last executing test programs: 16.063423334s ago: executing program 3 (id=1376): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x635c, 0x1f480, 0x0, 0x399}) (async) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x80200, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000040)={0x6, 0x3, 0x1, 0x5}) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x18, 0xa, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000300010000470d000018410000fdffffff000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500000000000000"], 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9ef}, 0x94) (async) mmap$xdp(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xd, 0x11, r2, 0x80000000) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x33}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x80) (async) ioctl$FS_IOC_GETFSUUID(r0, 0x80111500, &(0x7f00000001c0)) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x95, 0x200, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x200, 0x2, @perf_bp={0x0}, 0xc224, 0x2, 0xffffffff, 0x0, 0x2, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) inotify_init() (async, rerun: 32) io_uring_enter(r1, 0x616c, 0x6938, 0x1, 0x0, 0x2b) (rerun: 32) getrlimit(0x3, &(0x7f0000000200)) 15.985661414s ago: executing program 3 (id=1379): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x300) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000100)={0x504, 0x8, 0x101, 0x8000, 0x4f, "0840950887d026d76d7fcb456b00", 0xc, 0x3}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000040)=0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002"], 0x110) setsockopt$inet_group_source_req(r3, 0x0, 0x2b, &(0x7f0000000000)={0x2, {{0x2, 0x4e26, @multicast2}}, {{0x2, 0x2, @empty}}}, 0x108) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="300000001e000100000000000000000007000000", @ANYRES16=r1, @ANYBLOB="000000000a00020000000000000000000800090009000000ba2b8f44e7e1e96d00e515ea6bde607d93c3684cd287ffea2cf732e24be4a5f08565f467", @ANYRES8=r1, @ANYRESOCT=r3], 0x30}}, 0x40000) 15.961283487s ago: executing program 3 (id=1380): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000100)='./file1\x00', 0x8008, &(0x7f00000000c0)={[{@lazytime}, {@errors_remount}]}, 0x82, 0x53a, &(0x7f0000000a40)="$eJzs3c9vI1cdAPDvOPHmR7NNCj0AArqUwoJW6yTeNqp6YXsBoaoSouLEYRsSN4pir6PYK5qwh+yReyVW4gT8B9w4IPXEgRs3kDj0Ug5IC6xADRIHoxlPEjexE7dJ7ST+fKTJzHszO9/34n3veV5kvwBG1o2I2I2IaxHxdkTM5vlJvsXd9pZe99HThyt7Tx+uJNFqvfXPJDuf5kXHv0k9k99zMiJ++L2InyTH4za2dzaWq9XKVp6eb9Y25xvbO7fXC3lOeWlxaeHVO6+Uz62uL9R+++S762/86Pe/+8qHf9r99s/SYs38/Hp2rrMeh4pnjpnk95npyBuPiDfOfOeLYzz//8Plk7a2z0XEi1n7n42x7NUEAK6yVms2WrOdaQDgqkuf/2ciKZTyuYCZKBRKpfYc3vMxXajWG81bs/UH91cjm8Oai2LhnfVqZSGfK5yLYpKmF7Pjw3T5Y+n3Knci4rmIeG9iKjtfWqlXV4f5xgcARtgzR8b//0y0x/9OZ/8rGABw4UwOuwAAwMB1jP9zwywHADA4nv8BYPR8gvHfpwMB4Irw/A8Ao8f4DwCj59Tx/9FgygEADMQP3nwz3Vp77e+/3v+m7turlcZGqfZgpbRS39osrdXra9VKaaXVOu1+1Xp9c/Hlg2Rje+derf7gfvPeem15rXKv4rsEAGD4nnvh/b+kg/7ua1PZFh1rORir4WorDLsAwNCMDbsAwND4PA+Mrj6e8U0DwBXXZYnetnyCIOl1wWOLv8JldfOL5v9hVJ1l/t/cAVxun27+/zvnXg5g8IzhMLparcSa/wAwYszxAz3//p/r+RUhj/u4+d1PXh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4DGayLSmUsrXAd9OfhVIp4npEzEUxeWe9WlmIiGcj4s8TxYk0vTjsQgMAZ1T4e5Kv/3Vz9qWZo2evJf+dyPYR8dNfvvWLd5ebza3FNP9fB/nNx2n+VHOrfG0YFQAAOu2vu/nBYVY2fpfzfceD/EdPH67sb4Ms4pPXI2JyKou/l2/tM+Mxnu0noxgR0/9O8nRb+n5l7Bzi7z6KiC/s138y3u2IMJPNgbRXPj0aP419/dzjd/7+j8YvfKy+hexcui9mv4vPx5HCAad6//V2P5m3vbSJ5+2vEDeyfff2P5n1UGeX9n9pc9071v8VDvq/sWPxk6zN3zhIn1ySJy//4fvHMluz7XOPIr403i1+chA/6d7/Fl/qs44ffPmrL/Y61/pVxM2u9d9fkbqWdbPzzdrmfGN75/Z6bXmtsla5Xy4vLS4tvHrnlfJ8Nkfd/vnHbjH+8dqtZ3vFT+s/3SP+5Mn1j2/0Wf9f/+/tH3/thPjf+nr31//5E+KnY+I3+4y/PH235/LdafzVHvU/5fWPW33G//BvO6t9XgoADEBje2djuVqtbJ1ykL7XPO0aB/0fpM/2F6AY2UHsRpzXDbNJiYjoek36jvpiVPmzOkiGFv03533DYfdMwGftsNH3vuavgywQAAAAAAAAAAAAAABwTGN7Z2Oi+6e1zu1g2HUEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg6vp/AAAA//9W1cZQ") open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='veth0_virt_wifi\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) close(0x3) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000001740)=0x7ffffffd, 0x4) connect$netlink(r2, &(0x7f0000000100)=@kern={0x10, 0x0, 0x0, 0x8000}, 0xc) write$binfmt_script(r1, 0x0, 0x6f4000) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) setsockopt(r3, 0x4, 0x7c0, &(0x7f0000000400)="1dbfe112abdc74da9bea64f944acdb6779d47c0c4a1b80862596499f7f3b75d5c550a5bc8622da3bbb1812ce6db308d8b5d7737395f4649920d448444c1f6400fa506c1c241cecf461f765e63d2987dd75011735490f08a285057b861c5c3428a94ab5e1906cc1695b40a203165f034e7304e48bdd1c63d866dbd580fae996a8bac87790abeec8a501542e8ea6cf354ec54e6004c334f8ee21e936100426ac37e95dbf761d923d1a690b41346fdf72e7e578c091c7bff22ead5fe09be6486b56c8", 0xc1) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) ioperm(0x5, 0x8, 0x8000000000005) perf_event_open(&(0x7f0000000000)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x241a2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x3, @perf_bp={&(0x7f0000000300), 0x1}, 0x0, 0x2, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x80, 0x2, 0x1f9}, &(0x7f0000000000), &(0x7f0000000300)) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x10010, r5, 0xed526000) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x6) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r4, 0x8982, &(0x7f00000006c0)={0x0, 'bridge0\x00', {0x101}, 0x2}) socket$netlink(0x10, 0x3, 0x4) 15.068127302s ago: executing program 3 (id=1396): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) (async) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) (async) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) (async) mount$bind(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x88000, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendmmsg$inet6(r0, &(0x7f0000004cc0)=[{{&(0x7f0000000040)={0xa, 0x4e22, 0x1ff, @private0, 0x401}, 0x1c, &(0x7f00000001c0)=[{&(0x7f00000003c0)="f5", 0x1}], 0x1}}, {{&(0x7f0000000480)={0xa, 0x4e24, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8e}, 0x1c, &(0x7f0000000d80)=[{&(0x7f0000000c40)="ea", 0x1}], 0x1}}], 0x2, 0x40) (async) shutdown(r0, 0x1) (async) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x800, 0x7fff, 0xd, 0x1, 0xa2}, 0x14) 14.76990917s ago: executing program 3 (id=1398): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x4001, @empty}, 0x10, 0x0}, 0x30006041) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) recvmmsg(r1, &(0x7f0000001980)=[{{0x0, 0x0, 0x0}, 0x5ec}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) close(r0) 14.135337392s ago: executing program 3 (id=1404): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x1, &(0x7f0000000200), 0x4, 0x4c1, &(0x7f00000012c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MohKiEhuQqpC4ocSJo9gpTdRFCrsuWCAQSIgFe/4CNnRFhYRYwx6xQEVQggRISEb32i6JEweLpnHJ/f2kW5/7sL97an0n5x7fRwCZdTb5JxcxHBEfRcTRxuzWDc42Xjbu35xJplzU65e/zKXbJfOtTVvvOxIR6xExEBFP/jfi2dz2uNXVtfnpcrm03Jwv1haWitXVtQvXFqbnSnOlxbHJi1NTk6MT41N7VtfbLz9/+9K7/+9/59uX7t195f33kt0abq7r37MoWzWq3hfHNy07FBH/fkTx9luhWZ/BXu8Iv0jy/f0uIs6l+X80Cum3CWRBvV6v/1A/3Gn1eh04sPJpHziXH4mIRjmfHxlp9OF/H0P5cqVa+/vVysribKOvfCz68levlUujzWOFY9GXS+bH0vJP8+Nt8xMRaR/41cJgOj8yUynP7m9TB7Q50pb/3xQa+Q9khEN+yC75D9kl/yG75D9kl/yH7JL/kF3yH7JL/kN2yX/ILvkP2SX/IZOeuHQpmeqt6/hnr6+uzFeuX5gtVedHFlZmRmYqy0sjc5XKXHrNzsLPfV65Ulka+0es3CjWStVasbq6dmWhsrJYu5Je13+l1LcvtQK6cfzMnU9yEbH+z8F0ik33wpCrcLDV67no9TXIQG8Uet0AAT1j6A+yyzE+0H6L3vZ+wUCnNy7tfu9cxxfw+Mr3egeAnjl/yu9/kFX655Bdxv8hu/TxgR0e0bfFbuP/wK+T8X/IruEOz//6zaZnd41GxG8j4uNC3+HWs76AgyD/ea7Z/z9/9M/D7Wv7c9+lPxH0R8QLb15+/cZ0rbY8liz/6sHy2hvN5eOb3tjxgAHolVaetvIYAMiujfs3Z1rTfsb94j+NkxC2xz/UHJscSH+jHNrIbTlXIbdH5y6s34qIkzvFzzWfd944kBnaKGyLf6L5mmt8RLq/h9Lnpndv6SHin9oU/0+b4p9+6P8VyIY7SfszulP+5dOcjgf5t7X9Gd6jcyc6t3/5B+1foUP7d6bLGM+99eJnHePfiji9Y/xWvIE0Vnv8ZN/Odxn/3jNP/aHTuvrbjc/ZKX5LUirWFpaK1dW1C+l95OZKi2OTF6emJkcnxqeK6Rh1sTVSvd2/Tn54d7f6D3WIv1v9k2V/7bL+3//xg6fP7hL/L+d2/v5P7BJ/MCL+1mX8r8c/7finMok/26H++V3iJ8smuoxffe1/h7vcFADYB9XVtfnpcrm0rKCg0JPCrcdjN9oKvW6ZgEetupocmidJ3+s9AQAAAAAAAAAAALq1H6cT97qOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHwY8BAAD//0K90ao=") mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='hfsplus\x00', 0x200000, 0x0) getxattr(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f0000000380)=@known='system.posix_acl_access\x00', 0x0, 0x0) 14.092210457s ago: executing program 32 (id=1404): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x1, &(0x7f0000000200), 0x4, 0x4c1, &(0x7f00000012c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MohKiEhuQqpC4ocSJo9gpTdRFCrsuWCAQSIgFe/4CNnRFhYRYwx6xQEVQggRISEb32i6JEweLpnHJ/f2kW5/7sL97an0n5x7fRwCZdTb5JxcxHBEfRcTRxuzWDc42Xjbu35xJplzU65e/zKXbJfOtTVvvOxIR6xExEBFP/jfi2dz2uNXVtfnpcrm03Jwv1haWitXVtQvXFqbnSnOlxbHJi1NTk6MT41N7VtfbLz9/+9K7/+9/59uX7t195f33kt0abq7r37MoWzWq3hfHNy07FBH/fkTx9luhWZ/BXu8Iv0jy/f0uIs6l+X80Cum3CWRBvV6v/1A/3Gn1eh04sPJpHziXH4mIRjmfHxlp9OF/H0P5cqVa+/vVysribKOvfCz68levlUujzWOFY9GXS+bH0vJP8+Nt8xMRaR/41cJgOj8yUynP7m9TB7Q50pb/3xQa+Q9khEN+yC75D9kl/yG75D9kl/yH7JL/kF3yH7JL/kN2yX/ILvkP2SX/IZOeuHQpmeqt6/hnr6+uzFeuX5gtVedHFlZmRmYqy0sjc5XKXHrNzsLPfV65Ulka+0es3CjWStVasbq6dmWhsrJYu5Je13+l1LcvtQK6cfzMnU9yEbH+z8F0ik33wpCrcLDV67no9TXIQG8Uet0AAT1j6A+yyzE+0H6L3vZ+wUCnNy7tfu9cxxfw+Mr3egeAnjl/yu9/kFX655Bdxv8hu/TxgR0e0bfFbuP/wK+T8X/IruEOz//6zaZnd41GxG8j4uNC3+HWs76AgyD/ea7Z/z9/9M/D7Wv7c9+lPxH0R8QLb15+/cZ0rbY8liz/6sHy2hvN5eOb3tjxgAHolVaetvIYAMiujfs3Z1rTfsb94j+NkxC2xz/UHJscSH+jHNrIbTlXIbdH5y6s34qIkzvFzzWfd944kBnaKGyLf6L5mmt8RLq/h9Lnpndv6SHin9oU/0+b4p9+6P8VyIY7SfszulP+5dOcjgf5t7X9Gd6jcyc6t3/5B+1foUP7d6bLGM+99eJnHePfiji9Y/xWvIE0Vnv8ZN/Odxn/3jNP/aHTuvrbjc/ZKX5LUirWFpaK1dW1C+l95OZKi2OTF6emJkcnxqeK6Rh1sTVSvd2/Tn54d7f6D3WIv1v9k2V/7bL+3//xg6fP7hL/L+d2/v5P7BJ/MCL+1mX8r8c/7finMok/26H++V3iJ8smuoxffe1/h7vcFADYB9XVtfnpcrm0rKCg0JPCrcdjN9oKvW6ZgEetupocmidJ3+s9AQAAAAAAAAAAALq1H6cT97qOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHwY8BAAD//0K90ao=") mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='hfsplus\x00', 0x200000, 0x0) getxattr(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f0000000380)=@known='system.posix_acl_access\x00', 0x0, 0x0) 1.966151717s ago: executing program 1 (id=1607): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=[{0x10, 0x0, 0x300}, {0x18, 0x110, 0xd, "f8"}], 0x28}, 0x0) 1.965980857s ago: executing program 1 (id=1608): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100070c100000000000224e0000", 0x58}], 0x1) 1.963539458s ago: executing program 2 (id=1609): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x4000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f00000013c0)=0x80000000001, 0x4) connect$inet6(r2, &(0x7f0000000340)={0xa, 0x4e22, 0x0, @loopback, 0x1}, 0x1c) sendto$inet6(r2, &(0x7f00000002c0)="e8", 0xfffffffffffffd79, 0x2000c850, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x10020, 0x0) 1.935418212s ago: executing program 1 (id=1610): socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setstatus(r0, 0x4, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) getrandom(0x0, 0x0, 0x2) sendmsg$NFT_BATCH(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x4c, 0x1, 0x0, 0xb4, 0x0, 0x9, 0x84233, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1, @perf_bp={0x0, 0x4}, 0x10100, 0x10001, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3cc51a000000000000000000000000000a0000040900010073797a3100000000080005400000002b0900020073797a310000000008000a40fffffffc1400000011000100000000000000"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4008050) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) listen(r1, 0x5) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='setgroups\x00') writev(r4, &(0x7f0000000240)=[{&(0x7f0000000200)="3e5a090a38905e6b65b372c93557866e79", 0x11}, {&(0x7f0000000640)="126a6054e702b230a528b13d383944d529484c3971cebc37c65ab741fa18f058d94fb1a12a9750f23bc2be2e5c3459d7933292971c0d527aa93b97cb7fb7e4b20c90b38aef428919e989c308fa43a242827d17345b60a894b579aec153de22d83cdded237180e9ec106db3bb47a9a2979739d7558db664ebcaf4b05c976a7617784e61bd820cff59fcadd3e9d6c01a9bd34d0e7d5ede66a00e49a2f4eea1f0e44602098a397efc5050b038f6960516d33caa62117d4a18d8eec595bc2c925a71db29bc12f4abedc2a1ce803efd9adcfae1349e463706", 0xd6}], 0x2) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000007000000020000000400000000000000", @ANYRES32, @ANYBLOB="000000000000ee569d67659cdfd63ae0aa1409cf2eacbc111156f72bb19b9f0717794734dc1fb97c9f0cf83426a6261c2184d140011526a88f54e42b0523b7fd90f94d7afceb2e6038c4af5fab6235c8f41acf77bedd5ee426e4435f8967207d84567fc73b99b1bca6af980f070c93998790eb4342c5789c297cc6de7f0525bf1b1ae20ab60f018bf72a90385c8b672270988624ef9ba969fc9b07a33cf55961b7e583c8f5e146f1899cd1f6eb372104eaa108dbc5b4f52501f07341fcc3905a6e20be1a70dfd2e0c147195c43c0c83fa789c9982d9874b6de3f916341ff4874ea1cf1ad403381955dfcee36022806", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0xff, 0x7ffc1ffd}]}) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffbfff, 0x1, 0x1}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0x14, &(0x7f0000000500)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c3a00db1f457a57000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000080000850000002d0000004e630000f782cc93e85c595b2c7a102092aed5c67aca390d4e00c387636984dec7d1d13fca39e15f835722f84015761332f39a5327569f83527764b544657c24927103148f61a6e6b39ceff2c92179daf37c8eb5553792fc3ceb9813f6887beff19b0e0a09e4e7db1a8a18fbaa68b8e5710debc8e5af", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0x7, &(0x7f0000000000)={0x10040000, 0x9, 0x5, 0x7}, 0x10) mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) r7 = socket$nl_rdma(0x10, 0x3, 0x14) fcntl$addseals(r7, 0x409, 0xa) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4400e289a6c53db22000000700e70d10db2c4527fa0678d939bd5c", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100626174616476000014000280100001004241544d414e5f56"], 0xfd12}}, 0x0) 1.878044889s ago: executing program 4 (id=1611): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) (async) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCSBRKP(r4, 0x5425, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCSETSW2(r5, 0x5408, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, "23f555d9adb42d4408020e90d1beaa82dc1ecf"}) (async) ioctl$TIOCGPGRP(r4, 0x5437, 0x0) (async) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001e0000000c0001800800", @ANYRES32], 0x20}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000000)={0x58, 0x1, 0x1, 0x201, 0x0, 0x0, {0x2, 0x0, 0x9}, [@CTA_TUPLE_ORIG={0x20, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x15}}, {0x8, 0x2, @remote}}}]}, @CTA_FILTER={0x24, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x6}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0xa80}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x80}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x502}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x406c450}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="780000001000010400"/20, @ANYRES32=r2, @ANYBLOB="60300300001400005800128009000100626f6e6400000000480002802c0008"], 0x78}}, 0x0) 1.842796993s ago: executing program 1 (id=1612): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r0, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 1.577244347s ago: executing program 1 (id=1613): pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(0xffffffffffffffff) futex(&(0x7f000000cffc)=0x4, 0xb, 0x4, 0x0, &(0x7f0000048000)=0x1, 0x0) futex(&(0x7f000000cffc), 0x3, 0x0, &(0x7f0000fd7ff0), &(0x7f0000048000), 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2, 0x0, 0xd057}) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2, &(0x7f0000000200)=0x0) io_submit(r6, 0x1, &(0x7f0000000040)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x80000000}]) io_getevents(r6, 0x2, 0x2, &(0x7f0000000540)=[{}, {}], 0x0) io_submit(r6, 0x1, &(0x7f0000000140)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r5, 0x0}]) setsockopt$inet6_IPV6_RTHDR(r5, 0x29, 0x39, &(0x7f0000000100)=ANY=[@ANYRESDEC=0x0], 0x18) socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000240)={0x0, 0x1}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000300)={r7, 0xf49}, &(0x7f0000000340)=0x8) bind$netlink(r1, &(0x7f0000000040)={0x10, 0x0, 0x20000, 0x8822d55593a2179}, 0xc) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) sendmmsg$inet6(r4, &(0x7f0000000a80)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4d7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}}], 0x1, 0x4c040) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) 1.576732957s ago: executing program 4 (id=1614): mq_open(&(0x7f0000000040)='!seli\x1a\x1d!\xa7\x00\x00inux\x00G\xd0\xc6(\xaf', 0x6e93ebbbcc0884f2, 0x10, 0x0) socket(0x23, 0x80805, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r0) sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000007c0)={0x30, r1, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x80) r2 = syz_io_uring_setup(0x5ce, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x82e, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0xb2752a96f73d6e14, 0x0, 0x0, 0x0, 0x23456}) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) mq_open(&(0x7f0000000040)='!seli\x1a\x1d!\xa7\x00\x00inux\x00G\xd0\xc6(\xaf', 0x6e93ebbbcc0884f2, 0x10, 0x0) (async) socket(0x23, 0x80805, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r0) (async) sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000007c0)={0x30, r1, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x80) (async) syz_io_uring_setup(0x5ce, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f0000000000), &(0x7f0000000080)) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x82e, 0x0, 0x0, 0x4}]}, 0x10) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0xb2752a96f73d6e14, 0x0, 0x0, 0x0, 0x23456}) (async) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) (async) 1.523360424s ago: executing program 4 (id=1615): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0xc, &(0x7f0000000000)="c1", 0x1) getsockopt$inet_opts(r0, 0x0, 0x9, 0x0, &(0x7f00000000c0)) syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs\x00') r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f00000000c0)=0x100a, 0x4) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=@reiserfs_2={0x8, 0x2, {0xb}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'dummy0\x00'}) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0xb, 0x2014, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0xd07, 0x40}, 0x100b28, 0x6, 0x0, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0xfffe, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0xe}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000180), 0xfea7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) 1.441985085s ago: executing program 4 (id=1616): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xb, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b0000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0xd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) syz_emit_ethernet(0x12, &(0x7f0000000000)=ANY=[@ANYBLOB="910418166421b54fa0aaaa050004424203"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) mmap$perf(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x4000011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x26, 0x1, 0x0, 0x0, 0x0, 0x7, 0x8514, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x8, 0x6}, 0x120, 0x10000, 0x4, 0x1, 0x8, 0x20007, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x4) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x4000000) mbind(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x0, 0x1ff, 0x3) r1 = syz_clone(0x0, 0x0, 0x43, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newtaction={0x64, 0x30, 0xb, 0x0, 0x25dfdbfb, {}, [{0x50, 0x1, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_MARK={0x8, 0x10, 0x8}, @TCA_CT_PARMS={0x18, 0x1, {0x0, 0x20, 0x6}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) r2 = perf_event_open(&(0x7f0000000300)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x9, 0x690ba, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x0, @perf_bp={0x0, 0x4}, 0x0, 0x7, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x400000000, 0xffffffffffffffff, 0x1) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r4, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000800)=[@fadd={0x58, 0x114, 0x6, {{0x5, 0x6}, &(0x7f0000000400)=0x7, 0x0, 0xf, 0x4, 0x9, 0xfffffffffffffff9, 0x22, 0x7}}], 0x58, 0x8000}, 0x0) r5 = io_uring_setup(0x513, &(0x7f0000000540)={0x0, 0xf, 0x2000, 0x503fa, 0x8100014a}) r6 = socket$rds(0x15, 0x5, 0x0) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendmsg$rds(r6, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x44, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone(0x40800300, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000019200)={0x11, 0xd, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000880)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) openat$cgroup(r0, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) 1.0940058s ago: executing program 2 (id=1619): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}]}], {0x14}}, 0x84}}, 0x0) (async) r0 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000300)={0x9ac0c63, 0x7}) (async) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x10, 0x4, 0x8, 0x8}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) (async) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r2, 0x0, 0xc8, &(0x7f0000003d40), 0x4) (async) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) (async) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$igmp(0x2, 0x3, 0x2) r5 = socket(0x10, 0x3, 0x4) (async) r6 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r7, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x25b}, 0x3548}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x58, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x4}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x28, 0x2, [@TCA_BASIC_EMATCHES={0x24, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x8, 0x7, 0x6}, {{0x2, 0x1, 0x1, 0x1}, {0x0, 0x0, 0x1}}}}]}]}]}}]}, 0x58}}, 0x0) (async) setsockopt$inet_mreq(r3, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) (async) syz_emit_ethernet(0x2a, &(0x7f0000000040)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @echo_reply={0x0, 0x0, 0x0, 0x64, 0xd2}}}}}, 0x0) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000340)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r9, {}, {}, {0xfff3}}}, 0x24}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r4, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) 1.01475733s ago: executing program 2 (id=1620): keyctl$set_reqkey_keyring(0xe, 0x4) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\x10rust\xe3c*sgrVdx:De', 0x0) keyctl$set_reqkey_keyring(0xe, 0x6) 960.067727ms ago: executing program 5 (id=1623): socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setstatus(r0, 0x4, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) getrandom(0x0, 0x0, 0x2) sendmsg$NFT_BATCH(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x4c, 0x1, 0x0, 0xb4, 0x0, 0x9, 0x84233, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1, @perf_bp={0x0, 0x4}, 0x10100, 0x10001, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3cc51a000000000000000000000000000a0000040900010073797a3100000000080005400000002b0900020073797a310000000008000a40fffffffc1400000011000100000000000000"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4008050) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) listen(r1, 0x5) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='setgroups\x00') writev(r4, &(0x7f0000000240)=[{&(0x7f0000000200)="3e5a090a38905e6b65b372c93557866e79", 0x11}, {&(0x7f0000000640)="126a6054e702b230a528b13d383944d529484c3971cebc37c65ab741fa18f058d94fb1a12a9750f23bc2be2e5c3459d7933292971c0d527aa93b97cb7fb7e4b20c90b38aef428919e989c308fa43a242827d17345b60a894b579aec153de22d83cdded237180e9ec106db3bb47a9a2979739d7558db664ebcaf4b05c976a7617784e61bd820cff59fcadd3e9d6c01a9bd34d0e7d5ede66a00e49a2f4eea1f0e44602098a397efc5050b038f6960516d33caa62117d4a18d8eec595bc2c925a71db29bc12f4abedc2a1ce803efd9adcfae1349e463706", 0xd6}], 0x2) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000007000000020000000400000000000000", @ANYRES32, @ANYBLOB="000000000000ee569d67659cdfd63ae0aa1409cf2eacbc111156f72bb19b9f0717794734dc1fb97c9f0cf83426a6261c2184d140011526a88f54e42b0523b7fd90f94d7afceb2e6038c4af5fab6235c8f41acf77bedd5ee426e4435f8967207d84567fc73b99b1bca6af980f070c93998790eb4342c5789c297cc6de7f0525bf1b1ae20ab60f018bf72a90385c8b672270988624ef9ba969fc9b07a33cf55961b7e583c8f5e146f1899cd1f6eb372104eaa108dbc5b4f52501f07341fcc3905a6e20be1a70dfd2e0c147195c43c0c83fa789c9982d9874b6de3f916341ff4874ea1cf1ad403381955dfcee36022806", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0xff, 0x7ffc1ffd}]}) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffbfff, 0x1, 0x1}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0x14, &(0x7f0000000500)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c3a00db1f457a57000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000080000850000002d0000004e630000f782cc93e85c595b2c7a102092aed5c67aca390d4e00c387636984dec7d1d13fca39e15f835722f84015761332f39a5327569f83527764b544657c24927103148f61a6e6b39ceff2c92179daf37c8eb5553792fc3ceb9813f6887beff19b0e0a09e4e7db1a8a18fbaa68b8e5710debc8e5af", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0x7, &(0x7f0000000000)={0x10040000, 0x9, 0x5, 0x7}, 0x10) mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) r7 = socket$nl_rdma(0x10, 0x3, 0x14) fcntl$addseals(r7, 0x409, 0xa) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4400e289a6c53db22000000700e70d10db2c4527fa0678d939bd5c", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100626174616476000014000280100001004241544d414e5f56"], 0xfd12}}, 0x0) 956.622097ms ago: executing program 2 (id=1624): r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'team_slave_0\x00'}) (async) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x29, 0x14, &(0x7f0000000100), 0x120) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x10000000) (async) setsockopt$sock_attach_bpf(r1, 0x29, 0x15, &(0x7f0000000100), 0x3d) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, 0x0, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0106000000000000faff0800000024000480080005"], 0x38}, 0x1, 0x0, 0x0, 0x2400c005}, 0x0) (async) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000d40)=ANY=[@ANYBLOB="0212000005020000fcffffff0000000001020900008000006bdae99676f5d98b222c1d175b1bde5f2af814867595cca148f284845d6726daecb906b52bcbe4a0671f0cfe91064a71252070eab7b079faae2437c1c6375c071120ac3c3dfb0e5500269ca1cd7c4713a0369feb90311ab8556d5bac400f5ffbe90545162b4d370163c56d991d223d5da19c52bdbff65404e119035c710bccfff638d731934ecdd791b655adfc821d0887903e07df64c986fa6fb88f4a7d0b3f81044ac984488238d0f3c48cf099ab574e73f1a68d600ab06ec38d634b447f1d4aad0dd4f056494500bab1d7792480ea186568121117e75c05a8bde6476b7304bb2b64f14f54921845a91f868fa925cf0a818b9bba4ea375d10464e94cba1fefd1cf5efc16c2e5c1cf9adb172617d21d333c27c4554adf58cd7508fe0eed1a11186e77fce9e4518b7280db2fc8acac72e4934e0ae31d2132afdb95c105813b90284c0f3bd48d2bae45cd2d03aeb092f6ad45692fc26c26909b57d12e3bf2024de3edce03c2dd8cf1081fbc181cb24fb432907ee893125e386edee1e48b5fb72dc536fd879fc356b5bff8ae29afeda341fbb0fbba2d1a133f05b1cac0479743ca5c562d8a9d0ddb7bee5282f97fea614ca3aab3c10d6d6a81f495737f3787737ade4f9af413bc0298d7364c46dbcacedb88aba3b4add5e20c7927ca485152618468c3d23edc4d9cd368d4791e555fd2b8ec465a838f331950b862e23a9d8291dc879d7ea58209a3372319c8a5f2db16e3ebd1e349eb699a79faa391f8cee02ba5e9d1bc0f71b4e912681dfe4716c490dbf06199553c3bac487a1f2964d2f5fd7f064807dd11c3ca2f12c7a3ec79362c247f63d20d3ca52f0474b47c40a394ddfed196dce0259bf849bcb86f2d4919522d46f87443998f7ed5e40da41a80428d3b6e3845a9b377b3c6577add73ead5d1dc4d3620b53818be04d9f7ba74600cf5b462a7ed38b53b701465a152983c8fabe301fc42bebcb7c631e94afec308dee54b51e9c1df0f446fcd47612e90a275e51516310c59eb67c1e3b2da93bd52a7c9c4135fdc36027aad74c3cfd5c6ca6f5ae914a7cab1a3a5d397422163c49c609f53bd370fdecb126cea447defd3d448dadf5079430c058cba11fbb17c14ea71f96091f9a5d3a034ae9b34ac7a0b1d4eca440a51e4cd265911eeba260345b28ac84c065553e9aace53f1f29aa6b80ef7c4070192e4c12cb4389c3476b1f0a69825fdf4de60e9d02266fe9f50cba35775b2103bf85b312b04f3c6bec4b67e1b642a6b9bbef45d28ea1af055bf3c6cc62cb571cfbc4229c7d5aa62a2ed3ce2f42666fa295c71f44263c703d207fb6925f303a3facbd7afa4dccb0b6c37cf8e8a3fdc8ed1cfff049b48a94e50a5631a75589317dbcfd154f16e7dddac2945baf059a2aa4b14b9ac1d411c81dc600343abf5e9c4750e190a5116bab2258d8f1d5e0d3ab740423267be7e21c2eac41ae2aefead42fd71f91c4c3694617fb7fc265a48c3b82eea6e57c90824914847f857deb94c810b34ad53a9824127c2fef4cc5d7fd23307dd90c01bc32c79c2344459a58442b59260d8e21dc41f0b54d5d5433b9fd44ba4803766cacfec5bb5fd1ca3ccbc7c11cfd7274b526b9b61a231499a83831b9be1f708cde614165ce3bd0ccd42ab401bcd35143199d43395107e240e61c3abbcbad69a53ec9205bc2946dab619214ae55dfc6aad9a72683cb84f489efd02f1d439d6abfc4a9d2588c4db6419a7dd6c2387461298941a1d8d5bf4c0e35d0294014f217985cca434d557899c3090c236efe06bc9f2c5dc46f67896d56450a0aa4b6b6247ce45c12a1f547825cbac09f13bb48200ee1f85b00a0ce88723c19449fe2bbe500861bb03dbc2ae489e9b3f5ddaea3b4459be8aebd66cdc054affa87d60e0e86bb0ce56f604f697c5be3cb868e6dad28e3366ef5b6e9a26f8e1ba44d700eda13fa3f589ae638843a8a98c157f25c5e88c3df285e1e70d32110614c51d0e0a74abc7800006cf0d1d3d66e84ec726edc5c52f26f702d182e702be580bf74670201ebeffecc62630b637320626cbac4e9e98c608252e3932da36804e3e1e3ec3bee53bcf0071088c84f2a014b0122dcd9507d6003e63e34d7b59807dd24907e17ba43b83af0b734d9861870f137464be924a415a7607d7c2936c9156f6bc604c51600c558cdf18fe73fffa575443a4174311ecab11cd96572306b00a8998c20bb3879c37c9d400b06f03fd7b54ab24cefc134176df98af05086839f83eeaa9efa3e7629bdb0bc8377020b040e86cf36ff9f2bcc788091c9285b423cc7670a8290c394db287b24533b508a7df6786d571e6be8cd989ea2d1b846a03f24fcdae10333f55461716292e0589efbf61462943b8c8544ac128c8ce01e99ae5ba81cf037e86e1f35271c405c640a8429bc189a749033b831ef71bfb05fa72d2da716f2d86046296f481e4364f7e033dcb4fed15eb0937a66b62143ad51e76242f4cf425d662eeeb179a46a059489c2bbdee163cf5ac3d0fb6441bf171a7c34bbbcf2e3a59e637d35f32301d9d4a85b2a1db1a5cb6fffa7ebec998674711fdfd49297d7ac33f5c89d0999172bc3dad8e76ac1f081e4c1bb755562ff5715361000f56fb464881dfe6abb4f039a139f8fb2e2dca14b895ad3ee1d2835e0cd47051ea34d855b7c8387ef1a85d94b851602cbdb2242a2afb59d26292be2ebbd8ca3b2866b293c1ef2048dd65addb63230643502ab8e9548dfee031ee8306344f89973dc22712ae6896ab40c61e6093c026524da15ca192b1ecd14ec10cebfea7faed1a9bae2be7edf9c53182805fa4af868751ff3758b9c4f7e877dc8e16475592c85bda5a62c1b38938ac3b7031773c06c5eb5539baeb0588e6ede91d2da317a1a823045e375bb4ac29d6dc75d228a4ade916671eccd320ee5c0298650b541d98c4d1e09ed841f1cffbf0c7551c5ae725ad0f77f612829a409becb4e60ccc3cbb80d77e8d9bac59cfcac2c8a4c857f862747473148d9089dc56ed827784a63390eeb78f791c75c4eb3a1efad0f75e062cc4948e4b1b67a373494b88ff819a695ceac580bdd7b2c63222a663432e31b8531ee74d34afa70266ffe08d6ab6439c1b442df9195bd1b729d9ebfa25f326e48f7104303120046b2f1eb45c59a415b68d9cc3f6ca68dadf64748393f4c1f4a5876173ef0c95ea73c682b05e9e05c9a8a1d65500106a980f0a0effa10b93a03715f40f851d122a15fd4b60740a711b1121c146bb59b740ccf8db57b2eee36e4c5a3c6aadaca73b9637cb21f1d87acd9b76885b8694a5d036b6e3dde6ceb589575b6414bef68ae179973b5e04012a3ad10c55f9049ccd757185583633543f556967796eeebb8348e969860fdeb9166f1a431d44a2ae6e73c75d3b891ea014ce2be631c9d1eb301c7043aa03b66218095c0375ed12090e5bc32c44e3ddfbbcbe48f8d396e489db24cd7d8779d659b48193b96374e2937d3087e911b4d1c70cef3b984a72f80ed2f17ef50aab6f5931c897367aa6dd86e8e93de921c611f112f676e34b4ee720f46434b2c70742c1af99bee1b0c72683cd840bbba4e75e3a0128d0ebf1010dea64f896ef3cfd82a73fe329ce53b63697cb7bc0c03e127fd59d3241646f62a25ceb692d9e469c649dec8b693975d718d89394345b684ea2507d295422c88892de4e69c71e2dbf6bfd160a1c20b63e6e21b73d6bb14377ce3578664196f7ab33be87d3fe5772415361f857f6128b7ecd261638f4133f6384b1e2ba1c045985636e818e622460d4ef2af43267efb71168a92d22ec6b337158d3bcff2f0913ece4258ba89b5e19f8cae9c7f87ac8d051247f3635f398404f1d9fb1ace4082dd6897024070dddd7942b566d3f7f2a4fd9ec148397ddb814057c66b738f45ccb08f2f9ed8c5c8735a9c6938b7c5260a8cb0cbfd2bb9656592b4a70f368ecdcc8fdfcd52ad0ea0b9c3152147e9e441519eb1a69bc1b216fda362376ce23729bd384e8579c37aadf759b6c23ea54bfde28652d0b37cbcea221da9125919212cbad64e4aec3075bb70cc7eca71a25cb2a77c898fd775d74d61dcfcbff9d4d20102f3b5c804ccc3bb711b88140508a8802dcb205ebff54cbd9af252f36cf44b2337c382a7562ad6fc035313bff7f7d30a45fe01a083fb744460147a3a4b34b8dcc047607f38ba6b927c93872830e8d0c84031889b29afc2ef3944c4c0a3f3060f337bf0da8c7209e79a81f09330ecbf0024dcf85f7e4ec644867f5343f259825b1f421c51d30f3da87bbcb67946f133c6a4add120054b1b8a16a12a58352d37425f68d55e8e3a0391ed03085fef286214f51ab917906b2b9fcbf6ef85e04ba368f8811f9ec5a3a112c1b498f553e6659ed41b10ad141d921cca6878c7e1960380a2d0f86226f6b7e95a9639b41be4f73c392d3e7b133cfc2009f6a02edcfeb11bd2c84b3fcf50d4cb0d49f770ae2c71c73c766d327fb0c8d79c9908e1f7292eff8657f0ff0542df3127613c31cc2387d270b9510bd0a9709d80ed781b828d3a0f92df1be687206d572066d44b9afcf6b440b7298bf30f657fd9f986debea4f23032f37d711859854a134e7ad44613643eb7104e624e0bc34dddc2dd0ecee2bd04a87b03e06864710c51d561f28718c88ddc35dcbf23f1c5f0ef8149e24949e1d50572f039da9ef0fd29934fc6c7bcc9c44771b0d8c1dd739796eedd036abd78f4f26da1bb680138f9191eac4669d84e4866974257d8438f3253198b0478d33c325f633aaf85d9e6056766d1a17fa6cc1e1d639cf59dd06c1d8c1f4d48ea9ab2c3cc08fa812821eda5f32f17e808c14002aa846ee6f18177d27e6f715462e5562f0f7afbe6f5fa6ec031536b478733270175d928a46bc23cf14ed073854afd5032a8bef43d4c5664e159ffa7e9cdef4fe17c2c5ef36c6e6ddf342d16ce207cfe09b8067f2e48c6bae69b620d8be76725200b63522d766517203c6641e7d891469bf239c7a48d14f7c690e182c4f6a1fd02f2aa1b97dbecb8e120cc0fbd374ff598c53cb505698f94429466b97acb1a0232169e0e19e9ad7e3a41ee63e3b9ddcc0d40385c3d5acbb51e1987821de029bd9dc1fabd200a2e55bf786c52ae9ffc335d8a82e9156705ebfaff0992c1f5bca9d0d020834fea9163fcb691bf06deb6f92b76e2c21b3fa1625910846f3c715cbfb7de75209aec43c1a9acd2b4f833ac3a3883ba23349aa2a439871764c54ac8842a4a10280ff498072928aa1b4ced9ab3d9d27e4b5fab13bb979788848f7a4239896fe73a176a38766ed7fa1e84e88efb12a9c75c2e4431396b192b9dc4fa92343a702538feef01ae577fa443f4b50666bb87fc62577045963e8168981e1b6063b7454345a84dfdb278a4090d155220a18fd21e90a2c84943d947f5079aaa3e04364ffeb8a804df0f6e3c1b45782fcd5a4535940f26636ee79188ccb2ba071e0c832d9e9a9a391e0992e0f6965100ad2e6608d5db25847b2aa794ea6ee9b7687a1f9357320d073d06db8c38fbdc1be781bf53d05a5deeeb9e8d8ff66876b3a88b309d27bb83f8b3390947fd97c9f9ea41b215803088ac254cdab849291ed081e4a0cfd611fb7819d50753121bdda8770ad38d84bfadd9da9d7e9ffa5b9af3b9b8c13d7f73d920173137a6d4d17f2a2d0605926a68623947ee798dffe22746288195a718ae5dbfcc03b7da8a8ff0aa40c133b56c0c3ee95dd1dfaadafbdb37dc17ec84b0a0ce29ad46d50ef4fde31b6ba31c76498091fea2ef0c785be2daf492121dbc2101fd102000a"], 0x1028}}, 0x20000050) 796.915728ms ago: executing program 0 (id=1625): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000002c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000480)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f00000001c0)={r0}) 796.487578ms ago: executing program 2 (id=1626): r0 = openat$sysfs(0xffffff9c, &(0x7f00000037c0)='/sys/kernel/notes', 0x0, 0x2) syz_io_uring_setup(0xbdc, &(0x7f0000000080)={0x0, 0xec21, 0x80, 0x1, 0x40000333}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001800)=""/201, 0xc9}], 0x1, 0x0, 0x1}) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r4 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r5 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="5f9ccd8224ee9e2dbff75b8bc1fd83ba0de2dcad0be2926968197a702915d6256a9ce70926da180149738d5604c8543d767b9d75ea018c9bc57e383e077133610fdc955fef025af302ac76f1b2ee5bb0d9f0de129996f0d52c890b25b53d94fd322b68bbb8e36e36e7b4a5f641c34694f147b23a7dc0a887872ed068f939447bc41f601bd4faf22f7bd6835c960b1edb64a49a10f54dedca8156fad1339b19ba63458485fb34d09e3a91d5822a7fa54fecfff91c69fc2c36ddab638a6b", @ANYRES16=r3, @ANYBLOB="010425bd7000fedbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008c0001000000080001007063690011000200303030303a30303a31302e300000000008008c0000000000080001007063690011000200303030303a30303a31302e300000000008008a00", @ANYRES32, @ANYBLOB="080001007063690011000200303030303a30303a31302e300000000008008c0002000000080001007063690011000200303030303a30303a31302e300000000008008a00", @ANYRES32=r4, @ANYBLOB="0e0001006e657464657673696d0000000f0002006e657464657673696d30000008008c00030000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008a00", @ANYRES32=r5, @ANYBLOB="0e0001006e657464657673696d0000000f0002006e657464657673696d30000008008c0000000000"], 0x144}, 0x1, 0x0, 0x0, 0x80}, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r7, &(0x7f0000000080)={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x3f}, 0x4}, 0x1c) r8 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000300)={0x10000000}) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x439, 0x0, 0x60001, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x108}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_FWD_MASK={0x6, 0x9, 0xfffe}, @IFLA_BR_VLAN_STATS_PER_PORT={0x5, 0x2d, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x8000000) 666.138145ms ago: executing program 0 (id=1627): perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0xfffffffd, 0x0, @perf_config_ext={0x3fffffffc}, 0x0, 0x0, 0x0, 0x3, 0xfff, 0x8001, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) uname(0x0) getxattr(0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, 0x0, &(0x7f00000001c0)='GPL\x00'}, 0x94) syz_io_uring_setup(0x4175, &(0x7f0000000180)={0x0, 0xbf56, 0x10000, 0x2, 0x297}, 0x0, 0x0) r0 = socket(0x1, 0x5, 0x0) close(r0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000021000100000000000000000002000000fd00000201000100140011d24b719368305f746f5f6873720000000008000a00"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x4800) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x52, 0x3, 0x162, 0x6}, 0x14) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000000), &(0x7f0000000080)=0x4) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000500)={0xe000200c}) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f00000000c0)) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 581.971545ms ago: executing program 5 (id=1628): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x27, 0x6, 0x0, 0x0, 0x0, 0x9, 0x794bb, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x1, @perf_bp={0x0, 0xc}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x3, 0x1, 0x1, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="8000000010000304000000000000000ffe000000", @ANYRES32=0x0, @ANYBLOB="00000000000000005000128009000100766c616e000000004000028006000100"], 0x80}, 0x1, 0x0, 0x0, 0x20044081}, 0x8000) 581.571286ms ago: executing program 1 (id=1629): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x4000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f00000013c0)=0x80000000001, 0x4) connect$inet6(r2, &(0x7f0000000340)={0xa, 0x4e22, 0x0, @loopback, 0x1}, 0x1c) sendto$inet6(r2, &(0x7f00000002c0)="e8", 0xfffffffffffffd79, 0x2000c850, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x10020, 0x0) 460.507091ms ago: executing program 0 (id=1630): r0 = socket$kcm(0x2d, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f00000000c0)={r1}) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}, 0x97ff}], 0x400000000000172, 0x4001c00) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="580000006900010025bd7000fbdbdf25000003000000000008000180"], 0x58}, 0x1, 0x0, 0x0, 0x20058000}, 0xc259abe47edcfd22) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000100)={r2}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={r1}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0xc0, 0x0, 0x6, 0x0, 0x10000000000000, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_bp={0x0, 0x8}, 0xa100, 0xc8, 0xff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xb, 0xffffffffffffffff, 0x0) close(r7) recvmsg$unix(r6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x4d}, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r8, &(0x7f0000000640)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce8102032908000000000000000000000000ac14140a000000000000000000000000ac1414aa"], 0xfdef) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x100000f, 0x2172, r5, 0xd16cb000) 460.097841ms ago: executing program 4 (id=1631): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x7, 0x8604, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x8, 0x6}, 0x0, 0x10000, 0x0, 0x6, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r1) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000003040)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000003100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002bbd7000fbdbdf25020000000a000900aaaaaaaaaa44000008000300", @ANYRES32=r3, @ANYBLOB='\b\x00\v'], 0x30}, 0x1, 0x1000000, 0x0, 0x20000050}, 0x20040084) 459.691791ms ago: executing program 0 (id=1632): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r1, &(0x7f0000000580)=[{{&(0x7f0000000080)={0xa, 0x4e20, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x7}, 0x1c, 0x0}}], 0x1, 0x24000000) recvmmsg(r1, &(0x7f0000000940)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f80)=""/130, 0x82}, 0xdb30}], 0x1, 0x40002042, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x0) ftruncate(r0, 0xc17a) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000080)=0x9, 0x8, 0x0) mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) r2 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$inet6(0xa, 0x2, 0x0) mlock(&(0x7f00005f8000/0x1000)=nil, 0x1000) setsockopt$inet6_int(r3, 0x29, 0x4b, &(0x7f0000000100)=0x101, 0x4) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x11}, 0x2}, 0x1c) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000001000010420000000ffdbdfcc04b26637", @ANYRES32=r2, @ANYBLOB="7b13000000000000200012800b00010067656e657665000010000280060005004e200000040006"], 0x40}}, 0x40800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) (async) socket$inet6(0xa, 0x800000000000002, 0x0) (async) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) (async) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) (async) sendmmsg$inet6(r1, &(0x7f0000000580)=[{{&(0x7f0000000080)={0xa, 0x4e20, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x7}, 0x1c, 0x0}}], 0x1, 0x24000000) (async) recvmmsg(r1, &(0x7f0000000940)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f80)=""/130, 0x82}, 0xdb30}], 0x1, 0x40002042, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x0) (async) ftruncate(r0, 0xc17a) (async) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000080)=0x9, 0x8, 0x0) (async) mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0) (async) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) (async) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) (async) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) socket$inet6(0xa, 0x2, 0x0) (async) mlock(&(0x7f00005f8000/0x1000)=nil, 0x1000) (async) setsockopt$inet6_int(r3, 0x29, 0x4b, &(0x7f0000000100)=0x101, 0x4) (async) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x11}, 0x2}, 0x1c) (async) socket$nl_route(0x10, 0x3, 0x0) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) (async) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000001000010420000000ffdbdfcc04b26637", @ANYRES32=r2, @ANYBLOB="7b13000000000000200012800b00010067656e657665000010000280060005004e200000040006"], 0x40}}, 0x40800) (async) 409.664108ms ago: executing program 4 (id=1633): syz_emit_ethernet(0x3a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004600002c0000000000069078ac1414bbac14140b010000004e224001", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="0902000090780000"], 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x40082, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0xfe) ioctl$PPPIOCSACTIVE(r0, 0x40047459, &(0x7f0000009280)={0xfffffffffffffff7, 0x0}) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x50, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7f, 0x1, @perf_config_ext={0x407fff}, 0x14105, 0x2e, 0xfffffc00, 0x3, 0x2, 0xfffffffd, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$ptp0(0xffffffffffffff9c, 0x0, 0x42880, 0x0) pipe2(&(0x7f0000000000), 0x2080) syz_open_dev$tty1(0xc, 0x4, 0x3) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x3000046, &(0x7f00000134c0)={[{@dioread_nolock}, {@noauto_da_alloc}, {@inlinecrypt}, {@sysvgroups}, {@mblk_io_submit}, {@barrier_val}, {@data_err_ignore}, {@grpquota}, {@nombcache}, {@nobarrier}, {@resuid}, {@quota}]}, 0x1, 0x562, &(0x7f00000003c0)="$eJzs3d9rW+UbAPDnpO1+f7/rYAwVkcIunMyla+uPCV7MS9HhQO9naM/KaLqMJh1rHbhduBtvZAgiDsR7vfdy+A/4Vwx0MGQUvRAhctKTLl2TNuuypjOfD5zyvjkn5z1PznnevidvQgIYWGPZn0LEixHxVRJxOCKSfN1w5CvHVrdbeXh9OluSqNc//iNpbJfVm/tqPu9gXnkhIn75IuJkYWO71aXluVK5nC7k9fHa/JXx6tLyqUvzpdl0Nr08OTV15s2pyXfefqtnsb52/q9vP7r7/pkvj69889P9I7eTOBuH8nWtcTyFG62VsRjLX5OROPvYhhM9aGw3Sfp9AGzLUJ7nI5H1AYdjKM964L/v84ioAwMqkf8woJrjgOa9fY/ug58bD95bvQHaGP/w6nsjsa9xb3RgJVl3Z5Td7472oP2sjZ9/v3M7W6J370MAbOnGzYg4PTy8sf9L8v5v+053sc3jbej/YOfczcY/r7cb/xTWxj/RZvxzsE3ubsfW+V+434NmOsrGf++2Hf+uTVqNDuW1/zXGfCPJxUvlNOvb/h8RJ2Jkb1bfbD7nzMq9eqd1reO/bMnab44F8+O4P7x3/XNmSrXS08Tc6sHNiJfajn+TtfOftDn/2etxfv2u/ukU5LH0ziud2t86/mer/kPEq23P/6MZrWTz+cnxxvUw3rwqNvrz1rFfO7Xf7/iz839g8/hHk9b52uqTt/H9vr/TTuvWxR/dX/97kk8a5T35Y9dKtdrCRMSe5MONj08+em6z3tw+i//E8c37v3bX//6I+LTL+G8d/fHlruLv0/mfeaLz/+SFex989l2n9rvr/95olE7kj3TT/3V7gE/z2gEAAAAAAMBuU4iIQ5EUimvlQqFYXP18x9E4UChXqrWTFyuLl2ei8V3Z0RgpNGe6D7d8HmIi/zxssz75WH0qIo5ExNdD+xv14nSlPNPv4AEAAAAAAAAAAAAAAAAAAGCXONjh+/+Z34b6fXTAM+cnv2FwbZn/vfilJ2BX8v8fBpf8h8El/2FwyX8YXPIfBpf8h8El/2FwyX8AAAAAAAAAAAAAAAAAAAAAAAAAAADoqfPnzmVLfeXh9emsPnN1aXGucvXUTFqdK84vThenKwtXirOVymw5LU5X5rfaX7lSuTIxGYvXxmtptTZeXVq+MF9ZvFy7cGm+NJteSEd2JCoAAAAAAAAAAAAAAAAAAAB4vlSXludK5XK6oKCwrcLw7jiMdoWzPdxhRN/D2dlCv3smAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHjk3wAAAP//J6c4pg==") r2 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r2, &(0x7f00000065c0)=[{{&(0x7f0000000440)={0xa, 0x4e1f, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x40}, 0x1c, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="12000000000000001100000067"], 0xa0}}], 0x1, 0x400c0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) inotify_init() inotify_init() pipe2$9p(&(0x7f0000000180), 0x0) perf_event_open(&(0x7f0000001080)={0x2, 0x80, 0x9, 0xc, 0x4, 0x0, 0x0, 0x80, 0x50608, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x5, 0x7fffffffffffffff}, 0x10000, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffd}, 0x0, 0x0, 0xffffffffffffffff, 0x8) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="58000000020605000000000000000000000000000900020073797a3100000000050005000a000000050001000600000013000300686173683a6e65742c696661636500000c0007800800124005000000050004"], 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x800) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000400)=""/235, 0xeb}], 0x1) 389.64784ms ago: executing program 5 (id=1634): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000001d40)=""/102395, 0x18ffb}], 0x1, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) bind$tipc(r0, &(0x7f0000000000)=@id={0x1e, 0x3, 0x3, {0x4e20, 0x4}}, 0x10) 363.750604ms ago: executing program 0 (id=1635): r0 = getpgid(0xffffffffffffffff) prlimit64(r0, 0x6, &(0x7f0000000000)={0xfffffffffffffffc, 0x40}, 0x0) (async) prlimit64(r0, 0x6, &(0x7f0000000000)={0xfffffffffffffffc, 0x40}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000380)={@cgroup, 0xffffffffffffffff, 0x1a, 0x200c}, 0x20) capset(&(0x7f0000000380)={0x20071026}, &(0x7f0000000040)={0x200000, 0x40200003, 0x0, 0x6, 0x7, 0xb}) syz_clone(0x44200400, 0x0, 0x0, 0x0, 0x0, 0x0) 234.04729ms ago: executing program 5 (id=1636): r0 = socket$nl_route(0x10, 0x3, 0x0) flock(r0, 0x1) r1 = socket$rxrpc(0x21, 0x2, 0xa) sendto$rxrpc(r1, 0x0, 0x0, 0x0, 0x0, 0x0) bind$rxrpc(r1, &(0x7f0000000000)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e20, 0x8, @private0, 0x9}}, 0x24) perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0xe, 0x0, 0x0, 0x0, 0x8, 0x40008, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_config_ext={0x9, 0x20000006}, 0x0, 0x0, 0x800000, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = socket$rxrpc(0x21, 0x2, 0xa) open(&(0x7f0000000280)='./file0\x00', 0x101200, 0x4) bind$rxrpc(r2, &(0x7f0000000100)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e20, 0x4, @mcast2, 0x7da3}}, 0x24) r3 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x717f, 0x100, 0x14, 0x7f}, &(0x7f0000000140)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000003c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd=r2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x3}}) io_uring_enter(r3, 0x3516, 0x0, 0xffffffea, 0x0, 0x0) r6 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[], 0x10b8}, 0x20008004) 230.081781ms ago: executing program 5 (id=1637): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000002c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000480)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f00000001c0)={r0}) 126.045944ms ago: executing program 5 (id=1638): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="0100000040fc51c64400000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x80}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="0100"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="01000000080800"/16, @ANYRESDEC=r1, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES16=r0], 0x80}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r5 = accept(r2, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r4, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) 62.063382ms ago: executing program 0 (id=1639): bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) syz_emit_ethernet(0x5e, &(0x7f0000000280)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x28, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @mcast2={0xff, 0x5}, @remote}}}}}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r1, &(0x7f0000000100)={@val={0x0, 0x6003}, @void, @eth={@link_local, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x18, 0x67, 0x0, 0x3, 0x2f, 0x0, @private=0x1fe1, @multicast1}, {0xa000, 0x86dd, 0xc, 0x0, @opaque='\x00\x00\x00\x00'}}}}}}, 0x32) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 0s ago: executing program 2 (id=1640): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f00000002c0)={0x401, 0x3, 0x80, 0x7, 0x16, '\x00\x00\x00\x00\x00c\t\x00'}) write$binfmt_aout(r0, &(0x7f0000000180)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)) r1 = syz_open_pts(r0, 0x101000) r2 = dup3(r1, r0, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r3) syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0xc0085508, &(0x7f0000000500)=0x800000b) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x17) kernel console output (not intermixed with test programs): 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 109.137604][ T3316] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 109.241720][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 109.339878][ T6458] xt_TPROXY: Can be used only with -p tcp or -p udp [ 109.368539][ T6465] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=6465 comm=syz.0.939 [ 109.426935][ T6467] x_tables: duplicate underflow at hook 1 [ 109.641508][ T6472] syz.2.942: attempt to access beyond end of device [ 109.641508][ T6472] loop2: rw=2049, sector=145, nr_sectors = 896 limit=128 [ 109.669983][ T6472] syz.2.942: attempt to access beyond end of device [ 109.669983][ T6472] loop2: rw=524288, sector=145, nr_sectors = 224 limit=128 [ 109.681140][ T6481] FAULT_INJECTION: forcing a failure. [ 109.681140][ T6481] name failslab, interval 1, probability 0, space 0, times 0 [ 109.697165][ T6481] CPU: 0 UID: 0 PID: 6481 Comm: syz.3.945 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 109.697200][ T6481] Tainted: [W]=WARN [ 109.697208][ T6481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 109.697222][ T6481] Call Trace: [ 109.697229][ T6481] [ 109.697238][ T6481] __dump_stack+0x1d/0x30 [ 109.697303][ T6481] dump_stack_lvl+0x95/0xd0 [ 109.697328][ T6481] dump_stack+0x15/0x1b [ 109.697348][ T6481] should_fail_ex+0x263/0x280 [ 109.697372][ T6481] should_failslab+0x8c/0xb0 [ 109.697461][ T6481] __kmalloc_cache_noprof+0x64/0x4a0 [ 109.697488][ T6481] ? basic_init+0x32/0xc0 [ 109.697599][ T6481] ? __slab_alloc+0x25/0x50 [ 109.697630][ T6481] basic_init+0x32/0xc0 [ 109.697662][ T6481] tcf_proto_create+0x130/0x1a0 [ 109.697711][ T6481] tc_new_tfilter+0xa82/0x1110 [ 109.697758][ T6481] ? ns_capable+0x7c/0xb0 [ 109.697801][ T6481] ? __pfx_tc_new_tfilter+0x10/0x10 [ 109.697837][ T6481] rtnetlink_rcv_msg+0x64b/0x720 [ 109.697866][ T6481] netlink_rcv_skb+0x123/0x220 [ 109.697973][ T6481] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 109.697998][ T6481] rtnetlink_rcv+0x1c/0x30 [ 109.698016][ T6481] netlink_unicast+0x5c0/0x690 [ 109.698049][ T6481] netlink_sendmsg+0x5c8/0x6f0 [ 109.698143][ T6481] ? __pfx_netlink_sendmsg+0x10/0x10 [ 109.698165][ T6481] __sock_sendmsg+0x145/0x170 [ 109.698190][ T6481] ____sys_sendmsg+0x31e/0x4a0 [ 109.698227][ T6481] ___sys_sendmsg+0x195/0x1e0 [ 109.698376][ T6481] __x64_sys_sendmsg+0xd4/0x160 [ 109.698416][ T6481] x64_sys_call+0x17ba/0x3000 [ 109.698477][ T6481] do_syscall_64+0xc0/0x2a0 [ 109.698564][ T6481] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.698616][ T6481] RIP: 0033:0x7f4b0c0bacb9 [ 109.698632][ T6481] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.698651][ T6481] RSP: 002b:00007f4b0ab17028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 109.698729][ T6481] RAX: ffffffffffffffda RBX: 00007f4b0c335fa0 RCX: 00007f4b0c0bacb9 [ 109.698743][ T6481] RDX: 0000000000000000 RSI: 0000200000006040 RDI: 0000000000000004 [ 109.698756][ T6481] RBP: 00007f4b0ab17090 R08: 0000000000000000 R09: 0000000000000000 [ 109.698769][ T6481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 109.698783][ T6481] R13: 00007f4b0c336038 R14: 00007f4b0c335fa0 R15: 00007ffe1d14c298 [ 109.698884][ T6481] [ 109.699553][ T6472] syz.2.942: attempt to access beyond end of device [ 109.699553][ T6472] loop2: rw=8388608, sector=145, nr_sectors = 8 limit=128 [ 109.951049][ T6472] syz.2.942: attempt to access beyond end of device [ 109.951049][ T6472] loop2: rw=8388608, sector=145, nr_sectors = 8 limit=128 [ 109.965057][ T6472] syz.2.942: attempt to access beyond end of device [ 109.965057][ T6472] loop2: rw=8388608, sector=145, nr_sectors = 8 limit=128 [ 109.978785][ T6472] syz.2.942: attempt to access beyond end of device [ 109.978785][ T6472] loop2: rw=8388608, sector=145, nr_sectors = 8 limit=128 [ 109.992532][ T6472] syz.2.942: attempt to access beyond end of device [ 109.992532][ T6472] loop2: rw=8388608, sector=145, nr_sectors = 8 limit=128 [ 109.997429][ T6479] lo speed is unknown, defaulting to 1000 [ 110.006487][ T6472] syz.2.942: attempt to access beyond end of device [ 110.006487][ T6472] loop2: rw=8388608, sector=145, nr_sectors = 8 limit=128 [ 110.026266][ T6472] syz.2.942: attempt to access beyond end of device [ 110.026266][ T6472] loop2: rw=8388608, sector=145, nr_sectors = 8 limit=128 [ 110.040986][ T6472] syz.2.942: attempt to access beyond end of device [ 110.040986][ T6472] loop2: rw=8388608, sector=145, nr_sectors = 8 limit=128 [ 110.275453][ T6494] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=6494 comm=syz.3.951 [ 110.507540][ T6512] netlink: 'syz.3.957': attribute type 30 has an invalid length. [ 110.693240][ T6526] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=6526 comm=syz.3.963 [ 110.736061][ T6528] lo speed is unknown, defaulting to 1000 [ 110.887008][ T10] IPVS: starting estimator thread 0... [ 110.981540][ T6543] IPVS: using max 2208 ests per chain, 110400 per kthread [ 111.016011][ T29] kauditd_printk_skb: 326 callbacks suppressed [ 111.016027][ T29] audit: type=1326 audit(1768826606.228:12898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6541 comm="syz.0.969" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 111.100201][ T29] audit: type=1326 audit(1768826606.308:12899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6552 comm="syz.0.971" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 111.129740][ T6554] netlink: 'syz.0.971': attribute type 30 has an invalid length. [ 111.162948][ T10] IPVS: starting estimator thread 0... [ 111.185501][ T6558] set_capacity_and_notify: 5 callbacks suppressed [ 111.185521][ T6558] loop3: detected capacity change from 0 to 2048 [ 111.226454][ T29] audit: type=1326 audit(1768826606.338:12900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6552 comm="syz.0.971" exe="/root/syz-executor" sig=0 arch=c000003e syscall=318 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 111.250001][ T29] audit: type=1326 audit(1768826606.338:12901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6552 comm="syz.0.971" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 111.255573][ T6559] IPVS: using max 2448 ests per chain, 122400 per kthread [ 111.273508][ T29] audit: type=1326 audit(1768826606.338:12902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6552 comm="syz.0.971" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 111.273538][ T29] audit: type=1326 audit(1768826606.338:12903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6552 comm="syz.0.971" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 111.273633][ T29] audit: type=1326 audit(1768826606.338:12904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6552 comm="syz.0.971" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 111.273665][ T29] audit: type=1326 audit(1768826606.338:12905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6552 comm="syz.0.971" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 111.273745][ T29] audit: type=1326 audit(1768826606.338:12906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6552 comm="syz.0.971" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 111.273824][ T29] audit: type=1326 audit(1768826606.338:12907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6552 comm="syz.0.971" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 111.449059][ T6566] __nla_validate_parse: 10 callbacks suppressed [ 111.449081][ T6566] netlink: 8752 bytes leftover after parsing attributes in process `syz.4.976'. [ 111.492689][ T6558] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 111.517997][ T6566] program syz.4.976 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 111.557694][ T6580] loop0: detected capacity change from 0 to 1024 [ 111.565612][ T6580] EXT4-fs: Ignoring removed nomblk_io_submit option [ 111.598568][ T6580] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 111.612575][ T6566] netlink: 28 bytes leftover after parsing attributes in process `syz.4.976'. [ 111.653898][ T3316] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 111.794091][ T6594] netlink: 'syz.2.986': attribute type 30 has an invalid length. [ 111.930099][ T6604] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=6604 comm=syz.1.990 [ 111.944031][ T6604] netlink: 232 bytes leftover after parsing attributes in process `syz.1.990'. [ 112.025642][ T6609] loop1: detected capacity change from 0 to 8192 [ 112.095030][ T6614] netlink: 4 bytes leftover after parsing attributes in process `syz.0.991'. [ 112.113405][ T6618] netlink: 60 bytes leftover after parsing attributes in process `syz.1.996'. [ 112.142810][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 112.163117][ T6621] loop4: detected capacity change from 0 to 128 [ 112.177414][ T6623] FAULT_INJECTION: forcing a failure. [ 112.177414][ T6623] name failslab, interval 1, probability 0, space 0, times 0 [ 112.190757][ T6623] CPU: 0 UID: 0 PID: 6623 Comm: syz.1.998 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 112.190846][ T6623] Tainted: [W]=WARN [ 112.190855][ T6623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 112.190893][ T6623] Call Trace: [ 112.190899][ T6623] [ 112.190906][ T6623] __dump_stack+0x1d/0x30 [ 112.190931][ T6623] dump_stack_lvl+0x95/0xd0 [ 112.190956][ T6623] dump_stack+0x15/0x1b [ 112.191059][ T6623] should_fail_ex+0x263/0x280 [ 112.191089][ T6623] should_failslab+0x8c/0xb0 [ 112.191135][ T6623] kmem_cache_alloc_node_noprof+0x6a/0x4a0 [ 112.191162][ T6623] ? __alloc_skb+0x2f0/0x4b0 [ 112.191188][ T6623] __alloc_skb+0x2f0/0x4b0 [ 112.191218][ T6623] ? __alloc_skb+0x219/0x4b0 [ 112.191275][ T6623] netlink_alloc_large_skb+0xbf/0xf0 [ 112.191313][ T6623] netlink_sendmsg+0x40c/0x6f0 [ 112.191338][ T6623] ? __pfx_netlink_sendmsg+0x10/0x10 [ 112.191367][ T6623] __sock_sendmsg+0x145/0x170 [ 112.191457][ T6623] ____sys_sendmsg+0x31e/0x4a0 [ 112.191549][ T6623] ___sys_sendmsg+0x195/0x1e0 [ 112.191603][ T6623] __x64_sys_sendmsg+0xd4/0x160 [ 112.191639][ T6623] x64_sys_call+0x17ba/0x3000 [ 112.191690][ T6623] do_syscall_64+0xc0/0x2a0 [ 112.191716][ T6623] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.191741][ T6623] RIP: 0033:0x7f5ce1fbacb9 [ 112.191778][ T6623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.191801][ T6623] RSP: 002b:00007f5ce0a17028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 112.191823][ T6623] RAX: ffffffffffffffda RBX: 00007f5ce2235fa0 RCX: 00007f5ce1fbacb9 [ 112.191878][ T6623] RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000003 [ 112.191894][ T6623] RBP: 00007f5ce0a17090 R08: 0000000000000000 R09: 0000000000000000 [ 112.191910][ T6623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 112.191925][ T6623] R13: 00007f5ce2236038 R14: 00007f5ce2235fa0 R15: 00007fff1af688a8 [ 112.191949][ T6623] [ 112.322550][ T6616] lo speed is unknown, defaulting to 1000 [ 112.415031][ T6627] loop3: detected capacity change from 0 to 128 [ 112.451118][ T6627] buffer_io_error: 2 callbacks suppressed [ 112.451190][ T6627] Buffer I/O error on dev loop3, logical block 70, lost async page write [ 112.465965][ T6631] netlink: 'syz.0.1001': attribute type 13 has an invalid length. [ 112.477852][ T6627] Buffer I/O error on dev loop3, logical block 71, lost async page write [ 112.496571][ T6627] Buffer I/O error on dev loop3, logical block 72, lost async page write [ 112.515486][ T6626] Buffer I/O error on dev loop3, logical block 69, async page read [ 112.531148][ T6631] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 112.549266][ T6636] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=6636 comm=syz.4.1002 [ 112.563482][ T6626] Buffer I/O error on dev loop3, logical block 70, async page read [ 112.572396][ T6626] Buffer I/O error on dev loop3, logical block 71, async page read [ 112.580460][ T6626] Buffer I/O error on dev loop3, logical block 72, async page read [ 112.588911][ T6626] Buffer I/O error on dev loop3, logical block 69, async page read [ 112.597193][ T6626] Buffer I/O error on dev loop3, logical block 70, async page read [ 112.605423][ T6626] Buffer I/O error on dev loop3, logical block 71, async page read [ 112.614065][ T6637] netlink: 232 bytes leftover after parsing attributes in process `syz.4.1002'. [ 112.650600][ T6641] netlink: 172 bytes leftover after parsing attributes in process `syz.4.1003'. [ 112.659781][ T6641] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1003'. [ 112.670416][ T6640] netlink: 'syz.1.1004': attribute type 30 has an invalid length. [ 112.732811][ T6645] loop2: detected capacity change from 0 to 164 [ 112.750812][ T6645] iso9660: Unknown parameter 'ïæ½ïèkUt| ¸ ¡¢øöèÈêu¬¦7ÜëR' [ 112.850618][ T6658] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1009'. [ 112.860338][ T6658] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1009'. [ 112.948833][ T6664] loop4: detected capacity change from 0 to 128 [ 113.003640][ T6675] loop3: detected capacity change from 0 to 256 [ 113.007534][ T6672] lo speed is unknown, defaulting to 1000 [ 113.073861][ T6681] loop4: detected capacity change from 0 to 1024 [ 113.122800][ T6690] syz.3.1018 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 113.153397][ T6692] veth0_to_batadv: mtu less than device minimum [ 113.184928][ T6696] loop2: detected capacity change from 0 to 1024 [ 113.261762][ T6696] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 113.327969][ T6711] lo speed is unknown, defaulting to 1000 [ 113.335559][ T6696] EXT4-fs (loop2): shut down requested (1) [ 113.375940][ T6708] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 113.403176][ T3323] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.495210][ T6707] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1306: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 113.511720][ T6707] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 32 with max blocks 5 with error 28 [ 113.524081][ T6707] EXT4-fs (loop4): This should not happen!! Data will be lost [ 113.524081][ T6707] [ 113.533884][ T6707] EXT4-fs (loop4): Total free blocks count 0 [ 113.540030][ T6707] EXT4-fs (loop4): Free/Dirty block details [ 113.546190][ T6707] EXT4-fs (loop4): free_blocks=2415919504 [ 113.551962][ T6707] EXT4-fs (loop4): dirty_blocks=16 [ 113.557307][ T6707] EXT4-fs (loop4): Block reservation details [ 113.563413][ T6707] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 113.653693][ T3324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.777070][ T6749] netlink: 'syz.4.1045': attribute type 30 has an invalid length. [ 113.807040][ T6747] lo speed is unknown, defaulting to 1000 [ 113.858478][ T6753] xt_hashlimit: max too large, truncated to 1048576 [ 113.865974][ T6753] xt_CT: You must specify a L4 protocol and not use inversions on it [ 113.917728][ T6758] FAULT_INJECTION: forcing a failure. [ 113.917728][ T6758] name failslab, interval 1, probability 0, space 0, times 0 [ 113.930571][ T6758] CPU: 0 UID: 0 PID: 6758 Comm: syz.1.1049 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 113.930622][ T6758] Tainted: [W]=WARN [ 113.930629][ T6758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 113.930644][ T6758] Call Trace: [ 113.930652][ T6758] [ 113.930661][ T6758] __dump_stack+0x1d/0x30 [ 113.930683][ T6758] dump_stack_lvl+0x95/0xd0 [ 113.930762][ T6758] dump_stack+0x15/0x1b [ 113.930784][ T6758] should_fail_ex+0x263/0x280 [ 113.930822][ T6758] should_failslab+0x8c/0xb0 [ 113.930840][ T6758] __kmalloc_cache_noprof+0x64/0x4a0 [ 113.930915][ T6758] ? bpf_prog_alloc_no_stats+0xc4/0x380 [ 113.930950][ T6758] bpf_prog_alloc_no_stats+0xc4/0x380 [ 113.930981][ T6758] bpf_prog_alloc+0x3c/0x150 [ 113.931076][ T6758] bpf_prog_load+0x506/0x1140 [ 113.931113][ T6758] ? security_bpf+0x2b/0x90 [ 113.931157][ T6758] __sys_bpf+0x469/0x7b0 [ 113.931182][ T6758] __x64_sys_bpf+0x41/0x50 [ 113.931262][ T6758] x64_sys_call+0x28e1/0x3000 [ 113.931285][ T6758] do_syscall_64+0xc0/0x2a0 [ 113.931309][ T6758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.931366][ T6758] RIP: 0033:0x7f5ce1fbacb9 [ 113.931386][ T6758] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 113.931406][ T6758] RSP: 002b:00007f5ce0a17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 113.931425][ T6758] RAX: ffffffffffffffda RBX: 00007f5ce2235fa0 RCX: 00007f5ce1fbacb9 [ 113.931438][ T6758] RDX: 0000000000000094 RSI: 0000200000000200 RDI: 0000000000000005 [ 113.931520][ T6758] RBP: 00007f5ce0a17090 R08: 0000000000000000 R09: 0000000000000000 [ 113.931532][ T6758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 113.931546][ T6758] R13: 00007f5ce2236038 R14: 00007f5ce2235fa0 R15: 00007fff1af688a8 [ 113.931613][ T6758] [ 114.246035][ T6775] tipc: Enabling of bearer rejected, media not registered [ 114.264255][ T6777] FAULT_INJECTION: forcing a failure. [ 114.264255][ T6777] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 114.278095][ T6777] CPU: 0 UID: 0 PID: 6777 Comm: syz.3.1056 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 114.278170][ T6777] Tainted: [W]=WARN [ 114.278179][ T6777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 114.278194][ T6777] Call Trace: [ 114.278202][ T6777] [ 114.278211][ T6777] __dump_stack+0x1d/0x30 [ 114.278316][ T6777] dump_stack_lvl+0x95/0xd0 [ 114.278338][ T6777] dump_stack+0x15/0x1b [ 114.278357][ T6777] should_fail_ex+0x263/0x280 [ 114.278386][ T6777] should_fail+0xb/0x20 [ 114.278406][ T6777] should_fail_usercopy+0x1a/0x20 [ 114.278537][ T6777] _copy_to_user+0x20/0xa0 [ 114.278573][ T6777] simple_read_from_buffer+0xb5/0x130 [ 114.278615][ T6777] proc_fail_nth_read+0x10e/0x150 [ 114.278674][ T6777] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 114.278705][ T6777] vfs_read+0x1ab/0x7f0 [ 114.278814][ T6777] ? __rcu_read_unlock+0x4e/0x70 [ 114.278835][ T6777] ? __fget_files+0x184/0x1c0 [ 114.278933][ T6777] ? mutex_lock+0x57/0x90 [ 114.278966][ T6777] ksys_read+0xdc/0x1a0 [ 114.279035][ T6777] __x64_sys_read+0x40/0x50 [ 114.279057][ T6777] x64_sys_call+0x2889/0x3000 [ 114.279083][ T6777] do_syscall_64+0xc0/0x2a0 [ 114.279184][ T6777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.279210][ T6777] RIP: 0033:0x7f4b0c07b58e [ 114.279228][ T6777] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 114.279250][ T6777] RSP: 002b:00007f4b0ab16fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 114.279328][ T6777] RAX: ffffffffffffffda RBX: 00007f4b0ab176c0 RCX: 00007f4b0c07b58e [ 114.279341][ T6777] RDX: 000000000000000f RSI: 00007f4b0ab170a0 RDI: 0000000000000003 [ 114.279356][ T6777] RBP: 00007f4b0ab17090 R08: 0000000000000000 R09: 0000000000000000 [ 114.279370][ T6777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 114.279384][ T6777] R13: 00007f4b0c336038 R14: 00007f4b0c335fa0 R15: 00007ffe1d14c298 [ 114.279407][ T6777] [ 114.557024][ T6784] EXT4-fs warning (device loop1): ext4_xattr_inode_get:546: inode #11: comm syz.1.1057: ea_inode file size=4 entry size=6 [ 114.577192][ T6784] EXT4-fs error (device loop1): ext4_do_update_inode:5617: inode #15: comm syz.1.1057: corrupted inode contents [ 114.590137][ T6784] EXT4-fs error (device loop1): ext4_dirty_inode:6502: inode #15: comm syz.1.1057: mark_inode_dirty error [ 114.603605][ T6784] EXT4-fs error (device loop1): ext4_do_update_inode:5617: inode #15: comm syz.1.1057: corrupted inode contents [ 114.616133][ T6784] EXT4-fs error (device loop1): ext4_xattr_delete_inode:3001: inode #15: comm syz.1.1057: mark_inode_dirty error [ 114.629031][ T6784] EXT4-fs error (device loop1): ext4_xattr_delete_inode:3004: inode #15: comm syz.1.1057: mark inode dirty (error -117) [ 114.642846][ T6784] EXT4-fs warning (device loop1): ext4_evict_inode:273: xattr delete (err -117) [ 114.652185][ T6784] EXT4-fs (loop1): 1 orphan inode deleted [ 114.658595][ T6784] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 114.687947][ T3320] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 114.708673][ T6794] EXT4-fs: Ignoring removed nobh option [ 114.723466][ T6788] lo speed is unknown, defaulting to 1000 [ 114.758911][ T6794] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 114.830793][ T6794] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1306: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 114.854304][ T6807] IPVS: dh: FWM 3 0x00000003 - no destination available [ 115.121005][ T6816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.154001][ T6816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.174597][ T6826] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 115.198219][ T6826] EXT4-fs (loop3): shut down requested (1) [ 115.258600][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.355779][ T6832] lo speed is unknown, defaulting to 1000 [ 115.433520][ T6835] vxcan1: tx drop: invalid sa for name 0x0000000000000002 [ 115.552620][ T6250] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 115.565003][ T6250] EXT4-fs (loop0): This should not happen!! Data will be lost [ 115.565003][ T6250] [ 115.574799][ T6250] EXT4-fs (loop0): Total free blocks count 0 [ 115.581476][ T6250] EXT4-fs (loop0): Free/Dirty block details [ 115.587706][ T6250] EXT4-fs (loop0): free_blocks=20480 [ 115.593099][ T6250] EXT4-fs (loop0): dirty_blocks=16 [ 115.598230][ T6250] EXT4-fs (loop0): Block reservation details [ 115.604303][ T6250] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 115.614241][ T3316] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.781744][ T6857] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 115.828846][ T6871] EXT4-fs: Ignoring removed mblk_io_submit option [ 115.868266][ T6871] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 115.892468][ T6884] netlink: 'syz.2.1090': attribute type 6 has an invalid length. [ 115.904576][ T6857] EXT4-fs (loop4): shut down requested (1) [ 115.928420][ T6871] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.960742][ T3324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.974441][ T6871] EXT4-fs: Ignoring removed nobh option [ 115.988613][ T6874] lo speed is unknown, defaulting to 1000 [ 116.022252][ T6871] EXT4-fs (loop0): can't mount with journal_async_commit, fs mounted w/o journal [ 116.029635][ T6884] FAULT_INJECTION: forcing a failure. [ 116.029635][ T6884] name failslab, interval 1, probability 0, space 0, times 0 [ 116.044330][ T6884] CPU: 1 UID: 0 PID: 6884 Comm: syz.2.1090 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 116.044452][ T6884] Tainted: [W]=WARN [ 116.044458][ T6884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 116.044470][ T6884] Call Trace: [ 116.044475][ T6884] [ 116.044483][ T6884] __dump_stack+0x1d/0x30 [ 116.044506][ T6884] dump_stack_lvl+0x95/0xd0 [ 116.044601][ T6884] dump_stack+0x15/0x1b [ 116.044624][ T6884] should_fail_ex+0x263/0x280 [ 116.044650][ T6884] should_failslab+0x8c/0xb0 [ 116.044673][ T6884] __kmalloc_noprof+0xb8/0x580 [ 116.044697][ T6884] ? fib_create_info+0xb9a/0x1950 [ 116.044809][ T6884] fib_create_info+0xb9a/0x1950 [ 116.044862][ T6884] fib_table_insert+0x60/0xe80 [ 116.044902][ T6884] ? __mutex_lock_slowpath+0xa/0x10 [ 116.044936][ T6884] ? fib_new_table+0xad/0x1c0 [ 116.044968][ T6884] inet_rtm_newroute+0xb5/0x160 [ 116.044995][ T6884] ? __pfx_inet_rtm_newroute+0x10/0x10 [ 116.045070][ T6884] rtnetlink_rcv_msg+0x64b/0x720 [ 116.045160][ T6884] netlink_rcv_skb+0x123/0x220 [ 116.045196][ T6884] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 116.045299][ T6884] rtnetlink_rcv+0x1c/0x30 [ 116.045316][ T6884] netlink_unicast+0x5c0/0x690 [ 116.045344][ T6884] netlink_sendmsg+0x5c8/0x6f0 [ 116.045363][ T6884] ? __pfx_netlink_sendmsg+0x10/0x10 [ 116.045406][ T6884] __sock_sendmsg+0x145/0x170 [ 116.045426][ T6884] ____sys_sendmsg+0x31e/0x4a0 [ 116.045462][ T6884] ___sys_sendmsg+0x195/0x1e0 [ 116.045544][ T6884] __x64_sys_sendmsg+0xd4/0x160 [ 116.045583][ T6884] x64_sys_call+0x17ba/0x3000 [ 116.045612][ T6884] do_syscall_64+0xc0/0x2a0 [ 116.045708][ T6884] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.045874][ T6884] RIP: 0033:0x7f4f4158acb9 [ 116.045893][ T6884] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.045993][ T6884] RSP: 002b:00007f4f3ffe7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 116.046016][ T6884] RAX: ffffffffffffffda RBX: 00007f4f41805fa0 RCX: 00007f4f4158acb9 [ 116.046032][ T6884] RDX: 0000000000000894 RSI: 0000200000000000 RDI: 0000000000000004 [ 116.046047][ T6884] RBP: 00007f4f3ffe7090 R08: 0000000000000000 R09: 0000000000000000 [ 116.046062][ T6884] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 116.046076][ T6884] R13: 00007f4f41806038 R14: 00007f4f41805fa0 R15: 00007ffd44e80588 [ 116.046127][ T6884] [ 116.360844][ T6891] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 116.403268][ T3323] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 116.453431][ T6918] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=6918 comm=syz.4.1092 [ 116.479504][ T6923] set_capacity_and_notify: 14 callbacks suppressed [ 116.479525][ T6923] loop2: detected capacity change from 0 to 1024 [ 116.503568][ T6918] __nla_validate_parse: 7 callbacks suppressed [ 116.503586][ T6918] netlink: 232 bytes leftover after parsing attributes in process `syz.4.1092'. [ 116.521704][ T6923] EXT4-fs (loop2): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 116.552341][ T6923] ext4 filesystem being mounted at /190/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 116.588663][ T29] kauditd_printk_skb: 453 callbacks suppressed [ 116.588821][ T29] audit: type=1400 audit(1768826611.798:13361): avc: denied { write } for pid=6906 comm="syz.0.1097" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 116.712826][ T6934] loop4: detected capacity change from 0 to 1024 [ 116.745172][ T6934] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 116.782701][ T6934] EXT4-fs (loop4): shut down requested (1) [ 116.801041][ T3324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 116.869991][ T6932] syzkaller0: entered promiscuous mode [ 116.876319][ T6932] syzkaller0: entered allmulticast mode [ 116.894393][ T29] audit: type=1400 audit(1768826612.108:13362): avc: denied { create } for pid=6939 comm="syz.4.1104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 117.079422][ T3323] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 117.103022][ T29] audit: type=1400 audit(1768826612.318:13363): avc: denied { create } for pid=6958 comm="syz.4.1112" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 117.139334][ T6962] netlink: 'syz.0.1113': attribute type 30 has an invalid length. [ 117.168361][ T6959] netlink: 'syz.4.1112': attribute type 2 has an invalid length. [ 117.176306][ T6959] netlink: 'syz.4.1112': attribute type 4 has an invalid length. [ 117.184845][ T6959] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1112'. [ 117.205765][ T6969] loop1: detected capacity change from 0 to 1024 [ 117.206710][ T29] audit: type=1326 audit(1768826612.338:13364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6961 comm="syz.0.1113" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 117.236087][ T29] audit: type=1326 audit(1768826612.338:13365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6961 comm="syz.0.1113" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 117.260468][ T29] audit: type=1326 audit(1768826612.338:13366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6961 comm="syz.0.1113" exe="/root/syz-executor" sig=0 arch=c000003e syscall=318 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 117.284009][ T29] audit: type=1326 audit(1768826612.338:13367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6961 comm="syz.0.1113" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 117.308369][ T29] audit: type=1326 audit(1768826612.338:13368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6961 comm="syz.0.1113" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 117.332677][ T29] audit: type=1326 audit(1768826612.338:13369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6961 comm="syz.0.1113" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 117.356852][ T29] audit: type=1326 audit(1768826612.338:13370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6961 comm="syz.0.1113" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc47f16acb9 code=0x7ffc0000 [ 117.462438][ T6969] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 117.528292][ T6969] EXT4-fs (loop1): shut down requested (1) [ 117.546143][ T3320] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 117.705771][ T7001] Cannot find del_set index 286 as target [ 117.760301][ T7006] netlink: 'syz.2.1127': attribute type 2 has an invalid length. [ 117.768223][ T7006] netlink: 'syz.2.1127': attribute type 4 has an invalid length. [ 117.776781][ T7006] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1127'. [ 117.786063][ T7004] netlink: 'syz.1.1126': attribute type 30 has an invalid length. [ 118.068570][ T7027] netlink: 'syz.0.1133': attribute type 7 has an invalid length. [ 118.108266][ T7027] netlink: 'syz.0.1133': attribute type 21 has an invalid length. [ 118.122705][ T7027] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1133'. [ 118.195488][ T7031] loop1: detected capacity change from 0 to 512 [ 118.258058][ T7038] netlink: 'syz.2.1137': attribute type 1 has an invalid length. [ 118.308290][ T7038] 8021q: adding VLAN 0 to HW filter on device bond4 [ 118.324874][ T7038] veth7: entered promiscuous mode [ 118.334008][ T7038] bond4: (slave veth7): Enslaving as a backup interface with a down link [ 118.357688][ T7039] lo speed is unknown, defaulting to 1000 [ 118.491065][ T7059] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=7059 comm=syz.0.1146 [ 118.518638][ T7060] loop4: detected capacity change from 0 to 1024 [ 118.537452][ T7059] netlink: 232 bytes leftover after parsing attributes in process `syz.0.1146'. [ 118.568590][ T7060] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 118.591116][ T7060] EXT4-fs (loop4): shut down requested (1) [ 118.592888][ T7066] loop1: detected capacity change from 0 to 1024 [ 118.604766][ T7066] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 118.613363][ T7066] EXT4-fs (loop1): filesystem too large to mount safely on this system [ 118.646095][ T7068] loop1: detected capacity change from 0 to 512 [ 118.662479][ T7068] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 118.696305][ T3324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 118.767878][ T7078] loop0: detected capacity change from 0 to 512 [ 118.779830][ T7078] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -13 [ 118.793611][ T7078] EXT4-fs error (device loop0): ext4_orphan_get:1391: inode #13: comm syz.0.1155: iget: bad i_size value: 12154757448730 [ 118.807395][ T7078] EXT4-fs error (device loop0): ext4_orphan_get:1396: comm syz.0.1155: couldn't read orphan inode 13 (err -117) [ 118.837353][ T7078] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 118.897512][ T7088] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1157'. [ 118.928777][ T7090] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7090 comm=syz.1.1158 [ 118.952563][ T7078] IPVS: set_ctl: invalid protocol: 33 100.1.1.2:20004 [ 119.008117][ T3316] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 119.053828][ T7106] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1163'. [ 119.072165][ T7106] loop0: detected capacity change from 0 to 2048 [ 119.094780][ T7106] [EXT4 FS bs=2048, gc=1, bpg=262144, ipg=32, mo=8842c128, mo2=0002] [ 119.104464][ T7111] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 119.120771][ T7102] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1162'. [ 119.130469][ T7112] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1162'. [ 119.140870][ T7106] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 119.158155][ T7102] vlan0: entered promiscuous mode [ 119.163414][ T7102] vlan0: entered allmulticast mode [ 119.168566][ T7102] hsr_slave_1: entered allmulticast mode [ 119.213590][ T3316] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 119.375877][ T7117] loop3: detected capacity change from 0 to 512 [ 119.457217][ T7117] ------------[ cut here ]------------ [ 119.462821][ T7117] EA inode 11 i_nlink=2 [ 119.462834][ T7117] WARNING: fs/ext4/xattr.c:1059 at ext4_xattr_inode_update_ref+0x313/0x350, CPU#1: syz.3.1167/7117 [ 119.477895][ T7117] Modules linked in: [ 119.481857][ T7117] CPU: 1 UID: 0 PID: 7117 Comm: syz.3.1167 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 119.493272][ T7117] Tainted: [W]=WARN [ 119.497112][ T7117] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 119.507216][ T7117] RIP: 0010:ext4_xattr_inode_update_ref+0x332/0x350 [ 119.513969][ T7117] Code: b4 ce 9b ff 4c 8d 2d 1d a7 3f 05 49 8d 7e 40 e8 64 85 b7 ff 49 8b 6e 40 4c 89 e7 e8 98 80 b7 ff 41 8b 56 48 4c 89 ef 48 89 ee <67> 48 0f b9 3a e9 02 ff ff ff e8 7f b8 c5 03 66 66 66 66 66 66 2e [ 119.533752][ T7117] RSP: 0018:ffffc90000e27778 EFLAGS: 00010246 [ 119.539925][ T7117] RAX: ffff88811b480a90 RBX: ffff88811a513af0 RCX: ffffffff81bc6a88 [ 119.547962][ T7117] RDX: 0000000000000002 RSI: 000000000000000b RDI: ffffffff86fc1190 [ 119.556126][ T7117] RBP: 000000000000000b R08: 000188811a513aa3 R09: 0000000000000000 [ 119.564152][ T7117] R10: ffffc90000e276a8 R11: 0001c90000e276a8 R12: ffff88811a513aa0 [ 119.572232][ T7117] R13: ffffffff86fc1190 R14: ffff88811a513a58 R15: 0000000000000001 [ 119.580230][ T7117] FS: 00007f4b0ab176c0(0000) GS:ffff8882aec79000(0000) knlGS:0000000000000000 [ 119.589216][ T7117] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 119.595910][ T7117] CR2: 00007f1f0a8e6d58 CR3: 00000001353fe000 CR4: 00000000003506f0 [ 119.603998][ T7117] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 119.612178][ T7117] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 00000000000f0602 [ 119.620182][ T7117] Call Trace: [ 119.623584][ T7117] [ 119.626556][ T7117] ext4_xattr_inode_dec_ref_all+0x57c/0x880 [ 119.632767][ T7117] ? errseq_check+0x2c/0x50 [ 119.637308][ T7117] ext4_xattr_delete_inode+0x6c1/0x7a0 [ 119.642832][ T7117] ? ext4_truncate+0x92b/0xad0 [ 119.647736][ T7117] ext4_evict_inode+0xa1f/0xd40 [ 119.652692][ T7117] ? __pfx_ext4_evict_inode+0x10/0x10 [ 119.658102][ T7117] evict+0x2af/0x510 [ 119.662080][ T7117] ? __dquot_initialize+0x146/0x7c0 [ 119.667336][ T7117] iput+0x4b9/0x650 [ 119.671177][ T7117] ext4_process_orphan+0x1a9/0x1c0 [ 119.676336][ T7117] ext4_orphan_cleanup+0x6a8/0xa00 [ 119.681490][ T7117] ext4_fill_super+0x3476/0x3800 [ 119.686455][ T7117] ? set_blocksize+0x1a3/0x310 [ 119.691258][ T7117] ? setup_bdev_super+0x30e/0x370 [ 119.696374][ T7117] ? __pfx_ext4_fill_super+0x10/0x10 [ 119.701777][ T7117] get_tree_bdev_flags+0x291/0x300 [ 119.706924][ T7117] ? __pfx_ext4_fill_super+0x10/0x10 [ 119.712328][ T7117] get_tree_bdev+0x1f/0x30 [ 119.716773][ T7117] ext4_get_tree+0x1c/0x30 [ 119.721251][ T7117] vfs_get_tree+0x57/0x1d0 [ 119.725748][ T7117] do_new_mount+0x288/0x700 [ 119.730408][ T7117] path_mount+0x4c0/0xb90 [ 119.734828][ T7117] ? user_path_at+0xbf/0x130 [ 119.739453][ T7117] __se_sys_mount+0x28c/0x2e0 [ 119.744472][ T7117] __x64_sys_mount+0x67/0x80 [ 119.749126][ T7117] x64_sys_call+0x2cca/0x3000 [ 119.753897][ T7117] do_syscall_64+0xc0/0x2a0 [ 119.758443][ T7117] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.764417][ T7117] RIP: 0033:0x7f4b0c0bbf4a [ 119.768878][ T7117] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.788619][ T7117] RSP: 002b:00007f4b0ab16e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 119.797146][ T7117] RAX: ffffffffffffffda RBX: 00007f4b0ab16ee0 RCX: 00007f4b0c0bbf4a [ 119.805266][ T7117] RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007f4b0ab16ea0 [ 119.813309][ T7117] RBP: 0000200000000180 R08: 00007f4b0ab16ee0 R09: 0000000000800718 [ 119.821306][ T7117] R10: 0000000000800718 R11: 0000000000000246 R12: 00002000000001c0 [ 119.829349][ T7117] R13: 00007f4b0ab16ea0 R14: 000000000000047f R15: 0000200000000200 [ 119.837417][ T7117] [ 119.840466][ T7117] ---[ end trace 0000000000000000 ]--- [ 119.861221][ T7117] EXT4-fs (loop3): 1 orphan inode deleted [ 119.869480][ T7143] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 119.882945][ T7117] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 119.899796][ T7143] EXT4-fs (loop2): shut down requested (1) [ 119.936640][ T7147] lo speed is unknown, defaulting to 1000 [ 119.949134][ T3323] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.074698][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.120103][ T7166] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1184'. [ 120.169770][ T7173] serio: Serial port ptm0 [ 120.229377][ T7177] EXT4-fs error (device loop4): ext4_acquire_dquot:6986: comm syz.4.1182: Failed to acquire dquot type 0 [ 120.242225][ T7177] EXT4-fs error (device loop4): mb_free_blocks:2037: group 0, inode 13: block 144:freeing already freed block (bit 9); block bitmap corrupt. [ 120.261485][ T7177] EXT4-fs error (device loop4): ext4_do_update_inode:5617: inode #13: comm syz.4.1182: corrupted inode contents [ 120.292402][ T7177] EXT4-fs error (device loop4): ext4_dirty_inode:6502: inode #13: comm syz.4.1182: mark_inode_dirty error [ 120.332248][ T7177] EXT4-fs error (device loop4): ext4_do_update_inode:5617: inode #13: comm syz.4.1182: corrupted inode contents [ 120.335351][ T7173] serio: Serial port ptm0 [ 120.347413][ T7170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.357459][ T7170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.379465][ T7177] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #13: comm syz.4.1182: mark_inode_dirty error [ 120.392895][ T7177] EXT4-fs error (device loop4): ext4_do_update_inode:5617: inode #13: comm syz.4.1182: corrupted inode contents [ 120.405335][ T7177] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 120.429825][ T7177] EXT4-fs error (device loop4): ext4_do_update_inode:5617: inode #13: comm syz.4.1182: corrupted inode contents [ 120.448668][ T7177] EXT4-fs error (device loop4): ext4_truncate:4635: inode #13: comm syz.4.1182: mark_inode_dirty error [ 120.480385][ T7177] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 120.500438][ T7177] EXT4-fs (loop4): 1 truncate cleaned up [ 120.517376][ T7177] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 120.556182][ T7177] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.824035][ T7198] ext4 filesystem being mounted at /212/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 121.064334][ T7226] bond5: option tlb_dynamic_lb: invalid value (2) [ 121.078432][ T7226] bond5 (unregistering): Released all slaves [ 121.111999][ T7230] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 121.603854][ T7260] set_capacity_and_notify: 4 callbacks suppressed [ 121.603913][ T7260] loop3: detected capacity change from 0 to 128 [ 121.618949][ T7260] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem [ 121.673781][ T7263] lo speed is unknown, defaulting to 1000 [ 121.717828][ T7260] ext2 filesystem being mounted at /245/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 121.930443][ T7272] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=7272 comm=syz.0.1218 [ 121.972806][ T7272] __nla_validate_parse: 2 callbacks suppressed [ 121.972822][ T7272] netlink: 232 bytes leftover after parsing attributes in process `syz.0.1218'. [ 122.033861][ T7276] FAULT_INJECTION: forcing a failure. [ 122.033861][ T7276] name failslab, interval 1, probability 0, space 0, times 0 [ 122.046740][ T7276] CPU: 0 UID: 0 PID: 7276 Comm: syz.3.1219 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 122.046770][ T7276] Tainted: [W]=WARN [ 122.046778][ T7276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 122.046861][ T7276] Call Trace: [ 122.046869][ T7276] [ 122.046876][ T7276] __dump_stack+0x1d/0x30 [ 122.046899][ T7276] dump_stack_lvl+0x95/0xd0 [ 122.046939][ T7276] dump_stack+0x15/0x1b [ 122.046956][ T7276] should_fail_ex+0x263/0x280 [ 122.046980][ T7276] should_failslab+0x8c/0xb0 [ 122.047055][ T7276] kmem_cache_alloc_node_noprof+0x6a/0x4a0 [ 122.047081][ T7276] ? __alloc_skb+0x2f0/0x4b0 [ 122.047172][ T7276] __alloc_skb+0x2f0/0x4b0 [ 122.047199][ T7276] ? __alloc_skb+0x219/0x4b0 [ 122.047225][ T7276] netlink_alloc_large_skb+0xbf/0xf0 [ 122.047317][ T7276] netlink_sendmsg+0x40c/0x6f0 [ 122.047343][ T7276] ? __pfx_netlink_sendmsg+0x10/0x10 [ 122.047367][ T7276] __sock_sendmsg+0x145/0x170 [ 122.047395][ T7276] ____sys_sendmsg+0x31e/0x4a0 [ 122.047497][ T7276] ___sys_sendmsg+0x195/0x1e0 [ 122.047556][ T7276] __x64_sys_sendmsg+0xd4/0x160 [ 122.047667][ T7276] x64_sys_call+0x17ba/0x3000 [ 122.047694][ T7276] do_syscall_64+0xc0/0x2a0 [ 122.047722][ T7276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.047745][ T7276] RIP: 0033:0x7f4b0c0bacb9 [ 122.047764][ T7276] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.047784][ T7276] RSP: 002b:00007f4b0ab17028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 122.047804][ T7276] RAX: ffffffffffffffda RBX: 00007f4b0c335fa0 RCX: 00007f4b0c0bacb9 [ 122.047838][ T7276] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 122.047854][ T7276] RBP: 00007f4b0ab17090 R08: 0000000000000000 R09: 0000000000000000 [ 122.047869][ T7276] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 122.047884][ T7276] R13: 00007f4b0c336038 R14: 00007f4b0c335fa0 R15: 00007ffe1d14c298 [ 122.047908][ T7276] [ 122.336480][ T7291] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 122.359846][ T7291] SET target dimension over the limit! [ 122.406339][ T7301] unsupported nlmsg_type 40 [ 122.440168][ T7305] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1226'. [ 122.450039][ T7305] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1226'. [ 122.772946][ T29] kauditd_printk_skb: 227 callbacks suppressed [ 122.772966][ T29] audit: type=1400 audit(1768826617.988:13596): avc: denied { mounton } for pid=7332 comm="syz.3.1239" path="/syzcgroup/unified/syz3" dev="cgroup2" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 122.803795][ T29] audit: type=1400 audit(1768826617.988:13597): avc: denied { mount } for pid=7332 comm="syz.3.1239" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 122.877722][ T29] audit: type=1400 audit(1768826618.088:13598): avc: denied { mount } for pid=7344 comm="syz.1.1243" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 122.923641][ T29] audit: type=1400 audit(1768826618.088:13599): avc: denied { read } for pid=7344 comm="syz.1.1243" name="usbmon9" dev="devtmpfs" ino=169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 122.947881][ T29] audit: type=1400 audit(1768826618.088:13600): avc: denied { open } for pid=7344 comm="syz.1.1243" path="/dev/usbmon9" dev="devtmpfs" ino=169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 122.972717][ T29] audit: type=1400 audit(1768826618.088:13601): avc: denied { create } for pid=7346 comm="syz.2.1245" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 122.994204][ T29] audit: type=1400 audit(1768826618.088:13602): avc: denied { write } for pid=7346 comm="syz.2.1245" name="file0" dev="tmpfs" ino=1182 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 123.017554][ T29] audit: type=1400 audit(1768826618.088:13603): avc: denied { open } for pid=7346 comm="syz.2.1245" path="/218/file0" dev="tmpfs" ino=1182 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 123.041235][ T29] audit: type=1400 audit(1768826618.088:13604): avc: denied { ioctl } for pid=7346 comm="syz.2.1245" path="/218/file0" dev="tmpfs" ino=1182 ioctlcmd=0x70c8 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 123.066240][ T29] audit: type=1400 audit(1768826618.118:13605): avc: denied { map } for pid=7344 comm="syz.1.1243" path="/dev/usbmon9" dev="devtmpfs" ino=169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 123.196135][ T7364] loop1: detected capacity change from 0 to 512 [ 123.232377][ T7364] EXT4-fs (loop1): filesystem is read-only [ 123.248702][ T7364] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 123.279670][ T7364] EXT4-fs (loop1): filesystem is read-only [ 123.286359][ T7364] EXT4-fs (loop1): orphan cleanup on readonly fs [ 123.293129][ T7364] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.1251: bg 0: block 64: padding at end of block bitmap is not set [ 123.311575][ T7364] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6689: Corrupt filesystem [ 123.320583][ T7364] EXT4-fs (loop1): 1 orphan inode deleted [ 123.331456][ T7367] ipip0: entered promiscuous mode [ 123.343725][ T7367] loop2: detected capacity change from 0 to 512 [ 123.350766][ T7367] EXT4-fs: Ignoring removed bh option [ 123.356909][ T7367] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 123.368946][ T7367] EXT4-fs (loop2): 1 truncate cleaned up [ 123.470649][ T7375] loop2: detected capacity change from 0 to 512 [ 123.502140][ T7375] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 123.522597][ T7375] EXT4-fs (loop2): 1 truncate cleaned up [ 123.606457][ T7389] loop1: detected capacity change from 0 to 512 [ 123.649803][ T7394] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=7394 comm=syz.0.1260 [ 123.674028][ T7389] EXT4-fs (loop1): filesystem is read-only [ 123.700446][ T7389] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 123.752723][ T7389] EXT4-fs (loop1): filesystem is read-only [ 123.758604][ T7389] EXT4-fs (loop1): orphan cleanup on readonly fs [ 123.797775][ T7389] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.1261: bg 0: block 64: padding at end of block bitmap is not set [ 123.835251][ T7389] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6689: Corrupt filesystem [ 123.859451][ T7389] EXT4-fs (loop1): 1 orphan inode deleted [ 123.875467][ T7389] FAULT_INJECTION: forcing a failure. [ 123.875467][ T7389] name failslab, interval 1, probability 0, space 0, times 0 [ 123.888268][ T7389] CPU: 1 UID: 0 PID: 7389 Comm: syz.1.1261 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 123.888316][ T7389] Tainted: [W]=WARN [ 123.888352][ T7389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 123.888364][ T7389] Call Trace: [ 123.888373][ T7389] [ 123.888382][ T7389] __dump_stack+0x1d/0x30 [ 123.888434][ T7389] dump_stack_lvl+0x95/0xd0 [ 123.888558][ T7389] dump_stack+0x15/0x1b [ 123.888582][ T7389] should_fail_ex+0x263/0x280 [ 123.888678][ T7389] should_failslab+0x8c/0xb0 [ 123.888700][ T7389] kmem_cache_alloc_noprof+0x68/0x490 [ 123.888761][ T7389] ? getname_kernel+0x3c/0x1f0 [ 123.888788][ T7389] getname_kernel+0x3c/0x1f0 [ 123.888819][ T7389] kern_path+0x23/0x130 [ 123.888915][ T7389] autofs_dev_ioctl_ismountpoint+0x163/0x4e0 [ 123.888945][ T7389] ? __pfx_autofs_dev_ioctl_ismountpoint+0x10/0x10 [ 123.888970][ T7389] ? __pfx_autofs_dev_ioctl_ismountpoint+0x10/0x10 [ 123.889008][ T7389] autofs_dev_ioctl+0x35c/0x6a0 [ 123.889033][ T7389] ? __pfx_autofs_dev_ioctl+0x10/0x10 [ 123.889088][ T7389] __se_sys_ioctl+0xce/0x140 [ 123.889127][ T7389] __x64_sys_ioctl+0x43/0x50 [ 123.889223][ T7389] x64_sys_call+0x14b0/0x3000 [ 123.889322][ T7389] do_syscall_64+0xc0/0x2a0 [ 123.889349][ T7389] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.889377][ T7389] RIP: 0033:0x7f5ce1fbacb9 [ 123.889398][ T7389] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.889447][ T7389] RSP: 002b:00007f5ce0a17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 123.889473][ T7389] RAX: ffffffffffffffda RBX: 00007f5ce2235fa0 RCX: 00007f5ce1fbacb9 [ 123.889487][ T7389] RDX: 0000200000000200 RSI: 00000000c018937e RDI: 0000000000000004 [ 123.889499][ T7389] RBP: 00007f5ce0a17090 R08: 0000000000000000 R09: 0000000000000000 [ 123.889513][ T7389] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 123.889594][ T7389] R13: 00007f5ce2236038 R14: 00007f5ce2235fa0 R15: 00007fff1af688a8 [ 123.889613][ T7389] [ 124.139496][ T7401] erspan1: entered promiscuous mode [ 124.275550][ T7408] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1267'. [ 124.298607][ T7410] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1268'. [ 124.318277][ T7408] bridge_slave_1: left allmulticast mode [ 124.324094][ T7408] bridge_slave_1: left promiscuous mode [ 124.329825][ T7408] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.340078][ T7408] bridge_slave_0: left allmulticast mode [ 124.345850][ T7408] bridge_slave_0: left promiscuous mode [ 124.351597][ T7408] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.412074][ T7416] loop4: detected capacity change from 0 to 512 [ 124.455720][ T7416] EXT4-fs error (device loop4): ext4_orphan_get:1391: inode #15: comm syz.4.1267: inode has both inline data and extents flags [ 124.508168][ T7416] EXT4-fs error (device loop4): ext4_orphan_get:1396: comm syz.4.1267: couldn't read orphan inode 15 (err -117) [ 124.523920][ T7427] loop0: detected capacity change from 0 to 512 [ 124.551286][ T7427] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 124.559341][ T7427] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=c000e118, mo2=0002] [ 124.585762][ T7427] EXT4-fs (loop0): orphan cleanup on readonly fs [ 124.592467][ T7427] EXT4-fs warning (device loop0): ext4_enable_quotas:7221: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 124.607761][ T7427] EXT4-fs (loop0): Cannot turn on quotas: error -22 [ 124.631161][ T7427] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.1274: bg 0: block 40: padding at end of block bitmap is not set [ 124.646519][ T7427] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6689: Corrupt filesystem [ 124.656416][ T7427] EXT4-fs (loop0): 1 truncate cleaned up [ 124.994126][ T7438] macvlan2: entered promiscuous mode [ 125.030514][ T7440] loop3: detected capacity change from 0 to 512 [ 125.042312][ T7440] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 125.059189][ T7440] EXT4-fs (loop3): 1 truncate cleaned up [ 125.066643][ T7440] EXT4-fs warning (device loop3): ext4_group_add:1736: No reserved GDT blocks, can't resize [ 125.292895][ T7454] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1282'. [ 125.323567][ T7457] loop4: detected capacity change from 0 to 2048 [ 125.345931][ T7459] FAULT_INJECTION: forcing a failure. [ 125.345931][ T7459] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 125.359176][ T7459] CPU: 1 UID: 0 PID: 7459 Comm: syz.1.1283 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 125.359284][ T7459] Tainted: [W]=WARN [ 125.359293][ T7459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 125.359310][ T7459] Call Trace: [ 125.359318][ T7459] [ 125.359399][ T7459] __dump_stack+0x1d/0x30 [ 125.359442][ T7459] dump_stack_lvl+0x95/0xd0 [ 125.359514][ T7459] dump_stack+0x15/0x1b [ 125.359539][ T7459] should_fail_ex+0x263/0x280 [ 125.359569][ T7459] should_fail+0xb/0x20 [ 125.359645][ T7459] should_fail_usercopy+0x1a/0x20 [ 125.359674][ T7459] _copy_from_user+0x1c/0xb0 [ 125.359707][ T7459] ___sys_sendmsg+0xc1/0x1e0 [ 125.359760][ T7459] __x64_sys_sendmsg+0xd4/0x160 [ 125.359842][ T7459] x64_sys_call+0x17ba/0x3000 [ 125.359934][ T7459] do_syscall_64+0xc0/0x2a0 [ 125.359961][ T7459] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.360043][ T7459] RIP: 0033:0x7f5ce1fbacb9 [ 125.360063][ T7459] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.360084][ T7459] RSP: 002b:00007f5ce0a17028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 125.360103][ T7459] RAX: ffffffffffffffda RBX: 00007f5ce2235fa0 RCX: 00007f5ce1fbacb9 [ 125.360192][ T7459] RDX: 0000000000000004 RSI: 0000200000000380 RDI: 0000000000000005 [ 125.360208][ T7459] RBP: 00007f5ce0a17090 R08: 0000000000000000 R09: 0000000000000000 [ 125.360220][ T7459] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.360286][ T7459] R13: 00007f5ce2236038 R14: 00007f5ce2235fa0 R15: 00007fff1af688a8 [ 125.360308][ T7459] [ 125.601580][ T7471] loop1: detected capacity change from 0 to 512 [ 125.612996][ T7471] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 125.666525][ T7471] EXT4-fs (loop1): 1 truncate cleaned up [ 125.680458][ T7478] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=7478 comm=syz.3.1291 [ 125.752469][ T7478] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1291'. [ 125.774187][ T7478] netlink: 232 bytes leftover after parsing attributes in process `syz.3.1291'. [ 125.992585][ T7506] lo speed is unknown, defaulting to 1000 [ 126.364650][ T7520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1305'. [ 126.373713][ T7520] validate_nla: 8 callbacks suppressed [ 126.373729][ T7520] netlink: 'syz.1.1305': attribute type 30 has an invalid length. [ 126.396321][ T4763] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 126.405899][ T4763] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 126.465788][ T4763] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 126.475571][ T4763] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 126.595966][ T7536] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 126.632505][ T7541] set_capacity_and_notify: 3 callbacks suppressed [ 126.632523][ T7541] loop4: detected capacity change from 0 to 1024 [ 126.725030][ T7541] EXT4-fs: Ignoring removed nobh option [ 126.754183][ T7541] EXT4-fs: inline encryption not supported [ 126.776414][ T7546] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=7546 comm=syz.2.1314 [ 126.854813][ T7546] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1314'. [ 126.864282][ T7541] delete_channel: no stack [ 126.868822][ T7541] delete_channel: no stack [ 126.953114][ T7556] batadv2: entered promiscuous mode [ 127.015674][ T7556] batadv2: entered promiscuous mode [ 127.023811][ T7564] __nla_validate_parse: 1 callbacks suppressed [ 127.023847][ T7564] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1321'. [ 127.058840][ T7562] loop4: detected capacity change from 0 to 8192 [ 127.092196][ T7556] debugfs: 'netdev@ffff88811d936558' already exists in 'ref_tracker' [ 127.118150][ T7556] batadv2: entered promiscuous mode [ 127.171585][ T7571] tmpfs: Bad value for 'mpol' [ 127.210489][ T7579] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=7579 comm=syz.2.1328 [ 127.226941][ T7556] batadv2: entered promiscuous mode [ 127.233918][ T7579] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1328'. [ 127.252992][ T7579] netlink: 232 bytes leftover after parsing attributes in process `syz.2.1328'. [ 127.294169][ T7586] netlink: 71 bytes leftover after parsing attributes in process `syz.2.1331'. [ 127.368534][ T7589] loop3: detected capacity change from 0 to 8192 [ 127.376991][ T7556] batadv2: entered promiscuous mode [ 127.399338][ T7595] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1335'. [ 127.408437][ T7595] netlink: 'syz.4.1335': attribute type 30 has an invalid length. [ 127.437382][ T6155] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 127.452886][ T6155] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 127.464509][ T6155] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 127.476969][ T7556] batadv2: entered promiscuous mode [ 127.487698][ T6155] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 127.526143][ T7604] netlink: 7 bytes leftover after parsing attributes in process `syz.3.1339'. [ 127.537485][ T7604] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1339'. [ 127.546566][ T7604] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1339'. [ 127.557209][ T7556] batadv2: entered promiscuous mode [ 127.584008][ T7608] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1340'. [ 127.592368][ T7612] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1341'. [ 127.611931][ T7609] loop1: detected capacity change from 0 to 512 [ 127.627416][ T7609] ext4: Unknown parameter '€' [ 127.645177][ T7605] syzkaller0: entered promiscuous mode [ 127.650722][ T7605] syzkaller0: entered allmulticast mode [ 127.675372][ T7556] batadv2: entered promiscuous mode [ 127.705243][ T7617] loop4: detected capacity change from 0 to 2048 [ 127.725752][ T7617] EXT4-fs (loop4): blocks per group (4278386688) and clusters per group (16384) inconsistent [ 127.736781][ T7619] loop3: detected capacity change from 0 to 512 [ 127.748741][ T7619] EXT4-fs (loop3): ext4_check_descriptors: Inode table for group 0 overlaps block group descriptors [ 127.759644][ T7619] EXT4-fs (loop3): ext4_check_descriptors: Inode table for group 0 not in group (block 2)! [ 127.769711][ T7619] EXT4-fs (loop3): group descriptors corrupted! [ 127.845775][ T7624] loop4: detected capacity change from 0 to 512 [ 127.888336][ T7624] EXT4-fs: Ignoring removed mblk_io_submit option [ 127.889356][ T7634] loop1: detected capacity change from 0 to 128 [ 127.904628][ T7632] 8021q: adding VLAN 0 to HW filter on device bond6 [ 127.914621][ T7624] ext4: Unknown parameter 'fowner<18446744073709551615' [ 127.934254][ T7634] ext4 filesystem being mounted at /282/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 127.977837][ T7640] SET target dimension over the limit! [ 128.012683][ T29] kauditd_printk_skb: 134 callbacks suppressed [ 128.012758][ T29] audit: type=1400 audit(1768826623.228:13739): avc: denied { load_policy } for pid=7643 comm="syz.0.1352" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 128.040123][ T7644] SELinux: policydb table sizes (0,0) do not match mine (8,7) [ 128.060130][ T7644] SELinux: failed to load policy [ 128.084921][ T29] audit: type=1326 audit(1768826623.288:13740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7649 comm="syz.1.1356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 128.108532][ T29] audit: type=1326 audit(1768826623.288:13741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7649 comm="syz.1.1356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 128.132157][ T29] audit: type=1326 audit(1768826623.288:13742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7649 comm="syz.1.1356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f5ce1fb9b97 code=0x7ffc0000 [ 128.156102][ T29] audit: type=1326 audit(1768826623.288:13743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7649 comm="syz.1.1356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 128.179741][ T29] audit: type=1326 audit(1768826623.288:13744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7649 comm="syz.1.1356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 128.223901][ T29] audit: type=1326 audit(1768826623.288:13745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7649 comm="syz.1.1356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 128.247552][ T29] audit: type=1326 audit(1768826623.298:13746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7649 comm="syz.1.1356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 128.271186][ T29] audit: type=1326 audit(1768826623.298:13747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7649 comm="syz.1.1356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 128.295058][ T29] audit: type=1326 audit(1768826623.298:13748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7649 comm="syz.1.1356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 128.339402][ T7659] FAULT_INJECTION: forcing a failure. [ 128.339402][ T7659] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 128.353245][ T7659] CPU: 0 UID: 0 PID: 7659 Comm: syz.2.1359 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 128.353350][ T7659] Tainted: [W]=WARN [ 128.353358][ T7659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 128.353371][ T7659] Call Trace: [ 128.353379][ T7659] [ 128.353388][ T7659] __dump_stack+0x1d/0x30 [ 128.353418][ T7659] dump_stack_lvl+0x95/0xd0 [ 128.353444][ T7659] dump_stack+0x15/0x1b [ 128.353541][ T7659] should_fail_ex+0x263/0x280 [ 128.353570][ T7659] should_fail+0xb/0x20 [ 128.353592][ T7659] should_fail_usercopy+0x1a/0x20 [ 128.353674][ T7659] _copy_to_user+0x20/0xa0 [ 128.353710][ T7659] simple_read_from_buffer+0xb5/0x130 [ 128.353823][ T7659] proc_fail_nth_read+0x10e/0x150 [ 128.353856][ T7659] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 128.353882][ T7659] vfs_read+0x1ab/0x7f0 [ 128.353973][ T7659] ? __schedule+0x82d/0xc90 [ 128.354003][ T7659] ? __rcu_read_unlock+0x4e/0x70 [ 128.354026][ T7659] ? __fget_files+0x184/0x1c0 [ 128.354051][ T7659] ? mutex_lock+0x57/0x90 [ 128.354106][ T7659] ksys_read+0xdc/0x1a0 [ 128.354129][ T7659] __x64_sys_read+0x40/0x50 [ 128.354213][ T7659] x64_sys_call+0x2889/0x3000 [ 128.354246][ T7659] do_syscall_64+0xc0/0x2a0 [ 128.354273][ T7659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.354371][ T7659] RIP: 0033:0x7f4f4154b58e [ 128.354386][ T7659] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 128.354418][ T7659] RSP: 002b:00007f4f3ffe6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 128.354450][ T7659] RAX: ffffffffffffffda RBX: 00007f4f3ffe76c0 RCX: 00007f4f4154b58e [ 128.354465][ T7659] RDX: 000000000000000f RSI: 00007f4f3ffe70a0 RDI: 0000000000000005 [ 128.354477][ T7659] RBP: 00007f4f3ffe7090 R08: 0000000000000000 R09: 0000000000000000 [ 128.354489][ T7659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 128.354525][ T7659] R13: 00007f4f41806038 R14: 00007f4f41805fa0 R15: 00007ffd44e80588 [ 128.354549][ T7659] [ 128.354598][ T7650] hsr_slave_1 (unregistering): left promiscuous mode [ 128.460244][ T7662] netlink: 'syz.4.1362': attribute type 5 has an invalid length. [ 128.647053][ T7668] netlink: 'syz.2.1364': attribute type 30 has an invalid length. [ 128.697514][ T7670] SET target dimension over the limit! [ 128.827518][ T7686] lo speed is unknown, defaulting to 1000 [ 128.870638][ T7693] loop1: detected capacity change from 0 to 512 [ 128.996546][ T7710] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 129.037008][ T7713] loop3: detected capacity change from 0 to 512 [ 129.038113][ T7711] FAULT_INJECTION: forcing a failure. [ 129.038113][ T7711] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 129.056467][ T7711] CPU: 1 UID: 0 PID: 7711 Comm: syz.0.1377 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 129.056514][ T7711] Tainted: [W]=WARN [ 129.056522][ T7711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 129.056562][ T7711] Call Trace: [ 129.056570][ T7711] [ 129.056579][ T7711] __dump_stack+0x1d/0x30 [ 129.056604][ T7711] dump_stack_lvl+0x95/0xd0 [ 129.056629][ T7711] dump_stack+0x15/0x1b [ 129.056648][ T7711] should_fail_ex+0x263/0x280 [ 129.056676][ T7711] should_fail+0xb/0x20 [ 129.056695][ T7711] should_fail_usercopy+0x1a/0x20 [ 129.056792][ T7711] _copy_to_user+0x20/0xa0 [ 129.056828][ T7711] simple_read_from_buffer+0xb5/0x130 [ 129.056918][ T7711] proc_fail_nth_read+0x10e/0x150 [ 129.057030][ T7711] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 129.057082][ T7711] vfs_read+0x1ab/0x7f0 [ 129.057116][ T7711] ? __rcu_read_unlock+0x4e/0x70 [ 129.057136][ T7711] ? __fget_files+0x184/0x1c0 [ 129.057173][ T7711] ? mutex_lock+0x57/0x90 [ 129.057211][ T7711] ksys_read+0xdc/0x1a0 [ 129.057262][ T7711] __x64_sys_read+0x40/0x50 [ 129.057280][ T7711] x64_sys_call+0x2889/0x3000 [ 129.057317][ T7711] do_syscall_64+0xc0/0x2a0 [ 129.057340][ T7711] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.057361][ T7711] RIP: 0033:0x7fc47f12b58e [ 129.057378][ T7711] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 129.057529][ T7711] RSP: 002b:00007fc47dba5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 129.057555][ T7711] RAX: ffffffffffffffda RBX: 00007fc47dba66c0 RCX: 00007fc47f12b58e [ 129.057569][ T7711] RDX: 000000000000000f RSI: 00007fc47dba60a0 RDI: 0000000000000007 [ 129.057585][ T7711] RBP: 00007fc47dba6090 R08: 0000000000000000 R09: 0000000000000000 [ 129.057669][ T7711] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 129.057685][ T7711] R13: 00007fc47f3e6128 R14: 00007fc47f3e6090 R15: 00007ffdcdfda0a8 [ 129.057710][ T7711] [ 129.276404][ T7715] bridge7: entered promiscuous mode [ 129.281768][ T7715] bridge7: entered allmulticast mode [ 129.337060][ T7713] ext4 filesystem being mounted at /281/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 129.479210][ T7728] FAULT_INJECTION: forcing a failure. [ 129.479210][ T7728] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 129.493142][ T7728] CPU: 0 UID: 0 PID: 7728 Comm: syz.0.1385 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 129.493178][ T7728] Tainted: [W]=WARN [ 129.493198][ T7728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 129.493213][ T7728] Call Trace: [ 129.493221][ T7728] [ 129.493247][ T7728] __dump_stack+0x1d/0x30 [ 129.493275][ T7728] dump_stack_lvl+0x95/0xd0 [ 129.493377][ T7728] dump_stack+0x15/0x1b [ 129.493409][ T7728] should_fail_ex+0x263/0x280 [ 129.493437][ T7728] should_fail+0xb/0x20 [ 129.493460][ T7728] should_fail_usercopy+0x1a/0x20 [ 129.493513][ T7728] _copy_from_user+0x1c/0xb0 [ 129.493547][ T7728] restore_altstack+0x4b/0x300 [ 129.493565][ T7728] ? __set_task_blocked+0x238/0x290 [ 129.493635][ T7728] __ia32_sys_rt_sigreturn+0xdb/0x350 [ 129.493661][ T7728] ? arch_do_signal_or_restart+0x2c2/0x450 [ 129.493738][ T7728] ? __secure_computing+0x81/0x150 [ 129.493768][ T7728] x64_sys_call+0x274a/0x3000 [ 129.493791][ T7728] do_syscall_64+0xc0/0x2a0 [ 129.493833][ T7728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.493853][ T7728] RIP: 0033:0x7fc47f10c0d9 [ 129.493868][ T7728] Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25 [ 129.493889][ T7728] RSP: 002b:00007fc47dbc6a80 EFLAGS: 00000202 ORIG_RAX: 000000000000000f [ 129.493912][ T7728] RAX: ffffffffffffffda RBX: 00007fc47f3e5fa0 RCX: 00007fc47f10c0d9 [ 129.493947][ T7728] RDX: 00007fc47dbc6a80 RSI: 00007fc47dbc6bb0 RDI: 0000000000000021 [ 129.493962][ T7728] RBP: 00007fc47dbc7090 R08: 0000000000000000 R09: 0000000000000000 [ 129.493977][ T7728] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002 [ 129.493991][ T7728] R13: 00007fc47f3e6038 R14: 00007fc47f3e5fa0 R15: 00007ffdcdfda0a8 [ 129.494020][ T7728] [ 129.753887][ T7736] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=8856c01c, mo2=0002] [ 129.763960][ T7736] EXT4-fs (loop2): orphan cleanup on readonly fs [ 129.770764][ T7736] EXT4-fs warning (device loop2): ext4_enable_quotas:7221: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 129.787529][ T7736] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 129.794739][ T7736] EXT4-fs error (device loop2): ext4_ext_check_inode:523: inode #13: comm syz.2.1389: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 129.813922][ T7736] EXT4-fs error (device loop2): ext4_orphan_get:1396: comm syz.2.1389: couldn't read orphan inode 13 (err -117) [ 129.993768][ T7756] bridge5: entered promiscuous mode [ 129.999086][ T7756] bridge5: entered allmulticast mode [ 130.052135][ T7756] team0: Port device bridge5 added [ 130.058977][ T7762] bridge0: port 3(team0) entered blocking state [ 130.065471][ T7762] bridge0: port 3(team0) entered disabled state [ 130.073411][ T7753] FAULT_INJECTION: forcing a failure. [ 130.073411][ T7753] name failslab, interval 1, probability 0, space 0, times 0 [ 130.086095][ T7753] CPU: 0 UID: 0 PID: 7753 Comm: syz.4.1395 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 130.086197][ T7753] Tainted: [W]=WARN [ 130.086216][ T7753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 130.086229][ T7753] Call Trace: [ 130.086235][ T7753] [ 130.086242][ T7753] __dump_stack+0x1d/0x30 [ 130.086267][ T7753] dump_stack_lvl+0x95/0xd0 [ 130.086288][ T7753] dump_stack+0x15/0x1b [ 130.086307][ T7753] should_fail_ex+0x263/0x280 [ 130.086366][ T7753] should_failslab+0x8c/0xb0 [ 130.086390][ T7753] kmem_cache_alloc_node_noprof+0x6a/0x4a0 [ 130.086458][ T7753] ? __alloc_skb+0x2f0/0x4b0 [ 130.086519][ T7753] __alloc_skb+0x2f0/0x4b0 [ 130.086615][ T7753] ? __alloc_skb+0x219/0x4b0 [ 130.086642][ T7753] netlink_alloc_large_skb+0xbf/0xf0 [ 130.086679][ T7753] netlink_sendmsg+0x40c/0x6f0 [ 130.086704][ T7753] ? __pfx_netlink_sendmsg+0x10/0x10 [ 130.086727][ T7753] __sock_sendmsg+0x145/0x170 [ 130.086858][ T7753] ____sys_sendmsg+0x31e/0x4a0 [ 130.086981][ T7753] ___sys_sendmsg+0x195/0x1e0 [ 130.087028][ T7753] __x64_sys_sendmsg+0xd4/0x160 [ 130.087105][ T7753] x64_sys_call+0x17ba/0x3000 [ 130.087213][ T7753] do_syscall_64+0xc0/0x2a0 [ 130.087240][ T7753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.087267][ T7753] RIP: 0033:0x7f1f0beaacb9 [ 130.087350][ T7753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.087371][ T7753] RSP: 002b:00007f1f0a907028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 130.087394][ T7753] RAX: ffffffffffffffda RBX: 00007f1f0c125fa0 RCX: 00007f1f0beaacb9 [ 130.087417][ T7753] RDX: 0000000000000880 RSI: 0000200000000500 RDI: 0000000000000007 [ 130.087495][ T7753] RBP: 00007f1f0a907090 R08: 0000000000000000 R09: 0000000000000000 [ 130.087511][ T7753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 130.087526][ T7753] R13: 00007f1f0c126038 R14: 00007f1f0c125fa0 R15: 00007ffdfb067c78 [ 130.087546][ T7753] [ 130.154809][ T7762] team0: entered allmulticast mode [ 130.296366][ T7762] team_slave_0: entered allmulticast mode [ 130.302141][ T7762] team_slave_1: entered allmulticast mode [ 130.309294][ T7762] team0: entered promiscuous mode [ 130.314393][ T7762] team_slave_0: entered promiscuous mode [ 130.320098][ T7762] team_slave_1: entered promiscuous mode [ 130.326640][ T7762] bridge0: port 3(team0) entered blocking state [ 130.332965][ T7762] bridge0: port 3(team0) entered forwarding state [ 130.395776][ T7767] FAULT_INJECTION: forcing a failure. [ 130.395776][ T7767] name failslab, interval 1, probability 0, space 0, times 0 [ 130.408644][ T7767] CPU: 0 UID: 0 PID: 7767 Comm: syz.4.1399 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 130.408683][ T7767] Tainted: [W]=WARN [ 130.408739][ T7767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 130.408751][ T7767] Call Trace: [ 130.408759][ T7767] [ 130.408767][ T7767] __dump_stack+0x1d/0x30 [ 130.408795][ T7767] dump_stack_lvl+0x95/0xd0 [ 130.408822][ T7767] dump_stack+0x15/0x1b [ 130.408902][ T7767] should_fail_ex+0x263/0x280 [ 130.408949][ T7767] should_failslab+0x8c/0xb0 [ 130.408978][ T7767] __kmalloc_cache_noprof+0x64/0x4a0 [ 130.409118][ T7767] ? rtnl_newlink+0x5c/0x1370 [ 130.409139][ T7767] ? __pfx_rtnl_newlink+0x10/0x10 [ 130.409159][ T7767] rtnl_newlink+0x5c/0x1370 [ 130.409192][ T7767] ? should_fail_ex+0xd9/0x280 [ 130.409307][ T7767] ? __rcu_read_unlock+0x33/0x70 [ 130.409332][ T7767] ? sock_def_readable+0xaf/0x190 [ 130.409358][ T7767] ? __rcu_read_unlock+0x4e/0x70 [ 130.409444][ T7767] ? avc_has_perm_noaudit+0xab/0x130 [ 130.409466][ T7767] ? cred_has_capability+0x224/0x290 [ 130.409506][ T7767] ? selinux_capable+0x31/0x40 [ 130.409535][ T7767] ? security_capable+0x7b/0x90 [ 130.409567][ T7767] ? ns_capable+0x7c/0xb0 [ 130.409596][ T7767] ? __pfx_rtnl_newlink+0x10/0x10 [ 130.409662][ T7767] rtnetlink_rcv_msg+0x64b/0x720 [ 130.409754][ T7767] netlink_rcv_skb+0x123/0x220 [ 130.409795][ T7767] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 130.409826][ T7767] rtnetlink_rcv+0x1c/0x30 [ 130.409918][ T7767] netlink_unicast+0x5c0/0x690 [ 130.409956][ T7767] netlink_sendmsg+0x5c8/0x6f0 [ 130.410057][ T7767] ? __pfx_netlink_sendmsg+0x10/0x10 [ 130.410077][ T7767] __sock_sendmsg+0x145/0x170 [ 130.410103][ T7767] ____sys_sendmsg+0x31e/0x4a0 [ 130.410160][ T7767] ___sys_sendmsg+0x195/0x1e0 [ 130.410207][ T7767] __x64_sys_sendmsg+0xd4/0x160 [ 130.410241][ T7767] x64_sys_call+0x17ba/0x3000 [ 130.410342][ T7767] do_syscall_64+0xc0/0x2a0 [ 130.410413][ T7767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.410435][ T7767] RIP: 0033:0x7f1f0beaacb9 [ 130.410450][ T7767] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.410471][ T7767] RSP: 002b:00007f1f0a907028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 130.410496][ T7767] RAX: ffffffffffffffda RBX: 00007f1f0c125fa0 RCX: 00007f1f0beaacb9 [ 130.410514][ T7767] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000004 [ 130.410566][ T7767] RBP: 00007f1f0a907090 R08: 0000000000000000 R09: 0000000000000000 [ 130.410599][ T7767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 130.410687][ T7767] R13: 00007f1f0c126038 R14: 00007f1f0c125fa0 R15: 00007ffdfb067c78 [ 130.410708][ T7767] [ 130.692553][ T3323] EXT4-fs unmount: 31 callbacks suppressed [ 130.692572][ T3323] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 130.712678][ T7768] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=7768 comm=syz.0.1400 [ 130.947265][ T7749] lo speed is unknown, defaulting to 1000 [ 131.199147][ T7791] EXT4-fs: Ignoring removed bh option [ 131.235974][ T7791] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 131.280881][ T7791] EXT4-fs (loop0): 1 truncate cleaned up [ 131.292660][ T7791] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 131.392940][ T7811] rock: corrupted directory entry. extent=32, offset=2044, size=237 [ 131.410728][ T7784] lo speed is unknown, defaulting to 1000 [ 131.491777][ T7797] openvswitch: netlink: ufid size 36 bytes exceeds the range (1, 16) [ 131.501551][ T7797] openvswitch: netlink: Message has 4 unknown bytes. [ 131.509856][ T3316] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 131.664699][ T7784] chnl_net:caif_netlink_parms(): no params data found [ 131.693400][ T7831] SET target dimension over the limit! [ 131.715374][ T7831] set_capacity_and_notify: 3 callbacks suppressed [ 131.715392][ T7831] loop4: detected capacity change from 0 to 512 [ 131.753658][ T7831] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.1422: invalid indirect mapped block 256 (level 2) [ 131.781056][ T7835] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 131.789701][ T7831] EXT4-fs (loop4): 2 truncates cleaned up [ 131.802897][ T7831] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 131.816918][ T7831] EXT4-fs error (device loop4): ext4_validate_block_bitmap:432: comm syz.4.1422: bg 0: block 5: invalid block bitmap [ 131.829921][ T7831] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 131.842479][ T7831] EXT4-fs (loop4): This should not happen!! Data will be lost [ 131.842479][ T7831] [ 131.852256][ T7831] EXT4-fs (loop4): Total free blocks count 0 [ 131.858360][ T7831] EXT4-fs (loop4): Free/Dirty block details [ 131.864326][ T7831] EXT4-fs (loop4): free_blocks=0 [ 131.869334][ T7831] EXT4-fs (loop4): dirty_blocks=2 [ 131.874495][ T7831] EXT4-fs (loop4): Block reservation details [ 131.880504][ T7831] EXT4-fs (loop4): i_reserved_data_blocks=2 [ 131.924293][ T7784] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.931506][ T7784] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.950584][ T7843] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=7843 comm=syz.0.1425 [ 131.955287][ T7784] bridge_slave_0: entered allmulticast mode [ 131.998019][ T406] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 131075 with max blocks 1 with error 28 [ 132.012053][ T7784] bridge_slave_0: entered promiscuous mode [ 132.031558][ T7844] __nla_validate_parse: 8 callbacks suppressed [ 132.031578][ T7844] netlink: 232 bytes leftover after parsing attributes in process `syz.0.1425'. [ 132.048202][ T7784] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.055606][ T7784] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.081629][ T7784] bridge_slave_1: entered allmulticast mode [ 132.088638][ T7784] bridge_slave_1: entered promiscuous mode [ 132.158703][ T7784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 132.179813][ T7784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 132.228032][ T7856] netlink: 'syz.0.1430': attribute type 12 has an invalid length. [ 132.252218][ T7784] team0: Port device team_slave_0 added [ 132.262146][ T7784] team0: Port device team_slave_1 added [ 132.296541][ T7784] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 132.303577][ T7784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 132.329571][ T7784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 132.361473][ T7784] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 132.368792][ T7784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 132.394897][ T7784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 132.426382][ T7784] hsr_slave_0: entered promiscuous mode [ 132.432748][ T7784] hsr_slave_1: entered promiscuous mode [ 132.438698][ T7784] debugfs: 'hsr0' already exists in 'hsr' [ 132.444518][ T7784] Cannot create hsr debugfs directory [ 132.529691][ T7869] loop2: detected capacity change from 0 to 128 [ 132.537224][ T7866] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1433'. [ 132.547001][ T7866] netlink: 'syz.0.1433': attribute type 30 has an invalid length. [ 132.583316][ T7869] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 132.631896][ T7869] ext4 filesystem being mounted at /251/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 132.710739][ T411] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 132.735915][ T411] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 132.773043][ T411] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 132.802336][ T3323] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 132.818909][ T411] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 132.854112][ T7784] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 132.886137][ T7784] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 132.915790][ T7784] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 132.943032][ T7891] lo speed is unknown, defaulting to 1000 [ 132.945233][ T7784] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 133.205294][ T7784] 8021q: adding VLAN 0 to HW filter on device bond0 [ 133.244135][ T7784] 8021q: adding VLAN 0 to HW filter on device team0 [ 133.261020][ T4763] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.268243][ T4763] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.301197][ T4763] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.308452][ T4763] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.348722][ T7784] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 133.379999][ T29] kauditd_printk_skb: 195 callbacks suppressed [ 133.380033][ T29] audit: type=1326 audit(1768826628.588:13944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7943 comm="syz.1.1451" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 133.430137][ T29] audit: type=1326 audit(1768826628.628:13945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7943 comm="syz.1.1451" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 133.454739][ T29] audit: type=1326 audit(1768826628.628:13946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7943 comm="syz.1.1451" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 133.478880][ T29] audit: type=1326 audit(1768826628.628:13947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7943 comm="syz.1.1451" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 133.490808][ T7784] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 133.503910][ T29] audit: type=1326 audit(1768826628.628:13948): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7943 comm="syz.1.1451" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 133.533477][ T29] audit: type=1326 audit(1768826628.628:13949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7943 comm="syz.1.1451" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 133.557694][ T29] audit: type=1326 audit(1768826628.628:13950): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7943 comm="syz.1.1451" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 133.581995][ T29] audit: type=1326 audit(1768826628.628:13951): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7943 comm="syz.1.1451" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 133.606325][ T29] audit: type=1326 audit(1768826628.628:13952): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7943 comm="syz.1.1451" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 133.630513][ T29] audit: type=1326 audit(1768826628.628:13953): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7943 comm="syz.1.1451" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 133.736361][ T7971] loop1: detected capacity change from 0 to 512 [ 133.743400][ T7971] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 133.755505][ T7971] EXT4-fs error (device loop1): ext4_validate_block_bitmap:432: comm syz.1.1454: bg 0: block 4: invalid block bitmap [ 133.769817][ T7971] EXT4-fs (loop1): Remounting filesystem read-only [ 133.777797][ T7971] EXT4-fs (loop1): 1 truncate cleaned up [ 133.784038][ T7971] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 133.841913][ T7784] veth0_vlan: entered promiscuous mode [ 133.851151][ T7784] veth1_vlan: entered promiscuous mode [ 133.890822][ T7784] veth0_macvtap: entered promiscuous mode [ 133.900620][ T7784] veth1_macvtap: entered promiscuous mode [ 133.914338][ T7784] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 133.929261][ T7784] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 133.940601][ T4779] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.963626][ T4779] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.983727][ T4779] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.021607][ T4779] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.032706][ T7998] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1459'. [ 134.053024][ T3320] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.070066][ T8000] loop5: detected capacity change from 0 to 128 [ 134.428553][ T8019] loop5: detected capacity change from 0 to 512 [ 134.459690][ T8019] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e842c11c, mo2=0002] [ 134.479297][ T8019] System zones: 0-2, 18-18, 34-34 [ 134.495447][ T8019] EXT4-fs (loop5): too many log groups per flexible block group [ 134.523429][ T8019] EXT4-fs (loop5): failed to initialize mballoc (-12) [ 134.545451][ T8019] EXT4-fs (loop5): mount failed [ 134.701072][ T8038] loop5: detected capacity change from 0 to 1024 [ 134.729784][ T8038] EXT4-fs: Ignoring removed orlov option [ 134.759459][ T8038] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 134.787530][ T8038] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.958596][ T8052] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1469'. [ 134.967644][ T8052] netlink: 'syz.4.1469': attribute type 30 has an invalid length. [ 135.185870][ T8061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1471'. [ 135.201753][ T8011] syz.5.1465 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 135.213526][ T8011] CPU: 0 UID: 0 PID: 8011 Comm: syz.5.1465 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 135.213558][ T8011] Tainted: [W]=WARN [ 135.213564][ T8011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 135.213580][ T8011] Call Trace: [ 135.213593][ T8011] [ 135.213603][ T8011] __dump_stack+0x1d/0x30 [ 135.213632][ T8011] dump_stack_lvl+0x95/0xd0 [ 135.213697][ T8011] dump_stack+0x15/0x1b [ 135.213778][ T8011] dump_header+0x80/0x240 [ 135.213804][ T8011] oom_kill_process+0x295/0x350 [ 135.213831][ T8011] out_of_memory+0x97d/0xb80 [ 135.213853][ T8011] try_charge_memcg+0x62e/0xa10 [ 135.213920][ T8011] charge_memcg+0x51/0xc0 [ 135.213956][ T8011] mem_cgroup_swapin_charge_folio+0xcc/0x150 [ 135.213999][ T8011] __read_swap_cache_async+0x17b/0x2d0 [ 135.214088][ T8011] swap_cluster_readahead+0x362/0x3c0 [ 135.214131][ T8011] swapin_readahead+0xde/0x840 [ 135.214166][ T8011] ? __rcu_read_unlock+0x33/0x70 [ 135.214191][ T8011] ? __rcu_read_unlock+0x4e/0x70 [ 135.214241][ T8011] ? swap_cache_get_folio+0x26f/0x280 [ 135.214273][ T8011] do_swap_page+0x2f4/0x2140 [ 135.214302][ T8011] ? update_load_avg+0x1da/0x810 [ 135.214323][ T8011] ? update_curr+0xb0/0x150 [ 135.214425][ T8011] ? __pfx_default_wake_function+0x10/0x10 [ 135.214464][ T8011] handle_mm_fault+0xb40/0x3030 [ 135.214572][ T8011] ? vma_start_read+0x1c7/0x2c0 [ 135.214653][ T8011] do_user_addr_fault+0x62f/0x1050 [ 135.214734][ T8011] ? arch_exit_work+0x30/0x40 [ 135.214759][ T8011] ? irqentry_exit+0x3c/0x510 [ 135.214795][ T8011] exc_page_fault+0x62/0xa0 [ 135.214829][ T8011] asm_exc_page_fault+0x26/0x30 [ 135.214938][ T8011] RIP: 0033:0x7fdfd9b2b2b9 [ 135.215026][ T8011] Code: f0 0f 83 c0 00 00 00 48 89 75 00 49 89 4c 24 f8 48 8b 4d 08 48 8b 55 00 eb 91 0f 1f 80 00 00 00 00 4c 89 ea 4c 89 e6 48 89 df 02 ff ff ff 48 89 d8 48 29 e8 48 3d 80 00 00 00 0f 8e 7d 00 00 [ 135.215050][ T8011] RSP: 002b:00007fff2e20dbd0 EFLAGS: 00010212 [ 135.215112][ T8011] RAX: 00007fdfd971c568 RBX: 00007fdfd971c570 RCX: ffffffff817ccc1b [ 135.215130][ T8011] RDX: 0000000000000020 RSI: 00007fdfd9730a28 RDI: 00007fdfd971c570 [ 135.215145][ T8011] RBP: 00007fdfd96ead50 R08: 00007fdfd9ec0000 R09: 00007fdfd9ed6038 [ 135.215194][ T8011] R10: 0000000000000001 R11: 0000000000000009 R12: 00007fdfd9730a28 [ 135.215210][ T8011] R13: 0000000000000020 R14: 0000000000008b9b R15: 0000000000000001 [ 135.215249][ T8011] ? __remove_mapping+0x1b/0x4c0 [ 135.215283][ T8011] [ 135.215290][ T8011] memory: usage 307200kB, limit 307200kB, failcnt 210 [ 135.318687][ T8072] loop2: detected capacity change from 0 to 1024 [ 135.324313][ T8011] memory+swap: usage 307396kB, limit 9007199254740988kB, failcnt 0 [ 135.329754][ T8072] EXT4-fs: Ignoring removed bh option [ 135.332456][ T8011] kmem: usage 307192kB, limit 9007199254740988kB, failcnt 0 [ 135.332474][ T8011] Memory cgroup stats for /syz5 [ 135.337973][ T8072] EXT4-fs: inline encryption not supported [ 135.344438][ T8011] : [ 135.349990][ T8072] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 135.516230][ T8063] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1471'. [ 135.526844][ T8011] cache 8192 [ 135.530089][ T8011] rss 0 [ 135.533006][ T8011] shmem 0 [ 135.535991][ T8011] mapped_file 0 [ 135.539471][ T8011] dirty 0 [ 135.542465][ T8011] writeback 0 [ 135.545761][ T8011] workingset_refault_anon 34 [ 135.550346][ T8011] workingset_refault_file 0 [ 135.554915][ T8011] swap 200704 [ 135.558229][ T8011] swapcached 0 [ 135.561648][ T8011] pgpgin 433 [ 135.564855][ T8011] pgpgout 431 [ 135.568152][ T8011] pgfault 655 [ 135.571542][ T8011] pgmajfault 11 [ 135.575065][ T8011] inactive_anon 0 [ 135.578725][ T8011] active_anon 0 [ 135.582317][ T8011] inactive_file 4096 [ 135.586232][ T8011] active_file 4096 [ 135.590030][ T8011] unevictable 0 [ 135.593529][ T8011] hierarchical_memory_limit 314572800 [ 135.598928][ T8011] hierarchical_memsw_limit 9223372036854771712 [ 135.605110][ T8011] total_cache 8192 [ 135.608849][ T8011] total_rss 0 [ 135.612190][ T8011] total_shmem 0 [ 135.615660][ T8011] total_mapped_file 0 [ 135.619718][ T8011] total_dirty 0 [ 135.623280][ T8011] total_writeback 0 [ 135.627110][ T8011] total_workingset_refault_anon 34 [ 135.632300][ T8011] total_workingset_refault_file 0 [ 135.637336][ T8011] total_swap 200704 [ 135.641261][ T8011] total_swapcached 0 [ 135.645181][ T8011] total_pgpgin 433 [ 135.648960][ T8011] total_pgpgout 431 [ 135.652820][ T8011] total_pgfault 655 [ 135.656686][ T8011] total_pgmajfault 11 [ 135.660675][ T8011] total_inactive_anon 0 [ 135.664888][ T8011] total_active_anon 0 [ 135.668974][ T8011] total_inactive_file 4096 [ 135.673515][ T8011] total_active_file 4096 [ 135.677769][ T8011] total_unevictable 0 [ 135.681776][ T8011] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0,oom_memcg=/syz5,task_memcg=/syz5,task=syz.5.1465,pid=8011,uid=0 [ 135.696711][ T8011] Memory cgroup out of memory: Killed process 8011 (syz.5.1465) total-vm:96320kB, anon-rss:1204kB, file-rss:22708kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 135.722320][ T8072] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c84ce018, mo2=0000] [ 135.763619][ T8012] syz.5.1465 (8012) used greatest stack depth: 7416 bytes left [ 135.822235][ T8077] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1475'. [ 135.837102][ T8077] loop1: detected capacity change from 0 to 512 [ 135.855714][ T8072] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #3: block 2: comm syz.2.1474: lblock 2 mapped to illegal pblock 2 (length 1) [ 135.872451][ T8072] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #3: block 48: comm syz.2.1474: lblock 0 mapped to illegal pblock 48 (length 1) [ 135.904672][ T8072] EXT4-fs error (device loop2): ext4_acquire_dquot:6986: comm syz.2.1474: Failed to acquire dquot type 0 [ 135.936916][ T8079] netlink: 444 bytes leftover after parsing attributes in process `syz.0.1476'. [ 135.956807][ T8079] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1476'. [ 135.967613][ T8077] EXT4-fs warning (device loop1): ext4_enable_quotas:7221: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 135.987298][ T8077] EXT4-fs (loop1): mount failed [ 135.998781][ T8072] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 136.009722][ T8072] EXT4-fs error (device loop2): ext4_evict_inode:253: inode #11: comm syz.2.1474: mark_inode_dirty error [ 136.030332][ T8072] EXT4-fs warning (device loop2): ext4_evict_inode:256: couldn't mark inode dirty (err -117) [ 136.041322][ T8072] EXT4-fs (loop2): 1 orphan inode deleted [ 136.047677][ T8072] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 136.060678][ T53] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:4: lblock 1 mapped to illegal pblock 1 (length 1) [ 136.084244][ T53] EXT4-fs error (device loop2): ext4_release_dquot:7022: comm kworker/u8:4: Failed to release dquot type 0 [ 136.173891][ T3323] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 136.190334][ T3323] EXT4-fs error (device loop2): __ext4_get_inode_loc:4830: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 136.233716][ T8095] FAULT_INJECTION: forcing a failure. [ 136.233716][ T8095] name failslab, interval 1, probability 0, space 0, times 0 [ 136.246516][ T8095] CPU: 1 UID: 0 PID: 8095 Comm: syz.4.1481 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 136.246559][ T8095] Tainted: [W]=WARN [ 136.246565][ T8095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 136.246577][ T8095] Call Trace: [ 136.246583][ T8095] [ 136.246590][ T8095] __dump_stack+0x1d/0x30 [ 136.246676][ T8095] dump_stack_lvl+0x95/0xd0 [ 136.246696][ T8095] dump_stack+0x15/0x1b [ 136.246720][ T8095] should_fail_ex+0x263/0x280 [ 136.246749][ T8095] should_failslab+0x8c/0xb0 [ 136.246823][ T8095] kmem_cache_alloc_node_noprof+0x6a/0x4a0 [ 136.246851][ T8095] ? __alloc_skb+0x2f0/0x4b0 [ 136.246884][ T8095] __alloc_skb+0x2f0/0x4b0 [ 136.246913][ T8095] ? __alloc_skb+0x219/0x4b0 [ 136.246950][ T8095] netlink_ack+0xfd/0x500 [ 136.246983][ T8095] netlink_rcv_skb+0x192/0x220 [ 136.247095][ T8095] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 136.247182][ T8095] rtnetlink_rcv+0x1c/0x30 [ 136.247228][ T8095] netlink_unicast+0x5c0/0x690 [ 136.247266][ T8095] netlink_sendmsg+0x5c8/0x6f0 [ 136.247326][ T8095] ? __pfx_netlink_sendmsg+0x10/0x10 [ 136.247351][ T8095] __sock_sendmsg+0x145/0x170 [ 136.247382][ T8095] ____sys_sendmsg+0x31e/0x4a0 [ 136.247493][ T8095] ___sys_sendmsg+0x195/0x1e0 [ 136.247550][ T8095] __x64_sys_sendmsg+0xd4/0x160 [ 136.247646][ T8095] x64_sys_call+0x17ba/0x3000 [ 136.247677][ T8095] do_syscall_64+0xc0/0x2a0 [ 136.247706][ T8095] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.247760][ T8095] RIP: 0033:0x7f1f0beaacb9 [ 136.247780][ T8095] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.247803][ T8095] RSP: 002b:00007f1f0a907028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 136.247828][ T8095] RAX: ffffffffffffffda RBX: 00007f1f0c125fa0 RCX: 00007f1f0beaacb9 [ 136.247846][ T8095] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 136.247862][ T8095] RBP: 00007f1f0a907090 R08: 0000000000000000 R09: 0000000000000000 [ 136.247878][ T8095] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 136.247958][ T8095] R13: 00007f1f0c126038 R14: 00007f1f0c125fa0 R15: 00007ffdfb067c78 [ 136.248043][ T8095] [ 136.248377][ T3323] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6298: Corrupt filesystem [ 136.477732][ T3323] EXT4-fs error (device loop2): ext4_quota_off:7270: inode #3: comm syz-executor: mark_inode_dirty error [ 136.563401][ T8109] loop4: detected capacity change from 0 to 1024 [ 136.580794][ T8109] EXT4-fs: Invalid want_extra_isize 0 [ 136.646331][ T8116] lo speed is unknown, defaulting to 1000 [ 136.658014][ T8111] loop2: detected capacity change from 0 to 8192 [ 136.692272][ T8119] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 136.715433][ T8119] ext4 filesystem being mounted at /312/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 137.148089][ T8152] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1490'. [ 137.157211][ T8152] netlink: 'syz.5.1490': attribute type 7 has an invalid length. [ 137.165669][ T8152] netlink: 'syz.5.1490': attribute type 8 has an invalid length. [ 137.173641][ T8152] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1490'. [ 137.225089][ T8159] set_capacity_and_notify: 1 callbacks suppressed [ 137.225110][ T8159] loop0: detected capacity change from 0 to 128 [ 137.251538][ T8152] FAULT_INJECTION: forcing a failure. [ 137.251538][ T8152] name failslab, interval 1, probability 0, space 0, times 0 [ 137.264333][ T8152] CPU: 1 UID: 0 PID: 8152 Comm: syz.5.1490 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 137.264370][ T8152] Tainted: [W]=WARN [ 137.264377][ T8152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 137.264389][ T8152] Call Trace: [ 137.264471][ T8152] [ 137.264479][ T8152] __dump_stack+0x1d/0x30 [ 137.264533][ T8152] dump_stack_lvl+0x95/0xd0 [ 137.264559][ T8152] dump_stack+0x15/0x1b [ 137.264583][ T8152] should_fail_ex+0x263/0x280 [ 137.264645][ T8152] should_failslab+0x8c/0xb0 [ 137.264671][ T8152] kmem_cache_alloc_noprof+0x68/0x490 [ 137.264698][ T8152] ? skb_clone+0x151/0x1f0 [ 137.264736][ T8152] skb_clone+0x151/0x1f0 [ 137.264794][ T8152] __netlink_deliver_tap+0x2c9/0x500 [ 137.264852][ T8152] ? netlink_attachskb+0x2e2/0x660 [ 137.264881][ T8152] netlink_sendskb+0x126/0x150 [ 137.264948][ T8152] netlink_unicast+0x2a2/0x690 [ 137.264981][ T8152] netlink_ack+0x4c8/0x500 [ 137.265021][ T8152] netlink_rcv_skb+0x192/0x220 [ 137.265058][ T8152] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 137.265137][ T8152] rtnetlink_rcv+0x1c/0x30 [ 137.265163][ T8152] netlink_unicast+0x5c0/0x690 [ 137.265195][ T8152] netlink_sendmsg+0x5c8/0x6f0 [ 137.265234][ T8152] ? __pfx_netlink_sendmsg+0x10/0x10 [ 137.265258][ T8152] __sock_sendmsg+0x145/0x170 [ 137.265295][ T8152] ____sys_sendmsg+0x31e/0x4a0 [ 137.265389][ T8152] ___sys_sendmsg+0x195/0x1e0 [ 137.265443][ T8152] __x64_sys_sendmsg+0xd4/0x160 [ 137.265486][ T8152] x64_sys_call+0x17ba/0x3000 [ 137.265552][ T8152] do_syscall_64+0xc0/0x2a0 [ 137.265575][ T8152] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.265602][ T8152] RIP: 0033:0x7fdfd9c5acb9 [ 137.265622][ T8152] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.265645][ T8152] RSP: 002b:00007fdfd86b7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 137.265705][ T8152] RAX: ffffffffffffffda RBX: 00007fdfd9ed5fa0 RCX: 00007fdfd9c5acb9 [ 137.265722][ T8152] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 137.265738][ T8152] RBP: 00007fdfd86b7090 R08: 0000000000000000 R09: 0000000000000000 [ 137.265754][ T8152] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 137.265766][ T8152] R13: 00007fdfd9ed6038 R14: 00007fdfd9ed5fa0 R15: 00007fff2e20db88 [ 137.265803][ T8152] [ 137.268684][ T8158] loop5: detected capacity change from 0 to 512 [ 137.594708][ T8158] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 137.608580][ T8158] EXT4-fs (loop5): 1 truncate cleaned up [ 137.615749][ T8158] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 137.656083][ T8159] FAT-fs (loop0): Directory bread(block 32) failed [ 137.663495][ T8159] FAT-fs (loop0): Directory bread(block 33) failed [ 137.703950][ T8159] FAT-fs (loop0): Directory bread(block 34) failed [ 137.723603][ T7784] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 137.747132][ T8128] syz.2.1479 (8128) used greatest stack depth: 6248 bytes left [ 137.765040][ T8159] FAT-fs (loop0): Directory bread(block 35) failed [ 137.785923][ T8159] FAT-fs (loop0): Directory bread(block 36) failed [ 137.818708][ T8159] FAT-fs (loop0): Directory bread(block 37) failed [ 137.835980][ T8181] loop5: detected capacity change from 0 to 512 [ 137.855723][ T8159] FAT-fs (loop0): Directory bread(block 38) failed [ 137.904693][ T8159] FAT-fs (loop0): Directory bread(block 39) failed [ 137.912161][ T8181] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.1495: inode has both inline data and extents flags [ 137.953314][ T8159] FAT-fs (loop0): Directory bread(block 40) failed [ 137.960106][ T8159] FAT-fs (loop0): Directory bread(block 41) failed [ 137.967420][ T3320] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 137.984911][ T8181] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.1495: couldn't read orphan inode 15 (err -117) [ 138.002043][ T8159] bio_check_eod: 1017 callbacks suppressed [ 138.002062][ T8159] syz.0.1491: attempt to access beyond end of device [ 138.002062][ T8159] loop0: rw=8388611, sector=4124, nr_sectors = 4 limit=128 [ 138.022011][ T8159] syz.0.1491: attempt to access beyond end of device [ 138.022011][ T8159] loop0: rw=8390659, sector=4128, nr_sectors = 4056 limit=128 [ 138.032690][ T8181] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 138.081259][ T8193] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1551 sclass=netlink_xfrm_socket pid=8193 comm=syz.1.1499 [ 138.105626][ T8181] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1495'. [ 138.114853][ T8187] netlink: 108 bytes leftover after parsing attributes in process `syz.4.1498'. [ 138.132018][ T8181] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8181 comm=syz.5.1495 [ 138.140553][ T8194] netlink: 232 bytes leftover after parsing attributes in process `syz.1.1499'. [ 138.206732][ T7784] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 138.265830][ T8159] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.276294][ T8159] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.324670][ T8201] tipc: Started in network mode [ 138.329689][ T8201] tipc: Node identity 84e, cluster identity 4711 [ 138.336266][ T8201] tipc: Node number set to 2126 [ 138.375648][ T8159] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.386221][ T8159] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.386251][ T29] kauditd_printk_skb: 84 callbacks suppressed [ 138.386267][ T29] audit: type=1326 audit(1768826633.578:14032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8204 comm="syz.1.1504" exe="/root/syz-executor" sig=0 arch=c000003e syscall=50 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 138.426850][ T29] audit: type=1326 audit(1768826633.578:14033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8204 comm="syz.1.1504" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 138.451757][ T8205] netlink: 'syz.1.1504': attribute type 30 has an invalid length. [ 138.493987][ T29] audit: type=1326 audit(1768826633.588:14034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8204 comm="syz.1.1504" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 138.518284][ T29] audit: type=1326 audit(1768826633.618:14035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8204 comm="syz.1.1504" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 138.542395][ T29] audit: type=1326 audit(1768826633.618:14036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8204 comm="syz.1.1504" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 138.566607][ T29] audit: type=1326 audit(1768826633.618:14037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8204 comm="syz.1.1504" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 138.590994][ T29] audit: type=1326 audit(1768826633.648:14038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8204 comm="syz.1.1504" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 138.615219][ T29] audit: type=1326 audit(1768826633.648:14039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8204 comm="syz.1.1504" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 138.639457][ T29] audit: type=1326 audit(1768826633.648:14040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8204 comm="syz.1.1504" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 138.663801][ T29] audit: type=1326 audit(1768826633.648:14041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8204 comm="syz.1.1504" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f5ce1fbacb9 code=0x7ffc0000 [ 138.696134][ T8159] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.707181][ T8159] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.745869][ T8227] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1509'. [ 138.765009][ T8227] loop4: detected capacity change from 0 to 128 [ 138.775589][ T8159] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.786603][ T8159] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.899626][ T290] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 138.907964][ T290] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.940007][ T290] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 138.948361][ T290] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.952354][ T8241] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=784 sclass=netlink_route_socket pid=8241 comm=syz.2.1516 [ 139.141728][ T290] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.150008][ T290] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.192445][ T290] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.200783][ T290] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.363811][ T8312] netlink: 'syz.1.1522': attribute type 30 has an invalid length. [ 139.404349][ T8314] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1523'. [ 139.511629][ T8319] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 139.529383][ T8319] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 139.550338][ T8320] loop2: detected capacity change from 0 to 512 [ 139.604719][ T8320] EXT4-fs (loop2): too many log groups per flexible block group [ 139.606901][ T8321] lo speed is unknown, defaulting to 1000 [ 139.623567][ T8325] veth2: entered promiscuous mode [ 139.628669][ T8325] veth2: entered allmulticast mode [ 139.634294][ T8317] loop1: detected capacity change from 0 to 1024 [ 139.641500][ T8320] EXT4-fs (loop2): failed to initialize mballoc (-12) [ 139.663438][ T8317] EXT4-fs (loop1): stripe (6) is not aligned with cluster size (16), stripe is disabled [ 139.704877][ T8320] EXT4-fs (loop2): mount failed [ 139.747851][ T8317] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 139.817364][ T8344] loop5: detected capacity change from 0 to 128 [ 139.821114][ T8317] erspan0: entered promiscuous mode [ 139.831047][ T8317] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1525'. [ 139.902050][ T8350] loop2: detected capacity change from 0 to 128 [ 139.940797][ T8355] syz.5.1532: attempt to access beyond end of device [ 139.940797][ T8355] loop5: rw=2049, sector=241, nr_sectors = 128 limit=128 [ 139.964706][ T3320] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 140.125829][ T8369] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1541'. [ 140.213007][ T8376] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1543'. [ 140.314876][ T8382] loop2: detected capacity change from 0 to 512 [ 140.369126][ T8382] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 140.400810][ T8382] ext4 filesystem being mounted at /279/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 140.478829][ T8358] loop4: detected capacity change from 0 to 256 [ 140.506081][ T3323] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 140.519128][ T8358] msdos: Bad value for 'uid' [ 140.523968][ T8358] msdos: Bad value for 'uid' [ 140.719249][ T8403] lo speed is unknown, defaulting to 1000 [ 140.827826][ T8408] netlink: 'syz.2.1553': attribute type 30 has an invalid length. [ 141.463786][ T8442] netlink: 'syz.1.1566': attribute type 30 has an invalid length. [ 141.704226][ T8457] can0: slcan on ttyS3. [ 141.752107][ T8457] can0 (unregistered): slcan off ttyS3. [ 141.769843][ T8464] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 141.793760][ T8464] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 141.849638][ T290] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 141.862667][ T8470] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 141.882707][ T8470] EXT4-fs (loop4): 1 truncate cleaned up [ 141.888997][ T8470] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 141.936134][ T8478] bridge0: port 4(bond0) entered blocking state [ 141.942520][ T8478] bridge0: port 4(bond0) entered disabled state [ 141.954242][ T8478] bond0: entered allmulticast mode [ 141.959424][ T8478] bond_slave_0: entered allmulticast mode [ 141.966094][ T8478] bond_slave_1: entered allmulticast mode [ 141.973494][ T8478] bond0: entered promiscuous mode [ 141.978554][ T8478] bond_slave_0: entered promiscuous mode [ 141.985036][ T8478] bond_slave_1: entered promiscuous mode [ 141.991532][ T8478] bridge0: port 4(bond0) entered blocking state [ 141.997836][ T8478] bridge0: port 4(bond0) entered forwarding state [ 142.041900][ T8485] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 142.073626][ T8487] IPv6: sit1: Disabled Multicast RS [ 142.074177][ T3324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 142.269663][ T8507] set_capacity_and_notify: 5 callbacks suppressed [ 142.269683][ T8507] loop2: detected capacity change from 0 to 1024 [ 142.298242][ T8507] EXT4-fs: Ignoring removed nobh option [ 142.304694][ T8507] EXT4-fs: Ignoring removed bh option [ 142.330216][ T8507] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0002-000000000000 r/w without journal. Quota mode: writeback. [ 142.353455][ T8507] netlink: 83992 bytes leftover after parsing attributes in process `syz.2.1590'. [ 142.362952][ T8507] netlink: zone id is out of range [ 142.368146][ T8507] netlink: zone id is out of range [ 142.387696][ T8507] netlink: zone id is out of range [ 142.398293][ T8521] loop0: detected capacity change from 0 to 1024 [ 142.405461][ T8507] netlink: zone id is out of range [ 142.417455][ T8507] netlink: zone id is out of range [ 142.422706][ T8507] netlink: zone id is out of range [ 142.428019][ T8507] netlink: zone id is out of range [ 142.433623][ T8507] netlink: zone id is out of range [ 142.444644][ T8521] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 142.483822][ T3316] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 142.494111][ T8527] loop5: detected capacity change from 0 to 1024 [ 142.503415][ T3323] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0002-000000000000. [ 142.525763][ T8527] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 142.561293][ T8532] FAULT_INJECTION: forcing a failure. [ 142.561293][ T8532] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 142.575450][ T8532] CPU: 0 UID: 0 PID: 8532 Comm: syz.0.1597 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 142.575542][ T8532] Tainted: [W]=WARN [ 142.575550][ T8532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 142.575563][ T8532] Call Trace: [ 142.575569][ T8532] [ 142.575575][ T8532] __dump_stack+0x1d/0x30 [ 142.575600][ T8532] dump_stack_lvl+0x95/0xd0 [ 142.575627][ T8532] dump_stack+0x15/0x1b [ 142.575658][ T8532] should_fail_ex+0x263/0x280 [ 142.575681][ T8532] should_fail_alloc_page+0xf2/0x100 [ 142.575740][ T8532] __alloc_frozen_pages_noprof+0x108/0x350 [ 142.575770][ T8532] alloc_pages_mpol+0xb3/0x260 [ 142.575803][ T8532] vma_alloc_folio_noprof+0x1a9/0x300 [ 142.575856][ T8532] handle_mm_fault+0x111f/0x3030 [ 142.575888][ T8532] ? __rcu_read_unlock+0x4e/0x70 [ 142.575928][ T8532] ? check_vma_flags+0x26d/0x330 [ 142.576001][ T8532] __get_user_pages+0x1023/0x1ea0 [ 142.576086][ T8532] get_user_pages_remote+0x1d5/0x6b0 [ 142.576137][ T8532] ? down_read+0x76/0xb0 [ 142.576167][ T8532] get_arg_page+0x8e/0x1e0 [ 142.576235][ T8532] copy_string_kernel+0x12c/0x1f0 [ 142.576326][ T8532] do_execveat_common+0x594/0x740 [ 142.576375][ T8532] __x64_sys_execveat+0x73/0x90 [ 142.576407][ T8532] x64_sys_call+0x1c0e/0x3000 [ 142.576479][ T8532] do_syscall_64+0xc0/0x2a0 [ 142.576505][ T8532] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.576532][ T8532] RIP: 0033:0x7fc47f16acb9 [ 142.576551][ T8532] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.576613][ T8532] RSP: 002b:00007fc47dbc7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 142.576635][ T8532] RAX: ffffffffffffffda RBX: 00007fc47f3e5fa0 RCX: 00007fc47f16acb9 [ 142.576648][ T8532] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 142.576660][ T8532] RBP: 00007fc47dbc7090 R08: 0000000000001000 R09: 0000000000000000 [ 142.576685][ T8532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 142.576698][ T8532] R13: 00007fc47f3e6038 R14: 00007fc47f3e5fa0 R15: 00007ffdcdfda0a8 [ 142.576727][ T8532] [ 142.810502][ T7784] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 142.882571][ T8541] loop5: detected capacity change from 0 to 128 [ 143.060527][ T8560] netlink: 'syz.1.1610': attribute type 30 has an invalid length. [ 143.213595][ T8568] lo speed is unknown, defaulting to 1000 [ 143.393885][ T29] kauditd_printk_skb: 469 callbacks suppressed [ 143.393903][ T29] audit: type=1400 audit(1768826638.598:14511): avc: denied { cmd } for pid=8573 comm="syz.4.1614" path="socket:[24069]" dev="sockfs" ino=24069 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 143.585407][ T8584] atomic_op ffff88811d83c528 conn xmit_atomic 0000000000000000 [ 143.659704][ T8587] lo speed is unknown, defaulting to 1000 [ 143.811456][ T8590] loop0: detected capacity change from 0 to 512 [ 143.844090][ T8590] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 143.890777][ T8590] netlink: 'syz.0.1617': attribute type 4 has an invalid length. [ 143.911233][ T8598] syz_tun: entered allmulticast mode [ 143.924746][ T8590] netlink: 'syz.0.1617': attribute type 4 has an invalid length. [ 143.938128][ T8598] syz_tun: left allmulticast mode [ 143.987756][ T3316] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 144.033351][ T8609] SET target dimension over the limit! [ 144.041108][ T29] audit: type=1326 audit(1768826639.248:14512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8607 comm="syz.5.1623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd9c5acb9 code=0x7ffc0000 [ 144.064887][ T29] audit: type=1326 audit(1768826639.248:14513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8607 comm="syz.5.1623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd9c5acb9 code=0x7ffc0000 [ 144.097534][ T8610] netlink: 'syz.5.1623': attribute type 30 has an invalid length. [ 144.133370][ T29] audit: type=1326 audit(1768826639.258:14514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8607 comm="syz.5.1623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=318 compat=0 ip=0x7fdfd9c5acb9 code=0x7ffc0000 [ 144.157024][ T29] audit: type=1326 audit(1768826639.258:14515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8607 comm="syz.5.1623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd9c5acb9 code=0x7ffc0000 [ 144.180821][ T29] audit: type=1326 audit(1768826639.258:14516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8607 comm="syz.5.1623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd9c5acb9 code=0x7ffc0000 [ 144.204632][ T29] audit: type=1326 audit(1768826639.308:14517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8607 comm="syz.5.1623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fdfd9c5acb9 code=0x7ffc0000 [ 144.228462][ T29] audit: type=1326 audit(1768826639.308:14518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8607 comm="syz.5.1623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd9c5acb9 code=0x7ffc0000 [ 144.251999][ T29] audit: type=1326 audit(1768826639.308:14519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8607 comm="syz.5.1623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7fdfd9c5acb9 code=0x7ffc0000 [ 144.275533][ T29] audit: type=1326 audit(1768826639.308:14520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8607 comm="syz.5.1623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd9c5acb9 code=0x7ffc0000 [ 144.452206][ T8625] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1628'. [ 144.461240][ T8625] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1628'. [ 144.563142][ T8634] loop4: detected capacity change from 0 to 1024 [ 144.572781][ T8634] EXT4-fs: inline encryption not supported [ 144.578662][ T8634] EXT4-fs: Ignoring removed mblk_io_submit option [ 144.619605][ T8634] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 144.675282][ T8644] lo speed is unknown, defaulting to 1000 [ 145.132520][ T8634] ================================================================== [ 145.140743][ T8634] BUG: KCSAN: data-race in __filemap_remove_folio / folio_mapping [ 145.148576][ T8634] [ 145.150892][ T8634] write to 0xffffea0004b96a98 of 8 bytes by task 8585 on cpu 1: [ 145.158511][ T8634] __filemap_remove_folio+0x201/0x300 [ 145.163986][ T8634] filemap_remove_folio+0x6d/0x1d0 [ 145.169128][ T8634] truncate_inode_folio+0x42/0x50 [ 145.174157][ T8634] shmem_undo_range+0x28a/0xb10 [ 145.179007][ T8634] shmem_evict_inode+0x12e/0x510 [ 145.183958][ T8634] evict+0x2af/0x510 [ 145.187857][ T8634] iput+0x4b9/0x650 [ 145.191666][ T8634] dentry_unlink_inode+0x24f/0x260 [ 145.196782][ T8634] __dentry_kill+0x18d/0x4b0 [ 145.201400][ T8634] finish_dput+0x2b/0x200 [ 145.205728][ T8634] dput+0x52/0x60 [ 145.209364][ T8634] __fput+0x444/0x650 [ 145.213350][ T8634] ____fput+0x1c/0x30 [ 145.217423][ T8634] task_work_run+0x130/0x1a0 [ 145.222028][ T8634] do_exit+0x466/0x1590 [ 145.226187][ T8634] do_group_exit+0xfe/0x140 [ 145.230694][ T8634] get_signal+0xe4f/0xf60 [ 145.235029][ T8634] arch_do_signal_or_restart+0x96/0x450 [ 145.240582][ T8634] irqentry_exit+0xf7/0x510 [ 145.245093][ T8634] asm_exc_page_fault+0x26/0x30 [ 145.250116][ T8634] [ 145.252438][ T8634] read to 0xffffea0004b96a98 of 8 bytes by task 8634 on cpu 0: [ 145.259979][ T8634] folio_mapping+0xa1/0xe0 [ 145.264393][ T8634] evict_folios+0xde9/0x35b0 [ 145.268983][ T8634] try_to_shrink_lruvec+0x5f6/0x960 [ 145.274185][ T8634] shrink_lruvec+0x24e/0x1bc0 [ 145.278871][ T8634] shrink_node+0x68e/0x2000 [ 145.283373][ T8634] do_try_to_free_pages+0x404/0xcc0 [ 145.288584][ T8634] try_to_free_mem_cgroup_pages+0x222/0x470 [ 145.294503][ T8634] try_charge_memcg+0x37e/0xa10 [ 145.299383][ T8634] obj_cgroup_charge_pages+0xa6/0x150 [ 145.304757][ T8634] __memcg_kmem_charge_page+0x9e/0x170 [ 145.310222][ T8634] __alloc_frozen_pages_noprof+0x18a/0x350 [ 145.316033][ T8634] alloc_pages_mpol+0xb3/0x260 [ 145.320800][ T8634] alloc_pages_noprof+0x8f/0x130 [ 145.325742][ T8634] __vmalloc_node_range_noprof+0xa46/0x12b0 [ 145.331650][ T8634] __kvmalloc_node_noprof+0x471/0x680 [ 145.337027][ T8634] ip_set_alloc+0x24/0x30 [ 145.341398][ T8634] hash_netiface_create+0x282/0x740 [ 145.346609][ T8634] ip_set_create+0x3cf/0x970 [ 145.351208][ T8634] nfnetlink_rcv_msg+0x509/0x5d0 [ 145.356155][ T8634] netlink_rcv_skb+0x123/0x220 [ 145.360951][ T8634] nfnetlink_rcv+0x167/0x1720 [ 145.365639][ T8634] netlink_unicast+0x5c0/0x690 [ 145.370411][ T8634] netlink_sendmsg+0x5c8/0x6f0 [ 145.375169][ T8634] __sock_sendmsg+0x145/0x170 [ 145.379843][ T8634] ____sys_sendmsg+0x31e/0x4a0 [ 145.384617][ T8634] ___sys_sendmsg+0x195/0x1e0 [ 145.389319][ T8634] __x64_sys_sendmsg+0xd4/0x160 [ 145.394178][ T8634] x64_sys_call+0x17ba/0x3000 [ 145.398942][ T8634] do_syscall_64+0xc0/0x2a0 [ 145.403445][ T8634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.409336][ T8634] [ 145.411665][ T8634] value changed: 0xffff8881050d0d90 -> 0x0000000000000000 [ 145.418762][ T8634] [ 145.421080][ T8634] Reported by Kernel Concurrency Sanitizer on: [ 145.427246][ T8634] CPU: 0 UID: 0 PID: 8634 Comm: syz.4.1633 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 145.438546][ T8634] Tainted: [W]=WARN [ 145.442341][ T8634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 145.452388][ T8634] ================================================================== [ 145.542428][ T8663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 145.552802][ T8663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 145.801933][ T8634] syz.4.1633 (8634) used greatest stack depth: 6152 bytes left [ 145.815024][ T3324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.