-fs (loop4): Cannot turn on quotas: error -117 [ 220.323115][T13548] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.3457: bg 0: block 40: padding at end of block bitmap is not set [ 220.337725][T13548] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 220.347360][T13548] EXT4-fs (loop4): 1 truncate cleaned up [ 220.353541][T13548] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 220.562406][T13552] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 220.573620][T11382] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 220.856653][T13569] ªªªªªª: renamed from lo [ 220.890929][T13571] netlink: 'syz.1.3466': attribute type 10 has an invalid length. [ 220.901492][T13571] bond0: (slave dummy0): Releasing backup interface [ 220.910977][T13571] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 220.920512][T13571] team0: Failed to send options change via netlink (err -105) [ 220.928701][T13571] team0: Port device dummy0 added [ 220.936838][T13571] netlink: 'syz.1.3466': attribute type 10 has an invalid length. [ 220.945524][T13571] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 220.956981][T13571] team0: Failed to send options change via netlink (err -105) [ 220.964760][T13571] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 220.973988][T13571] team0: Port device dummy0 removed [ 220.983523][T13571] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 221.052942][T12917] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.071518][T13585] loop4: detected capacity change from 0 to 512 [ 221.079059][T13585] EXT4-fs: Ignoring removed i_version option [ 221.085430][T13587] loop1: detected capacity change from 0 to 512 [ 221.092069][T13585] EXT4-fs: Ignoring removed bh option [ 221.099024][T13587] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 221.111579][T13587] ext4 filesystem being mounted at /48/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 221.117111][T13585] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 221.135710][T13585] ext4 filesystem being mounted at /28/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 221.160033][T12736] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.170211][T12917] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.228460][T13602] FAULT_INJECTION: forcing a failure. [ 221.228460][T13602] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 221.241604][T13602] CPU: 1 UID: 0 PID: 13602 Comm: syz.0.3476 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 221.241683][T13602] Tainted: [W]=WARN [ 221.241689][T13602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 221.241701][T13602] Call Trace: [ 221.241706][T13602] [ 221.241713][T13602] __dump_stack+0x1d/0x30 [ 221.241734][T13602] dump_stack_lvl+0xe8/0x140 [ 221.241823][T13602] dump_stack+0x15/0x1b [ 221.241839][T13602] should_fail_ex+0x265/0x280 [ 221.241856][T13602] should_fail+0xb/0x20 [ 221.241870][T13602] should_fail_usercopy+0x1a/0x20 [ 221.241891][T13602] _copy_from_user+0x1c/0xb0 [ 221.241975][T13602] __copy_msghdr+0x244/0x300 [ 221.242014][T13602] ___sys_sendmsg+0x109/0x1d0 [ 221.242059][T13602] __sys_sendmmsg+0x178/0x300 [ 221.242088][T13602] __x64_sys_sendmmsg+0x57/0x70 [ 221.242138][T13602] x64_sys_call+0x1c4a/0x3000 [ 221.242217][T13602] do_syscall_64+0xd2/0x200 [ 221.242332][T13602] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 221.242399][T13602] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 221.242432][T13602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.242514][T13602] RIP: 0033:0x7f522cc1efc9 [ 221.242528][T13602] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 221.242544][T13602] RSP: 002b:00007f522b687038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 221.242691][T13602] RAX: ffffffffffffffda RBX: 00007f522ce75fa0 RCX: 00007f522cc1efc9 [ 221.242703][T13602] RDX: 0000000000000002 RSI: 0000200000000880 RDI: 0000000000000003 [ 221.242713][T13602] RBP: 00007f522b687090 R08: 0000000000000000 R09: 0000000000000000 [ 221.242725][T13602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 221.242755][T13602] R13: 00007f522ce76038 R14: 00007f522ce75fa0 R15: 00007ffefc049c38 [ 221.242774][T13602] [ 221.465954][T13597] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 221.553116][T13616] netlink: 'syz.3.3480': attribute type 10 has an invalid length. [ 221.569263][T13616] bond0: (slave dummy0): Releasing backup interface [ 221.590466][T13616] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 221.609037][T13616] team0: Failed to send options change via netlink (err -105) [ 221.617467][T13616] team0: Port device dummy0 added [ 221.622861][T13618] netlink: 'syz.3.3480': attribute type 10 has an invalid length. [ 221.641710][T13618] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 221.666483][T13618] team0: Failed to send options change via netlink (err -105) [ 221.684223][T13618] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 221.709120][T13618] team0: Port device dummy0 removed [ 221.746661][T13618] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 221.850627][T13627] loop2: detected capacity change from 0 to 512 [ 221.866132][T13627] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 221.874197][T13627] EXT4-fs (loop2): orphan cleanup on readonly fs [ 221.881072][T13627] EXT4-fs warning (device loop2): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 221.896631][T13627] EXT4-fs (loop2): Cannot turn on quotas: error -117 [ 221.903977][T13627] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.3482: bg 0: block 40: padding at end of block bitmap is not set [ 221.931520][T13628] ip6_vti0 speed is unknown, defaulting to 1000 [ 221.990775][T13628] lo speed is unknown, defaulting to 1000 [ 221.996924][T13628] lo speed is unknown, defaulting to 1000 [ 222.052117][T13627] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 222.074053][T13627] EXT4-fs (loop2): 1 truncate cleaned up [ 222.080685][T13627] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 222.234116][T13634] ip6_vti0 speed is unknown, defaulting to 1000 [ 222.282390][T13637] FAULT_INJECTION: forcing a failure. [ 222.282390][T13637] name failslab, interval 1, probability 0, space 0, times 0 [ 222.295794][T13637] CPU: 0 UID: 0 PID: 13637 Comm: syz.1.3485 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 222.295826][T13637] Tainted: [W]=WARN [ 222.295832][T13637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 222.295872][T13637] Call Trace: [ 222.295878][T13637] [ 222.295887][T13637] __dump_stack+0x1d/0x30 [ 222.295926][T13637] dump_stack_lvl+0xe8/0x140 [ 222.295944][T13637] dump_stack+0x15/0x1b [ 222.296046][T13637] should_fail_ex+0x265/0x280 [ 222.296131][T13637] should_failslab+0x8c/0xb0 [ 222.296198][T13637] __kmalloc_noprof+0xa5/0x570 [ 222.296234][T13637] ? __crypto_alloc_tfmgfp+0xb6/0x220 [ 222.296341][T13637] __crypto_alloc_tfmgfp+0xb6/0x220 [ 222.296375][T13637] __crypto_alloc_tfm+0x25/0x30 [ 222.296455][T13637] crypto_spawn_tfm+0x62/0xb0 [ 222.296476][T13637] ? __pfx_lskcipher_init_tfm_simple2+0x10/0x10 [ 222.296504][T13637] lskcipher_init_tfm_simple2+0x30/0x70 [ 222.296533][T13637] ? __pfx_lskcipher_init_tfm_simple2+0x10/0x10 [ 222.296643][T13637] crypto_lskcipher_init_tfm+0x6c/0x80 [ 222.296697][T13637] crypto_create_tfm_node+0x108/0x250 [ 222.296733][T13637] crypto_spawn_tfm2+0x43/0x80 [ 222.296758][T13637] ? __pfx_lskcipher_init_tfm_simple+0x10/0x10 [ 222.296835][T13637] lskcipher_init_tfm_simple+0x26/0x60 [ 222.296866][T13637] ? __pfx_lskcipher_init_tfm_simple+0x10/0x10 [ 222.296972][T13637] crypto_lskcipher_init_tfm+0x6c/0x80 [ 222.297004][T13637] crypto_create_tfm_node+0x108/0x250 [ 222.297039][T13637] crypto_init_lskcipher_ops_sg+0x3f/0xa0 [ 222.297071][T13637] crypto_skcipher_init_tfm+0xb6/0x140 [ 222.297156][T13637] crypto_create_tfm_node+0x108/0x250 [ 222.297356][T13637] crypto_alloc_tfm_node+0xdc/0x2b0 [ 222.297445][T13637] ? __kmalloc_node_track_caller_noprof+0x399/0x580 [ 222.297483][T13637] crypto_alloc_sync_skcipher+0x39/0xa0 [ 222.297531][T13637] set_secret+0xec/0x250 [ 222.297566][T13637] ceph_crypto_key_decode+0x104/0x170 [ 222.297599][T13637] ceph_key_preparse+0xbb/0x140 [ 222.297628][T13637] __key_create_or_update+0x28b/0x750 [ 222.297674][T13637] ? key_validate+0xad/0xd0 [ 222.297702][T13637] key_create_or_update+0x42/0x60 [ 222.297802][T13637] __se_sys_add_key+0x29b/0x350 [ 222.297836][T13637] __x64_sys_add_key+0x67/0x80 [ 222.297869][T13637] x64_sys_call+0x28c8/0x3000 [ 222.297974][T13637] do_syscall_64+0xd2/0x200 [ 222.297995][T13637] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 222.298026][T13637] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 222.298058][T13637] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.298146][T13637] RIP: 0033:0x7fa4f532efc9 [ 222.298165][T13637] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 222.298184][T13637] RSP: 002b:00007fa4f3d8f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 222.298247][T13637] RAX: ffffffffffffffda RBX: 00007fa4f5585fa0 RCX: 00007fa4f532efc9 [ 222.298258][T13637] RDX: 00002000000009c0 RSI: 0000000000000000 RDI: 0000200000000040 [ 222.298270][T13637] RBP: 00007fa4f3d8f090 R08: 000000001ab31d73 R09: 0000000000000000 [ 222.298283][T13637] R10: 000000000000002b R11: 0000000000000246 R12: 0000000000000001 [ 222.298297][T13637] R13: 00007fa4f5586038 R14: 00007fa4f5585fa0 R15: 00007fffb2aa2f48 [ 222.298318][T13637] [ 222.735781][T13634] lo speed is unknown, defaulting to 1000 [ 222.752025][T13634] lo speed is unknown, defaulting to 1000 [ 222.945741][T10962] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 222.979520][T13641] SELinux: Context system_u:object is not valid (left unmapped). [ 223.006222][T13641] __nla_validate_parse: 10 callbacks suppressed [ 223.006238][T13641] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3487'. [ 223.083544][ T9486] hid_parser_main: 22 callbacks suppressed [ 223.083564][ T9486] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x4 [ 223.095497][ T29] kauditd_printk_skb: 256 callbacks suppressed [ 223.095515][ T29] audit: type=1400 audit(2000000084.990:22608): avc: denied { read write } for pid=13643 comm="syz.1.3489" name="uhid" dev="devtmpfs" ino=252 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 223.097895][ T9486] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x2 [ 223.103227][ T29] audit: type=1400 audit(2000000084.990:22609): avc: denied { open } for pid=13643 comm="syz.1.3489" path="/dev/uhid" dev="devtmpfs" ino=252 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 223.155393][ T9486] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 223.166505][ T9486] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 223.174142][ T9486] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 223.181808][ T9486] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 223.190126][ T9486] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 223.197973][ T9486] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 223.206084][ T9486] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 223.213719][ T9486] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 223.279984][T13646] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 223.295263][ T9486] hid-generic 0000:3000000:0000.0004: hidraw0: HID v0.00 Device [sy] on syz0 [ 223.435359][ T29] audit: type=1400 audit(2000000085.350:22610): avc: denied { setopt } for pid=13648 comm="syz.0.3491" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 223.474994][ T29] audit: type=1400 audit(2000000085.390:22611): avc: denied { read } for pid=13657 comm="syz.1.3495" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 223.536512][T13659] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3494'. [ 223.647229][ T29] audit: type=1326 audit(2000000085.560:22612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13666 comm="syz.0.3497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f522cc1efc9 code=0x7ffc0000 [ 223.657233][T13660] FAULT_INJECTION: forcing a failure. [ 223.657233][T13660] name failslab, interval 1, probability 0, space 0, times 0 [ 223.684583][T13660] CPU: 0 UID: 0 PID: 13660 Comm: syz.1.3495 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 223.684681][T13660] Tainted: [W]=WARN [ 223.684687][T13660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 223.684697][T13660] Call Trace: [ 223.684702][T13660] [ 223.684709][T13660] __dump_stack+0x1d/0x30 [ 223.684732][T13660] dump_stack_lvl+0xe8/0x140 [ 223.684796][T13660] dump_stack+0x15/0x1b [ 223.684813][T13660] should_fail_ex+0x265/0x280 [ 223.684874][T13660] ? assoc_array_insert+0x75/0x1990 [ 223.684898][T13660] should_failslab+0x8c/0xb0 [ 223.684927][T13660] __kmalloc_cache_noprof+0x4c/0x4a0 [ 223.685012][T13660] ? key_put+0x89/0x170 [ 223.685032][T13660] assoc_array_insert+0x75/0x1990 [ 223.685055][T13660] ? __pfx_key_default_cmp+0x10/0x10 [ 223.685138][T13660] ? __pfx_keyring_search_iterator+0x10/0x10 [ 223.685173][T13660] __key_link_begin+0x8a/0x140 [ 223.685267][T13660] request_key_and_link+0x51f/0xd70 [ 223.685290][T13660] ? __pfx_key_default_cmp+0x10/0x10 [ 223.685317][T13660] ? __pfx_keyring_search_iterator+0x10/0x10 [ 223.685365][T13660] __se_sys_request_key+0x1df/0x290 [ 223.685539][T13660] ? fput+0x8f/0xc0 [ 223.685560][T13660] __x64_sys_request_key+0x55/0x70 [ 223.685652][T13660] x64_sys_call+0x1d98/0x3000 [ 223.685673][T13660] do_syscall_64+0xd2/0x200 [ 223.685690][T13660] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 223.685790][T13660] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 223.685820][T13660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.685849][T13660] RIP: 0033:0x7fa4f532efc9 [ 223.685865][T13660] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 223.685939][T13660] RSP: 002b:00007fa4f3d8f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 223.685960][T13660] RAX: ffffffffffffffda RBX: 00007fa4f5585fa0 RCX: 00007fa4f532efc9 [ 223.685973][T13660] RDX: 0000200000000580 RSI: 0000200000000540 RDI: 0000200000000400 [ 223.685986][T13660] RBP: 00007fa4f3d8f090 R08: 0000000000000000 R09: 0000000000000000 [ 223.685999][T13660] R10: fffffffffffffffc R11: 0000000000000246 R12: 0000000000000001 [ 223.686066][T13660] R13: 00007fa4f5586038 R14: 00007fa4f5585fa0 R15: 00007fffb2aa2f48 [ 223.686085][T13660] [ 223.714109][ T29] audit: type=1326 audit(2000000085.560:22613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13666 comm="syz.0.3497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f522cc1efc9 code=0x7ffc0000 [ 223.978959][ T29] audit: type=1326 audit(2000000085.630:22614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13666 comm="syz.0.3497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=306 compat=0 ip=0x7f522cc1efc9 code=0x7ffc0000 [ 224.003225][ T29] audit: type=1326 audit(2000000085.630:22615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13666 comm="syz.0.3497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f522cc1efc9 code=0x7ffc0000 [ 224.027433][ T29] audit: type=1326 audit(2000000085.630:22616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13666 comm="syz.0.3497" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f522cc1efc9 code=0x7ffc0000 [ 224.062371][T13677] loop0: detected capacity change from 0 to 512 [ 224.088203][T13677] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 224.096880][T13677] EXT4-fs (loop0): orphan cleanup on readonly fs [ 224.112407][T13677] Quota error (device loop0): v2_read_file_info: Block with free entry 1 out of range (1, 6). [ 224.123039][T13677] EXT4-fs warning (device loop0): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 224.143762][T13681] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 224.154655][T13677] EXT4-fs (loop0): Cannot turn on quotas: error -117 [ 224.161836][T13677] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.3498: bg 0: block 40: padding at end of block bitmap is not set [ 224.186201][T13677] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 224.214267][T13681] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 224.214267][T13681] program syz.1.3503 not setting count and/or reply_len properly [ 224.258327][T13685] ip6gre1: entered allmulticast mode [ 224.303542][T13677] EXT4-fs (loop0): 1 truncate cleaned up [ 224.325117][T13677] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 224.417873][T13691] netlink: 'syz.2.3507': attribute type 5 has an invalid length. [ 224.631807][T13702] loop3: detected capacity change from 0 to 2048 [ 224.690347][T13696] ip6_vti0 speed is unknown, defaulting to 1000 [ 224.697417][T13702] EXT4-fs error (device loop3): ext4_ext_check_inode:523: inode #2: comm syz.3.3511: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 224.776223][T13704] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 224.794473][T13702] EXT4-fs (loop3): Remounting filesystem read-only [ 224.805971][T11382] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.808427][T13702] EXT4-fs (loop3): get root inode failed [ 224.820662][T13702] EXT4-fs (loop3): mount failed [ 224.835221][T13696] lo speed is unknown, defaulting to 1000 [ 224.841575][T13696] lo speed is unknown, defaulting to 1000 [ 224.852353][T13710] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 224.935915][T13711] loop3: detected capacity change from 0 to 1024 [ 225.032421][T13714] loop1: detected capacity change from 0 to 128 [ 225.043992][T13711] ext4: Bad value for 'max_dir_size_kb' [ 225.134571][T13714] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 225.148026][T13714] ext4 filesystem being mounted at /59/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 225.159553][T13714] EXT4-fs warning (device loop1): ext4_dirblock_csum_verify:375: inode #2: comm syz.1.3514: No space for directory leaf checksum. Please run e2fsck -D. [ 225.175473][T13714] EXT4-fs error (device loop1): htree_dirblock_to_tree:1051: inode #2: comm syz.1.3514: Directory block failed checksum [ 225.203165][T12736] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 225.424872][T13732] xt_CT: You must specify a L4 protocol and not use inversions on it [ 225.437921][T13730] netlink: 'syz.1.3519': attribute type 10 has an invalid length. [ 225.462620][T13730] bond0: (slave dummy0): Releasing backup interface [ 225.497817][T13730] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 225.525554][T13734] netlink: 'syz.1.3519': attribute type 10 has an invalid length. [ 225.537729][T13730] team0: Failed to send options change via netlink (err -105) [ 225.545985][T13730] team0: Port device dummy0 added [ 225.627196][T13740] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 225.642846][T13734] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 225.710098][T13732] loop4: detected capacity change from 0 to 1024 [ 225.717099][T13734] team0: Failed to send options change via netlink (err -105) [ 225.729536][T13734] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 225.768171][T13734] team0: Port device dummy0 removed [ 225.775739][T13732] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 225.801061][T13734] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 225.817250][T13732] can: request_module (can-proto-0) failed. [ 225.876862][T13743] ip6_vti0 speed is unknown, defaulting to 1000 [ 225.944370][T13743] lo speed is unknown, defaulting to 1000 [ 225.954233][T13743] lo speed is unknown, defaulting to 1000 [ 225.967032][T13761] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 226.026789][T13763] loop1: detected capacity change from 0 to 128 [ 226.056232][T13763] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 226.069061][T13763] ext4 filesystem being mounted at /66/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 226.080081][T13763] EXT4-fs warning (device loop1): ext4_dirblock_csum_verify:375: inode #2: comm syz.1.3526: No space for directory leaf checksum. Please run e2fsck -D. [ 226.096027][T13763] EXT4-fs error (device loop1): htree_dirblock_to_tree:1051: inode #2: comm syz.1.3526: Directory block failed checksum [ 226.120729][T13766] loop0: detected capacity change from 0 to 512 [ 226.169219][T13766] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 226.184491][T12736] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 226.222326][T13766] ext4 filesystem being mounted at /146/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 226.337133][T13766] EXT4-fs error (device loop0): ext4_get_first_dir_block:3537: inode #12: block 32: comm syz.0.3527: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 226.344066][T13774] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 226.378158][T13766] EXT4-fs error (device loop0): ext4_get_first_dir_block:3540: inode #12: comm syz.0.3527: directory missing '.' [ 226.435095][T13772] loop2: detected capacity change from 0 to 256 [ 226.441750][T12917] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 226.469384][T13746] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3522'. [ 226.496507][T13772] FAT-fs (loop2): Directory bread(block 64) failed [ 226.502744][T13746] ip6_vti0 speed is unknown, defaulting to 1000 [ 226.504718][T13772] FAT-fs (loop2): Directory bread(block 65) failed [ 226.525489][T13772] FAT-fs (loop2): Directory bread(block 66) failed [ 226.526888][T11382] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 226.532023][T13772] FAT-fs (loop2): Directory bread(block 67) failed [ 226.532059][T13772] FAT-fs (loop2): Directory bread(block 68) failed [ 226.532076][T13772] FAT-fs (loop2): Directory bread(block 69) failed [ 226.532152][T13772] FAT-fs (loop2): Directory bread(block 70) failed [ 226.532167][T13772] FAT-fs (loop2): Directory bread(block 71) failed [ 226.532266][T13772] FAT-fs (loop2): Directory bread(block 72) failed [ 226.588849][T13779] loop4: detected capacity change from 0 to 128 [ 226.635624][T13772] FAT-fs (loop2): Directory bread(block 73) failed [ 226.637840][T13746] lo speed is unknown, defaulting to 1000 [ 226.649950][T13746] lo speed is unknown, defaulting to 1000 [ 226.669091][T13779] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 226.678361][T13779] FAT-fs (loop4): Filesystem has been set read-only [ 226.728612][T13779] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 226.760884][T13779] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 226.813126][T13786] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3534'. [ 226.823593][T13786] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3534'. [ 226.871550][T13793] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 226.961126][T13799] loop2: detected capacity change from 0 to 128 [ 226.996035][T13799] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 227.003896][T13799] FAT-fs (loop2): Filesystem has been set read-only [ 227.022579][T13799] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 227.049955][T13799] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 227.122734][T13797] ip6_vti0 speed is unknown, defaulting to 1000 [ 227.147895][T13803] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 227.208939][T13809] loop2: detected capacity change from 0 to 512 [ 227.211421][T13797] lo speed is unknown, defaulting to 1000 [ 227.222126][T13809] EXT4-fs: Ignoring removed i_version option [ 227.222914][T13797] lo speed is unknown, defaulting to 1000 [ 227.228193][T13809] EXT4-fs: Ignoring removed bh option [ 227.229005][T13809] ext2: Unknown parameter 'euid' [ 227.372670][T13822] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 227.380530][T13822] loop2: detected capacity change from 0 to 256 [ 227.399477][T13822] FAT-fs (loop2): Directory bread(block 64) failed [ 227.406275][T13822] FAT-fs (loop2): Directory bread(block 65) failed [ 227.413033][T13822] FAT-fs (loop2): Directory bread(block 66) failed [ 227.420188][T13822] FAT-fs (loop2): Directory bread(block 67) failed [ 227.426745][T13822] FAT-fs (loop2): Directory bread(block 68) failed [ 227.433279][T13822] FAT-fs (loop2): Directory bread(block 69) failed [ 227.440060][T13822] FAT-fs (loop2): Directory bread(block 70) failed [ 227.443924][T13814] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3542'. [ 227.447445][T13822] FAT-fs (loop2): Directory bread(block 71) failed [ 227.475529][T13824] netlink: 'syz.1.3544': attribute type 4 has an invalid length. [ 227.486947][T13814] ip6_vti0 speed is unknown, defaulting to 1000 [ 227.494896][T13822] FAT-fs (loop2): Directory bread(block 72) failed [ 227.502183][T13822] FAT-fs (loop2): Directory bread(block 73) failed [ 227.587486][T13827] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3546'. [ 227.622368][T13814] lo speed is unknown, defaulting to 1000 [ 227.635493][T13814] lo speed is unknown, defaulting to 1000 [ 227.681787][T13833] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 227.688535][T13833] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 227.696695][T13833] vhci_hcd vhci_hcd.0: Device attached [ 227.706219][T13833] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(5) [ 227.712765][T13833] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 227.720387][T13833] vhci_hcd vhci_hcd.0: Device attached [ 227.736298][T13840] loop2: detected capacity change from 0 to 512 [ 227.747253][T13836] vhci_hcd: connection closed [ 227.756301][T13834] vhci_hcd: connection closed [ 227.761307][ T9589] vhci_hcd: stop threads [ 227.770858][ T9589] vhci_hcd: release socket [ 227.775430][ T9589] vhci_hcd: disconnect device [ 227.791918][T13844] loop4: detected capacity change from 0 to 128 [ 227.801292][T13840] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 227.809421][T13840] EXT4-fs (loop2): orphan cleanup on readonly fs [ 227.816143][T13840] EXT4-fs warning (device loop2): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 227.831369][T13840] EXT4-fs (loop2): Cannot turn on quotas: error -117 [ 227.837138][T13844] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 227.839250][ T9589] vhci_hcd: stop threads [ 227.845968][T13844] FAT-fs (loop4): Filesystem has been set read-only [ 227.857287][ T9589] vhci_hcd: release socket [ 227.861695][ T9589] vhci_hcd: disconnect device [ 227.866873][T13840] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.3548: bg 0: block 40: padding at end of block bitmap is not set [ 227.882157][T13840] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 227.891182][T13840] EXT4-fs (loop2): 1 truncate cleaned up [ 227.897258][T13840] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 227.907042][T13850] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 227.917253][T13849] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 227.918619][T13849] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 227.918619][T13849] program syz.0.3551 not setting count and/or reply_len properly [ 227.958952][T13844] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 228.033886][T13852] loop3: detected capacity change from 0 to 256 [ 228.135524][T13858] loop4: detected capacity change from 0 to 512 [ 228.142080][T13858] EXT4-fs: Ignoring removed i_version option [ 228.148747][T13858] EXT4-fs: Ignoring removed bh option [ 228.154265][T13858] ext2: Unknown parameter 'euid' [ 228.192929][ T29] kauditd_printk_skb: 78 callbacks suppressed [ 228.192944][ T29] audit: type=1326 audit(2000000090.100:22694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13861 comm="syz.1.3556" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 228.229630][ T29] audit: type=1326 audit(2000000090.110:22695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13861 comm="syz.1.3556" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 228.254066][ T29] audit: type=1326 audit(2000000090.110:22696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13861 comm="syz.1.3556" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 228.285970][ T29] audit: type=1326 audit(2000000090.200:22697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13861 comm="syz.1.3556" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 228.310618][ T29] audit: type=1326 audit(2000000090.200:22698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13861 comm="syz.1.3556" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 228.310776][T13865] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3557'. [ 228.334400][ T29] audit: type=1326 audit(2000000090.200:22699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13861 comm="syz.1.3556" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 228.334452][ T29] audit: type=1326 audit(2000000090.200:22700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13861 comm="syz.1.3556" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 228.334480][ T29] audit: type=1326 audit(2000000090.200:22701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13861 comm="syz.1.3556" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 228.334531][ T29] audit: type=1326 audit(2000000090.200:22702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13861 comm="syz.1.3556" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 228.334558][ T29] audit: type=1326 audit(2000000090.200:22703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13861 comm="syz.1.3556" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 228.530289][T10962] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 228.739398][T13883] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 228.809680][T13889] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3566'. [ 228.822644][T13877] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3562'. [ 228.848545][T13877] ip6_vti0 speed is unknown, defaulting to 1000 [ 228.928450][T13877] lo speed is unknown, defaulting to 1000 [ 228.934613][T13877] lo speed is unknown, defaulting to 1000 [ 228.965615][T13898] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3569'. [ 229.145317][T13907] FAULT_INJECTION: forcing a failure. [ 229.145317][T13907] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 229.159224][T13907] CPU: 1 UID: 0 PID: 13907 Comm: syz.0.3571 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 229.159260][T13907] Tainted: [W]=WARN [ 229.159266][T13907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 229.159279][T13907] Call Trace: [ 229.159287][T13907] [ 229.159295][T13907] __dump_stack+0x1d/0x30 [ 229.159317][T13907] dump_stack_lvl+0xe8/0x140 [ 229.159374][T13907] dump_stack+0x15/0x1b [ 229.159390][T13907] should_fail_ex+0x265/0x280 [ 229.159408][T13907] should_fail+0xb/0x20 [ 229.159441][T13907] should_fail_usercopy+0x1a/0x20 [ 229.159462][T13907] _copy_to_user+0x20/0xa0 [ 229.159529][T13907] simple_read_from_buffer+0xb5/0x130 [ 229.159553][T13907] proc_fail_nth_read+0x10e/0x150 [ 229.159582][T13907] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 229.159612][T13907] vfs_read+0x1a8/0x770 [ 229.159668][T13907] ? __rcu_read_unlock+0x4f/0x70 [ 229.159694][T13907] ? __fget_files+0x184/0x1c0 [ 229.159723][T13907] ksys_read+0xda/0x1a0 [ 229.159769][T13907] __x64_sys_read+0x40/0x50 [ 229.159821][T13907] x64_sys_call+0x27c0/0x3000 [ 229.159842][T13907] do_syscall_64+0xd2/0x200 [ 229.159910][T13907] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 229.159939][T13907] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 229.159969][T13907] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 229.160060][T13907] RIP: 0033:0x7f522cc1d9dc [ 229.160077][T13907] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 229.160093][T13907] RSP: 002b:00007f522b687030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 229.160110][T13907] RAX: ffffffffffffffda RBX: 00007f522ce75fa0 RCX: 00007f522cc1d9dc [ 229.160121][T13907] RDX: 000000000000000f RSI: 00007f522b6870a0 RDI: 0000000000000005 [ 229.160131][T13907] RBP: 00007f522b687090 R08: 0000000000000000 R09: 0000000000000000 [ 229.160174][T13907] R10: 0000000000010001 R11: 0000000000000246 R12: 0000000000000001 [ 229.160187][T13907] R13: 00007f522ce76038 R14: 00007f522ce75fa0 R15: 00007ffefc049c38 [ 229.160206][T13907] [ 229.630020][T13918] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 229.641909][T13918] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 229.641909][T13918] program syz.1.3576 not setting count and/or reply_len properly [ 229.726217][T13924] FAULT_INJECTION: forcing a failure. [ 229.726217][T13924] name failslab, interval 1, probability 0, space 0, times 0 [ 229.738969][T13924] CPU: 0 UID: 0 PID: 13924 Comm: syz.3.3579 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 229.739127][T13924] Tainted: [W]=WARN [ 229.739134][T13924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 229.739146][T13924] Call Trace: [ 229.739153][T13924] [ 229.739162][T13924] __dump_stack+0x1d/0x30 [ 229.739186][T13924] dump_stack_lvl+0xe8/0x140 [ 229.739277][T13924] dump_stack+0x15/0x1b [ 229.739297][T13924] should_fail_ex+0x265/0x280 [ 229.739318][T13924] should_failslab+0x8c/0xb0 [ 229.739346][T13924] __kvmalloc_node_noprof+0x12e/0x670 [ 229.739406][T13924] ? alloc_netdev_mqs+0x6f1/0xa50 [ 229.739488][T13924] alloc_netdev_mqs+0x6f1/0xa50 [ 229.739580][T13924] tun_set_iff+0x42c/0x8a0 [ 229.739657][T13924] __tun_chr_ioctl+0x5f0/0x14c0 [ 229.739738][T13924] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 229.739815][T13924] tun_chr_ioctl+0x27/0x40 [ 229.739844][T13924] __se_sys_ioctl+0xce/0x140 [ 229.739868][T13924] __x64_sys_ioctl+0x43/0x50 [ 229.739886][T13924] x64_sys_call+0x1816/0x3000 [ 229.739972][T13924] do_syscall_64+0xd2/0x200 [ 229.739992][T13924] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 229.740018][T13924] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 229.740085][T13924] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 229.740108][T13924] RIP: 0033:0x7f3a7470efc9 [ 229.740124][T13924] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 229.740145][T13924] RSP: 002b:00007f3a73177038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 229.740162][T13924] RAX: ffffffffffffffda RBX: 00007f3a74965fa0 RCX: 00007f3a7470efc9 [ 229.740249][T13924] RDX: 0000200000000100 RSI: 00000000400454ca RDI: 0000000000000006 [ 229.740262][T13924] RBP: 00007f3a73177090 R08: 0000000000000000 R09: 0000000000000000 [ 229.740275][T13924] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 229.740289][T13924] R13: 00007f3a74966038 R14: 00007f3a74965fa0 R15: 00007fff377d9bc8 [ 229.740309][T13924] [ 229.964422][T13928] loop0: detected capacity change from 0 to 128 [ 229.992538][T13928] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 230.016224][T13928] ext4 filesystem being mounted at /159/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 230.028079][T13928] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:375: inode #2: comm syz.0.3582: No space for directory leaf checksum. Please run e2fsck -D. [ 230.043642][T13928] EXT4-fs error (device loop0): htree_dirblock_to_tree:1051: inode #2: comm syz.0.3582: Directory block failed checksum [ 230.084483][T11382] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 230.241879][T13949] FAULT_INJECTION: forcing a failure. [ 230.241879][T13949] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.255129][T13949] CPU: 0 UID: 0 PID: 13949 Comm: syz.4.3590 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 230.255243][T13949] Tainted: [W]=WARN [ 230.255250][T13949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 230.255263][T13949] Call Trace: [ 230.255271][T13949] [ 230.255279][T13949] __dump_stack+0x1d/0x30 [ 230.255302][T13949] dump_stack_lvl+0xe8/0x140 [ 230.255356][T13949] dump_stack+0x15/0x1b [ 230.255373][T13949] should_fail_ex+0x265/0x280 [ 230.255391][T13949] should_fail+0xb/0x20 [ 230.255405][T13949] should_fail_usercopy+0x1a/0x20 [ 230.255436][T13949] _copy_from_user+0x1c/0xb0 [ 230.255459][T13949] __ia32_sys_rt_sigreturn+0x128/0x350 [ 230.255557][T13949] x64_sys_call+0x2d4b/0x3000 [ 230.255582][T13949] do_syscall_64+0xd2/0x200 [ 230.255604][T13949] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 230.255669][T13949] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 230.255702][T13949] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.255781][T13949] RIP: 0033:0x7fcc8dffb099 [ 230.255794][T13949] Code: 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 04 25 [ 230.255874][T13949] RSP: 002b:00007fcc8cac6a80 EFLAGS: 00000202 ORIG_RAX: 000000000000000f [ 230.255895][T13949] RAX: ffffffffffffffda RBX: 00007fcc8e2b5fa0 RCX: 00007fcc8dffb099 [ 230.255908][T13949] RDX: 00007fcc8cac6a80 RSI: 00007fcc8cac6bb0 RDI: 0000000000000021 [ 230.255924][T13949] RBP: 00007fcc8cac7090 R08: 0000000000000000 R09: 0000000000000000 [ 230.255935][T13949] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 [ 230.255946][T13949] R13: 00007fcc8e2b6038 R14: 00007fcc8e2b5fa0 R15: 00007ffecf569948 [ 230.255965][T13949] [ 230.336418][T13941] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3586'. [ 230.532249][T13961] ip6_vti0 speed is unknown, defaulting to 1000 [ 230.642670][T13970] loop1: detected capacity change from 0 to 128 [ 230.651626][T13970] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 230.663893][T13970] ext4 filesystem being mounted at /75/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 230.677623][T13970] EXT4-fs warning (device loop1): ext4_dirblock_csum_verify:375: inode #2: comm syz.1.3596: No space for directory leaf checksum. Please run e2fsck -D. [ 230.693120][T13970] EXT4-fs error (device loop1): htree_dirblock_to_tree:1051: inode #2: comm syz.1.3596: Directory block failed checksum [ 230.706514][T13972] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 230.706514][T13972] The task syz.2.3595 (13972) triggered the difference, watch for misbehavior. [ 230.758251][T12736] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 230.788744][T13961] lo speed is unknown, defaulting to 1000 [ 230.810169][T13961] lo speed is unknown, defaulting to 1000 [ 230.854939][T13956] infiniband !yz!: set active [ 230.859724][T13956] infiniband !yz!: added team_slave_0 [ 230.875958][T13974] loop1: detected capacity change from 0 to 256 [ 230.891905][T13974] FAULT_INJECTION: forcing a failure. [ 230.891905][T13974] name failslab, interval 1, probability 0, space 0, times 0 [ 230.905380][T13974] CPU: 1 UID: 0 PID: 13974 Comm: syz.1.3597 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 230.905438][T13974] Tainted: [W]=WARN [ 230.905445][T13974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 230.905459][T13974] Call Trace: [ 230.905466][T13974] [ 230.905475][T13974] __dump_stack+0x1d/0x30 [ 230.905498][T13974] dump_stack_lvl+0xe8/0x140 [ 230.905516][T13974] dump_stack+0x15/0x1b [ 230.905532][T13974] should_fail_ex+0x265/0x280 [ 230.905586][T13974] should_failslab+0x8c/0xb0 [ 230.905612][T13974] kmem_cache_alloc_noprof+0x50/0x480 [ 230.905644][T13974] ? security_file_alloc+0x32/0x100 [ 230.905672][T13974] security_file_alloc+0x32/0x100 [ 230.905717][T13974] init_file+0x5c/0x1d0 [ 230.905734][T13974] alloc_empty_file+0x8b/0x200 [ 230.905766][T13974] alloc_file_pseudo+0xc6/0x160 [ 230.905785][T13974] __shmem_file_setup+0x1de/0x210 [ 230.905886][T13974] shmem_file_setup+0x3b/0x50 [ 230.905902][T13974] __se_sys_memfd_create+0x2c3/0x590 [ 230.905975][T13974] __x64_sys_memfd_create+0x31/0x40 [ 230.905999][T13974] x64_sys_call+0x2ac2/0x3000 [ 230.906032][T13974] do_syscall_64+0xd2/0x200 [ 230.906048][T13974] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 230.906102][T13974] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 230.906129][T13974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.906179][T13974] RIP: 0033:0x7fa4f532efc9 [ 230.906195][T13974] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 230.906213][T13974] RSP: 002b:00007fa4f3d8ee18 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 230.906232][T13974] RAX: ffffffffffffffda RBX: 0000000000000617 RCX: 00007fa4f532efc9 [ 230.906249][T13974] RDX: 00007fa4f3d8eef0 RSI: 0000000000000000 RDI: 00007fa4f53b2960 [ 230.906261][T13974] RBP: 0000200000001080 R08: 00007fa4f3d8ebb7 R09: 00007fa4f3d8ee40 [ 230.906274][T13974] R10: 000000000000000a R11: 0000000000000202 R12: 0000200000000040 [ 230.906287][T13974] R13: 00007fa4f3d8eef0 R14: 00007fa4f3d8eeb0 R15: 0000200000000540 [ 230.906305][T13974] [ 230.941292][T13956] RDS/IB: !yz!: added [ 231.164302][T13956] smc: adding ib device !yz! with port count 1 [ 231.173233][T13982] loop1: detected capacity change from 0 to 512 [ 231.191034][T13956] smc: ib device !yz! port 1 has no pnetid [ 231.191987][T13982] EXT4-fs: Ignoring removed i_version option [ 231.203532][T13982] EXT4-fs: Ignoring removed bh option [ 231.221873][T13982] ext2: Unknown parameter 'euid' [ 231.241760][T13984] loop3: detected capacity change from 0 to 512 [ 231.249181][T13984] EXT4-fs: Ignoring removed orlov option [ 231.255558][T13984] EXT4-fs: Mount option(s) incompatible with ext2 [ 231.268209][T13984] loop3: detected capacity change from 0 to 512 [ 231.298959][T13990] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 231.351280][T13992] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 231.351280][T13992] program syz.3.3604 not setting count and/or reply_len properly [ 231.559867][T14002] loop0: detected capacity change from 0 to 256 [ 231.588997][T14001] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 231.595733][T14002] FAT-fs (loop0): Directory bread(block 64) failed [ 231.610382][T14002] FAT-fs (loop0): Directory bread(block 65) failed [ 231.626038][T14002] FAT-fs (loop0): Directory bread(block 66) failed [ 231.639717][T14002] FAT-fs (loop0): Directory bread(block 67) failed [ 231.656564][T14002] FAT-fs (loop0): Directory bread(block 68) failed [ 231.686376][T14002] FAT-fs (loop0): Directory bread(block 69) failed [ 231.699282][T14002] FAT-fs (loop0): Directory bread(block 70) failed [ 231.711816][T14002] FAT-fs (loop0): Directory bread(block 71) failed [ 231.718655][T14002] FAT-fs (loop0): Directory bread(block 72) failed [ 231.725462][T14002] FAT-fs (loop0): Directory bread(block 73) failed [ 231.789847][T13988] ip6_vti0 speed is unknown, defaulting to 1000 [ 231.849219][T13988] lo speed is unknown, defaulting to 1000 [ 231.855761][T13988] lo speed is unknown, defaulting to 1000 [ 231.883909][T13998] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 231.973799][T14020] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3611'. [ 231.997794][T14022] loop1: detected capacity change from 0 to 512 [ 232.004443][T14022] EXT4-fs: Ignoring removed i_version option [ 232.010594][T14022] EXT4-fs: Ignoring removed bh option [ 232.023822][T14022] ext2: Unknown parameter 'euid' [ 232.163466][T14039] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 232.213979][T14041] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 232.223116][T14041] loop4: detected capacity change from 0 to 256 [ 232.258998][T14041] FAT-fs (loop4): Directory bread(block 64) failed [ 232.268115][T14041] FAT-fs (loop4): Directory bread(block 65) failed [ 232.284132][T14041] FAT-fs (loop4): Directory bread(block 66) failed [ 232.291499][T14041] FAT-fs (loop4): Directory bread(block 67) failed [ 232.300519][T14047] loop1: detected capacity change from 0 to 512 [ 232.317333][T14041] FAT-fs (loop4): Directory bread(block 68) failed [ 232.319280][T14047] EXT4-fs: Ignoring removed i_version option [ 232.329931][T14041] FAT-fs (loop4): Directory bread(block 69) failed [ 232.329973][T14041] FAT-fs (loop4): Directory bread(block 70) failed [ 232.329995][T14041] FAT-fs (loop4): Directory bread(block 71) failed [ 232.330032][T14041] FAT-fs (loop4): Directory bread(block 72) failed [ 232.330046][T14041] FAT-fs (loop4): Directory bread(block 73) failed [ 232.364060][T14047] EXT4-fs: Ignoring removed bh option [ 232.375178][T14047] ext2: Unknown parameter 'euid' [ 232.416426][T14050] FAULT_INJECTION: forcing a failure. [ 232.416426][T14050] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 232.429720][T14050] CPU: 0 UID: 0 PID: 14050 Comm: syz.1.3626 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 232.429750][T14050] Tainted: [W]=WARN [ 232.429756][T14050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 232.429844][T14050] Call Trace: [ 232.429852][T14050] [ 232.429860][T14050] __dump_stack+0x1d/0x30 [ 232.429932][T14050] dump_stack_lvl+0xe8/0x140 [ 232.429991][T14050] dump_stack+0x15/0x1b [ 232.430008][T14050] should_fail_ex+0x265/0x280 [ 232.430026][T14050] should_fail+0xb/0x20 [ 232.430041][T14050] should_fail_usercopy+0x1a/0x20 [ 232.430060][T14050] _copy_to_user+0x20/0xa0 [ 232.430131][T14050] simple_read_from_buffer+0xb5/0x130 [ 232.430155][T14050] proc_fail_nth_read+0x10e/0x150 [ 232.430186][T14050] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 232.430215][T14050] vfs_read+0x1a8/0x770 [ 232.430255][T14050] ? __rcu_read_unlock+0x4f/0x70 [ 232.430278][T14050] ? __fget_files+0x184/0x1c0 [ 232.430307][T14050] ksys_read+0xda/0x1a0 [ 232.430344][T14050] __x64_sys_read+0x40/0x50 [ 232.430386][T14050] x64_sys_call+0x27c0/0x3000 [ 232.430477][T14050] do_syscall_64+0xd2/0x200 [ 232.430555][T14050] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 232.430583][T14050] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 232.430610][T14050] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.430632][T14050] RIP: 0033:0x7fa4f532d9dc [ 232.430648][T14050] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 232.430668][T14050] RSP: 002b:00007fa4f3d8f030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 232.430688][T14050] RAX: ffffffffffffffda RBX: 00007fa4f5585fa0 RCX: 00007fa4f532d9dc [ 232.430701][T14050] RDX: 000000000000000f RSI: 00007fa4f3d8f0a0 RDI: 0000000000000007 [ 232.430711][T14050] RBP: 00007fa4f3d8f090 R08: 0000000000000000 R09: 0000000000000000 [ 232.430723][T14050] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 232.430736][T14050] R13: 00007fa4f5586038 R14: 00007fa4f5585fa0 R15: 00007fffb2aa2f48 [ 232.430752][T14050] [ 232.710009][T14060] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 232.727747][T14061] loop4: detected capacity change from 0 to 512 [ 232.767765][T14048] netlink: 19 bytes leftover after parsing attributes in process `syz.0.3616'. [ 232.777643][T14061] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 232.800499][T14061] ext4 filesystem being mounted at /61/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 232.830838][T14067] loop2: detected capacity change from 0 to 2048 [ 232.880557][T14067] syzkaller0: entered allmulticast mode [ 232.886295][T14067] syzkaller0: entered promiscuous mode [ 232.893513][T14067] syzkaller0 (unregistering): left allmulticast mode [ 232.900292][T14067] syzkaller0 (unregistering): left promiscuous mode [ 232.987026][T14070] loop0: detected capacity change from 0 to 2048 [ 233.006080][T14070] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 233.019368][T14070] ext4 filesystem being mounted at /167/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 233.038657][T14070] netlink: 'syz.0.3633': attribute type 1 has an invalid length. [ 233.059607][T14080] loop2: detected capacity change from 0 to 512 [ 233.066499][T14080] EXT4-fs: Ignoring removed i_version option [ 233.067212][T11382] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 233.072660][T14080] EXT4-fs: Ignoring removed bh option [ 233.088104][T14080] ext2: Unknown parameter 'euid' [ 233.111854][T14084] netlink: 'syz.3.3639': attribute type 10 has an invalid length. [ 233.123979][T14084] bond0: (slave dummy0): Releasing backup interface [ 233.134432][T14084] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 233.143446][T14084] team0: Failed to send options change via netlink (err -105) [ 233.151605][T14084] team0: Port device dummy0 added [ 233.159367][T14084] netlink: 'syz.3.3639': attribute type 10 has an invalid length. [ 233.167865][T14084] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 233.180094][T14084] team0: Failed to send options change via netlink (err -105) [ 233.187698][T14084] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 233.196877][T14084] team0: Port device dummy0 removed [ 233.204440][T14084] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 233.216427][ T29] kauditd_printk_skb: 395 callbacks suppressed [ 233.216459][ T29] audit: type=1400 audit(2000000095.130:23099): avc: denied { name_bind } for pid=14085 comm="syz.0.3640" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 233.263061][ T29] audit: type=1326 audit(2000000095.170:23100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14096 comm="syz.3.3643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 233.296460][T14097] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14097 comm=syz.3.3643 [ 233.316989][T14098] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3640'. [ 233.323281][ T29] audit: type=1326 audit(2000000095.170:23101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14096 comm="syz.3.3643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 233.350175][ T29] audit: type=1326 audit(2000000095.170:23102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14096 comm="syz.3.3643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 233.373866][ T29] audit: type=1326 audit(2000000095.170:23103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14096 comm="syz.3.3643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 233.397878][ T29] audit: type=1326 audit(2000000095.170:23104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14096 comm="syz.3.3643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 233.421484][ T29] audit: type=1326 audit(2000000095.170:23105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14096 comm="syz.3.3643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=235 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 233.445632][ T29] audit: type=1326 audit(2000000095.170:23106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14096 comm="syz.3.3643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 233.469225][ T29] audit: type=1326 audit(2000000095.170:23107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14096 comm="syz.3.3643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 233.493124][ T29] audit: type=1326 audit(2000000095.170:23108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14096 comm="syz.3.3643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 233.528281][T12917] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 233.579783][T14111] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3648'. [ 233.593915][T14113] FAULT_INJECTION: forcing a failure. [ 233.593915][T14113] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 233.607624][T14113] CPU: 1 UID: 0 PID: 14113 Comm: syz.4.3649 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 233.607646][T14113] Tainted: [W]=WARN [ 233.607650][T14113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 233.607657][T14113] Call Trace: [ 233.607661][T14113] [ 233.607665][T14113] __dump_stack+0x1d/0x30 [ 233.607680][T14113] dump_stack_lvl+0xe8/0x140 [ 233.607704][T14113] dump_stack+0x15/0x1b [ 233.607714][T14113] should_fail_ex+0x265/0x280 [ 233.607725][T14113] should_fail+0xb/0x20 [ 233.607734][T14113] should_fail_usercopy+0x1a/0x20 [ 233.607821][T14113] _copy_to_user+0x20/0xa0 [ 233.607835][T14113] simple_read_from_buffer+0xb5/0x130 [ 233.607850][T14113] proc_fail_nth_read+0x10e/0x150 [ 233.607869][T14113] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 233.607960][T14113] vfs_read+0x1a8/0x770 [ 233.607973][T14113] ? __rcu_read_unlock+0x4f/0x70 [ 233.607988][T14113] ? __fget_files+0x184/0x1c0 [ 233.608005][T14113] ksys_read+0xda/0x1a0 [ 233.608060][T14113] __x64_sys_read+0x40/0x50 [ 233.608084][T14113] x64_sys_call+0x27c0/0x3000 [ 233.608107][T14113] do_syscall_64+0xd2/0x200 [ 233.608130][T14113] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 233.608205][T14113] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 233.608224][T14113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.608237][T14113] RIP: 0033:0x7fcc8e05d9dc [ 233.608247][T14113] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 233.608307][T14113] RSP: 002b:00007fcc8cac7030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 233.608319][T14113] RAX: ffffffffffffffda RBX: 00007fcc8e2b5fa0 RCX: 00007fcc8e05d9dc [ 233.608326][T14113] RDX: 000000000000000f RSI: 00007fcc8cac70a0 RDI: 0000000000000006 [ 233.608333][T14113] RBP: 00007fcc8cac7090 R08: 0000000000000000 R09: 0000000000000000 [ 233.608340][T14113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 233.608347][T14113] R13: 00007fcc8e2b6038 R14: 00007fcc8e2b5fa0 R15: 00007ffecf569948 [ 233.608406][T14113] [ 233.826592][T14118] loop4: detected capacity change from 0 to 512 [ 233.833320][T14118] EXT4-fs: Ignoring removed i_version option [ 233.837780][T14111] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3648'. [ 233.839565][T14118] EXT4-fs: Ignoring removed bh option [ 233.854370][T14118] ext2: Unknown parameter 'euid' [ 234.071757][T14155] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 234.088145][T14155] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 234.088145][T14155] program syz.2.3666 not setting count and/or reply_len properly [ 234.135923][T14156] loop1: detected capacity change from 0 to 512 [ 234.147475][T14156] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 234.155514][T14156] EXT4-fs (loop1): orphan cleanup on readonly fs [ 234.162152][T14156] EXT4-fs warning (device loop1): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 234.177553][T14156] EXT4-fs (loop1): Cannot turn on quotas: error -117 [ 234.185659][T14156] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.3665: bg 0: block 40: padding at end of block bitmap is not set [ 234.200048][T14156] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 234.209272][T14156] EXT4-fs (loop1): 1 truncate cleaned up [ 234.215318][T14156] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 234.370478][T14160] loop4: detected capacity change from 0 to 512 [ 234.377546][T14160] EXT4-fs: Ignoring removed i_version option [ 234.383571][T14160] EXT4-fs: Ignoring removed bh option [ 234.389418][T14160] ext2: Unknown parameter 'euid' [ 234.440090][T14166] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3670'. [ 234.801152][T14179] FAULT_INJECTION: forcing a failure. [ 234.801152][T14179] name failslab, interval 1, probability 0, space 0, times 0 [ 234.813892][T14179] CPU: 1 UID: 0 PID: 14179 Comm: syz.3.3675 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 234.813924][T14179] Tainted: [W]=WARN [ 234.813930][T14179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 234.813942][T14179] Call Trace: [ 234.813995][T14179] [ 234.814003][T14179] __dump_stack+0x1d/0x30 [ 234.814031][T14179] dump_stack_lvl+0xe8/0x140 [ 234.814049][T14179] dump_stack+0x15/0x1b [ 234.814064][T14179] should_fail_ex+0x265/0x280 [ 234.814088][T14179] should_failslab+0x8c/0xb0 [ 234.814117][T14179] kmem_cache_alloc_noprof+0x50/0x480 [ 234.814142][T14179] ? alloc_vfsmnt+0x2d/0x300 [ 234.814160][T14179] alloc_vfsmnt+0x2d/0x300 [ 234.814178][T14179] clone_mnt+0x30/0x5d0 [ 234.814223][T14179] copy_tree+0x2cd/0x8c0 [ 234.814249][T14179] copy_mnt_ns+0x13d/0x610 [ 234.814337][T14179] ? kmem_cache_alloc_noprof+0x2b8/0x480 [ 234.814365][T14179] ? create_new_namespaces+0x3c/0x3d0 [ 234.814383][T14179] create_new_namespaces+0x83/0x3d0 [ 234.814407][T14179] unshare_nsproxy_namespaces+0xe8/0x120 [ 234.814428][T14179] ksys_unshare+0x3d0/0x6d0 [ 234.814459][T14179] ? trace_sys_enter+0xd0/0xf0 [ 234.814549][T14179] __x64_sys_unshare+0x1f/0x30 [ 234.814599][T14179] x64_sys_call+0x2915/0x3000 [ 234.814619][T14179] do_syscall_64+0xd2/0x200 [ 234.814636][T14179] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 234.814720][T14179] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 234.814803][T14179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.814825][T14179] RIP: 0033:0x7f3a7470efc9 [ 234.814840][T14179] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 234.814866][T14179] RSP: 002b:00007f3a73177038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 234.814966][T14179] RAX: ffffffffffffffda RBX: 00007f3a74965fa0 RCX: 00007f3a7470efc9 [ 234.814977][T14179] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040060080 [ 234.814991][T14179] RBP: 00007f3a73177090 R08: 0000000000000000 R09: 0000000000000000 [ 234.815057][T14179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 234.815067][T14179] R13: 00007f3a74966038 R14: 00007f3a74965fa0 R15: 00007fff377d9bc8 [ 234.815087][T14179] [ 235.044381][T12736] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 235.149590][T14194] loop2: detected capacity change from 0 to 512 [ 235.156902][T14194] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 235.165070][T14193] loop3: detected capacity change from 0 to 512 [ 235.190487][T14194] EXT4-fs (loop2): 1 truncate cleaned up [ 235.196911][T14193] EXT4-fs error (device loop3): ext4_orphan_get:1392: inode #15: comm syz.3.3682: inode has both inline data and extents flags [ 235.215817][T14194] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 235.229504][T14193] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.3682: couldn't read orphan inode 15 (err -117) [ 235.270160][T14193] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 235.298021][T14208] netlink: 'syz.0.3686': attribute type 10 has an invalid length. [ 235.323644][T14208] bond0: (slave dummy0): Releasing backup interface [ 235.350373][T14209] netlink: 'syz.0.3686': attribute type 10 has an invalid length. [ 235.355491][T14208] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 235.396958][T14208] team0: Failed to send options change via netlink (err -105) [ 235.404568][T14208] team0: Port device dummy0 added [ 235.460914][T11620] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 235.464587][T14214] loop4: detected capacity change from 0 to 128 [ 235.470778][T14209] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 235.494489][T14214] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 235.517013][T14217] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 235.545083][T14214] ext4 filesystem being mounted at /77/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 235.545093][T14209] team0: Failed to send options change via netlink (err -105) [ 235.545125][T14209] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 235.572705][T14214] EXT4-fs warning (device loop4): ext4_dirblock_csum_verify:375: inode #2: comm syz.4.3688: No space for directory leaf checksum. Please run e2fsck -D. [ 235.574349][T14217] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 235.574349][T14217] program syz.3.3689 not setting count and/or reply_len properly [ 235.588754][T14214] EXT4-fs error (device loop4): htree_dirblock_to_tree:1051: inode #2: comm syz.4.3688: Directory block failed checksum [ 235.618646][T14209] team0: Port device dummy0 removed [ 235.637173][T14209] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 235.687646][T12917] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 235.928156][T14224] loop0: detected capacity change from 0 to 4096 [ 236.087825][T10962] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 236.432944][T14232] ip6_vti0 speed is unknown, defaulting to 1000 [ 236.533020][T14232] lo speed is unknown, defaulting to 1000 [ 236.539904][T14232] lo speed is unknown, defaulting to 1000 [ 236.692721][T14232] ip6_vti0 speed is unknown, defaulting to 1000 [ 236.749648][T14224] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 236.768590][T14232] lo speed is unknown, defaulting to 1000 [ 236.775537][T14232] lo speed is unknown, defaulting to 1000 [ 236.828368][T14236] loop2: detected capacity change from 0 to 1024 [ 236.922621][T14243] SELinux: Context Ü is not valid (left unmapped). [ 236.995446][T11382] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 237.117048][T14252] netlink: 'syz.1.3701': attribute type 10 has an invalid length. [ 237.161374][T14252] bond0: (slave dummy0): Releasing backup interface [ 237.198662][T14259] netlink: 'syz.1.3701': attribute type 10 has an invalid length. [ 237.218320][T14260] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3702'. [ 237.249480][T14252] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 237.294467][T14262] loop3: detected capacity change from 0 to 512 [ 237.333998][T14252] team0: Failed to send options change via netlink (err -105) [ 237.341596][T14252] team0: Port device dummy0 added [ 237.355485][T14262] EXT4-fs: Ignoring removed i_version option [ 237.361567][T14262] EXT4-fs: Ignoring removed bh option [ 237.406358][T14259] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 237.444088][T14262] ext2: Unknown parameter 'euid' [ 237.519286][T14259] team0: Failed to send options change via netlink (err -105) [ 237.574852][T14259] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 237.659167][T14259] team0: Port device dummy0 removed [ 237.686691][T14259] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 237.695870][T14274] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3705'. [ 237.731279][T14274] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3705'. [ 237.796012][T14278] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 237.818770][T14278] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 237.818770][T14278] program syz.2.3706 not setting count and/or reply_len properly [ 237.896835][T14280] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3705'. [ 238.118207][T14301] program syz.1.3712 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 238.272601][ T29] kauditd_printk_skb: 218 callbacks suppressed [ 238.272616][ T29] audit: type=1400 audit(2000000100.180:23326): avc: denied { create } for pid=14314 comm="syz.4.3718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 238.274867][T14313] loop1: detected capacity change from 0 to 512 [ 238.282430][ T29] audit: type=1400 audit(2000000100.190:23327): avc: denied { bind } for pid=14314 comm="syz.4.3718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 238.328543][ T29] audit: type=1400 audit(2000000100.240:23328): avc: denied { listen } for pid=14314 comm="syz.4.3718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 238.329934][T14313] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 238.361470][T14313] ext4 filesystem being mounted at /111/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 238.393151][ T29] audit: type=1326 audit(2000000100.270:23329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14314 comm="syz.4.3718" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 238.417469][ T29] audit: type=1326 audit(2000000100.270:23330): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14314 comm="syz.4.3718" exe="/root/syz-executor" sig=0 arch=c000003e syscall=198 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 238.441285][ T29] audit: type=1326 audit(2000000100.270:23331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14314 comm="syz.4.3718" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 238.465586][ T29] audit: type=1326 audit(2000000100.280:23332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14314 comm="syz.4.3718" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 238.468187][T14318] EXT4-fs error (device loop1): ext4_get_first_dir_block:3537: inode #12: block 32: comm syz.1.3717: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 238.489376][ T29] audit: type=1326 audit(2000000100.280:23333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14314 comm="syz.4.3718" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 238.489451][ T29] audit: type=1326 audit(2000000100.280:23334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14314 comm="syz.4.3718" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 238.489483][ T29] audit: type=1326 audit(2000000100.280:23335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14314 comm="syz.4.3718" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 238.611036][T14318] EXT4-fs error (device loop1): ext4_get_first_dir_block:3540: inode #12: comm syz.1.3717: directory missing '.' [ 238.700527][T12736] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 238.750700][T14330] loop2: detected capacity change from 0 to 2048 [ 238.766238][T14330] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 238.779374][T14330] ext4 filesystem being mounted at /203/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 238.791903][T14330] netlink: 'syz.2.3722': attribute type 1 has an invalid length. [ 238.811328][T10962] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 238.831827][T14354] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 238.930759][T14350] ip6_vti0 speed is unknown, defaulting to 1000 [ 238.991365][T14365] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 239.004421][T14350] lo speed is unknown, defaulting to 1000 [ 239.011916][T14350] lo speed is unknown, defaulting to 1000 [ 239.020370][T14365] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 239.020370][T14365] program syz.4.3731 not setting count and/or reply_len properly [ 239.387419][T14385] netlink: 'syz.2.3738': attribute type 1 has an invalid length. [ 239.683769][T14397] blktrace: Concurrent blktraces are not allowed on loop2 [ 239.707640][T14397] ip6_vti0 speed is unknown, defaulting to 1000 [ 239.758318][T14397] lo speed is unknown, defaulting to 1000 [ 239.764342][T14397] lo speed is unknown, defaulting to 1000 [ 239.797539][T14400] loop3: detected capacity change from 0 to 512 [ 239.804427][T14400] EXT4-fs: Ignoring removed i_version option [ 239.811246][T14400] EXT4-fs: Ignoring removed bh option [ 239.817259][T14400] ext2: Unknown parameter 'euid' [ 239.848143][T14402] netlink: 'syz.3.3745': attribute type 10 has an invalid length. [ 239.859580][T14402] bond0: (slave dummy0): Releasing backup interface [ 239.869167][T14402] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 239.878430][T14402] team0: Failed to send options change via netlink (err -105) [ 239.885976][T14402] team0: Port device dummy0 added [ 239.892829][T14402] netlink: 'syz.3.3745': attribute type 10 has an invalid length. [ 239.906606][T14404] netlink: 'syz.4.3746': attribute type 39 has an invalid length. [ 239.920021][T14402] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 239.930954][T14402] team0: Failed to send options change via netlink (err -105) [ 239.939066][T14402] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 239.949075][ T10] hid_parser_main: 4 callbacks suppressed [ 239.949093][ T10] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 239.962669][ T10] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 239.970638][ T10] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 239.975730][T14402] team0: Port device dummy0 removed [ 239.978174][ T10] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 239.985777][T14402] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 239.990649][ T10] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 239.990671][ T10] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 240.000738][T14412] x_tables: unsorted underflow at hook 2 [ 240.007288][ T10] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 240.020039][T14412] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3747'. [ 240.020296][ T10] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 240.044595][ T10] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 240.052002][ T10] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 240.061285][ T10] hid-generic 0000:0000:0000.0005: hidraw0: HID v8.00 Device [syz0] on syz0 [ 240.091621][T14414] FAULT_INJECTION: forcing a failure. [ 240.091621][T14414] name failslab, interval 1, probability 0, space 0, times 0 [ 240.104326][T14414] CPU: 0 UID: 0 PID: 14414 Comm: Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 240.104358][T14414] Tainted: [W]=WARN [ 240.104398][T14414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 240.104407][T14414] Call Trace: [ 240.104413][T14414] [ 240.104420][T14414] __dump_stack+0x1d/0x30 [ 240.104441][T14414] dump_stack_lvl+0xe8/0x140 [ 240.104528][T14414] dump_stack+0x15/0x1b [ 240.104546][T14414] should_fail_ex+0x265/0x280 [ 240.104569][T14414] should_failslab+0x8c/0xb0 [ 240.104609][T14414] kmem_cache_alloc_node_noprof+0x57/0x4a0 [ 240.104637][T14414] ? __alloc_skb+0x101/0x320 [ 240.104672][T14414] __alloc_skb+0x101/0x320 [ 240.104760][T14414] netlink_ack+0xfd/0x500 [ 240.104793][T14414] netlink_rcv_skb+0x192/0x220 [ 240.104822][T14414] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 240.104858][T14414] nfnetlink_rcv+0x167/0x16c0 [ 240.104895][T14414] ? kmem_cache_free+0xe4/0x3d0 [ 240.104925][T14414] ? __kfree_skb+0x109/0x150 [ 240.105009][T14414] ? nlmon_xmit+0x4f/0x60 [ 240.105032][T14414] ? consume_skb+0x49/0x150 [ 240.105062][T14414] ? nlmon_xmit+0x4f/0x60 [ 240.105140][T14414] ? dev_hard_start_xmit+0x3b0/0x3e0 [ 240.105173][T14414] ? __dev_queue_xmit+0x1200/0x2000 [ 240.105275][T14414] ? __dev_queue_xmit+0x182/0x2000 [ 240.105308][T14414] ? ref_tracker_free+0x37d/0x3e0 [ 240.105470][T14414] ? __netlink_deliver_tap+0x4dc/0x500 [ 240.105504][T14414] netlink_unicast+0x5c0/0x690 [ 240.105563][T14414] netlink_sendmsg+0x58b/0x6b0 [ 240.105585][T14414] ? __pfx_netlink_sendmsg+0x10/0x10 [ 240.105606][T14414] __sock_sendmsg+0x145/0x180 [ 240.105642][T14414] ____sys_sendmsg+0x31e/0x4e0 [ 240.105754][T14414] ___sys_sendmsg+0x17b/0x1d0 [ 240.105802][T14414] __x64_sys_sendmsg+0xd4/0x160 [ 240.105834][T14414] x64_sys_call+0x191e/0x3000 [ 240.105855][T14414] do_syscall_64+0xd2/0x200 [ 240.105875][T14414] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 240.106017][T14414] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 240.106048][T14414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.106071][T14414] RIP: 0033:0x7f3a7470efc9 [ 240.106088][T14414] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 240.106136][T14414] RSP: 002b:00007f3a73177038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 240.106155][T14414] RAX: ffffffffffffffda RBX: 00007f3a74965fa0 RCX: 00007f3a7470efc9 [ 240.106168][T14414] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005 [ 240.106181][T14414] RBP: 00007f3a73177090 R08: 0000000000000000 R09: 0000000000000000 [ 240.106222][T14414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 240.106233][T14414] R13: 00007f3a74966038 R14: 00007f3a74965fa0 R15: 00007fff377d9bc8 [ 240.106254][T14414] [ 240.437258][T14416] veth2: entered promiscuous mode [ 240.442330][T14416] veth2: entered allmulticast mode [ 240.459831][ T10] hid-generic 0000:0000:0000.0006: hidraw0: HID v8.00 Device [syz0] on syz0 [ 240.471155][T14420] x_tables: unsorted underflow at hook 2 [ 240.487452][T14420] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3750'. [ 240.498105][T14422] netlink: 'syz.4.3752': attribute type 1 has an invalid length. [ 240.530109][T14425] loop0: detected capacity change from 0 to 512 [ 240.562040][T14431] netlink: 'syz.4.3754': attribute type 10 has an invalid length. [ 240.564960][T14430] loop3: detected capacity change from 0 to 512 [ 240.583784][T14430] EXT4-fs: Ignoring removed i_version option [ 240.590736][T14430] EXT4-fs: Ignoring removed bh option [ 240.597843][T14430] ext2: Unknown parameter 'euid' [ 240.603337][T14425] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.3753: couldn't read orphan inode 26 (err -116) [ 240.616305][T14418] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3751'. [ 240.626188][T14431] team0: Port device dummy0 added [ 240.651491][T14436] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 240.666566][T14437] rdma_op ffff888113a3ed80 conn xmit_rdma 0000000000000000 [ 240.681185][T14431] netlink: 'syz.4.3754': attribute type 10 has an invalid length. [ 240.698914][T14425] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 240.712302][T14431] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 240.743138][T14436] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 240.743138][T14436] program syz.3.3756 not setting count and/or reply_len properly [ 240.746642][T14425] ext4 filesystem being mounted at /186/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 240.771383][T14431] team0: Failed to send options change via netlink (err -105) [ 240.779402][T14431] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 240.787246][T14425] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3753'. [ 240.790812][T14431] team0: Port device dummy0 removed [ 240.817330][T14431] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 240.842468][T14425] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3753'. [ 240.864495][T14425] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14425 comm=syz.0.3753 [ 240.902148][T11382] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 241.080530][T14463] loop4: detected capacity change from 0 to 128 [ 241.088525][T14463] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 241.101508][T14463] ext4 filesystem being mounted at /95/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 241.112598][T14463] EXT4-fs warning (device loop4): ext4_dirblock_csum_verify:375: inode #2: comm syz.4.3764: No space for directory leaf checksum. Please run e2fsck -D. [ 241.128958][T14463] EXT4-fs error (device loop4): htree_dirblock_to_tree:1051: inode #2: comm syz.4.3764: Directory block failed checksum [ 241.174167][T12917] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 241.189196][T14466] siw: device registration error -23 [ 241.200245][T14466] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3765'. [ 241.217450][T14468] loop4: detected capacity change from 0 to 512 [ 241.224048][T14468] EXT4-fs: Ignoring removed i_version option [ 241.230136][T14468] EXT4-fs: Ignoring removed bh option [ 241.235606][T14468] ext2: Unknown parameter 'euid' [ 241.286659][T14472] FAULT_INJECTION: forcing a failure. [ 241.286659][T14472] name failslab, interval 1, probability 0, space 0, times 0 [ 241.299518][T14472] CPU: 1 UID: 0 PID: 14472 Comm: syz.4.3768 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 241.299552][T14472] Tainted: [W]=WARN [ 241.299558][T14472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 241.299639][T14472] Call Trace: [ 241.299647][T14472] [ 241.299655][T14472] __dump_stack+0x1d/0x30 [ 241.299678][T14472] dump_stack_lvl+0xe8/0x140 [ 241.299697][T14472] dump_stack+0x15/0x1b [ 241.299714][T14472] should_fail_ex+0x265/0x280 [ 241.299735][T14472] should_failslab+0x8c/0xb0 [ 241.299781][T14472] __kmalloc_noprof+0xa5/0x570 [ 241.299811][T14472] ? __d_alloc+0x90/0x340 [ 241.299844][T14472] __d_alloc+0x90/0x340 [ 241.299938][T14472] ? selinux_file_open+0x2df/0x330 [ 241.299972][T14472] d_alloc_parallel+0x58/0xc70 [ 241.300076][T14472] ? lockref_get_not_dead+0x120/0x1c0 [ 241.300101][T14472] ? __rcu_read_unlock+0x4f/0x70 [ 241.300127][T14472] __lookup_slow+0x8c/0x250 [ 241.300147][T14472] lookup_slow+0x3c/0x60 [ 241.300190][T14472] walk_component+0x1ec/0x220 [ 241.300221][T14472] path_lookupat+0xfe/0x2a0 [ 241.300326][T14472] filename_lookup+0x147/0x340 [ 241.300368][T14472] user_path_at+0x3e/0x130 [ 241.300428][T14472] vfs_open_tree+0x19c/0x530 [ 241.300529][T14472] __x64_sys_open_tree+0x45/0xc0 [ 241.300554][T14472] x64_sys_call+0x2a8b/0x3000 [ 241.300577][T14472] do_syscall_64+0xd2/0x200 [ 241.300594][T14472] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 241.300620][T14472] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 241.300715][T14472] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 241.300797][T14472] RIP: 0033:0x7fcc8e05efc9 [ 241.300812][T14472] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 241.300829][T14472] RSP: 002b:00007fcc8cac7038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ac [ 241.300848][T14472] RAX: ffffffffffffffda RBX: 00007fcc8e2b5fa0 RCX: 00007fcc8e05efc9 [ 241.300862][T14472] RDX: 0000000000080001 RSI: 0000200000001080 RDI: ffffffffffffff9c [ 241.300875][T14472] RBP: 00007fcc8cac7090 R08: 0000000000000000 R09: 0000000000000000 [ 241.300915][T14472] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 241.300928][T14472] R13: 00007fcc8e2b6038 R14: 00007fcc8e2b5fa0 R15: 00007ffecf569948 [ 241.300947][T14472] [ 241.379116][T14476] loop2: detected capacity change from 0 to 512 [ 241.567246][T14476] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 241.580131][T14483] loop3: detected capacity change from 0 to 128 [ 241.586875][T14476] EXT4-fs (loop2): orphan cleanup on readonly fs [ 241.587054][T14476] EXT4-fs warning (device loop2): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 241.609306][T14476] EXT4-fs (loop2): Cannot turn on quotas: error -117 [ 241.620232][T14483] FAT-fs (loop3): error, corrupted directory (invalid entries) [ 241.624896][T14476] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.3767: bg 0: block 40: padding at end of block bitmap is not set [ 241.630998][T14483] FAT-fs (loop3): Filesystem has been set read-only [ 241.649221][T14476] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 241.649533][T14476] EXT4-fs (loop2): 1 truncate cleaned up [ 241.649903][T14476] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 241.689977][T14483] FAT-fs (loop3): error, corrupted directory (invalid entries) [ 241.706665][T14483] FAT-fs (loop3): error, corrupted directory (invalid entries) [ 241.756152][ T23] hid-generic 0000:0000:0000.0007: hidraw0: HID v8.00 Device [syz0] on syz0 [ 241.769244][T14492] x_tables: unsorted underflow at hook 2 [ 241.826108][T14492] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3774'. [ 242.006705][T14508] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 242.055160][T14510] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3781'. [ 242.114398][T10962] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 242.118463][T14502] ip6_vti0 speed is unknown, defaulting to 1000 [ 242.130340][T14510] bond1: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 242.179832][T14510] bond1 (unregistering): Released all slaves [ 242.207584][T14518] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 242.231404][T14520] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 242.233528][T14502] lo speed is unknown, defaulting to 1000 [ 242.248181][T14502] lo speed is unknown, defaulting to 1000 [ 242.277035][T14520] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 242.277035][T14520] program syz.2.3782 not setting count and/or reply_len properly [ 242.406486][T14525] loop4: detected capacity change from 0 to 512 [ 242.519184][T14525] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 242.534955][T14525] EXT4-fs (loop4): orphan cleanup on readonly fs [ 242.542690][T14525] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #16: comm syz.4.3783: corrupted inode contents [ 242.554889][T14525] EXT4-fs (loop4): Remounting filesystem read-only [ 242.561485][T14525] EXT4-fs (loop4): 1 truncate cleaned up [ 242.567909][ T9597] EXT4-fs (loop4): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 242.578540][ T9597] EXT4-fs (loop4): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 242.589302][ T9597] EXT4-fs (loop4): Quota write (off=8, len=24) cancelled because transaction is not started [ 242.593416][T14540] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3788'. [ 242.599996][T14525] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 242.801278][T12917] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 242.856928][T14545] netlink: 'syz.0.3790': attribute type 39 has an invalid length. [ 242.874167][T14546] loop1: detected capacity change from 0 to 128 [ 242.909947][T14546] FAT-fs (loop1): error, corrupted directory (invalid entries) [ 242.922130][T14546] FAT-fs (loop1): Filesystem has been set read-only [ 242.958586][T14542] ip6_vti0 speed is unknown, defaulting to 1000 [ 242.987150][T14546] FAT-fs (loop1): error, corrupted directory (invalid entries) [ 242.998670][T14554] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 243.008749][T14546] FAT-fs (loop1): error, corrupted directory (invalid entries) [ 243.122769][T14542] lo speed is unknown, defaulting to 1000 [ 243.149819][T14542] lo speed is unknown, defaulting to 1000 [ 243.271683][T14566] dummy0: entered allmulticast mode [ 243.306983][ T10] hid-generic 0000:3000000:0000.0008: hidraw0: HID v0.00 Device [sy] on syz0 [ 243.336495][T14565] dummy0: left allmulticast mode [ 243.390850][T14574] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 243.441854][T14577] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 243.441854][T14577] program syz.2.3801 not setting count and/or reply_len properly [ 243.938994][T14596] netlink: 'syz.3.3807': attribute type 1 has an invalid length. [ 243.947518][ T29] kauditd_printk_skb: 1068 callbacks suppressed [ 243.947531][ T29] audit: type=1326 audit(2000000105.860:24397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14597 comm="syz.1.3808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 243.989354][ T29] audit: type=1326 audit(2000000105.890:24398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14597 comm="syz.1.3808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=306 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 244.013672][ T29] audit: type=1326 audit(2000000105.890:24399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14597 comm="syz.1.3808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 244.068104][T14592] FAULT_INJECTION: forcing a failure. [ 244.068104][T14592] name failslab, interval 1, probability 0, space 0, times 0 [ 244.080946][T14592] CPU: 1 UID: 0 PID: 14592 Comm: syz.0.3806 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 244.080978][T14592] Tainted: [W]=WARN [ 244.080985][T14592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 244.080997][T14592] Call Trace: [ 244.081003][T14592] [ 244.081016][T14592] __dump_stack+0x1d/0x30 [ 244.081039][T14592] dump_stack_lvl+0xe8/0x140 [ 244.081060][T14592] dump_stack+0x15/0x1b [ 244.081078][T14592] should_fail_ex+0x265/0x280 [ 244.081098][T14592] should_failslab+0x8c/0xb0 [ 244.081126][T14592] kmem_cache_alloc_noprof+0x50/0x480 [ 244.081156][T14592] ? vm_area_alloc+0x2c/0xb0 [ 244.081186][T14592] vm_area_alloc+0x2c/0xb0 [ 244.081216][T14592] mmap_region+0xa99/0x1620 [ 244.081261][T14592] do_mmap+0x9b3/0xbe0 [ 244.081283][T14592] vm_mmap_pgoff+0x17a/0x2e0 [ 244.081316][T14592] ksys_mmap_pgoff+0xc2/0x310 [ 244.081334][T14592] ? __x64_sys_mmap+0x49/0x70 [ 244.081358][T14592] x64_sys_call+0x14a3/0x3000 [ 244.081379][T14592] do_syscall_64+0xd2/0x200 [ 244.081394][T14592] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 244.081420][T14592] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 244.081451][T14592] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 244.081472][T14592] RIP: 0033:0x7f522cc1f003 [ 244.081488][T14592] Code: f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 89 ca 41 f7 c1 ff 0f 00 00 75 14 b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 25 c3 0f 1f 40 00 48 c7 c0 a8 ff ff ff 64 c7 [ 244.081504][T14592] RSP: 002b:00007f522b686e18 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 244.081523][T14592] RAX: ffffffffffffffda RBX: 0000000000000537 RCX: 00007f522cc1f003 [ 244.081536][T14592] RDX: 0000000000000003 RSI: 0000000008400000 RDI: 0000000000000000 [ 244.081548][T14592] RBP: 00002000000005c2 R08: 00000000ffffffff R09: 0000000000000000 [ 244.081560][T14592] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000000010 [ 244.081573][T14592] R13: 00007f522b686ef0 R14: 00007f522b686eb0 R15: 0000200000000140 [ 244.081592][T14592] [ 244.348140][T14607] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 244.356515][T14607] loop1: detected capacity change from 0 to 256 [ 244.421929][T14616] loop4: detected capacity change from 0 to 512 [ 244.453721][T14607] FAT-fs (loop1): Directory bread(block 64) failed [ 244.462153][T14607] FAT-fs (loop1): Directory bread(block 65) failed [ 244.489272][T14616] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 244.518280][T14619] ip6_vti0 speed is unknown, defaulting to 1000 [ 244.556424][T14607] FAT-fs (loop1): Directory bread(block 66) failed [ 244.562985][T14607] FAT-fs (loop1): Directory bread(block 67) failed [ 244.581609][T14626] binfmt_misc: register: failed to install interpreter file ./file0 [ 244.614885][T14616] ext4 filesystem being mounted at /109/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 244.688795][T14616] EXT4-fs error (device loop4): ext4_get_first_dir_block:3537: inode #12: block 32: comm syz.4.3814: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 244.691615][T14619] lo speed is unknown, defaulting to 1000 [ 244.715577][T14607] FAT-fs (loop1): Directory bread(block 68) failed [ 244.722099][T14607] FAT-fs (loop1): Directory bread(block 69) failed [ 244.733336][T14616] EXT4-fs error (device loop4): ext4_get_first_dir_block:3540: inode #12: comm syz.4.3814: directory missing '.' [ 244.745834][T14619] lo speed is unknown, defaulting to 1000 [ 244.771928][T14607] FAT-fs (loop1): Directory bread(block 70) failed [ 244.777516][T14631] netlink: 'syz.2.3819': attribute type 39 has an invalid length. [ 244.786771][T14607] FAT-fs (loop1): Directory bread(block 71) failed [ 244.793425][T14607] FAT-fs (loop1): Directory bread(block 72) failed [ 244.799996][T14607] FAT-fs (loop1): Directory bread(block 73) failed [ 244.810470][T12917] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 244.831915][ T29] audit: type=1326 audit(2000000106.740:24400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14632 comm="syz.4.3820" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 244.856110][ T29] audit: type=1326 audit(2000000106.740:24401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14632 comm="syz.4.3820" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 244.880087][ T29] audit: type=1326 audit(2000000106.740:24402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14632 comm="syz.4.3820" exe="/root/syz-executor" sig=0 arch=c000003e syscall=306 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 244.904306][ T29] audit: type=1326 audit(2000000106.740:24403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14632 comm="syz.4.3820" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 244.928507][ T29] audit: type=1326 audit(2000000106.740:24404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14632 comm="syz.4.3820" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc8e05efc9 code=0x7ffc0000 [ 244.978259][T14638] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 244.990379][T14638] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 244.990379][T14638] program syz.4.3822 not setting count and/or reply_len properly [ 245.351771][T14654] ip6_vti0 speed is unknown, defaulting to 1000 [ 245.443556][T14654] lo speed is unknown, defaulting to 1000 [ 245.450046][T14654] lo speed is unknown, defaulting to 1000 [ 245.595620][T14654] loop1: detected capacity change from 0 to 512 [ 245.609719][ T29] audit: type=1326 audit(2000000107.500:24405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14645 comm="syz.1.3825" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 245.633987][ T29] audit: type=1326 audit(2000000107.500:24406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14645 comm="syz.1.3825" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 245.693279][T14654] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 245.706320][T14654] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 245.926349][T14678] __nla_validate_parse: 5 callbacks suppressed [ 245.926366][T14678] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3834'. [ 245.977801][T14685] loop2: detected capacity change from 0 to 128 [ 245.986882][T14685] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 245.999464][T14685] ext4 filesystem being mounted at /231/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 246.015872][T14685] EXT4-fs warning (device loop2): ext4_dirblock_csum_verify:375: inode #2: comm syz.2.3836: No space for directory leaf checksum. Please run e2fsck -D. [ 246.031372][T14685] EXT4-fs error (device loop2): htree_dirblock_to_tree:1051: inode #2: comm syz.2.3836: Directory block failed checksum [ 246.035777][T14689] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 246.059641][T14689] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 246.059641][T14689] program syz.1.3837 not setting count and/or reply_len properly [ 246.077373][T10962] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 246.686197][T14700] loop3: detected capacity change from 0 to 512 [ 246.713858][T14702] loop4: detected capacity change from 0 to 1024 [ 246.721317][T14702] EXT4-fs: Ignoring removed nomblk_io_submit option [ 246.791082][T14702] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 246.799887][T14702] System zones: 0-1, 3-36 [ 246.808243][T14702] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 246.823612][T14700] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 246.874883][T14700] ext4 filesystem being mounted at /161/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 246.904150][T12917] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 246.971551][T14722] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3847'. [ 247.032255][T11620] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 247.047430][T14727] netlink: 'syz.4.3851': attribute type 4 has an invalid length. [ 247.058146][T14718] loop0: detected capacity change from 0 to 8192 [ 247.115601][T14718] loop0: p2 p3 p4 [ 247.125713][T14718] loop0: p2 start 2936012800 is beyond EOD, truncated [ 247.130342][T14724] blktrace: Concurrent blktraces are not allowed on loop2 [ 247.132511][T14718] loop0: p3 start 1912602624 is beyond EOD, truncated [ 247.146567][T14718] loop0: p4 size 656640 extends beyond EOD, truncated [ 247.161260][T14724] ip6_vti0 speed is unknown, defaulting to 1000 [ 247.180524][T14731] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 247.274605][T14737] netlink: 'syz.0.3854': attribute type 1 has an invalid length. [ 247.287633][T14724] lo speed is unknown, defaulting to 1000 [ 247.293794][T14724] lo speed is unknown, defaulting to 1000 [ 247.318623][T14740] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3857'. [ 247.345071][T14740] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3857'. [ 247.423942][T14745] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 247.461392][T14747] FAULT_INJECTION: forcing a failure. [ 247.461392][T14747] name failslab, interval 1, probability 0, space 0, times 0 [ 247.474919][T14747] CPU: 0 UID: 0 PID: 14747 Comm: syz.3.3859 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 247.474961][T14747] Tainted: [W]=WARN [ 247.474968][T14747] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 247.474983][T14747] Call Trace: [ 247.474992][T14747] [ 247.475002][T14747] __dump_stack+0x1d/0x30 [ 247.475027][T14747] dump_stack_lvl+0xe8/0x140 [ 247.475071][T14747] dump_stack+0x15/0x1b [ 247.475089][T14747] should_fail_ex+0x265/0x280 [ 247.475110][T14747] ? legacy_init_fs_context+0x31/0x80 [ 247.475141][T14747] should_failslab+0x8c/0xb0 [ 247.475192][T14747] __kmalloc_cache_noprof+0x4c/0x4a0 [ 247.475225][T14747] legacy_init_fs_context+0x31/0x80 [ 247.475252][T14747] alloc_fs_context+0x3ef/0x4e0 [ 247.475284][T14747] fs_context_for_mount+0x22/0x30 [ 247.475312][T14747] do_new_mount+0xea/0x660 [ 247.475335][T14747] ? security_capable+0x83/0x90 [ 247.475387][T14747] path_mount+0x4a5/0xb70 [ 247.475410][T14747] ? user_path_at+0x109/0x130 [ 247.475437][T14747] __se_sys_mount+0x28c/0x2e0 [ 247.475459][T14747] ? fput+0x8f/0xc0 [ 247.475539][T14747] __x64_sys_mount+0x67/0x80 [ 247.475648][T14747] x64_sys_call+0x2b51/0x3000 [ 247.475709][T14747] do_syscall_64+0xd2/0x200 [ 247.475734][T14747] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 247.475765][T14747] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 247.475799][T14747] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.475873][T14747] RIP: 0033:0x7f3a7470efc9 [ 247.475888][T14747] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 247.475974][T14747] RSP: 002b:00007f3a73177038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 247.475995][T14747] RAX: ffffffffffffffda RBX: 00007f3a74965fa0 RCX: 00007f3a7470efc9 [ 247.476010][T14747] RDX: 0000200000000280 RSI: 0000200000000300 RDI: 0000000000000000 [ 247.476024][T14747] RBP: 00007f3a73177090 R08: 0000200000000600 R09: 0000000000000000 [ 247.476104][T14747] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.476163][T14747] R13: 00007f3a74966038 R14: 00007f3a74965fa0 R15: 00007fff377d9bc8 [ 247.476183][T14747] [ 247.557117][T14743] ip6_vti0 speed is unknown, defaulting to 1000 [ 247.586612][T14745] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 247.586612][T14745] program syz.1.3858 not setting count and/or reply_len properly [ 247.640243][T14751] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 247.768085][T14755] netlink: 'syz.0.3861': attribute type 4 has an invalid length. [ 247.772353][T14743] lo speed is unknown, defaulting to 1000 [ 247.783918][T14743] lo speed is unknown, defaulting to 1000 [ 247.811367][T14755] netlink: 'syz.0.3861': attribute type 4 has an invalid length. [ 248.073903][T14774] netlink: 'syz.3.3867': attribute type 4 has an invalid length. [ 248.242511][T14773] blktrace: Concurrent blktraces are not allowed on loop8 [ 248.326298][T14780] loop1: detected capacity change from 0 to 512 [ 248.403041][T14773] ip6_vti0 speed is unknown, defaulting to 1000 [ 248.415793][T14780] EXT4-fs (loop1): orphan cleanup on readonly fs [ 248.422710][T14780] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.3870: Failed to acquire dquot type 1 [ 248.476174][T14780] EXT4-fs (loop1): 1 truncate cleaned up [ 248.498942][T14780] EXT4-fs error (device loop1): ext4_lookup:1791: inode #2: comm syz.1.3870: deleted inode referenced: 12 [ 248.558814][T14773] lo speed is unknown, defaulting to 1000 [ 248.565099][T14773] lo speed is unknown, defaulting to 1000 [ 248.639471][T14784] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3871'. [ 248.769819][T14789] netlink: 'syz.1.3873': attribute type 1 has an invalid length. [ 248.851026][T14792] loop0: detected capacity change from 0 to 4096 [ 248.867533][T14792] EXT4-fs warning (device loop0): ext4_init_metadata_csum:4635: metadata_csum and uninit_bg are redundant flags; please run fsck. [ 248.881752][T14792] EXT4-fs (loop0): VFS: Found ext4 filesystem with unknown checksum algorithm. [ 248.956453][T14792] IPv6: NLM_F_CREATE should be specified when creating new route [ 249.046606][T14800] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3877'. [ 249.065509][T14806] loop5: detected capacity change from 0 to 4223 [ 249.092343][T14807] loop4: detected capacity change from 0 to 512 [ 249.116153][T14808] loop5: detected capacity change from 4223 to 4543 [ 249.157886][T14807] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 249.202974][T14807] EXT4-fs (loop4): orphan cleanup on readonly fs [ 249.216136][T14807] __quota_error: 129 callbacks suppressed [ 249.216149][T14807] Quota error (device loop4): v2_read_file_info: Block with free entry 1 out of range (1, 6). [ 249.232834][T14807] EXT4-fs warning (device loop4): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 249.261460][T14807] EXT4-fs (loop4): Cannot turn on quotas: error -117 [ 249.262316][T14802] ip6_vti0 speed is unknown, defaulting to 1000 [ 249.333143][T14807] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.3879: bg 0: block 40: padding at end of block bitmap is not set [ 249.354158][T14814] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 249.424740][T14807] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 249.495460][T14807] EXT4-fs (loop4): 1 truncate cleaned up [ 249.501518][T14807] EXT4-fs mount: 2 callbacks suppressed [ 249.501538][T14807] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 249.526342][T14802] lo speed is unknown, defaulting to 1000 [ 249.532461][T14802] lo speed is unknown, defaulting to 1000 [ 249.645129][T14800] ip6_vti0 speed is unknown, defaulting to 1000 [ 249.787629][T14819] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3881'. [ 249.833818][T14800] lo speed is unknown, defaulting to 1000 [ 249.866357][T12917] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 249.886766][T14824] netlink: 'syz.0.3882': attribute type 10 has an invalid length. [ 249.908865][T14826] loop2: detected capacity change from 0 to 512 [ 249.917020][T14824] bond0: (slave dummy0): Releasing backup interface [ 249.926821][T14824] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 249.941725][T14826] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 249.964782][T14824] team0: Failed to send options change via netlink (err -105) [ 249.972258][T14824] team0: Port device dummy0 added [ 250.002656][T14826] ext4 filesystem being mounted at /233/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 250.015458][T14831] netlink: 'syz.0.3882': attribute type 10 has an invalid length. [ 250.034087][T14800] lo speed is unknown, defaulting to 1000 [ 250.080518][T14831] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 250.091166][T14836] netlink: 'syz.3.3886': attribute type 1 has an invalid length. [ 250.099112][T14831] team0: Failed to send options change via netlink (err -105) [ 250.107867][T14831] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 250.123687][ T29] audit: type=1326 audit(2000000112.040:24534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14838 comm="syz.3.3888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 250.157898][T10962] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 250.167989][T14831] team0: Port device dummy0 removed [ 250.199972][T14831] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 250.210748][ T29] audit: type=1326 audit(2000000112.060:24535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14838 comm="syz.3.3888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 250.235028][ T29] audit: type=1326 audit(2000000112.060:24536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14838 comm="syz.3.3888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=306 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 250.258624][ T29] audit: type=1326 audit(2000000112.060:24537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14838 comm="syz.3.3888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 250.283141][ T29] audit: type=1326 audit(2000000112.060:24538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14838 comm="syz.3.3888" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a7470efc9 code=0x7ffc0000 [ 250.343240][T14852] loop3: detected capacity change from 0 to 512 [ 250.425325][T14857] loop0: detected capacity change from 0 to 512 [ 250.467869][T14852] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 250.476789][T14846] ip6_vti0 speed is unknown, defaulting to 1000 [ 250.481500][T14857] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 250.516563][T14852] ext4 filesystem being mounted at /174/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 250.531321][T14852] EXT4-fs error (device loop3): ext4_get_first_dir_block:3537: inode #12: block 32: comm syz.3.3892: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 250.545357][T14857] ext4 filesystem being mounted at /214/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 250.552410][T14852] EXT4-fs error (device loop3): ext4_get_first_dir_block:3540: inode #12: comm syz.3.3892: directory missing '.' [ 250.575739][T14855] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 250.817424][T14857] EXT4-fs error (device loop0): ext4_get_first_dir_block:3537: inode #12: block 32: comm syz.0.3893: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 250.839879][T11620] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 250.850643][T14857] EXT4-fs error (device loop0): ext4_get_first_dir_block:3540: inode #12: comm syz.0.3893: directory missing '.' [ 250.915786][T11382] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 250.941120][T14867] loop3: detected capacity change from 0 to 512 [ 250.965469][T14867] EXT4-fs: Ignoring removed i_version option [ 250.971682][T14867] EXT4-fs: Ignoring removed bh option [ 250.989894][T14846] lo speed is unknown, defaulting to 1000 [ 250.998693][T14867] ext2: Unknown parameter 'euid' [ 251.007678][ T29] audit: type=1326 audit(2000000112.920:24539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14870 comm="syz.1.3898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 251.013580][T14846] lo speed is unknown, defaulting to 1000 [ 251.031919][ T29] audit: type=1326 audit(2000000112.920:24540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14870 comm="syz.1.3898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 251.158010][ T29] audit: type=1326 audit(2000000112.920:24541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14870 comm="syz.1.3898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 251.182397][ T29] audit: type=1326 audit(2000000112.920:24542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14870 comm="syz.1.3898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 251.287517][T14880] netlink: 'syz.3.3900': attribute type 1 has an invalid length. [ 251.365423][T14884] xt_hashlimit: size too large, truncated to 1048576 [ 251.406053][T14886] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3901'. [ 251.426626][T14887] netlink: 'syz.1.3902': attribute type 21 has an invalid length. [ 251.434455][T14887] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3902'. [ 251.443875][T14887] netlink: 'syz.1.3902': attribute type 6 has an invalid length. [ 251.452144][T14887] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3902'. [ 251.514191][T14892] loop1: detected capacity change from 0 to 128 [ 251.529561][T14887] netlink: 'syz.1.3902': attribute type 10 has an invalid length. [ 251.695238][T14900] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 251.707090][T14900] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 251.707090][T14900] program syz.4.3905 not setting count and/or reply_len properly [ 251.946194][T14904] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3908'. [ 252.007939][T14910] loop3: detected capacity change from 0 to 512 [ 252.014410][T14910] EXT4-fs: Ignoring removed i_version option [ 252.020559][T14910] EXT4-fs: Ignoring removed bh option [ 252.026681][T14910] ext2: Unknown parameter 'euid' [ 252.137690][T14904] ip6_vti0 speed is unknown, defaulting to 1000 [ 252.146047][T14913] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3910'. [ 252.324131][T14904] lo speed is unknown, defaulting to 1000 [ 252.356231][T14904] lo speed is unknown, defaulting to 1000 [ 252.365370][T14917] netlink: 'syz.3.3911': attribute type 1 has an invalid length. [ 252.488737][T14923] xt_hashlimit: size too large, truncated to 1048576 [ 252.566178][T14924] netlink: 'syz.3.3914': attribute type 21 has an invalid length. [ 252.574116][T14924] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3914'. [ 252.689462][T14924] netlink: 'syz.3.3914': attribute type 6 has an invalid length. [ 252.697259][T14924] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3914'. [ 252.747113][T14924] loop3: detected capacity change from 0 to 128 [ 252.946258][T14931] ip6_vti0 speed is unknown, defaulting to 1000 [ 253.005919][T14931] lo speed is unknown, defaulting to 1000 [ 253.012052][T14931] lo speed is unknown, defaulting to 1000 [ 253.042287][T14934] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 253.136573][T14938] loop1: detected capacity change from 0 to 512 [ 253.175018][T14938] ext4: Unknown parameter '"' [ 253.186293][T14943] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3916'. [ 253.215774][T14938] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3917'. [ 253.235339][T14946] FAULT_INJECTION: forcing a failure. [ 253.235339][T14946] name failslab, interval 1, probability 0, space 0, times 0 [ 253.248698][T14946] CPU: 0 UID: 0 PID: 14946 Comm: syz.4.3919 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 253.248733][T14946] Tainted: [W]=WARN [ 253.248740][T14946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 253.248754][T14946] Call Trace: [ 253.248761][T14946] [ 253.248782][T14946] __dump_stack+0x1d/0x30 [ 253.248807][T14946] dump_stack_lvl+0xe8/0x140 [ 253.248830][T14946] dump_stack+0x15/0x1b [ 253.248850][T14946] should_fail_ex+0x265/0x280 [ 253.248879][T14946] should_failslab+0x8c/0xb0 [ 253.248929][T14946] kmem_cache_alloc_noprof+0x50/0x480 [ 253.249017][T14946] ? getname_flags+0x80/0x3b0 [ 253.249098][T14946] getname_flags+0x80/0x3b0 [ 253.249130][T14946] __x64_sys_execve+0x42/0x70 [ 253.249160][T14946] x64_sys_call+0x271a/0x3000 [ 253.249260][T14946] do_syscall_64+0xd2/0x200 [ 253.249280][T14946] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 253.249311][T14946] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 253.249346][T14946] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.249417][T14946] RIP: 0033:0x7fcc8e05efc9 [ 253.249434][T14946] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 253.249453][T14946] RSP: 002b:00007fcc8cac7038 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 253.249474][T14946] RAX: ffffffffffffffda RBX: 00007fcc8e2b5fa0 RCX: 00007fcc8e05efc9 [ 253.249488][T14946] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 253.249502][T14946] RBP: 00007fcc8cac7090 R08: 0000000000000000 R09: 0000000000000000 [ 253.249569][T14946] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 253.249594][T14946] R13: 00007fcc8e2b6038 R14: 00007fcc8e2b5fa0 R15: 00007ffecf569948 [ 253.249615][T14946] [ 253.753547][T14963] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 253.787992][T14963] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 253.787992][T14963] program syz.3.3924 not setting count and/or reply_len properly [ 253.915258][T14971] xt_hashlimit: size too large, truncated to 1048576 [ 253.968638][T14972] loop2: detected capacity change from 0 to 128 [ 254.008215][T14972] team0: Port device dummy0 removed [ 254.015839][T14972] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 254.301087][ T29] kauditd_printk_skb: 124 callbacks suppressed [ 254.301102][ T29] audit: type=1400 audit(2000000116.210:24667): avc: denied { read } for pid=14987 comm="syz.2.3932" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 254.386697][T14990] tipc: Started in network mode [ 254.391638][T14990] tipc: Node identity ea22fb27d196, cluster identity 4711 [ 254.398847][T14990] tipc: Enabled bearer , priority 0 [ 254.411961][T14988] tipc: Disabling bearer [ 254.419323][ T29] audit: type=1400 audit(2000000116.320:24668): avc: denied { create } for pid=14991 comm="syz.0.3933" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 254.542802][T14992] xt_hashlimit: invalid interval [ 254.700443][T15007] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 254.708694][T15007] loop1: detected capacity change from 0 to 256 [ 254.748080][T15007] FAT-fs (loop1): Directory bread(block 64) failed [ 254.754808][T15007] FAT-fs (loop1): Directory bread(block 65) failed [ 254.763708][T15007] FAT-fs (loop1): Directory bread(block 66) failed [ 254.779644][T15007] FAT-fs (loop1): Directory bread(block 67) failed [ 254.811395][T15007] FAT-fs (loop1): Directory bread(block 68) failed [ 254.818083][T15018] xt_hashlimit: size too large, truncated to 1048576 [ 254.844800][T15007] FAT-fs (loop1): Directory bread(block 69) failed [ 254.851344][T15007] FAT-fs (loop1): Directory bread(block 70) failed [ 254.863917][T15020] loop3: detected capacity change from 0 to 128 [ 254.929579][T15007] FAT-fs (loop1): Directory bread(block 71) failed [ 254.945419][T15007] FAT-fs (loop1): Directory bread(block 72) failed [ 254.951963][T15007] FAT-fs (loop1): Directory bread(block 73) failed [ 255.043895][T15025] loop1: detected capacity change from 0 to 512 [ 255.050646][T15025] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 255.083839][T15025] EXT4-fs error (device loop1): ext4_validate_block_bitmap:432: comm syz.1.3943: bg 0: block 104: invalid block bitmap [ 255.139526][ T29] audit: type=1400 audit(2000000117.040:24669): avc: denied { ioctl } for pid=15028 comm="syz.3.3944" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=251 ioctlcmd=0x54a5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 255.139600][T15025] ================================================================== [ 255.174279][T15025] BUG: KCSAN: data-race in data_alloc / prb_reserve [ 255.180881][T15025] [ 255.183207][T15025] write to 0xffffffff8686a748 of 8 bytes by task 29 on cpu 0: [ 255.190659][T15025] data_alloc+0x280/0x2e0 [ 255.194991][T15025] prb_reserve+0x807/0xaf0 [ 255.195013][T15025] vprintk_store+0x56d/0x860 [ 255.195037][T15025] vprintk_emit+0x10d/0x580 [ 255.195059][T15025] vprintk_default+0x26/0x30 [ 255.195081][T15025] vprintk+0x1d/0x30 [ 255.195107][T15025] _printk+0x79/0xa0 [ 255.195139][T15025] kauditd_hold_skb+0x1b1/0x1c0 [ 255.195166][T15025] kauditd_send_queue+0x273/0x2c0 [ 255.195193][T15025] kauditd_thread+0x421/0x630 [ 255.195215][T15025] kthread+0x489/0x510 [ 255.195241][T15025] ret_from_fork+0x122/0x1b0 [ 255.195264][T15025] ret_from_fork_asm+0x1a/0x30 [ 255.195288][T15025] [ 255.195293][T15025] read to 0xffffffff8686a748 of 8 bytes by task 15025 on cpu 1: [ 255.195311][T15025] prb_reserve+0x220/0xaf0 [ 255.195332][T15025] vprintk_store+0x56d/0x860 [ 255.195351][T15025] vprintk_emit+0x10d/0x580 [ 255.195371][T15025] vprintk_default+0x26/0x30 [ 255.276948][T15025] vprintk+0x1d/0x30 [ 255.280848][T15025] _printk+0x79/0xa0 [ 255.284749][T15025] __ext4_std_error+0x346/0x370 [ 255.289603][T15025] ext4_free_blocks+0x1367/0x1480 [ 255.294615][T15025] ext4_clear_blocks+0x2a2/0x2c0 [ 255.299636][T15025] ext4_ind_truncate+0x382/0x830 [ 255.304571][T15025] ext4_truncate+0x6e1/0xae0 [ 255.309158][T15025] ext4_process_orphan+0x110/0x1c0 [ 255.314263][T15025] ext4_orphan_cleanup+0x6a8/0xa00 [ 255.319365][T15025] ext4_fill_super+0x3483/0x3810 [ 255.324287][T15025] get_tree_bdev_flags+0x291/0x300 [ 255.329388][T15025] get_tree_bdev+0x1f/0x30 [ 255.333799][T15025] ext4_get_tree+0x1c/0x30 [ 255.338230][T15025] vfs_get_tree+0x57/0x1d0 [ 255.342634][T15025] do_new_mount+0x24d/0x660 [ 255.347124][T15025] path_mount+0x4a5/0xb70 [ 255.351450][T15025] __se_sys_mount+0x28c/0x2e0 [ 255.356119][T15025] __x64_sys_mount+0x67/0x80 [ 255.360698][T15025] x64_sys_call+0x2b51/0x3000 [ 255.365435][T15025] do_syscall_64+0xd2/0x200 [ 255.369923][T15025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.375809][T15025] [ 255.378115][T15025] value changed: 0xfffffffffffc6ee8 -> 0x000000000006c1e0 [ 255.385200][T15025] [ 255.387504][T15025] Reported by Kernel Concurrency Sanitizer on: [ 255.393653][T15025] CPU: 1 UID: 0 PID: 15025 Comm: syz.1.3943 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 255.405020][T15025] Tainted: [W]=WARN [ 255.408812][T15025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 255.418859][T15025] ================================================================== [ 255.139523][T15025] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 255.536179][T15025] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #11: comm syz.1.3943: invalid indirect mapped block 1 (level 1) [ 255.575003][T15025] EXT4-fs (loop1): 1 truncate cleaned up [ 255.584397][T15025] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 255.638292][ T29] audit: type=1326 audit(2000000117.550:24670): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15024 comm="syz.1.3943" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 255.684704][ T29] audit: type=1326 audit(2000000117.570:24671): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15024 comm="syz.1.3943" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 255.709041][ T29] audit: type=1326 audit(2000000117.570:24672): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15024 comm="syz.1.3943" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 255.732658][ T29] audit: type=1326 audit(2000000117.570:24673): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15024 comm="syz.1.3943" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 255.757274][ T29] audit: type=1326 audit(2000000117.570:24674): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15024 comm="syz.1.3943" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 255.780835][ T29] audit: type=1326 audit(2000000117.570:24675): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15024 comm="syz.1.3943" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 255.804994][ T29] audit: type=1326 audit(2000000117.570:24676): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15024 comm="syz.1.3943" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4f532efc9 code=0x7ffc0000 [ 255.870953][T12736] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 264.683324][ T9608] smc: removing ib device syz2 [ 264.690402][ T9597] dvmrp1 (unregistering): left allmulticast mode [ 264.819480][ T9597] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 264.830411][ T9597] bond0 (unregistering): Released all slaves [ 264.838712][ T9597] bond1 (unregistering): Released all slaves [ 264.846685][ T9597] bond2 (unregistering): Released all slaves [ 264.952094][ T9597] hsr_slave_0: left promiscuous mode [ 264.958297][ T9597] hsr_slave_1: left promiscuous mode [ 265.006699][ T9608] smc: removing ib device sz1