last executing test programs: 14m20.214615824s ago: executing program 0 (id=780): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000004180)=ANY=[@ANYBLOB="02000000040000"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r1}, 0x10) uname(&(0x7f00000000c0)=""/235) 14m19.763128741s ago: executing program 0 (id=782): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x12, 0x5, &(0x7f0000000040)=@framed={{0x45, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x18}, [@initr0]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x80) 14m19.749696161s ago: executing program 0 (id=783): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b000000080000000100010009"], 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b708000002001e007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000d00)='sched_switch\x00', r4}, 0x10) r5 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x0) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$incfs(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='./bus\x00', &(0x7f00000000c0), 0x0, 0x0) 14m18.855621573s ago: executing program 0 (id=790): mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000001007b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x18) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) 14m15.526415001s ago: executing program 0 (id=795): fchdir(0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, 0x0, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000002440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000010c0)=""/174, 0xae}, 0x7}], 0x1, 0x60010100, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) mount(&(0x7f0000002680)=@rnullb, 0x0, &(0x7f0000002700)='virtiofs\x00', 0x1108000, 0x0) mount$9p_tcp(0x0, &(0x7f0000000300)='./file0\x00', 0x0, 0x800002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x800) connect$unix(r5, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) sendmsg$nl_route_sched(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000780)=@newtaction={0x80, 0x30, 0xb, 0x0, 0x0, {}, [{0x6c, 0x1, [@m_skbedit={0x68, 0x1, 0x0, 0x0, {{0xc}, {0x3c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PTYPE={0x6, 0x4}, @TCA_SKBEDIT_PARMS={0x18}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x3}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x5, 0x10}}, @TCA_SKBEDIT_PTYPE={0x6}]}, {0x4}, {0xc, 0xa}, {0xc, 0x9, {0xf5}}}}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x10}, 0x0) 14m12.671844921s ago: executing program 0 (id=798): r0 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x5) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) lseek(r3, 0x929f, 0x1) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1600000000000000040000000500000000000000", @ANYRES32=0x1], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb70300000800"], 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r5}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe, 0x7}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x0) 13m57.549973725s ago: executing program 32 (id=798): r0 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x5) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) lseek(r3, 0x929f, 0x1) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1600000000000000040000000500000000000000", @ANYRES32=0x1], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb70300000800"], 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r5}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe, 0x7}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x0) 4.759237911s ago: executing program 3 (id=4023): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfd6c}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1}, 0x0, &(0x7f00000002c0)}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000004c0)={0x0, 0x0, 0x0, &(0x7f00000007c0), 0xffffd6c0, 0xffffffffffffffff, 0x0, 0x20}, 0x38) sendto$inet(r0, 0x0, 0xfffffffffffffe1a, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, &(0x7f0000000700)="0c268a927f1f6588b967481241ba78600a34f65ac618ded8974895abeaf4b4834ff959bcecc7a95425a3a07e758044ab4ea6f7c555d88fecf90b037511bf746bec66ba", 0x994b6e03113064ae, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f0000001500)={0x0, 0xa, &(0x7f0000002200)=[{&(0x7f00000035c0)=""/4106, 0x437aba2}], 0x1, 0x0, 0x46, 0x407006}, 0x104) 4.634011223s ago: executing program 3 (id=4026): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x0, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r2}, 0x18) timer_settime(r1, 0x0, &(0x7f0000000340)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x2, 0x0, &(0x7f0000000080)={0x0, 0x989680}, 0x0) 4.008039952s ago: executing program 2 (id=4028): pipe2$9p(&(0x7f0000000240), 0x0) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0xb0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r3}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x36, 0x0, 0x4000}, 0x28) write$FUSE_INIT(0xffffffffffffffff, &(0x7f00000001c0)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x4, 0x800000, 0x4, 0x400, 0x5, 0x1, 0x0, 0x0, 0x1, 0x74}}, 0x50) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0x14c}, 0x137) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, 0xffffffffffffffff, 0x0) syz_clone(0x20223000, 0x0, 0x0, 0x0, 0x0, 0x0) 3.830299304s ago: executing program 3 (id=4029): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r3}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 3.828820444s ago: executing program 4 (id=4030): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000340)='mm_page_alloc\x00', r1}, 0x18) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) 3.800404375s ago: executing program 4 (id=4031): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030"], 0x15) r2 = dup(r0) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, 0x0, 0xb0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r6}, 0x10) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB, @ANYRESHEX]) syz_clone(0x20223000, 0x0, 0x0, 0x0, 0x0, 0x0) 3.516033369s ago: executing program 5 (id=4033): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') read$FUSE(r1, &(0x7f000000cb80)={0x2020}, 0x206c) 3.394064361s ago: executing program 5 (id=4034): setitimer(0x0, 0x0, 0x0) 3.073423995s ago: executing program 5 (id=4035): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./file1\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x6, 0x35d, &(0x7f0000000f00)="$eJzs3c1rO0UYwPEnaZImKW1yEEVBOtiLXpY2ehaDtCAELG0jtoKwbTcasiYlG6oRse3Jq3j3JHgovVnwUND+A71404sI3noRPNiDurJvyeatLzFpfr/2+4GSycw8u7OZSXk27WYv3/3yo0rJ0kp6Q6JJJRERkSuRrEQlEPEfo245IWGH8srMnz+/uL5ZTHoVaiW/8WpOKTU3/8PHn6X8bmfTcpF9//KP3O8Xz148f/nvxodlS5UtVa01lK62a7829G3TULtlq6IptWoaumWoctUy6l77d/52zNreXlPp1d3Z9F7dsCylV5uqYjRVo6Ya9abSP9DLVaVpmppNC25SPF5b0/NDBu+MeDAYk3o9r0+JSKqnpXg8kQEBAICJ6s7/o05KP0z+vyVzhcLymnI6t/P/k5fOGzPvnM75+f9Zol/+/9ov3rY68n/ndKKd/9e884PSzfn/13KH/L83I3pchs7/s2MYDIYzn+ipinQ8c/L/tP/+dR29d7LoFsj/AQAAAAAAAAAAAAAAAAAAAAB4GlzZdsa27UzwGPy0LyHwn+NBGjT/0yKSdGbfZv4fsvXNLUm6F+45c2x+sV/cL3qPfodzETHF+Mfu5qyN4Moj5cjKj+aBH3+wX5xyW/IlKTvxsiQZybrrKRRv2ytvFZaXlMePb12mlA7H5yQjz4Tjv3dXpxOf64z395+QlxdC8Zpk5KcdqYkpu25ke/+fLyn15tuFrviU209Efrv3SQEAAAAAYMQ01dL3/F3TBrV73zKSL7kfExmyKBn5u//5/WLf8/NY5oXYpI8eAAAAAIDHwWp+WtElatTdgmn2K6RkYNMICrGOmriI9O2c6KqJX7flqdAR3nY8CfHuYPJ/j+ub4FW9S1TwjxTOwFtN/h1VZLjxBMfv1kRiw09T5FDcBXAYborKLcJj3YOfdypU384LA7dz5B9Iqyb42Cgx4HWW1d7tRK9ZCfGeGjsy3AJ47qtv/xrdG+T1U38FfHJz5yPTsA/kNpPSVXB20dsUH/svHgAAAAD3rp30BzVvhJvDNxIJ3yyHv9wDAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBCY/lKv67CpI8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFL8FwAA//8GuPOT") syz_emit_ethernet(0x5e, &(0x7f0000000000)={@broadcast, @empty, @val={@val={0x88a8, 0x0, 0x0, 0x2}, {0x8100, 0x6}}, {@canfd={0xd, {{0x2}, 0x29, 0x1, 0x0, 0x0, "5942736a2409c8d4ec7976d9ada7b4d127ba613cb3047b21658d99b0fab1f469bbca32f6d995b496b5f95f7dac027e88cfa075eb4bc612a560a89f19b2492899"}}}}, &(0x7f0000000080)={0x1, 0x2, [0xbfa, 0xd11, 0xde4, 0x109]}) r4 = open(&(0x7f0000000340)='./file1\x00', 0x185982, 0x3c) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x28011, r4, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) openat$uinput(0xffffffffffffff9c, &(0x7f0000000900), 0x802, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r5, 0x541b, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) read$FUSE(r4, &(0x7f00000018c0)={0x2020}, 0x2020) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) 3.072484346s ago: executing program 2 (id=4036): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYRES32=0x0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff}, 0x0) io_setup(0x9, &(0x7f0000003080)=0x0) io_getevents(r3, 0x1, 0x1, &(0x7f0000000000)=[{}], 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r1, 0x8983, &(0x7f0000000300)) io_submit(r3, 0x1, &(0x7f0000000940)=[&(0x7f0000001940)={0x0, 0x0, 0x0, 0x7, 0x0, r2, 0x0}]) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$tipc(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000580)="ad4308a803a93ae832cfe6d5ef23337e0f698efa258fa9d3bc1c9df29b8749c5ffd0074397d4b10c19ca158b9169fc747e0ce81800f6ab54701b60db0d358f0341b17544b7edabe88d90fc5a63b52a5eee75baf1278b9c106f3c728d86482d41a1b38f52ef3ad9e716e77953d785625a2279cf4fd6266ccaba213de2e35c65a01968cf04d00a1ca520baf750b816fafde164d33bfafb0fee4aae07b55527d4d61deda8a79a1be0238b8309d25f34019a61f0363bd8bdf6bae02edd9d34b01b8157e510898a6e7d7217224d331981b5c2bb14d88bdc317c7a88eb04c5ef7be4021f8dbbf25c65b82d0f787de0c0b87c2d51c21e948c9c8f8077e0341b04c4ff0c0f3e7a48fae5ca15222bc350f59307d42d0670f91610d4dec94cfbbbe3b383decd29515965a3059d4b2cbed6a77948d374d320ef04b9fd74c87eef26125b3e3418aca9bd8e98db179d57611d0f85528116cae7b18393dd78c7528c45e7a8d64db9adb31bb95564d75ff0dc06fb71fc52ee5c02779cb166d93180cbd74ab3fb7e19b3509381c4e2b6e9cb7953347d0993c3d7445d201aa1e11c8eace70bc364fb0572af4c00f9c53d1a8fa4702a792ff9a83eef082e90a18dadd9dcbbc808b8887be9f1b74d8bd5de8adfbcd46b7ab3df6ea858bff5a1b4b5d5f85a6df2e90f370f67e9b7b9e9e02f7b5cb615a86297b112bd735d61d66e25624c465d5a87bfc7f7ec3daac70d4abc99c7a12cc79a14e9a7618a86a295c0fd5cbd9f716ad49a35b152828c3a16bdd4b649d0bf6a1c80a500cdde4627b13751d91cb67fd9003ba3a91891f240be702f978e4e55354de192406defe3d84917f02e27855d6611d8ffc41f73ea5abd7b0f48ad277b691a27e5b747a7d8aa632920f3fce2788d4437fc23f59f9a4b4dbe7fa3460c5c4047277a8b02cb508a2c1853d14aa78689c4814b44391bfc4acc022e7119e9109d35225271c063d6d89d09347a8c1d2ab958bad1ac3890de420877b875272db3402a63da014a38c8ddb9568f00c7c29f31d11bcd473dac29c91247d570cc491384ece7f19ce3a3e4b2c8d72bde83120c3c7d38b49fbb640d7842f9f9a86b1ea6915b2121b72e281667bec82aeb7665d5dde31c6bceb7eb14f41f08d71faaf1b8f31f96564a8add5fbdb69045bfba0fbf3a4e1ea032bbbf3babe0de46ca56fd7738562e8c65c7ad1e8ecf3fe810cca9521a345af1d1bab6eac8a35e391bf1787bf16ee6050635188afa2f9b455c44690b2fecf9f40f08a10c7caf00744db2d389f2d618abcf44e5a45348c186fe926d1eb87f7b402735c05ae96544b5ab3367b60bdb4598152cea9f8f2844ca81fd5fd0b87383db0024db1d2b3c7469245793199cb5aba92dafaf2c90a9e1a93841ff78663ca97d8d51deba8cc06f3f5b7a1af71d3b65dfa48c9acd436bf364641db455d6e8e8ed644b30a4dd7806f1ba82f33c856c76e1f28ec3939e1ad0a7d38426e7af4ae49c0aa9e575a13d9d520aa84bd15090c28a142777e0b6a9d5ddd07918e3a20257a6be334196489ee60ba275d0b821d1ff315da51921111905409311b457fef71d2679a271752cd98cd9b0b1f871ec2e1e02525b41587f88a0bbf7bb63e34f8ca3975789c252a0b803518f2c03d327af92f9c2ed4ec9beb301da910331ad8a2d79c2c461362662c47859154ce8a26c9a12bcae161899a4005572dd3191cec8e4db0ab78816455c0a388c78a979c8ebe0593b23a7fd8681555d686507cf215dd4b1ce9ecd49fb7a4e2884f0449e40bf8eb6347f59a268e7a51441890200a4bb9e86aa18c088e5994699657d4d2d518bf83b59adc8220841e7ad807ed7adad95403d2319836d069b15d245ce013867121224e5e74371c32ff8cd9d19cc477ca36b5e0ac7c15041f2fe7f46a91a8c9cd089f4f38a6118f45f1fc9c48eb4820d355a869fecc2b391630b13aeacb2b745b22018d554a2b8d833f404784f1687d554089aedba3d7036788860bf66e8735603e6e2ed2235e8800931fdc30c9eec3d224650c5b58229faaa9cfacc31", 0x5a9}], 0x1, 0x0, 0x0, 0x4000}, 0x40080) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000021"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x18) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=@newsa={0x170, 0x10, 0x413, 0x0, 0x25dfdbfb, {{@in=@private=0xa010100, @in=@remote}, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x32}, @in=@dev={0xac, 0x14, 0x14, 0x44}, {}, {0x9, 0x0, 0x0, 0x5}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "25cac5216d1c8af0a976902918bf448c5d9f5459"}}, @replay_esn_val={0x20, 0x17, {0x1, 0x70bd27, 0x70bd2d, 0x70bd25, 0x70bd2d, 0x1, [0x5]}}]}, 0x170}}, 0x0) 2.969079017s ago: executing program 3 (id=4037): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, 0x0, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) 2.581357142s ago: executing program 1 (id=4038): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000010"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00'}, 0x10) r0 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) mkdir(&(0x7f0000000140)='./control\x00', 0x0) close(r0) r1 = inotify_init1(0x0) fcntl$setstatus(r1, 0x4, 0x2800) r2 = gettid() fcntl$setown(r0, 0x8, r2) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) rt_sigtimedwait(&(0x7f0000000600)={[0xffffffffffff7ffa]}, 0x0, 0x0, 0x8) inotify_add_watch(r1, &(0x7f0000000180)='./control\x00', 0x86000809) rmdir(&(0x7f0000001c00)='./control\x00') 2.556367283s ago: executing program 2 (id=4039): r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$inet(0x2, 0x200000003, 0x84) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r1, &(0x7f0000001280)={0x2, 0x0, @multicast1}, 0x10) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000200)="488592ccd2", 0x5}], 0x1) 2.542331093s ago: executing program 2 (id=4040): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x0, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r2}, 0x18) timer_settime(r1, 0x0, &(0x7f0000000340)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x2, 0x0, &(0x7f0000000080)={0x0, 0x989680}, 0x0) 2.524029473s ago: executing program 1 (id=4041): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000340)='mm_page_alloc\x00', r1}, 0x18) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) 2.481982254s ago: executing program 1 (id=4042): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x2, &(0x7f0000000180)={[{@errors_remount}, {@grpquota}]}, 0x2, 0x51f, &(0x7f0000000bc0)="$eJzs3W9rJHcdAPDvTLJnrpea1PqgFlqLrdwVvd1Lo23wQVtBfFZQ6vMzJHsxZJMN2U17iUVSfAGCiBZ85COfCL4AQeo7KIUDfS4qiuhVH4ioI7M720u2s5eE7mbD7ucDk/nNb/58v7/Z29n5dzMBTK1nIuLViJiJiOcjYqGoT4sujrpdPt0H999ay7t4L4nX/5ZEUtRFp/TAtWK2uW6vVOvgcGu10ajvFcO19vZurXVweHNze3WjvlHfWV5eenHlpZWYuzVoEd85Tzvzdr38tT/9+Ac///rLv/7im7+//Zcb38uzni/Gd9vxcOmJoZkzxe2umUq+LnL3/l3U750n+UssKdZtZdyJAABwJo9HxKci4nOd/f+FmInZ3ii7dAAAADAhslfm4z9JRAYAAABMrFc698AmabW4v3U+0rRa7d7D++l4JG00W+0v3Gnu76x375VdjEp6Z7NRv1Xc97kYlSQfXuqUHwy/0De8HBGPRcSPFq52hqtrzcb6uE9+AAAAwJS41nf8/8+F7vE/AAAAMGEWx50AAAAAMHKDjv+TC84DAAAAGB3X/wEAAGCifeO11/Iu673/ev2Ng/2t5hs31+utrer2/lp1rbm3W91oNjc6z+zbPm15jWZz90uxs3+31q632rXWweHt7eb+Tvv2Zu8V2AAAAMBFe+yz7/4uiYijr1ztdLkr+Z+ZATO4VwAmRnqeif84ujyAizfoZx6YfLPjTgAYn6PieB+YWice9VGyU3D85p0T5wzeG11OAADAcF3/TPn1//wQoDLu5ICROtf1f2CiuP4P06vs+v9vBk/+/ihzAS5WxR4ATL3TXvUx8OEdZ77+n2WnLgsAABip+Xzf/yiiWlwLnI80rVYjHu38V/9KcmezUb8VEZ+MiN8uVD6RDy915ky8HhAAAAAAAAAAAAAAAAAAAAAAAAAAzijLksgAAACAiRaR/jkp3v91feG5+f7zA1eSfy10+hHx5k9f/8nd1XZ7bymv//uH9e13ivoXxnEGAwAAAKbebH9F7zi9dxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMP0wf231nrdRcb961cjYrEs/mzMdfpzUYmIR/6RxOyx+ZKImBlC/KO3I+KJsvhJnlYsFln0x08j4urFxH8qy7I0SuJfG0J8mGbv5tufV8u+f2k80+mXf/9ni+7jGrz9Sz/c/s0M2P49esYYT977ZW1g/Lcjnpwt3/704icD4j9btsCSlfLtbx0eDoqf/SzieunvT3IiVq29vVtrHRze3Nxe3ahv1HeWl5deXHlp5csrt2p3Nhv14m9pjB8+9av/9VX9N+vqtD8GxF88pf3P5YXK8cb0hymC3bt7//FusdK3iE78G8+Wf/5PPCR+/m/i88XvQD7+eq981C0f9/Qv3n+6NLEi/vqA9p/2+d8YtNA+z3/z+38446QAwAVoHRxurTYa9b0hFvLlfnTUO1mWDT/WJS9klyONS1GYuxxpTEeh8rFmH8aZLQAA4LJ5sNN/jpm+O8KEAAAAAAAAAAAAAAAAAAAAYAq1DiId+BiwK8N5Gll/zKPxNBUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4KH+HwAA//9f2eLN") pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_selinux(r0, &(0x7f00000000c0), &(0x7f0000000e00)='system_u:object_r:sshd_exec_t:s0\x00', 0x21, 0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000008002b000000000000000018040000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x12, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="10d2eb4bc74a6201e40566f12207"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r1}, 0x10) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) 2.462219594s ago: executing program 1 (id=4043): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0x8, &(0x7f0000000e00)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00'}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x8, &(0x7f00000017c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546000677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289d01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5467a932b77674e802a0d42bc6099ad238af770b5ed8925161729298700000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809b5b9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed3957f813567f7a95435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0ac559eaf39027ceb379a902d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff7a1ef3282830689da6b53b263339863297771429d120000003341bf4abacac94500fca0493cf29b33dcc9ffffffffffffffd39f6ce0c6ff01589646efd1cf870cd7bb2366fdf870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1293b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd000c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c7df8be5877050c91301fb997316dbf17866fb84d4173731efe895ff2e1c55ef08235a0126e01254c44060926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a861887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc74aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7ad333545794f37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f4df90400000000000000d6b2c5ea139376f24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff070000001e48418046c216c1f895778cb25122a2a998de0842a486721737390cbf3a74cb2003016f1514216bdf57d2a40dddb51ab63e96ec84ac3571f02f647b3385b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba2f58ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df986741517abf11389b751f4e109b60000000000000000d6d5210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288d139bd3da230ed05a8fe64680b0a3f9f2dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30235b9100000000a55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c776f4b4ce07e1c6fa66fcfc7a228805f76785efc0ceb1c8e5729c66418d169fc03aa18854693ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7e478950aa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab848753203b458b97ec1afb079b4b4ba686fcdf240430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7db3c4be290159f6bcd75f0dda9de5532e71ae9e48b0ed1254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b70ebc660309e1e245b0fdf9743af932cd6db49a47613808bad959719c0000000000378ac2e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6ca0400966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e3030108000000000000c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bffef97dcecc467ace456597685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4cba6e6390a9f302c6eb2df7766411bef0ebb5000000000006065d6735eb7a00e127c0000000000000000000000bfb0bba79344643b1d8daa9f38e4b62c1e2af68c6f5054b078acd74b4a9c944e4505da485a3a4154387a0a88370d9ed9467b09c5888a06431df3f68abf0b366c4d5f8bea7b29c257ed756dff7a21c6b661cbdd43de65afd7f661d5c84f915c90e3d6ea012b68b787eb01d8320000000000000060176dacba0ec503a37fae6b472ec369c79ee6a420c0fd8d8d82fe136d5af6c30bfeb0a7275babfdb96a127aa9386e0671c6454245a18c1c8c49552cff5d27b547cdc34c0858c77a47a9ff86ee9fbd9ceda428716a4218821176d8067997527230fa67d26950d3e4f2750fa7c872874ad3a2d11f9f6eb08e6d7b6fa257b04d8ce36360f524e3dfd2211641f3d2637d86b80681eca50ce0eecafdd22d41fa515c15591e70ded4b70efac3cb42fb352d82e8f7573e8ed8248da356fa91a252976d3a4d8c1843a8d5bb7f5f1028453a0562a3ea93117076dd4940b7df50d78289fe66197525f6095f8662d232970bef61b03fa83027963a1a2e07cfee30c0d0b4c5877f93b3637ca21eab5afcf5d4638dfe8f9202aaad51c979049dd76d65368cbd4187d9f74257c7c4a23ac4a34eec5aa17e78c5167216f5e72138d20f8325dd5f8f96c32189c904eaef580987f1ce601a7cdc35461db9981ac42f9e24b0699bbe4e3d986e38952b0b7938eefd9e7a292bbb66367ad77045fdc18855c81c031dedd185c723238373fc698d676791d04f1ff5f0825a6619e844882f31ed190233d58ecee949e310bf2b1a51b8a33ae65a06d2b6ad386bf8dc49dd328bcd75d1843a13d68560175a18af7efc3c0f20e32f84f6aaaf000000000000000000000013a6c66bce74a8fb9092023df695da2714a7933d699d42de2bc4a85e0a0e22228290a7a7553ab93a16e42553ed86869a02df2f47d4088fac1772d3cd955c81cbf91c2ca7942942f61723b558079b82547844f92df2499c4b2c2ef2539e5daa8d8727baaa6b5755e6f83bbfca000000000000000000000509619f5f0cbc72eebc653946d3552236f0dfe485cfa71bd69f4ded6e131128c3875b785875addfcbd5931c12adbe"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x4c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x4c}}, 0x0) 1.681209126s ago: executing program 5 (id=4044): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001c80)={{r3}, &(0x7f0000001c00)=0x8000000, &(0x7f0000001c40)=r4}, 0x20) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 1.589676937s ago: executing program 2 (id=4045): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x60, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28}, @TCA_TBF_BURST={0x8, 0x6, 0x58}]}}]}, 0x60}}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000fb"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r5}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@gettclass={0x24, 0x2a, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}}}, 0x24}}, 0x0) 1.578506017s ago: executing program 4 (id=4046): setitimer(0x0, 0x0, 0x0) 1.573259877s ago: executing program 3 (id=4047): pipe2$9p(&(0x7f0000000240), 0x0) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0xb0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r3}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x36, 0x0, 0x4000}, 0x28) write$FUSE_INIT(0xffffffffffffffff, &(0x7f00000001c0)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x4, 0x800000, 0x4, 0x400, 0x5, 0x1, 0x0, 0x0, 0x1, 0x74}}, 0x50) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0x14c}, 0x137) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, 0xffffffffffffffff, 0x0) syz_clone(0x20223000, 0x0, 0x0, 0x0, 0x0, 0x0) 1.555324118s ago: executing program 4 (id=4048): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="070000000400000008000000010000000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000d00)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071105400000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0a00fe000000007313000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff31a8fd3c0fd8b7ff831028e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a83469620c6e74e1f46132559c4f8700a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a920099c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40fc5d2f55ff07c53147de202ce517b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661061173f359e9052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff26b61aac8aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3ba18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e26534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336dfaa6d5d164301190bc2d4c04087729033342045804a28082abc3b4762302a271722fb515f31e0dd115a292f1e68481a62c49d15ea5460a29c60b1058fb7aa9bf4ee3cbe11b03711a15d730646b72d074dab1e8c429339f3460d324c17a4a8bfc7d7eab45bef00664d6dc82300000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) 1.554870988s ago: executing program 1 (id=4049): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000050000000200"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r1}, 0x10) rmdir(&(0x7f0000001c00)='./control\x00') 1.526003428s ago: executing program 1 (id=4050): r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0xa000000d}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000400)={0xa}) syz_usb_connect(0x4, 0x24, 0x0, 0x0) epoll_pwait(r0, &(0x7f0000000080)=[{}], 0x1, 0x4c6, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) 573.681552ms ago: executing program 5 (id=4051): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000010"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00'}, 0x10) r0 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) mkdir(&(0x7f0000000140)='./control\x00', 0x0) close(r0) r1 = inotify_init1(0x0) fcntl$setstatus(r1, 0x4, 0x2800) r2 = gettid() fcntl$setown(r0, 0x8, r2) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) rt_sigtimedwait(&(0x7f0000000600)={[0xffffffffffff7ffa]}, 0x0, 0x0, 0x8) inotify_add_watch(r1, &(0x7f0000000180)='./control\x00', 0x86000809) rmdir(&(0x7f0000001c00)='./control\x00') 389.752144ms ago: executing program 2 (id=4052): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r3}, &(0x7f0000000040), &(0x7f0000000280)}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r4}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 383.044364ms ago: executing program 4 (id=4053): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r2, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x300) 364.703855ms ago: executing program 5 (id=4054): r0 = socket$can_bcm(0x1d, 0x2, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x80) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}, 0xc251}, {{0x0, 0x0, 0x0}, 0x7f}], 0x2, 0x10140, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000002540)=ANY=[@ANYBLOB="61156c000000000061134c0000000000bfa000000000000007000000080000002d0301000000000095000000000000006916000000000000bf67000000000000350607000fff0720670600001f000000160300000ee60060bf050000000000000f650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f674629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5480a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000005574d074fa7e93447a88c0fbab48660aae7cdf367ef0e4538279b6113de5b94e1056f443305145c9"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) 200.382397ms ago: executing program 4 (id=4055): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfd6c}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1}, 0x0, &(0x7f00000002c0)}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000004c0)={0x0, 0x0, 0x0, &(0x7f00000007c0), 0xffffd6c0, 0xffffffffffffffff, 0x0, 0x20}, 0x38) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0xfffffffffffffe1a, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, &(0x7f0000000700)="0c268a927f1f6588b967481241ba78600a34f65ac618ded8974895abeaf4b4834ff959bcecc7a95425a3a07e758044ab4ea6f7c555d88fecf90b037511bf746bec66ba", 0x994b6e03113064ae, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f0000001500)={0x0, 0xa, &(0x7f0000002200)=[{&(0x7f00000035c0)=""/4106, 0x437aba2}], 0x1, 0x0, 0x46, 0x407006}, 0x104) 0s ago: executing program 3 (id=4056): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r2, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x300) kernel console output (not intermixed with test programs): r parsing attributes in process `syz.3.1446'. [ 401.559957][ T1203] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 401.967535][ T4958] netlink: 192 bytes leftover after parsing attributes in process `syz.1.1455'. [ 401.977115][ T1203] usb 6-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 401.997881][ T1203] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 402.013753][ T1203] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 402.022939][ T1203] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 402.051775][ T1203] usb 6-1: config 0 descriptor?? [ 402.059994][ T1203] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 402.089433][ T4971] device xfrm1 entered promiscuous mode [ 402.132069][ T4981] overlayfs: conflicting options: nfs_export=on,index=off [ 402.480790][ T4988] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1469'. [ 402.537307][ T5015] netlink: 'syz.2.1480': attribute type 25 has an invalid length. [ 403.824676][ T5045] bridge0: port 3(syz_tun) entered blocking state [ 403.833017][ T5045] bridge0: port 3(syz_tun) entered disabled state [ 403.840139][ T5045] device syz_tun entered promiscuous mode [ 403.846716][ T5045] bridge0: port 3(syz_tun) entered blocking state [ 403.853229][ T5045] bridge0: port 3(syz_tun) entered forwarding state [ 403.867325][ T5045] device syz_tun left promiscuous mode [ 403.878297][ T5045] bridge0: port 3(syz_tun) entered disabled state [ 403.900007][ T5045] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 403.930218][ T5045] device bridge_slave_0 left promiscuous mode [ 403.945601][ T5045] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.974924][ T5045] device bridge_slave_1 left promiscuous mode [ 403.993047][ T5045] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.265478][ T339] usb 6-1: USB disconnect, device number 3 [ 407.474679][ T28] kauditd_printk_skb: 38 callbacks suppressed [ 407.474695][ T28] audit: type=1400 audit(1751401295.448:402): avc: denied { bind } for pid=5115 comm="syz.4.1521" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 407.521753][ T5120] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1522'. [ 407.532205][ T28] audit: type=1400 audit(1751401295.448:403): avc: denied { setopt } for pid=5115 comm="syz.4.1521" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 407.676450][ T5126] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=5126 comm=syz.1.1522 [ 407.958794][ T5144] tipc: Started in network mode [ 407.964247][ T5144] tipc: Node identity 7f000001, cluster identity 4711 [ 407.973750][ T5144] tipc: Enabled bearer , priority 10 [ 409.124550][ T5163] input: syz1 as /devices/virtual/input/input5 [ 409.168848][ T24] tipc: Node number set to 2130706433 [ 409.177588][ T28] audit: type=1326 audit(1751401297.148:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5164 comm="syz.4.1538" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f616278e929 code=0x7ffc0000 [ 409.202003][ T28] audit: type=1326 audit(1751401297.148:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5164 comm="syz.4.1538" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f616278e929 code=0x7ffc0000 [ 409.280771][ T28] audit: type=1326 audit(1751401297.238:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5164 comm="syz.4.1538" exe="/root/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7f616278e929 code=0x7ffc0000 [ 409.376708][ T28] audit: type=1326 audit(1751401297.238:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5164 comm="syz.4.1538" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f616278e929 code=0x7ffc0000 [ 409.488984][ T28] audit: type=1326 audit(1751401297.238:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5164 comm="syz.4.1538" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f616278e929 code=0x7ffc0000 [ 409.771050][ T28] audit: type=1400 audit(1751401297.738:409): avc: denied { ioctl } for pid=5199 comm="syz.1.1553" path="socket:[27361]" dev="sockfs" ino=27361 ioctlcmd=0x8912 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 409.918557][ T5203] tmpfs: Unknown parameter 'usrquota' [ 410.118263][ T28] audit: type=1400 audit(1751401298.088:410): avc: denied { mounton } for pid=5211 comm="syz.1.1559" path="/340/file0" dev="tmpfs" ino=1843 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 410.457880][ T28] audit: type=1400 audit(1751401298.408:411): avc: denied { read write } for pid=5223 comm="syz.5.1563" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 410.699872][ T5240] capability: warning: `syz.2.1570' uses deprecated v2 capabilities in a way that may be insecure [ 410.741205][ T5246] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 410.749034][ T5246] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 410.755854][ T5246] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 410.762634][ T5246] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 410.769357][ T5246] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 410.776102][ T5246] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 410.782863][ T5246] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 410.789610][ T5246] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 410.796402][ T5246] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 410.803162][ T5246] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 411.152378][ T5254] overlayfs: unrecognized mount option "smackfshat=workdir" or missing value [ 412.441371][ T5280] overlayfs: failed to clone upperpath [ 414.740402][ T5301] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 415.047882][ T5311] 9pnet: p9_errstr2errno: server reported unknown error @í00000000000000000004 [ 415.085241][ T5317] device wireguard2 entered promiscuous mode [ 415.103416][ T5320] device wireguard0 entered promiscuous mode [ 421.811589][ T5354] loop5: detected capacity change from 0 to 512 [ 421.848852][ T5362] device wireguard0 entered promiscuous mode [ 423.861894][ T5354] EXT4-fs: Ignoring removed nomblk_io_submit option [ 423.869063][ T5354] ext4: Unknown parameter 'subj_user' [ 424.058481][ T5377] netlink: 128 bytes leftover after parsing attributes in process `syz.4.1617'. [ 427.347779][ T5421] device wireguard1 entered promiscuous mode [ 428.483972][ T5431] 9pnet_fd: Insufficient options for proto=fd [ 428.652298][ T5447] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 430.478304][ T5462] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1640'. [ 430.788393][ T28] kauditd_printk_skb: 6 callbacks suppressed [ 430.788408][ T28] audit: type=1400 audit(1751401831.407:418): avc: denied { associate } for pid=5479 comm="syz.1.1645" name="core" scontext=root:object_r:etc_runtime_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 431.347318][ T5490] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1649'. [ 431.789911][ T5501] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 432.191669][ T5501] device xfrm1 left promiscuous mode [ 432.225952][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 432.676128][ T5513] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1655'. [ 433.547379][ T5523] device wireguard0 entered promiscuous mode [ 433.573160][ T5527] loop5: detected capacity change from 0 to 512 [ 433.606569][ T5527] EXT4-fs: Ignoring removed nomblk_io_submit option [ 433.711750][ T5527] ext4: Unknown parameter 'subj_user' [ 433.982121][ T5533] device wireguard0 entered promiscuous mode [ 433.998686][ T5536] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1662'. [ 434.062094][ T5542] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1666'. [ 434.506651][ T5564] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1673'. [ 434.669190][ T28] audit: type=1400 audit(1751401835.253:419): avc: denied { associate } for pid=5566 comm="syz.5.1674" name="pfkey" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 435.232069][ T5577] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1678'. [ 435.266000][ T5579] device wireguard2 entered promiscuous mode [ 435.343748][ T5584] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1675'. [ 435.508667][ T5585] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1681'. [ 437.005425][ T5622] loop5: detected capacity change from 0 to 512 [ 437.556920][ T5622] EXT4-fs error (device loop5): ext4_orphan_get:1400: inode #17: comm syz.5.1694: iget: bogus i_mode (0) [ 437.591803][ T5622] EXT4-fs error (device loop5): ext4_orphan_get:1405: comm syz.5.1694: couldn't read orphan inode 17 (err -117) [ 437.634348][ T5622] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 437.806369][ T5634] device wireguard2 entered promiscuous mode [ 438.256377][ T3013] EXT4-fs (loop5): unmounting filesystem. [ 438.432271][ T5653] loop5: detected capacity change from 0 to 512 [ 438.449732][ T5652] device wireguard0 entered promiscuous mode [ 438.467579][ T5653] EXT4-fs error (device loop5): ext4_orphan_get:1400: inode #17: comm syz.5.1703: iget: bogus i_mode (0) [ 438.485434][ T5653] EXT4-fs error (device loop5): ext4_orphan_get:1405: comm syz.5.1703: couldn't read orphan inode 17 (err -117) [ 438.498545][ T5653] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 441.317001][ T5689] cgroup: noprefix used incorrectly [ 441.430982][ T5628] EXT4-fs error (device loop5): ext4_validate_block_bitmap:429: comm ext4lazyinit: bg 0: block 7: invalid block bitmap [ 442.081933][ T3013] EXT4-fs (loop5): unmounting filesystem. [ 442.602320][ T5704] loop5: detected capacity change from 0 to 512 [ 442.610810][ T5704] EXT4-fs: Ignoring removed nomblk_io_submit option [ 442.623890][ T5704] ext4: Unknown parameter 'subj_user' [ 442.632158][ T5706] device wireguard1 entered promiscuous mode [ 442.975842][ T5710] device wireguard0 entered promiscuous mode [ 446.228428][ T5753] netlink: 'syz.1.1730': attribute type 25 has an invalid length. [ 446.468872][ T5760] cgroup: noprefix used incorrectly [ 448.612330][ T5780] netlink: 96 bytes leftover after parsing attributes in process `syz.5.1739'. [ 448.933019][ T5783] loop5: detected capacity change from 0 to 512 [ 449.000784][ T5783] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 449.009867][ T5783] ext4 filesystem being mounted at /145/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 449.039608][ T5783] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 449.056187][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 449.068020][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 449.098424][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 449.866424][ T3013] EXT4-fs (loop5): unmounting filesystem. [ 449.897732][ T5806] device wireguard2 entered promiscuous mode [ 449.943046][ T5813] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1748'. [ 451.340082][ T5831] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1754'. [ 451.749091][ T5843] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 451.786896][ T5843] device wireguard1 left promiscuous mode [ 454.299163][ T5879] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1768'. [ 454.775504][ T5881] loop5: detected capacity change from 0 to 512 [ 454.856106][ T5881] EXT4-fs: Ignoring removed nomblk_io_submit option [ 454.990374][ T5881] ext4: Unknown parameter 'subj_user' [ 458.967194][ T5917] 9pnet_fd: Insufficient options for proto=fd [ 459.470637][ T5909] device wireguard0 entered promiscuous mode [ 461.832101][ T5957] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1789'. [ 463.314574][ T5987] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 463.322789][ T5987] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 463.332610][ T5987] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 464.664717][ T6009] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 465.914237][ T6024] syz.4.1808[6024] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 465.914334][ T6024] syz.4.1808[6024] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 469.041470][ T6038] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1813'. [ 469.548977][ T6054] device wireguard0 entered promiscuous mode [ 469.874995][ T6065] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1819'. [ 471.337387][ T6085] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 471.369386][ T6085] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 471.379212][ T6085] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 471.505471][ T6088] device wireguard0 entered promiscuous mode [ 471.844643][ T6097] 9pnet_fd: Insufficient options for proto=fd [ 473.651799][ T6112] loop5: detected capacity change from 0 to 512 [ 473.975627][ T6112] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 473.985042][ T6112] ext4 filesystem being mounted at /163/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 475.974148][ T3013] EXT4-fs (loop5): unmounting filesystem. [ 476.079270][ T6133] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1834'. [ 477.350737][ T6151] netlink: 96 bytes leftover after parsing attributes in process `syz.5.1844'. [ 477.439255][ T6155] tipc: Started in network mode [ 477.454406][ T6155] tipc: Node identity 7f000001, cluster identity 4711 [ 477.474847][ T6155] tipc: Enabled bearer , priority 10 [ 477.576842][ T6159] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1848'. [ 477.798200][ T6164] cgroup: noprefix used incorrectly [ 477.808373][ T6164] loop5: detected capacity change from 0 to 1024 [ 478.100367][ T6164] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 478.851425][ T498] tipc: Node number set to 2130706433 [ 478.860197][ T3013] EXT4-fs (loop5): unmounting filesystem. [ 478.926070][ T6143] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1843'. [ 479.308152][ T6186] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1852'. [ 479.863124][ T6195] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1856'. [ 480.270856][ T6201] netlink: 96 bytes leftover after parsing attributes in process `syz.5.1858'. [ 480.294099][ T6205] tipc: Started in network mode [ 480.299081][ T6205] tipc: Node identity 7f000001, cluster identity 4711 [ 480.306737][ T6205] tipc: Enabled bearer , priority 10 [ 480.355715][ T6210] device wireguard1 entered promiscuous mode [ 480.438120][ T6217] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 480.511846][ T6218] cgroup: noprefix used incorrectly [ 480.798556][ T6217] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 480.936548][ T6216] loop5: detected capacity change from 0 to 16 [ 481.013629][ T6216] erofs: (device loop5): mounted with root inode @ nid 36. [ 481.626982][ T6216] erofs: (device loop5): z_erofs_readahead: readahead error at page 2 @ nid 89 [ 481.655060][ T6] tipc: Node number set to 2130706433 [ 481.661646][ T6217] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 481.754480][ T47] erofs: (device loop5): z_erofs_lz4_decompress_mem: failed to decompress 6887 in[4096, 0] out[8192] [ 481.766351][ T6216] erofs: (device loop5): z_erofs_lz4_decompress_mem: failed to decompress 6887 in[4096, 0] out[8192] [ 482.772349][ T6245] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1873'. [ 482.824035][ T6248] tipc: Enabling of bearer rejected, already enabled [ 488.288042][ T6324] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 488.297842][ T6326] device wireguard0 entered promiscuous mode [ 492.942669][ T6390] device wireguard0 entered promiscuous mode [ 494.568433][ T6402] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1922'. [ 499.349754][ T6461] device wireguard0 entered promiscuous mode [ 499.361928][ T6468] device wireguard0 entered promiscuous mode [ 500.405739][ T6486] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1948'. [ 502.472146][ T6521] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 502.847480][ T6526] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1961'. [ 502.930136][ T6533] device wireguard2 entered promiscuous mode [ 507.812291][ T6597] loop5: detected capacity change from 0 to 512 [ 507.831761][ T6597] EXT4-fs error (device loop5): ext4_orphan_get:1400: inode #17: comm syz.5.1981: iget: bogus i_mode (0) [ 507.843581][ T6597] EXT4-fs error (device loop5): ext4_orphan_get:1405: comm syz.5.1981: couldn't read orphan inode 17 (err -117) [ 507.856034][ T6597] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 511.169777][ T3013] EXT4-fs (loop5): unmounting filesystem. [ 511.525072][ T6633] device wireguard0 entered promiscuous mode [ 511.710948][ T6638] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1988'. [ 512.640987][ T6656] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1998'. [ 512.722942][ T6662] device wireguard1 entered promiscuous mode [ 513.950353][ T6684] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 517.073349][ T6714] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2011'. [ 517.129458][ T6708] device wireguard0 entered promiscuous mode [ 518.809286][ T6722] device wireguard1 entered promiscuous mode [ 519.390778][ T6739] loop5: detected capacity change from 0 to 512 [ 519.526354][ T6742] device wireguard1 entered promiscuous mode [ 519.746112][ T6739] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 519.885765][ T6739] ext4 filesystem being mounted at /207/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 521.218825][ T6760] netlink: 88 bytes leftover after parsing attributes in process `syz.4.2029'. [ 521.241302][ T6760] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2029'. [ 521.253845][ T6760] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2029'. [ 521.264383][ T6760] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2029'. [ 524.450405][ T6780] device wireguard0 entered promiscuous mode [ 525.036544][ T6789] device wireguard1 entered promiscuous mode [ 526.022747][ T6808] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2042'. [ 527.351105][ T3013] EXT4-fs (loop5): unmounting filesystem. [ 528.366887][ T6835] device wireguard1 entered promiscuous mode [ 528.379736][ T6838] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 528.407691][ T6833] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2049'. [ 528.677464][ T6846] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2054'. [ 531.624677][ T6874] netlink: 88 bytes leftover after parsing attributes in process `syz.3.2062'. [ 531.925754][ T6879] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2063'. [ 532.123851][ T6881] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 532.162058][ T6883] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2065'. [ 534.333519][ T6910] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 535.237131][ T6910] device wireguard0 left promiscuous mode [ 535.244142][ T6924] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2076'. [ 535.282815][ T6926] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 544.333210][ T6994] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2096'. [ 544.373845][ T6996] device wireguard1 entered promiscuous mode [ 546.021205][ T7028] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 546.597774][ T7036] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2109'. [ 547.558702][ T7052] device wireguard1 entered promiscuous mode [ 547.656328][ T7057] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2116'. [ 547.687420][ T7059] device wireguard1 entered promiscuous mode [ 550.612635][ T7084] device wireguard1 entered promiscuous mode [ 550.622881][ T7088] device wireguard1 entered promiscuous mode [ 550.631579][ T7090] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2128'. [ 551.356771][ T7100] device wireguard0 entered promiscuous mode [ 552.505275][ T7112] device ipip0 entered promiscuous mode [ 552.559252][ T7118] 9pnet_fd: Insufficient options for proto=fd [ 553.774300][ T7141] 9pnet_fd: Insufficient options for proto=fd [ 553.783199][ T7135] device wireguard1 entered promiscuous mode [ 554.236045][ T7148] device wireguard0 entered promiscuous mode [ 554.331502][ T7151] device wireguard1 entered promiscuous mode [ 554.411258][ T7154] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2146'. [ 554.699086][ T7156] 9pnet_fd: Insufficient options for proto=fd [ 555.095989][ T7174] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2155'. [ 555.319734][ T28] audit: type=1326 audit(1751401955.784:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7175 comm="syz.1.2156" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5bb998e929 code=0x0 [ 556.746702][ T7186] device wireguard1 entered promiscuous mode [ 557.244413][ T7193] device wireguard1 entered promiscuous mode [ 557.434078][ T7196] 9pnet_fd: Insufficient options for proto=fd [ 557.450963][ T7198] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2163'. [ 557.469697][ T7198] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2163'. [ 557.561602][ T7198] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2163'. [ 557.570740][ T7200] device wireguard1 entered promiscuous mode [ 557.590157][ T7206] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2166'. [ 557.760175][ T7216] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2170'. [ 558.694034][ T7224] device wireguard0 entered promiscuous mode [ 558.911450][ T28] audit: type=1326 audit(1751401959.384:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7219 comm="syz.1.2171" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5bb998e929 code=0x0 [ 559.295882][ T7243] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2179'. [ 559.665363][ T7251] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2181'. [ 561.112150][ T7275] device wireguard2 entered promiscuous mode [ 561.124073][ T7276] device wireguard0 entered promiscuous mode [ 561.233320][ T7280] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2190'. [ 561.256690][ T7282] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2191'. [ 561.722348][ T7289] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 562.017239][ T7295] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2195'. [ 562.043159][ T7297] 9pnet: Could not find request transport: f [ 563.343398][ T7304] __nla_validate_parse: 2 callbacks suppressed [ 563.343438][ T7304] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2196'. [ 563.764297][ T7317] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2203'. [ 563.778148][ T7316] device wireguard2 entered promiscuous mode [ 563.809848][ T7314] device wireguard0 entered promiscuous mode [ 564.524640][ T7339] device wireguard0 entered promiscuous mode [ 566.728755][ T7374] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2216'. [ 567.776649][ T7375] incfs: Backing dir is not set, filesystem can't be mounted. [ 567.784428][ T7375] incfs: mount failed -2 [ 568.306221][ T7401] syz.3.2227[7401] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 568.307644][ T7401] syz.3.2227[7401] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 571.167980][ T28] audit: type=1400 audit(1751401971.624:422): avc: denied { write } for pid=7422 comm="syz.5.2233" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 571.202015][ T28] audit: type=1400 audit(1751401971.624:423): avc: denied { add_name } for pid=7422 comm="syz.5.2233" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 571.222995][ T28] audit: type=1400 audit(1751401971.624:424): avc: denied { create } for pid=7422 comm="syz.5.2233" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 571.251673][ T28] audit: type=1400 audit(1751401971.624:425): avc: denied { associate } for pid=7422 comm="syz.5.2233" name="file0" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 571.399979][ T7438] incfs: Backing dir is not set, filesystem can't be mounted. [ 571.407632][ T7438] incfs: mount failed -2 [ 571.448012][ T7436] tipc: Enabled bearer , priority 10 [ 571.707864][ T7446] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 572.966867][ T7464] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2245'. [ 573.801950][ T7471] 9pnet: Could not find request transport: fd0x0000000000000006 [ 573.918362][ T7478] tipc: Enabling of bearer rejected, already enabled [ 574.231728][ T7481] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 574.393375][ T7486] cgroup: noprefix used incorrectly [ 575.502529][ T7492] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2257'. [ 575.504746][ T7498] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2259'. [ 575.546239][ T7494] device wireguard2 entered promiscuous mode [ 575.619104][ T7495] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 577.591708][ T7534] device wireguard2 entered promiscuous mode [ 579.267641][ T7538] cgroup: noprefix used incorrectly [ 579.345486][ T7555] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2276'. [ 579.699372][ T7558] 9pnet_fd: Insufficient options for proto=fd [ 581.422374][ T7571] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 582.027592][ T7591] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2286'. [ 582.061005][ T7592] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 582.083885][ T7594] device wireguard0 entered promiscuous mode [ 582.092974][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 582.104683][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 582.394747][ T7601] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2289'. [ 582.484919][ T7605] 9pnet: Could not find request transport: f [ 582.808780][ T7611] 9pnet_fd: Insufficient options for proto=fd [ 583.874515][ T7625] device wireguard2 entered promiscuous mode [ 583.949420][ T7632] cgroup: noprefix used incorrectly [ 585.651790][ T7637] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2300'. [ 585.890547][ T7654] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 585.935384][ T7654] device ipip0 left promiscuous mode [ 586.910746][ T7677] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2314'. [ 587.084356][ T7691] loop5: detected capacity change from 0 to 512 [ 587.123973][ T7691] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 587.137402][ T7691] ext4 filesystem being mounted at /267/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 587.165091][ T7691] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 589.161961][ T3013] EXT4-fs (loop5): unmounting filesystem. [ 589.410248][ T7716] cgroup: noprefix used incorrectly [ 590.557547][ T7718] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2327'. [ 590.758591][ T7724] device wireguard0 entered promiscuous mode [ 591.213972][ T7742] cgroup: noprefix used incorrectly [ 592.029002][ T7755] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2340'. [ 592.100031][ T7761] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 592.118034][ T7763] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2342'. [ 592.149395][ T7763] sch_tbf: burst 88 is lower than device veth5 mtu (1514) ! [ 592.750180][ T7777] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2343'. [ 593.922937][ T7796] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2355'. [ 594.756623][ T7800] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 594.790452][ T7802] device wireguard1 entered promiscuous mode [ 594.893713][ T7808] cgroup: noprefix used incorrectly [ 596.367301][ T7814] device wireguard1 entered promiscuous mode [ 596.543180][ T7820] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 596.551460][ T7820] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 596.561920][ T7820] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 596.585402][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 596.593607][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 597.375224][ T7833] device wireguard2 entered promiscuous mode [ 597.517804][ T7838] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 597.876112][ T7852] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2370'. [ 598.103333][ T7854] device wireguard2 entered promiscuous mode [ 598.127324][ T7860] device wireguard0 entered promiscuous mode [ 598.330863][ T7868] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 599.138848][ T7879] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 599.372402][ T7881] device wireguard2 entered promiscuous mode [ 600.351175][ T7894] device wireguard1 entered promiscuous mode [ 601.609179][ T7909] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2390'. [ 603.891252][ T7941] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 607.058925][ T7961] device wireguard0 entered promiscuous mode [ 607.491851][ T7973] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2410'. [ 607.575541][ T7970] 9pnet_fd: Insufficient options for proto=fd [ 610.161288][ T8011] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2420'. [ 610.213724][ T8011] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 611.114003][ T8031] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 611.386363][ T8035] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 611.535225][ T28] audit: type=1326 audit(1751402012.004:426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8036 comm="syz.1.2429" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5bb998e929 code=0x0 [ 611.859218][ T8051] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2434'. [ 613.340459][ T8066] device wireguard2 entered promiscuous mode [ 613.365070][ T8072] device wireguard1 entered promiscuous mode [ 615.705791][ T8105] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2444'. [ 616.420857][ T8120] device wireguard0 entered promiscuous mode [ 620.136203][ T8163] device wireguard2 entered promiscuous mode [ 622.580663][ T8207] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 623.076387][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth5: link becomes ready [ 623.086437][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth4: link becomes ready [ 623.583114][ T8217] device wireguard1 entered promiscuous mode [ 624.210345][ T8236] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2488'. [ 624.269596][ T8237] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2486'. [ 624.872866][ T8248] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 624.883061][ T8248] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 624.897256][ T8248] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 626.501963][ T8264] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 626.527823][ T8262] device wireguard2 entered promiscuous mode [ 632.122847][ T8335] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 632.407969][ T8349] 9pnet_fd: Insufficient options for proto=fd [ 634.721241][ T8371] device wireguard0 entered promiscuous mode [ 634.867716][ T8375] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2526'. [ 634.905218][ T8375] sch_tbf: burst 88 is lower than device veth7 mtu (1514) ! [ 634.928176][ T8381] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 635.012679][ T8387] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 635.039547][ T8161] IPv6: ADDRCONF(NETDEV_CHANGE): veth7: link becomes ready [ 635.167259][ T8161] IPv6: ADDRCONF(NETDEV_CHANGE): veth6: link becomes ready [ 635.573567][ T8393] cgroup: noprefix used incorrectly [ 636.749154][ T8400] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2534'. [ 636.791976][ T8400] sch_tbf: burst 88 is lower than device veth5 mtu (1514) ! [ 636.827311][ T8407] device wireguard0 entered promiscuous mode [ 637.524442][ T8418] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 639.699775][ T8460] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 639.720827][ T8458] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2552'. [ 639.731482][ T8462] tipc: Started in network mode [ 639.736460][ T8462] tipc: Node identity 7f000001, cluster identity 4711 [ 639.743854][ T8462] tipc: Enabled bearer , priority 10 [ 639.999391][ T8469] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2555'. [ 640.869742][ T219] tipc: Node number set to 2130706433 [ 642.226944][ T8495] tipc: Enabling of bearer rejected, already enabled [ 642.275337][ T8499] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 643.028875][ T8516] cgroup: noprefix used incorrectly [ 644.318028][ T8532] tipc: Enabling of bearer rejected, already enabled [ 644.728780][ T8540] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2571'. [ 645.157385][ T8546] device wireguard0 entered promiscuous mode [ 645.644429][ T8558] cgroup: noprefix used incorrectly [ 647.283700][ T8572] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 648.276285][ T8586] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2592'. [ 649.636597][ T8614] syz.4.2600[8614] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 649.637185][ T8614] syz.4.2600[8614] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 651.756545][ T8621] device wireguard0 entered promiscuous mode [ 652.170180][ T8629] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2606'. [ 652.781110][ T8643] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2607'. [ 652.974146][ T8650] device wireguard0 entered promiscuous mode [ 653.635225][ T8667] device wireguard0 entered promiscuous mode [ 653.803046][ T8673] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2619'. [ 654.727572][ T8682] device wireguard1 entered promiscuous mode [ 655.859177][ T8711] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2628'. [ 656.103694][ T8717] device wireguard0 entered promiscuous mode [ 656.651985][ T8723] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2633'. [ 657.058808][ T8729] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2635'. [ 657.145972][ T8731] device wireguard2 entered promiscuous mode [ 659.060107][ T8765] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2647'. [ 659.075996][ T8767] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2646'. [ 659.096263][ T8767] sch_tbf: burst 88 is lower than device veth9 mtu (1514) ! [ 659.111253][ T8765] sch_tbf: burst 88 is lower than device veth5 mtu (1514) ! [ 661.115446][ T8783] device wireguard1 entered promiscuous mode [ 661.231542][ T8788] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2652'. [ 662.261828][ T8800] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2655'. [ 662.347932][ T8806] device wireguard1 entered promiscuous mode [ 662.367068][ T8810] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2658'. [ 663.760437][ T8838] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2666'. [ 664.149758][ T8844] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 665.416705][ T8855] 9pnet: Could not find request transport: f [ 666.978455][ T8872] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2676'. [ 667.346953][ T8877] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 667.369240][ T8880] device wireguard1 entered promiscuous mode [ 672.157107][ T8933] device wireguard1 entered promiscuous mode [ 673.367330][ T8947] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2696'. [ 674.290409][ T8967] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 674.295414][ T8966] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 674.317713][ T8966] device wireguard0 left promiscuous mode [ 674.327751][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth9: link becomes ready [ 674.342700][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth8: link becomes ready [ 676.678316][ T9004] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2713'. [ 677.030190][ T9006] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 677.130489][ T9012] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2719'. [ 677.219027][ T9021] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 677.456275][ T9024] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2722'. [ 677.681603][ T9027] device wireguard0 entered promiscuous mode [ 678.969413][ T9049] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2728'. [ 678.996124][ T9048] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 679.317713][ T9062] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2726'. [ 681.141834][ T9083] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 681.167587][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 681.175650][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 681.183449][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth5: link becomes ready [ 681.191297][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth4: link becomes ready [ 682.173244][ T9106] cgroup: noprefix used incorrectly [ 683.116331][ T9120] tipc: Enabling of bearer rejected, already enabled [ 683.679869][ T9125] syz.1.2750[9125] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 683.679948][ T9125] syz.1.2750[9125] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 683.775497][ T9131] device wireguard0 entered promiscuous mode [ 683.946747][ T9138] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 683.955170][ T9138] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 683.965060][ T9138] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 683.983396][ T3322] IPv6: ADDRCONF(NETDEV_CHANGE): veth5: link becomes ready [ 683.991479][ T3322] IPv6: ADDRCONF(NETDEV_CHANGE): veth4: link becomes ready [ 685.287984][ T9161] tipc: Enabling of bearer rejected, already enabled [ 686.146994][ T9171] cgroup: noprefix used incorrectly [ 686.319154][ T9178] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 686.725895][ T9182] bridge0: port 1(bridge_slave_0) entered blocking state [ 686.740420][ T9182] bridge0: port 1(bridge_slave_0) entered disabled state [ 686.756620][ T9182] device bridge_slave_0 entered promiscuous mode [ 686.772355][ T9182] bridge0: port 2(bridge_slave_1) entered blocking state [ 686.787712][ T9182] bridge0: port 2(bridge_slave_1) entered disabled state [ 686.803218][ T9182] device bridge_slave_1 entered promiscuous mode [ 686.971451][ T9182] bridge0: port 2(bridge_slave_1) entered blocking state [ 686.978586][ T9182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 686.986011][ T9182] bridge0: port 1(bridge_slave_0) entered blocking state [ 686.993077][ T9182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 687.012435][ T3322] tipc: Disabling bearer [ 687.017872][ T3322] tipc: Left network mode [ 687.025406][ T5693] bridge0: port 1(bridge_slave_0) entered disabled state [ 687.033138][ T5693] bridge0: port 2(bridge_slave_1) entered disabled state [ 687.040834][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 687.052543][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 687.075823][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 687.086751][ T5693] bridge0: port 1(bridge_slave_0) entered blocking state [ 687.093863][ T5693] bridge0: port 1(bridge_slave_0) entered forwarding state [ 687.102826][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 687.111164][ T5693] bridge0: port 2(bridge_slave_1) entered blocking state [ 687.118246][ T5693] bridge0: port 2(bridge_slave_1) entered forwarding state [ 687.125838][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 687.151283][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 687.177028][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 687.187230][ T9196] tipc: Enabling of bearer rejected, already enabled [ 687.204498][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 687.218430][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 687.228605][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 687.238987][ T9182] device veth0_vlan entered promiscuous mode [ 687.256247][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 687.272652][ T9182] device veth1_macvtap entered promiscuous mode [ 687.340723][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 687.364088][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 687.882445][ T3322] device veth1_macvtap left promiscuous mode [ 687.888676][ T3322] device veth0_vlan left promiscuous mode [ 688.027798][ T9211] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 688.303982][ T9217] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2783'. [ 689.395985][ T9220] cgroup: noprefix used incorrectly [ 689.473496][ T9225] loop3: detected capacity change from 0 to 512 [ 689.502475][ T9225] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 689.512234][ T9225] ext4 filesystem being mounted at /1/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 689.611622][ T9225] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 689.618998][ T9225] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 689.641158][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 689.652736][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 689.667091][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 689.675752][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 689.684414][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 689.693100][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 689.702084][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 689.710864][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 690.037323][ T9235] tipc: Enabling of bearer rejected, already enabled [ 690.200349][ T9182] EXT4-fs (loop3): unmounting filesystem. [ 690.301937][ T9246] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2791'. [ 692.197447][ T9269] tipc: Enabling of bearer rejected, already enabled [ 695.562738][ T9299] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 696.490492][ T9311] tipc: Enabling of bearer rejected, already enabled [ 696.728964][ T9315] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2812'. [ 697.138308][ T9328] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2818'. [ 697.858890][ T9341] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 698.922228][ T9362] tipc: Enabling of bearer rejected, already enabled [ 704.605704][ T9429] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 705.002915][ T9437] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 705.923785][ T9451] bridge0: port 1(bridge_slave_0) entered blocking state [ 705.931360][ T9451] bridge0: port 1(bridge_slave_0) entered disabled state [ 705.939176][ T9451] device bridge_slave_0 entered promiscuous mode [ 705.947202][ T9451] bridge0: port 2(bridge_slave_1) entered blocking state [ 705.954576][ T9451] bridge0: port 2(bridge_slave_1) entered disabled state [ 705.962394][ T9451] device bridge_slave_1 entered promiscuous mode [ 706.038248][ T9451] bridge0: port 2(bridge_slave_1) entered blocking state [ 706.045379][ T9451] bridge0: port 2(bridge_slave_1) entered forwarding state [ 706.052802][ T9451] bridge0: port 1(bridge_slave_0) entered blocking state [ 706.059882][ T9451] bridge0: port 1(bridge_slave_0) entered forwarding state [ 706.082586][ T318] tipc: Disabling bearer [ 706.087970][ T318] tipc: Left network mode [ 706.093632][ T326] bridge0: port 1(bridge_slave_0) entered disabled state [ 706.101319][ T326] bridge0: port 2(bridge_slave_1) entered disabled state [ 706.108948][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 706.117782][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 706.137706][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 706.179316][ T326] bridge0: port 1(bridge_slave_0) entered blocking state [ 706.186421][ T326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 706.212425][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 706.233923][ T326] bridge0: port 2(bridge_slave_1) entered blocking state [ 706.241049][ T326] bridge0: port 2(bridge_slave_1) entered forwarding state [ 706.360567][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 706.368817][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 707.681190][ T9451] device veth0_vlan entered promiscuous mode [ 708.251567][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 708.271516][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 708.362689][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 708.375665][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 708.406437][ T9451] device veth1_macvtap entered promiscuous mode [ 708.419218][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 708.429708][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 708.444223][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 709.315235][ T3322] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 709.344058][ T3322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 709.404475][ T9488] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 709.432068][ T3322] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 709.457663][ T3322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 709.955992][ T318] device bridge_slave_1 left promiscuous mode [ 709.962333][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 709.970036][ T318] device bridge_slave_0 left promiscuous mode [ 709.976199][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 709.984545][ T318] device veth1_macvtap left promiscuous mode [ 709.990699][ T318] device veth0_vlan left promiscuous mode [ 711.181910][ T9511] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 712.685724][ T9533] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2876'. [ 712.760419][ T9536] sch_tbf: burst 88 is lower than device veth11 mtu (1514) ! [ 712.938998][ T9546] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 713.077324][ T9549] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2875'. [ 714.117540][ T9566] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2882'. [ 716.247474][ T9588] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2885'. [ 717.301045][ T9598] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2892'. [ 718.899182][ T9610] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 719.244876][ T9610] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 719.486279][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 719.500942][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 719.514363][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 719.594616][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 719.603108][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 719.611553][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 719.634303][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 719.643089][ T5693] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 719.755734][ T9632] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2901'. [ 719.969197][ T9631] sch_tbf: burst 88 is lower than device bond_slave_0 mtu (1514) ! [ 720.282611][ T9638] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 720.298452][ T9638] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 720.326309][ T9638] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 720.570774][ T9639] 9pnet_fd: Insufficient options for proto=fd [ 721.002840][ T9643] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2905'. [ 722.130011][ T9661] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 722.155903][ T9661] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 722.165536][ T9661] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 723.030060][ T9663] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 723.633950][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth11: link becomes ready [ 723.762485][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth10: link becomes ready [ 727.196095][ T9701] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2921'. [ 728.839901][ T9708] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2922'. [ 729.306285][ T9727] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 730.117473][ T9730] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2926'. [ 733.338241][ T28] audit: type=1326 audit(1751402133.804:427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9755 comm="syz.3.2936" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c8fb8e929 code=0x0 [ 736.597921][ T9787] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2945'. [ 737.626271][ T9808] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 739.521724][ T9822] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 740.201431][ T9834] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 740.392324][ T9836] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2951'. [ 743.080357][ T9856] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2964'. [ 743.212055][ T9858] sch_tbf: burst 88 is lower than device veth13 mtu (1514) ! [ 744.633315][ T9874] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 744.654838][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth13: link becomes ready [ 744.668009][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth12: link becomes ready [ 749.913630][ T9960] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2994'. [ 750.039822][ T9955] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2987'. [ 751.795719][ T9987] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2996'. [ 752.021998][ T9992] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3001'. [ 752.333323][ T9997] tipc: Enabling of bearer rejected, already enabled [ 752.975714][T10013] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3010'. [ 753.015345][T10013] sch_tbf: burst 88 is lower than device veth5 mtu (1514) ! [ 753.035672][T10007] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 753.218287][T10019] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3012'. [ 753.572258][T10024] cgroup: noprefix used incorrectly [ 753.673310][T10027] cgroup: noprefix used incorrectly [ 753.986126][T10032] tipc: Started in network mode [ 753.991885][T10032] tipc: Node identity 7f000001, cluster identity 4711 [ 753.999121][T10032] tipc: Enabled bearer , priority 10 [ 755.330767][ T6] tipc: Node number set to 2130706433 [ 756.913913][T10058] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3024'. [ 757.626974][T10072] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 757.644305][T10072] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 757.670410][T10072] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 759.095273][T10081] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 759.122390][T10084] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3029'. [ 759.167137][T10083] tipc: Enabling of bearer rejected, already enabled [ 761.128484][T10111] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3041'. [ 761.174329][T10111] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 761.622800][T10120] device wireguard0 entered promiscuous mode [ 761.643370][T10125] tipc: Enabling of bearer rejected, already enabled [ 762.596917][T10145] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3051'. [ 763.431988][T10160] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 763.467078][ T3322] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 763.476008][ T3322] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 763.486055][T10150] bridge0: port 1(bridge_slave_0) entered blocking state [ 763.495645][T10150] bridge0: port 1(bridge_slave_0) entered disabled state [ 763.504133][T10150] device bridge_slave_0 entered promiscuous mode [ 763.512029][T10150] bridge0: port 2(bridge_slave_1) entered blocking state [ 763.519178][T10150] bridge0: port 2(bridge_slave_1) entered disabled state [ 763.527039][T10150] device bridge_slave_1 entered promiscuous mode [ 763.615572][T10150] bridge0: port 2(bridge_slave_1) entered blocking state [ 763.622697][T10150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 763.630041][T10150] bridge0: port 1(bridge_slave_0) entered blocking state [ 763.637087][T10150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 763.662244][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 763.669880][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 763.677553][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 763.685329][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 763.694842][ T3322] tipc: Disabling bearer [ 763.700243][ T3322] tipc: Left network mode [ 763.705486][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 763.713838][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 763.720986][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 763.728415][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 763.737193][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 763.744270][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 763.766542][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 763.775579][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 763.783924][T10165] tipc: Enabling of bearer rejected, already enabled [ 763.802917][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 763.825030][T10150] device veth0_vlan entered promiscuous mode [ 763.832123][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 763.841007][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 763.848778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 763.870505][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 763.879213][T10150] device veth1_macvtap entered promiscuous mode [ 763.891550][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 763.906858][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 766.416607][T10200] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 766.712414][ T3322] device bridge_slave_1 left promiscuous mode [ 766.720096][ T3322] bridge0: port 2(bridge_slave_1) entered disabled state [ 766.735498][ T3322] device bridge_slave_0 left promiscuous mode [ 766.745972][ T3322] bridge0: port 1(bridge_slave_0) entered disabled state [ 766.764918][ T3322] device veth1_macvtap left promiscuous mode [ 766.771151][ T3322] device veth0_vlan left promiscuous mode [ 767.139818][T10206] tipc: Enabling of bearer rejected, already enabled [ 767.180297][T10209] device wireguard1 entered promiscuous mode [ 769.680566][T10243] tipc: Enabling of bearer rejected, already enabled [ 769.760294][T10250] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3082'. [ 769.850423][T10254] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3081'. [ 772.331183][T10284] tipc: Started in network mode [ 772.346788][T10284] tipc: Node identity 7f000001, cluster identity 4711 [ 772.404047][T10290] loop4: detected capacity change from 0 to 16 [ 772.415756][T10290] erofs: (device loop4): mounted with root inode @ nid 36. [ 772.424904][T10290] erofs: (device loop4): z_erofs_readahead: readahead error at page 2 @ nid 89 [ 772.436947][ T46] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress 6887 in[4096, 0] out[8192] [ 772.448253][T10290] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress 6887 in[4096, 0] out[8192] [ 772.948424][T10284] tipc: Enabled bearer , priority 10 [ 773.104893][T10301] loop4: detected capacity change from 0 to 512 [ 773.272042][T10301] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 773.281562][T10301] ext4 filesystem being mounted at /6/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 773.369050][T10300] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 774.174822][T10150] EXT4-fs (loop4): unmounting filesystem. [ 774.181207][ T24] tipc: Node number set to 2130706433 [ 774.422885][T10319] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 776.275553][T10336] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 778.007303][T10355] syz.2.3109[10355] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 778.008354][T10355] syz.2.3109[10355] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 783.688770][T10368] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3115'. [ 784.385404][T10380] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 784.770157][T10394] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 786.097058][T10405] cgroup: noprefix used incorrectly [ 786.679841][T10410] syz.3.3127[10410] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 786.679929][T10410] syz.3.3127[10410] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 789.095504][T10412] syz.4.3128[10412] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 789.107149][T10412] syz.4.3128[10412] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 790.400762][T10417] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 790.628775][T10422] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3132'. [ 791.247343][T10431] loop4: detected capacity change from 0 to 512 [ 791.265556][T10431] EXT4-fs error (device loop4): ext4_orphan_get:1400: inode #17: comm syz.4.3135: iget: bogus i_mode (0) [ 791.277568][T10431] EXT4-fs error (device loop4): ext4_orphan_get:1405: comm syz.4.3135: couldn't read orphan inode 17 (err -117) [ 791.290346][T10431] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 791.634153][T10150] EXT4-fs (loop4): unmounting filesystem. [ 791.651932][T10415] tipc: Disabling bearer [ 791.657568][T10415] tipc: Left network mode [ 791.860900][T10445] bridge0: port 1(bridge_slave_0) entered blocking state [ 791.897857][T10445] bridge0: port 1(bridge_slave_0) entered disabled state [ 791.910685][T10445] device bridge_slave_0 entered promiscuous mode [ 791.951317][T10445] bridge0: port 2(bridge_slave_1) entered blocking state [ 791.958402][T10445] bridge0: port 2(bridge_slave_1) entered disabled state [ 791.982312][T10445] device bridge_slave_1 entered promiscuous mode [ 792.194844][T10445] bridge0: port 2(bridge_slave_1) entered blocking state [ 792.202047][T10445] bridge0: port 2(bridge_slave_1) entered forwarding state [ 792.209520][T10445] bridge0: port 1(bridge_slave_0) entered blocking state [ 792.216624][T10445] bridge0: port 1(bridge_slave_0) entered forwarding state [ 792.285060][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 792.295957][ T326] bridge0: port 1(bridge_slave_0) entered disabled state [ 792.313930][ T326] bridge0: port 2(bridge_slave_1) entered disabled state [ 792.326406][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 792.339354][ T326] bridge0: port 1(bridge_slave_0) entered blocking state [ 792.346458][ T326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 792.369950][T10414] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 792.383332][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 792.395260][ T326] bridge0: port 2(bridge_slave_1) entered blocking state [ 792.402375][ T326] bridge0: port 2(bridge_slave_1) entered forwarding state [ 792.440297][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 792.453735][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 792.473070][T10415] device veth1_macvtap left promiscuous mode [ 792.479135][T10415] device veth0_vlan left promiscuous mode [ 792.569620][T10414] usb 5-1: Using ep0 maxpacket: 32 [ 792.575940][T10414] usb 5-1: New USB device found, idVendor=05e3, idProduct=0502, bcdDevice=b2.ac [ 792.595900][T10414] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 792.626752][T10414] usb 5-1: config 0 descriptor?? [ 792.643287][T10414] gl620a: probe of 5-1:0.0 failed with error -22 [ 792.757974][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 792.769909][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 792.789524][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 792.809042][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 792.828751][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 792.859646][ T326] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 792.878206][T10445] device veth0_vlan entered promiscuous mode [ 792.899170][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 792.910240][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 792.930547][T10445] device veth1_macvtap entered promiscuous mode [ 792.948387][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 792.959960][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 792.978515][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 792.995186][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 793.009997][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 793.068846][T10466] tipc: Started in network mode [ 793.078299][T10466] tipc: Node identity 7f000001, cluster identity 4711 [ 793.097435][T10466] tipc: Enabled bearer , priority 10 [ 793.276548][T10470] loop2: detected capacity change from 0 to 512 [ 793.496803][T10470] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 793.506080][T10470] ext4 filesystem being mounted at /1/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 794.931742][ T219] tipc: Node number set to 2130706433 [ 794.984974][T10470] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 794.992452][T10470] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 795.074982][T10445] EXT4-fs (loop2): unmounting filesystem. [ 795.080846][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 795.099386][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 795.111853][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 795.121189][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 795.964309][T10485] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 796.190172][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 796.226719][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 796.255006][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 796.263664][ T3378] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 796.275687][T10490] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3150'. [ 796.307722][T10490] sch_tbf: burst 88 is lower than device ip6gretap0 mtu (1574) ! [ 796.598613][T10499] 9pnet_fd: Insufficient options for proto=fd [ 796.771038][T10427] usb 5-1: USB disconnect, device number 2 [ 796.927212][T10508] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3154'. [ 798.894207][T10531] syz.5.3160[10531] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 798.894292][T10531] syz.5.3160[10531] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 801.309942][T10541] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3164'. [ 802.676077][T10553] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3168'. [ 803.170988][T10560] 9pnet_fd: Insufficient options for proto=fd [ 806.525016][T10590] syz.2.3177[10590] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 806.525222][T10590] syz.2.3177[10590] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 807.865265][T10603] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3182'. [ 808.142971][T10601] 9pnet: Could not find request transport: f [ 808.259765][T10427] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 809.269253][T10427] usb 3-1: device not accepting address 4, error -71 [ 809.504336][T10635] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3193'. [ 809.668284][T10640] 9pnet_fd: Insufficient options for proto=fd [ 809.803525][T10643] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3195'. [ 810.983772][T10663] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3199'. [ 811.543448][T10664] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 813.028449][T10679] tipc: Enabling of bearer rejected, already enabled [ 815.313320][T10689] syz.2.3208[10689] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 815.313402][T10689] syz.2.3208[10689] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 815.791446][T10693] device wireguard0 entered promiscuous mode [ 816.210883][T10696] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 816.433210][T10700] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 818.805416][T10735] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3222'. [ 818.969282][T10741] cgroup: noprefix used incorrectly [ 820.920449][T10757] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 823.724282][T10783] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3236'. [ 825.132949][T10804] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 825.171816][T10808] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3245'. [ 827.800279][T10830] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3249'. [ 828.546017][T10841] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3251'. [ 828.811246][T10847] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3254'. [ 830.402464][T10860] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 830.445566][T10863] cgroup: noprefix used incorrectly [ 830.781030][T10872] 9pnet_fd: Insufficient options for proto=fd [ 833.033138][T10895] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3267'. [ 833.277901][T10900] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 833.285312][T10900] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 833.339749][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 833.438262][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 833.486930][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 834.664164][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 834.678316][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 834.684115][T10906] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 834.695721][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 835.197018][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 835.966052][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 836.105832][T10904] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 837.842386][T10938] device wireguard1 entered promiscuous mode [ 838.714309][T10946] 9pnet_fd: Insufficient options for proto=fd [ 839.677637][T10950] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3274'. [ 842.144431][T10990] 9pnet_fd: Insufficient options for proto=fd [ 844.308312][T11023] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3303'. [ 847.749723][T11043] 9pnet_fd: Insufficient options for proto=fd [ 849.029704][T11049] 9pnet_fd: Insufficient options for proto=fd [ 852.926794][T11089] syz.5.3317[11089] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 852.927142][T11089] syz.5.3317[11089] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 854.940264][T11112] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 855.318362][T11120] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3323'. [ 855.845653][T11130] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 856.096166][T11136] 9pnet_fd: Insufficient options for proto=fd [ 856.682093][T11147] syz.5.3331[11147] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 856.682484][T11147] syz.5.3331[11147] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 856.882888][T11150] tipc: Enabling of bearer rejected, already enabled [ 861.045348][T11191] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 861.175757][T11195] tipc: Enabling of bearer rejected, already enabled [ 862.184225][T11199] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 862.197042][T11200] 9pnet_fd: Insufficient options for proto=fd [ 866.525394][T11230] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 867.539042][T11237] tmpfs: Unknown parameter 'nolazytimeÿÿ' [ 869.736850][T11254] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 869.752532][T11257] 9pnet_fd: Insufficient options for proto=fd [ 875.930971][T11314] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3378'. [ 879.315902][T11321] cgroup: noprefix used incorrectly [ 879.459218][T11329] net_ratelimit: 3320 callbacks suppressed [ 879.459238][T11329] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 879.474800][T11345] device wireguard0 entered promiscuous mode [ 880.953039][T11350] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 881.546043][T11349] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 883.064141][T11369] cgroup: noprefix used incorrectly [ 883.423460][T11378] device wireguard1 entered promiscuous mode [ 884.042512][T11388] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3398'. [ 884.425808][T11390] 9pnet_fd: Insufficient options for proto=fd [ 884.724634][T11394] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 884.894919][T11399] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 885.805631][T11403] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3405'. [ 886.880007][T11412] 9pnet_fd: Insufficient options for proto=fd [ 887.226446][T11415] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3407'. [ 887.414053][T11426] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3413'. [ 888.220549][T11441] 9pnet_fd: Insufficient options for proto=fd [ 891.701843][T11456] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 891.800730][T11466] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3424'. [ 894.358599][T11485] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 895.056978][T11492] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 895.599281][T11502] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3435'. [ 896.149763][T11502] sch_tbf: burst 88 is lower than device veth5 mtu (1514) ! [ 896.248214][T11510] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 898.016796][T11518] 9pnet_fd: Insufficient options for proto=fd [ 899.205227][T11508] cgroup: noprefix used incorrectly [ 901.494850][T11557] 9pnet_fd: Insufficient options for proto=fd [ 901.810234][ T28] audit: type=1400 audit(1751402302.284:428): avc: denied { watch watch_reads } for pid=11553 comm="syz.4.3449" path="/64/control" dev="tmpfs" ino=370 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 901.881658][T11566] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3452'. [ 901.899824][T11566] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 903.117298][T11582] cgroup: noprefix used incorrectly [ 904.001603][T11585] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 904.176363][T11589] cgroup: noprefix used incorrectly [ 904.718099][T11600] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 905.658079][T11608] cgroup: noprefix used incorrectly [ 907.328739][T11625] syz.4.3467[11625] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 907.328819][T11625] syz.4.3467[11625] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 913.757458][T11661] syz.5.3476[11661] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 913.769497][T11661] syz.5.3476[11661] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 913.903583][T11663] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 918.558251][T11695] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 921.091130][T11727] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 921.276648][T11735] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 921.350300][ T3322] IPv6: ADDRCONF(NETDEV_CHANGE): veth5: link becomes ready [ 921.426286][ T3322] IPv6: ADDRCONF(NETDEV_CHANGE): veth4: link becomes ready [ 924.786132][T11780] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3512'. [ 928.773059][T11821] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 931.627339][ T28] audit: type=1400 audit(1751402332.054:429): avc: denied { connect } for pid=11844 comm="syz.4.3530" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 933.508111][T11857] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3533'. [ 934.176746][T11877] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 937.932028][T11894] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3543'. [ 938.292421][T11910] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 938.312188][T11910] device wireguard1 left promiscuous mode [ 939.248307][T11919] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3554'. [ 939.313413][T11919] sch_tbf: burst 88 is lower than device veth5 mtu (1514) ! [ 940.702034][T11937] syz.4.3556[11937] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 940.703218][T11937] syz.4.3556[11937] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 941.511753][T11930] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 942.051337][T11947] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 943.478148][T11974] device wireguard0 entered promiscuous mode [ 943.582873][T11980] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 947.044063][ T28] audit: type=1400 audit(1751402347.514:430): avc: denied { bind } for pid=12032 comm="syz.4.3589" lport=132 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 947.248035][ T28] audit: type=1400 audit(1751402347.534:431): avc: denied { node_bind } for pid=12032 comm="syz.4.3589" saddr=172.20.20.170 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 948.603746][T12051] 9pnet_fd: Insufficient options for proto=fd [ 948.614133][T12052] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 948.631745][T12052] device wireguard0 left promiscuous mode [ 948.943300][T12058] 9pnet_fd: Insufficient options for proto=fd [ 950.463654][T12077] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3599'. [ 951.877252][T12093] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 952.563882][T12104] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 955.176297][ T28] audit: type=1400 audit(1751402355.644:432): avc: denied { write } for pid=12137 comm="syz.1.3618" path="socket:[43612]" dev="sockfs" ino=43612 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 960.091920][T12197] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3637'. [ 960.108133][T12197] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 960.762245][T12219] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3643'. [ 962.800064][ T28] audit: type=1400 audit(1751402363.274:433): avc: denied { relabelfrom } for pid=12250 comm="syz.2.3656" name="" dev="pipefs" ino=43735 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 962.823667][T12251] SELinux: Context system_u:object_r:sshd_exec_t:s0 is not valid (left unmapped). [ 962.833658][ T28] audit: type=1400 audit(1751402363.304:434): avc: denied { relabelto } for pid=12250 comm="syz.2.3656" name="" dev="pipefs" ino=43735 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=fifo_file permissive=1 trawcon="system_u:object_r:sshd_exec_t:s0" [ 962.963253][T12252] 9pnet_fd: Insufficient options for proto=fd [ 964.352114][T12269] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3661'. [ 967.311756][T12307] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3674'. [ 969.213854][T12326] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3678'. [ 971.143993][T12350] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3686'. [ 971.990986][T12358] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3690'. [ 972.008668][T12358] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 976.453358][T12410] syz.4.3705[12410] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 976.453793][T12410] syz.4.3705[12410] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 981.361675][T12451] syz.5.3714[12451] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 981.373217][T12451] syz.5.3714[12451] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 982.319818][T12460] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3717'. [ 984.704686][T12485] syz.5.3724[12485] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 984.704861][T12485] syz.5.3724[12485] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 990.656424][T12498] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3729'. [ 991.869055][T12511] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 991.882996][T12508] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3730'. [ 995.011711][T12538] syz.1.3737[12538] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 995.011789][T12538] syz.1.3737[12538] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 997.105065][T12540] cgroup: noprefix used incorrectly [ 997.834746][T12546] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3742'. [ 997.947585][T12557] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 998.451674][T12563] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3747'. [ 998.496249][T12563] sch_tbf: burst 88 is lower than device veth15 mtu (1514) ! [ 999.674554][T12590] tipc: Enabling of bearer rejected, already enabled [ 1002.598746][T12613] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3763'. [ 1003.321503][T12624] syz.5.3765[12624] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1003.321980][T12624] syz.5.3765[12624] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1004.566590][T12632] cgroup: noprefix used incorrectly [ 1007.259298][T12654] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1007.449732][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 1007.920741][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 1008.199408][T12665] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3775'. [ 1009.826442][T12684] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3781'. [ 1013.484752][T12720] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3792'. [ 1015.127225][T12733] cgroup: noprefix used incorrectly [ 1015.912226][T12738] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3798'. [ 1016.025100][T12741] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3795'. [ 1016.306205][T12749] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3801'. [ 1016.472418][T12750] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3794'. [ 1016.834725][T12765] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3806'. [ 1018.938404][T12792] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3814'. [ 1018.949990][T12782] cgroup: noprefix used incorrectly [ 1020.374201][T12817] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3822'. [ 1025.799199][T12879] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3838'. [ 1027.164491][T12906] cgroup: noprefix used incorrectly [ 1033.965340][T12966] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3862'. [ 1036.842082][T12991] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3869'. [ 1037.278004][T12994] cgroup: noprefix used incorrectly [ 1037.472694][T13003] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3874'. [ 1037.927430][T13010] cgroup: noprefix used incorrectly [ 1038.959446][T13028] 9pnet_fd: Insufficient options for proto=fd [ 1040.415517][T13055] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3889'. [ 1043.371736][T13092] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3897'. [ 1043.443506][T13093] 9pnet_fd: Insufficient options for proto=fd [ 1045.549200][T13117] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3905'. [ 1046.560855][T13129] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3908'. [ 1046.572844][ T28] audit: type=1326 audit(1751402447.044:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13127 comm="syz.3.3910" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5c8fb8e929 code=0x0 [ 1047.156860][T13140] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1049.128945][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth15: link becomes ready [ 1049.157033][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth14: link becomes ready [ 1050.593115][T13150] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1052.233494][T13152] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1052.824017][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 1052.951190][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 1055.636991][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1055.677477][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 1056.891409][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 1056.916021][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth5: link becomes ready [ 1057.066417][T13213] 9pnet_fd: Insufficient options for proto=fd [ 1057.073062][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth4: link becomes ready [ 1058.727226][T13231] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3937'. [ 1059.756418][T13252] 9pnet_fd: Insufficient options for proto=fd [ 1059.777858][T13249] bridge0: port 1(bridge_slave_0) entered blocking state [ 1059.845482][T13249] bridge0: port 1(bridge_slave_0) entered disabled state [ 1059.903220][T13249] device bridge_slave_0 entered promiscuous mode [ 1059.940460][T13249] bridge0: port 2(bridge_slave_1) entered blocking state [ 1059.947526][T13249] bridge0: port 2(bridge_slave_1) entered disabled state [ 1059.960093][T13249] device bridge_slave_1 entered promiscuous mode [ 1060.179500][ C1] ------------[ cut here ]------------ [ 1060.185028][ C1] refcount_t: addition on 0; use-after-free. [ 1060.191209][ C1] WARNING: CPU: 1 PID: 13261 at lib/refcount.c:25 refcount_warn_saturate+0x104/0x1a0 [ 1060.200765][ C1] Modules linked in: [ 1060.204723][ C1] CPU: 1 PID: 13261 Comm: syz.3.3945 Not tainted 6.1.141-syzkaller-00036-g7011769d221c #0 [ 1060.214685][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1060.224830][ C1] RIP: 0010:refcount_warn_saturate+0x104/0x1a0 [ 1060.231061][ C1] Code: 05 01 48 c7 c7 e0 a1 a9 85 e8 38 fb dd fe 0f 0b eb df e8 6f b5 0c ff c6 05 cf ab 0b 05 01 48 c7 c7 20 a1 a9 85 e8 1c fb dd fe <0f> 0b eb c3 e8 53 b5 0c ff c6 05 b4 ab 0b 05 01 48 c7 c7 80 a1 a9 [ 1060.250857][ C1] RSP: 0018:ffffc900001b09e0 EFLAGS: 00010246 [ 1060.256952][ C1] RAX: cc69cc302aa5db00 RBX: 0000000000000002 RCX: ffff88812c100000 [ 1060.265087][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 1060.273160][ C1] RBP: ffffc900001b09f0 R08: dffffc0000000000 R09: fffff520000360b9 [ 1060.281232][ C1] R10: fffff520000360b9 R11: 1ffff920000360b8 R12: ffffc900001b0ba0 [ 1060.289257][ C1] R13: dffffc0000000000 R14: 0000000000000002 R15: ffff8881204eee00 [ 1060.297297][ C1] FS: 00007f5c909fc6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 1060.306287][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1060.313145][ C1] CR2: 00002000001bb030 CR3: 0000000115c79000 CR4: 00000000003506a0 [ 1060.321180][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1060.329213][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1060.337262][ C1] Call Trace: [ 1060.340613][ C1] [ 1060.343489][ C1] tipc_crypto_xmit+0x1822/0x2220 [ 1060.348577][ C1] ? probe_sched_wakeup+0x5e/0x90 [ 1060.353714][ C1] ? __cfi_tipc_crypto_xmit+0x10/0x10 [ 1060.359151][ C1] ? __copy_skb_header+0x49f/0x630 [ 1060.364345][ C1] tipc_bearer_xmit_skb+0x226/0x380 [ 1060.369622][ C1] ? __skb_clone+0x47a/0x790 [ 1060.374284][ C1] ? __cfi_tipc_bearer_xmit_skb+0x10/0x10 [ 1060.380085][ C1] ? skb_clone+0x228/0x380 [ 1060.384552][ C1] tipc_disc_timeout+0x6a2/0x830 [ 1060.389568][ C1] ? __cfi_tipc_disc_timeout+0x10/0x10 [ 1060.395072][ C1] ? __kasan_check_write+0x14/0x20 [ 1060.400274][ C1] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 1060.405875][ C1] ? __cfi_tipc_disc_timeout+0x10/0x10 [ 1060.411417][ C1] call_timer_fn+0x46/0x2a0 [ 1060.415967][ C1] ? __cfi_tipc_disc_timeout+0x10/0x10 [ 1060.421504][ C1] __run_timers+0x639/0x9a0 [ 1060.426058][ C1] ? calc_index+0x200/0x200 [ 1060.430645][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 1060.435896][ C1] run_timer_softirq+0x6a/0xf0 [ 1060.440742][ C1] handle_softirqs+0x1d7/0x600 [ 1060.445555][ C1] ? irqtime_account_irq+0xc4/0x240 [ 1060.450864][ C1] __irq_exit_rcu+0x52/0xf0 [ 1060.455504][ C1] irq_exit_rcu+0x9/0x10 [ 1060.459814][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 1060.465499][ C1] [ 1060.468469][ C1] [ 1060.471467][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 1060.477490][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x55/0x80 [ 1060.484031][ C1] Code: 40 d2 ed 86 e8 dc 0b c4 fc 4c 89 f7 48 83 3d d1 8c fd 01 00 74 30 e8 1e 0d 00 00 90 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 a6 50 5b fc 65 8b 05 37 28 12 7b 85 c0 74 05 5b 41 5e 5d c3 e8 [ 1060.503733][ C1] RSP: 0018:ffffc900007975a0 EFLAGS: 00000206 [ 1060.509845][ C1] RAX: 0000000000000001 RBX: 0000000000000a06 RCX: dffffc0000000000 [ 1060.517847][ C1] RDX: ffffc900063cf698 RSI: 0000000000000a06 RDI: 0000000000000001 [ 1060.525881][ C1] RBP: ffffc900007975b0 R08: dffffc0000000000 R09: ffffed1025820a21 [ 1060.533911][ C1] R10: ffffed1025820a21 R11: 1ffff11025820a20 R12: ffff88813220d300 [ 1060.541996][ C1] R13: 0000000000000010 R14: 0000000000000001 R15: 0000000000000000 [ 1060.550183][ C1] __wake_up_sync_key+0x166/0x280 [ 1060.555311][ C1] ? __cfi___wake_up_sync_key+0x10/0x10 [ 1060.560974][ C1] ? __skb_try_recv_datagram+0x3da/0x4d0 [ 1060.566671][ C1] ? __cfi_sk_busy_loop_end+0x10/0x10 [ 1060.572148][ C1] __unix_dgram_recvmsg+0x496/0xd70 [ 1060.577395][ C1] ? __switch_to_asm+0x3a/0x60 [ 1060.582258][ C1] ? __cfi___unix_dgram_recvmsg+0x10/0x10 [ 1060.588038][ C1] ? __schedule+0xb8f/0x14e0 [ 1060.592721][ C1] ? ____sys_recvmsg+0x60/0x590 [ 1060.597623][ C1] unix_dgram_recvmsg+0xc7/0xe0 [ 1060.602550][ C1] ? __cfi_unix_dgram_recvmsg+0x10/0x10 [ 1060.608140][ C1] ____sys_recvmsg+0x2a0/0x590 [ 1060.613082][ C1] ? __sys_recvmsg_sock+0x50/0x50 [ 1060.618202][ C1] ? import_iovec+0x7c/0xb0 [ 1060.622780][ C1] ___sys_recvmsg+0x1b2/0x510 [ 1060.627525][ C1] ? __sys_recvmsg+0x270/0x270 [ 1060.632405][ C1] ? cgroup_rstat_updated+0xf5/0x370 [ 1060.637828][ C1] ? asm_sysvec_reschedule_ipi+0x1b/0x20 [ 1060.643645][ C1] ? do_recvmmsg+0x50b/0x7a0 [ 1060.648343][ C1] do_recvmmsg+0x359/0x7a0 [ 1060.652935][ C1] ? __sys_recvmmsg+0x280/0x280 [ 1060.657842][ C1] __x64_sys_recvmmsg+0x18d/0x240 [ 1060.662965][ C1] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 1060.668590][ C1] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 1060.674800][ C1] x64_sys_call+0x3e7/0x9a0 [ 1060.679414][ C1] do_syscall_64+0x4c/0xa0 [ 1060.683927][ C1] ? clear_bhb_loop+0x30/0x80 [ 1060.688722][ C1] ? clear_bhb_loop+0x30/0x80 [ 1060.693491][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1060.699474][ C1] RIP: 0033:0x7f5c8fb8e929 [ 1060.703943][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1060.723713][ C1] RSP: 002b:00007f5c909fc038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1060.732184][ C1] RAX: ffffffffffffffda RBX: 00007f5c8fdb6080 RCX: 00007f5c8fb8e929 [ 1060.740262][ C1] RDX: 03fffffffffffcb5 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1060.748301][ C1] RBP: 00007f5c8fc10b39 R08: 0000000000000000 R09: 0000000000000000 [ 1060.756384][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 1060.764451][ C1] R13: 0000000000000001 R14: 00007f5c8fdb6080 R15: 00007ffdf88f6868 [ 1060.772498][ C1] [ 1060.775560][ C1] ---[ end trace 0000000000000000 ]--- [ 1060.781088][ C1] ------------[ cut here ]------------ [ 1060.786570][ C1] refcount_t: underflow; use-after-free. [ 1060.792364][ C1] WARNING: CPU: 1 PID: 13261 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 1060.801900][ C1] Modules linked in: [ 1060.805838][ C1] CPU: 1 PID: 13261 Comm: syz.3.3945 Tainted: G W 6.1.141-syzkaller-00036-g7011769d221c #0 [ 1060.817273][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1060.827403][ C1] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 1060.833642][ C1] Code: 05 01 48 c7 c7 20 a1 a9 85 e8 1c fb dd fe 0f 0b eb c3 e8 53 b5 0c ff c6 05 b4 ab 0b 05 01 48 c7 c7 80 a1 a9 85 e8 00 fb dd fe <0f> 0b eb a7 e8 37 b5 0c ff c6 05 95 ab 0b 05 01 48 c7 c7 c0 a0 a9 [ 1060.853326][ C1] RSP: 0018:ffffc900001b09e0 EFLAGS: 00010246 [ 1060.859474][ C1] RAX: cc69cc302aa5db00 RBX: 0000000000000003 RCX: ffff88812c100000 [ 1060.867562][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 1060.875646][ C1] RBP: ffffc900001b09f0 R08: dffffc0000000000 R09: fffff520000360b9 [ 1060.883734][ C1] R10: fffff520000360b9 R11: 1ffff920000360b8 R12: 00000000c0000000 [ 1060.891789][ C1] R13: dffffc0000000000 R14: 0000000000000003 R15: ffff8881204eee00 [ 1060.899808][ C1] FS: 00007f5c909fc6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 1060.908816][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1060.915521][ C1] CR2: 00002000001bb030 CR3: 0000000115c79000 CR4: 00000000003506a0 [ 1060.923727][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1060.931902][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1060.940024][ C1] Call Trace: [ 1060.943389][ C1] [ 1060.946315][ C1] tipc_crypto_xmit+0x195e/0x2220 [ 1060.951470][ C1] ? probe_sched_wakeup+0x5e/0x90 [ 1060.956693][ C1] ? __cfi_tipc_crypto_xmit+0x10/0x10 [ 1060.962206][ C1] ? __copy_skb_header+0x49f/0x630 [ 1060.967436][ C1] tipc_bearer_xmit_skb+0x226/0x380 [ 1060.972761][ C1] ? __skb_clone+0x47a/0x790 [ 1060.977470][ C1] ? __cfi_tipc_bearer_xmit_skb+0x10/0x10 [ 1060.983369][ C1] ? skb_clone+0x228/0x380 [ 1060.987856][ C1] tipc_disc_timeout+0x6a2/0x830 [ 1060.992993][ C1] ? __cfi_tipc_disc_timeout+0x10/0x10 [ 1060.998559][ C1] ? __kasan_check_write+0x14/0x20 [ 1061.003810][ C1] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 1061.009468][ C1] ? __cfi_tipc_disc_timeout+0x10/0x10 [ 1061.014985][ C1] call_timer_fn+0x46/0x2a0 [ 1061.019589][ C1] ? __cfi_tipc_disc_timeout+0x10/0x10 [ 1061.025150][ C1] __run_timers+0x639/0x9a0 [ 1061.029758][ C1] ? calc_index+0x200/0x200 [ 1061.034391][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 1061.039738][ C1] run_timer_softirq+0x6a/0xf0 [ 1061.044586][ C1] handle_softirqs+0x1d7/0x600 [ 1061.049475][ C1] ? irqtime_account_irq+0xc4/0x240 [ 1061.054754][ C1] __irq_exit_rcu+0x52/0xf0 [ 1061.059308][ C1] irq_exit_rcu+0x9/0x10 [ 1061.063672][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 1061.069379][ C1] [ 1061.072352][ C1] [ 1061.075297][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 1061.081319][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x55/0x80 [ 1061.087775][ C1] Code: 40 d2 ed 86 e8 dc 0b c4 fc 4c 89 f7 48 83 3d d1 8c fd 01 00 74 30 e8 1e 0d 00 00 90 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 a6 50 5b fc 65 8b 05 37 28 12 7b 85 c0 74 05 5b 41 5e 5d c3 e8 [ 1061.107433][ C1] RSP: 0018:ffffc900007975a0 EFLAGS: 00000206 [ 1061.113557][ C1] RAX: 0000000000000001 RBX: 0000000000000a06 RCX: dffffc0000000000 [ 1061.121582][ C1] RDX: ffffc900063cf698 RSI: 0000000000000a06 RDI: 0000000000000001 [ 1061.129598][ C1] RBP: ffffc900007975b0 R08: dffffc0000000000 R09: ffffed1025820a21 [ 1061.137598][ C1] R10: ffffed1025820a21 R11: 1ffff11025820a20 R12: ffff88813220d300 [ 1061.145638][ C1] R13: 0000000000000010 R14: 0000000000000001 R15: 0000000000000000 [ 1061.153665][ C1] __wake_up_sync_key+0x166/0x280 [ 1061.158721][ C1] ? __cfi___wake_up_sync_key+0x10/0x10 [ 1061.164342][ C1] ? __skb_try_recv_datagram+0x3da/0x4d0 [ 1061.170028][ C1] ? __cfi_sk_busy_loop_end+0x10/0x10 [ 1061.175431][ C1] __unix_dgram_recvmsg+0x496/0xd70 [ 1061.180694][ C1] ? __switch_to_asm+0x3a/0x60 [ 1061.185483][ C1] ? __cfi___unix_dgram_recvmsg+0x10/0x10 [ 1061.191247][ C1] ? __schedule+0xb8f/0x14e0 [ 1061.195864][ C1] ? ____sys_recvmsg+0x60/0x590 [ 1061.200776][ C1] unix_dgram_recvmsg+0xc7/0xe0 [ 1061.205653][ C1] ? __cfi_unix_dgram_recvmsg+0x10/0x10 [ 1061.211258][ C1] ____sys_recvmsg+0x2a0/0x590 [ 1061.216044][ C1] ? __sys_recvmsg_sock+0x50/0x50 [ 1061.221128][ C1] ? import_iovec+0x7c/0xb0 [ 1061.225652][ C1] ___sys_recvmsg+0x1b2/0x510 [ 1061.230378][ C1] ? __sys_recvmsg+0x270/0x270 [ 1061.235165][ C1] ? cgroup_rstat_updated+0xf5/0x370 [ 1061.240523][ C1] ? asm_sysvec_reschedule_ipi+0x1b/0x20 [ 1061.246189][ C1] ? do_recvmmsg+0x50b/0x7a0 [ 1061.250804][ C1] do_recvmmsg+0x359/0x7a0 [ 1061.255249][ C1] ? __sys_recvmmsg+0x280/0x280 [ 1061.260142][ C1] __x64_sys_recvmmsg+0x18d/0x240 [ 1061.265182][ C1] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 1061.270761][ C1] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 1061.276847][ C1] x64_sys_call+0x3e7/0x9a0 [ 1061.281383][ C1] do_syscall_64+0x4c/0xa0 [ 1061.285814][ C1] ? clear_bhb_loop+0x30/0x80 [ 1061.290513][ C1] ? clear_bhb_loop+0x30/0x80 [ 1061.295202][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1061.301127][ C1] RIP: 0033:0x7f5c8fb8e929 [ 1061.305553][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1061.325214][ C1] RSP: 002b:00007f5c909fc038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1061.333670][ C1] RAX: ffffffffffffffda RBX: 00007f5c8fdb6080 RCX: 00007f5c8fb8e929 [ 1061.341676][ C1] RDX: 03fffffffffffcb5 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1061.349665][ C1] RBP: 00007f5c8fc10b39 R08: 0000000000000000 R09: 0000000000000000 [ 1061.357655][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 1061.365765][ C1] R13: 0000000000000001 R14: 00007f5c8fdb6080 R15: 00007ffdf88f6868 [ 1061.373787][ C1] [ 1061.376825][ C1] ---[ end trace 0000000000000000 ]--- [ 1061.382637][ C1] ------------[ cut here ]------------ [ 1061.388198][ C1] refcount_t: saturated; leaking memory. [ 1061.393975][ C1] WARNING: CPU: 1 PID: 13261 at lib/refcount.c:22 refcount_warn_saturate+0x158/0x1a0 [ 1061.403488][ C1] Modules linked in: [ 1061.407379][ C1] CPU: 1 PID: 13261 Comm: syz.3.3945 Tainted: G W 6.1.141-syzkaller-00036-g7011769d221c #0 [ 1061.418783][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1061.428882][ C1] RIP: 0010:refcount_warn_saturate+0x158/0x1a0 [ 1061.435117][ C1] Code: 05 01 48 c7 c7 c0 a0 a9 85 e8 e4 fa dd fe 0f 0b eb 8b e8 1b b5 0c ff c6 05 7a ab 0b 05 01 48 c7 c7 c0 a0 a9 85 e8 c8 fa dd fe <0f> 0b e9 6c ff ff ff e8 fc b4 0c ff c6 05 5f ab 0b 05 01 48 c7 c7 [ 1061.454890][ C1] RSP: 0018:ffffc900001b09e0 EFLAGS: 00010246 [ 1061.460994][ C1] RAX: cc69cc302aa5db00 RBX: 0000000000000001 RCX: ffff88812c100000 [ 1061.468982][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 1061.476989][ C1] RBP: ffffc900001b09f0 R08: dffffc0000000000 R09: fffff520000360b9 [ 1061.485008][ C1] R10: fffff520000360b9 R11: 1ffff920000360b8 R12: ffffc900001b0ba0 [ 1061.493045][ C1] R13: dffffc0000000000 R14: 0000000000000001 R15: ffff8881204eee00 [ 1061.501057][ C1] FS: 00007f5c909fc6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 1061.510029][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1061.516625][ C1] CR2: 00002000001bb030 CR3: 0000000115c79000 CR4: 00000000003506a0 [ 1061.524634][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1061.532655][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1061.540654][ C1] Call Trace: [ 1061.543957][ C1] [ 1061.546800][ C1] tipc_crypto_xmit+0x1822/0x2220 [ 1061.551879][ C1] ? __cfi_tipc_crypto_xmit+0x10/0x10 [ 1061.557280][ C1] ? __copy_skb_header+0x49f/0x630 [ 1061.562435][ C1] tipc_bearer_xmit_skb+0x226/0x380 [ 1061.567664][ C1] ? __skb_clone+0x47a/0x790 [ 1061.572299][ C1] ? __cfi_tipc_bearer_xmit_skb+0x10/0x10 [ 1061.578039][ C1] ? skb_clone+0x228/0x380 [ 1061.582475][ C1] tipc_disc_timeout+0x6a2/0x830 [ 1061.587444][ C1] ? irqtime_account_irq+0xc4/0x240 [ 1061.592698][ C1] ? __cfi_tipc_disc_timeout+0x10/0x10 [ 1061.598174][ C1] ? __cfi_tipc_disc_timeout+0x10/0x10 [ 1061.603660][ C1] call_timer_fn+0x46/0x2a0 [ 1061.608178][ C1] ? __cfi_tipc_disc_timeout+0x10/0x10 [ 1061.613719][ C1] __run_timers+0x639/0x9a0 [ 1061.618246][ C1] ? calc_index+0x200/0x200 [ 1061.622778][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 1061.628013][ C1] run_timer_softirq+0x6a/0xf0 [ 1061.632815][ C1] handle_softirqs+0x1d7/0x600 [ 1061.637595][ C1] ? irqtime_account_irq+0xc4/0x240 [ 1061.642824][ C1] __irq_exit_rcu+0x52/0xf0 [ 1061.647358][ C1] irq_exit_rcu+0x9/0x10 [ 1061.651648][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 1061.657300][ C1] [ 1061.660250][ C1] [ 1061.663189][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 1061.669164][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x55/0x80 [ 1061.675618][ C1] Code: 40 d2 ed 86 e8 dc 0b c4 fc 4c 89 f7 48 83 3d d1 8c fd 01 00 74 30 e8 1e 0d 00 00 90 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 a6 50 5b fc 65 8b 05 37 28 12 7b 85 c0 74 05 5b 41 5e 5d c3 e8 [ 1061.695271][ C1] RSP: 0018:ffffc900007975a0 EFLAGS: 00000206 [ 1061.701366][ C1] RAX: 0000000000000001 RBX: 0000000000000a06 RCX: dffffc0000000000 [ 1061.709348][ C1] RDX: ffffc900063cf698 RSI: 0000000000000a06 RDI: 0000000000000001 [ 1061.717384][ C1] RBP: ffffc900007975b0 R08: dffffc0000000000 R09: ffffed1025820a21 [ 1061.725391][ C1] R10: ffffed1025820a21 R11: 1ffff11025820a20 R12: ffff88813220d300 [ 1061.733399][ C1] R13: 0000000000000010 R14: 0000000000000001 R15: 0000000000000000 [ 1061.741411][ C1] __wake_up_sync_key+0x166/0x280 [ 1061.746451][ C1] ? __cfi___wake_up_sync_key+0x10/0x10 [ 1061.752039][ C1] ? __skb_try_recv_datagram+0x3da/0x4d0 [ 1061.757699][ C1] ? __cfi_sk_busy_loop_end+0x10/0x10 [ 1061.763099][ C1] __unix_dgram_recvmsg+0x496/0xd70 [ 1061.768313][ C1] ? __switch_to_asm+0x3a/0x60 [ 1061.773131][ C1] ? __cfi___unix_dgram_recvmsg+0x10/0x10 [ 1061.778871][ C1] ? __schedule+0xb8f/0x14e0 [ 1061.783500][ C1] ? ____sys_recvmsg+0x60/0x590 [ 1061.788366][ C1] unix_dgram_recvmsg+0xc7/0xe0 [ 1061.793255][ C1] ? __cfi_unix_dgram_recvmsg+0x10/0x10 [ 1061.798837][ C1] ____sys_recvmsg+0x2a0/0x590 [ 1061.803643][ C1] ? __sys_recvmsg_sock+0x50/0x50 [ 1061.808737][ C1] ? import_iovec+0x7c/0xb0 [ 1061.813293][ C1] ___sys_recvmsg+0x1b2/0x510 [ 1061.817991][ C1] ? __sys_recvmsg+0x270/0x270 [ 1061.822784][ C1] ? cgroup_rstat_updated+0xf5/0x370 [ 1061.828093][ C1] ? asm_sysvec_reschedule_ipi+0x1b/0x20 [ 1061.833766][ C1] ? do_recvmmsg+0x50b/0x7a0 [ 1061.838388][ C1] do_recvmmsg+0x359/0x7a0 [ 1061.842831][ C1] ? __sys_recvmmsg+0x280/0x280 [ 1061.847708][ C1] __x64_sys_recvmmsg+0x18d/0x240 [ 1061.852773][ C1] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 1061.858339][ C1] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 1061.864433][ C1] x64_sys_call+0x3e7/0x9a0 [ 1061.868953][ C1] do_syscall_64+0x4c/0xa0 [ 1061.873411][ C1] ? clear_bhb_loop+0x30/0x80 [ 1061.878104][ C1] ? clear_bhb_loop+0x30/0x80 [ 1061.882807][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1061.888720][ C1] RIP: 0033:0x7f5c8fb8e929 [ 1061.893170][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1061.912811][ C1] RSP: 002b:00007f5c909fc038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1061.921248][ C1] RAX: ffffffffffffffda RBX: 00007f5c8fdb6080 RCX: 00007f5c8fb8e929 [ 1061.929236][ C1] RDX: 03fffffffffffcb5 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1061.937245][ C1] RBP: 00007f5c8fc10b39 R08: 0000000000000000 R09: 0000000000000000 [ 1061.945250][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 1061.953258][ C1] R13: 0000000000000001 R14: 00007f5c8fdb6080 R15: 00007ffdf88f6868 [ 1061.961263][ C1] [ 1061.964286][ C1] ---[ end trace 0000000000000000 ]--- [ 1062.101903][T13262] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1062.169431][ T326] tipc: Disabling bearer [ 1062.174869][ T326] tipc: Left network mode [ 1062.325247][ T326] ------------[ cut here ]------------ [ 1062.331009][ T326] refcount_t: saturated; leaking memory. [ 1062.343412][ T326] WARNING: CPU: 1 PID: 326 at lib/refcount.c:19 refcount_warn_saturate+0x13c/0x1a0 [ 1062.352941][ T326] Modules linked in: [ 1062.356855][ T326] CPU: 1 PID: 326 Comm: kworker/u4:6 Tainted: G W 6.1.141-syzkaller-00036-g7011769d221c #0 [ 1062.368292][ T326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1062.378376][ T326] Workqueue: netns cleanup_net [ 1062.383188][ T326] RIP: 0010:refcount_warn_saturate+0x13c/0x1a0 [ 1062.389359][ T326] Code: 05 01 48 c7 c7 80 a1 a9 85 e8 00 fb dd fe 0f 0b eb a7 e8 37 b5 0c ff c6 05 95 ab 0b 05 01 48 c7 c7 c0 a0 a9 85 e8 e4 fa dd fe <0f> 0b eb 8b e8 1b b5 0c ff c6 05 7a ab 0b 05 01 48 c7 c7 c0 a0 a9 [ 1062.409032][ T326] RSP: 0018:ffffc9000dccf7c0 EFLAGS: 00010246 [ 1062.415137][ T326] RAX: 46f7e811b1969e00 RBX: 0000000000000000 RCX: ffff88810fb31440 [ 1062.423338][ T326] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 1062.431413][ T326] RBP: ffffc9000dccf7d0 R08: dffffc0000000000 R09: ffffed103ee24eb4 [ 1062.439404][ T326] R10: ffffed103ee24eb4 R11: 1ffff1103ee24eb3 R12: 1ffff92001b99f04 [ 1062.447444][ T326] R13: ffffc9000dccf840 R14: 0000000000000000 R15: ffff88811a8b808c [ 1062.455482][ T326] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 1062.464497][ T326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1062.471132][ T326] CR2: 0000200000039000 CR3: 000000011e67f000 CR4: 00000000003506a0 [ 1062.479132][ T326] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1062.487150][ T326] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1062.495185][ T326] Call Trace: [ 1062.498485][ T326] [ 1062.501475][ T326] nf_nat_masq_schedule+0x46b/0x4e0 [ 1062.506733][ T326] ? __kasan_check_write+0x14/0x20 [ 1062.511923][ T326] ? __cfi_device_cmp+0x10/0x10 [ 1062.516806][ T326] ? masq_device_event+0xd0/0xd0 [ 1062.521840][ T326] ? nfqnl_rcv_dev_event+0x441/0x470 [ 1062.527169][ T326] ? rtnl_is_locked+0x15/0x20 [ 1062.531894][ T326] masq_device_event+0x9b/0xd0 [ 1062.536685][ T326] raw_notifier_call_chain+0xa1/0x110 [ 1062.542239][ T326] dev_close_many+0x32d/0x4d0 [ 1062.546938][ T326] ? __ww_mutex_lock_interruptible_slowpath+0x20/0x20 [ 1062.553823][ T326] ? __cfi_dev_close_many+0x10/0x10 [ 1062.559056][ T326] ? wait_for_common+0x54c/0x620 [ 1062.564045][ T326] ? __kasan_check_read+0x11/0x20 [ 1062.569102][ T326] unregister_netdevice_many+0x439/0x1820 [ 1062.574879][ T326] ? __cfi_unregister_netdevice_many+0x10/0x10 [ 1062.581098][ T326] ? unregister_netdevice_queue+0x1aa/0x360 [ 1062.587020][ T326] ? __cfi_unregister_netdevice_queue+0x10/0x10 [ 1062.593371][ T326] ? rcu_barrier+0x7e/0x600 [ 1062.597916][ T326] ip6gre_exit_batch_net+0x5a8/0x5f0 [ 1062.603296][ T326] ? __cfi_ip6gre_exit_batch_net+0x10/0x10 [ 1062.610196][ T326] ? __cfi_ip6gre_exit_batch_net+0x10/0x10 [ 1062.616068][ T326] cleanup_net+0x62d/0xb00 [ 1062.620542][ T326] ? __cfi_cleanup_net+0x10/0x10 [ 1062.625524][ T326] process_one_work+0x71f/0xc40 [ 1062.630441][ T326] worker_thread+0xa29/0x11f0 [ 1062.636136][ T326] ? _raw_spin_lock_irqsave+0xb0/0x110 [ 1062.641681][ T326] kthread+0x281/0x320 [ 1062.645784][ T326] ? __cfi_worker_thread+0x10/0x10 [ 1062.650952][ T326] ? __cfi_kthread+0x10/0x10 [ 1062.656539][ T326] ret_from_fork+0x1f/0x30 [ 1062.661041][ T326] [ 1062.664075][ T326] ---[ end trace 0000000000000000 ]--- [ 1062.692032][ T326] ------------[ cut here ]------------ [ 1062.697539][ T326] WARNING: CPU: 1 PID: 326 at lib/ref_tracker.c:77 ref_tracker_alloc+0x2ae/0x430 [ 1062.706753][ T326] Modules linked in: [ 1062.710730][ T326] CPU: 1 PID: 326 Comm: kworker/u4:6 Tainted: G W 6.1.141-syzkaller-00036-g7011769d221c #0 [ 1062.722134][ T326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1062.732241][ T326] Workqueue: netns cleanup_net [ 1062.737032][ T326] RIP: 0010:ref_tracker_alloc+0x2ae/0x430 [ 1062.742900][ T326] Code: f9 e5 fe 48 bb 00 00 00 00 00 fc ff df 4c 8b 74 24 08 48 8b 7c 24 10 48 8b 74 24 18 e8 1b 47 66 02 31 c0 eb 6d e8 52 f9 e5 fe <0f> 0b 4d 85 e4 0f 85 09 fe ff ff 4c 8b 64 24 10 4d 8d 74 24 0c 4c [ 1062.762717][ T326] RSP: 0018:ffffc9000dccf6a0 EFLAGS: 00010293 [ 1062.768806][ T326] RAX: ffffffff8289fe1e RBX: dffffc0000000000 RCX: ffff88810fb31440 [ 1062.776833][ T326] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000dccf760 [ 1062.784849][ T326] RBP: ffffc9000dccf7d0 R08: dffffc0000000000 R09: ffffc9000dccf6e0 [ 1062.792908][ T326] R10: fffff52001b99eec R11: 1ffff92001b99edc R12: ffff888116ff85b8 [ 1062.800909][ T326] R13: ffff88811a8b80a0 R14: 0000000000000cc0 R15: ffff88811a8b8090 [ 1062.808891][ T326] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 1062.817846][ T326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1062.824596][ T326] CR2: 00007f5c8fd80ab8 CR3: 000000013cf28000 CR4: 00000000003506a0 [ 1062.832631][ T326] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1062.840650][ T326] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1062.848650][ T326] Call Trace: [ 1062.851990][ T326] [ 1062.854938][ T326] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 1062.860453][ T326] ? kasan_save_alloc_info+0x25/0x30 [ 1062.865779][ T326] ? __kasan_kmalloc+0x95/0xb0 [ 1062.870591][ T326] ? nf_nat_masq_schedule+0x238/0x4e0 [ 1062.875995][ T326] ? kmalloc_trace+0x40/0xb0 [ 1062.880662][ T326] nf_nat_masq_schedule+0x338/0x4e0 [ 1062.885892][ T326] ? __kasan_check_write+0x14/0x20 [ 1062.891057][ T326] ? __cfi_device_cmp+0x10/0x10 [ 1062.895945][ T326] ? masq_device_event+0xd0/0xd0 [ 1062.900997][ T326] ? nfqnl_rcv_dev_event+0x441/0x470 [ 1062.906318][ T326] ? rtnl_is_locked+0x15/0x20 [ 1062.911074][ T326] masq_device_event+0x9b/0xd0 [ 1062.915872][ T326] raw_notifier_call_chain+0xa1/0x110 [ 1062.921606][ T326] dev_close_many+0x32d/0x4d0 [ 1062.926313][ T326] ? __ww_mutex_lock_interruptible_slowpath+0x20/0x20 [ 1062.933420][ T326] ? __cfi_dev_close_many+0x10/0x10 [ 1062.938849][ T326] ? wait_for_common+0x54c/0x620 [ 1062.943882][ T326] ? __kasan_check_read+0x11/0x20 [ 1062.949648][ T326] unregister_netdevice_many+0x439/0x1820 [ 1062.955383][ T326] ? __cfi_unregister_netdevice_many+0x10/0x10 [ 1062.961592][ T326] ? unregister_netdevice_queue+0x1aa/0x360 [ 1062.967507][ T326] ? __cfi_unregister_netdevice_queue+0x10/0x10 [ 1062.973784][ T326] ? rcu_barrier+0x7e/0x600 [ 1062.978303][ T326] ip6gre_exit_batch_net+0x5a8/0x5f0 [ 1062.983702][ T326] ? __cfi_ip6gre_exit_batch_net+0x10/0x10 [ 1062.989572][ T326] ? __cfi_ip6gre_exit_batch_net+0x10/0x10 [ 1062.995457][ T326] cleanup_net+0x62d/0xb00 [ 1062.999902][ T326] ? __cfi_cleanup_net+0x10/0x10 [ 1063.004866][ T326] process_one_work+0x71f/0xc40 [ 1063.009779][ T326] worker_thread+0xa29/0x11f0 [ 1063.014479][ T326] ? _raw_spin_lock_irqsave+0xb0/0x110 [ 1063.020005][ T326] kthread+0x281/0x320 [ 1063.024097][ T326] ? __cfi_worker_thread+0x10/0x10 [ 1063.029228][ T326] ? __cfi_kthread+0x10/0x10 [ 1063.033895][ T326] ret_from_fork+0x1f/0x30 [ 1063.038347][ T326] [ 1063.041415][ T326] ---[ end trace 0000000000000000 ]--- [ 1063.048708][ T397] ------------[ cut here ]------------ [ 1063.054237][ T397] WARNING: CPU: 1 PID: 397 at lib/ref_tracker.c:110 ref_tracker_free+0x5de/0x7c0 [ 1063.063465][ T397] Modules linked in: [ 1063.067388][ T397] CPU: 1 PID: 397 Comm: kworker/1:5 Tainted: G W 6.1.141-syzkaller-00036-g7011769d221c #0 [ 1063.078726][ T397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1063.088833][ T397] Workqueue: events iterate_cleanup_work [ 1063.094532][ T397] RIP: 0010:ref_tracker_free+0x5de/0x7c0 [ 1063.100228][ T397] Code: 85 e8 2e 70 5b 02 43 0f b6 04 2c 84 c0 4c 8b 74 24 08 0f 85 c9 01 00 00 41 8b 3f e8 dc e8 ff ff 4c 89 f6 eb 84 e8 62 f1 e5 fe <0f> 0b 4d 85 ff 0f 85 d3 fa ff ff 4c 8b 24 24 4d 8d 74 24 0c 4c 89 [ 1063.119933][ T397] RSP: 0018:ffffc9000e767b20 EFLAGS: 00010293 [ 1063.126046][ T397] RAX: ffffffff828a060e RBX: 1ffff92001cecf68 RCX: ffff888116c26540 [ 1063.134093][ T397] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000e767be0 [ 1063.142212][ T397] RBP: ffffc9000e767c50 R08: dffffc0000000000 R09: ffffc9000e767b60 [ 1063.150258][ T397] R10: fffff52001cecf7c R11: 1ffff92001cecf6c R12: ffff88811a8b80a0 [ 1063.158250][ T397] R13: dffffc0000000000 R14: ffffc9000e767b60 R15: ffff888116ff85b8 [ 1063.166343][ T397] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 1063.175317][ T397] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1063.181968][ T397] CR2: 00007f5c8fd80ab8 CR3: 0000000006e0f000 CR4: 00000000003506a0 [ 1063.189983][ T397] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1063.198009][ T397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1063.206033][ T397] Call Trace: [ 1063.209351][ T397] [ 1063.212372][ T397] ? __cfi_ref_tracker_free+0x10/0x10 [ 1063.217832][ T397] ? __cfi_device_cmp+0x10/0x10 [ 1063.222797][ T397] ? __kasan_check_read+0x11/0x20 [ 1063.227913][ T397] ? nf_ct_iterate_cleanup_net+0xe8/0x130 [ 1063.233700][ T397] iterate_cleanup_work+0x105/0x1f0 [ 1063.238954][ T397] ? __cfi_iterate_cleanup_work+0x10/0x10 [ 1063.244737][ T397] ? __schedule+0xb8f/0x14e0 [ 1063.249396][ T397] process_one_work+0x71f/0xc40 [ 1063.254315][ T397] worker_thread+0xa29/0x11f0 [ 1063.259034][ T397] kthread+0x281/0x320 [ 1063.263164][ T397] ? __cfi_worker_thread+0x10/0x10 [ 1063.268318][ T397] ? __cfi_kthread+0x10/0x10 [ 1063.272955][ T397] ret_from_fork+0x1f/0x30 [ 1063.277407][ T397] [ 1063.280497][ T397] ---[ end trace 0000000000000000 ]--- [ 1063.468077][T13284] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3953'. [ 1063.482202][T13287] sch_tbf: burst 88 is lower than device veth7 mtu (1514) ! [ 1063.677567][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1063.688358][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1063.720533][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1063.748351][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1063.775678][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 1063.782804][ T318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1063.803245][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1063.812396][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1063.821739][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 1063.828826][ T318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1063.851482][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1063.863460][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1063.871753][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1063.879937][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1063.888133][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1063.904234][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1063.912762][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1063.925837][T13249] device veth0_vlan entered promiscuous mode [ 1063.934655][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1063.943723][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1063.952229][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1063.960157][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1063.984312][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1063.993186][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1064.002560][T13249] device veth1_macvtap entered promiscuous mode [ 1064.025741][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1064.037777][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1064.046329][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1064.068495][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1064.107184][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1064.544309][T13309] syz.4.3958[13309] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1064.545630][T13309] syz.4.3958[13309] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1068.550896][T13313] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3942'. [ 1069.880882][ T326] device bridge_slave_1 left promiscuous mode [ 1069.898795][ T326] bridge0: port 2(bridge_slave_1) entered disabled state [ 1069.944901][ T326] device bridge_slave_0 left promiscuous mode [ 1069.957928][ T326] bridge0: port 1(bridge_slave_0) entered disabled state [ 1070.201567][ T326] device veth1_macvtap left promiscuous mode [ 1070.238727][ T326] device veth0_vlan left promiscuous mode [ 1071.115599][T13341] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3966'. [ 1071.454388][T13334] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1071.768502][ T326] ------------[ cut here ]------------ [ 1071.774072][ T326] WARNING: CPU: 0 PID: 326 at net/ipv4/tcp_ipv4.c:3261 tcp_sk_exit_batch+0xcb/0x140 [ 1071.783515][ T326] Modules linked in: [ 1071.787427][ T326] CPU: 0 PID: 326 Comm: kworker/u4:6 Tainted: G W 6.1.141-syzkaller-00036-g7011769d221c #0 [ 1071.798830][ T326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1071.808944][ T326] Workqueue: netns cleanup_net [ 1071.813767][ T326] RIP: 0010:tcp_sk_exit_batch+0xcb/0x140 [ 1071.819479][ T326] Code: e6 e8 29 dd 45 fd 41 83 fc 01 75 07 e8 fe d8 45 fd eb 19 bf 01 00 00 00 44 89 e6 e8 0f dd 45 fd 45 85 e4 7e 38 e8 e5 d8 45 fd <0f> 0b 49 8d 7e d0 e8 ca 06 01 00 4c 89 f0 48 c1 e8 03 42 80 3c 28 [ 1071.839157][ T326] RSP: 0018:ffffc9000dccfc28 EFLAGS: 00010293 [ 1071.845296][ T326] RAX: ffffffff842a1e8b RBX: ffffc9000dccfca0 RCX: ffff88810fb31440 [ 1071.853330][ T326] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001 [ 1071.861351][ T326] RBP: ffffc9000dccfc50 R08: dffffc0000000000 R09: ffffed1023517061 [ 1071.869339][ T326] R10: ffffed1023517061 R11: 1ffff11023517060 R12: 0000000000000002 [ 1071.877363][ T326] R13: dffffc0000000000 R14: ffff88811a8b8030 R15: ffff88811a8b8300 [ 1071.885395][ T326] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 1071.894382][ T326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1071.901010][ T326] CR2: 0000200001000000 CR3: 000000012f518000 CR4: 00000000003506b0 [ 1071.909005][ T326] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1071.917052][ T326] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1071.925065][ T326] Call Trace: [ 1071.928362][ T326] [ 1071.931330][ T326] ? __cfi_tcp_sk_exit_batch+0x10/0x10 [ 1071.936831][ T326] cleanup_net+0x62d/0xb00 [ 1071.941325][ T326] ? __cfi_cleanup_net+0x10/0x10 [ 1071.946285][ T326] process_one_work+0x71f/0xc40 [ 1071.951346][ T326] worker_thread+0xa29/0x11f0 [ 1071.956068][ T326] ? _raw_spin_lock_irqsave+0xb0/0x110 [ 1071.961594][ T326] kthread+0x281/0x320 [ 1071.965678][ T326] ? __cfi_worker_thread+0x10/0x10 [ 1071.970857][ T326] ? __cfi_kthread+0x10/0x10 [ 1071.975469][ T326] ret_from_fork+0x1f/0x30 [ 1071.979951][ T326] [ 1071.982985][ T326] ---[ end trace 0000000000000000 ]--- [ 1073.018465][T13360] 9pnet_fd: Insufficient options for proto=fd [ 1074.780697][T13388] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3979'. [ 1074.875989][T13389] cgroup: noprefix used incorrectly [ 1075.766690][T13394] loop5: detected capacity change from 0 to 512 [ 1075.821378][T13394] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 1075.844397][T13394] EXT4-fs (loop5): warning: maximal mount count reached, running e2fsck is recommended [ 1075.867183][T13394] EXT4-fs error (device loop5): ext4_orphan_get:1400: comm syz.5.3982: inode #15: comm syz.5.3982: iget: illegal inode # [ 1075.895835][T13394] EXT4-fs (loop5): Remounting filesystem read-only [ 1075.960740][T13394] EXT4-fs error (device loop5): ext4_orphan_get:1405: comm syz.5.3982: couldn't read orphan inode 15 (err -117) [ 1075.977906][T13403] 9pnet_fd: Insufficient options for proto=fd [ 1075.984555][T13403] 9pnet_fd: Insufficient options for proto=fd [ 1076.010560][T13394] EXT4-fs (loop5): Remounting filesystem read-only [ 1076.017116][T13394] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 1076.184408][T13249] EXT4-fs (loop5): unmounting filesystem. [ 1076.381675][T13418] syz.5.3988[13418] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1076.382016][T13418] syz.5.3988[13418] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1077.713363][T10414] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1078.099569][T10414] usb 6-1: Using ep0 maxpacket: 32 [ 1078.106568][T10414] usb 6-1: New USB device found, idVendor=05e3, idProduct=0502, bcdDevice=b2.ac [ 1078.206116][T10414] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1078.242577][T10414] usb 6-1: config 0 descriptor?? [ 1078.260919][T10414] gl620a: probe of 6-1:0.0 failed with error -22 [ 1078.430390][T13436] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3993'. [ 1078.687694][T13440] 9pnet_fd: Insufficient options for proto=fd [ 1078.694315][T13440] 9pnet_fd: Insufficient options for proto=fd [ 1079.538032][T10414] usb 6-1: USB disconnect, device number 4 [ 1079.670101][T13463] syz.3.4005 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 1080.305061][T13475] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4008'. [ 1081.398806][T13494] cgroup: noprefix used incorrectly [ 1082.658101][T13501] syz.1.4015[13501] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1082.658448][T13501] syz.1.4015[13501] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1083.913823][T13492] loop5: detected capacity change from 0 to 40427 [ 1084.661797][T13510] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 1084.683020][T13512] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4019'. [ 1085.371415][T13531] loop5: detected capacity change from 0 to 512 [ 1085.382915][T13531] EXT4-fs error (device loop5): ext4_orphan_get:1400: inode #17: comm syz.5.4027: iget: bogus i_mode (0) [ 1085.394468][T13531] EXT4-fs error (device loop5): ext4_orphan_get:1405: comm syz.5.4027: couldn't read orphan inode 17 (err -117) [ 1085.406948][T13531] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1086.310912][T13249] EXT4-fs (loop5): unmounting filesystem. [ 1086.335254][T13551] 9pnet_fd: Insufficient options for proto=fd [ 1086.975112][T13567] loop5: detected capacity change from 0 to 128 [ 1087.229562][ T28] audit: type=1400 audit(1751402487.504:436): avc: denied { mount } for pid=13559 comm="syz.5.4035" name="/" dev="loop5" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 1087.253115][T13562] FAT-fs (loop5): error, invalid FAT chain (i_pos 548, last_block 8) [ 1087.261274][T13562] FAT-fs (loop5): Filesystem has been set read-only [ 1087.267967][T13562] FAT-fs (loop5): error, corrupted file size (i_pos 548, 522) [ 1088.019595][T13582] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4043'. [ 1088.152251][ T28] audit: type=1400 audit(1751402488.624:437): avc: denied { unmount } for pid=13249 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 1088.284763][T13593] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4045'. [ 1089.350664][T13603] sch_tbf: burst 88 is lower than device veth5 mtu (1514) ! [ 1090.019476][ C0] ================================================================== [ 1090.027592][ C0] BUG: KASAN: use-after-free in inet_twsk_kill+0x62/0x670 [ 1090.034748][ C0] Read of size 8 at addr ffff88811a8b8340 by task syz.4.4055/13620 [ 1090.042656][ C0] [ 1090.045000][ C0] CPU: 0 PID: 13620 Comm: syz.4.4055 Tainted: G W 6.1.141-syzkaller-00036-g7011769d221c #0 [ 1090.056388][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1090.066465][ C0] Call Trace: [ 1090.069772][ C0] [ 1090.072638][ C0] __dump_stack+0x21/0x24 [ 1090.077012][ C0] dump_stack_lvl+0xee/0x150 [ 1090.081640][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 1090.086710][ C0] ? debug_smp_processor_id+0x17/0x20 [ 1090.092121][ C0] ? inet_twsk_kill+0x62/0x670 [ 1090.096915][ C0] print_address_description+0x71/0x210 [ 1090.102500][ C0] print_report+0x4a/0x60 [ 1090.106874][ C0] kasan_report+0x122/0x150 [ 1090.111409][ C0] ? inet_twsk_kill+0x62/0x670 [ 1090.116212][ C0] __asan_report_load8_noabort+0x14/0x20 [ 1090.121880][ C0] inet_twsk_kill+0x62/0x670 [ 1090.126506][ C0] ? __next_timer_interrupt+0x368/0x3d0 [ 1090.132085][ C0] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 1090.137671][ C0] ? __cfi_tw_timer_handler+0x10/0x10 [ 1090.143075][ C0] tw_timer_handler+0x1c/0x20 [ 1090.147782][ C0] call_timer_fn+0x46/0x2a0 [ 1090.152319][ C0] ? __cfi_tw_timer_handler+0x10/0x10 [ 1090.157726][ C0] __run_timers+0x639/0x9a0 [ 1090.162271][ C0] ? calc_index+0x200/0x200 [ 1090.166819][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 1090.172077][ C0] run_timer_softirq+0x6a/0xf0 [ 1090.176876][ C0] handle_softirqs+0x1d7/0x600 [ 1090.181687][ C0] __irq_exit_rcu+0x52/0xf0 [ 1090.186223][ C0] irq_exit_rcu+0x9/0x10 [ 1090.190497][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 1090.196185][ C0] [ 1090.199148][ C0] [ 1090.202105][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 1090.208123][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x60 [ 1090.214242][ C0] Code: 8b 3d 4c 2a 02 06 48 89 de e8 d4 9f 43 00 5b 5d c3 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 48 8b 45 08 <65> 48 8b 0d 40 76 92 7e 65 8b 15 41 76 92 7e 81 e2 00 01 ff 00 74 [ 1090.233887][ C0] RSP: 0018:ffffc90000a26938 EFLAGS: 00000246 [ 1090.239993][ C0] RAX: ffffffff81bad1ad RBX: 0000000008140dca RCX: 0000000000080000 [ 1090.248002][ C0] RDX: ffffc90006fd7000 RSI: 000000000007ffff RDI: ffffea00052fd4c0 [ 1090.256019][ C0] RBP: ffffc90000a26938 R08: ffff8881f5c00000 R09: 000000000006c864 [ 1090.264031][ C0] R10: 00000000495ab04d R11: 0000000000000001 R12: 0000000006bf00fa [ 1090.272039][ C0] R13: 0000000000000001 R14: ffffea00052fd4c0 R15: dffffc0000000000 [ 1090.280046][ C0] ? page_ext_get+0x1d/0x150 [ 1090.284678][ C0] page_ext_get+0x1d/0x150 [ 1090.289129][ C0] __set_page_owner+0x2a/0x60 [ 1090.293848][ C0] post_alloc_hook+0x1f5/0x210 [ 1090.298621][ C0] prep_new_page+0x1c/0x110 [ 1090.303136][ C0] get_page_from_freelist+0x2c7b/0x2cf0 [ 1090.308694][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 1090.314254][ C0] ? __mem_cgroup_uncharge_list+0x39/0xc0 [ 1090.319985][ C0] ? release_pages+0xad1/0xb20 [ 1090.324764][ C0] ? __alloc_pages+0x3a0/0x3a0 [ 1090.329539][ C0] ? __alloc_pages_bulk+0x9c0/0x9c0 [ 1090.334764][ C0] __alloc_pages+0x19e/0x3a0 [ 1090.339364][ C0] ? __cfi___alloc_pages+0x10/0x10 [ 1090.344490][ C0] ? folio_add_lru+0x260/0x390 [ 1090.349268][ C0] __folio_alloc+0x12/0x40 [ 1090.353698][ C0] wp_page_copy+0x255/0x15b0 [ 1090.358321][ C0] ? fault_dirty_shared_page+0x310/0x310 [ 1090.363995][ C0] ? vm_normal_page+0x1eb/0x200 [ 1090.368860][ C0] do_wp_page+0x9f2/0xfc0 [ 1090.373226][ C0] handle_mm_fault+0x10e4/0x2640 [ 1090.378177][ C0] ? __cfi_handle_mm_fault+0x10/0x10 [ 1090.383472][ C0] ? down_read_trylock+0x273/0x640 [ 1090.388597][ C0] ? lock_mm_and_find_vma+0x9e/0x320 [ 1090.393890][ C0] ? do_user_addr_fault+0x2ee/0x1050 [ 1090.399179][ C0] do_user_addr_fault+0x63b/0x1050 [ 1090.404295][ C0] exc_page_fault+0x51/0xb0 [ 1090.408814][ C0] asm_exc_page_fault+0x27/0x30 [ 1090.413665][ C0] RIP: 0010:copy_user_enhanced_fast_string+0xa/0x40 [ 1090.420269][ C0] Code: ff c9 75 f2 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 01 ca c3 8d 0c ca 89 ca eb 20 0f 01 cb 83 fa 40 72 38 89 d1 a4 31 c0 0f 01 ca c3 89 ca eb 0a 90 90 90 90 90 90 90 90 90 90 [ 1090.439873][ C0] RSP: 0018:ffffc90000a27380 EFLAGS: 00050202 [ 1090.445945][ C0] RAX: ffffffff82614701 RBX: 000000000000555a RCX: 0000000000002b1a [ 1090.453916][ C0] RDX: 000000000000555a RSI: ffff8881153e2a40 RDI: 0000200000f4e000 [ 1090.461886][ C0] RBP: ffffc90000a273b0 R08: dffffc0000000000 R09: ffffed1022a7caac [ 1090.469857][ C0] R10: 0000000000000000 R11: 0000000000000aa8 R12: 00007fffffff9aa6 [ 1090.477844][ C0] R13: 0000000000005500 R14: ffff8881153e0000 R15: 0000200000f4b5c0 [ 1090.485833][ C0] ? copy_pipe_to_iter+0x101/0x150 [ 1090.490983][ C0] ? copyout+0x82/0xa0 [ 1090.495081][ C0] _copy_to_iter+0x3f0/0xe50 [ 1090.499694][ C0] ? release_firmware_map_entry+0x194/0x194 [ 1090.505618][ C0] ? __cfi__copy_to_iter+0x10/0x10 [ 1090.510740][ C0] ? preempt_schedule_irq+0xbb/0x110 [ 1090.516034][ C0] ? __cfi_preempt_schedule_irq+0x10/0x10 [ 1090.521764][ C0] ? __virt_addr_valid+0x12a/0x2e0 [ 1090.526885][ C0] ? check_stack_object+0x81/0x140 [ 1090.532013][ C0] ? __kasan_check_read+0x11/0x20 [ 1090.537054][ C0] ? __check_object_size+0x45a/0x600 [ 1090.542381][ C0] simple_copy_to_iter+0x50/0x70 [ 1090.547366][ C0] __skb_datagram_iter+0x2fd/0x730 [ 1090.552518][ C0] ? __cfi_simple_copy_to_iter+0x10/0x10 [ 1090.558193][ C0] skb_copy_datagram_iter+0x40/0x150 [ 1090.563518][ C0] tcp_recvmsg_locked+0x916/0x23b0 [ 1090.568651][ C0] ? tcp_recvmsg+0x810/0x810 [ 1090.573278][ C0] ? avc_has_perm+0x158/0x240 [ 1090.577972][ C0] tcp_recvmsg+0x20e/0x810 [ 1090.582406][ C0] ? __cfi_tcp_recvmsg+0x10/0x10 [ 1090.587468][ C0] ? selinux_socket_recvmsg+0x208/0x2e0 [ 1090.593054][ C0] ? __cfi_selinux_socket_recvmsg+0x10/0x10 [ 1090.598979][ C0] ? get_page_from_freelist+0x2c7b/0x2cf0 [ 1090.604706][ C0] inet_recvmsg+0x13b/0x470 [ 1090.609220][ C0] ? try_charge_memcg+0x24a/0x15b0 [ 1090.614342][ C0] ? __cfi_inet_recvmsg+0x10/0x10 [ 1090.619395][ C0] ? security_socket_recvmsg+0x99/0xc0 [ 1090.624876][ C0] ? __cfi_inet_recvmsg+0x10/0x10 [ 1090.629916][ C0] ____sys_recvmsg+0x2a0/0x590 [ 1090.634705][ C0] ? __sys_recvmsg_sock+0x50/0x50 [ 1090.639831][ C0] ? import_iovec+0x7c/0xb0 [ 1090.644348][ C0] ___sys_recvmsg+0x1b2/0x510 [ 1090.649036][ C0] ? __sys_recvmsg+0x270/0x270 [ 1090.653801][ C0] ? finish_task_switch+0x16b/0x7b0 [ 1090.659008][ C0] ? __schedule+0xb8f/0x14e0 [ 1090.663625][ C0] ? __fget_files+0x2d5/0x330 [ 1090.668318][ C0] ? __fdget+0x19c/0x220 [ 1090.672576][ C0] __x64_sys_recvmsg+0x1ed/0x2c0 [ 1090.677543][ C0] ? __cfi___x64_sys_recvmsg+0x10/0x10 [ 1090.683018][ C0] x64_sys_call+0x75/0x9a0 [ 1090.687439][ C0] do_syscall_64+0x4c/0xa0 [ 1090.691855][ C0] ? clear_bhb_loop+0x30/0x80 [ 1090.696535][ C0] ? clear_bhb_loop+0x30/0x80 [ 1090.701215][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1090.707109][ C0] RIP: 0033:0x7f251678e929 [ 1090.711533][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1090.731150][ C0] RSP: 002b:00007f251763e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1090.739574][ C0] RAX: ffffffffffffffda RBX: 00007f25169b6080 RCX: 00007f251678e929 [ 1090.747551][ C0] RDX: 0000000000000104 RSI: 0000200000001500 RDI: 0000000000000003 [ 1090.755543][ C0] RBP: 00007f2516810b39 R08: 0000000000000000 R09: 0000000000000000 [ 1090.763515][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1090.771491][ C0] R13: 0000000000000001 R14: 00007f25169b6080 R15: 00007ffe25651648 [ 1090.779472][ C0] [ 1090.782489][ C0] [ 1090.784820][ C0] Allocated by task 3013: [ 1090.789142][ C0] kasan_set_track+0x4b/0x70 [ 1090.793732][ C0] kasan_save_alloc_info+0x25/0x30 [ 1090.798849][ C0] __kasan_slab_alloc+0x72/0x80 [ 1090.803707][ C0] slab_post_alloc_hook+0x4f/0x2d0 [ 1090.808823][ C0] kmem_cache_alloc+0x16e/0x330 [ 1090.813675][ C0] copy_net_ns+0x145/0x5c0 [ 1090.818093][ C0] create_new_namespaces+0x3a2/0x660 [ 1090.823382][ C0] unshare_nsproxy_namespaces+0x120/0x170 [ 1090.829101][ C0] ksys_unshare+0x4ac/0x7b0 [ 1090.833608][ C0] __x64_sys_unshare+0x38/0x40 [ 1090.838377][ C0] x64_sys_call+0x767/0x9a0 [ 1090.842876][ C0] do_syscall_64+0x4c/0xa0 [ 1090.847288][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1090.853183][ C0] [ 1090.855500][ C0] Freed by task 326: [ 1090.859385][ C0] kasan_set_track+0x4b/0x70 [ 1090.863978][ C0] kasan_save_free_info+0x31/0x50 [ 1090.869007][ C0] ____kasan_slab_free+0x132/0x180 [ 1090.874115][ C0] __kasan_slab_free+0x11/0x20 [ 1090.878887][ C0] slab_free_freelist_hook+0xc2/0x190 [ 1090.884259][ C0] kmem_cache_free+0x12d/0x300 [ 1090.889022][ C0] cleanup_net+0xa58/0xb00 [ 1090.893435][ C0] process_one_work+0x71f/0xc40 [ 1090.898279][ C0] worker_thread+0xa29/0x11f0 [ 1090.902947][ C0] kthread+0x281/0x320 [ 1090.907031][ C0] ret_from_fork+0x1f/0x30 [ 1090.911444][ C0] [ 1090.913759][ C0] Last potentially related work creation: [ 1090.919463][ C0] kasan_save_stack+0x3a/0x60 [ 1090.924137][ C0] __kasan_record_aux_stack+0xb6/0xc0 [ 1090.929527][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 1090.935343][ C0] insert_work+0x51/0x300 [ 1090.939675][ C0] __queue_work+0x9b1/0xd30 [ 1090.944181][ C0] delayed_work_timer_fn+0x61/0x80 [ 1090.949292][ C0] call_timer_fn+0x46/0x2a0 [ 1090.953794][ C0] __run_timers+0x667/0x9a0 [ 1090.958296][ C0] run_timer_softirq+0xb8/0xf0 [ 1090.963066][ C0] handle_softirqs+0x1d7/0x600 [ 1090.967829][ C0] __irq_exit_rcu+0x52/0xf0 [ 1090.972333][ C0] irq_exit_rcu+0x9/0x10 [ 1090.976568][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 1090.982203][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 1090.988183][ C0] [ 1090.990505][ C0] Second to last potentially related work creation: [ 1090.997081][ C0] kasan_save_stack+0x3a/0x60 [ 1091.001759][ C0] __kasan_record_aux_stack+0xb6/0xc0 [ 1091.007171][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 1091.013001][ C0] insert_work+0x51/0x300 [ 1091.017352][ C0] __queue_work+0x9b1/0xd30 [ 1091.021863][ C0] delayed_work_timer_fn+0x61/0x80 [ 1091.026977][ C0] call_timer_fn+0x46/0x2a0 [ 1091.031483][ C0] __run_timers+0x667/0x9a0 [ 1091.035989][ C0] run_timer_softirq+0xb8/0xf0 [ 1091.040758][ C0] handle_softirqs+0x1d7/0x600 [ 1091.045546][ C0] __irq_exit_rcu+0x52/0xf0 [ 1091.050070][ C0] irq_exit_rcu+0x9/0x10 [ 1091.054352][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 1091.060015][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 1091.066019][ C0] [ 1091.068358][ C0] The buggy address belongs to the object at ffff88811a8b8000 [ 1091.068358][ C0] which belongs to the cache net_namespace of size 4224 [ 1091.082692][ C0] The buggy address is located 832 bytes inside of [ 1091.082692][ C0] 4224-byte region [ffff88811a8b8000, ffff88811a8b9080) [ 1091.096062][ C0] [ 1091.098389][ C0] The buggy address belongs to the physical page: [ 1091.104793][ C0] page:ffffea00046a2e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88811a8bd780 pfn:0x11a8b8 [ 1091.116339][ C0] head:ffffea00046a2e00 order:3 compound_mapcount:0 compound_pincount:0 [ 1091.124662][ C0] flags: 0x4000000000010200(slab|head|zone=1) [ 1091.130757][ C0] raw: 4000000000010200 0000000000000000 dead000000000001 ffff8881002adc80 [ 1091.139376][ C0] raw: ffff88811a8bd780 0000000080070002 00000001ffffffff 0000000000000000 [ 1091.147963][ C0] page dumped because: kasan: bad access detected [ 1091.154384][ C0] page_owner tracks the page as allocated [ 1091.160093][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 2775, tgid 2768 (syz.0.764), ts 225552185926, free_ts 206891727015 [ 1091.183040][ C0] post_alloc_hook+0x1f5/0x210 [ 1091.187832][ C0] prep_new_page+0x1c/0x110 [ 1091.192350][ C0] get_page_from_freelist+0x2c7b/0x2cf0 [ 1091.197908][ C0] __alloc_pages+0x19e/0x3a0 [ 1091.202504][ C0] alloc_slab_page+0x6e/0xf0 [ 1091.207191][ C0] new_slab+0x98/0x3d0 [ 1091.211267][ C0] ___slab_alloc+0x6f6/0xb50 [ 1091.215858][ C0] __slab_alloc+0x5e/0xa0 [ 1091.220229][ C0] kmem_cache_alloc+0x1b0/0x330 [ 1091.225085][ C0] copy_net_ns+0x145/0x5c0 [ 1091.229502][ C0] create_new_namespaces+0x3a2/0x660 [ 1091.234793][ C0] copy_namespaces+0x1d1/0x220 [ 1091.239577][ C0] copy_process+0x12e0/0x3420 [ 1091.244258][ C0] kernel_clone+0x23a/0x810 [ 1091.248767][ C0] __x64_sys_clone+0x168/0x1b0 [ 1091.253538][ C0] x64_sys_call+0x990/0x9a0 [ 1091.258041][ C0] page last free stack trace: [ 1091.262711][ C0] free_unref_page_prepare+0x742/0x750 [ 1091.268174][ C0] free_unref_page+0x8f/0x530 [ 1091.272855][ C0] __free_pages+0x67/0x100 [ 1091.277270][ C0] __free_slab+0xca/0x1a0 [ 1091.281600][ C0] discard_slab+0x29/0x40 [ 1091.285943][ C0] __slab_free+0x201/0x280 [ 1091.290360][ C0] ___cache_free+0xbf/0xd0 [ 1091.294779][ C0] qlist_free_all+0xc6/0x140 [ 1091.299372][ C0] kasan_quarantine_reduce+0x14a/0x170 [ 1091.304836][ C0] __kasan_slab_alloc+0x24/0x80 [ 1091.309687][ C0] slab_post_alloc_hook+0x4f/0x2d0 [ 1091.314798][ C0] kmem_cache_alloc+0x16e/0x330 [ 1091.319645][ C0] vm_area_dup+0x27/0x280 [ 1091.323971][ C0] copy_mm+0xb45/0x1a10 [ 1091.328134][ C0] copy_process+0x12b4/0x3420 [ 1091.332815][ C0] kernel_clone+0x23a/0x810 [ 1091.337322][ C0] [ 1091.339641][ C0] Memory state around the buggy address: [ 1091.345267][ C0] ffff88811a8b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1091.353340][ C0] ffff88811a8b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1091.361390][ C0] >ffff88811a8b8300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1091.369464][ C0] ^ [ 1091.375620][ C0] ffff88811a8b8380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1091.383697][ C0] ffff88811a8b8400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1091.391762][ C0] ================================================================== [ 1091.399891][ C0] Disabling lock debugging due to kernel taint [ 1091.406081][ C0] ------------[ cut here ]------------ [ 1091.411574][ C0] refcount_t: decrement hit 0; leaking memory. [ 1091.417835][ C0] WARNING: CPU: 0 PID: 13620 at lib/refcount.c:31 refcount_warn_saturate+0xe8/0x1a0 [ 1091.427293][ C0] Modules linked in: [ 1091.431318][ C0] CPU: 0 PID: 13620 Comm: syz.4.4055 Tainted: G B W 6.1.141-syzkaller-00036-g7011769d221c #0 [ 1091.442728][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1091.452068][ T28] audit: type=1400 audit(1751402491.924:438): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 1091.452816][ C0] RIP: 0010:refcount_warn_saturate+0xe8/0x1a0 [ 1091.480684][ C0] Code: 05 01 0f 85 99 00 00 00 e8 95 b5 0c ff 5b 41 5e 5d c3 e8 8b b5 0c ff c6 05 ed ab 0b 05 01 48 c7 c7 e0 a1 a9 85 e8 38 fb dd fe <0f> 0b eb df e8 6f b5 0c ff c6 05 cf ab 0b 05 01 48 c7 c7 20 a1 a9 [ 1091.500342][ C0] RSP: 0018:ffffc90000007cb0 EFLAGS: 00010246 [ 1091.506443][ C0] RAX: 9f00e12c912fe600 RBX: 0000000000000004 RCX: ffff888113ccd100 [ 1091.514582][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 1091.516566][ T28] audit: type=1400 audit(1751402491.944:439): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1091.522610][ C0] RBP: ffffc90000007cc0 R08: dffffc0000000000 R09: fffff52000000f11 [ 1091.552025][ C0] R10: fffff52000000f11 R11: 1ffff92000000f10 R12: ffff88810cec1070 [ 1091.560050][ C0] R13: dffffc0000000000 R14: 0000000000000004 R15: 0000000000000001 [ 1091.568045][ C0] FS: 00007f251763e6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 1091.577041][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1091.583673][ C0] CR2: 0000200000f4e000 CR3: 000000011616a000 CR4: 00000000003506b0 [ 1091.591708][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1091.591977][ T28] audit: type=1400 audit(1751402491.944:440): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1091.599720][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1091.599738][ C0] Call Trace: [ 1091.599744][ C0] [ 1091.599752][ C0] inet_twsk_kill+0x533/0x670 [ 1091.599782][ C0] ? __cfi_tw_timer_handler+0x10/0x10 [ 1091.645182][ C0] tw_timer_handler+0x1c/0x20 [ 1091.649930][ C0] call_timer_fn+0x46/0x2a0 [ 1091.653016][ T28] audit: type=1400 audit(1751402491.944:441): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1091.654463][ C0] ? __cfi_tw_timer_handler+0x10/0x10 [ 1091.675483][ T28] audit: type=1400 audit(1751402491.944:442): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1091.680376][ C0] __run_timers+0x639/0x9a0 [ 1091.701227][ T28] audit: type=1400 audit(1751402491.944:443): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1091.705307][ C0] ? calc_index+0x200/0x200 [ 1091.728528][ T28] audit: type=1400 audit(1751402491.944:444): avc: denied { getattr } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1091.732668][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 1091.760381][ C0] run_timer_softirq+0x6a/0xf0 [ 1091.765178][ C0] handle_softirqs+0x1d7/0x600 [ 1091.770005][ C0] __irq_exit_rcu+0x52/0xf0 [ 1091.774535][ C0] irq_exit_rcu+0x9/0x10 [ 1091.778802][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 1091.784509][ C0] [ 1091.786660][T13631] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 1091.787459][ C0] [ 1091.787472][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 1091.802599][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x60 [ 1091.808703][ C0] Code: 8b 3d 4c 2a 02 06 48 89 de e8 d4 9f 43 00 5b 5d c3 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 48 8b 45 08 <65> 48 8b 0d 40 76 92 7e 65 8b 15 41 76 92 7e 81 e2 00 01 ff 00 74 [ 1091.828391][ C0] RSP: 0018:ffffc90000a26938 EFLAGS: 00000246 [ 1091.834515][ C0] RAX: ffffffff81bad1ad RBX: 0000000008140dca RCX: 0000000000080000 [ 1091.842542][ C0] RDX: ffffc90006fd7000 RSI: 000000000007ffff RDI: ffffea00052fd4c0 [ 1091.850567][ C0] RBP: ffffc90000a26938 R08: ffff8881f5c00000 R09: 000000000006c864 [ 1091.858565][ C0] R10: 00000000495ab04d R11: 0000000000000001 R12: 0000000006bf00fa [ 1091.866583][ C0] R13: 0000000000000001 R14: ffffea00052fd4c0 R15: dffffc0000000000 [ 1091.874602][ C0] ? page_ext_get+0x1d/0x150 [ 1091.879254][ C0] page_ext_get+0x1d/0x150 [ 1091.883721][ C0] __set_page_owner+0x2a/0x60 [ 1091.888428][ C0] post_alloc_hook+0x1f5/0x210 [ 1091.893255][ C0] prep_new_page+0x1c/0x110 [ 1091.897788][ C0] get_page_from_freelist+0x2c7b/0x2cf0 [ 1091.903397][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 1091.908980][ C0] ? __mem_cgroup_uncharge_list+0x39/0xc0 [ 1091.914771][ C0] ? release_pages+0xad1/0xb20 [ 1091.919603][ C0] ? __alloc_pages+0x3a0/0x3a0 [ 1091.924403][ C0] ? __alloc_pages_bulk+0x9c0/0x9c0 [ 1091.929661][ C0] __alloc_pages+0x19e/0x3a0 [ 1091.934289][ C0] ? __cfi___alloc_pages+0x10/0x10 [ 1091.939424][ C0] ? folio_add_lru+0x260/0x390 [ 1091.944242][ C0] __folio_alloc+0x12/0x40 [ 1091.948723][ C0] wp_page_copy+0x255/0x15b0 [ 1091.953372][ C0] ? fault_dirty_shared_page+0x310/0x310 [ 1091.959034][ C0] ? vm_normal_page+0x1eb/0x200 [ 1091.963925][ C0] do_wp_page+0x9f2/0xfc0 [ 1091.968292][ C0] handle_mm_fault+0x10e4/0x2640 [ 1091.973287][ C0] ? __cfi_handle_mm_fault+0x10/0x10 [ 1091.978607][ C0] ? down_read_trylock+0x273/0x640 [ 1091.983778][ C0] ? lock_mm_and_find_vma+0x9e/0x320 [ 1091.989108][ C0] ? do_user_addr_fault+0x2ee/0x1050 [ 1091.994447][ C0] do_user_addr_fault+0x63b/0x1050 [ 1091.999611][ C0] exc_page_fault+0x51/0xb0 [ 1092.004142][ C0] asm_exc_page_fault+0x27/0x30 [ 1092.009034][ C0] RIP: 0010:copy_user_enhanced_fast_string+0xa/0x40 [ 1092.015676][ C0] Code: ff c9 75 f2 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 01 ca c3 8d 0c ca 89 ca eb 20 0f 01 cb 83 fa 40 72 38 89 d1 a4 31 c0 0f 01 ca c3 89 ca eb 0a 90 90 90 90 90 90 90 90 90 90 [ 1092.035328][ C0] RSP: 0018:ffffc90000a27380 EFLAGS: 00050202 [ 1092.041462][ C0] RAX: ffffffff82614701 RBX: 000000000000555a RCX: 0000000000002b1a [ 1092.049487][ C0] RDX: 000000000000555a RSI: ffff8881153e2a40 RDI: 0000200000f4e000 [ 1092.057477][ C0] RBP: ffffc90000a273b0 R08: dffffc0000000000 R09: ffffed1022a7caac [ 1092.065485][ C0] R10: 0000000000000000 R11: 0000000000000aa8 R12: 00007fffffff9aa6 [ 1092.073488][ C0] R13: 0000000000005500 R14: ffff8881153e0000 R15: 0000200000f4b5c0 [ 1092.081492][ C0] ? copy_pipe_to_iter+0x101/0x150 [ 1092.086625][ C0] ? copyout+0x82/0xa0 [ 1092.090719][ C0] _copy_to_iter+0x3f0/0xe50 [ 1092.095323][ C0] ? release_firmware_map_entry+0x194/0x194 [ 1092.101260][ C0] ? __cfi__copy_to_iter+0x10/0x10 [ 1092.106390][ C0] ? preempt_schedule_irq+0xbb/0x110 [ 1092.111704][ C0] ? __cfi_preempt_schedule_irq+0x10/0x10 [ 1092.117434][ C0] ? __virt_addr_valid+0x12a/0x2e0 [ 1092.122579][ C0] ? check_stack_object+0x81/0x140 [ 1092.127724][ C0] ? __kasan_check_read+0x11/0x20 [ 1092.132792][ C0] ? __check_object_size+0x45a/0x600 [ 1092.138104][ C0] simple_copy_to_iter+0x50/0x70 [ 1092.143095][ C0] __skb_datagram_iter+0x2fd/0x730 [ 1092.148244][ C0] ? __cfi_simple_copy_to_iter+0x10/0x10 [ 1092.153936][ C0] skb_copy_datagram_iter+0x40/0x150 [ 1092.159274][ C0] tcp_recvmsg_locked+0x916/0x23b0 [ 1092.164435][ C0] ? tcp_recvmsg+0x810/0x810 [ 1092.169046][ C0] ? avc_has_perm+0x158/0x240 [ 1092.173758][ C0] tcp_recvmsg+0x20e/0x810 [ 1092.178207][ C0] ? __cfi_tcp_recvmsg+0x10/0x10 [ 1092.183171][ C0] ? selinux_socket_recvmsg+0x208/0x2e0 [ 1092.188745][ C0] ? __cfi_selinux_socket_recvmsg+0x10/0x10 [ 1092.194678][ C0] ? get_page_from_freelist+0x2c7b/0x2cf0 [ 1092.200435][ C0] inet_recvmsg+0x13b/0x470 [ 1092.204958][ C0] ? try_charge_memcg+0x24a/0x15b0 [ 1092.210156][ C0] ? __cfi_inet_recvmsg+0x10/0x10 [ 1092.215211][ C0] ? security_socket_recvmsg+0x99/0xc0 [ 1092.220715][ C0] ? __cfi_inet_recvmsg+0x10/0x10 [ 1092.225753][ C0] ____sys_recvmsg+0x2a0/0x590 [ 1092.230548][ C0] ? __sys_recvmsg_sock+0x50/0x50 [ 1092.235594][ C0] ? import_iovec+0x7c/0xb0 [ 1092.240137][ C0] ___sys_recvmsg+0x1b2/0x510 [ 1092.244835][ C0] ? __sys_recvmsg+0x270/0x270 [ 1092.249630][ C0] ? finish_task_switch+0x16b/0x7b0 [ 1092.254864][ C0] ? __schedule+0xb8f/0x14e0 [ 1092.259495][ C0] ? __fget_files+0x2d5/0x330 [ 1092.264203][ C0] ? __fdget+0x19c/0x220 [ 1092.268472][ C0] __x64_sys_recvmsg+0x1ed/0x2c0 [ 1092.273461][ C0] ? __cfi___x64_sys_recvmsg+0x10/0x10 [ 1092.278955][ C0] x64_sys_call+0x75/0x9a0 [ 1092.283416][ C0] do_syscall_64+0x4c/0xa0 [ 1092.287848][ C0] ? clear_bhb_loop+0x30/0x80 [ 1092.292560][ C0] ? clear_bhb_loop+0x30/0x80 [ 1092.297259][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1092.303218][ C0] RIP: 0033:0x7f251678e929 [ 1092.307657][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1092.327289][ C0] RSP: 002b:00007f251763e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1092.335754][ C0] RAX: ffffffffffffffda RBX: 00007f25169b6080 RCX: 00007f251678e929 [ 1092.343859][ C0] RDX: 0000000000000104 RSI: 0000200000001500 RDI: 0000000000000003 [ 1092.351871][ C0] RBP: 00007f2516810b39 R08: 0000000000000000 R09: 0000000000000000 [ 1092.359894][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1092.367880][ C0] R13: 0000000000000001 R14: 00007f25169b6080 R15: 00007ffe25651648 [ 1092.375889][ C0] [ 1092.378914][ C0] ---[ end trace 0000000000000000 ]--- [ 1092.387041][T13637] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4062'. [ 1098.955374][ T28] audit: type=1400 audit(1751402499.424:445): avc: denied { read } for pid=13640 comm="poweroff" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Stopping sshd: stopped /usr/sbin/sshd (pid 193) OK Stopping crond: stopped /usr/sbin/crond (pid 186) OK Stopping dhcpcd... stopped /sbin/dhcpcd (pid 140) [ 1099.219745][ T28] audit: type=1400 audit(1751402499.694:446): avc: denied { search } for pid=13652 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping network: [ 1099.290980][ T28] audit: type=1400 audit(1751402499.764:447): avc: denied { read write } for pid=13660 comm="ip" path="/dev/console" dev="rootfs" ino=1075 scontext=system_u:system_r:ifconfig_t tcontext=system_u:object_r:root_t tclass=chr_file permissive=1 [ 1099.338363][ T28] audit: type=1400 audit(1751402499.804:448): avc: denied { write } for pid=141 comm="dhcpcd" name="dhcpcd" dev="tmpfs" ino=489 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1099.360450][ T28] audit: type=1400 audit(1751402499.804:449): avc: denied { remove_name } for pid=141 comm="dhcpcd" name="sock" dev="tmpfs" ino=491 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1099.382623][ T28] audit: type=1400 audit(1751402499.804:450): avc: denied { unlink } for pid=141 comm="dhcpcd" name="sock" dev="tmpfs" ino=491 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=sock_file permissive=1 [ 1099.405865][ T28] audit: type=1400 audit(1751402499.804:451): avc: denied { unlink } for pid=141 comm="dhcpcd" name="pid" dev="tmpfs" ino=490 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 OK Stopping iptables: [ 1099.444516][ T28] audit: type=1400 audit(1751402499.914:452): avc: denied { read write } for pid=13666 comm="iptables" path="/dev/console" dev="rootfs" ino=1075 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:root_t tclass=chr_file permissive=1 OK [ 1099.468472][ T28] audit: type=1400 audit(1751402499.914:453): avc: denied { search } for pid=13666 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping system [ 1099.491336][ T28] audit: type=1400 audit(1751402499.914:454): avc: denied { write } for pid=13666 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 message bus: done Stopping klogd: OK