last executing test programs: 54.301407125s ago: executing program 0 (id=517): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r1}, 0x10) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20002) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffe, 0x6, 0x0, @buffer={0x2, 0x51, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374c96ee3", 0x0, 0x1, 0x0, 0x0, 0x0}) 54.252406737s ago: executing program 0 (id=519): bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000142020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000e02800850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f00000002c0)='rpm_return_int\x00', r1}, 0x10) syz_open_dev$usbfs(&(0x7f0000000040), 0xf, 0xc340) 54.18526696s ago: executing program 0 (id=520): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xa}, {0xffff, 0xffff}, {0x1a, 0xb}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x3, 0x3, 0x8001, 0x1400}, 0xa5, 0x5, 0xffffffd}}, @TCA_TBF_BURST={0x8, 0x6, 0x8054}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffe0, 0xa}, {0xf, 0x3}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8855}, 0x4004040) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r3, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x70, &(0x7f0000000580)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x0) 54.138153352s ago: executing program 0 (id=522): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0xab101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) umount2(&(0x7f0000000340)='./file0/file0\x00', 0x1) 53.977626969s ago: executing program 0 (id=525): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000edff0000000000000000850000000f00000018010000646c012500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000800000850000000600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f00000002c0)='rxrpc_peer\x00', r0}, 0x18) r1 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=[{0x18, 0x110, 0x1, 'p'}], 0x18}, 0x0) 53.896613873s ago: executing program 0 (id=528): r0 = fsopen(&(0x7f0000000080)='mqueue\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000001d40)='\xd0\x9e^\xa0\xee\xc8\x17T\xb1GI\x90\xe2Q1\xb0\x8f\xe1\xa8\x95\xa0\xcd\fL\xaei\xb6\xb7\xc1Y\xd5YG\xf9\xc2\xf1\xa4\xdb$\xf6]\xab\x1a\xdaY\xfb\x03dhS\x97nZ\xf8\xc6\x1f\x03\x00\x00\x00\x00\x00\x00\x00\x9bg-D#g\x16\xf4\xd9\x00\x00\x00\x00\x00eA\x9f\xc3\x11\x18\xe6\xc5\x95\x9e!^W\xf6\xacE\xa3\xc8\xe7\xec\xd6\xbd\x1c+\n\xc7Q( \xba\xff\x17N\x1fB\x91\x15\x83\xec(B\xc5\x05\x9d\xd6\x02|6\xdc\xee$\xb5\x1deC\xfb\xa2\xaa\xe0#\xcb\xde;sA\xad\xa6\xb6P\xa3\xf7\xc3q\xd4\xb6\x95\x02\xd8*\xa8\xd2\x94\xa3\x89\xa9\xa0\xc5\xc9=\xa5^\x00\x00\x00\x00\x00\x00\x00\x00\x00\xef\xcd\xd3\t\x01A\xd5\x81\xc1;9\xeez\xba\x00\x00\x00\xdc\x94\xff)\xa4\xe6\xfb]\x90bG\x11\b\x98#\xaa99ez|\x8b5\x92\xa5\xba\x96\xb3\xb26I\xbb\xdeb\x95?\xc0\x81', &(0x7f0000000200)='sockfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='\x00', &(0x7f00000001c0)='dE\x00', 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r1, 0x0, 0xfffffffffffffffd}, 0x18) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000280)='\xd0\x9e^\xa0\xee\xc8\x17T\xb1GI\x90\xe2Q1\xb0\x8f\xe1\xa8\x95\xa0\xcd\fL\xf10x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000370400000000ffdbdf2500000000", @ANYRES32=r3, @ANYBLOB="83450500000000002c0012800900010069706970000000001c00028006000f0002000000060011004e2200000800010007"], 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmmsg$inet(r1, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @empty, @dev={0xac, 0x14, 0x14, 0x27}}}}], 0x20}}], 0x1, 0x80) 1.374155709s ago: executing program 3 (id=2214): r0 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) syz_mount_image$iso9660(&(0x7f0000000040), &(0x7f0000000800)='./file0\x00', 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="757466382c626c6f636b3d307830303030303030303030303030323030006e6f726f636b2c63727566742c6d61703d6f66662c646d6f64653d3078303430303030303030303030303063664173657373696f6e3d3078303030303030303030303030303033382c756e686964652c756e686964652c6769643d29e0cd5c372ab078c28fb05c6421428d066455368833565fd726743513f4466efa8d4fba06d57341875f5775ab343c0f6bc59fbde784ec3597e0e286d8d0dbf360afa3bc5c145b6e4f8b0305932fb55ff13f9fcb5035769f5fca33ac02bdeacb24c58103edc3d8b46df7614aa493952584ee662174309b11a4ad19e64dcdeeca1c148170b8d1aaf26082364b0d90d63d8502ffa63dde945e4612ac134315f389af667a04931ad25ff10b9b5107e517dbbcf5dcb60f564f54b344218d9325b53e829c38c96c69adc9e745202923a1b8124333cce0a8f1c748d42a272eb3e5502051090f1ac34fe5e8f038", @ANYRES32=r0, @ANYBLOB="dd99401b1f441a835c3dfe053e0e094515e504b6316f2a67a040e860c8118441fc09df1fd193dfa63fcceb82dbd8c0c71b933214389bdf97fd6c3e72b4b836a0ee9b4d75f459e9e7a400ad5c01c749b8e8c6fc439e19077b742f12af535044eab14e1a16e1ed9b2552408b230507bb3d8db6c4b28f2bc0e55df68ae70f3f51e1a6f9a3931a26f5"], 0x2, 0x699, &(0x7f0000000140)="$eJzs3V9rG9n9x/HPyLIte3+E5dcSQsifk6QLDk2VkbxxMCl01dHInlbSiBm52FBY0o29hMjZNkmh8c3WN/0D2yfQu970og+i0Ot9Fr0pLSztXaE3KnNmJEvRv3ijOLvN+2V2NTrznTnfmaPoy9iaIwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADle1XVLjupBc2fXTOZVo7AxZX26t0XdTBduzuxXcpL/VCjoQtp04Zsnq88n/7uuS+mzSyokDwUdvXP+3XvfyOd6209J6MvQaXf49PnRo/udzv6Tl4hd0Kl3/yYp11taycZkTNCW3wziMGhUtnwTxKHZ3Nhwb2/XYlML6n68F7f9hvEiP9cOI7Pm3TSlzc114xf3wp3mVrVS93uNd79Tdt0N84PldKAlFWNvO6jXg+aWjUlWJzF3zWc/TgP8SsOYg4ed/fVZR5IElV4mqDwrqOyWy6VSuVzauLN5567r5kca3ITj9mkkYu4vWnzNzOeNG5iDXFL//+pIdRXU1I52Zcb+eKoqUqjGhPWZXv1/77Y/td/B+t+r8hek72WrL8rW/yvpsyuT6v+EXIyM3WDcGmdC++l+Fm1GRk/1XEd6pPvqqKN9PZnDvo3M1bns5Qx+tuSrqUCxQgVqqGJbTNZitKkNbcjVh9pWTbGMagpUl69Ye4rVlm9fUZ4i+aqorVCRjNbk6aaMStrUptZl5KuoPYXaUVNbqqqif3e73QM9tOd9fUqO6gWVJgQsDwaVp+xpUv3/yafp6zSr/y71/22Vvg6W04fPp8UAXwHd7Pp/UG72ZldfX0YAAAAAAGDeHPvbd8f+7f6ypK5qQd1333RaAAAAAABgjhx1l3VJTnL9L+myHK7/AQAAAAD4X+PYe+wcSav2Q/3OyZ1QL/NLgIUzSBEAAAAAALwie+f/lSWpayetuCrnVNf/AAAAAADga+A3A3Ps53tz7HZ7f9bPSYpby86f/7msaNE5bu1+yzmsJGsqh1nMyCcA2rWLzrlsol77sCTJPvP8S07WWzYJZn/ewS8OZs3170QvJLC0MLiDCQk4Sc8b+eyZPtO1dJNr2TzzD45ysmvSXlZrQd0vemH9XkmVyrlc299t//zxw19IUf84Dx529osffdJ5YHM5TpqOD5OdfjqUTm78yTjJ5Zmdb8HeczHuiFdU63X522Zj1bH9ur3jX1DlMDfY0bQBOOnzV7qejtn11TR29ag/435y/IXk+EtFO2RDRx8tOidZlF488nEDMSGLgs3iRhpzY+2Gyn9Ll/ujkHMK316QysXRMRjKojyYxexz4fxr5FwMZGEfemsGzsV6ksVfkh1NyGL9dFmMjAgAvCkHuiz7LnRZdhLzfhUqZHW3Vx56b2pfqu7Mru4fDFf3Z7/vdu0GC1I++9vE1F4KSt7R1xxbh5bSQ8pfHPOO7mZ1paAJ7+juK1S3pK8/nXwHUpb2SBb/6Xa790q239+9UFX/MNTdSL9xvbyQnMLbzw5/aifAT3y8//H+43J5fcN933XvlLVoDyN7WBC1BwAwYvZ37MyMcN7XtTTi2oN/vJcuDVW8/+9/pKCoj/SJOnqgW72vELg6fq+rAx9DuJVetWrgqtWcf/ee/V664diSbk28qrO1dCC23I9dVG+T4Up9Erv+mkcBAICzdX1GHR5f/wtD9f+W1tKItYtjr7uHa3l2ddy/pJ8UW5qd/AfzPhsAALwd/OgLZ7X9ayeKgtaHpc3NUqW97Zso9H5ooqC65Zug2fYjb7vS3PJNKwrboRfWTSvSclD1YxPvtFph1Da1MDKtMA527Te/m+yr32O/UWm2Ay9u1f1K7BsvbLYrXttUg9gzrZ3v14N424/sxnHL94Ja4FXaQdg0cbgTeX7RmNj3BwKDqt9sB7UgWWyaVhQ0KtGe+VFY32n4purHXhS02mG6w15fQbMWRg2722K+O+7zAgAAvHWePj96dL/T2X/y4sJKcmmethxrQszowpKePk+uypOWfLaKOYIAAPiKOSngp9io8BoTAgAAAAAAAAAAAAAAAAAAAAAAI2bf0nfKhcVxNwtK/Zafncta9Eud3GI4sh9H807sNAu5027VuyXi6NHnU4JX+i290z8Yc3xmB/j3/5PesS1KW/Lz72tlyuC+joXvHqRndGJMsnLsquX+WOTn/88hWXj8xwmrut1ud/rmy8PncGnaAQ4v5CU9WXqFITj79yIAZ+u/AQAA//9b5DOa") r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xf, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffc, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6b, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00', r2}, 0x10) write$binfmt_script(r0, &(0x7f00000012c0)={'#! ', './file0'}, 0xb) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 1.324656051s ago: executing program 2 (id=2215): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)="d8000000190081084e81f783db4cb9040a07290006007c09e8fc55a10a0015000600142603600e120800020081000401040001162a0d00fcc0ffff000000fd035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbaceac3c2fb14c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775820d16a4683f5a", 0x86}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0x0, 0x0, &(0x7f0000000140)='syzkaller\x00', 0x10, 0x0, 0x0, 0x41000, 0x60, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0x12) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080)) 1.303055132s ago: executing program 2 (id=2217): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r1}, 0x38) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x18, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2, 0x0, 0x2}, 0x18) getresgid(&(0x7f0000000700), &(0x7f0000000880), &(0x7f00000008c0)) 1.292388343s ago: executing program 3 (id=2218): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000740)='scsi_dispatch_cmd_start\x00', r0}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000740)='scsi_dispatch_cmd_start\x00', r1}, 0x10) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 1.216598956s ago: executing program 3 (id=2219): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x4, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_config_ext={0x1, 0x1000ffffffff}, 0x2000, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000005}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) syz_emit_ethernet(0x2e, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @random="e43f6642531e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x1, 0x1, 0x10, 0x0, @void}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x20000000000000ba, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfd71}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x2000, &(0x7f0000000000)='%', 0x0, 0xd01, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1.216412356s ago: executing program 2 (id=2220): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000380)={0xa, 0x14e24}, 0x1c) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @rand_addr, 0x1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000001600)="e4", 0x1}], 0x1}}], 0x1, 0xc8040) sendmmsg(r1, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="5d4d571c86a98aa510e2e8eaa56601506fa731b8912f19144e7cea3ec69250d401aa5b6bbe584c47c460d1fb153c119ce25670a26b2f9905512fba664f8ca79c908577ca", 0x44}], 0x1}}], 0x1, 0x0) splice(r1, 0x0, r0, 0x0, 0x7ffff000, 0x6) 980.586267ms ago: executing program 3 (id=2227): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xd, &(0x7f0000000c80)=ANY=[@ANYBLOB="18000000220000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000021007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1, 0x0, 0xfffffffffffffffc}, 0x18) r2 = socket(0x10, 0x3, 0x6) r3 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x90, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffab}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [], 0x0, [0x4, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x2, 0x2], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}, @TCA_RATE={0x6}]}, 0x90}}, 0x20008010) 980.336397ms ago: executing program 3 (id=2228): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000410"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000000c0)='kmem_cache_free\x00', r1}, 0x18) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f00000000c0)={0x1d, r3, 0x8000000000000002, {0x1, 0xf0}, 0xfd}, 0x18) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)={0x30, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x2, 0xfffffff7, 0xffffffff, 0xff}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) 520.589867ms ago: executing program 5 (id=2246): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000280)='kfree\x00', r1}, 0x18) sendmsg$NL80211_CMD_GET_SCAN(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000005000100070000000900020073797a30000000001400078008001240000000000500150004000000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB="28000000030605000000000000000000000000000500010007"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x20000010) 520.437757ms ago: executing program 5 (id=2247): socket$inet_tcp(0x2, 0x1, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f00000013c0)={0x2, {0x2, 0xa, 0x8, 0x6, 0x3}}) ioctl$TIOCL_SETSEL(r0, 0x541c, 0x0) timer_create(0x0, 0x0, &(0x7f0000bbdffc)=0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a03000000000000000000070000000900010073797a300000000070000000090a010400000000000000000700000008000a40000000020900020073797a31000000000900010073797a30000000000800054000000031340011800a0001006c696d6974000000240002800c000240", @ANYRES16=r1, @ANYRESDEC], 0xb3c}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000200)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x22}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cabf00", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra}}}}}, 0x0) 507.123228ms ago: executing program 5 (id=2249): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x9b00000}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001400ffd9b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000d00)={&(0x7f0000000cc0)='mm_page_alloc\x00', r1}, 0x10) r2 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xd4, 0x1, 0x0, 0x0, 0x0, 0xf, 0x9211, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, @perf_bp={0x0, 0xa}, 0x0, 0x4, 0x0, 0x8, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x11, r2, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8088e3ad132bc192, 0x4002011, r2, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) 481.697869ms ago: executing program 1 (id=2250): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41002, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r0}, 0x18) prlimit64(0x0, 0x9, &(0x7f0000000d80)={0x3, 0x1c88000000}, 0x0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r1) execve(&(0x7f0000000080)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) execve(&(0x7f0000000300)='./file0\x00', &(0x7f0000002200)={[&(0x7f0000000340)='^-%-\\x\\$})\'!&}*', &(0x7f0000000440)='syz0']}, 0x0) 465.00163ms ago: executing program 5 (id=2251): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) setxattr$incfs_size(&(0x7f0000000000)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000080), 0x0, 0x0, 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='kfree\x00', r1}, 0x18) removexattr(&(0x7f0000000340)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000400)=@known='user.incfs.size\x00') 408.681942ms ago: executing program 1 (id=2252): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x4) io_setup(0x2007, &(0x7f0000000980)=0x0) r2 = eventfd2(0x0, 0x0) io_submit(r1, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x1, r2}]) close_range(r2, r2, 0x0) shutdown(r0, 0x0) 408.522412ms ago: executing program 5 (id=2253): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r0, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x400000000000247, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000ec0)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000300)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x2, 0x0) close(r0) 346.300545ms ago: executing program 1 (id=2254): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000008000000020000000400000005"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r1, 0xffffffffffffffff}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='kmem_cache_free\x00', r3}, 0x10) write$cgroup_subtree(r0, 0x0, 0x30) 310.007806ms ago: executing program 5 (id=2255): timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0xc, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) 245.61514ms ago: executing program 1 (id=2257): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000380)='rxrpc_call\x00', r0}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='rxrpc_call\x00', r1}, 0x10) r2 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0xfffc, 0x2, 0x1c, {0xa, 0x4e22, 0x4, @dev}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x20000054) 245.307059ms ago: executing program 1 (id=2259): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4b, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r0}, &(0x7f0000000380), &(0x7f00000005c0)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 245.160209ms ago: executing program 4 (id=2260): r0 = socket(0x28, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) connect$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) connect$vsock_stream(r0, &(0x7f0000000400)={0x28, 0x0, 0x2710, @host}, 0x10) 245.016309ms ago: executing program 4 (id=2261): socket$nl_netfilter(0x10, 0x3, 0xc) socket$key(0xf, 0x3, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_xfrm(0x10, 0x3, 0x6) socket$packet(0x11, 0xa, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 96.657656ms ago: executing program 4 (id=2262): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200a}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') ioctl$TCXONC(r3, 0x540a, 0x3) 83.284097ms ago: executing program 4 (id=2263): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x10, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='mpol=interleave,mpol=local']) open$dir(&(0x7f0000000000)='./file0/file0\x00', 0x101042, 0x1) 46.792998ms ago: executing program 1 (id=2264): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000600)='./file0\x00', 0xc8d0, &(0x7f0000000140)=ANY=[@ANYRES8=0x0], 0x1, 0x30e, &(0x7f0000000f00)="$eJzs3E1rE10UwPGTNEnTlHayeHhEQXrRjW6GNu7FIC2IAUttxBcQp81EQ8akZEIlIrZduXEhfggXpcvuCtov0I07V27cdSO4sAtxJDOTl7aJrWnSWPv/QZlD7j0z9+Y24dyBzPbdN0/zWVvPGmUJRpUERER2ROISlJqAfwy6cUSaLcvl4W+fzt++d/9mMpWanFFqKjl7JaGUGh17/+zFkN9tY1C24g+3vya+bP2/dXb75+yTnK1ytioUy8pQc8XPZWPOMlUmZ+d1paYt07BNlSvYZslrd5ZELFNlreLCQkUZhcxIbKFk2rYyChWVNyuqXFTlUkUZj41cQem6rkZigoOkV2dmjGSHyfNdHgx6pFRKGgMiMrSvJb3alwEBAIC+8uv/erUfrJb0ndT/oZb1/9qFzfLwnfVRv/7fiFTrf5Gm+v9R41ymygTr9X9URBr1f9HbH3S7/t9fEZ1sr3cvjjhOPYy06n+k+h8nRLX+j/mfX9fKg7VxN6D+BwAAAAAAAAAAAAAAAAAAAADgJNhxHM1xHM07DvivOtqgiETdX5B47X0eJnpk9/o3/lj/06Hx4I7QqIj1ajG9mPaOfodNEbHElHHR5If7/+CrxpFl5XZSVXH5YC35+UuLae+7JJmVnJs/IZrE9+Y7ztSN1OSE8uzOD0usOT8hmvzXOj+xNz9cPUbk0sWmfF00+TgvRbEk4/8yrpb/ckKp67dSe64/5PYDAAAAAOBfoKu6+v59sLld39/u7Y+9dm9/HZLW9we8/fV4y/19SM6F+jVrAAAAAABOF7vyPG9YllnqUbAiIj2+RJugNsPDZtUekNumT0AC7Zq6ENQu3ll6dWxdG0/4UO9YsKOhjkX+cFFaBrXbRu36yHQnZ3Y0kaO+h2fevvv++z7enTGRw5zw6nr0gJl2GkQOmmn42L6AAAAAABybRtFfe+VafwcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMApdByP4uv3HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC/xa8AAAD//46ZAFE=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r1, &(0x7f0000000a00)="c7885a8f24f458bed72116", 0xb) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7ffff000) syz_clone(0x4000, &(0x7f00000001c0)="b0c4dc345846be585bf5b5590398bdef9afdcc0aea", 0x15, &(0x7f0000000200), &(0x7f0000000280), &(0x7f0000000640)="309b418c2ff6ecdc2325525eb0f919ed1e740654d86989c6c6078bc1da5e22f1aba91544f7a3d49c85c63c4ecbc0126032a428edf3f02782f9be1f36d8f276bf565a2ae3422f772cb62ad7b776582306ae5c8544501f942375553298fbdf44ff5954bdb9599b50228be204d9fa3a366c83a7") 611.99µs ago: executing program 4 (id=2265): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x1, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x30, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x9, 0x0, 0x0, 0xa}, {}, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x4000) 0s ago: executing program 4 (id=2266): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0xffffffff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x6}, 0x1c) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) bind$inet(r1, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) kernel console output (not intermixed with test programs): 33.440757][ T3315] veth1_macvtap: entered promiscuous mode [ 33.447592][ T31] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.475066][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.495192][ T3320] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.505407][ T31] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.515948][ T3485] process 'syz.3.4' launched './file0' with NULL argv: empty string added [ 33.523832][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.550695][ T3320] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.562151][ T31] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.575594][ T31] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.611270][ T31] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.643437][ T31] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.669378][ T31] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.699194][ T31] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.712954][ T29] kauditd_printk_skb: 35 callbacks suppressed [ 33.712969][ T29] audit: type=1400 audit(1763761026.523:107): avc: denied { open } for pid=3496 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 33.738187][ T29] audit: type=1400 audit(1763761026.523:108): avc: denied { kernel } for pid=3496 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 33.770708][ T31] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.790185][ T31] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.803413][ T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.820838][ T29] audit: type=1400 audit(1763761026.573:109): avc: denied { create } for pid=3501 comm="syz.1.10" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.841250][ T29] audit: type=1400 audit(1763761026.583:110): avc: denied { write } for pid=3496 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 33.860352][ T29] audit: type=1400 audit(1763761026.583:111): avc: denied { write } for pid=3501 comm="syz.1.10" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.880625][ T29] audit: type=1400 audit(1763761026.583:112): avc: denied { read } for pid=3501 comm="syz.1.10" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.900785][ T29] audit: type=1400 audit(1763761026.623:113): avc: denied { create } for pid=3503 comm="syz.1.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 33.921344][ T29] audit: type=1400 audit(1763761026.623:114): avc: denied { write } for pid=3503 comm="syz.1.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 34.037473][ T3513] netlink: 'syz.1.14': attribute type 12 has an invalid length. [ 34.058145][ T3509] syz.4.12 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 34.077454][ T10] hid-generic 0000:3000000:0000.0001: unknown main item tag 0x4 [ 34.085283][ T10] hid-generic 0000:3000000:0000.0001: unknown main item tag 0x2 [ 34.103439][ T29] audit: type=1400 audit(1763761026.883:115): avc: denied { read write } for pid=3510 comm="syz.3.13" name="uhid" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 34.126827][ T29] audit: type=1400 audit(1763761026.883:116): avc: denied { open } for pid=3510 comm="syz.3.13" path="/dev/uhid" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 34.151386][ T10] hid-generic 0000:3000000:0000.0001: unknown main item tag 0x3 [ 34.171541][ T10] hid-generic 0000:3000000:0000.0001: hidraw0: HID v0.00 Device [sy] on syz0 [ 34.221241][ T3517] fido_id[3517]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 34.292656][ T3526] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3526 comm=syz.3.19 [ 34.643684][ T3541] SELinux: ebitmap start bit (7340416) is beyond the end of the bitmap (1472) [ 34.681155][ T3541] SELinux: failed to load policy [ 34.720057][ T3518] Set syz1 is full, maxelem 65536 reached [ 34.728683][ T3547] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 34.731791][ C0] Illegal XDP return value 16128 on prog (id 24) dev lo, expect packet loss! [ 34.755910][ T3549] bridge0: port 3(gretap0) entered blocking state [ 34.762543][ T3549] bridge0: port 3(gretap0) entered disabled state [ 34.769225][ T3549] gretap0: entered allmulticast mode [ 34.775302][ T3549] gretap0: entered promiscuous mode [ 34.780872][ T3549] bridge0: port 3(gretap0) entered blocking state [ 34.787359][ T3549] bridge0: port 3(gretap0) entered forwarding state [ 34.797493][ T3549] gretap0: left allmulticast mode [ 34.802667][ T3549] gretap0: left promiscuous mode [ 34.807854][ T3549] bridge0: port 3(gretap0) entered disabled state [ 34.883476][ C0] hrtimer: interrupt took 27452 ns [ 34.899128][ T3555] Zero length message leads to an empty skb [ 35.035271][ T3566] netlink: 4 bytes leftover after parsing attributes in process `syz.2.37'. [ 35.071357][ T3568] SELinux: Context system_u:object_r:fsadm_exec_t:s0 is not valid (left unmapped). [ 35.106173][ T3422] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 35.121724][ T3422] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 35.396391][ T3581] loop3: detected capacity change from 0 to 2048 [ 35.416617][ T3579] syz.0.41 (3579) used greatest stack depth: 9984 bytes left [ 35.457529][ T3581] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.513954][ T3323] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.586723][ T3601] netlink: 'syz.3.49': attribute type 7 has an invalid length. [ 35.594534][ T3601] netlink: 8 bytes leftover after parsing attributes in process `syz.3.49'. [ 35.638272][ T3607] netlink: 'syz.3.53': attribute type 12 has an invalid length. [ 35.795146][ T3621] syz.0.60 uses obsolete (PF_INET,SOCK_PACKET) [ 36.221139][ T3662] netlink: 16 bytes leftover after parsing attributes in process `syz.3.78'. [ 36.256011][ T3667] FAT-fs (loop7): unable to read boot sector [ 36.294588][ T3671] bridge: RTM_NEWNEIGH with invalid state 0x10 [ 36.320419][ T3675] netlink: 12 bytes leftover after parsing attributes in process `syz.0.83'. [ 36.329414][ T3675] netlink: 12 bytes leftover after parsing attributes in process `syz.0.83'. [ 36.652208][ T3698] netlink: 180 bytes leftover after parsing attributes in process `syz.2.93'. [ 36.669496][ T3698] xt_time: unknown flags 0xf4 [ 36.720597][ T3704] loop4: detected capacity change from 0 to 512 [ 36.793971][ T3704] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.95: bg 0: block 248: padding at end of block bitmap is not set [ 36.889095][ T3704] EXT4-fs error (device loop4): ext4_acquire_dquot:6945: comm syz.4.95: Failed to acquire dquot type 1 [ 36.910455][ T3704] EXT4-fs (loop4): 1 truncate cleaned up [ 36.922125][ T3704] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 36.950068][ T3704] ext4 filesystem being mounted at /30/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.002248][ T3704] syz.4.95 (3704) used greatest stack depth: 9392 bytes left [ 37.048321][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.121140][ T3728] netlink: 4 bytes leftover after parsing attributes in process `syz.0.105'. [ 37.291550][ T3740] loop1: detected capacity change from 0 to 128 [ 37.428117][ T3754] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 37.442047][ T3754] loop4: detected capacity change from 0 to 256 [ 37.452164][ T3754] FAT-fs (loop4): bogus number of FAT sectors [ 37.452892][ T3722] syz.1.104: attempt to access beyond end of device [ 37.452892][ T3722] loop1: rw=2049, sector=138, nr_sectors = 112 limit=128 [ 37.458270][ T3754] FAT-fs (loop4): Can't find a valid FAT filesystem [ 37.561065][ T3761] netlink: 176 bytes leftover after parsing attributes in process `syz.0.121'. [ 37.599177][ T3764] netlink: 12 bytes leftover after parsing attributes in process `syz.0.122'. [ 37.608139][ T3764] netlink: 12 bytes leftover after parsing attributes in process `syz.0.122'. [ 37.689618][ T3770] loop4: detected capacity change from 0 to 764 [ 37.708167][ T3770] rock: directory entry would overflow storage [ 37.714514][ T3770] rock: sig=0x4f50, size=4, remaining=3 [ 37.714653][ T3772] loop0: detected capacity change from 0 to 512 [ 37.720216][ T3770] iso9660: Corrupted directory entry in block 6 of inode 1792 [ 37.735129][ T3772] EXT4-fs: Ignoring removed bh option [ 37.775642][ T3772] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 37.804772][ T3772] EXT4-fs (loop0): 1 truncate cleaned up [ 37.824286][ T3772] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 37.907805][ T3315] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.108829][ T3800] IPv6: NLM_F_CREATE should be specified when creating new route [ 38.303181][ T3813] netlink: 'syz.1.142': attribute type 13 has an invalid length. [ 38.755814][ T29] kauditd_printk_skb: 167 callbacks suppressed [ 38.755833][ T29] audit: type=1400 audit(38.744:282): avc: denied { write } for pid=3841 comm="syz.1.156" name="file0" dev="tmpfs" ino=129 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 38.783675][ T29] audit: type=1400 audit(38.744:283): avc: denied { open } for pid=3841 comm="syz.1.156" path="/22/file0" dev="tmpfs" ino=129 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 38.853988][ T29] audit: type=1400 audit(38.794:284): avc: denied { ioctl } for pid=3841 comm="syz.1.156" path="/22/file0" dev="tmpfs" ino=129 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 39.113656][ T3867] SELinux: Context system_u:object_r:crypt_device_t:s0 is not valid (left unmapped). [ 39.131703][ T29] audit: type=1400 audit(39.104:285): avc: denied { ioctl } for pid=3859 comm="syz.4.165" path="socket:[5531]" dev="sockfs" ino=5531 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 39.155686][ T29] audit: type=1400 audit(39.114:286): avc: denied { relabelto } for pid=3866 comm="syz.0.168" name="file0" dev="tmpfs" ino=185 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:crypt_device_t:s0" [ 39.181479][ T29] audit: type=1400 audit(39.114:287): avc: denied { associate } for pid=3866 comm="syz.0.168" name="file0" dev="tmpfs" ino=185 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:crypt_device_t:s0" [ 39.312896][ T3875] loop0: detected capacity change from 0 to 128 [ 39.326710][ T29] audit: type=1400 audit(39.314:288): avc: denied { name_connect } for pid=3872 comm="syz.4.171" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 39.363411][ T3875] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 39.465617][ T29] audit: type=1400 audit(39.424:289): avc: denied { create } for pid=3874 comm="syz.0.169" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 39.514052][ T3885] ======================================================= [ 39.514052][ T3885] WARNING: The mand mount option has been deprecated and [ 39.514052][ T3885] and is ignored by this kernel. Remove the mand [ 39.514052][ T3885] option from the mount to silence this warning. [ 39.514052][ T3885] ======================================================= [ 39.546345][ T29] audit: type=1400 audit(39.454:290): avc: denied { remove_name } for pid=3874 comm="syz.0.169" name="file1" dev="loop0" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 39.570848][ T29] audit: type=1400 audit(39.454:291): avc: denied { rename } for pid=3874 comm="syz.0.169" name="file1" dev="loop0" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 39.595796][ T3315] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 39.648141][ T3890] loop4: detected capacity change from 0 to 128 [ 39.660974][ T3888] SELinux: policydb version 704780991 does not match my version range 15-35 [ 39.684914][ T3893] loop0: detected capacity change from 0 to 512 [ 39.685536][ T3888] SELinux: failed to load policy [ 39.696752][ T3890] EXT4-fs: Ignoring removed nobh option [ 39.715961][ T3893] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 39.726880][ T3890] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 39.776145][ T3893] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.816987][ T3320] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 39.827686][ T3907] loop2: detected capacity change from 0 to 256 [ 39.858442][ T3893] EXT4-fs error (device loop0): ext4_validate_block_bitmap:432: comm syz.0.176: bg 0: block 18: invalid block bitmap [ 39.906230][ T3912] rdma_op ffff88811aab1d80 conn xmit_rdma 0000000000000000 [ 39.906437][ T3315] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.287808][ T3948] loop2: detected capacity change from 0 to 7 [ 40.398809][ T3961] loop3: detected capacity change from 0 to 256 [ 40.436893][ T3961] FAT-fs (loop3): Directory bread(block 64) failed [ 40.445517][ T3961] FAT-fs (loop3): Directory bread(block 65) failed [ 40.452449][ T3961] FAT-fs (loop3): Directory bread(block 66) failed [ 40.459037][ T3961] FAT-fs (loop3): Directory bread(block 67) failed [ 40.465895][ T3961] FAT-fs (loop3): Directory bread(block 68) failed [ 40.472626][ T3961] FAT-fs (loop3): Directory bread(block 69) failed [ 40.479244][ T3961] FAT-fs (loop3): Directory bread(block 70) failed [ 40.486150][ T3961] FAT-fs (loop3): Directory bread(block 71) failed [ 40.492792][ T3961] FAT-fs (loop3): Directory bread(block 72) failed [ 40.499433][ T3961] FAT-fs (loop3): Directory bread(block 73) failed [ 40.624372][ T3970] __nla_validate_parse: 7 callbacks suppressed [ 40.624388][ T3970] netlink: 64 bytes leftover after parsing attributes in process `syz.0.207'. [ 40.709766][ T3974] netlink: 20 bytes leftover after parsing attributes in process `syz.0.209'. [ 40.850634][ T3984] netlink: 20 bytes leftover after parsing attributes in process `syz.1.214'. [ 40.918419][ T3992] netlink: 7 bytes leftover after parsing attributes in process `syz.0.218'. [ 40.928321][ T3992] netlink: 7 bytes leftover after parsing attributes in process `syz.0.218'. [ 40.996709][ T3997] netlink: 44 bytes leftover after parsing attributes in process `syz.0.220'. [ 41.224354][ T4017] random: crng reseeded on system resumption [ 41.547786][ T3961] syz.3.205 (3961) used greatest stack depth: 7048 bytes left [ 41.733008][ T4045] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 41.741248][ T4045] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 42.275728][ T4079] mmap: syz.4.258 (4079) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 42.384204][ T4083] netlink: 8 bytes leftover after parsing attributes in process `syz.1.261'. [ 42.411098][ T4087] netlink: 4 bytes leftover after parsing attributes in process `syz.2.259'. [ 42.794305][ T4092] SELinux: ebitmap: truncated map [ 42.830748][ T4092] SELinux: failed to load policy [ 43.567229][ T4131] vlan2: entered allmulticast mode [ 43.654761][ T4137] loop4: detected capacity change from 0 to 1024 [ 43.682649][ T4137] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 43.691125][ T4137] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 43.731082][ T4137] EXT4-fs (loop4): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 43.742077][ T4137] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (53380!=20869) [ 43.760943][ T4137] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 43.771127][ T4137] EXT4-fs error (device loop4): ext4_get_journal_inode:5808: comm syz.4.283: inode #1: comm syz.4.283: iget: illegal inode # [ 43.784574][ T4137] EXT4-fs (loop4): Remounting filesystem read-only [ 43.791097][ T4137] EXT4-fs (loop4): no journal found [ 43.810005][ T4145] netlink: 32 bytes leftover after parsing attributes in process `syz.2.284'. [ 43.818999][ T4145] netem: unknown loss type 13 [ 43.823769][ T4145] netem: change failed [ 43.838420][ T29] kauditd_printk_skb: 163 callbacks suppressed [ 43.838444][ T29] audit: type=1400 audit(43.824:455): avc: denied { create } for pid=4143 comm="syz.1.286" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 43.903294][ T29] audit: type=1400 audit(43.894:456): avc: denied { wake_alarm } for pid=4149 comm="syz.2.288" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 43.943387][ T29] audit: type=1326 audit(43.934:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4153 comm="syz.1.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 43.966082][ T29] audit: type=1326 audit(43.934:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4153 comm="syz.1.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 44.043771][ T29] audit: type=1326 audit(43.974:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4153 comm="syz.1.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 44.066466][ T29] audit: type=1326 audit(43.974:460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4153 comm="syz.1.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=203 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 44.089075][ T29] audit: type=1326 audit(43.974:461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4153 comm="syz.1.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 44.111716][ T29] audit: type=1326 audit(43.974:462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4153 comm="syz.1.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 44.134291][ T29] audit: type=1326 audit(43.984:463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4153 comm="syz.1.289" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 44.156835][ T29] audit: type=1400 audit(43.984:464): avc: denied { write } for pid=4147 comm="syz.3.287" name="001" dev="devtmpfs" ino=171 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 44.262529][ T4178] vlan2: entered allmulticast mode [ 44.506486][ T4205] veth0_vlan: entered allmulticast mode [ 44.555785][ T4205] ÿÿÿÿÿÿ: renamed from vlan1 [ 44.743437][ T4232] netlink: 4 bytes leftover after parsing attributes in process `syz.4.325'. [ 44.839588][ T4248] loop2: detected capacity change from 0 to 128 [ 44.886568][ T4248] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 44.913335][ T4248] EXT4-fs error (device loop2): dx_make_map:1296: inode #2: block 20: comm syz.2.335: bad entry in directory: inode out of bounds - offset=988, inode=128, rec_len=36, size=1024 fake=1 [ 45.068820][ T4248] EXT4-fs error (device loop2) in do_split:2029: Corrupt filesystem [ 45.079350][ T4264] rdma_op ffff888119f14180 conn xmit_rdma 0000000000000000 [ 45.080071][ T4248] EXT4-fs error (device loop2): dx_make_map:1296: inode #2: block 20: comm syz.2.335: bad entry in directory: inode out of bounds - offset=988, inode=128, rec_len=36, size=1024 fake=1 [ 45.105837][ T4248] EXT4-fs error (device loop2) in do_split:2029: Corrupt filesystem [ 45.155696][ T3313] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 45.214588][ T52] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 45.231698][ T52] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 45.245860][ T52] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 45.262073][ T52] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 45.396257][ T3389] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x4 [ 45.403985][ T3389] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x2 [ 45.421702][ T3389] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x3 [ 45.432261][ T3389] hid-generic 0000:3000000:0000.0003: hidraw0: HID v0.00 Device [sy] on syz0 [ 45.479448][ T4280] fido_id[4280]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 45.890507][ T3402] kernel write not supported for file bpf-prog (pid: 3402 comm: kworker/1:3) [ 45.986210][ T4320] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 46.183491][ T4341] __nla_validate_parse: 4 callbacks suppressed [ 46.183508][ T4341] netlink: 28 bytes leftover after parsing attributes in process `syz.4.374'. [ 46.198828][ T4341] netlink: 32 bytes leftover after parsing attributes in process `syz.4.374'. [ 46.207882][ T4341] netlink: 28 bytes leftover after parsing attributes in process `syz.4.374'. [ 46.217155][ T4341] netlink: 32 bytes leftover after parsing attributes in process `syz.4.374'. [ 46.282939][ T4351] loop3: detected capacity change from 0 to 128 [ 46.289622][ T4351] EXT4-fs: test_dummy_encryption option not supported [ 46.324162][ T4355] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 46.347096][ T4355] SELinux: failed to load policy [ 46.399883][ T4366] netlink: 36 bytes leftover after parsing attributes in process `syz.4.387'. [ 46.442949][ T36] IPVS: starting estimator thread 0... [ 46.516804][ T4382] loop3: detected capacity change from 0 to 128 [ 46.538758][ T4382] FAT-fs (loop3): Invalid FSINFO signature: 0x41615200, 0x61417272 (sector = 1) [ 46.551878][ T4373] IPVS: using max 2400 ests per chain, 120000 per kthread [ 46.634378][ T4386] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 46.691364][ T4388] bridge0: port 3(macsec1) entered blocking state [ 46.698053][ T4388] bridge0: port 3(macsec1) entered disabled state [ 46.706678][ T4388] macsec1: entered allmulticast mode [ 46.742054][ T4388] macsec1: left allmulticast mode [ 47.317850][ T4431] ip6gre1: entered promiscuous mode [ 47.323159][ T4431] ip6gre1: entered allmulticast mode [ 47.482821][ T4438] bridge0: entered allmulticast mode [ 47.494109][ T4438] bridge0: left allmulticast mode [ 47.730193][ T4453] lo: Caught tx_queue_len zero misconfig [ 47.985937][ T4477] netlink: 348 bytes leftover after parsing attributes in process `syz.1.436'. [ 48.430128][ T4507] capability: warning: `syz.3.449' uses deprecated v2 capabilities in a way that may be insecure [ 48.891687][ T29] kauditd_printk_skb: 213 callbacks suppressed [ 48.891706][ T29] audit: type=1400 audit(48.864:678): avc: denied { bind } for pid=4540 comm="syz.0.464" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 48.916559][ T29] audit: type=1400 audit(48.864:679): avc: denied { node_bind } for pid=4540 comm="syz.0.464" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 48.989100][ T4546] ipip0: entered promiscuous mode [ 49.021802][ T29] audit: type=1400 audit(48.884:680): avc: denied { execute_no_trans } for pid=4536 comm="syz.2.462" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 49.090304][ T29] audit: type=1400 audit(49.014:681): avc: denied { read write } for pid=4549 comm="syz.0.468" name="sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 49.114203][ T29] audit: type=1400 audit(49.014:682): avc: denied { open } for pid=4549 comm="syz.0.468" path="/dev/sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 49.137317][ T29] audit: type=1400 audit(49.044:683): avc: denied { setopt } for pid=4547 comm="syz.2.467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 49.156068][ T29] audit: type=1400 audit(49.044:684): avc: denied { connect } for pid=4547 comm="syz.2.467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 49.174884][ T29] audit: type=1400 audit(49.054:685): avc: denied { ioctl } for pid=4549 comm="syz.0.468" path="/dev/sg0" dev="devtmpfs" ino=135 ioctlcmd=0x2285 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 49.243851][ T4563] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 49.252158][ T4563] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 49.316278][ T29] audit: type=1400 audit(49.294:686): avc: denied { bind } for pid=4568 comm="syz.3.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 49.364010][ T4575] xt_connbytes: Forcing CT accounting to be enabled [ 49.370757][ T4575] Cannot find set identified by id 0 to match [ 49.384978][ T29] audit: type=1400 audit(49.374:687): avc: denied { compute_member } for pid=4578 comm="syz.0.479" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 49.494207][ T4586] netlink: 96 bytes leftover after parsing attributes in process `syz.0.482'. [ 49.581443][ T4600] ip6tnl0: Caught tx_queue_len zero misconfig [ 49.587646][ T4600] sch_fq: defrate 4294967295 ignored. [ 49.764391][ T4618] netlink: 76 bytes leftover after parsing attributes in process `syz.1.494'. [ 49.944391][ T4628] netlink: 'syz.0.502': attribute type 3 has an invalid length. [ 50.275477][ T4660] vlan2: entered allmulticast mode [ 50.336047][ T4665] sch_tbf: burst 19869 is lower than device lo mtu (65550) ! [ 50.574842][ T2665] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 50.585263][ T2665] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.626990][ T4679] netlink: 8 bytes leftover after parsing attributes in process `syz.1.526'. [ 50.657010][ T2665] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 50.667508][ T2665] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.737662][ T2665] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 50.748081][ T2665] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.831162][ T2665] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 50.841659][ T2665] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.055249][ T2665] bridge_slave_1: left allmulticast mode [ 51.060928][ T2665] bridge_slave_1: left promiscuous mode [ 51.066724][ T2665] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.105432][ T2665] bridge_slave_0: left allmulticast mode [ 51.111122][ T2665] bridge_slave_0: left promiscuous mode [ 51.117006][ T2665] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.353855][ T2665] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 51.379030][ T2665] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 51.411174][ T2665] bond0 (unregistering): Released all slaves [ 51.495449][ T2665] hsr_slave_0: left promiscuous mode [ 51.512253][ T2665] hsr_slave_1: left promiscuous mode [ 51.517931][ T2665] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 51.525379][ T2665] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 51.569070][ T2665] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 51.576587][ T2665] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 51.592903][ T2665] veth1_macvtap: left promiscuous mode [ 51.621625][ T2665] veth0_macvtap: left promiscuous mode [ 51.627236][ T2665] veth1_vlan: left promiscuous mode [ 51.633640][ T2665] veth0_vlan: left promiscuous mode [ 51.814559][ T2665] team0 (unregistering): Port device team_slave_1 removed [ 51.835611][ T2665] team0 (unregistering): Port device team_slave_0 removed [ 51.909468][ T4685] chnl_net:caif_netlink_parms(): no params data found [ 52.067522][ T4685] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.074745][ T4685] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.106328][ T4685] bridge_slave_0: entered allmulticast mode [ 52.124095][ T4685] bridge_slave_0: entered promiscuous mode [ 52.137421][ T4685] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.144582][ T4685] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.156845][ T4685] bridge_slave_1: entered allmulticast mode [ 52.163671][ T4685] bridge_slave_1: entered promiscuous mode [ 52.186763][ T4787] policy can only be matched on NF_INET_PRE_ROUTING [ 52.186780][ T4787] unable to load match [ 52.200778][ T4791] netlink: 24 bytes leftover after parsing attributes in process `syz.1.550'. [ 52.217272][ T4685] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 52.248328][ T4685] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 52.309484][ T4796] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 52.335053][ T4685] team0: Port device team_slave_0 added [ 52.344408][ T4685] team0: Port device team_slave_1 added [ 52.352570][ T4796] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 52.389274][ T4685] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 52.396320][ T4685] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 52.422272][ T4685] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 52.502616][ T4685] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 52.509641][ T4685] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 52.535665][ T4685] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 52.616211][ T4685] hsr_slave_0: entered promiscuous mode [ 52.632283][ T4685] hsr_slave_1: entered promiscuous mode [ 52.638588][ T4685] debugfs: 'hsr0' already exists in 'hsr' [ 52.644397][ T4685] Cannot create hsr debugfs directory [ 52.681716][ T4818] loop3: detected capacity change from 0 to 8192 [ 52.824614][ T4833] SELinux: Context Ü is not valid (left unmapped). [ 52.980742][ T4685] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 52.992812][ T4685] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 53.152286][ T4685] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 53.181524][ T4685] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 53.360407][ T4685] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.412659][ T4685] 8021q: adding VLAN 0 to HW filter on device team0 [ 53.425438][ T2665] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.432680][ T2665] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.461100][ T2665] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.468288][ T2665] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.714899][ T4685] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.838060][ T4935] netlink: 12 bytes leftover after parsing attributes in process `syz.2.581'. [ 53.888446][ T4938] netlink: 'syz.3.582': attribute type 1 has an invalid length. [ 53.896200][ T4938] netlink: 'syz.3.582': attribute type 4 has an invalid length. [ 53.904169][ T4938] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.582'. [ 53.925279][ T4935] netlink: 12 bytes leftover after parsing attributes in process `syz.2.581'. [ 53.925376][ T37] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 53.971844][ T37] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 54.004587][ T37] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 54.032453][ T4685] veth0_vlan: entered promiscuous mode [ 54.038797][ T37] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 54.061379][ T4685] veth1_vlan: entered promiscuous mode [ 54.087090][ T4949] netlink: 8 bytes leftover after parsing attributes in process `syz.4.585'. [ 54.088690][ T4685] veth0_macvtap: entered promiscuous mode [ 54.115345][ T4685] veth1_macvtap: entered promiscuous mode [ 54.126716][ T4685] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 54.141116][ T4685] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 54.152378][ T37] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.175452][ T37] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.214548][ T37] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.223360][ T29] kauditd_printk_skb: 118 callbacks suppressed [ 54.223430][ T29] audit: type=1400 audit(54.194:806): avc: denied { mounton } for pid=4685 comm="syz-executor" path="/root/syzkaller.stXX4O/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 54.253268][ T29] audit: type=1400 audit(54.194:807): avc: denied { mount } for pid=4685 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 54.274570][ T29] audit: type=1400 audit(54.194:808): avc: denied { mounton } for pid=4685 comm="syz-executor" path="/root/syzkaller.stXX4O/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 54.300679][ T29] audit: type=1400 audit(54.194:809): avc: denied { mounton } for pid=4685 comm="syz-executor" path="/root/syzkaller.stXX4O/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=9809 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 54.331132][ T60] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.350033][ T29] audit: type=1400 audit(54.314:810): avc: denied { mounton } for pid=4685 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 54.354767][ T4949] netlink: 8 bytes leftover after parsing attributes in process `syz.4.585'. [ 54.372410][ T29] audit: type=1400 audit(54.314:811): avc: denied { mount } for pid=4685 comm="syz-executor" name="/" dev="gadgetfs" ino=3808 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 54.411911][ T29] audit: type=1400 audit(54.404:812): avc: denied { add_name } for pid=4685 comm="syz-executor" name="syz5" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 54.461671][ T29] audit: type=1400 audit(54.404:813): avc: denied { create } for pid=4685 comm="syz-executor" name="syz5" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 54.481347][ T29] audit: type=1400 audit(54.404:814): avc: denied { associate } for pid=4685 comm="syz-executor" name="syz5" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 54.561908][ T4968] netlink: 'syz.2.589': attribute type 1 has an invalid length. [ 54.610029][ T4968] bond1: entered promiscuous mode [ 54.615242][ T4968] bond1: entered allmulticast mode [ 54.749050][ T4986] loop3: detected capacity change from 0 to 128 [ 54.775801][ T4986] EXT4-fs: Ignoring removed nobh option [ 54.811838][ T29] audit: type=1326 audit(54.794:815): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4990 comm="syz.5.598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84a3d1f749 code=0x7ffc0000 [ 54.916116][ T4986] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 55.065730][ T3323] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 55.410023][ T5072] loop5: detected capacity change from 0 to 1024 [ 55.459400][ T5072] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 55.513019][ T5072] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 55.558023][ T37] EXT4-fs (loop5): Delayed block allocation failed for inode 16 at logical offset 131587 with max blocks 1 with error 28 [ 55.570753][ T37] EXT4-fs (loop5): This should not happen!! Data will be lost [ 55.570753][ T37] [ 55.580575][ T37] EXT4-fs (loop5): Total free blocks count 0 [ 55.586672][ T37] EXT4-fs (loop5): Free/Dirty block details [ 55.592632][ T37] EXT4-fs (loop5): free_blocks=68451041280 [ 55.598628][ T37] EXT4-fs (loop5): dirty_blocks=16 [ 55.603784][ T37] EXT4-fs (loop5): Block reservation details [ 55.609781][ T37] EXT4-fs (loop5): i_reserved_data_blocks=1 [ 55.651609][ T4685] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.682911][ T5102] netlink: 4 bytes leftover after parsing attributes in process `syz.5.628'. [ 55.950049][ T2665] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 56.173239][ T5169] uprobe: syz.5.662:5169 failed to unregister, leaking uprobe [ 56.275471][ T5168] uprobe: syz.5.662:5168 failed to unregister, leaking uprobe [ 56.468071][ T5178] netlink: 4 bytes leftover after parsing attributes in process `syz.5.665'. [ 56.497945][ T5178] netlink: 4 bytes leftover after parsing attributes in process `syz.5.665'. [ 56.518244][ T5183] loop4: detected capacity change from 0 to 512 [ 56.541809][ T5183] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.667: bg 0: block 393: padding at end of block bitmap is not set [ 56.561459][ T5183] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 56.573440][ T5185] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 56.581010][ T5185] vhci_hcd: default hub control req: 0305 vfffa i0002 l0 [ 56.589903][ T5183] EXT4-fs (loop4): 2 truncates cleaned up [ 56.596336][ T5183] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.653687][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.754934][ T2665] Bluetooth: hci0: Frame reassembly failed (-84) [ 57.260732][ T5230] netlink: 19 bytes leftover after parsing attributes in process `syz.2.687'. [ 57.466697][ T5251] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 57.569066][ T5257] netlink: 76 bytes leftover after parsing attributes in process `syz.1.698'. [ 57.715898][ T5267] netlink: 12 bytes leftover after parsing attributes in process `syz.4.703'. [ 57.724937][ T5267] netlink: 12 bytes leftover after parsing attributes in process `syz.4.703'. [ 57.920444][ T5282] loop3: detected capacity change from 0 to 512 [ 57.934411][ T5282] EXT4-fs error (device loop3): ext4_validate_block_bitmap:441: comm syz.3.709: bg 0: block 393: padding at end of block bitmap is not set [ 57.950641][ T5282] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 57.960672][ T5282] EXT4-fs (loop3): 2 truncates cleaned up [ 57.967434][ T5282] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 57.993357][ T3323] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.821688][ T5199] Bluetooth: hci0: command 0x1003 tx timeout [ 58.821948][ T44] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 58.951968][ T5366] capability: warning: `syz.4.744' uses 32-bit capabilities (legacy support in use) [ 59.025646][ T5374] loop5: detected capacity change from 0 to 512 [ 59.072723][ T5374] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 59.092101][ T5381] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 59.647537][ T5417] netlink: 96 bytes leftover after parsing attributes in process `syz.1.765'. [ 59.861981][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 59.908746][ T5432] netlink: 24 bytes leftover after parsing attributes in process `syz.1.772'. [ 59.954146][ T5437] GUP no longer grows the stack in syz.5.774 (5437): 200000004000-20000000a000 (200000002000) [ 59.964612][ T5437] CPU: 1 UID: 0 PID: 5437 Comm: syz.5.774 Not tainted syzkaller #0 PREEMPT(voluntary) [ 59.964639][ T5437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 59.964656][ T5437] Call Trace: [ 59.964664][ T5437] [ 59.964675][ T5437] __dump_stack+0x1d/0x30 [ 59.964697][ T5437] dump_stack_lvl+0xe8/0x140 [ 59.964754][ T5437] dump_stack+0x15/0x1b [ 59.964778][ T5437] __get_user_pages+0x1968/0x1ed0 [ 59.964834][ T5437] get_user_pages_remote+0x1d5/0x6c0 [ 59.964861][ T5437] __access_remote_vm+0x15c/0x590 [ 59.964969][ T5437] access_remote_vm+0x32/0x40 [ 59.964993][ T5437] proc_pid_cmdline_read+0x32b/0x6c0 [ 59.965029][ T5437] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 59.965134][ T5437] vfs_readv+0x3fb/0x690 [ 59.965175][ T5437] __x64_sys_preadv+0xfd/0x1c0 [ 59.965294][ T5437] x64_sys_call+0x282e/0x3000 [ 59.965319][ T5437] do_syscall_64+0xd2/0x200 [ 59.965339][ T5437] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 59.965365][ T5437] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 59.965476][ T5437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.965549][ T5437] RIP: 0033:0x7f84a3d1f749 [ 59.965563][ T5437] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 59.965584][ T5437] RSP: 002b:00007f84a2787038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 59.965676][ T5437] RAX: ffffffffffffffda RBX: 00007f84a3f75fa0 RCX: 00007f84a3d1f749 [ 59.965701][ T5437] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 59.965717][ T5437] RBP: 00007f84a3da3f91 R08: 0000000000000000 R09: 0000000000000000 [ 59.965732][ T5437] R10: 0000000000000300 R11: 0000000000000246 R12: 0000000000000000 [ 59.965747][ T5437] R13: 00007f84a3f76038 R14: 00007f84a3f75fa0 R15: 00007ffda759cf28 [ 59.965847][ T5437] [ 60.294497][ T29] kauditd_printk_skb: 646 callbacks suppressed [ 60.294515][ T29] audit: type=1400 audit(60.284:1462): avc: denied { bind } for pid=5457 comm="syz.5.782" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 60.322162][ T29] audit: type=1400 audit(60.284:1463): avc: denied { setopt } for pid=5457 comm="syz.5.782" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 60.809594][ T29] audit: type=1400 audit(60.794:1464): avc: denied { bind } for pid=5482 comm="syz.1.792" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 61.194813][ T5502] netlink: 131740 bytes leftover after parsing attributes in process `syz.2.800'. [ 61.204150][ T5502] netlink: zone id is out of range [ 61.209288][ T5502] netlink: zone id is out of range [ 61.214845][ T5502] netlink: zone id is out of range [ 61.220053][ T5502] netlink: zone id is out of range [ 61.225511][ T5502] netlink: del zone limit has 8 unknown bytes [ 61.322690][ T5516] netlink: 4 bytes leftover after parsing attributes in process `syz.4.807'. [ 61.352326][ T5516] netlink: 4 bytes leftover after parsing attributes in process `syz.4.807'. [ 61.447584][ T29] audit: type=1400 audit(61.434:1465): avc: denied { create } for pid=5534 comm="syz.4.816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 61.467631][ T29] audit: type=1400 audit(61.434:1466): avc: denied { setopt } for pid=5534 comm="syz.4.816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 61.490529][ T5537] netlink: 'syz.2.817': attribute type 27 has an invalid length. [ 61.524177][ T5537] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.531369][ T5537] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.568393][ T5537] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 61.578957][ T5537] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 61.608372][ T5537] bond1: left promiscuous mode [ 61.613701][ T5537] bond1: left allmulticast mode [ 61.618939][ T2665] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 61.628004][ T2665] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.638998][ T2665] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 61.647945][ T2665] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.659958][ T5543] dummy0: entered promiscuous mode [ 61.665662][ T2665] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 61.666086][ T5543] netlink: 4 bytes leftover after parsing attributes in process `syz.2.819'. [ 61.674592][ T2665] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.674692][ T2665] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 61.701215][ T2665] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.712218][ T5543] dummy0 (unregistering): left promiscuous mode [ 61.921058][ T5556] loop3: detected capacity change from 0 to 1024 [ 61.930663][ T5556] EXT4-fs: inline encryption not supported [ 61.954110][ T5556] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 61.979633][ T29] audit: type=1400 audit(61.964:1467): avc: denied { ioctl } for pid=5555 comm="syz.3.825" path="/140/file1/file1" dev="loop3" ino=15 ioctlcmd=0x662a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 62.014494][ T3323] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 62.094969][ T5572] bridge: RTM_NEWNEIGH with invalid ether address [ 62.216385][ T5580] veth1_macvtap: left promiscuous mode [ 62.222054][ T5580] macsec0: entered promiscuous mode [ 62.410583][ T5599] loop4: detected capacity change from 0 to 128 [ 62.417655][ T5599] msdos: Unknown parameter 'dos1xfl%›4?Ö…y' [ 62.486790][ T29] audit: type=1326 audit(62.474:1468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5608 comm="syz.5.847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84a3d1f749 code=0x7ffc0000 [ 62.509793][ T29] audit: type=1326 audit(62.474:1469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5608 comm="syz.5.847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84a3d1f749 code=0x7ffc0000 [ 62.513367][ T5611] netlink: 'syz.3.846': attribute type 8 has an invalid length. [ 62.540220][ T5611] __nla_validate_parse: 1 callbacks suppressed [ 62.540237][ T5611] netlink: 4 bytes leftover after parsing attributes in process `syz.3.846'. [ 62.559075][ T5611] bond0: entered promiscuous mode [ 62.564332][ T5611] bond_slave_0: entered promiscuous mode [ 62.568046][ T29] audit: type=1326 audit(62.524:1470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5608 comm="syz.5.847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f84a3d1f749 code=0x7ffc0000 [ 62.570164][ T5611] bond_slave_1: entered promiscuous mode [ 62.592664][ T29] audit: type=1326 audit(62.524:1471): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5608 comm="syz.5.847" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f84a3d1f749 code=0x7ffc0000 [ 62.623035][ T5611] geneve0: entered promiscuous mode [ 62.629986][ T5611] bond0: left promiscuous mode [ 62.634895][ T5611] bond_slave_0: left promiscuous mode [ 62.640541][ T5611] bond_slave_1: left promiscuous mode [ 62.648722][ T5611] geneve0: left promiscuous mode [ 62.720800][ T5622] netlink: 4 bytes leftover after parsing attributes in process `syz.4.851'. [ 62.789455][ T5631] netlink: 131740 bytes leftover after parsing attributes in process `syz.5.854'. [ 62.799084][ T5631] netlink: zone id is out of range [ 62.804287][ T5631] netlink: zone id is out of range [ 62.812545][ T5631] netlink: zone id is out of range [ 62.817862][ T5631] netlink: zone id is out of range [ 62.823717][ T5631] netlink: del zone limit has 8 unknown bytes [ 62.876020][ T5640] syz_tun: entered allmulticast mode [ 62.900660][ T5639] syz_tun: left allmulticast mode [ 63.111733][ T5667] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=5667 comm=syz.3.871 [ 63.312902][ T5675] uprobe: syz.1.875:5675 failed to unregister, leaking uprobe [ 63.503165][ T5673] uprobe: syz.1.875:5673 failed to unregister, leaking uprobe [ 63.693782][ T5679] netlink: 'syz.5.887': attribute type 1 has an invalid length. [ 63.729746][ T5679] bond1: (slave geneve2): making interface the new active one [ 63.758355][ T5679] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 63.767680][ T1457] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 63.776749][ T1457] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 63.787434][ T1457] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 63.796493][ T1457] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 64.231247][ T5739] loop4: detected capacity change from 0 to 256 [ 64.239253][ T5739] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 64.265156][ T5745] netlink: 'syz.3.899': attribute type 3 has an invalid length. [ 64.279747][ T5739] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 64.394516][ T5753] SELinux: failed to load policy [ 64.406671][ T5763] dummy0: entered promiscuous mode [ 64.412396][ T5763] netlink: 4 bytes leftover after parsing attributes in process `syz.1.903'. [ 64.425080][ T5763] dummy0 (unregistering): left promiscuous mode [ 64.440036][ T5766] netlink: 'syz.5.904': attribute type 8 has an invalid length. [ 64.447828][ T5766] netlink: 4 bytes leftover after parsing attributes in process `syz.5.904'. [ 64.465288][ T5766] bond0: entered promiscuous mode [ 64.470404][ T5766] bond_slave_0: entered promiscuous mode [ 64.476273][ T5766] bond_slave_1: entered promiscuous mode [ 64.509795][ T5766] geneve0: entered promiscuous mode [ 64.516683][ T5766] bond0: left promiscuous mode [ 64.521887][ T5766] bond_slave_0: left promiscuous mode [ 64.523203][ T5772] loop4: detected capacity change from 0 to 512 [ 64.527448][ T5766] bond_slave_1: left promiscuous mode [ 64.549407][ T5766] geneve0: left promiscuous mode [ 64.568111][ T5772] EXT4-fs: Ignoring removed orlov option [ 64.592510][ T5772] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 64.622241][ T5772] EXT4-fs error (device loop4): ext4_iget_extra_inode:5075: inode #15: comm syz.4.905: corrupted in-inode xattr: e_value size too large [ 64.677589][ T5772] EXT4-fs error (device loop4): ext4_orphan_get:1397: comm syz.4.905: couldn't read orphan inode 15 (err -117) [ 64.698795][ T5788] loop5: detected capacity change from 0 to 1024 [ 64.709132][ T5788] EXT4-fs: inline encryption not supported [ 64.719992][ T5772] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 64.749985][ T5788] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 64.789400][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 64.864319][ T4685] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 65.436426][ T5828] netlink: 8 bytes leftover after parsing attributes in process `syz.3.919'. [ 65.445668][ T5841] netlink: 'syz.4.920': attribute type 27 has an invalid length. [ 65.454117][ T29] kauditd_printk_skb: 33 callbacks suppressed [ 65.454133][ T29] audit: type=1400 audit(65.434:1505): avc: denied { firmware_load } for pid=5827 comm="syz.3.919" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 65.562756][ T5841] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.570107][ T5841] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.774523][ T5841] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 65.813999][ T5841] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 65.856355][ T5841] veth0_vlan: left allmulticast mode [ 65.962265][ T52] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.991526][ T52] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.011264][ T52] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.041766][ T52] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.151879][ T29] audit: type=1400 audit(66.144:1506): avc: denied { append } for pid=5909 comm="syz.3.933" name="sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 66.201072][ T5920] netlink: 4 bytes leftover after parsing attributes in process `syz.5.936'. [ 66.222177][ T29] audit: type=1326 audit(66.194:1507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5921 comm="syz.2.938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 66.244982][ T29] audit: type=1326 audit(66.194:1508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5921 comm="syz.2.938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 66.267760][ T29] audit: type=1326 audit(66.194:1509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5921 comm="syz.2.938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 66.290910][ T29] audit: type=1326 audit(66.194:1510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5921 comm="syz.2.938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 66.327577][ T29] audit: type=1326 audit(66.304:1511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5921 comm="syz.2.938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 66.350376][ T29] audit: type=1326 audit(66.304:1512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5921 comm="syz.2.938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 66.373075][ T29] audit: type=1326 audit(66.304:1513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5921 comm="syz.2.938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 66.395719][ T29] audit: type=1326 audit(66.304:1514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5921 comm="syz.2.938" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 66.465318][ T5940] sch_tbf: burst 19360 is lower than device lo mtu (65550) ! [ 66.529378][ T5947] netlink: 4 bytes leftover after parsing attributes in process `syz.1.946'. [ 66.613122][ T5947] erspan0: entered promiscuous mode [ 66.618483][ T5947] macvtap1: entered promiscuous mode [ 66.623985][ T5947] macvtap1: entered allmulticast mode [ 66.629386][ T5947] erspan0: entered allmulticast mode [ 66.732344][ T5966] netlink: 4 bytes leftover after parsing attributes in process `syz.1.955'. [ 66.866609][ T5977] sch_fq: defrate 0 ignored. [ 66.918634][ T5987] loop4: detected capacity change from 0 to 1024 [ 66.925773][ T5987] EXT4-fs: Ignoring removed oldalloc option [ 66.944363][ T5987] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 66.974088][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 66.981979][ T5994] netlink: 8 bytes leftover after parsing attributes in process `syz.2.966'. [ 67.543166][ T6015] __nla_validate_parse: 3 callbacks suppressed [ 67.543182][ T6015] netlink: 8 bytes leftover after parsing attributes in process `syz.5.974'. [ 67.558469][ T6015] netlink: 12 bytes leftover after parsing attributes in process `syz.5.974'. [ 67.567463][ T6015] netlink: 12 bytes leftover after parsing attributes in process `syz.5.974'. [ 67.579943][ T6015] netlink: 8 bytes leftover after parsing attributes in process `syz.5.974'. [ 67.594343][ T6015] netlink: 12 bytes leftover after parsing attributes in process `syz.5.974'. [ 67.603406][ T6015] netlink: 12 bytes leftover after parsing attributes in process `syz.5.974'. [ 67.738054][ T6035] netlink: 'syz.5.984': attribute type 5 has an invalid length. [ 67.818229][ T6048] netlink: 'syz.3.991': attribute type 12 has an invalid length. [ 67.885280][ T6057] netlink: 24 bytes leftover after parsing attributes in process `syz.1.997'. [ 67.922838][ T6064] netlink: 4 bytes leftover after parsing attributes in process `syz.5.999'. [ 67.940168][ T6064] erspan0: entered promiscuous mode [ 67.945912][ T6064] macvtap1: entered promiscuous mode [ 67.951477][ T6064] macvtap1: entered allmulticast mode [ 67.956981][ T6064] erspan0: entered allmulticast mode [ 67.969229][ T6064] erspan0: left allmulticast mode [ 67.974619][ T6064] erspan0: left promiscuous mode [ 68.204036][ T6086] loop3: detected capacity change from 0 to 512 [ 68.250562][ T6086] EXT4-fs error (device loop3): ext4_orphan_get:1392: inode #15: comm syz.3.1009: inode has both inline data and extents flags [ 68.272686][ T6086] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.1009: couldn't read orphan inode 15 (err -117) [ 68.297212][ T6086] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 68.335193][ T3323] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.414798][ T6109] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1018'. [ 68.477774][ T6111] loop4: detected capacity change from 0 to 1024 [ 68.486578][ T6111] EXT4-fs: Ignoring removed orlov option [ 68.519251][ T6111] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 68.781655][ T6137] IPVS: sync thread started: state = MASTER, mcast_ifn = hsr0, syncid = 4, id = 0 [ 68.791192][ T6136] IPVS: stopping master sync thread 6137 ... [ 68.872326][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.882024][ T3422] IPVS: starting estimator thread 0... [ 68.972308][ T6148] IPVS: using max 2448 ests per chain, 122400 per kthread [ 68.999401][ T6165] loop4: detected capacity change from 0 to 512 [ 69.006629][ T6165] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 69.052105][ T6164] Falling back ldisc for ttyS3. [ 69.163155][ T6190] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1047'. [ 69.718509][ T6260] loop3: detected capacity change from 0 to 1024 [ 69.742842][ T6260] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 69.806741][ T6273] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 69.837291][ T6273] vhci_hcd: invalid port number 96 [ 69.842533][ T6273] vhci_hcd: default hub control req: 0311 v0005 i0060 l7 [ 69.908480][ T6260] EXT4-fs error (device loop3): ext4_map_blocks:814: inode #15: block 8: comm syz.3.1074: lblock 8 mapped to illegal pblock 8 (length 4) [ 69.925527][ T6260] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 4 with error 117 [ 69.937912][ T6260] EXT4-fs (loop3): This should not happen!! Data will be lost [ 69.937912][ T6260] [ 69.988954][ T1457] EXT4-fs error (device loop3): ext4_map_blocks:814: inode #15: comm kworker/u8:6: lblock 0 mapped to illegal pblock 0 (length 5) [ 70.005485][ T1457] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 5 with error 117 [ 70.017816][ T1457] EXT4-fs (loop3): This should not happen!! Data will be lost [ 70.017816][ T1457] [ 70.073716][ T3323] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 70.089646][ T6290] loop4: detected capacity change from 0 to 2048 [ 70.138270][ T6290] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 70.161898][ T52] tipc: Subscription rejected, illegal request [ 70.180399][ T6290] EXT4-fs (loop4): shut down requested (1) [ 70.222875][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 70.289399][ T6313] loop5: detected capacity change from 0 to 1024 [ 70.327194][ T6313] EXT4-fs (loop5): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 70.400621][ T6324] EXT4-fs error (device loop5): ext4_map_blocks:814: inode #15: block 8: comm syz.5.1095: lblock 8 mapped to illegal pblock 8 (length 4) [ 70.439899][ T6324] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 4 with error 117 [ 70.452305][ T6324] EXT4-fs (loop5): This should not happen!! Data will be lost [ 70.452305][ T6324] [ 70.484022][ T6328] loop3: detected capacity change from 0 to 512 [ 70.502943][ T6328] EXT4-fs (loop3): too many log groups per flexible block group [ 70.510713][ T6328] EXT4-fs (loop3): failed to initialize mballoc (-12) [ 70.540026][ T6328] EXT4-fs (loop3): mount failed [ 70.606849][ T31] EXT4-fs error (device loop5): ext4_map_blocks:814: inode #15: comm kworker/u8:1: lblock 0 mapped to illegal pblock 0 (length 5) [ 70.621993][ T29] kauditd_printk_skb: 235 callbacks suppressed [ 70.622010][ T29] audit: type=1326 audit(70.614:1750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6342 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa902f9f749 code=0x7ffc0000 [ 70.651014][ T29] audit: type=1326 audit(70.614:1751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6342 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa902f9f749 code=0x7ffc0000 [ 70.682830][ T31] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 5 with error 117 [ 70.695174][ T31] EXT4-fs (loop5): This should not happen!! Data will be lost [ 70.695174][ T31] [ 70.712836][ T29] audit: type=1326 audit(70.614:1752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6342 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa902f9f749 code=0x7ffc0000 [ 70.735777][ T29] audit: type=1326 audit(70.614:1753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6342 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa902f9f749 code=0x7ffc0000 [ 70.758693][ T29] audit: type=1326 audit(70.614:1754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6342 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa902f9f749 code=0x7ffc0000 [ 70.781614][ T29] audit: type=1326 audit(70.614:1755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6342 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa902f9f749 code=0x7ffc0000 [ 70.804501][ T29] audit: type=1326 audit(70.644:1756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6342 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa902f9f749 code=0x7ffc0000 [ 70.806683][ T4685] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 70.827423][ T29] audit: type=1326 audit(70.644:1757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6342 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa902f9f749 code=0x7ffc0000 [ 70.859159][ T29] audit: type=1326 audit(70.664:1758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6342 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa902f9f749 code=0x7ffc0000 [ 70.881903][ T29] audit: type=1326 audit(70.664:1759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6342 comm="syz.3.1109" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa902f9f749 code=0x7ffc0000 [ 70.965579][ T6360] loop4: detected capacity change from 0 to 128 [ 71.064968][ T52] tipc: Subscription rejected, illegal request [ 71.119117][ T6388] netlink: 'syz.4.1125': attribute type 12 has an invalid length. [ 71.230476][ T6409] loop3: detected capacity change from 0 to 128 [ 71.238019][ T6408] usb usb5: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 71.245601][ T6408] vhci_hcd: invalid port number 253 [ 71.339718][ T52] tipc: Subscription rejected, illegal request [ 71.515220][ T6433] netlink: 'syz.3.1151': attribute type 1 has an invalid length. [ 71.529913][ T6433] 8021q: adding VLAN 0 to HW filter on device bond2 [ 71.545369][ T6433] bond2: (slave gretap1): making interface the new active one [ 71.553761][ T6433] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 72.250636][ T6487] usb usb5: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 72.258110][ T6487] vhci_hcd: invalid port number 253 [ 72.330555][ T6498] loop4: detected capacity change from 0 to 1024 [ 72.380980][ T6498] EXT4-fs: Ignoring removed bh option [ 72.422205][ T6502] raw_sendmsg: syz.5.1169 forgot to set AF_INET. Fix it! [ 72.429869][ C1] IPv4: Oversized IP packet from 127.0.0.1 [ 72.444390][ T6498] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 72.486253][ T6498] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4193: comm syz.4.1170: Allocating blocks 385-513 which overlap fs metadata [ 72.500823][ T6496] EXT4-fs (loop4): pa ffff888106e5b0e0: logic 16, phys. 129, len 24 [ 72.508990][ T6496] EXT4-fs error (device loop4): ext4_mb_release_inode_pa:5444: group 0, free 0, pa_free 8 [ 72.532768][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.573744][ T6515] __nla_validate_parse: 10 callbacks suppressed [ 72.573764][ T6515] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1176'. [ 72.601941][ T6517] netlink: 'syz.5.1177': attribute type 10 has an invalid length. [ 72.626695][ T6517] team0: Port device dummy0 added [ 72.642646][ T6517] netlink: 'syz.5.1177': attribute type 10 has an invalid length. [ 72.650948][ T6517] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 72.665004][ T6517] team0: Failed to send options change via netlink (err -105) [ 72.672783][ T6517] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 72.681913][ T6517] team0: Port device dummy0 removed [ 72.689851][ T6517] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 72.734158][ T6535] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6535 comm=syz.5.1182 [ 72.752148][ T6535] netlink: 'syz.5.1182': attribute type 1 has an invalid length. [ 72.793582][ T6535] bond2: (slave bridge1): making interface the new active one [ 72.810529][ T6535] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 73.243876][ T6564] futex_wake_op: syz.3.1195 tries to shift op by -1; fix this program [ 73.277847][ T6569] netlink: 'syz.3.1197': attribute type 1 has an invalid length. [ 73.296564][ T6569] bond3: entered promiscuous mode [ 73.301765][ T6569] bond3: entered allmulticast mode [ 73.307254][ T6569] 8021q: adding VLAN 0 to HW filter on device bond3 [ 73.322649][ T6569] ip6gretap1: entered promiscuous mode [ 73.328175][ T6569] ip6gretap1: entered allmulticast mode [ 73.344926][ T6569] bond3: (slave ip6gretap1): Enslaving as an active interface with an up link [ 73.415612][ T6586] netlink: 'syz.4.1205': attribute type 1 has an invalid length. [ 73.440095][ T6586] bond1: (slave bridge1): making interface the new active one [ 73.448257][ T6586] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 73.587500][ T6611] netlink: 220 bytes leftover after parsing attributes in process `syz.4.1216'. [ 73.596840][ T6611] netlink: 220 bytes leftover after parsing attributes in process `syz.4.1216'. [ 73.749731][ T6635] sch_tbf: burst 19360 is lower than device lo mtu (65550) ! [ 73.835887][ T6643] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1231'. [ 74.243964][ T6695] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1242'. [ 74.306548][ T6706] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1246'. [ 74.317086][ T6706] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1246'. [ 74.359438][ T6712] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1248'. [ 74.368492][ T6712] netlink: 121 bytes leftover after parsing attributes in process `syz.3.1248'. [ 74.493233][ T6721] loop3: detected capacity change from 0 to 764 [ 74.509681][ T6721] rock: directory entry would overflow storage [ 74.516143][ T6721] rock: sig=0x4f50, size=4, remaining=3 [ 74.521872][ T6721] iso9660: Corrupted directory entry in block 6 of inode 1792 [ 74.586938][ T6727] af_packet: tpacket_rcv: packet too big, clamped from 54 to 4294967286. macoff=82 [ 74.617614][ T6729] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1256'. [ 75.481781][ T6816] sctp: [Deprecated]: syz.5.1296 (pid 6816) Use of int in max_burst socket option deprecated. [ 75.481781][ T6816] Use struct sctp_assoc_value instead [ 76.111192][ T6860] loop4: detected capacity change from 0 to 512 [ 76.150193][ T6860] EXT4-fs: Ignoring removed nobh option [ 76.186900][ T6860] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 76.254393][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 76.489689][ T6895] netlink: 'syz.4.1329': attribute type 4 has an invalid length. [ 76.529425][ T6895] netlink: 'syz.4.1329': attribute type 4 has an invalid length. [ 76.538944][ T6903] bridge: RTM_NEWNEIGH with invalid ether address [ 76.610002][ T6915] vlan2: entered allmulticast mode [ 76.637950][ T6908] loop3: detected capacity change from 0 to 8192 [ 76.656966][ T6921] IPVS: Error connecting to the multicast addr [ 76.683034][ T3304] loop3: p1 p2 p4 < > [ 76.687153][ T3304] loop3: partition table partially beyond EOD, truncated [ 76.711916][ T3304] loop3: p1 start 16777216 is beyond EOD, truncated [ 76.718565][ T3304] loop3: p2 size 515840 extends beyond EOD, truncated [ 76.732398][ T3304] loop3: p4 start 16777216 is beyond EOD, truncated [ 76.750270][ T6908] loop3: p1 p2 p4 < > [ 76.754503][ T6908] loop3: partition table partially beyond EOD, truncated [ 76.772562][ T6908] loop3: p1 start 16777216 is beyond EOD, truncated [ 76.779200][ T6908] loop3: p2 size 515840 extends beyond EOD, truncated [ 76.787498][ T6908] loop3: p4 start 16777216 is beyond EOD, truncated [ 76.842229][ T6934] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 76.902900][ T3304] udevd[3304]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 76.942487][ T3304] udevd[3304]: inotify_add_watch(7, /dev/loop3p2, 10) failed: No such file or directory [ 77.022479][ T6956] wg2: entered promiscuous mode [ 77.027728][ T6956] wg2: entered allmulticast mode [ 77.300953][ T6990] loop3: detected capacity change from 0 to 512 [ 77.325588][ T6990] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 77.342868][ T6990] ext4 filesystem being mounted at /256/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 77.406890][ T3323] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.418313][ T6997] netlink: 'syz.5.1372': attribute type 4 has an invalid length. [ 77.458688][ T6997] netlink: 'syz.5.1372': attribute type 4 has an invalid length. [ 77.630356][ T7028] __nla_validate_parse: 10 callbacks suppressed [ 77.630373][ T7028] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1387'. [ 77.895519][ T29] kauditd_printk_skb: 108 callbacks suppressed [ 77.895601][ T29] audit: type=1400 audit(2000000001.270:1868): avc: denied { read write } for pid=3320 comm="syz-executor" name="loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 77.934044][ T29] audit: type=1400 audit(2000000001.270:1869): avc: denied { open } for pid=3320 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 77.958290][ T29] audit: type=1400 audit(2000000001.270:1870): avc: denied { ioctl } for pid=3320 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=104 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 77.999630][ T29] audit: type=1400 audit(2000000001.340:1871): avc: denied { allowed } for pid=7057 comm="syz.4.1404" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 78.005284][ T7058] syzkaller1: entered promiscuous mode [ 78.019027][ T29] audit: type=1400 audit(2000000001.360:1872): avc: denied { create } for pid=7057 comm="syz.4.1404" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 78.024525][ T7058] syzkaller1: entered allmulticast mode [ 78.045867][ T29] audit: type=1400 audit(2000000001.360:1873): avc: denied { prog_load } for pid=7056 comm="syz.5.1402" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 78.070513][ T29] audit: type=1400 audit(2000000001.360:1874): avc: denied { bpf } for pid=7056 comm="syz.5.1402" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 78.091193][ T29] audit: type=1400 audit(2000000001.360:1875): avc: denied { map_create } for pid=7056 comm="syz.5.1402" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 78.110377][ T29] audit: type=1400 audit(2000000001.360:1876): avc: denied { perfmon } for pid=7056 comm="syz.5.1402" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 78.131370][ T29] audit: type=1400 audit(2000000001.360:1877): avc: denied { map_read map_write } for pid=7056 comm="syz.5.1402" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 78.164033][ T7067] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1406'. [ 78.193465][ T7072] bridge: RTM_NEWNEIGH with invalid ether address [ 78.243990][ T7080] serio: Serial port ttyS3 [ 78.357499][ T7094] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1417'. [ 78.366992][ T7098] sch_tbf: burst 22 is lower than device lo mtu (11337746) ! [ 78.406323][ T7102] netlink: 'syz.3.1420': attribute type 1 has an invalid length. [ 78.754463][ T7136] ALSA: seq fatal error: cannot create timer (-19) [ 78.785754][ T7140] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1438'. [ 78.872561][ T7144] netlink: 'syz.1.1440': attribute type 1 has an invalid length. [ 78.893414][ T7144] 8021q: adding VLAN 0 to HW filter on device bond1 [ 78.937908][ T7144] bond1: (slave veth0_virt_wifi): making interface the new active one [ 78.947598][ T7144] bond1: (slave veth0_virt_wifi): Enslaving as an active interface with an up link [ 78.970530][ T7151] loop5: detected capacity change from 0 to 512 [ 78.985625][ T7151] EXT4-fs: Ignoring removed i_version option [ 78.991811][ T7151] EXT4-fs: Ignoring removed bh option [ 79.020268][ T7151] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 79.046038][ T7151] ext4 filesystem being mounted at /155/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 79.107439][ T4685] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 79.236658][ T7178] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1454'. [ 79.255750][ T7179] ALSA: seq fatal error: cannot create timer (-19) [ 79.290701][ T7186] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1457'. [ 79.299776][ T7186] netem: unknown loss type 12 [ 79.304534][ T7186] netem: change failed [ 79.440814][ T7199] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1462'. [ 79.454315][ T7194] SELinux: failed to load policy [ 79.676145][ T7215] Process accounting resumed [ 79.735052][ T7226] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1472'. [ 79.926364][ T7237] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1478'. [ 80.005235][ T36] IPVS: starting estimator thread 0... [ 80.071130][ T7248] sch_tbf: burst 22 is lower than device lo mtu (11337746) ! [ 80.091670][ T7243] IPVS: using max 2352 ests per chain, 117600 per kthread [ 80.702795][ T7276] netlink: 'syz.1.1503': attribute type 1 has an invalid length. [ 81.466033][ T7303] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1504'. [ 82.921812][ T7369] __nla_validate_parse: 6 callbacks suppressed [ 82.921831][ T7369] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1529'. [ 82.951420][ T7369] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1529'. [ 82.988896][ T7371] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1530'. [ 83.051188][ T29] kauditd_printk_skb: 122 callbacks suppressed [ 83.051208][ T29] audit: type=1400 audit(2000000006.410:2000): avc: denied { setopt } for pid=7377 comm="syz.2.1532" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 83.125632][ T29] audit: type=1326 audit(2000000006.500:2001): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7385 comm="syz.2.1537" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 83.149293][ T29] audit: type=1326 audit(2000000006.500:2002): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7385 comm="syz.2.1537" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 83.173018][ T29] audit: type=1326 audit(2000000006.500:2003): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7385 comm="syz.2.1537" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 83.196607][ T29] audit: type=1326 audit(2000000006.500:2004): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7385 comm="syz.2.1537" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 83.220084][ T29] audit: type=1326 audit(2000000006.500:2005): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7385 comm="syz.2.1537" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 83.244759][ T29] audit: type=1326 audit(2000000006.500:2006): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7385 comm="syz.2.1537" exe="/root/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 83.268326][ T29] audit: type=1326 audit(2000000006.550:2007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7385 comm="syz.2.1537" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 83.292229][ T29] audit: type=1326 audit(2000000006.570:2008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7389 comm="syz.2.1537" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f1de0b22005 code=0x7ffc0000 [ 83.315680][ T29] audit: type=1326 audit(2000000006.570:2009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7385 comm="syz.2.1537" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 83.365125][ T7399] netlink: 'syz.3.1542': attribute type 1 has an invalid length. [ 83.373013][ T7399] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1542'. [ 83.514571][ T7416] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1549'. [ 83.553089][ T7416] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1549'. [ 83.572456][ T7416] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1549'. [ 83.613741][ T7423] netlink: 'syz.1.1552': attribute type 1 has an invalid length. [ 83.631348][ T7425] ip6_tunnel: non-ECT from 2001:0000:0000:0000:0000:0000:0000:0001 with DS=0x7 [ 83.633964][ T7416] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1549'. [ 83.691234][ T7423] 8021q: adding VLAN 0 to HW filter on device bond2 [ 83.726086][ T7416] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1549'. [ 83.735705][ T7433] bond2: option tlb_dynamic_lb: unable to set because the bond device is up [ 83.773821][ T7425] ip6_tunnel: non-ECT from 2001:0000:0000:0000:0000:0000:0000:0001 with DS=0x7 [ 83.800780][ T7437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.810524][ T7437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.122470][ T7466] IPv6: NLM_F_CREATE should be specified when creating new route [ 84.156735][ T7468] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.167209][ T7468] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 84.260068][ T7468] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.270512][ T7468] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 84.367373][ T7468] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.377753][ T7468] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 84.525192][ T7468] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.535869][ T7468] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 84.684202][ T297] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 84.692577][ T297] netdevsim netdevsim5 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 84.726848][ T297] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 84.735226][ T297] netdevsim netdevsim5 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 84.746429][ T297] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 84.754842][ T297] netdevsim netdevsim5 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 84.773492][ T297] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 84.781899][ T297] netdevsim netdevsim5 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 84.839059][ T7493] sd 0:0:1:0: device reset [ 85.129151][ T7511] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1585'. [ 85.244332][ T7516] netlink: 'syz.1.1586': attribute type 1 has an invalid length. [ 85.274331][ T7516] 8021q: adding VLAN 0 to HW filter on device bond3 [ 85.958956][ T7581] sd 0:0:1:0: device reset [ 86.047609][ T7589] tipc: Started in network mode [ 86.052570][ T7589] tipc: Node identity ac14140f, cluster identity 4711 [ 86.059572][ T7589] tipc: New replicast peer: 255.255.255.32 [ 86.065692][ T7589] tipc: Enabled bearer , priority 10 [ 86.411823][ T7645] netlink: 'syz.1.1631': attribute type 8 has an invalid length. [ 86.461459][ T7645] bond0: entered promiscuous mode [ 86.466592][ T7645] bond_slave_0: entered promiscuous mode [ 86.472531][ T7645] bond_slave_1: entered promiscuous mode [ 86.480175][ T7645] gretap0: entered promiscuous mode [ 86.503064][ T7645] bond0: left promiscuous mode [ 86.507890][ T7645] bond_slave_0: left promiscuous mode [ 86.513524][ T7645] bond_slave_1: left promiscuous mode [ 86.525499][ T7645] gretap0: left promiscuous mode [ 86.623900][ T7670] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.643073][ T7668] loop4: detected capacity change from 0 to 128 [ 86.690703][ T7670] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.773047][ T7670] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.881986][ T7697] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.903658][ T7670] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.935210][ T7697] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.971483][ T31] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.984063][ T297] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.995598][ T7697] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.010715][ T31] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.022781][ T31] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.035263][ T7697] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.092011][ T31] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.105016][ T31] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.117608][ T31] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.129066][ T31] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.181679][ T5857] tipc: Node number set to 2886997007 [ 87.262784][ T7720] ALSA: seq fatal error: cannot create timer (-19) [ 87.778959][ T7781] loop5: detected capacity change from 0 to 1024 [ 87.795354][ T7781] EXT4-fs: Ignoring removed bh option [ 87.804841][ T7781] EXT4-fs: inline encryption not supported [ 87.811865][ T7781] EXT4-fs (loop5): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 87.822684][ T7781] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 87.830871][ T7781] EXT4-fs (loop5): orphan cleanup on readonly fs [ 87.843419][ T7781] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #3: block 2: comm syz.5.1690: lblock 2 mapped to illegal pblock 2 (length 1) [ 87.857939][ T7781] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #3: block 48: comm syz.5.1690: lblock 0 mapped to illegal pblock 48 (length 1) [ 87.881596][ T7781] EXT4-fs error (device loop5): ext4_acquire_dquot:6945: comm syz.5.1690: Failed to acquire dquot type 0 [ 87.893244][ T7781] EXT4-fs error (device loop5) in ext4_reserve_inode_write:6313: Corrupt filesystem [ 87.906952][ T7781] EXT4-fs error (device loop5): ext4_evict_inode:254: inode #11: comm syz.5.1690: mark_inode_dirty error [ 87.919539][ T7781] EXT4-fs warning (device loop5): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 87.930275][ T7781] EXT4-fs (loop5): 1 orphan inode deleted [ 87.940458][ T31] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #3: block 1: comm kworker/u8:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 87.967255][ T31] EXT4-fs error (device loop5): ext4_release_dquot:6981: comm kworker/u8:1: Failed to release dquot type 0 [ 87.979674][ T7781] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 88.008040][ T4685] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 88.580658][ T7826] loop3: detected capacity change from 0 to 512 [ 88.616098][ T7826] EXT4-fs error (device loop3): ext4_validate_block_bitmap:432: comm syz.3.1707: bg 0: block 5: invalid block bitmap [ 88.638737][ T7826] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 88.695538][ T7826] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.1707: invalid indirect mapped block 3 (level 2) [ 88.712112][ T7826] EXT4-fs (loop3): 2 truncates cleaned up [ 88.720420][ T7826] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 88.742290][ T29] kauditd_printk_skb: 178 callbacks suppressed [ 88.742310][ T29] audit: type=1400 audit(2000000525.113:2185): avc: denied { write open } for pid=7825 comm="syz.3.1707" path="/319/file0/bus" dev="loop3" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 88.771695][ T29] audit: type=1400 audit(2000000525.113:2186): avc: denied { append } for pid=7825 comm="syz.3.1707" name="file2" dev="loop3" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 88.849248][ T29] audit: type=1400 audit(2000000525.223:2187): avc: denied { read write } for pid=7845 comm="syz.4.1716" name="uhid" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 88.849585][ T5890] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x4 [ 88.873026][ T29] audit: type=1400 audit(2000000525.223:2188): avc: denied { open } for pid=7845 comm="syz.4.1716" path="/dev/uhid" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 88.880665][ T5890] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x2 [ 88.921692][ T5890] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 88.929602][ T5890] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 88.934597][ T3323] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 88.937446][ T5890] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 88.954034][ T5890] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 88.961731][ T5890] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 88.969404][ T5890] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 88.977199][ T5890] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 88.984893][ T5890] hid-generic 0000:3000000:0000.0004: unknown main item tag 0x0 [ 88.993991][ T5890] hid-generic 0000:3000000:0000.0004: hidraw0: HID v0.00 Device [sy] on syz0 [ 89.043259][ T29] audit: type=1400 audit(2000000525.423:2189): avc: denied { watch_reads } for pid=7858 comm="+}[@" path="/334" dev="tmpfs" ino=1729 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 89.140559][ T7871] netlink: 'syz.1.1728': attribute type 5 has an invalid length. [ 89.158884][ T7880] bridge0: port 3(gretap0) entered blocking state [ 89.165526][ T7880] bridge0: port 3(gretap0) entered disabled state [ 89.172332][ T7880] gretap0: entered allmulticast mode [ 89.178383][ T7880] gretap0: entered promiscuous mode [ 89.184682][ T7880] gretap0: left allmulticast mode [ 89.189748][ T7880] gretap0: left promiscuous mode [ 89.195081][ T7880] bridge0: port 3(gretap0) entered disabled state [ 89.218458][ T29] audit: type=1326 audit(2000000525.593:2190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7886 comm="syz.1.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 89.241944][ T29] audit: type=1326 audit(2000000525.593:2191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7886 comm="syz.1.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 89.270661][ T29] audit: type=1326 audit(2000000525.603:2192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7886 comm="syz.1.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 89.294197][ T29] audit: type=1326 audit(2000000525.603:2193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7886 comm="syz.1.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 89.297839][ T7884] loop3: detected capacity change from 0 to 2048 [ 89.317992][ T29] audit: type=1326 audit(2000000525.603:2194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7886 comm="syz.1.1735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17fbb7f749 code=0x7ffc0000 [ 89.331070][ T7884] EXT4-fs: Ignoring removed bh option [ 89.369520][ T7884] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 89.405093][ T7884] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 89.422264][ T7884] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 17 with error 28 [ 89.434603][ T7884] EXT4-fs (loop3): This should not happen!! Data will be lost [ 89.434603][ T7884] [ 89.444367][ T7884] EXT4-fs (loop3): Total free blocks count 0 [ 89.450376][ T7884] EXT4-fs (loop3): Free/Dirty block details [ 89.456328][ T7884] EXT4-fs (loop3): free_blocks=2415919104 [ 89.462214][ T7884] EXT4-fs (loop3): dirty_blocks=32 [ 89.467414][ T7884] EXT4-fs (loop3): Block reservation details [ 89.473452][ T7884] EXT4-fs (loop3): i_reserved_data_blocks=2 [ 89.542025][ T7913] loop4: detected capacity change from 0 to 128 [ 89.551399][ T7913] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 89.564751][ T7918] veth0_vlan: entered allmulticast mode [ 89.573236][ T7913] ext4 filesystem being mounted at /341/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 89.615312][ T3323] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.636478][ T7922] SELinux: Context @ is not valid (left unmapped). [ 89.695895][ T1457] Bluetooth: hci0: Frame reassembly failed (-84) [ 89.710084][ T7930] __nla_validate_parse: 5 callbacks suppressed [ 89.710098][ T7930] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1752'. [ 89.799845][ T3320] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 89.828628][ T7937] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1754'. [ 90.360181][ T8026] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1762'. [ 90.369339][ T8026] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1762'. [ 90.378426][ T8026] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1762'. [ 90.756829][ T8074] syzkaller1: entered promiscuous mode [ 90.762476][ T8074] syzkaller1: entered allmulticast mode [ 90.935687][ T8085] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1783'. [ 90.949467][ T1457] netdevsim netdevsim5 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 90.949493][ T8085] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1783'. [ 90.967387][ T1457] netdevsim netdevsim5 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 90.975700][ T1457] netdevsim netdevsim5 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 90.984166][ T1457] netdevsim netdevsim5 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 91.006011][ T8087] netlink: 'syz.5.1784': attribute type 8 has an invalid length. [ 91.013814][ T8087] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1784'. [ 91.025574][ T8087] bond0: entered promiscuous mode [ 91.030642][ T8087] bond_slave_0: entered promiscuous mode [ 91.036694][ T8087] bond_slave_1: entered promiscuous mode [ 91.042785][ T8087] dummy0: entered promiscuous mode [ 91.049382][ T8087] gretap0: entered promiscuous mode [ 91.055796][ T8087] veth0_to_batadv: entered promiscuous mode [ 91.062309][ T8087] hsr1: entered promiscuous mode [ 91.485466][ T8105] netlink: 27 bytes leftover after parsing attributes in process `syz.3.1792'. [ 91.524892][ T8109] netlink: 'syz.2.1794': attribute type 12 has an invalid length. [ 91.701659][ T44] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 91.749481][ T8130] pim6reg1: entered promiscuous mode [ 91.754879][ T8130] pim6reg1: entered allmulticast mode [ 91.803377][ T8137] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1807'. [ 92.054706][ T8167] netlink: 'syz.1.1821': attribute type 1 has an invalid length. [ 92.067651][ T8161] team1: entered promiscuous mode [ 92.072831][ T8161] team1: entered allmulticast mode [ 92.078431][ T8161] 8021q: adding VLAN 0 to HW filter on device team1 [ 92.100102][ T8167] bond4: entered promiscuous mode [ 92.105232][ T8167] bond4: entered allmulticast mode [ 92.112542][ T8167] 8021q: adding VLAN 0 to HW filter on device bond4 [ 92.116493][ T8172] loop5: detected capacity change from 0 to 2048 [ 92.183194][ T8172] Alternate GPT is invalid, using primary GPT. [ 92.189550][ T8172] loop5: p1 p2 p3 [ 92.193373][ T8172] loop5: partition table partially beyond EOD, truncated [ 92.229803][ T8186] loop4: detected capacity change from 0 to 512 [ 92.255629][ T8187] bridge0: entered promiscuous mode [ 92.276374][ T8186] EXT4-fs: Ignoring removed bh option [ 92.282089][ T8187] macsec1: entered promiscuous mode [ 92.296419][ T8187] bridge0: port 3(macsec1) entered blocking state [ 92.303070][ T8187] bridge0: port 3(macsec1) entered disabled state [ 92.311107][ T8186] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 92.321397][ T8187] macsec1: entered allmulticast mode [ 92.326854][ T8187] bridge0: entered allmulticast mode [ 92.345755][ T8187] macsec1: left allmulticast mode [ 92.350860][ T8187] bridge0: left allmulticast mode [ 92.356814][ T8186] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2853: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 92.370820][ T8187] bridge0: left promiscuous mode [ 92.375908][ T8186] EXT4-fs (loop4): 1 truncate cleaned up [ 92.382362][ T8186] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 92.446388][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 92.527050][ T8216] bond0: Caught tx_queue_len zero misconfig [ 92.618908][ T8228] pim6reg1: entered promiscuous mode [ 92.624316][ T8228] pim6reg1: entered allmulticast mode [ 92.771620][ T8245] veth1_to_bond: entered allmulticast mode [ 92.791362][ T8245] bond0: (slave bond_slave_1): Releasing backup interface [ 92.826455][ T8247] netlink: 'syz.4.1856': attribute type 10 has an invalid length. [ 92.834869][ T8245] veth1_to_bond (unregistering): left allmulticast mode [ 92.857416][ T8247] team0: Port device dummy0 added [ 93.014504][ T8256] loop4: detected capacity change from 0 to 2048 [ 93.032134][ T8256] EXT4-fs: Ignoring removed bh option [ 93.059490][ T8256] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 93.135763][ T8256] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 93.153192][ T8256] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 17 with error 28 [ 93.165648][ T8256] EXT4-fs (loop4): This should not happen!! Data will be lost [ 93.165648][ T8256] [ 93.175398][ T8256] EXT4-fs (loop4): Total free blocks count 0 [ 93.181397][ T8256] EXT4-fs (loop4): Free/Dirty block details [ 93.187420][ T8256] EXT4-fs (loop4): free_blocks=2415919104 [ 93.193243][ T8256] EXT4-fs (loop4): dirty_blocks=32 [ 93.198360][ T8256] EXT4-fs (loop4): Block reservation details [ 93.204476][ T8256] EXT4-fs (loop4): i_reserved_data_blocks=2 [ 93.242185][ T8267] loop5: detected capacity change from 0 to 1024 [ 93.264154][ T8267] EXT4-fs: Ignoring removed orlov option [ 93.292754][ T8267] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 93.330548][ T8267] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm syz.5.1873: bg 0: block 232: padding at end of block bitmap is not set [ 93.347851][ T8274] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 93.359639][ T8274] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 93.367624][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.392635][ T8267] EXT4-fs (loop5): Remounting filesystem read-only [ 93.418315][ T8267] EXT4-fs (loop5): error restoring inline_data for inode -- potential data loss! (inode 12, error -30) [ 93.492739][ T4685] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.556378][ T8288] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8288 comm=syz.4.1871 [ 93.612385][ T8294] xt_CT: You must specify a L4 protocol and not use inversions on it [ 94.308738][ T29] kauditd_printk_skb: 178 callbacks suppressed [ 94.308755][ T29] audit: type=1400 audit(2000000530.683:2373): avc: denied { create } for pid=8341 comm="syz.5.1896" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 94.328746][ T8342] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 94.334796][ T29] audit: type=1400 audit(2000000530.683:2374): avc: denied { setopt } for pid=8341 comm="syz.5.1896" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 94.366455][ T29] audit: type=1400 audit(2000000530.723:2375): avc: denied { bind } for pid=8341 comm="syz.5.1896" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 94.443312][ T29] audit: type=1400 audit(2000000530.823:2376): avc: denied { name_bind } for pid=8349 comm="syz.5.1900" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 94.542817][ T29] audit: type=1326 audit(2000000530.923:2377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8364 comm="syz.4.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0df362f749 code=0x7ffc0000 [ 94.567326][ T29] audit: type=1326 audit(2000000530.943:2378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8364 comm="syz.4.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0df362f749 code=0x7ffc0000 [ 94.600834][ T29] audit: type=1326 audit(2000000530.963:2379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8364 comm="syz.4.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0df362f749 code=0x7ffc0000 [ 94.624473][ T29] audit: type=1326 audit(2000000530.973:2380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8364 comm="syz.4.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0df362f749 code=0x7ffc0000 [ 94.647943][ T29] audit: type=1326 audit(2000000530.973:2381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8364 comm="syz.4.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0df362f749 code=0x7ffc0000 [ 94.671372][ T29] audit: type=1326 audit(2000000530.973:2382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8364 comm="syz.4.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0df362f749 code=0x7ffc0000 [ 94.748479][ T8377] __nla_validate_parse: 10 callbacks suppressed [ 94.748501][ T8377] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1910'. [ 94.783391][ T8381] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8381 comm=syz.3.1911 [ 94.942363][ T8406] vhci_hcd: USB_PORT_FEAT_U1/2_TIMEOUT req not supported for USB 2.0 roothub [ 95.292037][ T8428] netlink: 'syz.4.1936': attribute type 12 has an invalid length. [ 95.362225][ T8437] netlink: 27 bytes leftover after parsing attributes in process `syz.5.1939'. [ 95.420152][ T8443] loop3: detected capacity change from 0 to 128 [ 95.461107][ T8443] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 95.502281][ T8450] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 95.530079][ T8443] ext4 filesystem being mounted at /362/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 95.564836][ T8450] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 95.645204][ T3323] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 95.770359][ T8473] loop5: detected capacity change from 0 to 1024 [ 95.787343][ T8473] EXT4-fs: Ignoring removed mblk_io_submit option [ 95.803684][ T8477] netlink: 27 bytes leftover after parsing attributes in process `syz.2.1958'. [ 95.813261][ T8479] ªªªªªª: renamed from vlan0 (while UP) [ 95.830629][ T8473] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 95.889584][ T4685] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 95.997480][ T8498] xt_CT: You must specify a L4 protocol and not use inversions on it [ 96.057214][ T8506] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1970'. [ 96.073021][ T8506] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1970'. [ 96.115908][ T8518] netlink: 'syz.2.1975': attribute type 4 has an invalid length. [ 96.123825][ T8518] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1975'. [ 96.146030][ T8518] .`: renamed from bond0 [ 96.243789][ T8532] xt_CT: You must specify a L4 protocol and not use inversions on it [ 96.456687][ T8551] vhci_hcd: USB_PORT_FEAT_U1/2_TIMEOUT req not supported for USB 2.0 roothub [ 96.539154][ T8561] xt_CT: You must specify a L4 protocol and not use inversions on it [ 96.653094][ T8572] all: renamed from lo (while UP) [ 97.042932][ T8588] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 97.274286][ T8592] loop3: detected capacity change from 0 to 512 [ 97.304042][ T8592] EXT4-fs: Ignoring removed orlov option [ 97.326530][ T8592] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 97.361522][ T8592] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8042c119, mo2=0002] [ 97.401244][ T8598] ------------[ cut here ]------------ [ 97.406820][ T8598] verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0x4000000, 0x0] s64=[0x4000000, 0x0] u32=[0x4000000, 0x0] s32=[0x4000000, 0x0] var_off=(0x0, 0x0) [ 97.425202][ T8598] WARNING: CPU: 0 PID: 8598 at kernel/bpf/verifier.c:2721 reg_bounds_sanity_check+0x673/0x680 [ 97.435782][ T8598] Modules linked in: [ 97.439898][ T8598] CPU: 0 UID: 0 PID: 8598 Comm: syz.1.2011 Not tainted syzkaller #0 PREEMPT(voluntary) [ 97.449891][ T8598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 97.460050][ T8598] RIP: 0010:reg_bounds_sanity_check+0x673/0x680 [ 97.466431][ T8598] Code: 7c 24 18 41 ff 74 24 20 55 41 56 4d 89 ee 53 48 8b 5c 24 30 ff 74 24 40 ff 74 24 50 ff 74 24 30 e8 12 f7 ba ff 48 83 c4 38 90 <0f> 0b 90 90 e9 02 fb ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 [ 97.486135][ T8598] RSP: 0018:ffffc9000f2eb408 EFLAGS: 00010282 [ 97.492321][ T8598] RAX: 85796f5cd4e16d00 RBX: ffff8881094b12e0 RCX: 0000000000080000 [ 97.500321][ T8598] RDX: ffffc9000214a000 RSI: 00000000000047f0 RDI: 00000000000047f1 [ 97.508465][ T8598] RBP: 0000000000000000 R08: 0001c9000f2eb257 R09: 0000000000000000 [ 97.516670][ T8598] R10: 00000000ffffffff R11: 0000000000000002 R12: ffff8881094b12a0 [ 97.524919][ T8598] R13: ffff88811b2f0000 R14: ffff88811b2f0000 R15: ffff8881094b12d8 [ 97.530755][ T8592] EXT4-fs error (device loop3): ext4_iget_extra_inode:5075: inode #15: comm syz.3.2009: corrupted in-inode xattr: e_value size too large [ 97.533374][ T8598] FS: 00007f17fa5e76c0(0000) GS:ffff8882aee11000(0000) knlGS:0000000000000000 [ 97.556228][ T8598] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.561331][ T8592] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.2009: couldn't read orphan inode 15 (err -117) [ 97.562866][ T8598] CR2: 00002000000011a0 CR3: 000000013f888000 CR4: 00000000003506f0 [ 97.562889][ T8598] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 97.590844][ T8598] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 97.594650][ T8592] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 97.598987][ T8598] Call Trace: [ 97.598998][ T8598] [ 97.617314][ T8598] reg_set_min_max+0x215/0x260 [ 97.622806][ T8598] check_cond_jmp_op+0x130d/0x19e0 [ 97.628061][ T8598] do_check+0x3363/0x8460 [ 97.632734][ T8598] do_check_common+0xc5e/0x12b0 [ 97.637618][ T8598] bpf_check+0xaaae/0xd9d0 [ 97.642147][ T8598] ? __alloc_frozen_pages_noprof+0x188/0x360 [ 97.648180][ T8598] ? alloc_pages_bulk_noprof+0x4a6/0x530 [ 97.653960][ T8598] ? __vmap_pages_range_noflush+0xbc4/0xcf0 [ 97.659895][ T8598] ? try_charge_memcg+0x215/0xa10 [ 97.665048][ T8598] ? pcpu_block_update+0x24e/0x3b0 [ 97.670241][ T8598] ? pcpu_block_refresh_hint+0x157/0x170 [ 97.670267][ T8598] ? pcpu_block_update_hint_alloc+0x63d/0x660 [ 97.670318][ T8598] ? css_rstat_updated+0xb7/0x240 [ 97.670349][ T8598] ? __rcu_read_unlock+0x4f/0x70 [ 97.670385][ T8598] ? pcpu_memcg_post_alloc_hook+0xf1/0x150 [ 97.670414][ T8598] ? bpf_prog_alloc+0x5b/0x150 [ 97.670548][ T8598] ? pcpu_alloc_noprof+0xd29/0x1250 [ 97.670573][ T8598] ? should_fail_ex+0x30/0x280 [ 97.670652][ T8598] ? should_failslab+0x8c/0xb0 [ 97.670749][ T8598] ? __kmalloc_noprof+0x2a2/0x570 [ 97.670788][ T8598] ? security_bpf_prog_load+0x60/0x140 [ 97.670828][ T8598] ? selinux_bpf_prog_load+0xad/0xd0 [ 97.670902][ T8598] ? security_bpf_prog_load+0x9e/0x140 [ 97.670944][ T8598] bpf_prog_load+0xf6e/0x1100 [ 97.670984][ T8598] ? security_bpf+0x2b/0x90 [ 97.671037][ T8598] __sys_bpf+0x469/0x7c0 [ 97.671073][ T8598] __x64_sys_bpf+0x41/0x50 [ 97.671190][ T8598] x64_sys_call+0x2aee/0x3000 [ 97.671223][ T8598] do_syscall_64+0xd2/0x200 [ 97.671284][ T8598] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 97.671327][ T8598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.671348][ T8598] RIP: 0033:0x7f17fbb7f749 [ 97.671363][ T8598] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 97.671383][ T8598] RSP: 002b:00007f17fa5e7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 97.671490][ T8598] RAX: ffffffffffffffda RBX: 00007f17fbdd5fa0 RCX: 00007f17fbb7f749 [ 97.671508][ T8598] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005 [ 97.671526][ T8598] RBP: 00007f17fbc03f91 R08: 0000000000000000 R09: 0000000000000000 [ 97.671573][ T8598] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.671586][ T8598] R13: 00007f17fbdd6038 R14: 00007f17fbdd5fa0 R15: 00007ffc9e350d78 [ 97.671665][ T8598] [ 97.671674][ T8598] ---[ end trace 0000000000000000 ]--- [ 97.692662][ T3323] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.791170][ T8618] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2018'. [ 97.791197][ T8618] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 97.870418][ T8626] geneve2: entered promiscuous mode [ 97.877543][ T31] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.877760][ T31] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.877814][ T31] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.877857][ T31] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.905759][ T8628] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 97.905778][ T8628] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 97.906941][ T8628] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 97.906958][ T8628] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 98.653519][ T8655] netlink: 'syz.2.2037': attribute type 1 has an invalid length. [ 98.661336][ T8655] netlink: 'syz.2.2037': attribute type 4 has an invalid length. [ 98.669157][ T8655] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.2037'. [ 98.688983][ T8658] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2038'. [ 98.718104][ T8658] 8021q: adding VLAN 0 to HW filter on device bond5 [ 98.739354][ T8658] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 98.760924][ T8658] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2038'. [ 98.820335][ T8658] bond5 (unregistering): (slave gretap1): Releasing backup interface [ 98.830427][ T8658] bond5 (unregistering): Released all slaves [ 99.336455][ T8711] tipc: Started in network mode [ 99.341384][ T8711] tipc: Node identity 00000000000000000000007ade000001, cluster identity 4711 [ 99.350327][ T8711] tipc: Enabling of bearer rejected, failed to enable media [ 99.365579][ T29] kauditd_printk_skb: 66 callbacks suppressed [ 99.365652][ T29] audit: type=1400 audit(2000000535.743:2449): avc: denied { write } for pid=8714 comm="syz.2.2062" lport=53580 faddr=::ffff:172.30.0.3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 99.423785][ T29] audit: type=1400 audit(2000000535.773:2450): avc: denied { setopt } for pid=8714 comm="syz.2.2062" lport=53580 faddr=::ffff:172.30.0.3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 99.582093][ T8735] netlink: 'syz.1.2071': attribute type 12 has an invalid length. [ 99.590005][ T8735] netlink: 'syz.1.2071': attribute type 29 has an invalid length. [ 99.653184][ T8740] netlink: 'syz.2.2083': attribute type 1 has an invalid length. [ 99.673885][ T8747] all: renamed from lo (while UP) [ 99.732822][ T8752] bond0 (unregistering): Released all slaves [ 99.763395][ T8754] __nla_validate_parse: 6 callbacks suppressed [ 99.763410][ T8754] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2079'. [ 100.059735][ T8781] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2092'. [ 100.152474][ T8787] wireguard0: entered promiscuous mode [ 100.217663][ T8796] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2098'. [ 100.250621][ T8800] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2100'. [ 100.436087][ T8873] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2107'. [ 100.532878][ T8876] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2109'. [ 100.534515][ T8880] loop5: detected capacity change from 0 to 128 [ 100.549406][ T8880] EXT4-fs: Ignoring removed nobh option [ 100.573609][ T8880] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 100.586427][ T8880] ext4 filesystem being mounted at /284/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 100.604847][ T29] audit: type=1326 audit(2000000536.983:2451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.2111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f1de0ae65e7 code=0x7ffc0000 [ 100.647697][ T4685] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 100.650619][ T29] audit: type=1326 audit(2000000536.983:2452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.2111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f1de0a8b829 code=0x7ffc0000 [ 100.680144][ T29] audit: type=1326 audit(2000000536.983:2453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.2111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f1de0ae65e7 code=0x7ffc0000 [ 100.703640][ T29] audit: type=1326 audit(2000000536.983:2454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.2111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f1de0a8b829 code=0x7ffc0000 [ 100.727077][ T29] audit: type=1326 audit(2000000536.983:2455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.2111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 100.750607][ T29] audit: type=1326 audit(2000000536.983:2456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.2111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 100.774195][ T29] audit: type=1326 audit(2000000536.983:2457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.2111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 100.797725][ T29] audit: type=1326 audit(2000000536.983:2458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8883 comm="syz.2.2111" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1de0aef749 code=0x7ffc0000 [ 100.914021][ T8903] loop5: detected capacity change from 0 to 128 [ 100.927014][ T8903] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 100.940687][ T8903] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 100.989523][ T8909] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 101.024366][ T8909] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2120'. [ 101.138656][ T8916] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2122'. [ 101.179983][ T8920] geneve3: entered promiscuous mode [ 101.185628][ T8920] geneve3: entered allmulticast mode [ 101.317274][ T8938] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2132'. [ 101.363908][ T8946] netlink: 'syz.3.2137': attribute type 3 has an invalid length. [ 101.501100][ T8956] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2142'. [ 101.795264][ T8991] netlink: 'syz.1.2155': attribute type 1 has an invalid length. [ 101.958215][ T9012] Falling back ldisc for ttyS3. [ 102.019423][ T9017] hub 8-0:1.0: USB hub found [ 102.029532][ T9017] hub 8-0:1.0: 8 ports detected [ 102.052522][ T9025] xt_connbytes: Forcing CT accounting to be enabled [ 102.059228][ T9025] set match dimension is over the limit! [ 102.113651][ T9033] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 102.120996][ T9033] vhci_hcd: invalid port number 96 [ 102.126242][ T9033] vhci_hcd: default hub control req: 0300 vfffa i0060 l0 [ 102.194791][ T9047] loop5: detected capacity change from 0 to 1024 [ 102.228167][ T9047] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 102.277800][ T9047] EXT4-fs (loop5): shut down requested (0) [ 102.310966][ T9059] SELinux: failed to load policy [ 102.316505][ T4685] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 102.780584][ T9105] loop5: detected capacity change from 0 to 512 [ 102.791264][ T9105] EXT4-fs: Ignoring removed orlov option [ 102.804848][ T9105] EXT4-fs (loop5): mounting ext3 file system using the ext4 subsystem [ 102.819337][ T9103] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 102.819628][ T9105] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8042c119, mo2=0002] [ 102.850992][ T9105] EXT4-fs error (device loop5): ext4_iget_extra_inode:5075: inode #15: comm syz.5.2204: corrupted in-inode xattr: e_value size too large [ 102.926412][ T9105] EXT4-fs error (device loop5): ext4_orphan_get:1397: comm syz.5.2204: couldn't read orphan inode 15 (err -117) [ 102.965642][ T9105] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 103.010536][ T4685] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 103.095273][ T9125] ipip0: entered promiscuous mode [ 103.141937][ T9131] loop3: detected capacity change from 0 to 164 [ 103.163046][ T9131] syz.3.2214: attempt to access beyond end of device [ 103.163046][ T9131] loop3: rw=524288, sector=263328, nr_sectors = 4 limit=164 [ 103.187745][ T9131] syz.3.2214: attempt to access beyond end of device [ 103.187745][ T9131] loop3: rw=0, sector=263328, nr_sectors = 4 limit=164 [ 103.363500][ T9151] loop4: detected capacity change from 0 to 512 [ 103.377474][ T9151] EXT4-fs error (device loop4): ext4_xattr_inode_iget:446: comm syz.4.2223: error while reading EA inode 32 err=-116 [ 103.404749][ T9151] EXT4-fs (loop4): Remounting filesystem read-only [ 103.415800][ T9151] EXT4-fs warning (device loop4): ext4_evict_inode:257: couldn't mark inode dirty (err -30) [ 103.429022][ T9151] EXT4-fs (loop4): 1 orphan inode deleted [ 103.435257][ T9151] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 103.461486][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 103.487764][ T9158] loop4: detected capacity change from 0 to 1024 [ 103.495326][ T9158] EXT4-fs: Ignoring removed mblk_io_submit option [ 103.513479][ T9158] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 103.562629][ T3320] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 103.621385][ T9178] netlink: 'syz.4.2235': attribute type 4 has an invalid length. [ 103.630775][ T9178] .`: renamed from bond0 [ 104.535498][ T9252] ================================================================== [ 104.543638][ T9252] BUG: KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read [ 104.552260][ T9252] [ 104.554597][ T9252] write to 0xffff888104501768 of 8 bytes by task 9248 on cpu 0: [ 104.562238][ T9252] shmem_file_splice_read+0x470/0x600 [ 104.567632][ T9252] splice_direct_to_actor+0x26f/0x680 [ 104.573020][ T9252] do_splice_direct+0xda/0x150 [ 104.577902][ T9252] do_sendfile+0x380/0x650 [ 104.582351][ T9252] __x64_sys_sendfile64+0x105/0x150 [ 104.587572][ T9252] x64_sys_call+0x2bb4/0x3000 [ 104.592265][ T9252] do_syscall_64+0xd2/0x200 [ 104.596785][ T9252] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.602701][ T9252] [ 104.605132][ T9252] write to 0xffff888104501768 of 8 bytes by task 9252 on cpu 1: [ 104.612775][ T9252] shmem_file_splice_read+0x470/0x600 [ 104.618210][ T9252] splice_direct_to_actor+0x26f/0x680 [ 104.623603][ T9252] do_splice_direct+0xda/0x150 [ 104.628379][ T9252] do_sendfile+0x380/0x650 [ 104.632844][ T9252] __x64_sys_sendfile64+0x105/0x150 [ 104.638148][ T9252] x64_sys_call+0x2bb4/0x3000 [ 104.642859][ T9252] do_syscall_64+0xd2/0x200 [ 104.647384][ T9252] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.653315][ T9252] [ 104.655639][ T9252] value changed: 0x0000000000004c24 -> 0x0000000000004c2f [ 104.662745][ T9252] [ 104.665071][ T9252] Reported by Kernel Concurrency Sanitizer on: [ 104.671312][ T9252] CPU: 1 UID: 0 PID: 9252 Comm: syz.1.2264 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 104.682695][ T9252] Tainted: [W]=WARN [ 104.686501][ T9252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 104.696648][ T9252] ==================================================================