last executing test programs: 1.680777494s ago: executing program 0 (id=44): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000020b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000980)='mm_page_free\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="18020000fcffffff00000000000000008500000041000000850000007d00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0x2111, 0x300, &(0x7f0000000100), 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 1.529610296s ago: executing program 0 (id=47): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0xfffffffd, 0x25dfdbff, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') syz_emit_ethernet(0x2a, &(0x7f00000002c0)={@link_local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x22}}, @address_request={0x11, 0x0, 0x0, 0x1}}}}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) 1.037342514s ago: executing program 2 (id=63): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x40, r2, 0x1, 0x70bd26, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa5}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xff}]}, 0x40}}, 0x20) 998.074265ms ago: executing program 0 (id=64): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r0}, &(0x7f0000000000), &(0x7f00000005c0)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r2}, 0x10) ioperm(0x9, 0x2, 0x1000) 924.799766ms ago: executing program 2 (id=66): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000200180000000000000000000850000007b000000"], 0x0, 0xe6d}, 0x94) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xd48eb75a72641b5d) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x4, 0x65, &(0x7f0000000500)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0xc0085508, &(0x7f00000000c0)=0x7) 917.029815ms ago: executing program 0 (id=67): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b7030000faffffff850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r1, &(0x7f00000005c0)={'#! ', './file0'}, 0xb) close(r1) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 753.849588ms ago: executing program 0 (id=77): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) setsockopt$inet6_int(r0, 0x29, 0x3c, &(0x7f0000000000)=0x3, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x18) sendto$inet6(r0, &(0x7f0000000240)="c4", 0xffffffffffffff95, 0x20000845, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @rand_addr, 0x5}, 0x1c) 718.642429ms ago: executing program 0 (id=79): rt_sigtimedwait(&(0x7f0000000040)={[0xffffffffffff7ff8]}, 0x0, 0x0, 0x8) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f00000001c0)=0x2001) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000280)=[{0x4, 0x5, 0x40, 0x0, @time={0x8, 0x7}, {0xf7, 0xf}, {0x3, 0x9}, @queue={0x0, {0x17, 0x9}}}, {0x5, 0x9, 0x3, 0x2, @time={0xffffffff, 0x7}, {0xff, 0xb}, {0x6, 0xfc}, @queue={0xe, {0x1, 0x7}}}], 0x38) readv(r0, &(0x7f0000000200)=[{&(0x7f0000000040)=""/59, 0x3b}], 0x1) 490.029102ms ago: executing program 4 (id=90): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, 0x0, 0xf00) 455.186213ms ago: executing program 4 (id=93): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000b80)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b40)={&(0x7f0000000600)='kfree\x00', r0}, 0x10) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r1, &(0x7f0000000a00)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000940)=""/3, 0x3, 0x0, 0x4, 0x0, 0x0, 0xc08}}, 0x120) readv(r1, &(0x7f0000000140)=[{&(0x7f0000000080)=""/155, 0x9b}, {0x0, 0x4}], 0x2) write$UHID_DESTROY(r1, &(0x7f0000000200), 0x4) 339.899794ms ago: executing program 4 (id=96): r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)={0x8000200d}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000f2cff4)={0x77540947ed9a168d}) 321.719075ms ago: executing program 3 (id=97): r0 = socket$kcm(0x2b, 0x1, 0x0) close(r0) r1 = socket$kcm(0x2, 0x1000000000000005, 0x0) sendmsg$inet(r1, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x0, @rand_addr=0x20}, 0x140, &(0x7f0000000140)=[{&(0x7f0000000380), 0xff7a}], 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="1100000000000000004003001100000000000000000000001c00000000000000000f00fdffff0700", @ANYRES32=0x0, @ANYBLOB="ac1414bbe0000001000000001c0000000000000000078f020c000000", @ANYRES32=0x0, @ANYBLOB="a005000000000000000000002400000000000000840000000700000094040000441000000000000000050000000000000000000011000000000000000000011601000000000000000000000003cfaff1a411936940e815b82c26205472b6847265849d913aac5ebe"], 0x98}, 0x4dc) setsockopt$sock_attach_bpf(r0, 0x1, 0xd, &(0x7f00000001c0), 0x45) close(r0) 302.788255ms ago: executing program 4 (id=99): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1, 0x0, 0x0, 0x8040}], 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000f00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000300)='5', 0x1}], 0x1, &(0x7f0000000180)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c"], 0x30}], 0x1, 0x0) 261.989966ms ago: executing program 1 (id=100): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x10, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x7a, 0x14, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000340), &(0x7f0000000300)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x18) syz_emit_ethernet(0x22, &(0x7f00000013c0)={@local, @multicast, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x3b}}}}}}, 0x0) 254.345166ms ago: executing program 3 (id=101): r0 = socket$inet(0x2, 0x2, 0x0) close(r0) r1 = socket$inet(0x2, 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) setsockopt$inet_opts(r1, 0x0, 0x200000000000b, &(0x7f0000000080)='\x00', 0x1) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000240)="eaffff0005000000", 0x8) 248.776076ms ago: executing program 4 (id=102): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0, 0x0, 0xfffffffffffffffd}, 0x18) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f00000004c0)=ANY=[@ANYBLOB="1809000000000000000000000001000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r1}, &(0x7f0000000540), &(0x7f0000000580)=r2}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r1, &(0x7f0000000780)}, 0x20) 227.649946ms ago: executing program 3 (id=103): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000004c0)='mm_page_free\x00', r1, 0x0, 0x178}, 0x18) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 218.681696ms ago: executing program 4 (id=104): r0 = syz_io_uring_setup(0x4cef, &(0x7f0000000000)={0x0, 0x949, 0x100, 0x1, 0x2aa}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r0, 0xb516, 0xc2de, 0x8, 0x0, 0x0) syz_io_uring_setup(0x24fe, &(0x7f0000000300)={0x0, 0xf36e, 0x10100}, 0x0, 0x0) io_uring_enter(r0, 0xe2e, 0x78bf, 0x20, 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) 205.287527ms ago: executing program 1 (id=105): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x7, 0x4, 0x8, 0xd9}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000010bc0)='kfree\x00', r1}, 0x18) r2 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x0, 0xa0, &(0x7f0000000240)={0xa1, 0x15, 0x8, 0x42}, 0x8, 0x3, 0x0, 0x0, 0x2002, 0x0, 0x0}) 199.798957ms ago: executing program 3 (id=106): r0 = mq_open(&(0x7f0000000600)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdF\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1b\xf4\xce\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|9\x90\x8d\xf4r\xd9*\xd1\x83\n\x1a\xa8fa2\xd4:^\xd7a\x0f\x12}\a\x9d\xc9h\x02\xbe\xeb\x01\xd39LS\xefJ\xcc<\xc4\xc0\xb4A\xab{\x1b\x15<\x95\x02\xae\xfdT\x98\xf4\x85\a\x01@\x12\xe0<3\xb4\x97\xb6W\x84K\xd7\xc5\xf47\xed\xda4\xe2W\xb6r\xca\x1e\x90\xef\x13\xf1&~\x97n\x9f\x8eS\xa8R\xf6\x9d{9\x1bN\x81\x18~\xd7{', 0x42, 0x0, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r1, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x2}]) mq_timedsend(r0, 0x0, 0x0, 0x6, 0x0) mq_timedreceive(r0, &(0x7f000001a3c0)=""/102381, 0xffffffffffffff32, 0x0, 0x0) 174.934617ms ago: executing program 2 (id=107): r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f00000002c0)=0x7, 0x4) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03adcac4b74ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) 160.435267ms ago: executing program 1 (id=108): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r0, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) getpgrp(0xffffffffffffffff) 146.770288ms ago: executing program 2 (id=109): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0xc0}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x0, 0x0, 0x400}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) close(0x3) 129.681758ms ago: executing program 1 (id=110): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0x8}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r1}, &(0x7f0000000300), &(0x7f0000000340)}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='kmem_cache_free\x00', r2}, 0x10) sendto$inet6(r0, &(0x7f0000000080)="b1", 0x1, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) 126.961338ms ago: executing program 2 (id=111): socket$kcm(0x11, 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) 90.843418ms ago: executing program 3 (id=112): r0 = syz_io_uring_setup(0xd1, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x335}, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x12, 0x0, 0xffffffffffffffff, &(0x7f0000000140)={0x400000, 0x40, 0x29}, &(0x7f0000000100)='./file0\x00', 0x30, 0x0, 0x12345}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getrusage(0x0, 0x0) io_uring_enter(r0, 0x47ba, 0xda2a, 0x62, 0x0, 0x0) 85.944778ms ago: executing program 1 (id=113): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f0000000340)=[{&(0x7f00000002c0)='/', 0x1}], 0x1, 0x0, 0x0, 0x40}, 0x0) accept4(r0, 0x0, 0x0, 0x0) 72.497078ms ago: executing program 2 (id=114): openat$tun(0xffffffffffffff9c, 0x0, 0x1c1341, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200000, &(0x7f00000005c0)={[{@noblock_validity}, {}, {@sysvgroups}, {@norecovery}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@orlov}, {@nogrpid}, {@noauto_da_alloc}, {@user_xattr}]}, 0x3, 0x56a, &(0x7f00000015c0)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwFy9SBBEL4h/g3WPxH/CvKGihSAl68BKZzWy7TbL5uXW3zucD0743M5s3b998335nZ5cNoLBGsn9KEa9GxDdJxOG2bYORbxxZ2W/p8Y3JbEliefmzP5NI8nWt/ZP8/4N55ZWI+PWriJOlte3WFxZnKtVqOpfXRxuzV0frC4unLs9WptPp9Mr4xMSZdybG33/v3a719c0Lf3//6f2Pznx9fOm7nx8euZvEuTiUb2vvxy7caq+MxEj+nAzFuVU7jnWhsX6S9PoA2JGBPM6HIpsDDsdAHvXA/9/NiFgGCioR/1BQrTygdW3fpevgF8ajD1cugNb2f3DlvZHY17w2OrCUPHNllF3vDneh/ayNX/64dzdbYpP3IW52oT2Allu3I+L04ODa+S/J57+dO91883hjq9so2usP9NL9LP95a738p/Qk/4l18p+D68TuTmwe/6WHXWimoyz/+2Dd/PfJ1DU8kNdeauZ8Q8mly9X0dES8HBEnYmhvVt/ofs6ZpQfLnba153/ZkrXfygXz43g4uPfZx0xVGpXd9Lndo9sRrz3Nf5NYM//va+a6q8c/ez4ubLGNY+m91ztt27z/7bqfAS//FPHGuuP/9I5WsvH9ydHm+TDaOivW+uvOsd86tb+9/ndfNv4HNu7/cNJ+v7a+/TZ+3PdP2mnbTs//PcnnzfKefN31SqMxNxaxJ/lk7frxp49t1Vv7Z/0/cXzj+W+9839/RHyxxf7fOXqn4679MP5T2xr/7RcefPzlD53a39r4v90sncjXbGX+2+oB7ua5AwAAAAAAgH5TiohDkZTKT8qlUrm88vmOo3GgVK3VGycv1eavTEXzu7LDMVRq3ek+3PZ5iLH887Ct+viq+kREHImIbwf2N+vlyVp1qtedBwAAAAAAAAAAAAAAAAAAgD5xsMP3/zO/D/T66IDnzk9+Q3FtGv/d+KUnoC95/YfiEv9QXOIfikv8Q3GJfygu8Q/FJf6huMQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAAdNWF8+ezZXnp8Y3JrD51bWF+pnbt1FRanynPzk+WJ2tzV8vTtdp0NS1P1mY3+3vVWu3q2HjMXx9tpPXGaH1h8eJsbf5K4+Ll2cp0ejEd+k96BQAAAAAAAAAAAAAAAAAAAC+W+sLiTKVaTecUOhbORl8cxo4LyWajfDY/GXbUxGDvO6jwHAo9npgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoM2/AQAA///fKTPH") setxattr$trusted_overlay_upper(&(0x7f0000000380)='./file0/file0\x00', &(0x7f00000001c0), &(0x7f0000001400)=ANY=[], 0x835, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000380)='./file1\x00', &(0x7f00000001c0), &(0x7f0000001400)=ANY=[], 0x835, 0x0) sync() rename(&(0x7f0000000080)='./file0/file0\x00', &(0x7f0000000180)='./file1\x00') 36.073319ms ago: executing program 3 (id=115): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000de0000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r0}, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) io_setup(0x2, &(0x7f0000002400)=0x0) io_submit(r2, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2000000000, 0x4, 0x0, 0x1, 0x300, r1, &(0x7f0000000040)="5400ffff0000", 0x6, 0x0, 0x0, 0x2}]) 0s ago: executing program 1 (id=116): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='kfree\x00', r1, 0x0, 0x2}, 0x18) open_tree(0xffffffffffffff9c, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x3, 0x0, 0x3, 0xf, 0x0, 0x700, 0x0, [@sadb_key={0x5, 0x9, 0xe0, 0x0, "01d78771b90bd8a3b4914783c50400003d5b9538a9d03e6e9bfdac55"}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x2, 0xd}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}]}, 0x78}, 0x1, 0x7}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.130' (ED25519) to the list of known hosts. [ 24.883975][ T29] audit: type=1400 audit(1751064237.522:62): avc: denied { mounton } for pid=3293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.884882][ T3293] cgroup: Unknown subsys name 'net' [ 24.906785][ T29] audit: type=1400 audit(1751064237.522:63): avc: denied { mount } for pid=3293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.934131][ T29] audit: type=1400 audit(1751064237.552:64): avc: denied { unmount } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.059798][ T3293] cgroup: Unknown subsys name 'cpuset' [ 25.065883][ T3293] cgroup: Unknown subsys name 'rlimit' [ 25.185993][ T29] audit: type=1400 audit(1751064237.822:65): avc: denied { setattr } for pid=3293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.209286][ T29] audit: type=1400 audit(1751064237.822:66): avc: denied { create } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.229750][ T29] audit: type=1400 audit(1751064237.822:67): avc: denied { write } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.250180][ T29] audit: type=1400 audit(1751064237.822:68): avc: denied { read } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.256914][ T3297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.270544][ T29] audit: type=1400 audit(1751064237.822:69): avc: denied { mounton } for pid=3293 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.303935][ T29] audit: type=1400 audit(1751064237.822:70): avc: denied { mount } for pid=3293 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.327231][ T29] audit: type=1400 audit(1751064237.912:71): avc: denied { relabelto } for pid=3297 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.356959][ T3293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.436165][ T3303] chnl_net:caif_netlink_parms(): no params data found [ 26.448824][ T3304] chnl_net:caif_netlink_parms(): no params data found [ 26.502842][ T3310] chnl_net:caif_netlink_parms(): no params data found [ 26.534742][ T3304] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.542329][ T3304] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.549577][ T3304] bridge_slave_0: entered allmulticast mode [ 26.556098][ T3304] bridge_slave_0: entered promiscuous mode [ 26.565020][ T3304] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.572155][ T3304] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.579544][ T3304] bridge_slave_1: entered allmulticast mode [ 26.586245][ T3304] bridge_slave_1: entered promiscuous mode [ 26.602268][ T3311] chnl_net:caif_netlink_parms(): no params data found [ 26.635184][ T3308] chnl_net:caif_netlink_parms(): no params data found [ 26.652961][ T3303] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.660130][ T3303] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.668161][ T3303] bridge_slave_0: entered allmulticast mode [ 26.674531][ T3303] bridge_slave_0: entered promiscuous mode [ 26.682677][ T3304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.701690][ T3303] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.708937][ T3303] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.716287][ T3303] bridge_slave_1: entered allmulticast mode [ 26.722685][ T3303] bridge_slave_1: entered promiscuous mode [ 26.729895][ T3304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.781834][ T3304] team0: Port device team_slave_0 added [ 26.787589][ T3310] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.794834][ T3310] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.802167][ T3310] bridge_slave_0: entered allmulticast mode [ 26.808561][ T3310] bridge_slave_0: entered promiscuous mode [ 26.815087][ T3310] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.822236][ T3310] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.829482][ T3310] bridge_slave_1: entered allmulticast mode [ 26.836067][ T3310] bridge_slave_1: entered promiscuous mode [ 26.851303][ T3303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.860439][ T3311] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.867521][ T3311] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.874985][ T3311] bridge_slave_0: entered allmulticast mode [ 26.882289][ T3311] bridge_slave_0: entered promiscuous mode [ 26.891512][ T3304] team0: Port device team_slave_1 added [ 26.902689][ T3303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.916336][ T3311] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.923433][ T3311] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.930575][ T3311] bridge_slave_1: entered allmulticast mode [ 26.936871][ T3311] bridge_slave_1: entered promiscuous mode [ 26.979363][ T3308] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.986446][ T3308] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.993615][ T3308] bridge_slave_0: entered allmulticast mode [ 27.000122][ T3308] bridge_slave_0: entered promiscuous mode [ 27.006404][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.013441][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.039999][ T3304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.051555][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.058519][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.084467][ T3304] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.096506][ T3310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.108466][ T3303] team0: Port device team_slave_0 added [ 27.115227][ T3311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.125355][ T3311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.134464][ T3308] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.141580][ T3308] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.148863][ T3308] bridge_slave_1: entered allmulticast mode [ 27.155271][ T3308] bridge_slave_1: entered promiscuous mode [ 27.166388][ T3310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.176585][ T3303] team0: Port device team_slave_1 added [ 27.204893][ T3310] team0: Port device team_slave_0 added [ 27.220623][ T3308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.230985][ T3308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.248211][ T3310] team0: Port device team_slave_1 added [ 27.258863][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.265845][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.291915][ T3303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.303192][ T3311] team0: Port device team_slave_0 added [ 27.315286][ T3304] hsr_slave_0: entered promiscuous mode [ 27.321550][ T3304] hsr_slave_1: entered promiscuous mode [ 27.331869][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.338842][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.364971][ T3303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.378671][ T3311] team0: Port device team_slave_1 added [ 27.390949][ T3308] team0: Port device team_slave_0 added [ 27.397530][ T3308] team0: Port device team_slave_1 added [ 27.403923][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.410982][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.437088][ T3310] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.471801][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.479030][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.505077][ T3310] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.525765][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.532790][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.558729][ T3311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.569801][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.576884][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.602814][ T3311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.613912][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.620926][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.646918][ T3308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.668996][ T3303] hsr_slave_0: entered promiscuous mode [ 27.675106][ T3303] hsr_slave_1: entered promiscuous mode [ 27.681155][ T3303] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 27.688689][ T3303] Cannot create hsr debugfs directory [ 27.699533][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.706929][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.733130][ T3308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.772487][ T3310] hsr_slave_0: entered promiscuous mode [ 27.778346][ T3310] hsr_slave_1: entered promiscuous mode [ 27.784387][ T3310] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 27.792005][ T3310] Cannot create hsr debugfs directory [ 27.810226][ T3311] hsr_slave_0: entered promiscuous mode [ 27.816312][ T3311] hsr_slave_1: entered promiscuous mode [ 27.822221][ T3311] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 27.829789][ T3311] Cannot create hsr debugfs directory [ 27.846920][ T3308] hsr_slave_0: entered promiscuous mode [ 27.852991][ T3308] hsr_slave_1: entered promiscuous mode [ 27.858830][ T3308] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 27.866413][ T3308] Cannot create hsr debugfs directory [ 28.031995][ T3304] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 28.051299][ T3304] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 28.059964][ T3304] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 28.071103][ T3304] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 28.087831][ T3303] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 28.098765][ T3303] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 28.107900][ T3303] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 28.121399][ T3303] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 28.138461][ T3310] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 28.149537][ T3310] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 28.164269][ T3310] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 28.178876][ T3310] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 28.222632][ T3311] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 28.238102][ T3304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.252191][ T3311] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 28.264004][ T3303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.273674][ T3311] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 28.283174][ T3311] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 28.310358][ T3303] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.318648][ T3304] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.327529][ T3308] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 28.336697][ T3308] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 28.345830][ T3308] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 28.354771][ T3308] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 28.366099][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.373181][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.387880][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.394964][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.403594][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.410690][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.419504][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.426726][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.447436][ T3310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.474130][ T3310] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.491307][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.498391][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.522823][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.529947][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.547664][ T3304] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 28.612260][ T3303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.621539][ T3311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.645445][ T3311] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.654696][ T3308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.665605][ T1757] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.672752][ T1757] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.695202][ T3308] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.708375][ T3304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.723782][ T1757] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.730942][ T1757] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.741473][ T1757] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.748650][ T1757] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.761908][ T1757] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.769126][ T1757] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.814930][ T3308] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 28.832148][ T3310] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.914045][ T3304] veth0_vlan: entered promiscuous mode [ 28.933173][ T3308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.942577][ T3304] veth1_vlan: entered promiscuous mode [ 28.957908][ T3311] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.973234][ T3304] veth0_macvtap: entered promiscuous mode [ 28.988366][ T3304] veth1_macvtap: entered promiscuous mode [ 29.016460][ T3303] veth0_vlan: entered promiscuous mode [ 29.046220][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.062194][ T3303] veth1_vlan: entered promiscuous mode [ 29.082169][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.104965][ T3311] veth0_vlan: entered promiscuous mode [ 29.113862][ T3308] veth0_vlan: entered promiscuous mode [ 29.121421][ T3310] veth0_vlan: entered promiscuous mode [ 29.127400][ T3304] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.136169][ T3304] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.144980][ T3304] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.153956][ T3304] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.169851][ T3311] veth1_vlan: entered promiscuous mode [ 29.176948][ T3308] veth1_vlan: entered promiscuous mode [ 29.188467][ T3310] veth1_vlan: entered promiscuous mode [ 29.211770][ T3311] veth0_macvtap: entered promiscuous mode [ 29.222112][ T3303] veth0_macvtap: entered promiscuous mode [ 29.231235][ T3304] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 29.234588][ T3308] veth0_macvtap: entered promiscuous mode [ 29.252953][ T3311] veth1_macvtap: entered promiscuous mode [ 29.263396][ T3310] veth0_macvtap: entered promiscuous mode [ 29.270713][ T3310] veth1_macvtap: entered promiscuous mode [ 29.281694][ T3303] veth1_macvtap: entered promiscuous mode [ 29.289489][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.301179][ T3308] veth1_macvtap: entered promiscuous mode [ 29.313907][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.326921][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.339831][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.350658][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.361894][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.370632][ T3311] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.379384][ T3311] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.388142][ T3311] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.397012][ T3311] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.420171][ T3308] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.428948][ T3308] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.437805][ T3308] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.446643][ T3308] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.462035][ T3310] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.470954][ T3310] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.479793][ T3310] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.488525][ T3310] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.507407][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.520658][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.532450][ T3303] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.541432][ T3303] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.550268][ T3303] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.559025][ T3303] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.772923][ T3496] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9'. [ 29.781711][ T3496] netem: unknown loss type 13 [ 29.786467][ T3496] netem: change failed [ 29.901260][ T3510] syz.3.16 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 29.918492][ T29] kauditd_printk_skb: 68 callbacks suppressed [ 29.918506][ T29] audit: type=1326 audit(1751064242.552:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3511 comm="syz.0.17" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b7934e929 code=0x7ffc0000 [ 29.982809][ T29] audit: type=1326 audit(1751064242.552:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3511 comm="syz.0.17" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b7934e929 code=0x7ffc0000 [ 30.006157][ T29] audit: type=1326 audit(1751064242.552:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3511 comm="syz.0.17" exe="/root/syz-executor" sig=0 arch=c000003e syscall=241 compat=0 ip=0x7f1b7934e929 code=0x7ffc0000 [ 30.029641][ T29] audit: type=1326 audit(1751064242.552:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3511 comm="syz.0.17" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b7934e929 code=0x7ffc0000 [ 30.053241][ T29] audit: type=1326 audit(1751064242.552:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3511 comm="syz.0.17" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b7934e929 code=0x7ffc0000 [ 30.077618][ T29] audit: type=1326 audit(1751064242.552:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3511 comm="syz.0.17" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f1b7934e929 code=0x7ffc0000 [ 30.100665][ T29] audit: type=1326 audit(1751064242.552:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3511 comm="syz.0.17" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b7934e929 code=0x7ffc0000 [ 30.123809][ T29] audit: type=1326 audit(1751064242.552:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3511 comm="syz.0.17" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b7934e929 code=0x7ffc0000 [ 30.147078][ T29] audit: type=1400 audit(1751064242.592:148): avc: denied { create } for pid=3513 comm="syz.2.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 30.166406][ T29] audit: type=1400 audit(1751064242.622:149): avc: denied { write } for pid=3513 comm="syz.2.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 30.243054][ T3527] netlink: 4 bytes leftover after parsing attributes in process `syz.3.24'. [ 30.278406][ T3527] vlan0: entered promiscuous mode [ 30.286568][ T3527] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 30.350556][ T3540] geneve0: entered allmulticast mode [ 30.391092][ T3548] loop3: detected capacity change from 0 to 1024 [ 30.401279][ T3548] ======================================================= [ 30.401279][ T3548] WARNING: The mand mount option has been deprecated and [ 30.401279][ T3548] and is ignored by this kernel. Remove the mand [ 30.401279][ T3548] option from the mount to silence this warning. [ 30.401279][ T3548] ======================================================= [ 30.475851][ T3548] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 30.515112][ T3560] syz.4.39 (3560) used greatest stack depth: 10768 bytes left [ 30.551172][ T3548] ext4 filesystem being mounted at /7/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 30.563431][ T3569] loop4: detected capacity change from 0 to 128 [ 30.600886][ T3569] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 30.636905][ T3569] ext4 filesystem being mounted at /9/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 30.679777][ T3575] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=15 sclass=netlink_audit_socket pid=3575 comm=syz.2.45 [ 30.745375][ T51] EXT4-fs error (device loop3): ext4_validate_block_bitmap:441: comm kworker/u8:3: bg 0: block 393: padding at end of block bitmap is not set [ 30.746136][ T3303] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 30.785450][ T3580] bridge0: port 3(syz_tun) entered blocking state [ 30.792617][ T3580] bridge0: port 3(syz_tun) entered disabled state [ 30.796210][ T51] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 2035 with error 117 [ 30.802843][ T3580] syz_tun: entered allmulticast mode [ 30.811776][ T51] EXT4-fs (loop3): This should not happen!! Data will be lost [ 30.811776][ T51] [ 30.817750][ T3580] syz_tun: entered promiscuous mode [ 30.834194][ T3583] netlink: 176 bytes leftover after parsing attributes in process `syz.2.50'. [ 30.845574][ T3582] netlink: 'syz.4.49': attribute type 21 has an invalid length. [ 30.847139][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 30.855997][ T3580] bridge0: port 3(syz_tun) entered blocking state [ 30.868948][ T3580] bridge0: port 3(syz_tun) entered forwarding state [ 30.883223][ T3577] bridge: RTM_NEWNEIGH with invalid ether address [ 30.890134][ T3582] netlink: 132 bytes leftover after parsing attributes in process `syz.4.49'. [ 30.899201][ T3582] netlink: 'syz.4.49': attribute type 1 has an invalid length. [ 30.953263][ T3584] syz_tun: left allmulticast mode [ 30.958963][ T3584] syz_tun: left promiscuous mode [ 30.964218][ T3584] bridge0: port 3(syz_tun) entered disabled state [ 30.975441][ T3590] netlink: 'syz.1.52': attribute type 1 has an invalid length. [ 30.993354][ T3584] bridge_slave_0: left allmulticast mode [ 30.999075][ T3584] bridge_slave_0: left promiscuous mode [ 31.004897][ T3584] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.027281][ T3584] bridge_slave_1: left allmulticast mode [ 31.033109][ T3584] bridge_slave_1: left promiscuous mode [ 31.038972][ T3584] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.051371][ T3584] bond0: (slave bond_slave_0): Releasing backup interface [ 31.066694][ T3584] bond0: (slave bond_slave_1): Releasing backup interface [ 31.081528][ T3584] team0: Port device team_slave_0 removed [ 31.090405][ T3584] team0: Port device team_slave_1 removed [ 31.101086][ T3584] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 31.108577][ T3584] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 31.117942][ T3584] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 31.125622][ T3584] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 31.231403][ T3611] loop3: detected capacity change from 0 to 512 [ 31.241916][ T3611] EXT4-fs: Ignoring removed i_version option [ 31.248370][ T3611] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 31.261514][ T3611] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 31.283021][ T3609] usb usb8: usbfs: process 3609 (syz.4.61) did not claim interface 0 before use [ 31.284651][ T3611] EXT4-fs (loop3): 1 truncate cleaned up [ 31.298215][ T3611] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 31.354371][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.400368][ T3621] process 'syz.0.67' launched './file0' with NULL argv: empty string added [ 31.420850][ T3629] netlink: 156 bytes leftover after parsing attributes in process `syz.4.71'. [ 31.456978][ T3635] Cannot find add_set index 0 as target [ 31.662595][ T3662] loop3: detected capacity change from 0 to 512 [ 31.681685][ T3662] EXT4-fs (loop3): too many log groups per flexible block group [ 31.690039][ T3662] EXT4-fs (loop3): failed to initialize mballoc (-12) [ 31.698272][ T3662] EXT4-fs (loop3): mount failed [ 31.819479][ T3413] hid-generic 0000:0004:0000.0001: unknown main item tag 0x0 [ 31.827033][ T3413] hid-generic 0000:0004:0000.0001: unknown main item tag 0x0 [ 31.834958][ T3413] hid-generic 0000:0004:0000.0001: unknown main item tag 0x0 [ 31.850747][ T3413] hid-generic 0000:0004:0000.0001: hidraw0: HID v0.00 Device [syz0] on syz1 [ 31.866266][ T3689] syz.1.94 uses obsolete (PF_INET,SOCK_PACKET) [ 31.936180][ T3690] fido_id[3690]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 32.206877][ T3734] loop2: detected capacity change from 0 to 1024 [ 32.214688][ T3734] EXT4-fs: Ignoring removed orlov option [ 32.232443][ T3734] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.344439][ T3734] ================================================================== [ 32.352560][ T3734] BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked [ 32.359950][ T3734] [ 32.362267][ T3734] read-write to 0xffff888107161b48 of 8 bytes by task 12 on cpu 1: [ 32.370147][ T3734] __xa_clear_mark+0xf5/0x1e0 [ 32.374919][ T3734] __folio_end_writeback+0x177/0x470 [ 32.380213][ T3734] folio_end_writeback+0x71/0x3d0 [ 32.385240][ T3734] ext4_finish_bio+0x459/0x8c0 [ 32.389994][ T3734] ext4_release_io_end+0x9f/0x1f0 [ 32.395019][ T3734] ext4_end_io_end+0x18d/0x240 [ 32.399771][ T3734] ext4_end_io_rsv_work+0x151/0x1e0 [ 32.404970][ T3734] process_scheduled_works+0x4ce/0x9d0 [ 32.410429][ T3734] worker_thread+0x582/0x770 [ 32.415015][ T3734] kthread+0x486/0x510 [ 32.419081][ T3734] ret_from_fork+0xda/0x150 [ 32.423578][ T3734] ret_from_fork_asm+0x1a/0x30 [ 32.428333][ T3734] [ 32.430650][ T3734] read to 0xffff888107161b48 of 8 bytes by task 3734 on cpu 0: [ 32.438192][ T3734] xas_find_marked+0x218/0x620 [ 32.442949][ T3734] find_get_entry+0x5d/0x380 [ 32.447712][ T3734] filemap_get_folios_tag+0x13b/0x210 [ 32.453083][ T3734] filemap_fdatawait_keep_errors+0x6c/0x180 [ 32.458974][ T3734] sync_inodes_sb+0x39c/0x440 [ 32.463852][ T3734] sync_inodes_one_sb+0x3d/0x50 [ 32.468704][ T3734] __iterate_supers+0x110/0x1f0 [ 32.473557][ T3734] iterate_supers+0x1f/0x30 [ 32.478082][ T3734] ksys_sync+0x5c/0xe0 [ 32.482164][ T3734] __ia32_sys_sync+0xe/0x20 [ 32.486675][ T3734] x64_sys_call+0x2e53/0x2fb0 [ 32.491346][ T3734] do_syscall_64+0xd2/0x200 [ 32.495844][ T3734] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 32.501815][ T3734] [ 32.504158][ T3734] value changed: 0xfffffffffffffffe -> 0xfffffffffffffff0 [ 32.511258][ T3734] [ 32.513569][ T3734] Reported by Kernel Concurrency Sanitizer on: [ 32.519721][ T3734] CPU: 0 UID: 0 PID: 3734 Comm: syz.2.114 Not tainted 6.16.0-rc3-syzkaller-00190-g67a993863163 #0 PREEMPT(voluntary) [ 32.532124][ T3734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 32.542179][ T3734] ================================================================== [ 32.618029][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.