last executing test programs: 1.817725175s ago: executing program 0 (id=131): r0 = creat(&(0x7f0000000240)='./file0\x00', 0x103) dup2(r0, r0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f00000006c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2}, 0x18) lsetxattr$security_capability(&(0x7f0000000140)='./file0\x00', 0x0, &(0x7f00000001c0)=@v3={0x3000000, [], 0xee01}, 0x18, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000100000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="19"], 0x48) 1.791876866s ago: executing program 0 (id=134): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000002000000000000000018090000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='kfree\x00', r0}, 0x18) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f0000000300)={[{@minixdf}, {}, {@barrier_val={'barrier', 0x3d, 0x9}}, {@commit={'commit', 0x3d, 0x5}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@nodelalloc}, {@noblock_validity}, {@nomblk_io_submit}]}, 0x1, 0x566, &(0x7f00000015c0)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9GajdN4o8KgvUiiBYLeq9LMg0lm27JbkoTC20P9uJFiiBiQfwDvHss/gP+FQUtFClBD14is5lNt81ukqYbN3U+H5j2vZnZvPnum+/bNzu7bACFNZL9U4p4OSK+SSIOt20bjHzjyOp+yw+vTWVLEisrn/2ZRJKva+2f5P8fzCsvRcSvX0WcKK1vt764NFupVtP5vD7WmLs8Vl9cOnlxrjKTzqSXJiYnT781OfHuO2/3LNbXz/39/ad3Pzr99fHl736+f+R2EmfiUL6tPY5ncKO9MhIj+XMyFGee2HG8B43tJkm/D4BtGcjzfCiyMeBwDORZD/z/XY+IFaCgEvkPBdWaB7Su7Xt0HfzcePDB6gXQ+vgHV98biX3Na6MDy8ljV0bZ9e5wD9rP2vjljzu3syU2eR/ieg/aA2i5cTMiTg0Orh//knz8275TzTePN/ZkG0V7/YF+upvNf97oNP8prc1/osP852CH3N2OzfO/dL8HzXSVzf/e6zj/XRu6hgfy2gvNOd9QcuFiNT0VES9GxGgM7c3qG93POb18b6Xbtvb5X7Zk7bfmgvlx3B/c+/hjpiuNyrPE3O7BzYhXOs5/k7X+Tzr0f/Z8nNtiG8fSO69227Z5/Dtr5aeI1zr2/6M7WsnG9yfHmufDWOusWO+vW8d+69b+6If9jT/r/wMbxz+ctN+vrT99Gz/u+yfttm275/+e5PNmeU++7mql0Zgfj9iTfLJ+/cSjx7bqrf2z+EePbzz+dTr/90fEF1uM/9bRW1137ff5n8U//VT9//SFex9/+UO39rfW/282S6P5mq2Mf1s9wGd57gAAAAAAAGC3KUXEoUhK5bVyqVQur36+42gcKFVr9caJC7WFS9PR/K7scAyVWne6D7d9HmI8/zxsqz7xRH0yIo5ExLcD+5v18lStOt3v4AEAAAAAAAAAAAAAAAAAAGCXONjl+/+Z3wf6fXTAjvOT31Bcm+Z/L37pCdiVvP5Dccl/KC75D8Ul/6G45D8Ul/yH4pL/UFzyHwAAAAAAAAAAAAAAAAAAAAAAAAAAAHrq3Nmz2bKy/PDaVFafvrK4MFu7cnI6rc+W5xamylO1+cvlmVptppqWp2pzm/29aq12eXwiFq6ONdJ6Y6y+uHR+rrZwqXH+4lxlJj2fDv0nUQEAAAAAAAAAAAAAAAAAAMDzpb64NFupVtN5ha6F92NXHMZOBrhqWw8f3C1RKHQt7NtG5/Z5YAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACANv8GAAD//04mM/E=") lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./file1\x00', &(0x7f00000000c0), &(0x7f0000000040)=ANY=[], 0xfe37, 0x0) unlink(&(0x7f0000000180)='./file1\x00') 1.599367119s ago: executing program 0 (id=145): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe2, 0x1}, 0x48) 1.213994347s ago: executing program 1 (id=169): socket$netlink(0x10, 0x3, 0x4) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000280)="32780f", 0x3, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) 1.149924998s ago: executing program 1 (id=170): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x20000800, 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @random="5a01f3c2f136", @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x2, @random="43b1849c32a1", @remote, @local, @remote}}}}, 0x0) 1.148230928s ago: executing program 1 (id=173): syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, &(0x7f0000000080)={[{@usrquota}, {@noblock_validity}, {@bh}, {@max_batch_time={'max_batch_time', 0x3d, 0x8c9}}, {@debug}, {@inlinecrypt}]}, 0x1, 0x5fc, &(0x7f0000000c00)="$eJzs3c9rHGUfAPDvzCZ5kzavaUXEFsWAhxakaVKLVS+29WAPBQv2IOKhoUlq6PYHTQq2FkzBg4KCiFeRXvwHvEvv3kRQb56FKlJRUOnK7M62m2Q3XdPsTpr5fGCzz/PM7D7PdydP5pmZPDsBlNZ49iON2BVx51QSMdaybDQaC8fz9W7/du109kiiVnv91ySSvKy5fpI/b88zwxHx7dGIRyur6124cvXsdLXW8F7E/sVzF/cvXLm6b/7c9JnZM7Pnpw68cPDQ5ItTB6c2JM7t+fOx4689+fH7bz8/9111XxKH4+TguzOxIo6NMh7jcScPsbV8ICIOZYk2n8vDZguEUGqV/PdxMCIej7Go1HMNYzH/UaGNA3qqVomoASWV6P9QUs1xQPPYvrvj4JM9HpX0z60jjQOg1fEPNM6NxHD92Gjb7aTlyKhxbmPHBtSf1fHPtd2fZ49Ydh7iz7tbZ2AD6ulk6XpEPNEu/qTeth31SLP402XtSCJiMiKG8va98gBtSFrSvTgPs5b1xp9GxOH8OSs/us76x1fk+x0/AOV080i+I1/Kcvf2f9nYozn+iTbjn9E2+671KHr/13n819zfD9fPkacrxmHZmOVE+7ccXFnw04fHPu1Uf+v4L3tk9TfHgv1w63rE7hXxf5AFm49/sviTNts/W+XU4e7qePX7X451WlZ0/LUbEXvaHv/cG5VmqTWuT+6fm6/OTjZ+tq3j62/e+rJT/UXHn23/bR3ib9n+6crXZZ/JxS7r+OrEjXOdlo3eN/7056Gkcbw5lJe8M724eGkqYig5nq/SUn5g7bY012m+Rxb/3mfa9/9lv//Xl7/PSPNPZhcuvnH2dqdl69n+LReT79S6bEMnWfwz99/+q/p/VvZJl3X88eblpzotWyv+kQcJDAAAAAAAAEoorV+DTdKJu+k0nZhozJd9LLal1QsLi8/OXbh8fiZib/3/IQfT5pXusUY+yfJT+f/DNvMHVuSfi4idEfFZZaSenzh9oTpTdPAAAAAAAAAAAAAAAAAAAACwSWzP5/8371P9e6Ux/x8oiV7eYA7Y3PR/KK96/191iyegDOz/obz0fygv/R/KS/+H8tL/obz0fygv/R/KS/8HAAAAgC1p59M3f0wiYumlkfojM5QvMyMItrbBohsAFKZSdAOAwty99G+wD6XT1fj/r/zLAXvfHKAASbvC+uCgtnbnv9n2lQAAAAAAAAAAAABAD+zZ1Xn+v7nBsLWZ9gfl9QDz/311ADzkfPU/lJdjfOB+s/iHOy0w/x8AAAAAAAAAAAAA+ma0/kjSiXwu8Gik6cRExP8jYkcMJnPz1dnJiHgkIn6oDP4vy08V3WgAAAAAAAAAAAAAAAAAAADYYhauXD07Xa3OXmpN/L2qZGsnmndB7UNdL8d/fFUk/f9YRiKi8I3Ss8RAS0kSsZRt+U3RsEsLsTmaUU8U/IcJAAAAAAAAAAAAAAAAAABKqGXucXu7v+hziwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg/+7d/793iaJjBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeTv8GAAD//7V5QCw=") bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1}}, 0x80001}, 0x1c) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000006c0)='sched_switch\x00', r2}, 0x10) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x303}, "14bc0615786629f5", "a6c9551de1166e85479c4a99eaf7b7cb90502e8eeabb6016c7598a2a186e5d1a", "fd3d3cef", "b3615ce94cf32b55"}, 0x38) 613.926068ms ago: executing program 1 (id=183): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000480)='./file0\x00', 0x18000, &(0x7f0000000b80)=ANY=[@ANYRES32=0x0, @ANYBLOB="b8df8c961c8ecdfd2125a462658bd368b6c91a09f0657b8ecff649965a3d3daf3308d6a5aff5df9a779aaffc44ebee05003d7fb183b1b40a100b0b65ae170088c75cf7ac3b99409fd3", @ANYRES16=0x0, @ANYRES64, @ANYBLOB="fe2ecf20a9a17bd2ed7e803f830375c150a1f848f604c2c1f932d2b7163be4b2b9a5bd521d185cfbee555b27608594beba6325923aaf5db74cff01000053db92c6c5fcbba0abd975fc76bea49b00513afc856ed89d3fadeda307ca587354322803b0983cc65725ae7f45fb95e7cdb28c6b886959b7dde2c87c73f6008cf6eed7861f24b7423704b95f3d05b92d3d7ff9d392833ecd02443320b60131a350360fcc1d659e2a03cb469caf0498bacae0735a161345b3d71a55f14ef636b6f832c7a6071fce83904dfd871b6d8e03648dbaa3a039eb5673792cae80335732030f9aeabaf3bb3cc4ca5fe75271d69b2e78beb2b81fc3cf3a18a7ae93a3cdbe6599b99408275e2b4b4477c6fcf4806134e839e13533ec000000000000006a1c000000000000000000000000000000000000000000000000000069c3288311b7414705e975eb3f1b77a120", @ANYRESOCT], 0xc, 0x2f6, &(0x7f0000000880)="$eJzs3M9PE1sUwPHTH5S2BMri5b08E8ONbnQzgepaaQwkxiYSpMYfickAU206tqTTQGqM6Mqt8Y9wQViyI1H+ATbudOPGHRsTF7Iwjul0htIyUCmljfT7Scgceu+ZObct5EzTmZ17b57ms5aW1csSjCoJiIjsioxKUDwBdxt04ojs91IuD33/dP7O/Qe3Uun01KxS06m5K0ml1MjY+5XnMXfa5qBsjz7a+Zb8uv3v9v87v+ae5CyVs1ShWFa6mi9+KevzpqEWc1ZeU2rGNHTLULmCZZRq48XaeNYsLi1VlF5YHI4vlQzLUnqhovJGRZWLqlyqqNBjPVdQmqap4biglcza7KyeajN5ocPF4JSUSik9JCKxAyOZtZ4UBAAAeqq5/w+K6mT/v35hqzx0d2PE7f83I379/9XPtX019P9REfHt/73j+/b/+vH6/4MdUX85Uf9fFe1gMWjPWOTAQ4F6WB0spfS4+/frePVwfdwJ6P8BAAAAAAAAAAAAAAAAAAAAAPgb7Np2wrbthLf1fgbdizu8331SQyJyvQclo4NO8PrjDKhfuBceETFfL2eWM7WtO2FLREwxZFwS8tN5P7iqsXflkaoalQ/mqpu/upwJOSOprOSc/AlJDEhzvm1P30xPTaiaxvwBie/PT0pC/vHPT/rmR+TSxX35miTk44IUxZRFp456/osJpW7cTjflx5x5AAAAAACcBZra43v+rmmHjdfy986vmz8fCNXPr8d9z8/Dci7c27UDAAAAANAvrMqzvG6aRumIICat57QfhE9pz94K/zTL+y7D6a30iMA7eMOQd3Pdjj8tgWM8LYcEwYZSV7xKW2SNVeeok67C+9josDkyM9n9V9AJ/nv77kfndnhtI9pipe0HoaPfAANd+ecDAAAAoKvqTb/3yGRvCwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoA914+5ojUfkpv8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADoX78DAAD//0WxAls=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d80)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001240)={&(0x7f0000000200)='kfree\x00', r1, 0x0, 0xfffffffffffffffd}, 0x18) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r2) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r3, 0x201, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0201}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 529.94753ms ago: executing program 2 (id=187): syz_mount_image$ext4(&(0x7f0000000300)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x3000046, &(0x7f00000001c0), 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x182) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x181242, 0x148) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000040)={0xc, r0, 0x0, 0x0, 0x0, 0xfffffffffdffffff}) 527.92112ms ago: executing program 3 (id=189): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) unshare(0x4040600) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, 0x0) 495.81755ms ago: executing program 4 (id=190): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x5f}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x58, r2, 0x1, 0x4, 0x1, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x48c1}, 0x0) 487.682581ms ago: executing program 3 (id=191): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x10}, 0x18) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000006280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)=@newtaction={0xc4, 0x30, 0x1, 0x4000000, 0x0, {0x0, 0x0, 0x6a00}, [{0xb0, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x0, 0x10000000, 0x0, 0x4}, 0x3, r3}}]}, {0x4, 0xa}, {0xc}, {0xffac, 0x8, {0x0, 0x2}}}}, @m_mpls={0x5c, 0x2, 0x0, 0x0, {{0x9}, {0x30}, {0x4}, {0xc}, {0xc}}}]}]}, 0xc4}}, 0x0) 433.656252ms ago: executing program 0 (id=192): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0}, &(0x7f0000000380), &(0x7f00000003c0)=r1}, 0x20) r2 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) write$selinux_load(r2, &(0x7f0000000000)={0xf97cff8c, 0x8}, 0x10) 431.960132ms ago: executing program 2 (id=193): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000340)='kfree\x00', r1, 0x0, 0x4092}, 0x18) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r5 = socket(0x10, 0x3, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}, {0x5, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x2}}}}]}, 0x79}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001540)=@newtfilter={0x68, 0x28, 0xd27, 0x1004001, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x2, 0x9}, {}, {0x2, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_ACT={0x34, 0x1, [@m_sample={0x30, 0x21d, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x8810}, 0x400c8b4) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@delchain={0x24, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r6}}, 0x24}}, 0x10) 419.206992ms ago: executing program 4 (id=194): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000040340000000000000800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000357500007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x18) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) close_range(r2, r3, 0x0) 258.475905ms ago: executing program 0 (id=195): syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x3000046, &(0x7f0000000a40), 0x1, 0x55e, &(0x7f0000000a80)="$eJzs3c1rHOUfAPDvbJK+/35NoRQVkUAPVmo3TeJLBQ/1KFos6L0uyTSUbLoluylNLNge7MWLFEHEgnjXu8fiP+BfUdBCkRL04CUym9k0L7vJNt2ajfP5wITn2Znd5/nuzPfJMzuzbACFNZL9KUW8GBFfJRFHIyLJ1w1GvnJkZbulxzcnsyWJ5eWP/0ia22X11mu1nnc4r7wQEb98EXG6tLnd+sLiTKVaTefy+mhj9tpofWHxzJXZynQ6nV4dn5g49+bE+Dtvv9WzWF+7+Ne3H91//9yXJ5e++enhsbtJnI8j+bq1cTyDW2srIzGSvydDcX7DhmM9aKyfJLvdAXZkIM/zocjGgKMxkGc98N/3eUQsAwWVyH8oqNY8oHVu36Pz4D3j0XsrJ0Cb4x9c+WwkDjTPjQ4tJevOjLLz3eEetJ+18fPv9+5mS2z4HOJAD14foJNbtyPi7ODg5vEvyce/nTvbxTYb2yja/x/YTfez+c/r7eY/pdX5T7SZ/xxuk7s7sX3+lx72oJmOsvnfu23nv6sXrYYH8tr/mnO+oeTylWqajW3/j4hTMbQ/q291Pefc0oPlTuvWzv+yJWu/NRfM+/FwcP/650xVGpVniXmtR7cjXmo7/01W93/SZv9n78fFLts4kd57pdO67eN/vpZ/iHi17f5/ckUr2fr65GjzeBhtHRWb/XnnxK+d2t/t+LP9f2jr+IeTtddr60/fxvcH/k47rVsXf3R//O9LPmmW9+WP3ag0GnNjEfuSDzc/Pv7kua16a/ss/lMntx7/2h3/ByPi0y7jv3P8x5e7in+X9v/UU+3/py88+OCz7zq1393490azdCp/pJvxr9sOPst7BwAAAAAAAP2mFBFHIimVV8ulUrm8cn/H8ThUqtbqjdOXa/NXp6L5XdnhGCq1rnQfXXM/xFh+P2yrPr6hPhERxyLi64GDzXp5slad2u3gAQAAAAAAAAAAAAAAAAAAoE8c7vD9/8xvA7vdO+C585PfUFzb5n8vfukJ6Ev+/0NxyX8oLvkPxSX/objkPxSX/Ifikv9QXPIfAAAAAAAAAAAAAAAAAAAAAAAAAAAAeurihQvZsrz0+OZkVp+6vjA/U7t+Ziqtz5Rn5yfLk7W5a+XpWm26mpYna7PbvV61Vrs2Nh7zN0Ybab0xWl9YvDRbm7/auHRltjKdXkqH/pWoAAAAAAAAAAAAAAAAAAAAYG+pLyzOVKrVdE5BYUeFwf7oxp4vZNnYB91Y1x8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6A//BAAA//8iuzYD") r0 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x389b0d52417bb201) read$hidraw(r0, &(0x7f0000000040)=""/136, 0x88) 209.867606ms ago: executing program 3 (id=196): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=@allocspi={0x28c, 0x16, 0x1, 0x70bd2c, 0x25dfdbff, {{{@in6=@private2, @in6=@dev={0xfe, 0x80, '\x00', 0x28}, 0x4e20, 0x80, 0x4e24, 0x7, 0xa, 0x20, 0xc0, 0x4}, {@in6=@mcast2, 0x4d4, 0x32}, @in=@multicast2, {0x8, 0xcc20, 0xffffffffffffffff, 0xff, 0x8, 0x1, 0x9, 0x1}, {0x0, 0x7, 0x6, 0x4}, {0x2, 0x7f, 0x9}, 0x70bd25, 0x0, 0x2, 0x1, 0x2c, 0x7e7a119454a97e64}, 0x2, 0xef}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x4d3, 0x6c}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x2, 0xb, 0x9, 0x3, 0x1}]}, @algo_auth={0x48, 0x1, {{'sha256-ni\x00'}}}, @sa={0xe4, 0x6, {{@in=@empty, @in=@multicast1, 0x4e23, 0x0, 0x4e24, 0x0, 0x2, 0x0, 0x0, 0x2c}, {@in=@dev={0xac, 0x14, 0x14, 0x3b}, 0x4d6, 0xff}, @in=@loopback, {0xb299, 0x1, 0xc, 0x9, 0x945, 0x3, 0x95e9, 0x8}, {0x3ff, 0x0, 0xfffffffffffffeff, 0x4}, {0x3, 0x8001, 0x3}, 0x70bd2a, 0x3504, 0xf193bf3c8f03d324, 0x2, 0x1, 0x24}}, @lifetime_val={0x24, 0x9, {0x0, 0x9, 0x5, 0x81}}]}, 0x28c}, 0x1, 0x0, 0x0, 0x800}, 0x10) 209.735526ms ago: executing program 3 (id=197): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r0 = socket$vsock_stream(0x28, 0x1, 0x0) writev(r0, &(0x7f00000002c0), 0x1c) 196.106516ms ago: executing program 4 (id=198): mknod$loop(&(0x7f0000000080)='./file0\x00', 0x100000000000600d, 0x1) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0xc9028ba210c11f8b) ioctl$BLKTRACESETUP(r0, 0x301, &(0x7f0000000000)={'\x00', 0x8, 0x2, 0x803fd, 0x1, 0x800}) 165.022777ms ago: executing program 3 (id=199): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r3, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x13, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r4}, 0x10) 109.802698ms ago: executing program 1 (id=200): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000780)=[{0x200000000006, 0x1, 0x7, 0x7ffc1ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b708000000000e007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000020850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) 109.674568ms ago: executing program 4 (id=201): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000040)=@ethtool_link_settings={0x2, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x20, 0x8, [0x0, 0x0, 0x0, 0xc, 0x5, 0x0, 0x0, 0x2]}}) 109.568458ms ago: executing program 3 (id=202): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) r2 = dup3(r0, r1, 0x0) syz_clone(0x81400, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$MON_IOCG_STATS(r2, 0xc0109207, &(0x7f00000001c0)) 108.811068ms ago: executing program 2 (id=203): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000740)=ANY=[@ANYBLOB="b40000000000f3ff7910900000000000630000000000000095000000000000008d92133deb6af19a615221a5e9c1c30b6e95cc8fea035580b99721396dc8eb6d5df6dc9e699a633176330ff919676a6af14926d2972f96f1b3b7e18b030df52a4f7a1c2f51146019dbb20ca845aa71fa9b92bea75cad145375cd89be1d82fabf57ee85c5e4129f42d848ed23f5b44542fe5be65239e37e6b198ca137e4432993b4576fa1ecf61a856a521d26758e4ddf6730903b5d22548be0ddaae1e6c1233841b2f6c7e7daef09f949ba0db2a1e1c43aba69adbed02c5d6cf115129ee07e25ca8518500d95e5e3ff3e7503dcf5347bee255eeba0f102d4c4c415eb56239c523a4dde580ed459f309797655222077a0442fb4"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="61df712bc884fed5722780b6c2a7", 0x0, 0x0, 0x0, 0x1b, 0x0, &(0x7f0000000380)="fd97a6633528276901d509de9400a14fb5913c6c253c5551be0513", 0x0}, 0x50) 69.525839ms ago: executing program 4 (id=204): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000130000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000380), &(0x7f00000002c0)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.controllers\x00', 0x275a, 0x0) linkat(r2, &(0x7f0000000000)='\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1400) 64.886069ms ago: executing program 2 (id=205): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000540)='inet_sock_set_state\x00', r2}, 0x18) listen(r0, 0x3) 9.92151ms ago: executing program 0 (id=206): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioprio_set$uid(0x3, 0x0, 0x0) io_setup(0x9, &(0x7f0000000340)=0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x14, 0x2, &(0x7f0000000900)=@raw=[@map_idx_val={0x18, 0xa, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3}], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$xdp(0x2c, 0x3, 0x0) io_submit(r0, 0x2000000000000211, &(0x7f0000000840)=[&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x8, 0x9, r1, 0x0}]) 9.73927ms ago: executing program 2 (id=207): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000a80)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1088d8b8588d72ec29c48f0af5f2d9f51c4b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465ad32b77a74e802a0dc6bf25cca242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000026abfb0767042361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae645ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1fb8f72cd317902f19e385be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa7956488bef241875f3b4b6ab7929a57affe760e797724f4fce1093b62d7e8c7123d890decacec55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f870b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f154772f514216bdf57d2a40d40b51ab67903ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1594e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270bb29b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214d00000000d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c471c784ae7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec30cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd63bed8d31c31c37a373d4efd89f0000377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f0059161c5e0000000000000000000057d77480e0345effff6413258d1f6eb190aa28cbb4bafe34124172e436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fa03b84f63e022fe755f4007a4a899eaf52c4f491d8e97c862e29e457060000007ac691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104ebc1581848f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c716357d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c24936615ee68538e8fddd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426ca85e82ccf821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ad6acf5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba1c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63c41cbde2ba66ad81168070c8c6e18a6e452a31bdc4a60d637545ed4c8a1c649c3ce54ad3e16304d06a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c5140200000054d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c7340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a3bc38613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b9e6626f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f14eafe4b28ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1bfeef448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae0040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483f02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e9180100000000000000654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732e74dd690c57bdfdc1f069f9491bca7a8c59363799be70018c25ece5ad7307dc7a95c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2cdfb7fea73ca18874664d60a4b9423f3297bc8eb91b4ee1d73272ab28a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece98c077b358e752b439132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae2676384ff799783f55d7e5a1a092a01b965dc99cb7a9d98440c355927629f2bcf9dc2396eb2f5d25829715b24327642ac48f1201014a95e0e65e12cdf27e19043e3c5d3e798375cead35b9a93190a52cdecaaccc854a1d41ef365303f0e9b4fc969c9dab6df5e8a795b140fcc09e8a7b694d12932917facd8ceaa4e2d0d16bb0b95387fcd5ff136d8abddf94daf442bbff744591931872a36cf921ad69f2127386e8b0f9afee4da8d3fbec809fbb3ca0fded2859cf25d4c6155d396c5b9bd1a928923123f63f4c40688eae69990a9419456247bbaeb7948de84d2ff875414883bb1e503d4bfebc01bc12a53ea06bf38e571157bd642dac25dbee7832c58378374a39483d6721eec96c28911db21c0c006b42afc90000000000000000000000700000000000000000008ce4ea442c1a207108b35511186c5e860278f6463f52f3990ce08b1bfccc3cff4b5ae27b610aa9ba11b47d4f94c439e055cdbb2b12c983885c93ea4ab4ca1e02d831ae162ee104"], &(0x7f0000000100)='GPL\x00'}, 0x41) prctl$PR_SET_NAME(0xf, &(0x7f0000000280)='+}[@\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='task_newtask\x00', r0, 0x0, 0xfffffffffffffffc}, 0x10) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0\x00', 0x1809049, 0x0, 0xff, 0x0, 0x0) 9.5802ms ago: executing program 4 (id=208): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}}, {{@in6=@mcast2, 0x404d3, 0x2b}, 0x0, @in=@empty}}, 0xe4) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) close(r0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8}, {0x0, 0xb}}}, 0xb8}}, 0x0) 9.49707ms ago: executing program 1 (id=209): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x5, 0x4, 0x7fdf, 0x1}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x3, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = dup2(r1, r0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r2}, 0x10) r3 = io_uring_setup(0x5b09, &(0x7f0000000280)={0x0, 0xad22, 0x8, 0x2, 0x337}) flistxattr(r3, 0x0, 0x0) 0s ago: executing program 2 (id=210): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000095980000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f0ffffffb702000005"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2e, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000540)='kfree\x00', r0, 0x0, 0x4}, 0x18) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f00000000c0)={0x1, &(0x7f0000000300)=[{0x50, 0xff, 0x0, 0x6}]}) kernel console output (not intermixed with test programs): [ 15.759019][ T30] audit: type=1400 audit(1757192221.695:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.777943][ T30] audit: type=1400 audit(1757192221.695:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.117' (ED25519) to the list of known hosts. [ 23.043004][ T30] audit: type=1400 audit(1757192229.035:64): avc: denied { mounton } for pid=273 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.044517][ T273] cgroup: Unknown subsys name 'net' [ 23.066935][ T30] audit: type=1400 audit(1757192229.035:65): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.095219][ T30] audit: type=1400 audit(1757192229.065:66): avc: denied { unmount } for pid=273 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.095422][ T273] cgroup: Unknown subsys name 'devices' [ 23.271417][ T273] cgroup: Unknown subsys name 'hugetlb' [ 23.277207][ T273] cgroup: Unknown subsys name 'rlimit' [ 23.539654][ T30] audit: type=1400 audit(1757192229.535:67): avc: denied { setattr } for pid=273 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.563217][ T30] audit: type=1400 audit(1757192229.535:68): avc: denied { mounton } for pid=273 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.590121][ T30] audit: type=1400 audit(1757192229.535:69): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.599440][ T275] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.625512][ T30] audit: type=1400 audit(1757192229.615:70): avc: denied { relabelto } for pid=275 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.651423][ T30] audit: type=1400 audit(1757192229.615:71): avc: denied { write } for pid=275 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.680814][ T30] audit: type=1400 audit(1757192229.675:72): avc: denied { read } for pid=273 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.681364][ T273] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.706578][ T30] audit: type=1400 audit(1757192229.675:73): avc: denied { open } for pid=273 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.986207][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.993594][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.002317][ T282] device bridge_slave_0 entered promiscuous mode [ 25.009703][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.017012][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.024745][ T282] device bridge_slave_1 entered promiscuous mode [ 25.032332][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.039779][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.047298][ T281] device bridge_slave_0 entered promiscuous mode [ 25.055783][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.063385][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.071229][ T281] device bridge_slave_1 entered promiscuous mode [ 25.111657][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.118841][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.126570][ T285] device bridge_slave_0 entered promiscuous mode [ 25.144791][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.151920][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.159468][ T285] device bridge_slave_1 entered promiscuous mode [ 25.224769][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.231950][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.239617][ T283] device bridge_slave_0 entered promiscuous mode [ 25.256818][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.264207][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.272421][ T283] device bridge_slave_1 entered promiscuous mode [ 25.326782][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.333941][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.342131][ T284] device bridge_slave_0 entered promiscuous mode [ 25.361441][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.368856][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.376392][ T284] device bridge_slave_1 entered promiscuous mode [ 25.499038][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.508740][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.517897][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.525933][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.535619][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.542808][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.551132][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.558377][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.573440][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.580639][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.588067][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.596141][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.634199][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.642247][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.649679][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.658453][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.679207][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.687423][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.695621][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.704730][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.745637][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.754262][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.762688][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.770787][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.778636][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.786558][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.794063][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.801752][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.809758][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.818140][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.827292][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.837085][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.845997][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.872443][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.880954][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.888487][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.896122][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.904241][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.912069][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.920583][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.927970][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.936036][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.944469][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.951737][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.959431][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.967718][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.974879][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.983449][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.991735][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.998793][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.008478][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.016062][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.030210][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.037772][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.045539][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.053957][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.062618][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.070755][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.078712][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.087248][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.095667][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.102747][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.129914][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.138603][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.147031][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.154261][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.162583][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.171247][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.179692][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.186901][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.194357][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.203542][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.211907][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.219196][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.226693][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.235158][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.243589][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.252002][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.260398][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.268617][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.277136][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.285636][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.293818][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.302334][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.325310][ T282] device veth0_vlan entered promiscuous mode [ 26.332682][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.341306][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.350071][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.357129][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.364724][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.373081][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.381207][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.389258][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.397581][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.405797][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.414434][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.422839][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.431303][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.438823][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.455090][ T285] device veth0_vlan entered promiscuous mode [ 26.465066][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.473089][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.481918][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.489454][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.508200][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.517504][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.526053][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.540323][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.548711][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.557319][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.570182][ T285] device veth1_macvtap entered promiscuous mode [ 26.578454][ T281] device veth0_vlan entered promiscuous mode [ 26.586383][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.594079][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.602541][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.612313][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.620732][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.628635][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.636924][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.644790][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.652575][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.660351][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.670139][ T283] device veth0_vlan entered promiscuous mode [ 26.679545][ T284] device veth0_vlan entered promiscuous mode [ 26.691448][ T282] device veth1_macvtap entered promiscuous mode [ 26.700651][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.708877][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.717343][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.726054][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.734652][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.745534][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.753204][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.762425][ T283] device veth1_macvtap entered promiscuous mode [ 26.777633][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.786069][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.795704][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.804819][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.813995][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.822727][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.832843][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.841424][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.860823][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.875019][ T282] request_module fs-gadgetfs succeeded, but still no fs? [ 26.881013][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.891793][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.900666][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.909960][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.919508][ T284] device veth1_macvtap entered promiscuous mode [ 26.943060][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.954019][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.979839][ T281] device veth1_macvtap entered promiscuous mode [ 26.986819][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.005203][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.027510][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.044539][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.071199][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.088405][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.171654][ T350] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1'. [ 27.184910][ T351] loop3: detected capacity change from 0 to 16407 [ 27.192328][ T350] device erspan0 entered promiscuous mode [ 27.205228][ T350] device macsec1 entered promiscuous mode [ 27.236171][ T350] device erspan0 left promiscuous mode [ 27.464901][ T367] loop0: detected capacity change from 0 to 512 [ 27.494750][ T369] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14'. [ 27.559989][ T367] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.601851][ T367] ext4 filesystem being mounted at /3/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 27.630703][ T381] loop3: detected capacity change from 0 to 128 [ 27.660008][ T387] loop2: detected capacity change from 0 to 512 [ 27.687070][ T381] FAT-fs (loop3): Directory bread(block 32) failed [ 27.699380][ T387] ======================================================= [ 27.699380][ T387] WARNING: The mand mount option has been deprecated and [ 27.699380][ T387] and is ignored by this kernel. Remove the mand [ 27.699380][ T387] option from the mount to silence this warning. [ 27.699380][ T387] ======================================================= [ 27.700372][ T381] FAT-fs (loop3): Directory bread(block 33) failed [ 27.751187][ T391] SELinux: failed to load policy [ 27.766499][ T381] FAT-fs (loop3): Directory bread(block 34) failed [ 27.778220][ T381] FAT-fs (loop3): Directory bread(block 35) failed [ 27.786026][ T381] FAT-fs (loop3): Directory bread(block 36) failed [ 27.799719][ T387] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option [ 27.810312][ T381] FAT-fs (loop3): Directory bread(block 37) failed [ 27.823452][ T393] netlink: 12 bytes leftover after parsing attributes in process `syz.0.22'. [ 27.823639][ T387] EXT4-fs (loop2): 1 orphan inode deleted [ 27.833034][ T393] netlink: 28 bytes leftover after parsing attributes in process `syz.0.22'. [ 27.847799][ T381] FAT-fs (loop3): Directory bread(block 38) failed [ 27.854991][ T387] EXT4-fs (loop2): mounted filesystem without journal. Opts: nomblk_io_submit,bsdgroups,usrquota,jqfmt=vfsv1,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000000100,debug_want_extra_isize=0x000000000000005c,i_version,,errors=continue. Quota mode: writeback. [ 27.859304][ T381] FAT-fs (loop3): Directory bread(block 39) failed [ 27.891014][ T381] FAT-fs (loop3): Directory bread(block 40) failed [ 27.912153][ T381] FAT-fs (loop3): Directory bread(block 41) failed [ 27.966812][ T381] process 'syz.3.17' launched './file2' with NULL argv: empty string added [ 27.977617][ T381] attempt to access beyond end of device [ 27.977617][ T381] loop3: rw=0, want=4116, limit=128 [ 27.989490][ T381] Buffer I/O error on dev loop3, logical block 1028, async page read [ 28.003270][ T381] attempt to access beyond end of device [ 28.003270][ T381] loop3: rw=0, want=167968, limit=128 [ 28.017407][ T381] Buffer I/O error on dev loop3, logical block 41991, async page read [ 28.017453][ T406] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=406 comm=syz.0.28 [ 28.045320][ T381] FAT-fs (loop3): error, invalid access to FAT (entry 0x0000a009) [ 28.061978][ T381] FAT-fs (loop3): Filesystem has been set read-only [ 28.066331][ T30] kauditd_printk_skb: 133 callbacks suppressed [ 28.066350][ T30] audit: type=1400 audit(1757192234.055:207): avc: denied { create } for pid=411 comm="syz.1.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 28.089101][ T381] FAT-fs (loop3): error, invalid access to FAT (entry 0x0000a009) [ 28.112263][ T30] audit: type=1400 audit(1757192234.095:208): avc: denied { write } for pid=411 comm="syz.1.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 28.124776][ T381] FAT-fs (loop3): error, invalid access to FAT (entry 0x0000a009) [ 28.146024][ T381] FAT-fs (loop3): error, invalid access to FAT (entry 0x0000a009) [ 28.173140][ T381] FAT-fs (loop3): error, invalid access to FAT (entry 0x0000a009) [ 28.198333][ T381] attempt to access beyond end of device [ 28.198333][ T381] loop3: rw=0, want=4116, limit=128 [ 28.199539][ T30] audit: type=1400 audit(1757192234.105:209): avc: denied { execute } for pid=413 comm="syz.2.32" name="file0" dev="tmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 28.244930][ T381] Buffer I/O error on dev loop3, logical block 1028, async page read [ 28.291430][ T381] attempt to access beyond end of device [ 28.291430][ T381] loop3: rw=0, want=167968, limit=128 [ 28.317905][ T381] Buffer I/O error on dev loop3, logical block 41991, async page read [ 28.327786][ T437] audit: audit_backlog=65 > audit_backlog_limit=64 [ 28.334767][ T437] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 28.356910][ T439] audit: audit_backlog=65 > audit_backlog_limit=64 [ 28.357424][ T441] loop2: detected capacity change from 0 to 1024 [ 28.364503][ T442] audit: audit_backlog=65 > audit_backlog_limit=64 [ 28.373291][ T30] audit: type=1400 audit(1757192234.105:210): avc: denied { execute_no_trans } for pid=413 comm="syz.2.32" path="/6/file0" dev="tmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 28.379356][ T437] audit: backlog limit exceeded [ 28.405613][ T30] audit: type=1326 audit(1757192234.145:211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=415 comm="syz.0.33" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff197054be9 code=0x7ffc0000 [ 28.466598][ T441] EXT4-fs (loop2): mounted filesystem without journal. Opts: dioread_lock,jqfmt=vfsv1,nouid32,grpquota,,errors=continue. Quota mode: writeback. [ 28.536974][ T441] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 28.537342][ T456] device syzkaller0 entered promiscuous mode [ 28.542904][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.542936][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.542961][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.542985][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543009][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543031][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543055][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543078][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543101][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543125][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543148][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543171][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543194][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543217][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543240][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543263][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543286][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543309][ T286] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 28.543947][ T286] hid-generic 0003:0004:0000.0001: hidraw0: USB HID v0.00 Device [syz0] on syz1 [ 28.571784][ T461] loop0: detected capacity change from 0 to 8192 [ 28.626961][ T462] fido_id[462]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 28.636867][ T459] loop1: detected capacity change from 0 to 512 [ 28.734852][ T464] loop4: detected capacity change from 0 to 1024 [ 28.804269][ T464] EXT4-fs (loop4): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 28.827441][ T459] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 28.849279][ T464] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 28.876616][ T464] JBD2: no valid journal superblock found [ 28.883839][ T459] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 28.914961][ T464] EXT4-fs (loop4): error loading journal [ 28.936575][ T459] EXT4-fs (loop1): couldn't mount as ext2 due to feature incompatibilities [ 28.949575][ T477] loop0: detected capacity change from 0 to 128 [ 29.012298][ T484] loop4: detected capacity change from 0 to 512 [ 29.054438][ T484] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 29.057823][ T488] loop2: detected capacity change from 0 to 512 [ 29.072178][ T484] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #16: comm syz.4.63: invalid indirect mapped block 4294967295 (level 0) [ 29.116061][ T484] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #16: comm syz.4.63: invalid indirect mapped block 4294967295 (level 1) [ 29.132345][ T484] EXT4-fs (loop4): 1 orphan inode deleted [ 29.176760][ T484] EXT4-fs (loop4): 1 truncate cleaned up [ 29.182742][ T484] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 29.208265][ T488] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a803c02c, mo2=0102] [ 29.210281][ T459] loop1: detected capacity change from 0 to 1024 [ 29.242221][ T488] System zones: 1-12 [ 29.257444][ T488] EXT4-fs error (device loop2): ext4_xattr_inode_iget:409: comm syz.2.65: error while reading EA inode 32 err=-116 [ 29.273573][ T459] EXT4-fs (loop1): Ignoring removed bh option [ 29.280504][ T459] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 29.308298][ T459] EXT4-fs (loop1): mounted filesystem without journal. Opts: discard,bh,nomblk_io_submit,,errors=continue. Quota mode: writeback. [ 29.318188][ T488] EXT4-fs (loop2): Remounting filesystem read-only [ 29.337715][ T488] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2825: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 29.351609][ T488] EXT4-fs error (device loop2): ext4_xattr_inode_iget:409: comm syz.2.65: error while reading EA inode 32 err=-116 [ 29.451024][ T497] loop4: detected capacity change from 0 to 2048 [ 29.451757][ T488] EXT4-fs (loop2): Remounting filesystem read-only [ 29.465018][ T488] EXT4-fs (loop2): 1 orphan inode deleted [ 29.471641][ T488] EXT4-fs (loop2): mounted filesystem without journal. Opts: errors=remount-ro,debug,debug_want_extra_isize=0x000000000000005e,noauto_da_alloc,bsdgroups,jqfmt=vfsv1,abort,data_err=ignore,. Quota mode: none. [ 29.581448][ T497] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 29.773048][ T505] netlink: 8 bytes leftover after parsing attributes in process `syz.0.70'. [ 29.862075][ T507] loop2: detected capacity change from 0 to 512 [ 29.922881][ T511] netlink: 272 bytes leftover after parsing attributes in process `syz.0.73'. [ 29.959144][ T507] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 30.031730][ T507] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 30.088035][ T507] EXT4-fs (loop2): group descriptors corrupted! [ 30.327471][ T533] syz.1.83[533] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 30.327553][ T533] syz.1.83[533] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 30.349196][ T537] netlink: 'syz.4.85': attribute type 4 has an invalid length. [ 30.375545][ T538] loop0: detected capacity change from 0 to 512 [ 30.387978][ T537] netlink: 'syz.4.85': attribute type 4 has an invalid length. [ 30.450530][ T538] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [ 31.036239][ T576] loop2: detected capacity change from 0 to 512 [ 31.059275][ T570] loop0: detected capacity change from 0 to 512 [ 31.071823][ T580] netlink: 40 bytes leftover after parsing attributes in process `syz.3.106'. [ 31.101578][ T570] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 31.114560][ T576] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 31.136657][ T576] EXT4-fs (loop2): inodes count not valid: 24 vs 32 [ 31.156301][ T570] EXT4-fs (loop0): 1 truncate cleaned up [ 31.179748][ T570] EXT4-fs (loop0): mounted filesystem without journal. Opts: abort,errors=remount-ro,. Quota mode: none. [ 31.340526][ T600] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=600 comm=syz.2.115 [ 31.479579][ T596] 9pnet: Insufficient options for proto=fd [ 31.521508][ T594] loop1: detected capacity change from 0 to 512 [ 31.598776][ T620] loop0: detected capacity change from 0 to 8192 [ 31.625545][ T594] EXT4-fs (loop1): too many log groups per flexible block group [ 31.633711][ T594] EXT4-fs (loop1): failed to initialize mballoc (-12) [ 31.641480][ T594] EXT4-fs (loop1): mount failed [ 31.660441][ T620] capability: warning: `syz.0.124' uses deprecated v2 capabilities in a way that may be insecure [ 31.803899][ T645] loop0: detected capacity change from 0 to 1024 [ 31.822988][ T645] EXT4-fs (loop0): Ignoring removed nomblk_io_submit option [ 31.890672][ T645] EXT4-fs (loop0): mounted filesystem without journal. Opts: minixdf,bsddf,barrier=0x0000000000000009,commit=0x0000000000000005,debug_want_extra_isize=0x0000000000000080,lazytime,nodelalloc,noblock_validity,nomblk_io_submit,,errors=continue. Quota mode: none. [ 31.959085][ T666] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 32.167681][ T696] loop3: detected capacity change from 0 to 512 [ 32.255432][ T696] EXT4-fs (loop3): mounted filesystem without journal. Opts: noquota,noquota,grpjquota=,noauto_da_alloc,dioread_lock,,errors=continue. Quota mode: writeback. [ 32.274963][ T696] ext4 filesystem being mounted at /29/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 32.288111][ T696] EXT4-fs error (device loop3): ext4_xattr_block_get:546: inode #15: comm syz.3.159: corrupted xattr block 19 [ 32.301751][ T696] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop3 ino=15 [ 32.311247][ T696] EXT4-fs error (device loop3): ext4_xattr_block_get:546: inode #15: comm syz.3.159: corrupted xattr block 19 [ 32.324139][ T696] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop3 ino=15 [ 32.334957][ T696] EXT4-fs error (device loop3): ext4_xattr_block_get:546: inode #15: comm syz.3.159: corrupted xattr block 19 [ 32.438352][ T726] loop3: detected capacity change from 0 to 512 [ 32.439929][ T724] loop2: detected capacity change from 0 to 512 [ 32.464576][ T728] loop1: detected capacity change from 0 to 1024 [ 32.482512][ T724] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 32.499826][ T730] netlink: 4 bytes leftover after parsing attributes in process `syz.4.174'. [ 32.521628][ T724] EXT4-fs (loop2): 1 truncate cleaned up [ 32.534704][ T728] EXT4-fs (loop1): Ignoring removed bh option [ 32.549554][ T724] EXT4-fs (loop2): mounted filesystem without journal. Opts: init_itable=0x0000000000000000,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,user_xattr,errors=remount-ro,quota,. Quota mode: writeback. [ 32.573551][ T728] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 32.583372][ T726] EXT4-fs (loop3): too many log groups per flexible block group [ 32.607568][ T728] EXT4-fs error (device loop1): ext4_map_blocks:630: inode #3: block 2: comm syz.1.173: lblock 2 mapped to illegal pblock 2 (length 1) [ 32.626673][ T726] EXT4-fs (loop3): failed to initialize mballoc (-12) [ 32.635231][ T726] EXT4-fs (loop3): mount failed [ 32.641680][ T728] EXT4-fs error (device loop1): ext4_map_blocks:630: inode #3: block 48: comm syz.1.173: lblock 0 mapped to illegal pblock 48 (length 1) [ 32.656958][ T728] EXT4-fs error (device loop1): ext4_acquire_dquot:6198: comm syz.1.173: Failed to acquire dquot type 0 [ 32.673514][ T738] loop2: detected capacity change from 0 to 256 [ 32.685762][ T728] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5867: Corrupt filesystem [ 32.711287][ T728] EXT4-fs error (device loop1): ext4_evict_inode:283: inode #11: comm syz.1.173: mark_inode_dirty error [ 32.753433][ T728] EXT4-fs warning (device loop1): ext4_evict_inode:286: couldn't mark inode dirty (err -117) [ 32.777013][ T728] EXT4-fs (loop1): 1 orphan inode deleted [ 32.784239][ T728] EXT4-fs (loop1): mounted filesystem without journal. Opts: usrquota,noblock_validity,bh,max_batch_time=0x00000000000008c9,debug,inlinecrypt,,errors=continue. Quota mode: writeback. [ 32.802652][ T339] EXT4-fs error (device loop1): ext4_map_blocks:630: inode #3: block 1: comm kworker/u4:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 32.849330][ T339] EXT4-fs error (device loop1): ext4_release_dquot:6234: comm kworker/u4:3: Failed to release dquot type 0 [ 32.898352][ T283] EXT4-fs error (device loop1): __ext4_get_inode_loc:4352: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 32.922688][ T283] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5867: Corrupt filesystem [ 32.946445][ T755] netlink: 16 bytes leftover after parsing attributes in process `syz.3.185'. [ 32.967297][ T283] EXT4-fs error (device loop1): ext4_quota_off:6504: inode #3: comm syz-executor: mark_inode_dirty error [ 33.004038][ T759] loop2: detected capacity change from 0 to 1024 [ 33.040451][ T759] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 33.072730][ T30] kauditd_printk_skb: 332 callbacks suppressed [ 33.072746][ T30] audit: type=1400 audit(1757192239.065:534): avc: denied { add_name } for pid=758 comm="syz.2.187" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 33.090993][ T759] EXT4-fs (loop2): Online defrag not supported with bigalloc [ 33.102941][ T772] loop1: detected capacity change from 0 to 128 [ 33.118437][ T773] netlink: 12 bytes leftover after parsing attributes in process `syz.3.191'. [ 33.127645][ T30] audit: type=1400 audit(1757192239.065:535): avc: denied { create } for pid=758 comm="syz.2.187" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 33.133023][ T769] SELinux: failed to load policy [ 33.151532][ T30] audit: type=1400 audit(1757192239.085:536): avc: denied { write open } for pid=758 comm="syz.2.187" path="/45/file1/bus" dev="loop2" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 33.175565][ T30] audit: type=1400 audit(1757192239.085:537): avc: denied { read write } for pid=758 comm="syz.2.187" name="file1" dev="loop2" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 33.199501][ T30] audit: type=1400 audit(1757192239.085:538): avc: denied { open } for pid=758 comm="syz.2.187" path="/45/file1/file1" dev="loop2" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 33.205572][ T773] netlink: 28 bytes leftover after parsing attributes in process `syz.3.191'. [ 33.222521][ T30] audit: type=1400 audit(1757192239.085:539): avc: denied { ioctl } for pid=758 comm="syz.2.187" path="/45/file1/file1" dev="loop2" ino=15 ioctlcmd=0x660f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 33.222559][ T30] audit: type=1400 audit(1757192239.115:540): avc: denied { load_policy } for pid=768 comm="syz.0.192" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 33.302371][ T30] audit: type=1400 audit(1757192239.295:541): avc: denied { create } for pid=778 comm="syz.3.196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.316753][ T781] netlink: 4 bytes leftover after parsing attributes in process `syz.2.193'. [ 33.344594][ T783] loop0: detected capacity change from 0 to 1024 [ 33.356547][ T30] audit: type=1400 audit(1757192239.325:542): avc: denied { write } for pid=778 comm="syz.3.196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.397063][ T339] attempt to access beyond end of device [ 33.397063][ T339] loop1: rw=1, want=1041, limit=128 [ 33.417878][ T30] audit: type=1400 audit(1757192239.325:543): avc: denied { nlmsg_write } for pid=778 comm="syz.3.196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.457783][ T783] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 33.551872][ T808] ================================================================== [ 33.560228][ T808] BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 33.569506][ T808] Read of size 1 at addr ffff8881104eb3f8 by task syz.4.208/808 [ 33.577146][ T808] [ 33.579489][ T808] CPU: 1 PID: 808 Comm: syz.4.208 Not tainted syzkaller #0 [ 33.586703][ T808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 33.596865][ T808] Call Trace: [ 33.600163][ T808] [ 33.603170][ T808] __dump_stack+0x21/0x30 [ 33.607524][ T808] dump_stack_lvl+0xee/0x150 [ 33.612324][ T808] ? show_regs_print_info+0x20/0x20 [ 33.617624][ T808] ? load_image+0x3a0/0x3a0 [ 33.622252][ T808] ? unwind_get_return_address+0x4d/0x90 [ 33.627912][ T808] print_address_description+0x7f/0x2c0 [ 33.633572][ T808] ? xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 33.640087][ T808] kasan_report+0xf1/0x140 [ 33.644554][ T808] ? xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 33.651102][ T808] __asan_report_load1_noabort+0x14/0x20 [ 33.656756][ T808] xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 33.663125][ T808] xfrm_policy_inexact_insert_node+0x938/0xb50 [ 33.669375][ T808] ? xfrm_netlink_rcv+0x72/0x90 [ 33.674240][ T808] ? netlink_unicast+0x876/0xa40 [ 33.679200][ T808] ? netlink_sendmsg+0x86a/0xb70 [ 33.684158][ T808] ? ____sys_sendmsg+0x5a2/0x8c0 [ 33.689227][ T808] ? ___sys_sendmsg+0x1f0/0x260 [ 33.694090][ T808] ? x64_sys_call+0x4b/0x9a0 [ 33.698691][ T808] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 33.705001][ T808] xfrm_policy_inexact_alloc_chain+0x53a/0xb30 [ 33.711294][ T808] xfrm_policy_inexact_insert+0x70/0x1130 [ 33.717150][ T808] ? __get_hash_thresh+0x10c/0x420 [ 33.722333][ T808] ? policy_hash_bysel+0x110/0x4f0 [ 33.727469][ T808] xfrm_policy_insert+0x126/0x9a0 [ 33.732863][ T808] ? xfrm_policy_construct+0x54f/0x1f00 [ 33.738430][ T808] xfrm_add_policy+0x4d1/0x830 [ 33.743225][ T808] ? xfrm_dump_sa_done+0xc0/0xc0 [ 33.748180][ T808] xfrm_user_rcv_msg+0x45c/0x6e0 [ 33.753160][ T808] ? xfrm_netlink_rcv+0x90/0x90 [ 33.758287][ T808] ? avc_has_perm_noaudit+0x460/0x460 [ 33.763798][ T808] ? x64_sys_call+0x4b/0x9a0 [ 33.768417][ T808] ? selinux_nlmsg_lookup+0x237/0x4c0 [ 33.773810][ T808] netlink_rcv_skb+0x1e0/0x430 [ 33.778592][ T808] ? xfrm_netlink_rcv+0x90/0x90 [ 33.783458][ T808] ? netlink_ack+0xb60/0xb60 [ 33.788236][ T808] ? wait_for_completion_killable_timeout+0x10/0x10 [ 33.795046][ T808] ? __netlink_lookup+0x387/0x3b0 [ 33.800086][ T808] xfrm_netlink_rcv+0x72/0x90 [ 33.804780][ T808] netlink_unicast+0x876/0xa40 [ 33.809830][ T808] netlink_sendmsg+0x86a/0xb70 [ 33.814615][ T808] ? netlink_getsockopt+0x530/0x530 [ 33.819824][ T808] ? sock_alloc_file+0xba/0x260 [ 33.825035][ T808] ? security_socket_sendmsg+0x82/0xa0 [ 33.830514][ T808] ? netlink_getsockopt+0x530/0x530 [ 33.835744][ T808] ____sys_sendmsg+0x5a2/0x8c0 [ 33.840546][ T808] ? __sys_sendmsg_sock+0x40/0x40 [ 33.845771][ T808] ? import_iovec+0x7c/0xb0 [ 33.850309][ T808] ___sys_sendmsg+0x1f0/0x260 [ 33.855012][ T808] ? __sys_sendmsg+0x250/0x250 [ 33.859881][ T808] ? __fdget+0x1a1/0x230 [ 33.864135][ T808] __x64_sys_sendmsg+0x1e2/0x2a0 [ 33.869108][ T808] ? ___sys_sendmsg+0x260/0x260 [ 33.873999][ T808] ? __kasan_check_write+0x14/0x20 [ 33.879302][ T808] ? switch_fpu_return+0x15d/0x2c0 [ 33.884881][ T808] x64_sys_call+0x4b/0x9a0 [ 33.889760][ T808] do_syscall_64+0x4c/0xa0 [ 33.894278][ T808] ? clear_bhb_loop+0x50/0xa0 [ 33.899083][ T808] ? clear_bhb_loop+0x50/0xa0 [ 33.903795][ T808] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 33.910335][ T808] RIP: 0033:0x7f06c0e03be9 [ 33.914989][ T808] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 33.936679][ T808] RSP: 002b:00007f06bf86c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 33.945616][ T808] RAX: ffffffffffffffda RBX: 00007f06c103afa0 RCX: 00007f06c0e03be9 [ 33.953730][ T808] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000006 [ 33.962394][ T808] RBP: 00007f06c0e86e19 R08: 0000000000000000 R09: 0000000000000000 [ 33.970698][ T808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 33.978900][ T808] R13: 00007f06c103b038 R14: 00007f06c103afa0 R15: 00007ffe1dee5c08 [ 33.987494][ T808] [ 33.990534][ T808] [ 33.992871][ T808] Allocated by task 808: [ 33.997122][ T808] __kasan_kmalloc+0xda/0x110 [ 34.001836][ T808] __kmalloc+0x13d/0x2c0 [ 34.006112][ T808] sk_prot_alloc+0xed/0x320 [ 34.010985][ T808] sk_alloc+0x38/0x430 [ 34.016047][ T808] pfkey_create+0x12a/0x660 [ 34.021358][ T808] __sock_create+0x38d/0x7a0 [ 34.027089][ T808] __sys_socket+0xec/0x190 [ 34.032926][ T808] __x64_sys_socket+0x7a/0x90 [ 34.037736][ T808] x64_sys_call+0x8c5/0x9a0 [ 34.042888][ T808] do_syscall_64+0x4c/0xa0 [ 34.047670][ T808] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 34.054355][ T808] [ 34.057264][ T808] The buggy address belongs to the object at ffff8881104eb000 [ 34.057264][ T808] which belongs to the cache kmalloc-1k of size 1024 [ 34.073469][ T808] The buggy address is located 1016 bytes inside of [ 34.073469][ T808] 1024-byte region [ffff8881104eb000, ffff8881104eb400) [ 34.088096][ T808] The buggy address belongs to the page: [ 34.094492][ T808] page:ffffea0004413a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1104e8 [ 34.105012][ T808] head:ffffea0004413a00 order:3 compound_mapcount:0 compound_pincount:0 [ 34.113725][ T808] flags: 0x4000000000010200(slab|head|zone=1) [ 34.120383][ T808] raw: 4000000000010200 ffffea00043e1400 0000000300000003 ffff888100043080 [ 34.129083][ T808] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 34.137862][ T808] page dumped because: kasan: bad access detected [ 34.144397][ T808] page_owner tracks the page as allocated [ 34.150326][ T808] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 101, ts 7038936633, free_ts 0 [ 34.169149][ T808] post_alloc_hook+0x192/0x1b0 [ 34.174067][ T808] prep_new_page+0x1c/0x110 [ 34.178583][ T808] get_page_from_freelist+0x2cc5/0x2d50 [ 34.184200][ T808] __alloc_pages+0x18f/0x440 [ 34.188927][ T808] new_slab+0xa1/0x4d0 [ 34.193322][ T808] ___slab_alloc+0x381/0x810 [ 34.197944][ T808] __slab_alloc+0x49/0x90 [ 34.202739][ T808] __kmalloc_track_caller+0x169/0x2c0 [ 34.208128][ T808] __alloc_skb+0x21a/0x740 [ 34.212738][ T808] netlink_sendmsg+0x602/0xb70 [ 34.217815][ T808] ____sys_sendmsg+0x5a2/0x8c0 [ 34.222688][ T808] ___sys_sendmsg+0x1f0/0x260 [ 34.227577][ T808] __x64_sys_sendmsg+0x1e2/0x2a0 [ 34.233147][ T808] x64_sys_call+0x4b/0x9a0 [ 34.237773][ T808] do_syscall_64+0x4c/0xa0 [ 34.242256][ T808] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 34.249090][ T808] page_owner free stack trace missing [ 34.254568][ T808] [ 34.256906][ T808] Memory state around the buggy address: [ 34.262820][ T808] ffff8881104eb280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.271544][ T808] ffff8881104eb300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.281376][ T808] >ffff8881104eb380: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 34.290494][ T808] ^ [ 34.298866][ T808] ffff8881104eb400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.307764][ T808] ffff8881104eb480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.316278][ T808] ================================================================== [ 34.325113][ T808] Disabling lock debugging due to kernel taint