last executing test programs: 1.705864105s ago: executing program 1 (id=2): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4000) io_uring_setup(0x391f, &(0x7f0000000040)={0x0, 0xc8a1, 0x4480, 0x8, 0xe1}) accept(r1, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.502456314s ago: executing program 1 (id=6): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000000)='./file1\x00', 0x8, &(0x7f0000000580)=ANY=[@ANYBLOB='dots,check=s,tz=UTC,nodots,nodots,nodots,quiet,nodots,nodots,nodots,nodots,dots,nodots,nodots,dots,nodots,errors=continue,dots,dots,dots,debug,\x00'/154], 0x3, 0x1dc, &(0x7f0000000840)="$eJzs3UFrE0EUAOCXpG1ST70JorLgRS9F/QUViSAGBCUHPSlUL60I9hK9tD/DH+gPkJ5ykZU4m46JCGl0d2v9vkveztuXvAmbSSBk8ur6u4P990dvv1z9HINBJ7p7sRfTTuxEN+ZOAgC4TKZlGV/LpO1eAIBmrPD+/+23xb3a2gIAavT8xcsnD0aj4bOiGEScnkzGk3G6TflHj0fDu8UPd3LV6WQy7p3l7xXLnx1m+c24kr46GN5P9cVCfnMrbt9K9bPcw6ejxfy4H/v1Th0AAAAAAAAAAAAAAAAAAAAAAFpzI4q5nTya9/fZ3V3Ob1f5dPTT/kBL+/dsxLWN6jBvD1QeNzEpAAAAAAAAAAAAAAAAAAAA+Mccffx08Prw8M2HHPQjYnHkPEGnuuM1y5sOujEfubmVGr8gjbUR9C5GG38eFOeu6lWX7d/tZ81XwexKrOv5mZZludLJeY3oN74qAQAAAAAAAAAAAAAAAADA/yn/6PfX3KCNhgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgBfn//9cIjiNihZPPHmy71akCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwiX0PAAD//zqOLiI=") unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file1/file4/file5\x00', 0x81c0, 0x40000002) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file1/file4/file5\x00', 0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0) 1.447336306s ago: executing program 2 (id=3): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18020000ffffffff00000000000000001801000020646c2500000000002020207b1ab8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000007d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='mem_disconnect\x00', r0}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='mem_disconnect\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000004100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xe, 0x0, &(0x7f00000003c0)="131c8701feaa16bca4ac74ab821d", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) 1.383101349s ago: executing program 3 (id=4): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x13, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000580)='kmem_cache_free\x00', r1}, 0x18) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x20900, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) acct(&(0x7f0000000040)='./file0\x00') 1.339901991s ago: executing program 4 (id=5): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1], 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000380)='hrtimer_start\x00'}, 0x18) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f00000002c0)='sched_kthread_work_queue_work\x00', r2}, 0x10) socketpair(0xf, 0x3, 0x2, &(0x7f00000001c0)) 1.316040002s ago: executing program 1 (id=7): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="0b00000073790101000000000000000000000000000af7f4f0c55de8ca0000000000000000000000000000000000000000f3c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00000000000000000000000000000020"], 0x138) write$UHID_DESTROY(r3, &(0x7f0000000340), 0x4) 1.269886314s ago: executing program 3 (id=8): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000840)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x0, 0x1}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x200000, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x2, 0x1}, 0x10) sendmsg$tipc(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000090}, 0x95) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000000), 0x4) r2 = dup3(r0, r1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(r2, 0x10f, 0x88) 1.256627095s ago: executing program 4 (id=9): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000650000000800000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000640)='kfree\x00', r2}, 0x18) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=@newqdisc={0x78, 0x24, 0x3fe3aa0262d8c783, 0x20, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xa}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x3, 0x0, 0x7ff, 0x1}, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x8, 0x80, 0x0, 0x0, 0x0, {0x0, 0x0, 0xffffffdc, 0x0, 0xff}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40}, 0x0) 1.254329795s ago: executing program 0 (id=1): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b80)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0xffffffff}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xf, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00', r1}, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r2}, 0x10) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) r4 = syz_pidfd_open(r3, 0x0) pidfd_send_signal(r4, 0x2, 0x0, 0x0) 1.218084836s ago: executing program 2 (id=10): pipe2(&(0x7f00000006c0)={0xffffffffffffffff}, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000400)='kfree\x00', r3}, 0x18) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r4 = socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e22, @broadcast}, 0x2, 0x9800}}, 0x2e) close_range(r0, 0xffffffffffffffff, 0x0) 1.202148497s ago: executing program 4 (id=11): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r0}, &(0x7f00000008c0), &(0x7f0000000880)=r1}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) bpf$MAP_DELETE_ELEM(0x2, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x20000000}, 0x20) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x40010040) r5 = socket$kcm(0x2c, 0x3, 0x0) setsockopt$sock_attach_bpf(r5, 0x11b, 0x2, &(0x7f0000000900)=r4, 0x4) 1.025172435s ago: executing program 3 (id=12): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f00000002c0)='kfree\x00', r1, 0x0, 0x2}, 0x18) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) fchdir(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000140)={0x474203, 0x5d4}, 0x18) 988.372526ms ago: executing program 2 (id=13): socket$xdp(0x2c, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x4008032, 0xffffffffffffffff, 0x0) ioctl$TIOCCONS(0xffffffffffffffff, 0x541d) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000001018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000016c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000180)='kmem_cache_free\x00', r1}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) 838.017643ms ago: executing program 0 (id=14): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x39c4, 0x2, 0x4, 0xfffffffe}, &(0x7f0000000580)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) io_uring_enter(r2, 0x66a8, 0x4000, 0xf, 0x0, 0x18) 784.885146ms ago: executing program 1 (id=15): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) close(0x3) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r5], 0x1c}}, 0x0) close(0x3) 437.611921ms ago: executing program 3 (id=16): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc093, 0x4, @perf_bp={0x0, 0x8}, 0x4, 0x0, 0x10000, 0x8, 0x2, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x404, &(0x7f0000000580)={[{@orlov}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}]}, 0x1, 0x5d8, &(0x7f0000000c00)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./bus\x00', 0x42, 0x61) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1202, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7ffff000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 424.97363ms ago: executing program 1 (id=17): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x50) setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xd}, {0xffff, 0xffff}, {0xe}}}, 0x24}}, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x4, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_u}]}}) write$P9_RVERSION(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="150000006bffff"], 0x15) 309.214886ms ago: executing program 1 (id=18): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = syz_io_uring_setup(0x14f5, &(0x7f0000000400)={0x0, 0xd144, 0x0, 0xffffffff, 0x289}, &(0x7f00000001c0)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000004c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x68, 0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1, 0x1, {0x2}}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r2, 0x0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x30}}) io_uring_enter(r3, 0x3516, 0xddd6, 0x4, 0x0, 0x3ec0) 304.871486ms ago: executing program 4 (id=19): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xfffffffc) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) sendmmsg(r1, &(0x7f00000094c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000300)="eb", 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x80) 232.080979ms ago: executing program 2 (id=20): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x4}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001000)={0x11, 0xf, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x18) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200000008000300ac1414aa0800060001"], 0x38}, 0x1, 0x0, 0x0, 0x4000011}, 0x4c080) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="010028bd7000fcdbdf2504"], 0x14}}, 0x0) 229.115649ms ago: executing program 4 (id=21): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb146000) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r0}, &(0x7f00000008c0), &(0x7f0000000880)=r1}, 0x20) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) io_setup(0x8f0, &(0x7f0000002400)=0x0) io_submit(r3, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2000000000, 0x4, 0x0, 0x1, 0x0, r2, &(0x7f0000000040)="0200ffff0000", 0x6, 0x0, 0x0, 0x2}]) 168.366932ms ago: executing program 2 (id=22): socket$inet_sctp(0x2, 0x1, 0x84) r0 = inotify_init() syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='smaps_rollup\x00') fchdir(r1) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000000)='./file0\x00', 0x80000006) close(0x3) close_range(r0, 0xffffffffffffffff, 0x0) 52.111527ms ago: executing program 2 (id=23): fsopen(0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01063d0000000000000028000000280000000200000000000000000000030000020000000200000000000000010000000000000104"], 0x0, 0x42}, 0x28) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000180)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00"/47], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) read(0xffffffffffffffff, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000440)=ANY=[]) 0s ago: executing program 4 (id=24): perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}, 0x1100, 0x0, 0xfffffffc, 0x4, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) kernel console output (not intermixed with test programs): [ 18.194113][ T29] audit: type=1400 audit(1765259343.547:62): avc: denied { search } for pid=3198 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.216056][ T29] audit: type=1400 audit(1765259343.547:63): avc: denied { search } for pid=3198 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=477 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.238678][ T29] audit: type=1400 audit(1765259343.547:64): avc: denied { search } for pid=3198 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=481 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.261530][ T29] audit: type=1400 audit(1765259343.547:65): avc: denied { search } for pid=3198 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.284489][ T29] audit: type=1400 audit(1765259343.547:66): avc: denied { read open } for pid=3199 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.0.131' (ED25519) to the list of known hosts. [ 23.579840][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 23.579855][ T29] audit: type=1400 audit(1765259348.937:70): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.608766][ T29] audit: type=1400 audit(1765259348.967:71): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.609534][ T3304] cgroup: Unknown subsys name 'net' [ 23.636400][ T29] audit: type=1400 audit(1765259348.987:72): avc: denied { unmount } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.788721][ T3304] cgroup: Unknown subsys name 'cpuset' [ 23.794741][ T3304] cgroup: Unknown subsys name 'rlimit' [ 23.963982][ T29] audit: type=1400 audit(1765259349.317:73): avc: denied { setattr } for pid=3304 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.992795][ T29] audit: type=1400 audit(1765259349.317:74): avc: denied { create } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.013412][ T29] audit: type=1400 audit(1765259349.317:75): avc: denied { write } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.033809][ T29] audit: type=1400 audit(1765259349.317:76): avc: denied { read } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.040432][ T3306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.054063][ T29] audit: type=1400 audit(1765259349.327:77): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.087361][ T29] audit: type=1400 audit(1765259349.327:78): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.110676][ T29] audit: type=1400 audit(1765259349.347:79): avc: denied { read } for pid=3044 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 24.142538][ T3304] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.157042][ T3313] chnl_net:caif_netlink_parms(): no params data found [ 25.228890][ T3313] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.236001][ T3313] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.243272][ T3313] bridge_slave_0: entered allmulticast mode [ 25.249585][ T3313] bridge_slave_0: entered promiscuous mode [ 25.256262][ T3313] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.263390][ T3313] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.270686][ T3313] bridge_slave_1: entered allmulticast mode [ 25.276895][ T3313] bridge_slave_1: entered promiscuous mode [ 25.311104][ T3313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 25.323106][ T3313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 25.364541][ T3313] team0: Port device team_slave_0 added [ 25.372612][ T3313] team0: Port device team_slave_1 added [ 25.397787][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 25.404780][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 25.430831][ T3313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 25.448654][ T3320] chnl_net:caif_netlink_parms(): no params data found [ 25.459351][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 25.466335][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 25.492316][ T3313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 25.510491][ T3319] chnl_net:caif_netlink_parms(): no params data found [ 25.575517][ T3314] chnl_net:caif_netlink_parms(): no params data found [ 25.607558][ T3313] hsr_slave_0: entered promiscuous mode [ 25.613449][ T3313] hsr_slave_1: entered promiscuous mode [ 25.642726][ T3319] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.649909][ T3319] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.656979][ T3319] bridge_slave_0: entered allmulticast mode [ 25.663300][ T3319] bridge_slave_0: entered promiscuous mode [ 25.669676][ T3320] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.676708][ T3320] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.683850][ T3320] bridge_slave_0: entered allmulticast mode [ 25.690186][ T3320] bridge_slave_0: entered promiscuous mode [ 25.696737][ T3320] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.703809][ T3320] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.711073][ T3320] bridge_slave_1: entered allmulticast mode [ 25.717462][ T3320] bridge_slave_1: entered promiscuous mode [ 25.723807][ T3323] chnl_net:caif_netlink_parms(): no params data found [ 25.734277][ T3319] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.741324][ T3319] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.748460][ T3319] bridge_slave_1: entered allmulticast mode [ 25.754663][ T3319] bridge_slave_1: entered promiscuous mode [ 25.799785][ T3320] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 25.822976][ T3319] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 25.832904][ T3320] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 25.851211][ T3319] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 25.868677][ T3314] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.875732][ T3314] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.882955][ T3314] bridge_slave_0: entered allmulticast mode [ 25.889316][ T3314] bridge_slave_0: entered promiscuous mode [ 25.910791][ T3314] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.917896][ T3314] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.925145][ T3314] bridge_slave_1: entered allmulticast mode [ 25.931369][ T3314] bridge_slave_1: entered promiscuous mode [ 25.942626][ T3320] team0: Port device team_slave_0 added [ 25.959540][ T3319] team0: Port device team_slave_0 added [ 25.965807][ T3320] team0: Port device team_slave_1 added [ 25.978602][ T3323] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.985644][ T3323] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.992856][ T3323] bridge_slave_0: entered allmulticast mode [ 25.999180][ T3323] bridge_slave_0: entered promiscuous mode [ 26.010083][ T3319] team0: Port device team_slave_1 added [ 26.016605][ T3314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.034562][ T3323] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.041647][ T3323] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.048892][ T3323] bridge_slave_1: entered allmulticast mode [ 26.055313][ T3323] bridge_slave_1: entered promiscuous mode [ 26.066659][ T3314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.078977][ T3320] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.085909][ T3320] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.111904][ T3320] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.142275][ T3320] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.149284][ T3320] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.175194][ T3320] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.190980][ T3319] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.197942][ T3319] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.223850][ T3319] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.235650][ T3314] team0: Port device team_slave_0 added [ 26.250357][ T3323] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.259828][ T3319] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.266762][ T3319] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.292666][ T3319] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.304054][ T3314] team0: Port device team_slave_1 added [ 26.313336][ T3323] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.353810][ T3323] team0: Port device team_slave_0 added [ 26.363517][ T3320] hsr_slave_0: entered promiscuous mode [ 26.369515][ T3320] hsr_slave_1: entered promiscuous mode [ 26.375272][ T3320] debugfs: 'hsr0' already exists in 'hsr' [ 26.381070][ T3320] Cannot create hsr debugfs directory [ 26.387044][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.394037][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.419959][ T3314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.439927][ T3323] team0: Port device team_slave_1 added [ 26.446112][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.453128][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.479025][ T3314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.493502][ T3319] hsr_slave_0: entered promiscuous mode [ 26.499550][ T3319] hsr_slave_1: entered promiscuous mode [ 26.505331][ T3319] debugfs: 'hsr0' already exists in 'hsr' [ 26.511097][ T3319] Cannot create hsr debugfs directory [ 26.537961][ T3323] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.544988][ T3323] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.570976][ T3323] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.592159][ T3323] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.599193][ T3323] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.625108][ T3323] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.635889][ T3313] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 26.657810][ T3313] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 26.668038][ T3314] hsr_slave_0: entered promiscuous mode [ 26.673967][ T3314] hsr_slave_1: entered promiscuous mode [ 26.679755][ T3314] debugfs: 'hsr0' already exists in 'hsr' [ 26.685478][ T3314] Cannot create hsr debugfs directory [ 26.697471][ T3313] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 26.713504][ T3313] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 26.747222][ T3323] hsr_slave_0: entered promiscuous mode [ 26.753299][ T3323] hsr_slave_1: entered promiscuous mode [ 26.759197][ T3323] debugfs: 'hsr0' already exists in 'hsr' [ 26.764975][ T3323] Cannot create hsr debugfs directory [ 26.879804][ T3320] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 26.893354][ T3320] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 26.901960][ T3320] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 26.912499][ T3320] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 26.959756][ T3314] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 26.968634][ T3314] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 26.979542][ T3314] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 26.990487][ T3314] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 27.007248][ T3319] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 27.016173][ T3319] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 27.027097][ T3319] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 27.035716][ T3319] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 27.052771][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.074064][ T3323] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 27.083108][ T3323] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 27.095697][ T3323] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 27.105263][ T3323] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 27.123061][ T3313] 8021q: adding VLAN 0 to HW filter on device team0 [ 27.134448][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.141576][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.162531][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.169716][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.181640][ T3320] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.209800][ T3320] 8021q: adding VLAN 0 to HW filter on device team0 [ 27.228344][ T91] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.235445][ T91] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.256940][ T91] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.264099][ T91] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.282997][ T3314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.295739][ T3314] 8021q: adding VLAN 0 to HW filter on device team0 [ 27.320147][ T1668] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.327218][ T1668] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.335971][ T1668] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.343060][ T1668] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.371023][ T3323] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.392836][ T3319] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.407394][ T3313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 27.416224][ T3323] 8021q: adding VLAN 0 to HW filter on device team0 [ 27.429249][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.436312][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.450822][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.457883][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.468817][ T3319] 8021q: adding VLAN 0 to HW filter on device team0 [ 27.492116][ T3320] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 27.501902][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.509048][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.524010][ T3323] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 27.534385][ T3323] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 27.579517][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.586663][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.611613][ T3314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 27.635758][ T3313] veth0_vlan: entered promiscuous mode [ 27.646759][ T3313] veth1_vlan: entered promiscuous mode [ 27.668798][ T3323] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 27.700000][ T3313] veth0_macvtap: entered promiscuous mode [ 27.727056][ T3313] veth1_macvtap: entered promiscuous mode [ 27.744427][ T3319] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 27.781326][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 27.799251][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 27.810006][ T3314] veth0_vlan: entered promiscuous mode [ 27.824244][ T1668] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.841341][ T1668] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.850588][ T3314] veth1_vlan: entered promiscuous mode [ 27.859998][ T1668] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.882116][ T1668] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.892884][ T3323] veth0_vlan: entered promiscuous mode [ 27.906503][ T3320] veth0_vlan: entered promiscuous mode [ 27.916215][ T3323] veth1_vlan: entered promiscuous mode [ 27.927654][ T3320] veth1_vlan: entered promiscuous mode [ 27.940962][ T3314] veth0_macvtap: entered promiscuous mode [ 27.941387][ T3313] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.961608][ T3319] veth0_vlan: entered promiscuous mode [ 27.973191][ T3320] veth0_macvtap: entered promiscuous mode [ 27.991018][ T3314] veth1_macvtap: entered promiscuous mode [ 27.998769][ T3320] veth1_macvtap: entered promiscuous mode [ 28.009395][ T3323] veth0_macvtap: entered promiscuous mode [ 28.020679][ T3323] veth1_macvtap: entered promiscuous mode [ 28.029169][ T3319] veth1_vlan: entered promiscuous mode [ 28.037978][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 28.060577][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 28.069225][ T3323] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 28.081644][ T3320] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 28.092157][ T60] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.103405][ T3323] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 28.111820][ T3320] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 28.122233][ T60] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.139338][ T60] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.149874][ T60] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.170157][ T60] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.190608][ T60] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.199826][ T3319] veth0_macvtap: entered promiscuous mode [ 28.216810][ T60] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.229851][ T3319] veth1_macvtap: entered promiscuous mode [ 28.250482][ T60] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.260220][ T3489] loop1: detected capacity change from 0 to 256 [ 28.261812][ T3319] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 28.283775][ T60] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.320018][ T3319] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 28.329862][ T60] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.333787][ T3494] Driver unsupported XDP return value 0 on prog (id 3) dev N/A, expect packet loss! [ 28.355762][ T60] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.380192][ T60] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.411461][ C0] hrtimer: interrupt took 48128 ns [ 28.417862][ T60] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.457712][ T60] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.488893][ T3486] hid-generic 0000:0180:2000.0001: unknown main item tag 0x0 [ 28.494039][ T60] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.496330][ T3486] hid-generic 0000:0180:2000.0001: unknown main item tag 0x0 [ 28.512508][ T3486] hid-generic 0000:0180:2000.0001: unknown main item tag 0x0 [ 28.520185][ T3486] hid-generic 0000:0180:2000.0001: unknown main item tag 0x0 [ 28.524089][ T60] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 28.527567][ T3486] hid-generic 0000:0180:2000.0001: unknown main item tag 0x0 [ 28.543813][ T3486] hid-generic 0000:0180:2000.0001: unknown main item tag 0x0 [ 28.551420][ T3486] hid-generic 0000:0180:2000.0001: unknown main item tag 0x0 [ 28.558844][ T3486] hid-generic 0000:0180:2000.0001: unknown main item tag 0x0 [ 28.566226][ T3486] hid-generic 0000:0180:2000.0001: unknown main item tag 0x0 [ 28.573625][ T3486] hid-generic 0000:0180:2000.0001: unknown main item tag 0x0 [ 28.586976][ T3514] syz.4.11: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 [ 28.596118][ T29] kauditd_printk_skb: 46 callbacks suppressed [ 28.596136][ T29] audit: type=1400 audit(1765259353.937:126): avc: denied { setopt } for pid=3513 comm="syz.4.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 28.601406][ T3514] CPU: 0 UID: 0 PID: 3514 Comm: syz.4.11 Not tainted syzkaller #0 PREEMPT(voluntary) [ 28.601433][ T3514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 28.601465][ T3514] Call Trace: [ 28.601474][ T3514] [ 28.601481][ T3514] __dump_stack+0x1d/0x30 [ 28.601557][ T3514] dump_stack_lvl+0xe8/0x140 [ 28.601579][ T3514] dump_stack+0x15/0x1b [ 28.601598][ T3514] warn_alloc+0x12b/0x1a0 [ 28.601622][ T3514] ? _raw_spin_lock_irqsave+0x75/0xd0 [ 28.601655][ T3514] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 28.601768][ T3514] __vmalloc_node_range_noprof+0xa0/0x1310 [ 28.601854][ T3514] ? common_lsm_audit+0x1ca/0x230 [ 28.601921][ T3514] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 28.601955][ T3514] ? slow_avc_audit+0x104/0x140 [ 28.601995][ T3514] ? should_fail_ex+0x30/0x280 [ 28.602017][ T3514] ? should_failslab+0x8c/0xb0 [ 28.602094][ T3514] vmalloc_user_noprof+0x7d/0xb0 [ 28.602120][ T3514] ? xskq_create+0x80/0xe0 [ 28.602153][ T3514] xskq_create+0x80/0xe0 [ 28.602182][ T3514] xsk_init_queue+0x95/0xf0 [ 28.602261][ T3514] xsk_setsockopt+0x477/0x640 [ 28.602416][ T3514] ? __pfx_xsk_setsockopt+0x10/0x10 [ 28.602443][ T3514] __sys_setsockopt+0x184/0x200 [ 28.602470][ T3514] __x64_sys_setsockopt+0x64/0x80 [ 28.602539][ T3514] x64_sys_call+0x21d5/0x3000 [ 28.602563][ T3514] do_syscall_64+0xd8/0x2a0 [ 28.602594][ T3514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 28.602615][ T3514] RIP: 0033:0x7f09e13ff749 [ 28.602703][ T3514] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 28.602720][ T3514] RSP: 002b:00007f09dfe5f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 28.602778][ T3514] RAX: ffffffffffffffda RBX: 00007f09e1655fa0 RCX: 00007f09e13ff749 [ 28.602827][ T3514] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000007 [ 28.602840][ T3514] RBP: 00007f09e1483f91 R08: 0000000000000004 R09: 0000000000000000 [ 28.602853][ T3514] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 28.602866][ T3514] R13: 00007f09e1656038 R14: 00007f09e1655fa0 R15: 00007ffe7971ea38 [ 28.602886][ T3514] [ 28.602896][ T3514] Mem-Info: [ 28.627546][ T3486] hid-generic 0000:0180:2000.0001: hidraw0: HID v1.c0 Device [sy] on syz0 [ 28.636163][ T3514] active_anon:5586 inactive_anon:0 isolated_anon:0 [ 28.636163][ T3514] active_file:8017 inactive_file:2229 isolated_file:0 [ 28.636163][ T3514] unevictable:0 dirty:1410 writeback:0 [ 28.636163][ T3514] slab_reclaimable:3043 slab_unreclaimable:13777 [ 28.636163][ T3514] mapped:29052 shmem:175 pagetables:1034 [ 28.636163][ T3514] sec_pagetables:0 bounce:0 [ 28.636163][ T3514] kernel_misc_reclaimable:0 [ 28.636163][ T3514] free:1906543 free_pcp:5567 free_cma:0 [ 28.684283][ T29] audit: type=1400 audit(1765259354.007:127): avc: denied { connect } for pid=3510 comm="syz.2.10" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 28.687028][ T3514] Node 0 active_anon:22344kB inactive_anon:0kB active_file:32068kB inactive_file:8916kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:116208kB dirty:5640kB writeback:0kB shmem:700kB kernel_stack:3520kB pagetables:4368kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 28.717474][ T29] audit: type=1400 audit(1765259354.047:128): avc: denied { mount } for pid=3519 comm="syz.3.12" name="/" dev="ramfs" ino=3785 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 28.721879][ T3514] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 28.741789][ T3518] fido_id[3518]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 28.745409][ T3514] lowmem_reserve[]: 0 2880 7859 7859 [ 29.015354][ T3514] Node 0 DMA32 free:2945976kB boost:0kB min:4132kB low:7060kB high:9988kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:3129332kB managed:2949504kB mlocked:0kB bounce:0kB free_pcp:3528kB local_pcp:3528kB free_cma:0kB [ 29.041536][ T29] audit: type=1400 audit(1765259354.397:129): avc: denied { read write } for pid=3524 comm="syz.1.15" name="virtual_nci" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.046749][ T3514] lowmem_reserve[]: 0 0 4978 4978 [ 29.046786][ T3514] Node 0 Normal free:4662332kB boost:0kB min:7188kB low:12284kB high:17380kB reserved_highatomic:0KB free_highatomic:0KB active_anon:29884kB inactive_anon:0kB active_file:32068kB inactive_file:8916kB unevictable:0kB writepending:5640kB zspages:0kB present:5242880kB managed:5098240kB mlocked:0kB bounce:0kB free_pcp:10600kB local_pcp:6744kB free_cma:0kB [ 29.070099][ T29] audit: type=1400 audit(1765259354.397:130): avc: denied { open } for pid=3524 comm="syz.1.15" path="/dev/virtual_nci" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.075090][ T3514] lowmem_reserve[]: 0 0 0 0 [ 29.135681][ T3514] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 29.148526][ T3514] Node 0 DMA32: 4*4kB (M) 3*8kB (M) 5*16kB (M) 2*32kB (M) 4*64kB (M) 2*128kB (M) 3*256kB (M) 3*512kB (M) 4*1024kB (M) 3*2048kB (M) 716*4096kB (M) = 2945976kB [ 29.164782][ T3514] Node 0 Normal: 2*4kB (UE) 68*8kB (M) 55*16kB (UM) 31*32kB (ME) 23*64kB (M) 14*128kB (UME) 3*256kB (ME) 5*512kB (M) 4*1024kB (UME) 4*2048kB (UME) 1133*4096kB (M) = 4662072kB [ 29.182445][ T3514] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 29.191735][ T3514] 10446 total pagecache pages [ 29.196431][ T3514] 0 pages in swap cache [ 29.200594][ T3514] Free swap = 119556kB [ 29.204743][ T3514] Total swap = 124996kB [ 29.208929][ T3514] 2097051 pages RAM [ 29.212724][ T3514] 0 pages HighMem/MovableOnly [ 29.217397][ T3514] 81275 pages reserved [ 29.269375][ T3534] loop3: detected capacity change from 0 to 1024 [ 29.288125][ T3534] EXT4-fs: Ignoring removed orlov option [ 29.356859][ T3534] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 29.399235][ T3543] Zero length message leads to an empty skb [ 29.408573][ T29] audit: type=1400 audit(1765259354.747:131): avc: denied { name_bind } for pid=3541 comm="syz.4.19" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 29.430071][ T29] audit: type=1400 audit(1765259354.747:132): avc: denied { node_bind } for pid=3541 comm="syz.4.19" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 29.536266][ T29] audit: type=1400 audit(1765259354.807:133): avc: denied { mount } for pid=3533 comm="syz.3.16" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 29.557806][ T29] audit: type=1400 audit(1765259354.817:134): avc: denied { map } for pid=3540 comm="syz.1.18" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=3822 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 29.581738][ T29] audit: type=1400 audit(1765259354.817:135): avc: denied { read write } for pid=3540 comm="syz.1.18" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=3822 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 29.776031][ T12] ================================================================== [ 29.784153][ T12] BUG: KCSAN: data-race in copy_folio_from_iter_atomic / copy_folio_from_iter_atomic [ 29.793609][ T12] [ 29.795914][ T12] write to 0xffff888108c5e363 of 2 bytes by task 3548 on cpu 1: [ 29.803523][ T12] copy_folio_from_iter_atomic+0x760/0x1150 [ 29.809407][ T12] generic_perform_write+0x2c2/0x490 [ 29.814685][ T12] ext4_buffered_write_iter+0x1ee/0x3c0 [ 29.820223][ T12] ext4_file_write_iter+0x387/0xf60 [ 29.825411][ T12] iter_file_splice_write+0x66b/0xa20 [ 29.830767][ T12] direct_splice_actor+0x156/0x2a0 [ 29.835859][ T12] splice_direct_to_actor+0x312/0x680 [ 29.841212][ T12] do_splice_direct+0xda/0x150 [ 29.845960][ T12] do_sendfile+0x380/0x650 [ 29.850363][ T12] __x64_sys_sendfile64+0x105/0x150 [ 29.855548][ T12] x64_sys_call+0x2db1/0x3000 [ 29.860211][ T12] do_syscall_64+0xd8/0x2a0 [ 29.864706][ T12] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 29.870584][ T12] [ 29.872890][ T12] read to 0xffff888108c5e000 of 1024 bytes by task 12 on cpu 0: [ 29.880497][ T12] copy_folio_from_iter_atomic+0x760/0x1150 [ 29.886381][ T12] generic_perform_write+0x2c2/0x490 [ 29.891688][ T12] shmem_file_write_iter+0xc5/0xf0 [ 29.896790][ T12] lo_rw_aio+0x673/0x720 [ 29.901016][ T12] loop_process_work+0x56d/0xaa0 [ 29.905938][ T12] loop_workfn+0x31/0x40 [ 29.910183][ T12] process_scheduled_works+0x4ce/0x9d0 [ 29.915636][ T12] worker_thread+0x582/0x770 [ 29.920211][ T12] kthread+0x489/0x510 [ 29.924269][ T12] ret_from_fork+0x149/0x290 [ 29.928878][ T12] ret_from_fork_asm+0x1a/0x30 [ 29.933656][ T12] [ 29.935959][ T12] Reported by Kernel Concurrency Sanitizer on: [ 29.942088][ T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(voluntary) [ 29.951787][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 29.961915][ T12] Workqueue: loop3 loop_workfn [ 29.966701][ T12] ================================================================== [ 30.319966][ T3548] ================================================================== [ 30.328069][ T3548] BUG: KCSAN: data-race in file_write_and_wait_range / xas_set_mark [ 30.336071][ T3548] [ 30.338390][ T3548] write to 0xffff88811b0186f4 of 4 bytes by task 3534 on cpu 1: [ 30.346021][ T3548] xas_set_mark+0x12b/0x140 [ 30.350537][ T3548] __folio_start_writeback+0x155/0x340 [ 30.356012][ T3548] ext4_bio_write_folio+0x5ad/0x9f0 [ 30.361222][ T3548] mpage_process_page_bufs+0x4a1/0x620 [ 30.366684][ T3548] mpage_prepare_extent_to_map+0x7a3/0xc20 [ 30.372494][ T3548] ext4_do_writepages+0x9f6/0x27e0 [ 30.377668][ T3548] ext4_writepages+0x179/0x300 [ 30.382427][ T3548] do_writepages+0x1c6/0x310 [ 30.387034][ T3548] file_write_and_wait_range+0x156/0x2c0 [ 30.392670][ T3548] generic_buffers_fsync_noflush+0x45/0x130 [ 30.398566][ T3548] ext4_sync_file+0x1ab/0x690 [ 30.403246][ T3548] vfs_fsync_range+0x10d/0x130 [ 30.408003][ T3548] ext4_buffered_write_iter+0x34f/0x3c0 [ 30.413561][ T3548] ext4_file_write_iter+0x387/0xf60 [ 30.418775][ T3548] iter_file_splice_write+0x66b/0xa20 [ 30.424149][ T3548] direct_splice_actor+0x156/0x2a0 [ 30.429259][ T3548] splice_direct_to_actor+0x312/0x680 [ 30.434626][ T3548] do_splice_direct+0xda/0x150 [ 30.439385][ T3548] do_sendfile+0x380/0x650 [ 30.443818][ T3548] __x64_sys_sendfile64+0x105/0x150 [ 30.449020][ T3548] x64_sys_call+0x2db1/0x3000 [ 30.453693][ T3548] do_syscall_64+0xd8/0x2a0 [ 30.458213][ T3548] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 30.464101][ T3548] [ 30.466414][ T3548] read to 0xffff88811b0186f4 of 4 bytes by task 3548 on cpu 0: [ 30.473949][ T3548] file_write_and_wait_range+0x10e/0x2c0 [ 30.479588][ T3548] generic_buffers_fsync_noflush+0x45/0x130 [ 30.485490][ T3548] ext4_sync_file+0x1ab/0x690 [ 30.490164][ T3548] vfs_fsync_range+0x10d/0x130 [ 30.494932][ T3548] ext4_buffered_write_iter+0x34f/0x3c0 [ 30.500490][ T3548] ext4_file_write_iter+0x387/0xf60 [ 30.505692][ T3548] iter_file_splice_write+0x66b/0xa20 [ 30.511062][ T3548] direct_splice_actor+0x156/0x2a0 [ 30.516174][ T3548] splice_direct_to_actor+0x312/0x680 [ 30.521535][ T3548] do_splice_direct+0xda/0x150 [ 30.526302][ T3548] do_sendfile+0x380/0x650 [ 30.530723][ T3548] __x64_sys_sendfile64+0x105/0x150 [ 30.535930][ T3548] x64_sys_call+0x2db1/0x3000 [ 30.540604][ T3548] do_syscall_64+0xd8/0x2a0 [ 30.545117][ T3548] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 30.551011][ T3548] [ 30.553326][ T3548] value changed: 0x0a000021 -> 0x00000021 [ 30.559033][ T3548] [ 30.561350][ T3548] Reported by Kernel Concurrency Sanitizer on: [ 30.567485][ T3548] CPU: 0 UID: 0 PID: 3548 Comm: syz.3.16 Not tainted syzkaller #0 PREEMPT(voluntary) [ 30.577031][ T3548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 30.587096][ T3548] ================================================================== [ 30.670211][ T3548] syz.3.16 (3548) used greatest stack depth: 10368 bytes left [ 30.696730][ T3323] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.