last executing test programs: 4.83766974s ago: executing program 1 (id=2): prctl$PR_SET_IO_FLUSHER(0x39, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x8000000}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}, 0x1, 0x0, 0x0, 0x814}, 0x0) 3.84367545s ago: executing program 1 (id=8): prctl$PR_SET_NAME(0xf, &(0x7f0000000480)='gtp\x00') bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007d000000180100002020732600000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x2, 0x64, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x5, 0x2, 0x0, 0x70bd2d, 0x25dfdbfe}, 0x10}}, 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='kfree\x00', r1}, 0x18) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='\v\x00\x00\x00\a\x00\x00\x00\b'], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000060060000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000180)='kfree\x00', r3}, 0x18) r4 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffe, 0x6, 0x2, @scatter={0x0, 0x40000, 0x0}, &(0x7f0000000080)="0000501effd4", 0x0, 0x800004, 0x10030, 0x1, 0x0}) socket$netlink(0x10, 0x3, 0x8000000004) 3.84344718s ago: executing program 2 (id=3): prctl$PR_SET_NAME(0xf, &(0x7f0000000480)='gtp\x00') bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007d000000180100002020732600000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x2, 0x64, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x5, 0x2, 0x0, 0x70bd2d, 0x25dfdbfe}, 0x10}}, 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='kfree\x00', r1}, 0x18) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='\v\x00\x00\x00\a\x00\x00\x00\b\x00\x00\x00)\x00\x00\x00'], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000060060000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000180)='kfree\x00', r3}, 0x18) r4 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffe, 0x6, 0x2, @scatter={0x0, 0x40000, 0x0}, &(0x7f0000000080)="0000501effd4", 0x0, 0x800004, 0x10030, 0x1, 0x0}) socket$netlink(0x10, 0x3, 0x8000000004) 3.425424674s ago: executing program 0 (id=13): prctl$PR_SET_NAME(0xf, &(0x7f0000000480)='gtp\x00') bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007d000000180100002020732600000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x2, 0x64, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x5, 0x2, 0x0, 0x70bd2d, 0x25dfdbfe}, 0x10}}, 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='kfree\x00', r1}, 0x18) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='\v\x00\x00\x00\a\x00\x00\x00\b\x00\x00\x00)\x00\x00'], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000060060000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000180)='kfree\x00', r3}, 0x18) r4 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffe, 0x6, 0x2, @scatter={0x0, 0x40000, 0x0}, &(0x7f0000000080)="0000501effd4", 0x0, 0x800004, 0x10030, 0x1, 0x0}) socket$netlink(0x10, 0x3, 0x8000000004) 2.478539731s ago: executing program 3 (id=17): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00'}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) setsockopt$TIPC_MCAST_BROADCAST(r3, 0x10f, 0x85) bind$unix(r0, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) epoll_create1(0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x200008, &(0x7f0000000180)={[{@grpquota}, {@block_validity}, {@grpid}, {@oldalloc}]}, 0x1, 0x504, &(0x7f0000001000)="$eJzs3c9vI1cdAPDveOPEyaZNWnoABO3SFha0WifxtlHVA5QTQqgSokeQtiHxRlHsOIqd0oQ9pGckTkhU4gRH/gDOPXHnguDGpRyQ+BGBGiQORjMep07W3gSS2FH8+UijeW/erL/vbXbei7/Z+AUwtu5ExEFETEbEuxExl19P8iPe6hzpfZ8cPl49Ony8mkS7/c7fk6w9vRY9fyZ1O3/NUkR871sRP0yejNvc299cqdWqO3l9oVXfXmju7d/fqK+sV9erW5XK8tLy4hsPXq9c2lhfqk/mpS9+/LuDr/047dZsfqV3HJepM/TicZzURER85yqCjcCtfDyTo+4I/5dCRDwfES9nz/9c3Mq+mgDATdZuz0V7rrd+LDlZBQBuikKWA0sK5TwXMBuFQrncyeG9EDOFWqPZuveosbu11smVzUex8GijVl3Mc4XzUUzS+lJW/rReOVV/EBHPRcTPpqazenm1UVsb5Tc+ADDGbp9a//811Vn/AYAbrjTqDgAAQ2f9B4DxY/0HgPFj/QeA8dNZ/6dH3Q0AYIi8/weA8WP9B4Cx8t23306P9lH++ddr7+3tbjbeu79WbW6W67ur5dXGznZ5vdFYzz6zp37W69Uaje2l12L3/fmvbzdbC829/Yf1xu5W62H2ud4Pq8XsroMhjAwAGOS5lz76Y5KuyG9OZ0f07OVQHGnPgKtWGHUHgJG5NeoOACNjty8YXxd4j1+M+KkUAdwAfbboPaHU7xeE2u12++q6BFyxu5+T/4dx1ZP/97+AYczI/8P4kv+H8dVuJ+fd5D/OeyMAcL3J8QMDfv7/fH7+df7DgR+snb7jw6vsFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFxv3f1/y/le4LNRKJTLEc9ExHwUk0cbtepiRDwbEX+YKk6l9aUR9xkAuKjCX5J8/6+7c6/Onmh68fZxcTIifvSLd37+/kqrtfP7iMnkH1Pd660P8+uV4fceADhbd53Ozj1v5D85fLzaPYbZn79+MyJKnfhHh5NxdBx/IiaycymKETHzzySvdyQ9uYuLOPggIj7bb/xJzGY5kM7Op6fjp7GfGWr8won4haytc07/Lj5zCX2BcfNROv+81e/5K8Sd7Nz/+S9lM9TF5fNf+lKrR9kc+Gn87vx3a8D8d+e8MV777bc7pekn2z6I+PxERDf2Uc/8042fDIj/6jnj/+kLL748qK39y4i70T9+b6yFVn17obm3f3+jvrJeXa9uVSrLS8uLbzx4vbKQ5agXBq8Gf3vz3rOD2tLxzwyIXzpj/F8+5/h/9Z93v/+lp8T/6iv94hfihafET9fEr5wz/srMb0qD2tL4awPGf9bX/94543/85/0ntg0HAEanube/uVKrVXcUFK5/If0new260bfwjWHFmoz+TT95pfNMn2rqfu//P8YaNGNcRtYNuA6OH/qI+PeoOwMAAAAAAAAAAAAAAPQ1jN9YGvUYAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuLn+GwAA//+hm8cd") lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./file1\x00', &(0x7f00000000c0), &(0x7f0000000040)=ANY=[], 0xfe37, 0x0) llistxattr(&(0x7f0000000400)='./file1\x00', 0x0, 0x0) 2.219316141s ago: executing program 3 (id=20): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) pwrite64(r3, &(0x7f0000000080)='3', 0x1, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYRESDEC=r2, @ANYRESOCT=r2, @ANYBLOB="c3ef8c3b58aaef8c83f07d6ef0c8948ebc23a70e67599b79dd2f93ed176e052270b57e2e86c8fa8f8d1b202ebb9653b3e9e011b4aa9e407fbdc861f2af056e2c7270ecc339561cb0e1ffd9bc", @ANYBLOB], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002f40)=ANY=[@ANYBLOB="40000000210a010800000000000000000a0000010900020073797a31000000000900010073797a31000000001400038010"], 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) r6 = io_uring_setup(0x177e, &(0x7f0000000140)) r7 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, 0xffffffffffffffff, &(0x7f0000000040)={0xa0000004}) poll(&(0x7f00000000c0)=[{r7, 0x1009}], 0x1, 0x8000007) close_range(r6, 0xffffffffffffffff, 0x0) setgroups(0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0xf1, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x0, 0xf1ffffff, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_HH_FLOWS_LIMIT={0x4}]}}]}, 0x38}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000400)={'syztnl0\x00', &(0x7f0000000340)={'ip6gre0\x00', 0x0, 0x4, 0xa, 0x0, 0x6, 0x30, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x700, 0x1, 0xfffffa24, 0x6}}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)={0x58, r1, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x2000b805}, 0x4000080) 2.061680444s ago: executing program 3 (id=21): perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0xfc, 0x0, 0x7ffc0002}]}) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) pipe(&(0x7f0000000500)={0xffffffffffffffff}) io_setup(0x2, &(0x7f0000002400)) fcntl$setpipe(r2, 0x407, 0x401) ptrace$setregs(0xd, r1, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x4004944) mq_notify(0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0xa) modify_ldt$write(0x1, &(0x7f0000000040)={0x806, 0x100000}, 0x10) syz_clone(0x26801000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000500)=@IORING_OP_READ=@pass_buffer={0x16, 0x2, 0x2000, @fd, 0x9, 0x0, 0x0, 0x2}) 1.817114504s ago: executing program 3 (id=22): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002940)=ANY=[@ANYBLOB="140000001000010000008100000000000000000a98010000020a0102"], 0x3b0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0x200000000000002f, &(0x7f00000003c0)=ANY=[@ANYRES8=r1, @ANYRESHEX=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) socket$packet(0x11, 0x3, 0x300) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r2) r3 = socket$kcm(0x2, 0x200000000000001, 0x106) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000006"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRESDEC, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001940)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x64, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r4}, 0x10) r5 = socket(0x1e, 0x805, 0x0) connect$tipc(r5, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x40}, 0x2}}, 0x10) close(r5) sendmsg$inet(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x3406c012) write$cgroup_type(r2, &(0x7f0000000080), 0x11ffffce1) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) r8 = syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x0, 0x30002, 0x4}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) io_uring_register$IORING_REGISTER_FILES2(r2, 0xd, &(0x7f0000000880)={0x5, 0x0, 0x0, &(0x7f0000000780)=[{&(0x7f00000004c0)=""/7, 0x7}, {&(0x7f0000000580)=""/198, 0xc6}, {&(0x7f0000000500)=""/29, 0x1d}, {&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000000680)=""/255, 0xff}], &(0x7f0000000800)=[0x668, 0x7, 0x2, 0xfff, 0x8001, 0x100, 0x8, 0x6, 0x4]}, 0x20) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) io_uring_enter(r8, 0x4946, 0x4000, 0x0, 0x0, 0x0) syz_emit_ethernet(0x83, 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0xfffffe75, &(0x7f0000000c80)=ANY=[], 0xe0}, 0x20004025) 1.586329142s ago: executing program 4 (id=23): perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0xfc, 0x0, 0x7ffc0002}]}) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x2, &(0x7f0000002400)=0x0) io_submit(r4, 0x1, &(0x7f0000000040)=[&(0x7f00000010c0)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) fcntl$setpipe(r2, 0x407, 0x401) ptrace$setregs(0xd, r1, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x4004944) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r6, &(0x7f0000000000)='map_files\x00') mq_notify(0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0xa) modify_ldt$write(0x1, &(0x7f0000000040)={0x806, 0x100000}, 0x10) syz_clone(0x26801000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x400252}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000500)=@IORING_OP_READ=@pass_buffer={0x16, 0x2, 0x2000, @fd, 0x9, 0x0, 0x0, 0x2}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00'}, 0x10) 1.403992727s ago: executing program 2 (id=24): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000"], 0x0, 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = syz_open_dev$MSR(&(0x7f00000026c0), 0x1, 0x0) ioctl$X86_IOC_RDMSR_REGS(r0, 0xc02063a0, &(0x7f0000002700)=[0x8, 0x101, 0x100, 0x6b, 0x0, 0x2, 0xcf11, 0x9]) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x7, 0x4, 0x40, 0xd9}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r1}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r2, 0x0, 0x20008000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000ff0700000000000000000500000a140000000e0a010100000000000000000100000814000000110001000000001d000000000000000ac3d966911b05e435ad2fd9e26cd386ee89b942c7fe04223e01d998f1851d4223dc4dc2e77fdbfed6b58f7f0b0ef22d90ec2bc473c569a935f0dcfc46201d82b4c7fcdd34b5a4cf43bcd32173b3861f60b4a3766eea6303e3ab7d2e2a37f20742ffc78f283e107420354c2267818ec45308f6a75a3c1f55f67d9f99b4f3fceab19ece05c20ba6ab7f530cd93d497eb9f98a81589bc06c806dd5d8e7e41b5ea81ca8a2b7aad915"], 0x3c}, 0x1, 0x0, 0x0, 0x40051}, 0x1) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x200202, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)=ANY=[], 0xff2e) r5 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x4, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc9ffb}]}) mlock2(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000014c0)='kmem_cache_free\x00', r6}, 0x18) utimes(0x0, 0x0) ioctl$TCXONC(r4, 0x540a, 0x3) 1.400473677s ago: executing program 1 (id=25): perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0xfc, 0x0, 0x7ffc0002}]}) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) pipe(&(0x7f0000000500)={0xffffffffffffffff}) io_setup(0x2, &(0x7f0000002400)) fcntl$setpipe(r2, 0x407, 0x401) ptrace$setregs(0xd, r1, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x4004944) mq_notify(0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0xa) modify_ldt$write(0x1, &(0x7f0000000040)={0x806, 0x100000}, 0x10) syz_clone(0x26801000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000500)=@IORING_OP_READ=@pass_buffer={0x16, 0x2, 0x2000, @fd, 0x9, 0x0, 0x0, 0x2}) 1.399890917s ago: executing program 0 (id=26): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000100000000000a20000000000a01010000000000000000010000000900010073797a300000000068000000090a010400000000000000000100000008000a4000000000200011800e000100636f6e6e6c696d69740000000c00028008000140000000000900010073797a30000000000900020073797a3200000000080005400000001f0c000980080001400037"], 0xb0}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, 0x0, &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) 1.24552804s ago: executing program 4 (id=27): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0), 0x250a80, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='kmem_cache_free\x00', r4}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) ppoll(&(0x7f0000000500), 0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) sendmsg$nl_xfrm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="ac0000002100010027bd7000fbdbdf25ff010000000000000000000000000001fe8000000000000000000000000000bb4e2100004e219ffd070080201d000000", @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="a86b6e00b300000050001100fc00000000000000000000000000000100000000000000000000000000000001ffffffff000000000000000000000000000000000000000000000000000000006c010000000000000a0002000c001c00", @ANYRES16=r2, @ANYBLOB='*r\" '], 0xac}, 0x1, 0x0, 0x0, 0x4000840}, 0x4040) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000004c0)='netlink_extack\x00', r1, 0x0, 0x6}, 0x18) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_freezer_state(r5, &(0x7f0000000340), 0x2, 0x0) close(r6) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0xd, 0x10, &(0x7f0000000580)=ANY=[@ANYRESHEX=r6, @ANYRES32, @ANYRES64], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) mlock2(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1) r7 = memfd_secret(0x80000) syz_emit_ethernet(0x3b6, &(0x7f0000001040)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb86dd60122d9203803afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000000000300000080000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af180200b70000000500000000260004000518fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978001d06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000180b17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d61000000000000000cd1a9f51a948b5b303f4f0032107f5000000000002000000000200000000000000000000000000008879e66485201a0015ca000000000000000000000000000000145e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c0305d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81edd010d7d484516cdc803000486eca2e844e829f41ff629973b145062e3601137dfdc2b492cc0925d10616c76d77b0b4614bc8708c9b20f72ea34f08780f3a2553ba9fad676472386118b8ee5f0810261e4521f56d91d038adcddbd164dea2817fb163952fd690b771138f8534180c35be7e0ec7f246e9c2b24d2fc74a6adf51e20b610000000000"], 0x0) fcntl$setlease(r7, 0x400, 0x0) close(r7) socket$unix(0x1, 0x1, 0x0) r8 = perf_event_open(&(0x7f0000000600)={0x5, 0x80, 0x0, 0x2, 0x0, 0x4, 0x0, 0x5, 0x80260, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0, 0x4}}, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r8, 0x40042408, 0xffffffffffffffff) 1.200370963s ago: executing program 2 (id=28): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002940)=ANY=[@ANYBLOB="140000001000010000008100000000000000000a98010000020a0102"], 0x3b0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0x200000000000002f, &(0x7f00000003c0)=ANY=[@ANYRES8=r1, @ANYRESHEX=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) socket$packet(0x11, 0x3, 0x300) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r2) r3 = socket$kcm(0x2, 0x200000000000001, 0x106) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000006"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRESDEC, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001940)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x64, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r4}, 0x10) r5 = socket(0x1e, 0x805, 0x0) connect$tipc(r5, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x40}, 0x2}}, 0x10) close(r5) sendmsg$inet(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x3406c012) write$cgroup_type(r2, &(0x7f0000000080), 0x11ffffce1) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000150000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) r8 = syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x0, 0x30002, 0x4}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) io_uring_register$IORING_REGISTER_FILES2(r2, 0xd, &(0x7f0000000880)={0x5, 0x0, 0x0, &(0x7f0000000780)=[{&(0x7f00000004c0)=""/7, 0x7}, {&(0x7f0000000580)=""/198, 0xc6}, {&(0x7f0000000500)=""/29, 0x1d}, {&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000000680)=""/255, 0xff}], &(0x7f0000000800)=[0x668, 0x7, 0x2, 0xfff, 0x8001, 0x100, 0x8, 0x6, 0x4]}, 0x20) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) io_uring_enter(r8, 0x4946, 0x4000, 0x0, 0x0, 0x0) syz_emit_ethernet(0x83, 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0xfffffe75, &(0x7f0000000c80)=ANY=[], 0xe0}, 0x20004025) 1.11073298s ago: executing program 2 (id=29): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r0, 0x40383d0c, &(0x7f0000000980)={{0x2000000, 0x2000005}, {0x1, 0xffffffff}, 0x5, 0x6}) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_io_uring_setup(0x3a17, &(0x7f0000000b00)={0x0, 0x133e, 0x0, 0x2, 0x276}, 0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) close(0xffffffffffffffff) socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7040000080000008500000078000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kmem_cache_free\x00'}, 0x18) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0xa1, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x0) 1.069697794s ago: executing program 1 (id=30): prctl$PR_SET_NAME(0xf, &(0x7f0000000480)='gtp\x00') bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007d000000180100002020732600000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x2, 0x64, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x5, 0x2, 0x0, 0x70bd2d, 0x25dfdbfe}, 0x10}}, 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='kfree\x00', r1}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000002900000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000180)='kfree\x00', r2}, 0x18) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffe, 0x6, 0x2, @scatter={0x0, 0x40000, 0x0}, &(0x7f0000000080)="0000501effd4", 0x0, 0x800004, 0x10030, 0x1, 0x0}) socket$netlink(0x10, 0x3, 0x8000000004) 954.961483ms ago: executing program 3 (id=31): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0), 0x250a80, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='kmem_cache_free\x00', r5}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) ppoll(&(0x7f0000000500), 0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r4}, 0x10) sendmsg$nl_xfrm(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="ac0000002100010027bd7000fbdbdf25ff010000000000000000000000000001fe8000000000000000000000000000bb4e2100004e219ffd070080201d000000", @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="a86b6e00b300000050001100fc00000000000000000000000000000100000000000000000000000000000001ffffffff000000000000000000000000000000000000000000000000000000006c010000000000000a0002000c001c00", @ANYRES16=r3, @ANYBLOB='*r\" '], 0xac}, 0x1, 0x0, 0x0, 0x4000840}, 0x4040) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000004c0)='netlink_extack\x00', r2, 0x0, 0x6}, 0x18) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_freezer_state(r6, &(0x7f0000000340), 0x2, 0x0) close(r7) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0xd, 0x10, &(0x7f0000000580)=ANY=[@ANYRESHEX=r7, @ANYRES32=r1, @ANYRES64], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) mlock2(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1) r8 = memfd_secret(0x80000) syz_emit_ethernet(0x3b6, &(0x7f0000001040)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb86dd60122d9203803afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000000000300000080000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af180200b70000000500000000260004000518fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978001d06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000180b17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d61000000000000000cd1a9f51a948b5b303f4f0032107f5000000000002000000000200000000000000000000000000008879e66485201a0015ca000000000000000000000000000000145e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c0305d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81edd010d7d484516cdc803000486eca2e844e829f41ff629973b145062e3601137dfdc2b492cc0925d10616c76d77b0b4614bc8708c9b20f72ea34f08780f3a2553ba9fad676472386118b8ee5f0810261e4521f56d91d038adcddbd164dea2817fb163952fd690b771138f8534180c35be7e0ec7f246e9c2b24d2fc74a6adf51e20b610000000000"], 0x0) fcntl$setlease(r8, 0x400, 0x0) close(r8) socket$unix(0x1, 0x1, 0x0) r9 = perf_event_open(&(0x7f0000000600)={0x5, 0x80, 0x0, 0x2, 0x0, 0x4, 0x0, 0x5, 0x80260, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0, 0x4}}, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r9, 0x40042408, 0xffffffffffffffff) 599.745732ms ago: executing program 2 (id=32): socket(0x2, 0x80805, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x400c84, &(0x7f0000000340), 0x1, 0x786, &(0x7f0000000800)="$eJzs3c9rHGUfAPDvbJKmTfu+yQsvaL0YEDRQmpgaWwWFigcRLBT0bLtstqFmky3ZTWlCQIsIXgQVD4JeevLgj3rz6o+r/hcexFI1LVY8SGQ2s+2m2U03abIbzecDk32emdl8n+/Or2d3hpkA9qzh9E8u4nBEvJtEDGbjk4joq5V6I06uzndreamQDkmsrLz8a1Kb5+byUiEa3pM6mFUejIhv34o4klsft7KwOJ0vlYpzWX2sOnNhrLKwePT8TH6qOFWcPT4+MXHsxJMnjm9frr//sHjo2nsvPPbFyT/ffODqO98lcTIOZdMa89iyZ9dWh2M4+0z60o9wjefvO9juknS7AWxJumn2rG7lcTgGo6dWAgD+zV6PiBUAYI9JHP8BYI+p/w5wc3mpUB+6+4tEZ11/LiL2r+ZfP7+5OqU3O2e3v3YedOBmsubMSBIRQ9sQfzgiPv7q1c/SIbbrPCRAG964HBFnh4bX7/+TddcsbNbjG0zbl70O3zU+je8MNHTG12n/56lm/b/c7f5PNOn/9DfZdrei2fa/ZsSBbQiygeufRDzTcG3brYb8M0M9We0/tT5fX3LufKmY7tv+GxEj0def1sc3iDFy468braY19v9+e/+1T9P46eudOXI/9/avfc9kvpq/n5wbXb8c8VBvs/yT28s/adH/Pd1mjBeffvujVtPS/NN868P6/CO7OmlnrFyJeLTp8r9zRVuy4fWJY7XVYay+UjTx5Y8fDrSK37j80yGNX/8u0Anp8h/YOP+hpPF6zcrmY3x/ZfCbVtPunX/z9X9f8kqtXO9HXMpXq3PjEfuSl9aPP3bnvZfyD2el1fnT/Eceab79b7T+p98Jz7aZf++1Xz7fev47K81/clPLf/OFq7eme1rFb2/5T9RKI9mYdvZ/7Tbwfj47AAAAAAAAAAAAAAAAAAAAAAAAAGhXLiIORZIbvV3O5UZHV5/h/f8YyJXKleqRc+X52cmoPSt7KPpy9VtdDjbcD3U8ux9+vX7srvoTEfG/iPig/0BSv4/iZJdzBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC6gy2e/5/6qb/brQMAdsz+bjcAAOg4x38A2Hsc/wFg72nv+N+z4+0AADrH938A2Hsc/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANhhp0+dSoeVP5aXCml98uLC/HT54tHJYmV6dGa+MFooz10YnSqXp0rF0UJ55l7/r1QuX5iI2flLY9VipTpWWVg8M1Oen62eOT+TnyqeKfZ1JCsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2JzKwuJ0vlQqzilsobCyO5rR/UJPtjrtlvZ0tJDsjmZsc6HLOyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAf4i/AwAA//+3ACFj") open(&(0x7f0000000380)='./file0\x00', 0x4a240, 0x8) socket$inet(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xa, 0x3, 0x8, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='sys_enter\x00'}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r4 = accept4$unix(0xffffffffffffffff, &(0x7f00000002c0)=@abs, &(0x7f0000000340)=0x6e, 0xc0800) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r5, 0x84009422, &(0x7f0000002bc0)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000001300)={r6, 0x9, 0x0, [0x10000, 0x7, 0x1, 0x9, 0x9], [0x8000000000000000, 0x1, 0xa, 0x5, 0xc, 0xfffffffffffffff8, 0x0, 0x7f, 0x0, 0xd0, 0x91a, 0x3ff, 0x242, 0x3b, 0xe9, 0x9, 0xffffffffffffffff, 0x232, 0x3, 0x1c00000, 0x5, 0xd1e, 0x8, 0x4, 0x4, 0x23, 0x400, 0xcc, 0x0, 0x8, 0x6, 0x2, 0x33, 0x8000000000001, 0xfffffffffffffff8, 0x9, 0x5, 0x1ff, 0x1, 0x4, 0x6, 0x401, 0x40, 0x4, 0x100, 0x81df244, 0x100000001, 0x6, 0x89ff, 0x2, 0x4, 0x3, 0xe2, 0x0, 0x2, 0x100200001, 0xb3, 0x8, 0x4, 0x5, 0x1, 0x9, 0xa24, 0xb10, 0x3, 0x9, 0xe, 0x7, 0x9, 0x3ff, 0x0, 0x1, 0xfff, 0x6, 0x2000000, 0x800000000005, 0x18, 0x8, 0x7ff, 0x4000000200, 0x3, 0xe3, 0xff, 0x2, 0xb, 0x4, 0x1000, 0xd429, 0x5e5, 0x6, 0xe58, 0x10000, 0x1, 0x80, 0xffffffffffff8001, 0x6, 0x2, 0x4, 0x2421, 0xa, 0x5, 0x0, 0x7fffffffffffffff, 0x0, 0x7, 0x0, 0x2, 0x1000, 0x80000001, 0x3, 0x5, 0x20e, 0x2, 0x3, 0x8000, 0x80ff, 0x97, 0x4, 0x7, 0x8, 0xffffffff]}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r3, 0x50009417, &(0x7f0000002480)={{r4}, 0x0, 0x8, @unused=[0x6, 0x9, 0x5, 0x3d4], @devid=r6}) ioctl$BTRFS_IOC_BALANCE_V2(r2, 0xc4009420, &(0x7f00000017c0)={0x5, 0x0, {0x1, @usage=0x129e, 0x0, 0x7fffffff, 0x4, 0x9, 0x2, 0x80000000, 0x0, @struct={0xa, 0x10001}, 0x5, 0x5, [0x4, 0xe, 0x6, 0x7ff, 0x2b, 0x9]}, {0xc34f, @usage=0x97, 0x0, 0x4, 0x1, 0x7, 0x10, 0x5, 0x0, @usage=0x2, 0x800, 0x8, [0x6, 0x6, 0x1, 0x2]}, {0x2, @struct={0x4, 0x10000}, r6, 0x1, 0x3, 0x2, 0xdc3c, 0x4, 0x34, @struct={0x1000, 0x2}, 0x3, 0x3, [0x3, 0x8001, 0x1, 0xa160, 0xc, 0x7]}, {0x2, 0x6}}) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r2, 0xc0406618, &(0x7f0000000400)={@id={0x2, 0x0, @a}}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='kmem_cache_free\x00', 0xffffffffffffffff, 0x0, 0x6}, 0x18) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) writev(r7, &(0x7f0000000040)=[{&(0x7f00000000c0)='\f7', 0x2}], 0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) 432.540085ms ago: executing program 2 (id=33): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000001811000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='kfree_skb\x00', r0}, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000000000000000000000000000001ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c0000000000000000000000000000000000000000000000000000f100000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008000000000000000001000000000000004400050000000000000000000000000000000000000000003c00000002000000ac1414aa00000000000000000000000006000000040300"], 0xfc}}, 0x0) 386.601829ms ago: executing program 4 (id=34): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002940)=ANY=[@ANYBLOB="140000001000010000008100000000000000000a98010000020a0102"], 0x3b0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0x200000000000002f, &(0x7f00000003c0)=ANY=[@ANYRES8=r1, @ANYRESHEX=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) socket$packet(0x11, 0x3, 0x300) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r2) socket$kcm(0x2, 0x200000000000001, 0x106) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000006"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRESDEC, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001940)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x64, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r3}, 0x18) r4 = socket(0x1e, 0x805, 0x0) connect$tipc(r4, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x40}, 0x2}}, 0x10) close(r4) sendmsg$inet(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x3406c012) write$cgroup_type(r2, &(0x7f0000000080), 0x11ffffce1) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x10) syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x0, 0x30002, 0x4}, &(0x7f0000000140), &(0x7f0000000280)) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='sys_enter\x00', r7}, 0x10) setrlimit(0x40000000000008, &(0x7f0000000080)={0x0, 0x6}) 337.695353ms ago: executing program 4 (id=35): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r0, 0x40383d0c, &(0x7f0000000980)={{0x2000000, 0x2000005}, {0x1, 0xffffffff}, 0x5, 0x6}) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r1, 0x0, 0x7}, 0x18) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r2, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kmem_cache_free\x00', r3}, 0x18) r4 = memfd_create(&(0x7f0000000bc0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc00x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newtfilter={0x24, 0x11, 0x1, 0x691522ec, 0x0, {0x0, 0x0, 0x74, r6, {0x10, 0xf}, {}, {0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) 294.228486ms ago: executing program 4 (id=36): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r0}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000010000d0425bd7000ffdbff2500000000", @ANYRES32=0x0, @ANYBLOB="10000000000000001c001280a534cc2e62726964676500000e0002800500190085"], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf523", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0xffff, 0xffff}, {0x5, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x4000000000000c1, 0xa00) 237.562651ms ago: executing program 4 (id=37): mkdirat(0xffffffffffffff9c, 0x0, 0x10a) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) kcmp(r1, r1, 0x2, r3, r2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a3200000000140000001100"], 0x7c}}, 0x0) 89.359353ms ago: executing program 3 (id=38): prctl$PR_SET_IO_FLUSHER(0x39, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a3200000000140000001100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x8000000}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}, 0x1, 0x0, 0x0, 0x814}, 0x0) 76.763564ms ago: executing program 0 (id=39): bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000140)={0x2, &(0x7f0000000000)=[{0x9, 0x0, 0x4, 0xfc00000}, {0x5, 0x4, 0x4, 0x5}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000180)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000002c0)={r2, 0x3, r0, 0x400, 0x80000}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) getresgid(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r0}, 0x10) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x22a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, @perf_config_ext, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x42, 0x6, 0x8, 0x0, 0x1}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r3}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r4}, 0x38) syz_clone(0x2c9a4080, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) 40.907377ms ago: executing program 0 (id=40): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000100000000000a20000000000a01010000000000000000010000000900010073797a300000000068000000090a010400000000000000000100000008000a4000000000200011800e000100636f6e6e6c696d69740000000c00028008000140000000000900010073797a30000000000900020073797a3200000000080005400000001f0c000980080001400037"], 0xb0}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) 22.144718ms ago: executing program 0 (id=41): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040000000100000000000000", @ANYRES32=0x1], 0x50) r2 = socket$kcm(0xa, 0x5, 0x0) r3 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r3, &(0x7f00000004c0)={&(0x7f0000000180)={0x2, 0x2, @dev}, 0x10, &(0x7f0000000300)=[{&(0x7f0000001800)='@', 0x1}], 0x1}, 0x10004024) setsockopt$sock_attach_bpf(r3, 0x84, 0x1e, &(0x7f0000000000), 0x10) r4 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x8916, &(0x7f0000000000)={r4}) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x8936, &(0x7f0000000000)={r4}) 0s ago: executing program 0 (id=42): prctl$PR_SET_IO_FLUSHER(0x39, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x814}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.10.15' (ED25519) to the list of known hosts. [ 30.079508][ T29] audit: type=1400 audit(1754871410.243:62): avc: denied { mounton } for pid=3290 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 30.080744][ T3290] cgroup: Unknown subsys name 'net' [ 30.102257][ T29] audit: type=1400 audit(1754871410.243:63): avc: denied { mount } for pid=3290 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.129642][ T29] audit: type=1400 audit(1754871410.273:64): avc: denied { unmount } for pid=3290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.289144][ T3290] cgroup: Unknown subsys name 'cpuset' [ 30.295506][ T3290] cgroup: Unknown subsys name 'rlimit' [ 30.486558][ T29] audit: type=1400 audit(1754871410.643:65): avc: denied { setattr } for pid=3290 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.512177][ T29] audit: type=1400 audit(1754871410.643:66): avc: denied { create } for pid=3290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.532709][ T29] audit: type=1400 audit(1754871410.643:67): avc: denied { write } for pid=3290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.553210][ T29] audit: type=1400 audit(1754871410.643:68): avc: denied { read } for pid=3290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.562071][ T3292] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 30.573508][ T29] audit: type=1400 audit(1754871410.653:69): avc: denied { mounton } for pid=3290 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.606846][ T29] audit: type=1400 audit(1754871410.653:70): avc: denied { mount } for pid=3290 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 30.630339][ T29] audit: type=1400 audit(1754871410.753:71): avc: denied { relabelto } for pid=3292 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.666774][ T3290] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.816361][ T3300] chnl_net:caif_netlink_parms(): no params data found [ 31.910766][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 31.951966][ T3300] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.959179][ T3300] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.966542][ T3300] bridge_slave_0: entered allmulticast mode [ 31.973029][ T3300] bridge_slave_0: entered promiscuous mode [ 31.982052][ T3300] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.989242][ T3300] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.996612][ T3300] bridge_slave_1: entered allmulticast mode [ 32.003297][ T3300] bridge_slave_1: entered promiscuous mode [ 32.009719][ T3303] chnl_net:caif_netlink_parms(): no params data found [ 32.031343][ T3306] chnl_net:caif_netlink_parms(): no params data found [ 32.085815][ T3300] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.097342][ T3299] chnl_net:caif_netlink_parms(): no params data found [ 32.108286][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.115478][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.122645][ T3307] bridge_slave_0: entered allmulticast mode [ 32.129209][ T3307] bridge_slave_0: entered promiscuous mode [ 32.139044][ T3300] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.164398][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.171526][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.178861][ T3307] bridge_slave_1: entered allmulticast mode [ 32.185229][ T3307] bridge_slave_1: entered promiscuous mode [ 32.221570][ T3300] team0: Port device team_slave_0 added [ 32.227322][ T3303] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.234438][ T3303] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.241587][ T3303] bridge_slave_0: entered allmulticast mode [ 32.247971][ T3303] bridge_slave_0: entered promiscuous mode [ 32.260744][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.273359][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.287628][ T3300] team0: Port device team_slave_1 added [ 32.298924][ T3303] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.305996][ T3303] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.313296][ T3303] bridge_slave_1: entered allmulticast mode [ 32.319784][ T3303] bridge_slave_1: entered promiscuous mode [ 32.334352][ T3306] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.341514][ T3306] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.348662][ T3306] bridge_slave_0: entered allmulticast mode [ 32.354931][ T3306] bridge_slave_0: entered promiscuous mode [ 32.378313][ T3306] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.385905][ T3306] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.393157][ T3306] bridge_slave_1: entered allmulticast mode [ 32.399600][ T3306] bridge_slave_1: entered promiscuous mode [ 32.406117][ T3300] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 32.413262][ T3300] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.439178][ T3300] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.450486][ T3300] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 32.457504][ T3300] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.483410][ T3300] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 32.508814][ T3307] team0: Port device team_slave_0 added [ 32.514648][ T3299] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.521788][ T3299] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.528934][ T3299] bridge_slave_0: entered allmulticast mode [ 32.535417][ T3299] bridge_slave_0: entered promiscuous mode [ 32.551071][ T3303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.560916][ T3307] team0: Port device team_slave_1 added [ 32.566689][ T3299] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.573869][ T3299] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.581188][ T3299] bridge_slave_1: entered allmulticast mode [ 32.587552][ T3299] bridge_slave_1: entered promiscuous mode [ 32.600183][ T3306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.611059][ T3306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.621190][ T3303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.670472][ T3306] team0: Port device team_slave_0 added [ 32.686528][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 32.693546][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.719486][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.731535][ T3299] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 32.740971][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 32.747928][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.773850][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 32.785110][ T3306] team0: Port device team_slave_1 added [ 32.793146][ T3300] hsr_slave_0: entered promiscuous mode [ 32.799272][ T3300] hsr_slave_1: entered promiscuous mode [ 32.805789][ T3303] team0: Port device team_slave_0 added [ 32.812285][ T3303] team0: Port device team_slave_1 added [ 32.819262][ T3299] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 32.868304][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 32.875396][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.901310][ T3303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.914974][ T3299] team0: Port device team_slave_0 added [ 32.921099][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 32.928120][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.954059][ T3306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 32.966618][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 32.973654][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 32.999679][ T3306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 33.027422][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 33.034501][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.060519][ T3303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 33.071899][ T3299] team0: Port device team_slave_1 added [ 33.086332][ T3307] hsr_slave_0: entered promiscuous mode [ 33.092320][ T3307] hsr_slave_1: entered promiscuous mode [ 33.098122][ T3307] debugfs: 'hsr0' already exists in 'hsr' [ 33.103896][ T3307] Cannot create hsr debugfs directory [ 33.131416][ T3299] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 33.138578][ T3299] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.164579][ T3299] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 33.176471][ T3299] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 33.183514][ T3299] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 33.209663][ T3299] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 33.255367][ T3306] hsr_slave_0: entered promiscuous mode [ 33.262429][ T3306] hsr_slave_1: entered promiscuous mode [ 33.268498][ T3306] debugfs: 'hsr0' already exists in 'hsr' [ 33.274239][ T3306] Cannot create hsr debugfs directory [ 33.282308][ T3303] hsr_slave_0: entered promiscuous mode [ 33.288444][ T3303] hsr_slave_1: entered promiscuous mode [ 33.294290][ T3303] debugfs: 'hsr0' already exists in 'hsr' [ 33.300182][ T3303] Cannot create hsr debugfs directory [ 33.355162][ T3299] hsr_slave_0: entered promiscuous mode [ 33.361108][ T3299] hsr_slave_1: entered promiscuous mode [ 33.366926][ T3299] debugfs: 'hsr0' already exists in 'hsr' [ 33.372746][ T3299] Cannot create hsr debugfs directory [ 33.525557][ T3300] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 33.536915][ T3300] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 33.546177][ T3300] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 33.557089][ T3300] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 33.579600][ T3307] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 33.589846][ T3307] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 33.601033][ T3307] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 33.619101][ T3307] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 33.638961][ T3303] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 33.652035][ T3303] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 33.667688][ T3303] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 33.676801][ T3303] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 33.705268][ T3306] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 33.715582][ T3306] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 33.725364][ T3306] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 33.734860][ T3306] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 33.776580][ T3300] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.811525][ T3300] 8021q: adding VLAN 0 to HW filter on device team0 [ 33.822754][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.832997][ T3299] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 33.845433][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.852517][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.861450][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.868669][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.879491][ T3299] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 33.897550][ T3299] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 33.906859][ T3299] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 33.918483][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 33.931231][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.938335][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.961165][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.968254][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.002076][ T3306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.011799][ T3303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.023726][ T3307] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 34.051808][ T3306] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.072979][ T3303] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.081782][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.088919][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.105190][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.112379][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.129636][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.136708][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.151129][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.158258][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.185198][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.213015][ T3300] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.243499][ T3299] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.275405][ T3299] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.300140][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.307222][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.340195][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.347274][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.392629][ T3306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.406999][ T3299] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 34.417486][ T3299] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 34.456806][ T3303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.474734][ T3300] veth0_vlan: entered promiscuous mode [ 34.492217][ T3300] veth1_vlan: entered promiscuous mode [ 34.543884][ T3307] veth0_vlan: entered promiscuous mode [ 34.553392][ T3300] veth0_macvtap: entered promiscuous mode [ 34.566919][ T3307] veth1_vlan: entered promiscuous mode [ 34.586983][ T3306] veth0_vlan: entered promiscuous mode [ 34.594218][ T3300] veth1_macvtap: entered promiscuous mode [ 34.602187][ T3306] veth1_vlan: entered promiscuous mode [ 34.612631][ T3307] veth0_macvtap: entered promiscuous mode [ 34.625144][ T3299] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.636313][ T3307] veth1_macvtap: entered promiscuous mode [ 34.645157][ T3300] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.661903][ T3300] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.676736][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.684138][ T3416] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.704102][ T3303] veth0_vlan: entered promiscuous mode [ 34.713890][ T3303] veth1_vlan: entered promiscuous mode [ 34.728096][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.737213][ T3416] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.746482][ T3416] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.768387][ T3306] veth0_macvtap: entered promiscuous mode [ 34.783743][ T3303] veth0_macvtap: entered promiscuous mode [ 34.790547][ T3416] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.805134][ T3303] veth1_macvtap: entered promiscuous mode [ 34.815656][ T3306] veth1_macvtap: entered promiscuous mode [ 34.825283][ T3300] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 34.835970][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.858928][ T378] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.877324][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.892041][ T3416] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.903133][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.910989][ T37] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.925549][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.936406][ T37] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.963432][ T3299] veth0_vlan: entered promiscuous mode [ 34.970738][ T37] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.993560][ T3299] veth1_vlan: entered promiscuous mode [ 35.041929][ T37] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.050821][ T37] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.067946][ T37] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.090610][ T37] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.136935][ T3416] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.168531][ T29] kauditd_printk_skb: 26 callbacks suppressed [ 35.168550][ T29] audit: type=1400 audit(1754871415.323:98): avc: denied { write } for pid=3468 comm="syz.1.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 35.216828][ T3299] veth0_macvtap: entered promiscuous mode [ 35.280725][ C1] hrtimer: interrupt took 24873 ns [ 35.297098][ T3416] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.318979][ T3299] veth1_macvtap: entered promiscuous mode [ 35.404212][ T3416] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.447381][ T3299] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 35.479163][ T29] audit: type=1400 audit(1754871415.373:99): avc: denied { open } for pid=3477 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 35.498176][ T29] audit: type=1400 audit(1754871415.373:100): avc: denied { kernel } for pid=3477 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 35.517296][ T29] audit: type=1400 audit(1754871415.393:101): avc: denied { allowed } for pid=3474 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 35.526570][ T3299] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 35.536271][ T29] audit: type=1400 audit(1754871415.393:102): avc: denied { create } for pid=3474 comm="syz.0.1" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 35.536304][ T29] audit: type=1400 audit(1754871415.393:103): avc: denied { map } for pid=3474 comm="syz.0.1" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4055 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 35.576483][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.588217][ T29] audit: type=1400 audit(1754871415.393:104): avc: denied { read write } for pid=3474 comm="syz.0.1" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4055 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 35.588266][ T29] audit: type=1400 audit(1754871415.423:105): avc: denied { map_create } for pid=3477 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 35.588293][ T29] audit: type=1400 audit(1754871415.423:106): avc: denied { map_read map_write } for pid=3477 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 35.680180][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.707346][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.708535][ T29] audit: type=1400 audit(1754871415.833:107): avc: denied { create } for pid=3484 comm="syz.0.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 35.745797][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.126175][ T3505] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10'. [ 36.151612][ T3505] netlink: 388 bytes leftover after parsing attributes in process `syz.0.10'. [ 36.241400][ T3515] netlink: 48 bytes leftover after parsing attributes in process `syz.0.12'. [ 36.250559][ T3515] Zero length message leads to an empty skb [ 36.461481][ T3539] netlink: 76 bytes leftover after parsing attributes in process `syz.3.15'. [ 36.499025][ T3544] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 36.569065][ T3544] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.243659][ T3610] netlink: 12 bytes leftover after parsing attributes in process `syz.4.18'. [ 37.278162][ T3608] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.285543][ T3608] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.302032][ T3618] loop3: detected capacity change from 0 to 512 [ 37.309645][ T3618] EXT4-fs: Ignoring removed oldalloc option [ 37.331949][ T3618] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.354989][ T3608] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 37.362668][ T3618] ext4 filesystem being mounted at /3/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 37.373576][ T3608] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 37.381112][ T3618] EXT4-fs error (device loop3): ext4_validate_block_bitmap:441: comm syz.3.17: bg 0: block 217: padding at end of block bitmap is not set [ 37.415579][ T37] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.425933][ T3608] syz.3.17 (3608) used greatest stack depth: 10928 bytes left [ 37.433594][ T37] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.443931][ T37] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.453014][ T37] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.464364][ T3618] syz.3.17 (3618) used greatest stack depth: 10368 bytes left [ 37.474333][ T3306] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.506350][ T3639] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20'. [ 37.572603][ T3651] netlink: 'syz.3.20': attribute type 3 has an invalid length. [ 37.882611][ T3682] netlink: 388 bytes leftover after parsing attributes in process `syz.3.22'. [ 38.533928][ T3704] netlink: 388 bytes leftover after parsing attributes in process `syz.2.28'. [ 38.919154][ T3707] bridge0: port 3(batadv1) entered blocking state [ 38.927452][ T3707] bridge0: port 3(batadv1) entered disabled state [ 38.951850][ T3707] batadv1: entered allmulticast mode [ 39.031813][ T3707] batadv1: entered promiscuous mode [ 39.140346][ T3743] loop2: detected capacity change from 0 to 2048 [ 39.172635][ T3743] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 39.232063][ T3416] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 39.241386][ T3416] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 39.360584][ T3758] netlink: 4 bytes leftover after parsing attributes in process `syz.4.35'. [ 39.415804][ T3761] netlink: 48 bytes leftover after parsing attributes in process `syz.4.36'. [ 39.860405][ T2] ================================================================== [ 39.868514][ T2] BUG: KCSAN: data-race in memcpy_and_pad / release_task [ 39.875590][ T2] [ 39.877916][ T2] write to 0xffff888100211638 of 8 bytes by task 3819 on cpu 1: [ 39.885546][ T2] release_task+0x779/0xb60 [ 39.890162][ T2] do_exit+0xd81/0x15c0 [ 39.894330][ T2] kthread_exit+0x94/0x190 [ 39.898761][ T2] __module_put_and_kthread_exit+0x15/0x20 [ 39.904582][ T2] cryptomgr_probe+0x161/0x180 [ 39.909359][ T2] kthread+0x489/0x510 [ 39.913434][ T2] ret_from_fork+0xda/0x150 [ 39.917937][ T2] ret_from_fork_asm+0x1a/0x30 [ 39.922719][ T2] [ 39.925042][ T2] read to 0xffff888100211080 of 3264 bytes by task 2 on cpu 0: [ 39.932585][ T2] memcpy_and_pad+0x48/0x80 [ 39.937089][ T2] arch_dup_task_struct+0x2c/0x40 [ 39.942116][ T2] dup_task_struct+0x83/0x6a0 [ 39.946809][ T2] copy_process+0x399/0x2000 [ 39.951414][ T2] kernel_clone+0x16c/0x5c0 [ 39.956008][ T2] kernel_thread+0xac/0xe0 [ 39.960431][ T2] kthreadd+0x28d/0x360 [ 39.964586][ T2] ret_from_fork+0xda/0x150 [ 39.969098][ T2] ret_from_fork_asm+0x1a/0x30 [ 39.973882][ T2] [ 39.976208][ T2] Reported by Kernel Concurrency Sanitizer on: [ 39.982382][ T2] CPU: 0 UID: 0 PID: 2 Comm: kthreadd Not tainted 6.17.0-rc1-syzkaller #0 PREEMPT(voluntary) [ 39.992655][ T2] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 40.002806][ T2] ================================================================== [ 40.312548][ T29] kauditd_printk_skb: 333 callbacks suppressed [ 40.312565][ T29] audit: type=1400 audit(1754871420.473:441): avc: denied { read write } for pid=3307 comm="syz-executor" name="loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 40.460087][ T29] audit: type=1400 audit(1754871420.623:442): avc: denied { read write } for pid=3306 comm="syz-executor" name="loop3" dev="devtmpfs" ino=103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 40.541630][ T29] audit: type=1400 audit(1754871420.703:443): avc: denied { read write } for pid=3303 comm="syz-executor" name="loop0" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 40.675152][ T29] audit: type=1400 audit(1754871420.833:444): avc: denied { read write } for pid=3300 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 40.871068][ T3752] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.912031][ T3416] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.973220][ T3416] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.033075][ T3416] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.091321][ T3416] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.166504][ T3416] batadv1: left allmulticast mode [ 41.171623][ T3416] batadv1: left promiscuous mode [ 41.176701][ T3416] bridge0: port 3(batadv1) entered disabled state [ 41.185290][ T3416] bridge_slave_1: left allmulticast mode [ 41.191026][ T3416] bridge_slave_1: left promiscuous mode [ 41.196726][ T3416] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.206229][ T3416] bridge_slave_0: left allmulticast mode [ 41.212051][ T3416] bridge_slave_0: left promiscuous mode [ 41.217733][ T3416] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.311436][ T3416] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 41.322909][ T3416] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 41.332665][ T3416] bond0 (unregistering): Released all slaves [ 41.392891][ T3416] hsr_slave_0: left promiscuous mode [ 41.400476][ T3416] hsr_slave_1: left promiscuous mode [ 41.406286][ T3416] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 41.413729][ T3416] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 41.422979][ T3416] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 41.430698][ T3416] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 41.442811][ T3416] veth1_macvtap: left promiscuous mode [ 41.448328][ T3416] veth0_macvtap: left promiscuous mode [ 41.453957][ T3416] veth1_vlan: left promiscuous mode [ 41.460532][ T3416] veth0_vlan: left promiscuous mode [ 41.535451][ T3416] team0 (unregistering): Port device team_slave_1 removed [ 41.547131][ T3416] team0 (unregistering): Port device team_slave_0 removed