last executing test programs: 1.702983978s ago: executing program 1 (id=2): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1800403, &(0x7f0000000080)={[{@noload}]}, 0x0, 0x5e5, &(0x7f00000000c0)="$eJzs3c1vVFUbAPDn3k4Lpe/7ti8xKi5MoyGQKC0tYPBjAXtC8GPnxkoLQcpHaI0WTSwJbkyMGxckrlyI/4US3boyunDhxpUhQWNIDMboNXd6ZxjamXZaZnqx8/slw9xzzsycc0ufnnPPPXduAD1rNP8njdgVEReTiOGGskoUhaNLr7v927sn80cSWfbyr0kkRV7t9UnxPFS8+a/hiG+/SmJn38p65xYun52anZ25VKTH589dHJ9buLzvzLmp0zOnZ85PPjN5+NDBQ4cn9t/X/qUN28euvvHW8AfHX/3skz+Tic9/PJ7Ekfjl1FJZ4350ymiMxp0se295fv5zPdzpykrSV/89uStZnsEDq1LESH9EPBLD0dfwvzkc779YauOArsqSiAzoUYn4hx5VGwfUju3bOw5OuzwqATbDraNRPfpfGf+VpbnBGKnODexe9r4mU3obktfxzdfHr+aPaDkPt71DtQGNFq9sK7aWx39Sjc2RIvZ23E7vmefNRwAniuc8/6UN1j+6LN2NeXigucUrEfFos/H/2vH/WkP8v77B+sU/AAAAAAAAdM6NoxHxdLPzf2lxbm57PFE9/5csnf/7/u4Vgkc6UP/a5//Smx2oBmji1tGIF5qu/62v8R3pK1L/XVoNmJw6MzuzPyL+FxF7o39bnp5YpY59H+681qqscf1f/sjrr60FLNpxs7Lt3vdMT81P3c8+A0tuXYl4rNJ6/U/e/yeN/X8h/3twsc06du6+fqJV2drxD3RL9mnEnqb9f1J/TbL693OMV8cD47VRwUqPv/PRF63qF/9Qnrz/37F6/I8kjd/XM7e+zx+IiAMLlaxV+UbH/wPJK321z8+9PTU/f2kiYiA5tjJ/cn1thq2qFg+1eMnjf++Tq8//1cf/DXE4GBGLbdb58N9DP7UqG43Iio/V/8Mmy+N/ukn/P9iy/1//xuT1kS9b1d9e/3+w2qfvLXLM/8Hq2g3QstsJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP9GaUT8J5J0rL6dpmNjEUMR8VDsSGcvzM0/derCm+en87Lq/f/T2p1+h5fSSe3+/yMN6cll6QMR8f+I+LhvsJoeO3lhdrrsnQcAAAAAAAAAAAAAAAAAAIAHxFCL6/9zP/eV3Tqg6yrFs3iH3lMpuwFAacQ/9C7xD71L/EPvaiP+72xGO4DNt8H+3+kC2AKM/6FX9bf3su3dbgdQBv0/AAAAAABsKTeef/ZaEhGLzw1WH7mBoqx+YnCwrNYB3ZSW3QCgNNbwQu+y9Ad6V5uLf4EtLKlv/ZE1K2+9+j/pToMAAAAAAAAAAAAAgBX27Lrxw5rX/wNbUhpxpOw2AOVw/T/0Ltf/Q+9qcYzvmAB6yFpX8W/o+n+3DAQAAAAAAAAAAACAjppbuHx2qnYT8KnZ2ZlL1RwbW3Tju9+zbF3vyrLyfjf6I6L0n1gpGwON4bkZlUbE4oocAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADggfBPAAAA//9wQh8o") prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000880)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000008c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000900)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000009c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000a00), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b00)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0xfff}, 0x50) r3 = syz_create_resource$futex(&(0x7f00000007c0)=0x1) futex(r3, 0xd, 0x2, &(0x7f00000009c0)={0x0, 0x3938700}, r3, 0x2) futex(0x0, 0x2, 0x1, 0x0, r3, 0x1) 1.700144518s ago: executing program 4 (id=5): r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f00000000c0), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000500)={'vxcan1\x00', 0x0}) r3 = dup3(r1, r0, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r2, @ANYBLOB="3bf81bb9f9"], 0x20000600}}, 0x0) sendmsg$can_bcm(r3, &(0x7f0000000080)={&(0x7f00000001c0)={0x1d, r5, 0x3f420f00}, 0x10, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[], 0x4640}, 0x2}, 0x2c004000) sendmsg$can_bcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000007c0)=ANY=[@ANYBLOB="050000002308"], 0x80}}, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) 1.611502671s ago: executing program 4 (id=9): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x2200000, &(0x7f0000000300)={[{@discard}, {@journal_dev={'journal_dev', 0x3d, 0x2}}, {@grpquota}, {@nojournal_checksum}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@delalloc}, {@stripe}, {@noauto_da_alloc}, {@dioread_nolock}]}, 0xb, 0x572, &(0x7f00000006c0)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x80342, 0xcc) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x42, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0) gettid() syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x11, &(0x7f00000001c0)={[{@noblock_validity}, {@stripe={'stripe', 0x3d, 0x2}}, {@norecovery}, {@min_batch_time={'min_batch_time', 0x3d, 0x71d}}, {@abort}]}, 0x1, 0x610, &(0x7f0000000c40)="$eJzs3c9rFGcfAPDvTH6avO+bKC+8rz3UQCkKrYmJWqQUau5F7I9/IDVRxGgkSaFRwQjtsfTSQ6GnHmr/i1borfTQaw+9F0FK8VCL1C2zOxs3m93Nz/3h7ucDa+aZmczznTXfPM88eWY2gJ41kf2TRhyNiJtJxFjFtv7IN06U9nv8x51L2SuJQuH935O4czdZrzxWkn8dzb/577FIfk4jjvRtrXdl7da1ucXFheW8PLV6/ebUytqtk1evz11ZuLJwY+aNmXNnz5w9N31qX+c3UGPdN189Taa//fVCEufjWR5bdl7V+w3tq+bsPZuIQsmTyvXZ+3pun8fuFH+OlX9OnkuqV9CxLud5m+XJ/2Is+ir+N8fi03fbGhzQVIUkym0U0HOSOvn/42yj3wzDTYsHaJVyP6B8bV/rOnirtMm9EqAVHs2WBqRKuT8QEeX87y+NDcZwcWxg5HGyaZwniYj9jcyVZHX89MOFT7JX1BmHA5pj/V55lLu6/U+KuTkew8XSyON0c/6vFwpp3hPI1r+3x/onqsryH1pn/V5E/D9v/wdjx/mf5rlbzv8P91i//AcAAAAAAICD82A2Il6vNf8v3Zj/M1hj/s9oRJw/gPq3//tf+jBfSKp2HTyA6qGnPZqNeKvm/N+NOb7jfXnp38X5ALeTy1cXF05FxH8i4kQMDGXl6arjVs4QPvnZkS/r1V85/y97ZfWX5wLmR3rYX3Uj7vzc6tx+zxuIeHQv4qXi/N9j+ZrN83+y9j+p0f5n+X1zh3UcefX+xXrbts9/oFkKX0ccr9n+P+9uJ42fzzFV7A9MlXsFW718+/Pv6tVfnf9NOEWgjqz9H2mc/0NJ5fN6VnZ3/Owi/fRaf6He9r32/weTD/qiYhDg47nV1eXpiMHkna3rZ3YXM3SrPB+ORZ4vWf6feKXx+N9G/78iDw9FxPoO6hveZrv+P7RPlv/zjdv/8c3t/+4XZu6Pf1+v/os7av/PFNv0E/ka439QaevzOHaaoG0JFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABecGlE/CuSdHJjOU0nJyNGI+K/MZIuLq2svnZ56aMb89m2iPEYSMuf9DtWKiflz/8fryjPVJVPR8ThiPii71CxPHlpaXG+3ScPAAAAAAAAAAAAAAAAAAAAHWK0eM9/Yaj6/v/Mb33tjg5ouv78q3yH3tO/5+8sDB1oIEDL7T3/gRdYds2/i/wfaGYsQBvUz/8nTwtFLQ0HaCH9f+hde8x/fy6ALqD9h161wzG94WbHAbSD9h8AAAAAALrK4WMPfkkiYv3NQ8VXZjDfZrI/dLe03QEAbWMOL/Su/qV2RwC0i2t8INlY+qvmzf71Z/8nzQkIAAAAAAAAAAAAANji+FH3/0Ovanz/v7n90M0a3P9fK/k9LgC6SP2P/tD2Q7dzjQ9s19q7/x8AAAAAAAAAAAAAOsDwrWtzi4sLyytrL97C250Rxu4W1uc6IoxdLBTuRjTe51lzah+IiE55E5ZXsmhaVVf5ERxtPOU2/14CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2/BMAAP//cdEbCg==") bpf$PROG_LOAD(0x5, &(0x7f0000001280)={0x6, 0xd, &(0x7f0000001340)=ANY=[], &(0x7f0000001380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000001c80)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001cc0)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000001d00)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000001d40)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001d80)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000001dc0)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000001e40), 0x651, 0x0) recvmmsg(r3, &(0x7f0000001e80), 0x10106, 0x2, 0x0) flock(0xffffffffffffffff, 0x2) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f000068b000/0x3000)=nil, 0x3000, &(0x7f0000001ec0)='/+)(\x00') socket$inet6(0xa, 0x3, 0xff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002400)={&(0x7f0000002440)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x4, 0xa}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xfecc) 1.555220972s ago: executing program 0 (id=10): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000001c0)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'wg0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000240)="0b03feff4f00141202004788aa96a13bb1000011000088ca1a67", 0x1fffc, 0x0, &(0x7f0000000280)={0x11, 0x0, r1}, 0x14) 1.309500048s ago: executing program 0 (id=12): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={0x0}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f00000ad000/0x9000)=nil, 0x9000, 0x2000004, 0x12, 0xffffffffffffffff, 0xfe801000) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000880)={0xf642, 0x20, 0x6, 0x9dfe, 0x1a}) write$binfmt_aout(r0, &(0x7f00000008c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000900)={0x0, 0x0, 0xfffffff9, 0x6, 0x16, "0062007d8200f7ffffff00"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000940)=0x17) 1.228266869s ago: executing program 3 (id=15): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x21081e, &(0x7f00000000c0)={[{@block_validity}, {@usrquota}, {@nobh}]}, 0x1, 0x526, &(0x7f0000000500)="$eJzs3c9vG1kdAPCvnTi/mt1klz0Agt2wu1BQVedH2WjZAywnhNBKiJW4gNQNiRtFseModpYmVCI9c0WiEic4cOAP4Fxx4M4FwY1LOVQqEIEaEAejGY9TN7XTtEntbPz5SKP58cbzfS/pvFd/Hc8LYGDNRMReRIxExEcRMZUdz2VLvN9ckvMe7t9aPti/tZyLRuPDf+TS8uRYtL0mcSm75lhEfO9bET/KPRm3trO7vlQul7ay/dl6ZXO2trN7da2ytFpaLW0sLCzOL869e+2dhSdeu9dIPXNb36iMZFufv/fHva/8JKnWZHak1Y7xZ77q8ZpNLxzGSQxHxHfOOE6/DGXtGel3RXgu+Yh4NSLeTO//qRhKf5sAwEXWaExFY6p9HwC46PJpDiyXL2a5gMnI54vFZg7vtZjIl6u1+pUb1e2NlWaubDoK+Rtr5dJcliucjkIu2Z9PtyOms+v+tJkaOiy/FhGvRMTPR8fT/eJytbzSx//3AMAgu3Rk/P/3aHP8BwAuuLGI3/y++b6931UBAHpkrN8VAAB6zvgPAIPH+A8Ag6c5/p/1oy8AgPPsa/2uAADQc/L/ADBQvvvBB8nSOMief73y8c72evXjqyul2nqxsr1cXK5ubRZXq9XV9Jk9laddr1ytbn7/fmzfnP76Zq0+W9vZvV6pbm/Ur6fP9b5eKqRn7fWgZQBAN6+8cfcvuWREfm88XaJtLodCX2sGvGj5flcA6JuhflcA6BuzfcHgOsV7fOkBuCA6TNH7mLFOXxDywFD4RLv8mSP5///K/8OgaMv/+ytgGDDy/zC45P9hcDUauZPO+R8nPREAON/k+IEun/+/mq1/m3048MOVo2fcOdHlfbYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAhdSa/7eYzQU+Gfl8sRjxUkRMRyF3Y61cmouIlyPiz6OF0WR/vs91BgBOK38/l83/dXnq7cnHil6/dLg5EhE//uWHv7i5VK9v/SliJPfP0dbx+p3s+MIxYRovrgUAwPFa43S6bnsj/3D/1nJr6WV9HnyzOTtoEvdgfyQODuMPx3C6HotCREz8K5ftN+XachensXc7Ij7dqf25mExzIM2pS4/GT2K/1NP4+cfi59Oy5jr5WXzqDOoCg+Zu0v+83+n+y8dMuu58/4+lPdTpZf1fcqnlg7QPfBS/1f8Nden/Zh7tjh8b46t/+Ha30x7cjvjscEQr9kFb/9OKn+sS/+0TtvGvn3v9zW5ljV9FXI7O8dtjzdYrm7O1nd2ra5Wl1dJqaWNhYXF+ce7da+8szKY56tnuo8Hf37vycreypP0TXeKPPaX9Xzxh+3/9v49+8IVj4n/5rU7x8/HaMfGTMfFLJ4y/NPG7rvNvJ/FXurT/ab//KyeMf+9vu09MGw4A9E9tZ3d9qVwubdmwcf43kn+yLzbEzHO//Bu9+iGMROein73VvKePFDUazY3b8UyxuvUYZ5F1A86Dw5s+Iv7T78oAAAAAAAAAAAAAAAAd9eIbS/1uIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABfX/wMAAP//B0flCg==") quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000000a40)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000a80)={0x2, 0x91, 0x3, 0xb, 0x6, 0x8, 0xf, 0x4, 0xfffffffd}) capset(&(0x7f0000000b00)={0x20080522}, &(0x7f0000000b40)={0x0, 0x0, 0x40013, 0x0, 0x1}) symlinkat(&(0x7f0000000b80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000cc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 1.123999063s ago: executing program 2 (id=17): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x40) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="440000001000010500000000fbdbdf2500000000", @ANYRES32=r2, @ANYBLOB="0000000000000000240012800900010069706970000000001400028008000100b534e0155780d4d0d7eb09a2da87"], 0x44}}, 0x40848c0) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newlink={0x34, 0x10, 0x401, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, 0x12e1b, 0x1a001}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x4}}}]}, 0x34}}, 0x20004000) 924.823997ms ago: executing program 3 (id=18): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000040)) 819.99998ms ago: executing program 2 (id=19): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000002b80)=0x46c, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000002bc0)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f0000002c00)="09000000e70014000000d97b786ae7f69bf079aa060088a800a888a8009988a8", 0x20, 0x0, &(0x7f0000002c40)={0x11, 0x8100, r1, 0x1, 0xc, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}}, 0x14) 807.08532ms ago: executing program 2 (id=20): openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000040), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="0500000008000000ed00000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="03"], 0x48}, 0x1, 0x0, 0x0, 0x2000c014}, 0x800) sendmsg$can_bcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x200008c1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000240)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000280)={&(0x7f00000002c0)={0x1d, r1}, 0x10, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYRES64=r0], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8001) 795.533311ms ago: executing program 2 (id=21): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000004a00030000200000000000000a008000", @ANYRES32=0x0, @ANYBLOB="0800000014000100ff"], 0x30}, 0x1, 0x0, 0x0, 0x44090}, 0x900) 777.712371ms ago: executing program 2 (id=22): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x16, 0x13, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000020000000000000000000000180100002020752600000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000f50b000085000000060000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000840)={r0, 0x0, 0x10, 0x38, &(0x7f00000008c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000900)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 758.088461ms ago: executing program 1 (id=23): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1800403, &(0x7f0000000080)={[{@noload}]}, 0x0, 0x5e5, &(0x7f00000000c0)="$eJzs3c1vVFUbAPDn3k4Lpe/7ti8xKi5MoyGQKC0tYPBjAXtC8GPnxkoLQcpHaI0WTSwJbkyMGxckrlyI/4US3boyunDhxpUhQWNIDMboNXd6ZxjamXZaZnqx8/slw9xzzsycc0ufnnPPPXduAD1rNP8njdgVEReTiOGGskoUhaNLr7v927sn80cSWfbyr0kkRV7t9UnxPFS8+a/hiG+/SmJn38p65xYun52anZ25VKTH589dHJ9buLzvzLmp0zOnZ85PPjN5+NDBQ4cn9t/X/qUN28euvvHW8AfHX/3skz+Tic9/PJ7Ekfjl1FJZ4350ymiMxp0se295fv5zPdzpykrSV/89uStZnsEDq1LESH9EPBLD0dfwvzkc779YauOArsqSiAzoUYn4hx5VGwfUju3bOw5OuzwqATbDraNRPfpfGf+VpbnBGKnODexe9r4mU3obktfxzdfHr+aPaDkPt71DtQGNFq9sK7aWx39Sjc2RIvZ23E7vmefNRwAniuc8/6UN1j+6LN2NeXigucUrEfFos/H/2vH/WkP8v77B+sU/AAAAAAAAdM6NoxHxdLPzf2lxbm57PFE9/5csnf/7/u4Vgkc6UP/a5//Smx2oBmji1tGIF5qu/62v8R3pK1L/XVoNmJw6MzuzPyL+FxF7o39bnp5YpY59H+681qqscf1f/sjrr60FLNpxs7Lt3vdMT81P3c8+A0tuXYl4rNJ6/U/e/yeN/X8h/3twsc06du6+fqJV2drxD3RL9mnEnqb9f1J/TbL693OMV8cD47VRwUqPv/PRF63qF/9Qnrz/37F6/I8kjd/XM7e+zx+IiAMLlaxV+UbH/wPJK321z8+9PTU/f2kiYiA5tjJ/cn1thq2qFg+1eMnjf++Tq8//1cf/DXE4GBGLbdb58N9DP7UqG43Iio/V/8Mmy+N/ukn/P9iy/1//xuT1kS9b1d9e/3+w2qfvLXLM/8Hq2g3QstsJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP9GaUT8J5J0rL6dpmNjEUMR8VDsSGcvzM0/derCm+en87Lq/f/T2p1+h5fSSe3+/yMN6cll6QMR8f+I+LhvsJoeO3lhdrrsnQcAAAAAAAAAAAAAAAAAAIAHxFCL6/9zP/eV3Tqg6yrFs3iH3lMpuwFAacQ/9C7xD71L/EPvaiP+72xGO4DNt8H+3+kC2AKM/6FX9bf3su3dbgdQBv0/AAAAAABsKTeef/ZaEhGLzw1WH7mBoqx+YnCwrNYB3ZSW3QCgNNbwQu+y9Ad6V5uLf4EtLKlv/ZE1K2+9+j/pToMAAAAAAAAAAAAAgBX27Lrxw5rX/wNbUhpxpOw2AOVw/T/0Ltf/Q+9qcYzvmAB6yFpX8W/o+n+3DAQAAAAAAAAAAACAjppbuHx2qnYT8KnZ2ZlL1RwbW3Tju9+zbF3vyrLyfjf6I6L0n1gpGwON4bkZlUbE4oocAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADggfBPAAAA//9wQh8o") prlimit64(0x0, 0xe, &(0x7f0000000800)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000840)=0x8) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000a00)='./sys\x00', &(0x7f0000000ac0)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000e40)='./file0\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000e80)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000ec0)='./file0\x00', 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f0000000d80)='./sys/class/ptp/ptp0/n_vclocks\x00', 0x2, 0x0) write(r0, &(0x7f0000000dc0)='1', 0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000880)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000008c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000900)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000940)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000009c0), 0x318, 0x0) recvmmsg(r2, &(0x7f0000000a00), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000a40)=0x2) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="02000000040000"], 0x50) socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b00)={0x1b, 0x0, 0x0, 0x40000, 0x0, r4, 0xfff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x15, 0x1c, &(0x7f0000000c40)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xbda}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6, 0x2, 0x0, r4}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000d40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = syz_create_resource$futex(&(0x7f00000007c0)=0x1) futex(r6, 0x9, 0x1, 0x0, 0x0, 0x1) futex(r6, 0x5, 0x80000008, 0x0, r6, 0x4000000) r7 = openat$dir(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x0, 0x0) getdents64(r7, &(0x7f0000000700)=""/174, 0xff56) 746.927642ms ago: executing program 3 (id=24): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000040)='sec\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r0, &(0x7f0000000340)='27', 0x2) r1 = syz_open_dev$usbfs(&(0x7f0000000380), 0x74, 0x160341) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f00000003c0)) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000400)=@usbdevfs_connect) 678.108173ms ago: executing program 4 (id=25): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x14, &(0x7f0000000340)=ANY=[@ANYBLOB="620ad0ff45002c00620ad4ff00000000620ad8ff40060000620adcff7f000001620ae0ff7f000001620ae4ff12345678620ae8ff15223344620aecff00000000620af0ff60021000620af4ff00000000620af8ff1c0405b4620afcff00000000bfa100000000000007010000d0ffffffbfa200000000000007020000e4ffffffb70300001800000085000000cc000000b70000000200000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0x0, 0x22, 0x0, &(0x7f00000004c0)="00000000000100000000000208004500002800000000400600007f0000017f000001", 0x0, 0x4d08d857, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 423.97687ms ago: executing program 0 (id=26): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a23e00f9e505bbc964a0d3880bf0104a0a0a2f0d311efee16c7e85a0125b38f961918f99bf9c2c146e42327f178dc2b3ca936e7f7fff01f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853a0e9885cefbfca3f27cc", 0xffffffffffffff13, 0x40045, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000022c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000002d40)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffff87}, &(0x7f0000003d40)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000003d80)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f0000003dc0)=0x40) 396.14832ms ago: executing program 4 (id=27): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x38}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r0, 0x0, 0x0, 0x2400c806, &(0x7f0000000180)={0x2, 0x4e21, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x4004084, 0x0, 0x0) 301.015933ms ago: executing program 0 (id=28): r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f00000000c0)=[{{&(0x7f0000000100)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000680)=[@ip_retopts={{0x10, 0x0, 0x34}}], 0x10}}], 0x1, 0x20004850) 281.355013ms ago: executing program 4 (id=29): r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r0, 0x28, 0x8016, 0x0, &(0x7f0000000080)) 280.652833ms ago: executing program 3 (id=30): sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200c4011}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000080)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0xe22, 0x0, @empty, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000140), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000180)=@gcm_256={{0x304, 0x36}, "00001f880000dbaa", "a504eb69a751e9d7e9fb434d1665e900000000ffffff7f00", '\x00\t\x00', "a3df08cf1f5ef48d"}, 0x38) setsockopt$inet6_tcp_int(r0, 0x6, 0x17, &(0x7f00000001c0)=0x8, 0x4) 204.350895ms ago: executing program 4 (id=31): syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000200)='./bus\x00', 0x2000844, &(0x7f00000006c0)={[{@fat=@gid={'gid', 0x3d, 0xee00}}, {@dots}, {@dots}, {@fat=@errors_continue}, {@fat=@debug}, {@nodots}, {@fat=@quiet}, {@fat=@nocase}, {@fat=@discard}, {@fat=@tz_utc}, {@dots}, {@fat=@usefree}, {@dots}, {@dots}, {@nodots}, {@nodots}]}, 0x1, 0x23d, &(0x7f0000000300)="$eJzs3cFqE0EcBvB/27Td9mLP4mHBi6eivkGQCOKCENmDnlyoXloR0svqKY/hM/hIPkZPva3YXZq6UQ+yySbu7wdhP/IxMHPJ5DCTvHvw8fzs0+WH6vvXSJI0RhHzuI44id3Yi9pO89y9yQdx1zwAgG0znRbjvudAh3aW3jmKiGI/Ig6XqvzbmmYFAAAAAAAAAABAx5z/B4Dhcf7//zebjYvj5vvbr5z/BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPpzXVX3qr+8+p4fANA9+z8ADI/9HwCGx/4PAMPz+s3bl+Msm0zTNIm4mpd5mdfPun/+Ips8Tm+cLEZdlWW+3+Rs8qTu03Z/3Ix/+tv+IB49rPuf3bNXWas/jLNVLx4AAAAAAAAAAAAAAAAAAAA2xGl6q3W/f6/uT//U1+nO7wO07u+P4v5obcsAAAAAAAAAAAAAAAAAAACArXb5+ct5cXHxfiYIt+Eo/mFUEpsxeaGT0PcnEwAAAAAAAAAAAAAAAAAADM/i0m/fMwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/iz+/391oe81AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMPwIwAA//++jJCI") r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mountinfo\x00') lseek(r0, 0x9d2, 0x0) 204.142145ms ago: executing program 0 (id=32): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@migrate={0xac, 0x21, 0x1, 0x70bd28, 0x25dfdbfc, {{@in=@multicast2, @in=@dev={0xac, 0x14, 0x14, 0x2a}, 0x4e20, 0x8, 0x4e20, 0x0, 0x2, 0x80, 0x80, 0x2e}, 0x6e6bb5}, [@migrate={0x50, 0x11, [{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@mcast2, @in6=@private0, @in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xe}}, 0x32, 0x1, 0x0, 0x34ff, 0xa, 0xa}]}, @policy_type={0xa, 0x10, {0x1}}]}, 0xac}, 0x1, 0x0, 0x0, 0x8048044}, 0x4040) 46.875169ms ago: executing program 3 (id=33): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x14, 0x17, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0xfffc}}, 0x14}, 0x1, 0x0, 0x0, 0x20048005}, 0x40000) 46.536909ms ago: executing program 0 (id=34): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000001c0), r0) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x28, r1, 0x1, 0x400000, 0xfffffffc, {}, [@NLBL_MGMT_A_DOMAIN={0xa, 0x1, '$\x93~\x00\n@'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}]}, 0x28}}, 0x2404c0c0) 9.65171ms ago: executing program 2 (id=35): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x54}, 0x1, 0x0, 0x0, 0x90}, 0x0) 0s ago: executing program 3 (id=36): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001480)='net/arp\x00') preadv(r0, &(0x7f00000014c0)=[{&(0x7f0000001500)=""/119, 0x77}], 0x1, 0x4000ffe, 0x0) 0s ago: executing program 0 (id=37): r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='.\x00', 0x40000, 0x0) fcntl$notify(r0, 0x402, 0x24) mknod(&(0x7f0000000200)='./bus\x00', 0x1000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x8042, 0x20) write(r1, &(0x7f0000000e00)='of', 0x2) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 14.314471][ T28] kauditd_printk_skb: 31 callbacks suppressed [ 14.314486][ T28] audit: type=1400 audit(1792039429.545:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.319667][ T28] audit: type=1400 audit(1792039429.545:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.324187][ T28] audit: type=1400 audit(1792039429.555:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[14519]" dev="pipefs" ino=14519 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.327846][ T28] audit: type=1400 audit(1792039429.555:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.331184][ T28] audit: type=1400 audit(1792039429.555:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.713489][ T232] scp (232) used greatest stack depth: 22216 bytes left Warning: Permanently added '10.128.1.50' (ED25519) to the list of known hosts. [ 23.337019][ T28] audit: type=1400 audit(1792039438.565:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.340549][ T278] cgroup: Unknown subsys name 'net' [ 23.359737][ T28] audit: type=1400 audit(1792039438.565:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.387022][ T28] audit: type=1400 audit(1792039438.595:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.387451][ T278] cgroup: Unknown subsys name 'devices' [ 23.531769][ T278] cgroup: Unknown subsys name 'hugetlb' [ 23.537414][ T278] cgroup: Unknown subsys name 'rlimit' [ 23.682783][ T28] audit: type=1400 audit(1792039438.915:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.706031][ T28] audit: type=1400 audit(1792039438.915:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.730859][ T28] audit: type=1400 audit(1792039438.915:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.798781][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.807813][ T28] audit: type=1400 audit(1792039439.035:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.833279][ T28] audit: type=1400 audit(1792039439.035:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.848437][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.859220][ T28] audit: type=1400 audit(1792039439.065:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.893844][ T28] audit: type=1400 audit(1792039439.065:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.175524][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.182721][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.190332][ T286] device bridge_slave_0 entered promiscuous mode [ 25.197503][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.204609][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.212160][ T286] device bridge_slave_1 entered promiscuous mode [ 25.230218][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.237293][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.244860][ T288] device bridge_slave_0 entered promiscuous mode [ 25.255421][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.262549][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.269998][ T288] device bridge_slave_1 entered promiscuous mode [ 25.279842][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.286910][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.294429][ T287] device bridge_slave_0 entered promiscuous mode [ 25.303202][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.310310][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.317833][ T287] device bridge_slave_1 entered promiscuous mode [ 25.345334][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.352418][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.359938][ T290] device bridge_slave_0 entered promiscuous mode [ 25.380829][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.387907][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.395467][ T290] device bridge_slave_1 entered promiscuous mode [ 25.499617][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.506710][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.514377][ T289] device bridge_slave_0 entered promiscuous mode [ 25.521617][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.528674][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.536425][ T289] device bridge_slave_1 entered promiscuous mode [ 25.635591][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.642779][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.650113][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.657154][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.667088][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.674180][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.681505][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.688549][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.750694][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.757782][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.765112][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.772255][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.800966][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.808794][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.816748][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.824483][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.832957][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.841316][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.848516][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.857192][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.864842][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.891858][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.900138][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.907178][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.914807][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.923695][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.931990][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.939027][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.946551][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.970757][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.987984][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.015441][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.023366][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.045474][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.053216][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.061627][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.070360][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.078582][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.085656][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.093307][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.101891][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.110244][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.117275][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.124734][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.133164][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.140260][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.148108][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 26.155931][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 26.164487][ T288] device veth0_vlan entered promiscuous mode [ 26.177632][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.185319][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.193156][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.202059][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.210566][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.217616][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.225406][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.233814][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.242262][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.249299][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.256834][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.265454][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.273792][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.280855][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.291504][ T287] device veth0_vlan entered promiscuous mode [ 26.302807][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.310898][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.319134][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.326869][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.337943][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.346742][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.362048][ T287] device veth1_macvtap entered promiscuous mode [ 26.371398][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.379210][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.387559][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.396009][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.404502][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.412778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.420944][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.449636][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.457956][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.466269][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.474892][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.483879][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.492136][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.500278][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.508522][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.517081][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.525357][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.543696][ T290] device veth0_vlan entered promiscuous mode [ 26.553802][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.563080][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.571567][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.572151][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 26.582652][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.595807][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.604118][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.613053][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.620911][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.629223][ T288] device veth1_macvtap entered promiscuous mode [ 26.639299][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.647542][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.656141][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.670899][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.679573][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.692706][ T286] device veth0_vlan entered promiscuous mode [ 26.704399][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.712840][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.721172][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.730378][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.738778][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.747343][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.756067][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.763766][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.773920][ T312] device-mapper: ioctl: Invalid ioctl structure: name t, dev fc00 [ 26.778530][ T289] device veth0_vlan entered promiscuous mode [ 26.793198][ T290] device veth1_macvtap entered promiscuous mode [ 26.800541][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.808667][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.817129][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.825518][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.834089][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.842125][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.849904][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.862805][ T286] device veth1_macvtap entered promiscuous mode [ 26.875307][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.884045][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.892559][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.901016][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.909550][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.928117][ T289] device veth1_macvtap entered promiscuous mode [ 26.938548][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.947462][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.956282][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.965374][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.974724][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.983175][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.992024][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.017076][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.026585][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.038108][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.047620][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.102102][ T321] random: crng reseeded on system resumption [ 27.127080][ T326] loop1: detected capacity change from 0 to 1024 [ 27.149039][ T326] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 27.164485][ T326] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (30349!=20869) [ 27.176700][ T326] EXT4-fs (loop1): invalid journal inode [ 27.182808][ T326] EXT4-fs (loop1): can't get journal size [ 27.191074][ T326] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 27.218890][ T333] loop4: detected capacity change from 0 to 1024 [ 27.245649][ T330] loop2: detected capacity change from 0 to 8192 [ 27.318455][ T333] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 27.466339][ T333] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 27.526060][ T348] loop2: detected capacity change from 0 to 128 [ 27.575332][ T353] loop3: detected capacity change from 0 to 512 [ 27.584981][ T353] EXT4-fs: Ignoring removed nobh option [ 27.640247][ T358] netlink: 64 bytes leftover after parsing attributes in process `syz.2.16'. [ 27.640721][ T353] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 27.658267][ T353] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 27.677896][ T360] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17'. [ 28.007920][ T287] EXT4-fs (loop3): unmounting filesystem. [ 28.036111][ T289] EXT4-fs (loop1): unmounting filesystem. [ 28.091393][ T373] FAULT_INJECTION: forcing a failure. [ 28.091393][ T373] name fail_futex, interval 1, probability 0, space 0, times 1 [ 28.117699][ T373] CPU: 1 PID: 373 Comm: syz.3.24 Not tainted syzkaller #0 [ 28.124884][ T373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 28.134999][ T373] Call Trace: [ 28.138312][ T373] [ 28.141282][ T373] __dump_stack+0x21/0x24 [ 28.145693][ T373] dump_stack_lvl+0x110/0x170 [ 28.150435][ T373] ? __cfi_dump_stack_lvl+0x8/0x8 [ 28.155518][ T373] dump_stack+0x15/0x24 [ 28.159726][ T373] should_fail_ex+0x3bf/0x510 [ 28.164456][ T373] should_fail+0xb/0x10 [ 28.168655][ T373] get_futex_key+0x143/0xb10 [ 28.173309][ T373] ? __kmem_cache_free+0xb7/0x1b0 [ 28.178486][ T373] ? __cfi_get_futex_key+0x10/0x10 [ 28.181089][ T290] EXT4-fs (loop4): unmounting filesystem. [ 28.183654][ T373] futex_wake+0x150/0x8e0 [ 28.193732][ T373] ? __cfi_futex_wake+0x10/0x10 [ 28.198627][ T373] ? device_release_driver+0x19/0x20 [ 28.203976][ T373] ? ktime_get_coarse_real_ts64+0x10f/0x120 [ 28.209916][ T373] do_futex+0x2bf/0x430 [ 28.214122][ T373] ? __cfi_current_time+0x10/0x10 [ 28.219194][ T373] ? __cfi_do_futex+0x10/0x10 [ 28.223957][ T373] __se_sys_futex+0x136/0x310 [ 28.228681][ T373] ? __x64_sys_futex+0x100/0x100 [ 28.233660][ T373] ? xfd_validate_state+0x70/0x150 [ 28.238867][ T373] ? __kasan_check_write+0x14/0x20 [ 28.241173][ T375] loop1: detected capacity change from 0 to 1024 [ 28.244023][ T373] __x64_sys_futex+0xe5/0x100 [ 28.244053][ T373] x64_sys_call+0x7ec/0x9a0 [ 28.259602][ T373] do_syscall_64+0x4c/0xa0 [ 28.264169][ T373] ? clear_bhb_loop+0x30/0x80 [ 28.268901][ T373] ? clear_bhb_loop+0x30/0x80 [ 28.274038][ T373] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.280085][ T373] RIP: 0033:0x7f289859e559 [ 28.284568][ T373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.304218][ T373] RSP: 002b:00007f28995270e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 28.312227][ T375] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 28.312705][ T373] RAX: ffffffffffffffda RBX: 00007f2898825fa8 RCX: 00007f289859e559 [ 28.331568][ T373] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f2898825fac [ 28.339585][ T373] RBP: 00007f2898825fa0 R08: 000338097727b2ca R09: 0000000000000000 [ 28.347608][ T373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.355626][ T373] R13: 00007f2898826038 R14: 00007ffcddfea120 R15: 00007ffcddfea208 [ 28.363647][ T373] [ 28.372335][ T375] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (30349!=20869) [ 28.390051][ T375] EXT4-fs (loop1): invalid journal inode [ 28.395777][ T375] EXT4-fs (loop1): can't get journal size [ 28.408781][ T375] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 28.418657][ T373] hub 6-0:1.0: USB hub found [ 28.420134][ T28] kauditd_printk_skb: 65 callbacks suppressed [ 28.420175][ T28] audit: type=1400 audit(1792039443.655:137): avc: denied { map } for pid=378 comm="syz.0.26" path="socket:[15330]" dev="sockfs" ino=15330 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 28.423722][ T373] hub 6-0:1.0: 1 port detected [ 28.468954][ T28] audit: type=1400 audit(1792039443.695:138): avc: denied { mount } for pid=374 comm="syz.1.23" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 28.501680][ T375] ptp ptp0: new virtual clock ptp1 [ 28.506865][ T375] ptp ptp0: guarantee physical clock free running [ 28.523518][ T28] audit: type=1400 audit(1792039443.755:139): avc: denied { create } for pid=386 comm="syz.4.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 28.556498][ T390] loop4: detected capacity change from 0 to 512 [ 28.574880][ T390] ======================================================= [ 28.574880][ T390] WARNING: The mand mount option has been deprecated and [ 28.574880][ T390] and is ignored by this kernel. Remove the mand [ 28.574880][ T390] option from the mount to silence this warning. [ 28.574880][ T390] ======================================================= [ 28.610086][ T28] audit: type=1400 audit(1792039443.755:140): avc: denied { getopt } for pid=386 comm="syz.4.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 28.630467][ T391] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 37: comm syz.1.23: path /1/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 28.653827][ T391] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 3: comm syz.1.23: path /1/file0: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=511, rec_len=65535, size=1024 fake=0 [ 28.673902][ T28] audit: type=1400 audit(1792039443.885:141): avc: denied { create } for pid=394 comm="syz.0.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.694079][ T28] audit: type=1400 audit(1792039443.885:142): avc: denied { write } for pid=394 comm="syz.0.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.716204][ T28] audit: type=1400 audit(1792039443.885:143): avc: denied { nlmsg_write } for pid=394 comm="syz.0.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.737793][ T390] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 28.747387][ T28] audit: type=1400 audit(1792039443.975:144): avc: denied { read } for pid=396 comm="syz.0.34" dev="nsfs" ino=4026532319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 28.775681][ T28] audit: type=1400 audit(1792039444.005:145): avc: denied { open } for pid=396 comm="syz.0.34" path="net:[4026532319]" dev="nsfs" ino=4026532319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 28.806341][ T28] audit: type=1400 audit(1792039444.005:146): avc: denied { create } for pid=396 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.860511][ T405] ================================================================== [ 28.868639][ T405] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 28.876338][ T405] Write of size 8 at addr ffff888113b88190 by task syz.0.37/405 [ 28.883985][ T405] [ 28.886349][ T405] CPU: 0 PID: 405 Comm: syz.0.37 Not tainted syzkaller #0 [ 28.893494][ T405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 28.903562][ T405] Call Trace: [ 28.906862][ T405] [ 28.909803][ T405] __dump_stack+0x21/0x24 [ 28.914163][ T405] dump_stack_lvl+0x110/0x170 [ 28.918888][ T405] ? __cfi_dump_stack_lvl+0x8/0x8 [ 28.923948][ T405] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 28.929253][ T405] print_address_description+0x71/0x200 [ 28.934820][ T405] print_report+0x4a/0x60 [ 28.939278][ T405] kasan_report+0x122/0x150 [ 28.943811][ T405] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 28.949111][ T405] __asan_report_store8_noabort+0x17/0x20 [ 28.954859][ T405] rcu_segcblist_enqueue+0x9c/0xb0 [ 28.959998][ T405] call_rcu+0x554/0xf50 [ 28.964172][ T405] ? __cfi_call_rcu+0x10/0x10 [ 28.968874][ T405] free_pid+0x248/0x260 [ 28.973070][ T405] detach_pid+0x258/0x2c0 [ 28.977505][ T405] release_task+0x905/0x1200 [ 28.982120][ T405] do_exit+0x1a34/0x29f0 [ 28.986415][ T405] ? __cfi_do_exit+0x10/0x10 [ 28.991025][ T405] ? plist_check_list+0x255/0x270 [ 28.996060][ T405] ? _raw_spin_lock+0x94/0xf0 [ 29.000772][ T405] ? __kasan_check_write+0x14/0x20 [ 29.005896][ T405] ? _raw_spin_lock_irq+0x95/0xf0 [ 29.010959][ T405] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 29.016547][ T405] do_group_exit+0x21b/0x2e0 [ 29.021162][ T405] ? __kasan_check_write+0x14/0x20 [ 29.026286][ T405] ? recalc_sigpending+0x168/0x1c0 [ 29.031416][ T405] get_signal+0x167c/0x1700 [ 29.035945][ T405] ? __cfi_get_signal+0x10/0x10 [ 29.040816][ T405] arch_do_signal_or_restart+0xd1/0x11c0 [ 29.046475][ T405] ? do_futex+0x2e2/0x430 [ 29.050937][ T405] ? __cfi_do_futex+0x10/0x10 [ 29.055631][ T405] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 29.061806][ T405] ? __se_sys_futex+0x136/0x310 [ 29.066672][ T405] ? __cfi_ksys_write+0x10/0x10 [ 29.071544][ T405] exit_to_user_mode_loop+0x7a/0xb0 [ 29.076764][ T405] exit_to_user_mode_prepare+0x87/0xd0 [ 29.082239][ T405] syscall_exit_to_user_mode+0x1a/0x30 [ 29.087717][ T405] do_syscall_64+0x58/0xa0 [ 29.092152][ T405] ? clear_bhb_loop+0x30/0x80 [ 29.096864][ T405] ? clear_bhb_loop+0x30/0x80 [ 29.101589][ T405] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.107523][ T405] RIP: 0033:0x7f084379e559 [ 29.111958][ T405] Code: Unable to access opcode bytes at 0x7f084379e52f. [ 29.118985][ T405] RSP: 002b:00007f08421f70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 29.127410][ T405] RAX: fffffffffffffe00 RBX: 00007f0843a25fa8 RCX: 00007f084379e559 [ 29.135399][ T405] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0843a25fa8 [ 29.143383][ T405] RBP: 00007f0843a25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 29.151371][ T405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.159353][ T405] R13: 00007f0843a26038 R14: 00007ffe0b866a40 R15: 00007ffe0b866b28 [ 29.167345][ T405] [ 29.170381][ T405] [ 29.172717][ T405] Allocated by task 408: [ 29.176971][ T405] kasan_set_track+0x4b/0x70 [ 29.181606][ T405] kasan_save_alloc_info+0x1f/0x30 [ 29.186729][ T405] __kasan_kmalloc+0x95/0xb0 [ 29.191338][ T405] __kmalloc+0xb4/0x1e0 [ 29.195501][ T405] l2tp_session_create+0x38/0xbd0 [ 29.200547][ T405] pppol2tp_connect+0xbf5/0x1640 [ 29.205510][ T405] __sys_connect+0x3da/0x460 [ 29.210120][ T405] __x64_sys_connect+0x7a/0x90 [ 29.214900][ T405] x64_sys_call+0x88d/0x9a0 [ 29.219420][ T405] do_syscall_64+0x4c/0xa0 [ 29.223897][ T405] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.229808][ T405] [ 29.232140][ T405] Freed by task 8: [ 29.235866][ T405] kasan_set_track+0x4b/0x70 [ 29.240475][ T405] kasan_save_free_info+0x2b/0x40 [ 29.245517][ T405] ____kasan_slab_free+0x132/0x180 [ 29.250675][ T405] __kasan_slab_free+0x11/0x20 [ 29.255458][ T405] slab_free_freelist_hook+0xc2/0x190 [ 29.260847][ T405] __kmem_cache_free+0xb7/0x1b0 [ 29.265720][ T405] kfree+0x6f/0xf0 [ 29.269456][ T405] l2tp_session_put+0xaf/0x1a0 [ 29.274237][ T405] l2tp_session_delete+0x3df/0x4d0 [ 29.279416][ T405] l2tp_tunnel_del_work+0x199/0x410 [ 29.284637][ T405] process_one_work+0x717/0xc30 [ 29.289496][ T405] worker_thread+0xa4d/0x11d0 [ 29.294280][ T405] kthread+0x281/0x320 [ 29.298364][ T405] ret_from_fork+0x1f/0x30 [ 29.302823][ T405] [ 29.305162][ T405] Last potentially related work creation: [ 29.310908][ T405] kasan_save_stack+0x3a/0x60 [ 29.315602][ T405] __kasan_record_aux_stack+0xb6/0xc0 [ 29.320992][ T405] kasan_record_aux_stack_noalloc+0xb/0x10 [ 29.326812][ T405] call_rcu+0xcf/0xf50 [ 29.330920][ T405] pppol2tp_release+0x1e3/0x2b0 [ 29.335788][ T405] sock_close+0xc9/0x220 [ 29.340049][ T405] __fput+0x1fd/0x8f0 [ 29.344046][ T405] ____fput+0x15/0x20 [ 29.348071][ T405] task_work_run+0x1e1/0x250 [ 29.352675][ T405] exit_to_user_mode_loop+0x9b/0xb0 [ 29.357885][ T405] exit_to_user_mode_prepare+0x87/0xd0 [ 29.363356][ T405] syscall_exit_to_user_mode+0x1a/0x30 [ 29.368830][ T405] do_syscall_64+0x58/0xa0 [ 29.373271][ T405] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.379268][ T405] [ 29.381614][ T405] The buggy address belongs to the object at ffff888113b88000 [ 29.381614][ T405] which belongs to the cache kmalloc-512 of size 512 [ 29.395677][ T405] The buggy address is located 400 bytes inside of [ 29.395677][ T405] 512-byte region [ffff888113b88000, ffff888113b88200) [ 29.408963][ T405] [ 29.411322][ T405] The buggy address belongs to the physical page: [ 29.417759][ T405] page:ffffea00044ee200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113b88 [ 29.428017][ T405] head:ffffea00044ee200 order:2 compound_mapcount:0 compound_pincount:0 [ 29.436354][ T405] flags: 0x4000000000010200(slab|head|zone=1) [ 29.442454][ T405] raw: 4000000000010200 ffffea00044ee000 dead000000000003 ffff888100042f00 [ 29.451048][ T405] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 29.459638][ T405] page dumped because: kasan: bad access detected [ 29.466262][ T405] page_owner tracks the page as allocated [ 29.471984][ T405] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 116, tgid 116 (udevd), ts 6211662270, free_ts 0 [ 29.491705][ T405] post_alloc_hook+0x1f5/0x210 [ 29.496501][ T405] prep_new_page+0x1c/0x110 [ 29.501028][ T405] get_page_from_freelist+0x2ca9/0x2d20 [ 29.506646][ T405] __alloc_pages+0x1fa/0x610 [ 29.511257][ T405] alloc_slab_page+0x6e/0xf0 [ 29.515865][ T405] new_slab+0x98/0x3e0 [ 29.519943][ T405] ___slab_alloc+0x70f/0xb70 [ 29.524637][ T405] __slab_alloc+0x5e/0xa0 [ 29.529019][ T405] __kmem_cache_alloc_node+0x204/0x2d0 [ 29.534590][ T405] __kmalloc_node_track_caller+0xa1/0x1e0 [ 29.540353][ T405] __alloc_skb+0x226/0x4a0 [ 29.544786][ T405] alloc_skb_with_frags+0xa8/0x620 [ 29.549912][ T405] sock_alloc_send_pskb+0x87f/0x9a0 [ 29.555131][ T405] unix_dgram_sendmsg+0x5c1/0x1710 [ 29.560281][ T405] sock_write_iter+0x2ea/0x3f0 [ 29.565080][ T405] vfs_write+0x5ef/0xd00 [ 29.569510][ T405] page_owner free stack trace missing [ 29.574895][ T405] [ 29.577226][ T405] Memory state around the buggy address: [ 29.582859][ T405] ffff888113b88080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.590927][ T405] ffff888113b88100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.599006][ T405] >ffff888113b88180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.607077][ T405] ^ [ 29.611671][ T405] ffff888113b88200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.619737][ T405] ffff888113b88280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.627807][ T405] ================================================================== [ 29.635876][ T405] Disabling lock debugging due to kernel taint [ 29.661595][ T289] EXT4-fs (loop1): unmounting filesystem.