last executing test programs: 4.023245927s ago: executing program 3 (id=126): memfd_create(0x0, 0x0) unshare(0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) mbind(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x5, 0x0, 0x7e, 0x2) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 3.426560685s ago: executing program 3 (id=129): setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8000}, 0x8) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) close(0x3) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) getsockopt$bt_hci(r0, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9) 3.377909799s ago: executing program 3 (id=130): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r4}, 0x10) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x60, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28}, @TCA_TBF_BURST={0x8, 0x6, 0x58}]}}]}, 0x60}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@gettclass={0x24, 0x2a, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}}}, 0x24}}, 0x0) 3.273030238s ago: executing program 3 (id=131): ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r4, r3, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) close(r4) recvmsg$unix(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0x33fe0}], 0x1}, 0x0) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000380)='~', 0x1}], 0x1}, 0x0) 3.019830498s ago: executing program 3 (id=133): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000111e6ca5b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x18) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) r3 = getpid() r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r5, 0x1, 0x70bd26, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r3}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x0) 2.540398266s ago: executing program 3 (id=140): mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x15, 0xe, &(0x7f0000003540)=ANY=[@ANYBLOB="b700000050000008bca30000000000002403000040feffff7b1af0ff0000000079a4f0ff000000001f030000000000002e030200000000002604fdffffff000e61141800000000001d430000000000007a0a00fe0000001f61141c00000000004603f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566de74e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48b936e6f9e0fcda88fe4413537528fd79153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b602396df7e0c1e02b88c114f2440000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54dd84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f0e6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c9494963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637d4219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf699b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a4a274000000000000000000000000000000000000000000000009dd14b38f2f5426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd030000006d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10b0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c88629a6c921c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fc3167a257e040fa7cf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0c69c2c03f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fbf05b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac98708007c80d6c7d0de4614195e40d797c0348dd70f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fc52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97a4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71ca3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812dc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a296c22fdcea26498d26229110b1aade386b113045033a6188d56e675564d8cb8d5b40114b0f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795835f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb7ed9d12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b88ae780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca780049d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e2848890522c2288072467d2afe269f589fb7e034b92d3ca245b16b71998711bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb16e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b2676c07bb0fd14020a66718378825d5ed789711b77d40dc31e0b8fc651b45559da463f0000000000000000000000000052d42124e9c26aba885015e69d42ecd710342ac597ebea576ae15fdf611356f622e831741ab15549e0d7a2bd0324e2b3b48a10551607492c19eaf58485feb4cab19c303b30ba2ddea0d792d77724c9fa4ed58b93668fc20484f141ee2b6a0029e88fdc853189b4dafd36ff23b11967090e508f45e3f10857038a52ef275cf9e3e4b5d30b12d138dfa70930c603b5e3f4b7be67be3dba3cbd8d4d143195af0697d779445d67dcfbd922d12a8b49f93eac7a72faacf80346b3b60f132a2bf8a858392f34072d99aee0ec70aa6d75096e608d97ac4b7bfa2e0ae3e59718e7a7691a98b1334e34553300000000000000000000000000000000062c7cf52e9624806a4833e1c0059e5a703ab9c2e9b38779270dc5e80af75d509b1a31fe6ed3f8c0172659256dc88de4e377c8a07e95ec5549ae47dc43b93a159a201be254048b9e0857ea3c736c761e686f9b3d0690f035617a12055b2cb3a03794d67b95e7f4fc6af323120c09d0503c8ce92e869e22bb2590299ad76d541f844d32f96184f74d433793bbd75ec15fb1497ce835445212421cb4e3ce08395c9055a2"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xffffffffffffffc2}, 0x48) r3 = socket$nl_route(0x10, 0x3, 0x0) listen(0xffffffffffffffff, 0x0) bind$packet(r1, &(0x7f0000000040)={0x11, 0x1, r2, 0x1, 0x9}, 0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r2, {0x7, 0xa}, {0xd, 0xc}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) 945.659175ms ago: executing program 2 (id=150): syz_open_procfs$userns(0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x48) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00', r0}, 0x18) chroot(&(0x7f0000000000)='./file0/../file0\x00') mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f00000000c0)='./file0\x00') 910.190307ms ago: executing program 2 (id=151): prctl$PR_SET_NAME(0xf, &(0x7f0000000480)='gtp\x00') r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000009c0)=ANY=[], &(0x7f0000000100)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x34, 0x3, 0xffffffffffffffff, 0x0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x1}, 0x0, 0x40000000}) r1 = syz_io_uring_setup(0x74d, &(0x7f0000000100)={0x0, 0x11f8, 0x800, 0x1000, 0x5cc}, &(0x7f0000000300)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000740)=[{&(0x7f00000003c0)=""/201, 0xc9}], 0x1) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000000c0)={0x1, &(0x7f0000000200)=[{0x30, 0x4, 0x0, 0x2}]}, 0xffffffffffffff0e) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_EPOLL_CTL=@add={0x1d, 0x0, 0x0, 0xffffffffffffffff, 0x0, r1}) io_uring_enter(r1, 0x749f, 0x4, 0x0, 0x0, 0xfffffffffffffef5) 871.47102ms ago: executing program 2 (id=152): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000200)={{r0}, &(0x7f0000000140), &(0x7f0000000040)='%pI4 \x00'}, 0x2a) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = fsopen(&(0x7f0000000400)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)=',-\x15*\x00', &(0x7f0000000440)='$\b&U0\xb5i\x16\xca\xcd\x01\xf8\x13x\\\x16\x0e\x8c\x1b\xc1rv\xa5k|\x92*ON\x9d\xf21KH\xfcx\xdayx\xe4\xf8\x86\xc3\xf1\xb4\x94/9\',\xf7uX/W\xcc5\a\x9e^\x90\xa8\xaf\xda\x97\xe0M]\xcd\xe2\x17\'\xbf\x04i\xcakbA\xf6\xd2P\xa5H\xf0\xa0B=\x01\x00\x86%\x97\xcb\xbcWo\xf2\xa6', 0x0) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000005c0)='\x00H\xeb', 0x0, r2) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='syzkaller\x00', &(0x7f0000001140)='\xf1\x95\xb3>-\x8c\xd4\r\x01\xfa\xe2{eED\x0e\xaaPV\x11\xff\xb6j\xd4~6\x82^\x9b b', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000380)='kD\a\x00', &(0x7f0000000900)='\x00.-&]\xe1\x19\t\xe88\xces`Z1\\\x98\x8b\xb4\xb4\x14v\xf1\x94\x1e[\x8bs\x94\x80\x96\xf2\x02\x98+vv\x8a\xf7D\x19\x8cd\xa6\a\xe0S\xda2\b\xf1\xb5\x17V\x04\fm\xe4?0\x0fL\xc5\xba\xbb\x1di+Q~\xfa\x9a}m;\xe1\xcef8\xa0\x04\f\x15\x82!-\x91\x81\xac\xa3::\xc6\x9b\xa2\x13\xde&\xc4\x80\x8c\x15\x01\n\x81\xbf1\x96$\xeeQ\xe7\' RI\x1f\x00'/133, 0x0) close(r2) 830.254583ms ago: executing program 2 (id=153): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r1, 0x0, &(0x7f0000001700)=""/53}, 0x20) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x2c, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r3}, 0x18) r4 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a2f000000000800410072786500140033007465616d5f736c6176655f30"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8844) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000040), 0x0, 0x0, 0x0) fremovexattr(r0, &(0x7f00000000c0)=@known='trusted.overlay.metacopy\x00') 709.969983ms ago: executing program 0 (id=155): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x10) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000300)='io_uring_req_failed\x00', 0xffffffffffffffff, 0x0, 0x8000000000000000}, 0x18) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) setsockopt$inet_mreqsrc(r0, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) 667.534066ms ago: executing program 1 (id=156): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x4f, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x0, 0x0) r2 = io_uring_setup(0x5b42, &(0x7f0000000640)={0x0, 0xfffffffe, 0x800, 0x103fc, 0x159}) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000040)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x2b) sendmsg$rds(r3, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) fstat(0xffffffffffffffff, 0x0) 621.87489ms ago: executing program 0 (id=157): memfd_create(0x0, 0x0) unshare(0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) mbind(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x5, 0x0, 0x7e, 0x2) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 502.33027ms ago: executing program 1 (id=160): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x5452, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8923, &(0x7f00000000c0)={'bond_slave_0\x00', @random="0135014010ff"}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r2 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x50101, 0x0) r3 = openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) write$cgroup_freezer_state(r3, &(0x7f00000000c0)='THAWED\x00', 0x7) 437.402845ms ago: executing program 4 (id=161): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r2}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) timer_create(0x0, 0x0, &(0x7f0000bbdffc)=0x0) timer_delete(r3) 418.004026ms ago: executing program 1 (id=162): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040000000100000000000000", @ANYRES32=0x1], 0x50) r0 = socket$kcm(0xa, 0x5, 0x0) r1 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r1, &(0x7f00000002c0)={&(0x7f0000000180)={0x2, 0x2, @dev}, 0x10, &(0x7f0000001400)=[{&(0x7f0000001800)='_', 0x1}], 0x1}, 0x64) setsockopt$sock_attach_bpf(r1, 0x84, 0x1e, &(0x7f0000000240), 0x4) r2 = socket$kcm(0xa, 0x5, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x49, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r4}, 0x18) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8916, &(0x7f0000000000)={r2}) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)={r2}) 406.449037ms ago: executing program 4 (id=163): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket(0x28, 0x5, 0x0) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r2, 0x4) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) r4 = accept$unix(r2, 0x0, 0x0) sendmmsg(r4, &(0x7f0000002d00)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000001c0)="d9", 0x1}], 0x1}}], 0x1, 0x20000040) recvmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x2001) 389.091029ms ago: executing program 0 (id=164): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000040000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) memfd_create(0x0, 0x3) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000300)='kmem_cache_free\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffff9}, 0x18) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x281c2, 0x120) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000b40)=@filter={'filter\x00', 0x4, 0x4, 0x370, 0xffffffff, 0x260, 0x260, 0xe8, 0xfeffffff, 0xffffffff, 0x3e8, 0x3e8, 0x3e8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xffffffff, 0xffffffff, 0xffffffff], 'hsr0\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private2, @empty, [], [0x0, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00'}, 0x0, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x2000010}}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000a00)=ANY=[@ANYBLOB="442300003b0007010100000000000000017c00000400fc802b2301"], 0x2344}, 0x1, 0x0, 0x0, 0x20000000}, 0x4c000) 380.236329ms ago: executing program 1 (id=165): epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="81ffffff00000000180012800e0001007769726567756172640000000400028008000a00bc00"], 0x40}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x11, 0x8, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBMODE(r1, 0x4b45, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000bc0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000100)={0x0, 0x204000, 0x1000}, 0x20) 322.611064ms ago: executing program 4 (id=166): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r3}, 0x10) bind$bt_hci(r0, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) io_setup(0x8f0, &(0x7f0000002400)=0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) io_submit(r4, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2000000000, 0x4, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)="0200ffff0000", 0x6, 0x0, 0x0, 0x2}]) 256.936939ms ago: executing program 0 (id=167): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'pim6reg1\x00', 0x1}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0x6, 0x8, 0x8, 0x40}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000004c0), 0xce, r2}, 0x38) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @link_local}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='qdisc_destroy\x00', r3}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='qdisc_destroy\x00', r4}, 0x10) close(r0) 209.656233ms ago: executing program 4 (id=168): mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e8500000005"], 0x0, 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1a"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='writeback_bdi_register\x00', r3}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='writeback_bdi_register\x00', r4}, 0x10) r5 = dup(r2) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[], [], 0x6b}}) 208.693993ms ago: executing program 2 (id=169): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000008000000060000000010"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r1, 0x0, 0xfffffffffffff001}, 0x18) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x1008a, &(0x7f0000000400)={[{@nomblk_io_submit}, {@usrjquota, 0x22}, {@errors_continue}, {@noload}, {@nomblk_io_submit}, {@grpjquota, 0x22}, {@errors_continue}, {@errors_remount}, {@jqfmt_vfsv1}]}, 0xfe, 0x455, &(0x7f0000000fc0)="$eJzs3M9PHFUcAPDv7rJQ2iJY649iq2g1En9AoT/swUuNJh40MdFDjScE2mC3xRRMbEMUPeDRNPFuPJr4F3ixXox6MvGqd2NCDBerpzWzO0O3sAssLGx1P59k4L19b/Ped2be7ts3OxtAxxpK/uQiDkbErxHRX83eWWGo+u/WysLk3ysLk7kol9/4M1ep99fKwmRWNXvegWqmXN6g3aW3IyZKpemraX50/vJ7o3PXrj83c3ni4vTF6SvjZ8+eOnms+8z46ZbE2Zf0dfDD2aNHXnnrxmuT52+88+PXSX8PpuW1cbTKUHXv1vVkqxtrs76adK6rjR2hKYWISA5XsTL++6MQvatl/fHyJ23tHLCryuV8uadx8WIZ+B9LJupAJ8re6JPPv9m2R1OPu8LyuVhdx7iVbtWSrsindYrpZ6TdMBQR5xf/+SLZYpfWIQAAat08FxHP1pv/5eOBmnr3pNeGBiLi3og4FBH3RcThiLg/olL3wYh4qMn2114hWT//KfdvK7AtSuZ/L6TXtu6c/2WzvxgopLm+SvzF3IWZ0vSJdJ8MR7EnyY9t0MZ3L/3yWaOy2vlfsiXtZ3PBtB9/dK1ZoJuamJ/YScy1lj+OGOyqF39udc6bzI+PRMTgNtuYefqro43KNo9/Ay2YlJe/jHiqevwXY038mVzD65Njz58ZPz26L0rTJ0azs2K9n35eer1R+zuKvwWWb5Zjf93zfzX+gdy+iLlr1y9VrtfONd/G0m+fNvxMs93zvzv3ZiXdnT72wcT8/NWxiO7cq+sfH7/93Cyf1U/O/+Hj9cf/obi9Jx6OiOQkPhYRj0TEo2nfH4uIxyPi+Abx//DiE+82H/8Gq/ItlMQ/tdnxj9rj33yicOn7b5qPP5Mc/1OV1HD6yFZe/7bawZ3sOwAAAPivyFe+A5/Lj6ym8/mRkep3+A/H/nxpdm7+mQuz71+Zqn5XfiCK+Wylq79mPXQsXRvO8uNr8ifTdePPC72V/MjkbGmq3cFDhzvQYPwnfi+0u3fArnO/FnQu4x86l/EPncv4h85l/EPnqjf+P2pDP4C9t8n7f+9e9QPYe+b/0LmMf+hcxj90pIb3xud3dMu/RJsS33bv7Lcatp6I/F0S8q4neiNiL9oqRjXRExE1RV1b/jGLbSZ66ha1+5UJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgNf4NAAD//xwt370=") getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) close(r2) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)='F', 0x1}], 0x1, &(0x7f0000000180)=[@sndinfo={0x20, 0x84, 0x2, {0xa, 0x4, 0x28, 0x200000b, r4}}], 0x20, 0x2400e044}, 0x0) 178.413006ms ago: executing program 1 (id=170): socket$nl_generic(0x10, 0x3, 0x10) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) dup(r0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x8042, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0xa0b41, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f00000002c0)=ANY=[@ANYRES64=r1], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, r2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_GETKMSGREDIRECT(r3, 0x541c, &(0x7f0000000000)) 151.853088ms ago: executing program 0 (id=171): bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0x5}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f0000000040), &(0x7f0000000280)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='timer_start\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='timer_start\x00', r2}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000010c0)) 125.06604ms ago: executing program 1 (id=172): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r4}, 0x10) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x60, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28}, @TCA_TBF_BURST={0x8, 0x6, 0x58}]}}]}, 0x60}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@gettclass={0x24, 0x2a, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}}}, 0x24}}, 0x0) 78.516794ms ago: executing program 4 (id=173): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x5452, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8923, &(0x7f00000000c0)={'bond_slave_0\x00', @random="0135014010ff"}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r2 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x50101, 0x0) r3 = openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) write$cgroup_freezer_state(r3, &(0x7f00000000c0)='THAWED\x00', 0x7) 76.187444ms ago: executing program 0 (id=174): r0 = open(0x0, 0x145842, 0x10) pwritev2(r0, &(0x7f0000000240)=[{}], 0x1, 0x0, 0x0, 0xb) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYRES32=r1, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0xce}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="20000000110001010200"/20, @ANYRES32=r5], 0x20}}, 0x0) 31.703337ms ago: executing program 4 (id=175): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000111e6ca5b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x18) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) r3 = getpid() r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r5, 0x1, 0x70bd26, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r3}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x0) 0s ago: executing program 2 (id=176): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x3000)=nil) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800"], 0x64}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x3c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_REPLY={0x4}, @CTA_TIMEOUT={0x8}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100e}, @CTA_SEQ_ADJ_REPLY={0x14, 0x4, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8}]}]}, 0x3c}}, 0x0) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r2, &(0x7f0000000d00)=[{&(0x7f0000001b80)=""/4096, 0x1000}], 0x1, 0x2, 0x200) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r3) kernel console output (not intermixed with test programs): =process permissive=1 [ 18.109378][ T29] audit: type=1400 audit(1755375082.747:61): avc: denied { siginh } for pid=3179 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.212' (ED25519) to the list of known hosts. [ 26.067700][ T29] audit: type=1400 audit(1755375090.717:62): avc: denied { mounton } for pid=3291 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.068690][ T3291] cgroup: Unknown subsys name 'net' [ 26.090477][ T29] audit: type=1400 audit(1755375090.717:63): avc: denied { mount } for pid=3291 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.118369][ T29] audit: type=1400 audit(1755375090.777:64): avc: denied { unmount } for pid=3291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.273946][ T3291] cgroup: Unknown subsys name 'cpuset' [ 26.280243][ T3291] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 26.408880][ T29] audit: type=1400 audit(1755375091.057:65): avc: denied { setattr } for pid=3291 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.432298][ T29] audit: type=1400 audit(1755375091.057:66): avc: denied { create } for pid=3291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.453144][ T29] audit: type=1400 audit(1755375091.057:67): avc: denied { write } for pid=3291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.474002][ T29] audit: type=1400 audit(1755375091.057:68): avc: denied { read } for pid=3291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.494425][ T29] audit: type=1400 audit(1755375091.087:69): avc: denied { mounton } for pid=3291 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.501510][ T3293] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.519265][ T29] audit: type=1400 audit(1755375091.087:70): avc: denied { mount } for pid=3291 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 26.551682][ T29] audit: type=1400 audit(1755375091.187:71): avc: denied { relabelto } for pid=3293 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.582081][ T3291] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.708332][ T3302] chnl_net:caif_netlink_parms(): no params data found [ 27.731814][ T3303] chnl_net:caif_netlink_parms(): no params data found [ 27.786977][ T3306] chnl_net:caif_netlink_parms(): no params data found [ 27.799275][ T3302] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.806407][ T3302] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.813597][ T3302] bridge_slave_0: entered allmulticast mode [ 27.819902][ T3302] bridge_slave_0: entered promiscuous mode [ 27.837551][ T3302] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.844648][ T3302] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.851865][ T3302] bridge_slave_1: entered allmulticast mode [ 27.858195][ T3302] bridge_slave_1: entered promiscuous mode [ 27.873100][ T3300] chnl_net:caif_netlink_parms(): no params data found [ 27.906437][ T3302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.918111][ T3303] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.925430][ T3303] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.932562][ T3303] bridge_slave_0: entered allmulticast mode [ 27.939080][ T3303] bridge_slave_0: entered promiscuous mode [ 27.947211][ T3303] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.954450][ T3303] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.961686][ T3303] bridge_slave_1: entered allmulticast mode [ 27.968230][ T3303] bridge_slave_1: entered promiscuous mode [ 27.981897][ T3302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.996134][ T3308] chnl_net:caif_netlink_parms(): no params data found [ 28.031402][ T3303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.046360][ T3302] team0: Port device team_slave_0 added [ 28.052143][ T3306] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.059226][ T3306] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.066404][ T3306] bridge_slave_0: entered allmulticast mode [ 28.072905][ T3306] bridge_slave_0: entered promiscuous mode [ 28.085161][ T3303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.096876][ T3302] team0: Port device team_slave_1 added [ 28.107052][ T3306] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.114143][ T3306] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.121511][ T3306] bridge_slave_1: entered allmulticast mode [ 28.128078][ T3306] bridge_slave_1: entered promiscuous mode [ 28.151932][ T3302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.158931][ T3302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.184871][ T3302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.210530][ T3302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.217607][ T3302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.243758][ T3302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.261768][ T3303] team0: Port device team_slave_0 added [ 28.267532][ T3300] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.274622][ T3300] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.282641][ T3300] bridge_slave_0: entered allmulticast mode [ 28.289250][ T3300] bridge_slave_0: entered promiscuous mode [ 28.299274][ T3300] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.306421][ T3300] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.313783][ T3300] bridge_slave_1: entered allmulticast mode [ 28.320004][ T3300] bridge_slave_1: entered promiscuous mode [ 28.327109][ T3306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.339516][ T3306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.349357][ T3303] team0: Port device team_slave_1 added [ 28.381496][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.388494][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.415053][ T3303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.440953][ T3306] team0: Port device team_slave_0 added [ 28.447718][ T3306] team0: Port device team_slave_1 added [ 28.453722][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.460688][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.487415][ T3303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.499234][ T3300] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.508445][ T3308] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.515600][ T3308] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.522835][ T3308] bridge_slave_0: entered allmulticast mode [ 28.529348][ T3308] bridge_slave_0: entered promiscuous mode [ 28.552493][ T3300] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.561724][ T3308] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.568932][ T3308] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.576208][ T3308] bridge_slave_1: entered allmulticast mode [ 28.582738][ T3308] bridge_slave_1: entered promiscuous mode [ 28.591030][ T3302] hsr_slave_0: entered promiscuous mode [ 28.597041][ T3302] hsr_slave_1: entered promiscuous mode [ 28.609464][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.616599][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.642623][ T3306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.672039][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.679054][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.705426][ T3306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.732498][ T3303] hsr_slave_0: entered promiscuous mode [ 28.739345][ T3303] hsr_slave_1: entered promiscuous mode [ 28.745230][ T3303] debugfs: 'hsr0' already exists in 'hsr' [ 28.750956][ T3303] Cannot create hsr debugfs directory [ 28.764906][ T3300] team0: Port device team_slave_0 added [ 28.772652][ T3308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.782992][ T3308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.792801][ T3300] team0: Port device team_slave_1 added [ 28.827506][ T3306] hsr_slave_0: entered promiscuous mode [ 28.833657][ T3306] hsr_slave_1: entered promiscuous mode [ 28.839442][ T3306] debugfs: 'hsr0' already exists in 'hsr' [ 28.845185][ T3306] Cannot create hsr debugfs directory [ 28.858826][ T3300] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.865817][ T3300] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.891870][ T3300] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.908276][ T3308] team0: Port device team_slave_0 added [ 28.919416][ T3300] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.926419][ T3300] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.952933][ T3300] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.972986][ T3308] team0: Port device team_slave_1 added [ 29.019160][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.026294][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.053092][ T3308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.085316][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.092265][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 29.118275][ T3308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.131414][ T3300] hsr_slave_0: entered promiscuous mode [ 29.137486][ T3300] hsr_slave_1: entered promiscuous mode [ 29.143565][ T3300] debugfs: 'hsr0' already exists in 'hsr' [ 29.149319][ T3300] Cannot create hsr debugfs directory [ 29.187716][ T3308] hsr_slave_0: entered promiscuous mode [ 29.193895][ T3308] hsr_slave_1: entered promiscuous mode [ 29.199856][ T3308] debugfs: 'hsr0' already exists in 'hsr' [ 29.205757][ T3308] Cannot create hsr debugfs directory [ 29.264504][ T3302] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 29.283871][ T3302] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 29.301570][ T3302] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 29.316989][ T3302] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 29.352694][ T3303] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 29.365441][ T3303] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 29.380112][ T3303] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 29.394858][ T3303] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 29.407878][ T3306] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 29.419019][ T3306] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 29.430361][ T3306] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 29.446060][ T3306] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 29.465702][ T3300] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 29.475896][ T3300] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 29.485093][ T3300] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 29.500499][ T3300] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 29.541248][ T3308] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 29.554300][ T3308] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 29.564864][ T3308] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 29.578145][ T3302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.593876][ T3302] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.604911][ T3308] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 29.625691][ T145] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.633053][ T145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.650997][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.658145][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.692198][ T3303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.707517][ T3300] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.715998][ T3306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.741008][ T3300] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.753064][ T3306] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.762537][ T3303] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.778819][ T145] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.785876][ T145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.794821][ T145] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.802021][ T145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.826469][ T145] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.833559][ T145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.843931][ T145] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.850980][ T145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.859309][ T145] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.866370][ T145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.876084][ T145] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.883709][ T145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.912642][ T3308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.937047][ T3306] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 29.962902][ T3308] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.974233][ T3302] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.992762][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.000102][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.012822][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.020004][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.040094][ T3303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.064621][ T3308] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.075288][ T3308] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.100887][ T3300] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.143015][ T3306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.216670][ T3308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.230626][ T3300] veth0_vlan: entered promiscuous mode [ 30.252696][ T3302] veth0_vlan: entered promiscuous mode [ 30.279319][ T3303] veth0_vlan: entered promiscuous mode [ 30.298102][ T3303] veth1_vlan: entered promiscuous mode [ 30.305366][ T3300] veth1_vlan: entered promiscuous mode [ 30.314487][ T3302] veth1_vlan: entered promiscuous mode [ 30.326170][ T3306] veth0_vlan: entered promiscuous mode [ 30.346892][ T3306] veth1_vlan: entered promiscuous mode [ 30.357467][ T3300] veth0_macvtap: entered promiscuous mode [ 30.365794][ T3300] veth1_macvtap: entered promiscuous mode [ 30.378480][ T3300] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.396297][ T3302] veth0_macvtap: entered promiscuous mode [ 30.407515][ T3303] veth0_macvtap: entered promiscuous mode [ 30.419567][ T3300] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.428597][ T3302] veth1_macvtap: entered promiscuous mode [ 30.437266][ T3306] veth0_macvtap: entered promiscuous mode [ 30.447132][ T1389] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.456360][ T3303] veth1_macvtap: entered promiscuous mode [ 30.464219][ T3306] veth1_macvtap: entered promiscuous mode [ 30.471263][ T1389] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.485557][ T1389] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.498563][ T3302] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.505940][ T1389] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.518545][ T3308] veth0_vlan: entered promiscuous mode [ 30.536438][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.544500][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.552441][ T3302] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.561073][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.579550][ T41] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.589384][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.601879][ T3308] veth1_vlan: entered promiscuous mode [ 30.609401][ T41] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.624289][ T41] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.634973][ T41] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.644030][ T41] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.652837][ T41] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.667596][ T3300] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.677063][ T41] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.709624][ T41] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.747674][ T3308] veth0_macvtap: entered promiscuous mode [ 30.755085][ T41] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.785537][ T41] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.795876][ T3308] veth1_macvtap: entered promiscuous mode [ 30.815692][ T41] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.826819][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.828233][ T3479] loop1: detected capacity change from 0 to 512 [ 30.837911][ T41] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.852526][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.857138][ C1] hrtimer: interrupt took 38355 ns [ 30.865560][ T3479] ======================================================= [ 30.865560][ T3479] WARNING: The mand mount option has been deprecated and [ 30.865560][ T3479] and is ignored by this kernel. Remove the mand [ 30.865560][ T3479] option from the mount to silence this warning. [ 30.865560][ T3479] ======================================================= [ 30.916662][ T3479] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 30.933734][ T41] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.970950][ T41] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.982029][ T3481] loop3: detected capacity change from 0 to 512 [ 30.986949][ T41] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.997315][ T3479] EXT4-fs error (device loop1): ext4_do_update_inode:5653: inode #16: comm syz.1.6: corrupted inode contents [ 31.010401][ T41] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.033803][ T3479] EXT4-fs error (device loop1): ext4_dirty_inode:6538: inode #16: comm syz.1.6: mark_inode_dirty error [ 31.045227][ T3479] EXT4-fs error (device loop1): ext4_do_update_inode:5653: inode #16: comm syz.1.6: corrupted inode contents [ 31.055992][ T3481] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.057663][ T3479] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #16: comm syz.1.6: mark_inode_dirty error [ 31.074748][ T3490] netlink: 277 bytes leftover after parsing attributes in process `syz.2.7'. [ 31.088391][ T3481] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.102554][ T29] kauditd_printk_skb: 38 callbacks suppressed [ 31.102571][ T29] audit: type=1400 audit(1755375095.737:110): avc: denied { mount } for pid=3480 comm="syz.3.4" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 31.189302][ T3495] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 31.209769][ T3479] EXT4-fs error (device loop1): ext4_do_update_inode:5653: inode #16: comm syz.1.6: corrupted inode contents [ 31.244538][ T3479] EXT4-fs error (device loop1) in ext4_orphan_del:305: Corrupt filesystem [ 31.257236][ T3479] EXT4-fs error (device loop1): ext4_do_update_inode:5653: inode #16: comm syz.1.6: corrupted inode contents [ 31.271137][ T3306] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.303483][ T3479] EXT4-fs error (device loop1): ext4_truncate:4666: inode #16: comm syz.1.6: mark_inode_dirty error [ 31.321872][ T29] audit: type=1400 audit(1755375095.967:111): avc: denied { create } for pid=3498 comm="syz.2.10" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 31.359265][ T29] audit: type=1400 audit(1755375096.007:112): avc: denied { create } for pid=3500 comm="syz.3.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 31.363641][ T3479] EXT4-fs error (device loop1) in ext4_process_orphan:347: Corrupt filesystem [ 31.405284][ T3479] EXT4-fs (loop1): 1 truncate cleaned up [ 31.425587][ T41] Quota error (device loop1): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 31.426422][ T3479] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.435402][ T41] EXT4-fs error (device loop1): ext4_release_dquot:6969: comm kworker/u8:2: Failed to release dquot type 1 [ 31.462352][ T29] audit: type=1400 audit(1755375096.037:113): avc: denied { setopt } for pid=3500 comm="syz.3.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 31.481807][ T29] audit: type=1400 audit(1755375096.037:114): avc: denied { write } for pid=3500 comm="syz.3.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 31.501144][ T29] audit: type=1400 audit(1755375096.107:115): avc: denied { tracepoint } for pid=3498 comm="syz.2.10" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 31.533639][ T3479] ext4 filesystem being mounted at /1/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.545655][ T29] audit: type=1400 audit(1755375096.177:116): avc: denied { read } for pid=3498 comm="syz.2.10" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 31.548878][ T3499] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10'. [ 31.573834][ T3499] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10'. [ 31.628168][ T29] audit: type=1400 audit(1755375096.267:117): avc: denied { mounton } for pid=3506 comm="syz.3.12" path="/2/file0" dev="tmpfs" ino=29 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 31.650364][ T29] audit: type=1400 audit(1755375096.267:118): avc: denied { mount } for pid=3506 comm="syz.3.12" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 31.766824][ T3300] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.793046][ T3522] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17'. [ 31.811749][ T3522] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 31.819286][ T3522] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 31.829311][ T3522] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 31.837478][ T3522] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 31.899833][ T3539] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 31.907410][ T3539] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 31.922993][ T3539] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 31.931531][ T3539] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 32.083970][ T3515] syz.3.13 (3515) used greatest stack depth: 10872 bytes left [ 32.157035][ T3553] loop2: detected capacity change from 0 to 128 [ 32.170928][ T3553] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 32.180918][ T3553] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 32.208219][ T3553] syz.2.24 (3553) used greatest stack depth: 10712 bytes left [ 32.299979][ T3561] capability: warning: `wÞ£ÿ' uses deprecated v2 capabilities in a way that may be insecure [ 32.335760][ T3563] Driver unsupported XDP return value 0 on prog (id 26) dev N/A, expect packet loss! [ 32.417783][ T3573] netlink: 'syz.3.33': attribute type 17 has an invalid length. [ 32.425635][ T3573] netlink: 148 bytes leftover after parsing attributes in process `syz.3.33'. [ 32.478960][ T3575] loop2: detected capacity change from 0 to 8192 [ 32.486041][ T3577] netlink: 4 bytes leftover after parsing attributes in process `syz.3.35'. [ 32.513047][ T3577] hsr_slave_1 (unregistering): left promiscuous mode [ 32.685480][ T3581] netlink: 12 bytes leftover after parsing attributes in process `syz.2.37'. [ 32.760902][ T3585] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.768147][ T3585] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.804772][ T3585] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 32.821997][ T3585] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 32.853608][ T9] syz1: Port: 1 Link DOWN [ 32.853611][ T145] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.853643][ T145] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.877115][ T145] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.887419][ T145] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.001038][ T3596] netlink: 8 bytes leftover after parsing attributes in process `syz.2.43'. [ 33.010006][ T3596] netlink: 8 bytes leftover after parsing attributes in process `syz.2.43'. [ 33.018970][ T3596] Zero length message leads to an empty skb [ 33.074291][ T3603] loop0: detected capacity change from 0 to 512 [ 33.089523][ T3603] EXT4-fs error (device loop0): ext4_orphan_get:1392: inode #15: comm syz.0.46: iget: bad extended attribute block 1 [ 33.103174][ T3603] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.46: couldn't read orphan inode 15 (err -117) [ 33.116444][ T3603] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 33.131287][ T3603] netlink: 'syz.0.46': attribute type 10 has an invalid length. [ 33.142366][ T3603] team0: Port device dummy0 added [ 33.150751][ T3603] netlink: 'syz.0.46': attribute type 10 has an invalid length. [ 33.160655][ T3603] team0: Port device dummy0 removed [ 33.167642][ T3603] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 33.181577][ T3603] syz.0.46 (3603) used greatest stack depth: 10704 bytes left [ 33.198733][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.665950][ T3624] netlink: 'syz.1.54': attribute type 11 has an invalid length. [ 33.742550][ T3629] netlink: 12 bytes leftover after parsing attributes in process `syz.2.56'. [ 33.936428][ T3647] loop2: detected capacity change from 0 to 512 [ 33.945048][ T3647] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 33.964033][ T3647] EXT4-fs (loop2): 1 orphan inode deleted [ 33.969887][ T3647] EXT4-fs (loop2): 1 truncate cleaned up [ 33.976106][ T3647] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 33.992208][ T3647] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 34.007872][ T3647] EXT4-fs (loop2): Remounting filesystem read-only [ 34.015176][ T3647] EXT4-fs (loop2): error restoring inline_data for inode -- potential data loss! (inode 12, error -30) [ 34.043340][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.070394][ T3652] mmap: syz.3.64 (3652) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 34.124753][ T3658] syzkaller0: entered promiscuous mode [ 34.130475][ T3658] syzkaller0: entered allmulticast mode [ 34.372032][ T3664] hsr_slave_0: left promiscuous mode [ 34.379367][ T3664] hsr_slave_1: left promiscuous mode [ 34.560184][ T3670] loop3: detected capacity change from 0 to 2048 [ 34.619898][ T3287] Alternate GPT is invalid, using primary GPT. [ 34.626658][ T3287] loop3: p2 p3 p7 [ 34.639320][ T3670] Alternate GPT is invalid, using primary GPT. [ 34.645732][ T3670] loop3: p2 p3 p7 [ 34.837382][ T3689] loop0: detected capacity change from 0 to 128 [ 34.858603][ T3689] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 34.877134][ T3689] ext4 filesystem being mounted at /14/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.974980][ T3303] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 34.995960][ T3699] loop2: detected capacity change from 0 to 512 [ 35.032341][ T3699] EXT4-fs error (device loop2): ext4_xattr_inode_iget:442: comm syz.2.77: error while reading EA inode 32 err=-116 [ 35.048746][ T3699] EXT4-fs (loop2): Remounting filesystem read-only [ 35.056659][ T3699] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2848: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 35.071151][ T3699] EXT4-fs warning (device loop2): ext4_evict_inode:257: couldn't mark inode dirty (err -30) [ 35.082113][ T3699] EXT4-fs (loop2): 1 orphan inode deleted [ 35.090808][ T3699] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.115438][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.462091][ T3714] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.517401][ T3714] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.569480][ T3714] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.607369][ T3714] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.665434][ T145] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.690032][ T145] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.703911][ T145] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.712782][ T145] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.961976][ T3732] lo: entered allmulticast mode [ 35.969746][ T3732] tunl0: entered allmulticast mode [ 35.997369][ T3732] gre0: entered allmulticast mode [ 36.007550][ T3732] gretap0: entered allmulticast mode [ 36.054964][ T3732] erspan0: entered allmulticast mode [ 36.062291][ T3732] ip_vti0: entered allmulticast mode [ 36.082105][ T3732] ip6_vti0: entered allmulticast mode [ 36.115216][ T3732] sit0: entered allmulticast mode [ 36.129538][ T3732] ip6tnl0: entered allmulticast mode [ 36.153236][ T3732] ip6gre0: entered allmulticast mode [ 36.176814][ T3732] syz_tun: entered allmulticast mode [ 36.202533][ T3732] ip6gretap0: entered allmulticast mode [ 36.235670][ T3732] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.242958][ T3732] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.294434][ T3732] bridge0: entered allmulticast mode [ 36.327274][ T3732] vcan0: entered allmulticast mode [ 36.356015][ T3732] bond0: entered allmulticast mode [ 36.361179][ T3732] bond_slave_0: entered allmulticast mode [ 36.367781][ T3732] bond_slave_1: entered allmulticast mode [ 36.425602][ T3732] dummy0: entered allmulticast mode [ 36.448368][ T3732] team0: entered allmulticast mode [ 36.453990][ T3732] team_slave_0: entered allmulticast mode [ 36.461040][ T3732] team_slave_1: entered allmulticast mode [ 36.543651][ T3732] nlmon0: entered allmulticast mode [ 36.564234][ T3732] caif0: entered allmulticast mode [ 36.585253][ T3732] vxcan0: entered allmulticast mode [ 36.613817][ T3732] vxcan1: entered allmulticast mode [ 36.635155][ T3732] veth0: entered allmulticast mode [ 36.662886][ T3732] veth1: entered allmulticast mode [ 36.716229][ T3732] wg0: entered allmulticast mode [ 36.836941][ T3732] wg1: entered allmulticast mode [ 36.854329][ T3732] wg2: entered allmulticast mode [ 36.870359][ T3732] veth0_to_bridge: entered allmulticast mode [ 36.879732][ T3732] veth1_to_bridge: entered allmulticast mode [ 36.890635][ T3732] veth0_to_bond: entered allmulticast mode [ 36.908361][ T3732] veth1_to_bond: entered allmulticast mode [ 36.916200][ T29] kauditd_printk_skb: 250 callbacks suppressed [ 36.916212][ T29] audit: type=1400 audit(1755375101.567:369): avc: denied { kexec_image_load } for pid=3746 comm="syz.3.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 36.946289][ T3732] veth0_to_team: entered allmulticast mode [ 36.955263][ T3732] veth1_to_team: entered allmulticast mode [ 36.964159][ T3732] veth0_to_batadv: entered allmulticast mode [ 36.973004][ T3732] batadv_slave_0: entered allmulticast mode [ 36.980766][ T3732] veth1_to_batadv: entered allmulticast mode [ 36.989827][ T3732] batadv_slave_1: entered allmulticast mode [ 37.015027][ T3732] xfrm0: entered allmulticast mode [ 37.021407][ T3732] veth0_to_hsr: entered allmulticast mode [ 37.034461][ T3732] hsr_slave_0: entered allmulticast mode [ 37.041297][ T3732] veth1_to_hsr: entered allmulticast mode [ 37.048206][ T3732] hsr_slave_1: entered allmulticast mode [ 37.055266][ T3732] veth1_virt_wifi: entered allmulticast mode [ 37.062540][ T3732] veth0_virt_wifi: entered allmulticast mode [ 37.070161][ T3732] veth1_vlan: entered allmulticast mode [ 37.077040][ T3732] veth0_vlan: entered allmulticast mode [ 37.086322][ T3732] vlan0: entered allmulticast mode [ 37.091571][ T3732] vlan1: entered allmulticast mode [ 37.097226][ T3732] macvlan0: entered allmulticast mode [ 37.104129][ T3732] macvlan1: entered allmulticast mode [ 37.110644][ T3732] ipvlan0: entered allmulticast mode [ 37.116200][ T3732] ipvlan1: entered allmulticast mode [ 37.122796][ T3732] veth1_macvtap: entered allmulticast mode [ 37.131427][ T3732] veth0_macvtap: entered allmulticast mode [ 37.139732][ T3732] macvtap0: entered allmulticast mode [ 37.146869][ T3732] macsec0: entered allmulticast mode [ 37.154254][ T3732] geneve0: entered allmulticast mode [ 37.161659][ T3732] geneve1: entered allmulticast mode [ 37.169003][ T3732] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 37.177768][ T3732] netdevsim netdevsim0 netdevsim1: entered allmulticast mode [ 37.186465][ T3732] netdevsim netdevsim0 netdevsim2: entered allmulticast mode [ 37.194873][ T3732] netdevsim netdevsim0 netdevsim3: entered allmulticast mode [ 37.213019][ T29] audit: type=1400 audit(1755375101.857:370): avc: denied { firmware_load } for pid=3741 comm="syz.2.92" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 37.271962][ T41] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.307610][ T41] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.326789][ T41] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.343909][ T41] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.380754][ T29] audit: type=1400 audit(1755375102.027:371): avc: denied { read } for pid=3756 comm="syz.4.98" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 37.435478][ T3742] syz.2.92 (3742) used greatest stack depth: 9440 bytes left [ 37.544722][ T3766] veth1_macvtap: left promiscuous mode [ 37.561353][ T3766] veth1_macvtap: entered promiscuous mode [ 37.576687][ T3766] macsec0: entered promiscuous mode [ 37.582020][ T3766] macsec0: entered allmulticast mode [ 37.587407][ T3766] veth1_macvtap: entered allmulticast mode [ 37.712178][ T29] audit: type=1400 audit(1755375102.357:372): avc: denied { write } for pid=3767 comm="syz.1.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 37.763452][ T29] audit: type=1326 audit(1755375102.387:373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3770 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b5ca7ebe9 code=0x7ffc0000 [ 37.787892][ T29] audit: type=1326 audit(1755375102.387:374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3770 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b5ca7ebe9 code=0x7ffc0000 [ 37.811890][ T29] audit: type=1326 audit(1755375102.387:375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3770 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5b5ca7ebe9 code=0x7ffc0000 [ 37.835387][ T29] audit: type=1326 audit(1755375102.387:376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3770 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b5ca7ebe9 code=0x7ffc0000 [ 37.858758][ T29] audit: type=1326 audit(1755375102.387:377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3770 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b5ca7ebe9 code=0x7ffc0000 [ 37.882875][ T29] audit: type=1326 audit(1755375102.387:378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3770 comm="syz.2.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7f5b5ca7ebe9 code=0x7ffc0000 [ 37.993140][ T3773] __nla_validate_parse: 10 callbacks suppressed [ 37.993157][ T3773] netlink: 8 bytes leftover after parsing attributes in process `syz.2.105'. [ 38.012025][ T3773] vlan2: entered allmulticast mode [ 38.068698][ T3777] netlink: 'syz.2.106': attribute type 298 has an invalid length. [ 38.398883][ T3793] team0 (unregistering): Port device team_slave_0 removed [ 38.410329][ T3793] team0 (unregistering): Port device team_slave_1 removed [ 38.424794][ T3797] loop0: detected capacity change from 0 to 512 [ 38.454252][ T3797] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.468840][ T3797] ext4 filesystem being mounted at /20/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 38.507894][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.592057][ T3810] loop0: detected capacity change from 0 to 128 [ 38.640113][ T3816] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 38.647100][ T3816] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 38.656131][ T3816] vhci_hcd vhci_hcd.0: Device attached [ 38.665920][ T3819] vhci_hcd: connection closed [ 38.666046][ T413] vhci_hcd: stop threads [ 38.676975][ T413] vhci_hcd: release socket [ 38.682142][ T413] vhci_hcd: disconnect device [ 39.409869][ T3836] loop1: detected capacity change from 0 to 4096 [ 39.430782][ T3836] EXT4-fs: Ignoring removed nomblk_io_submit option [ 39.453702][ T3836] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.554784][ T3840] bridge_slave_0: left allmulticast mode [ 39.560705][ T3840] bridge_slave_0: left promiscuous mode [ 39.566531][ T3840] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.576965][ T3840] bridge_slave_1: left allmulticast mode [ 39.582816][ T3840] bridge_slave_1: left promiscuous mode [ 39.588871][ T3840] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.599506][ T3840] bond0: (slave bond_slave_0): Releasing backup interface [ 39.622825][ T3840] bond0: (slave bond_slave_1): Releasing backup interface [ 39.647123][ T3840] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.654947][ T3840] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 39.675194][ T3840] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.683839][ T3840] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 40.091196][ T3850] netlink: 24 bytes leftover after parsing attributes in process `syz.3.130'. [ 40.108328][ T3850] sch_tbf: burst 88 is lower than device geneve0 mtu (1464) ! [ 40.303491][ T3300] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.431539][ T3858] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.477403][ T3862] @ÿ: renamed from bond_slave_0 [ 40.498978][ T3858] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.522828][ T3865] netlink: 12 bytes leftover after parsing attributes in process `syz.0.135'. [ 40.548026][ T3865] 8021q: adding VLAN 0 to HW filter on device bond1 [ 40.589063][ T3858] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.614939][ T3865] vlan2: entered allmulticast mode [ 40.620376][ T3865] bond1: entered allmulticast mode [ 40.656290][ T3858] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.737439][ T3875] netlink: 4 bytes leftover after parsing attributes in process `syz.0.138'. [ 40.757842][ T3875] netlink: 4 bytes leftover after parsing attributes in process `syz.0.138'. [ 40.783054][ T413] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.806842][ T413] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.833311][ T413] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.850730][ T413] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.924607][ T3881] ------------[ cut here ]------------ [ 40.930992][ T3881] verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0xfffffffefffff630, 0xffffffff00000000] s64=[0xfffffffefffff630, 0xffffffff00000000] u32=[0x30, 0x8000050] s32=[0x30, 0x0] var_off=(0xfffffffe00000030, 0x10fffffc0)(1) [ 40.957365][ T3881] WARNING: CPU: 0 PID: 3881 at kernel/bpf/verifier.c:2728 reg_bounds_sanity_check+0x673/0x680 [ 40.968638][ T3881] Modules linked in: [ 40.973105][ T3881] CPU: 0 UID: 0 PID: 3881 Comm: syz.3.140 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(voluntary) [ 40.986977][ T3881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 40.999568][ T3881] RIP: 0010:reg_bounds_sanity_check+0x673/0x680 [ 41.006133][ T3881] Code: 7c 24 18 41 ff 74 24 20 55 41 56 4d 89 ee 53 48 8b 5c 24 30 ff 74 24 40 ff 74 24 50 ff 74 24 30 e8 92 80 ba ff 48 83 c4 38 90 <0f> 0b 90 90 e9 02 fb ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 [ 41.030263][ T3881] RSP: 0018:ffffc9000155f440 EFLAGS: 00010292 [ 41.036887][ T3881] RAX: b1c0b4a6559a9a00 RBX: ffff888119abc1a8 RCX: 0000000000080000 [ 41.045958][ T3881] RDX: ffffc900034f5000 RSI: 000000000001345e RDI: 000000000001345f [ 41.054606][ T3881] RBP: fffffffe00000030 R08: 0001c9000155f27f R09: 0000000000000000 [ 41.063379][ T3881] R10: 00000000ffffffff R11: 0000000000000002 R12: ffff888119abc168 [ 41.071968][ T3881] R13: ffff88811b048000 R14: ffff88811b048000 R15: ffff888119abc1a0 [ 41.080389][ T3881] FS: 00007fe8458ff6c0(0000) GS:ffff8882aee44000(0000) knlGS:0000000000000000 [ 41.084551][ T3884] netlink: 4 bytes leftover after parsing attributes in process `syz.3.140'. [ 41.089469][ T3881] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.105384][ T3881] CR2: 0000000000000000 CR3: 0000000104b1c000 CR4: 00000000003506f0 [ 41.115067][ T3881] Call Trace: [ 41.118857][ T3881] [ 41.122584][ T3881] reg_set_min_max+0x215/0x260 [ 41.128539][ T3881] check_cond_jmp_op+0x1080/0x16e0 [ 41.135750][ T3881] do_check+0x332a/0x7a10 [ 41.140649][ T3881] do_check_common+0xc3a/0x12a0 [ 41.145601][ T3881] bpf_check+0x942b/0xd9e0 [ 41.150401][ T3881] ? __rcu_read_unlock+0x4f/0x70 [ 41.157472][ T3881] ? __alloc_frozen_pages_noprof+0x188/0x360 [ 41.165482][ T3881] ? alloc_pages_bulk_noprof+0x4b8/0x540 [ 41.172571][ T3881] ? __vmap_pages_range_noflush+0xbb3/0xbd0 [ 41.181153][ T3881] ? pcpu_block_update+0x24e/0x3b0 [ 41.186612][ T3881] ? _find_next_zero_bit+0x64/0xa0 [ 41.193149][ T3881] ? pcpu_block_refresh_hint+0x157/0x170 [ 41.199356][ T3881] ? pcpu_block_update_hint_alloc+0x63d/0x660 [ 41.207022][ T3881] ? css_rstat_updated+0xb7/0x240 [ 41.213966][ T3881] ? __rcu_read_unlock+0x4f/0x70 [ 41.220314][ T3881] ? pcpu_memcg_post_alloc_hook+0xf1/0x150 [ 41.228483][ T3881] ? should_fail_ex+0x30/0x280 [ 41.233427][ T3881] ? selinux_bpf_prog_load+0x36/0xf0 [ 41.240003][ T3881] ? should_failslab+0x8c/0xb0 [ 41.245497][ T3881] ? __kmalloc_cache_noprof+0x189/0x320 [ 41.252216][ T3881] ? selinux_bpf_prog_load+0xbf/0xf0 [ 41.258270][ T3881] ? security_bpf_prog_load+0x2c/0xa0 [ 41.264366][ T3881] bpf_prog_load+0xedd/0x1070 [ 41.270424][ T3881] ? security_bpf+0x2b/0x90 [ 41.276801][ T3881] __sys_bpf+0x462/0x7b0 [ 41.281934][ T3881] __x64_sys_bpf+0x41/0x50 [ 41.286712][ T3881] x64_sys_call+0x2aea/0x2ff0 [ 41.291662][ T3881] do_syscall_64+0xd2/0x200 [ 41.297041][ T3881] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 41.304724][ T3881] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 41.311363][ T3881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 41.317972][ T3881] RIP: 0033:0x7fe846e9ebe9 [ 41.322724][ T3881] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 41.345630][ T3881] RSP: 002b:00007fe8458ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 41.355035][ T3881] RAX: ffffffffffffffda RBX: 00007fe8470c5fa0 RCX: 00007fe846e9ebe9 [ 41.364029][ T3881] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 41.372936][ T3881] RBP: 00007fe846f21e19 R08: 0000000000000000 R09: 0000000000000000 [ 41.382695][ T3881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.391005][ T3881] R13: 00007fe8470c6038 R14: 00007fe8470c5fa0 R15: 00007fffdce5f8c8 [ 41.399452][ T3881] [ 41.402671][ T3881] ---[ end trace 0000000000000000 ]--- [ 41.541536][ T3893] loop2: detected capacity change from 0 to 8192 [ 41.929129][ T29] kauditd_printk_skb: 227 callbacks suppressed [ 41.929142][ T29] audit: type=1326 audit(1755375106.577:606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.1.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7f841136ebe9 code=0x7ffc0000 [ 42.083292][ T29] audit: type=1326 audit(1755375106.617:607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.1.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7f841136ebe9 code=0x7ffc0000 [ 42.109513][ T29] audit: type=1326 audit(1755375106.627:608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.1.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7f841136ebe9 code=0x7ffc0000 [ 42.141855][ T29] audit: type=1326 audit(1755375106.637:609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.1.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7f841136ebe9 code=0x7ffc0000 [ 42.172792][ T29] audit: type=1326 audit(1755375106.647:610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.1.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7f841136ebe9 code=0x7ffc0000 [ 42.207667][ T29] audit: type=1326 audit(1755375106.657:611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.1.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7f841136ebe9 code=0x7ffc0000 [ 42.236021][ T29] audit: type=1326 audit(1755375106.697:612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.1.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7f841136ebe9 code=0x7ffc0000 [ 42.265420][ T29] audit: type=1326 audit(1755375106.707:613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.1.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7f841136ebe9 code=0x7ffc0000 [ 42.293200][ T29] audit: type=1326 audit(1755375106.717:614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.1.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7f841136ebe9 code=0x7ffc0000 [ 42.319428][ T29] audit: type=1326 audit(1755375106.727:615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3889 comm="syz.1.143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7f841136ebe9 code=0x7ffc0000 [ 42.680344][ T3917] infiniband syz!: set down [ 42.685716][ T3917] infiniband syz!: added team_slave_0 [ 42.709217][ T3917] RDS/IB: syz!: added [ 42.735803][ T3923] netlink: 'syz.0.155': attribute type 4 has an invalid length. [ 42.750140][ T3917] smc: adding ib device syz! with port count 1 [ 42.788538][ T3917] smc: ib device syz! port 1 has pnetid [ 42.874456][ T3927] bond0: (slave dummy0): Releasing backup interface [ 42.891281][ T3927] bridge_slave_0: left promiscuous mode [ 42.898123][ T3927] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.910361][ T3927] bridge_slave_1: left promiscuous mode [ 42.916798][ T3927] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.928853][ T3927] bond0: (slave 5@ÿ): Releasing backup interface [ 42.932413][ T3935] syz.4.159 uses obsolete (PF_INET,SOCK_PACKET) [ 42.947906][ T3927] bond0: (slave bond_slave_1): Releasing backup interface [ 42.957660][ T3927] team0: Port device team_slave_0 removed [ 42.965975][ T3927] team0: Port device team_slave_1 removed [ 42.983643][ T3937] @ÿ: renamed from bond_slave_0 (while UP) [ 43.063193][ T3946] netlink: zone id is out of range [ 43.075914][ T3948] wireguard0: entered promiscuous mode [ 43.076596][ T3946] netlink: zone id is out of range [ 43.082414][ T3948] wireguard0: entered allmulticast mode [ 43.089517][ T3946] netlink: zone id is out of range [ 43.101109][ T3946] netlink: zone id is out of range [ 43.107579][ T3946] netlink: zone id is out of range [ 43.113343][ T3946] netlink: zone id is out of range [ 43.118756][ T3946] netlink: zone id is out of range [ 43.125386][ T3946] netlink: zone id is out of range [ 43.133665][ T3946] netlink: zone id is out of range [ 43.140920][ T3946] netlink: zone id is out of range [ 43.240998][ T3958] loop2: detected capacity change from 0 to 512 [ 43.250520][ T3958] EXT4-fs: Ignoring removed nomblk_io_submit option [ 43.258101][ T3958] EXT4-fs: Ignoring removed nomblk_io_submit option [ 43.267451][ T3958] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 43.295923][ T3958] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2 [ 43.309507][ T3958] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -2 [ 43.322334][ T3958] EXT4-fs (loop2): 1 truncate cleaned up [ 43.330996][ T3958] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.331873][ T3968] @ÿ: renamed from bond_slave_0 (while UP) [ 43.357076][ T3966] netlink: 24 bytes leftover after parsing attributes in process `syz.1.172'. [ 43.430865][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.448805][ T2992] ================================================================== [ 43.457550][ T2992] BUG: KCSAN: data-race in dont_mount / step_into [ 43.465093][ T2992] [ 43.468207][ T2992] read-write to 0xffff8881058ec6c0 of 4 bytes by task 3287 on cpu 0: [ 43.479223][ T2992] dont_mount+0x2a/0x40 [ 43.487042][ T2992] vfs_unlink+0x28f/0x420 [ 43.493288][ T2992] do_unlinkat+0x24e/0x480 [ 43.499404][ T2992] __x64_sys_unlink+0x2e/0x40 [ 43.504783][ T2992] x64_sys_call+0x2dc0/0x2ff0 [ 43.510168][ T2992] do_syscall_64+0xd2/0x200 [ 43.514955][ T2992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 43.522263][ T2992] [ 43.525086][ T2992] read to 0xffff8881058ec6c0 of 4 bytes by task 2992 on cpu 1: [ 43.533263][ T2992] step_into+0xe3/0x820 [ 43.537792][ T2992] walk_component+0x162/0x220 [ 43.543525][ T2992] path_lookupat+0xfe/0x2a0 [ 43.548440][ T2992] filename_lookup+0x147/0x340 [ 43.554993][ T2992] do_readlinkat+0x7d/0x320 [ 43.561192][ T2992] __x64_sys_readlink+0x47/0x60 [ 43.567144][ T2992] x64_sys_call+0x28da/0x2ff0 [ 43.572241][ T2992] do_syscall_64+0xd2/0x200 [ 43.577290][ T2992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 43.584953][ T2992] [ 43.588462][ T2992] value changed: 0x00300080 -> 0x00004080 [ 43.595240][ T2992] [ 43.597739][ T2992] Reported by Kernel Concurrency Sanitizer on: [ 43.605058][ T2992] CPU: 1 UID: 0 PID: 2992 Comm: udevd Tainted: G W 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(voluntary) [ 43.622909][ T2992] Tainted: [W]=WARN [ 43.627177][ T2992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 43.639001][ T2992] ================================================================== [ 43.650271][ T3966] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 43.662774][ T3976] GUP no longer grows the stack in syz.2.176 (3976): 200000004000-200000008000 (200000002000) [ 43.674311][ T3976] CPU: 0 UID: 0 PID: 3976 Comm: syz.2.176 Tainted: G W 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(voluntary) [ 43.674413][ T3976] Tainted: [W]=WARN [ 43.674419][ T3976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 43.674429][ T3976] Call Trace: [ 43.674455][ T3976] [ 43.674462][ T3976] __dump_stack+0x1d/0x30 [ 43.674486][ T3976] dump_stack_lvl+0xe8/0x140 [ 43.674503][ T3976] dump_stack+0x15/0x1b [ 43.674609][ T3976] __get_user_pages+0x198d/0x1fa0 [ 43.674639][ T3976] ? __rcu_read_unlock+0x4f/0x70 [ 43.674740][ T3976] get_user_pages_remote+0x1d5/0x6d0 [ 43.674830][ T3976] __access_remote_vm+0x15c/0x590 [ 43.674861][ T3976] access_remote_vm+0x32/0x40 [ 43.674939][ T3976] proc_pid_cmdline_read+0x32b/0x6c0 [ 43.674963][ T3976] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 43.675052][ T3976] vfs_readv+0x3f8/0x690 [ 43.675158][ T3976] __x64_sys_preadv+0xfd/0x1c0 [ 43.675185][ T3976] x64_sys_call+0x282a/0x2ff0 [ 43.675210][ T3976] do_syscall_64+0xd2/0x200 [ 43.675237][ T3976] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 43.675260][ T3976] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 43.675293][ T3976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 43.675311][ T3976] RIP: 0033:0x7f5b5ca7ebe9 [ 43.675326][ T3976] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 43.675343][ T3976] RSP: 002b:00007f5b5b4e7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 43.675459][ T3976] RAX: ffffffffffffffda RBX: 00007f5b5cca5fa0 RCX: 00007f5b5ca7ebe9 [ 43.675534][ T3976] RDX: 0000000000000001 RSI: 0000200000000d00 RDI: 0000000000000006 [ 43.675551][ T3976] RBP: 00007f5b5cb01e19 R08: 0000000000000200 R09: 0000000000000000 [ 43.675564][ T3976] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 43.675619][ T3976] R13: 00007f5b5cca6038 R14: 00007f5b5cca5fa0 R15: 00007ffc41b5cf08 [ 43.675638][ T3976] [ 43.676977][ T3972] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.066104][ T3972] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.106115][ T3972] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.157190][ T3972] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.210149][ T145] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.226033][ T145] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.242349][ T413] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.251285][ T413] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0