last executing test programs: 5.208961364s ago: executing program 3 (id=131): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095", @ANYBLOB="4468760925d682ec15ef0a9eb12a9cb4aa8c600b00237280df8da0b29f6fac27b8081e52ef2ccd357b4b19adcdcd9ea15e6393f350a3f46889fe64b9fcc16d12d5a8db4f91f7188cd98498207674641b50b07aa49b9ef4f36bc50504aaa812d56e0fdd55be084f5053c6024dcaba6958920fe31d", @ANYRES64=r0, @ANYRES8=0x0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200000008000300ac1414aa0800060001"], 0x38}, 0x1, 0x0, 0x0, 0x4000011}, 0x4c080) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="010028bd7000fcdbdf2504"], 0x14}}, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000006c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x30, r4, 0x2d686096a521edef, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x1c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x4090) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000180), 0x401, 0x0) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000a40)={&(0x7f0000000980)='sys_enter\x00', r1}, 0x10) r6 = syz_clone(0x5028a80, 0x0, 0x12, 0x0, 0x0, 0x0) r7 = syz_pidfd_open(r6, 0x0) pidfd_send_signal(r7, 0x29, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5, {0x7}}, './file0\x00'}) getsockopt$inet_pktinfo(r8, 0x0, 0x8, &(0x7f0000000380)={0x0, @multicast2, @initdev}, &(0x7f00000003c0)=0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x9, &(0x7f00000001c0)=@raw=[@map_idx_val={0x18, 0x8, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0x1000}, @alu={0x7, 0x1, 0x5, 0x1, 0xa, 0xffffffffffffffe8, 0x8}, @tail_call={{0x18, 0x2, 0x1, 0x0, r8}}, @alu={0x7, 0x1, 0x7, 0x9, 0x5, 0xffffffffffffffb4}], &(0x7f0000000280)='GPL\x00', 0x2, 0x95, &(0x7f00000002c0)=""/149, 0x41000, 0x24, '\x00', r9, 0x0, r8, 0x8, &(0x7f0000000400)={0x6, 0x1}, 0x8, 0x10, &(0x7f0000000440)={0x4, 0x6, 0x7, 0x3}, 0x10}, 0x94) read$watch_queue(r8, &(0x7f0000000140)=""/62, 0x3e) 5.103784049s ago: executing program 3 (id=133): bpf$MAP_CREATE(0x0, 0x0, 0x48) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) creat(0x0, 0x0) syz_io_uring_setup(0x298b, &(0x7f0000000300)={0x0, 0x0, 0x10100, 0x2}, &(0x7f0000000100), 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b000000000000"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) rseq(&(0x7f0000000680), 0x20, 0x0, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0) r1 = socket(0x10, 0x3, 0x0) getpeername$tipc(r1, &(0x7f0000000240)=@id, &(0x7f0000000000)=0xfffffffffffffe37) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02159f02c26ed638eeb738256e06a40e07fff0797e", 0x140) io_setup(0x20, &(0x7f0000001140)=0x0) io_submit(r3, 0x1, &(0x7f0000000480)=[&(0x7f0000000d80)={0xf, 0x400000000000, 0x0, 0x3, 0x0, r0, 0x0}]) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000080)={0x0, 0x5, 0x0, 'queue1\x00'}) writev(r4, &(0x7f0000000580)=[{&(0x7f0000000000)="228292", 0xfff6}], 0x2) r5 = syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r5) waitid(0x0, 0x0, 0x0, 0xe, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="060000000400000099000000"], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x0, &(0x7f0000000040)}) syz_mount_image$msdos(&(0x7f0000000200), &(0x7f0000000000)='./file2\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='nodots,dmask=00000000000000000000003,usefree,nodots,flush,dots,dots,gid=', @ANYRESHEX=0x0, @ANYBLOB], 0x1, 0x214, &(0x7f0000000840)="$eJzs3D1rW1cYB/AjWa6tlhZPhXbpoV3a5bb10qVDS3GhVNCSRCEv0zWWEyFFAl8NksmgOVM+RwhkCWQL+QL+DFmymYDx5Ck3OJKs2NixE0dy4vx+ix6e/z1X5+jARVy9bP5+91ZjNUtW004ozRdC8Y/QDzuFsBCKYaQffnpwZfvOxavX/v2zUlm6MDvsx/jVd4+v377//ZPOF5cf7nYKIYStxWcbX298s/ni0s16FutZbLU7MY3L7XYnXW7W4ko9ayQx/t+spVkt1ltZbW1fvtpsj5861LIspq1ebNR6sdOOnbVeTG+k9VZMkiTOB06lem8nz8NWnuf5XD/kef62JyhMZl5Myyn3n4/c3kU97l5Nn/e71W518DjI//6nsvRLfGVhPGq7263O7OW/DvK4P58Nnw/zxUPzz8KPPwzy3eyv/yoH8nJYmfzyAQAAAADgXErinkPv7yfJUfmgeu3zgQP370vh29K4MzP5pQAAAABHyHrrjbS5Mrs2KJq1Myvmwv7Ob4+GUzxu+M9Pjz9mQsWXwyK843nKIYSjjymGM9+U6RSj75EPO6PfF5xseOl9TaP8gbwao2I+HBaVw3pjbjqbAgAAnC/jN/0nHlKc6IQAAAAAAAAAAAAAAAAAAADgEzSNPzM76zUCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALzJywAAAP//ixdW4w==") r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f00000004c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) pipe2$9p(&(0x7f0000000140), 0x1000) write$P9_RSETATTR(r6, &(0x7f00000001c0)={0x7, 0x1b, 0x2}, 0x7) 4.484270985s ago: executing program 3 (id=150): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r3, 0x0, 0x10003, 0x0) readv(r2, &(0x7f0000000140)=[{&(0x7f0000000800)=""/4096, 0x1000}], 0x1) (fail_nth: 2) write$binfmt_elf64(r1, &(0x7f00000001c0)=ANY=[], 0x10034) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = openat(0xffffffffffffffff, 0x0, 0x0, 0xc4) lseek(r6, 0x40000003, 0x1) getdents64(r6, 0x0, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000280)='ns\x00') fchdir(r5) readlinkat(r7, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000002780)=""/4112, 0x1010) openat$cgroup_int(r3, &(0x7f0000000080)='io.weight\x00', 0x2, 0x0) r8 = inotify_init1(0x80800) inotify_add_watch(r8, &(0x7f0000000340)='./cgroup\x00', 0x2000498) r9 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYRES32=r9, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2e, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.156273293s ago: executing program 3 (id=153): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000400000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) open_tree(0xffffffffffffffff, 0x0, 0x1100) (fail_nth: 4) 2.804694248s ago: executing program 3 (id=160): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3}, 0x18) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e2e"], 0x0, 0x35, 0x0, 0x1}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000eb0626f500000000000800000095"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x2, 0x2, 0x4, 0x9}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="440000001000371f68000000ffffffff00000000", @ANYRES32=r5, @ANYBLOB="0b12050000000000240012800b00010069703667726500001400028008000100", @ANYRES32=r5], 0x44}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="070000000400000008000000d9"], 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000940)={0x0, r6}, 0x8) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r8}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r9}, 0x18) r10 = syz_clone(0x4000000, &(0x7f00000007c0)="2c9b5227bd59cb26ea040a8cf97ae9bab60a933d3f7e92b2b0bb3532bf0f548340462190d2d55532a87c097f84b20bb3c2e748a4cd07b62a61fc429efe3c13d9f0b375b97ddfa89f52a4079dbbe4b25b6545d9c8d1c3d9c27fe2055155e6485917ba43df825badfd4b5f6f01998581429ac2e943e0ed540f2f9b4aace0970289d66ce085dc9a810dcd111010eb3b3f044c520cc09793944dbfd2638354702dae408f72a7014d679164e498864963", 0xae, &(0x7f0000000180), &(0x7f0000000280), &(0x7f0000000880)="615917a305c5de2855a5fc49ba51585ac02ff8217e6d3328152def91a88016f834b60ede4754e51336b4e5c030d74651ba80b9d35e3166f81eaece6bf3fd140015cfe1f28625effbb268ff435b903c406cfc6a50b8d3260f9d4e6190a4053fb4601e774292efe28312131d69115304890e18e7efc965f05efe2a7976e03f9c4cc5") sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x24, 0x39, 0x9, 0x70bd2c, 0x0, {0x4}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @pid=r10}]}]}, 0x24}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r6], 0x0, 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r11}, 0x10) sendmmsg$inet(r1, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @empty, @multicast1}}}], 0x20}}], 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000400)='sys_enter\x00', r0}, 0x18) syz_clone3(&(0x7f0000000080)={0x801400, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) pipe2$9p(&(0x7f0000000640), 0x880) rename(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='./file0\x00') pidfd_getfd(r12, r12, 0x0) 2.576312818s ago: executing program 3 (id=166): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = pidfd_getfd(r1, r1, 0x0) setns(r2, 0x66020000) syz_clone(0x498144ee5f62e149, 0x0, 0x17, 0x0, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)='usrquota') bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x31, 0x8000) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$PPPIOCSMAXCID(0xffffffffffffffff, 0x40047451, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f"], 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f0000000040)=[{&(0x7f0000000180)="290018002000190f00003fffffffda0602000000ffe80001dd0000040d001800ea11c21d0005000000", 0x29}], 0x1) 2.089685619s ago: executing program 4 (id=170): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x5c}}, 0x20050800) 2.045195981s ago: executing program 4 (id=171): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e0001821501f63ed02a170000000000000000000000000a"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000014"], 0xb8}}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000feffff950000000000000032590f8d7783ac04d2efb4b27dac1465ad32f624"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000080)='rxrpc_propose_ack\x00', r1}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) pipe(&(0x7f0000000200)) r2 = msgget$private(0x0, 0x480) msgctl$IPC_RMID(r2, 0x0) 1.920296967s ago: executing program 4 (id=172): bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000020001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = msgget$private(0x0, 0x1f3) msgrcv(r2, 0x0, 0x0, 0x3, 0x2000) msgsnd(r2, &(0x7f00000008c0)=ANY=[@ANYBLOB="ba"], 0x8, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)={0x1c, 0x0, 0x0, 0x0, 0x25dfdbfb}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 1.597640041s ago: executing program 4 (id=176): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @multicast1}, @time_exceeded={0x80, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @loopback}}}}}}, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x0, &(0x7f0000000700)={[{@init_itable_val={'init_itable', 0x3d, 0x1}}, {@errors_remount}, {@abort}, {@errors_continue}, {@quota}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000}}]}, 0x1, 0x783, &(0x7f0000001340)="$eJzs3M9rXOUaAOD3nGaa/si9kwt3ce+mCi20UDpJmk27Mm7ETaFQcFtDMgkhJ5mSmdQkFpq6E4TabFQE0b1Lt0Kpf4A7KSi4F0RrXKibkTOZTNt0Zjptk04bnwdO5vvOfN9533dm8uUcyJkA/rFezX8kEUMRcTEiis39aUQcbLQORaxvjdu8d20q35Ko1y/9kuTTYrNebB0raT4ejcaU+F9E3ClEnH7v0bjV1bX5ySwrLzX7I7WFKyPV1bUzcwuTs+XZ8uLY+PnRc+Pj50bHd63WE2+dP3zr2zc2Nr77qnbz2MCZJCYadUeztl0L9ICt16QQEzv2L+5FsD5Kehgz8BzyAACgu/w8/0Dz3KwQxTjQ7SzNCRwAAAC8lOqD9V792fNIAAAA4AWTRL8zAAAAAPbW9v8BbN/bu1f3wXby8+sRMdwu/kDjHuKIQ1GIiCObyUO3HyRb0+CZrN+IiNsTbT5/vdzR3N3o/ebh3Tkiu+12vv5MtFt/0tb6E23Wn4Ht7054Rp3Xv/vxD3RY/y72GOPrz/5f6Bj/RnXl/WPt4iet+EmH+G/3GP/mxge3Oj1X/yLiZNu/P8lDsbp8P8TIzFzW7lerle6dv07d7Vx/xJFH4idJI2rSvf4rPdb/7uZv8+td4p863v3934o/+NC8/DPxYTOPNCJuNR/z/saOGMcXvv/m0cjJ+nb86Q6vf/v3/81W/Z/3WP+PXw6u9DgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGtKIGIokLbXaaVoqRRyNiP/GkTSrVGunZyrLi9P5cxHDUUhn5rLyaEQUt/pJ3h9rtO/3z+7oj0fEf344vBV0LiuXpirZdL+LBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoOVoRAxFkpYiIo2I34tpWir1OysAAABg1w33OwEAAABgz7n+BwAAgP3vaa//k13OAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjXLl64kG/1zXvXpvL+9NXV5fnK1TPT5ep8aWF5qjRVWbpSmq1UZrNyaaqy8LjjpRExdj6WV0Zq5WptpLq6dnmhsrxYuzy3MDlbvlwuPJeqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFJDjS1JSxGRNtppWipF/CsihqOQzMxl5dGI+HdE3C0WBvP+WL+TBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYNdVV9fmJ7OsvPRyN+r7q5yeG5FEvABpdGh80nxXuo1J1iP6nmraTPRZjhPxJLOuP+Zl6XfjlT6tRwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9Fd1dW1+MsvKS9V+ZwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEB/pT8lEZFvJ4snhnY+ezD5o9h4jIh3Pr300cpkrbY0lu//tbW/9nFz/9kHJl5/njUAAADAvvfakwzevk7fvo4HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADoVXV1bX4yy8pLe9iIG/2uEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeBp/BwAA//9Js7nR") r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) write$P9_RREADLINK(r3, &(0x7f0000000000)={0xffffffffffffff23, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) fadvise64(r3, 0x7f, 0x0, 0x4) 1.416311438s ago: executing program 0 (id=177): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001400001cb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x80) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xe}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}}, 0x24048010) 1.316620813s ago: executing program 0 (id=179): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000043c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x49, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x18) socket$kcm(0xa, 0x3, 0x87) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000030400000000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="20000000100000001c001280090001006970697027d6fc6015b652eea28f3b"], 0x3c}}, 0x20000000) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 1.306274523s ago: executing program 4 (id=180): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000100000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x6c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='kfree\x00', r1}, 0x10) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x800448d2, &(0x7f0000000040)) 1.292188484s ago: executing program 1 (id=181): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x5c}}, 0x20050800) 1.286854554s ago: executing program 2 (id=182): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000100000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x6c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='kfree\x00', r1}, 0x10) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x800448d2, &(0x7f0000000040)) 1.241594666s ago: executing program 2 (id=183): socket$nl_route(0x10, 0x3, 0x0) socket$rxrpc(0x21, 0x2, 0xa) r0 = syz_io_uring_setup(0x49b, &(0x7f0000000300)={0x0, 0xf079, 0x0, 0x3, 0x28b}, &(0x7f0000000480)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffe, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r0, 0x3516, 0xea, 0x0, 0x0, 0x0) 1.228173517s ago: executing program 1 (id=184): getpid() openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = memfd_create(&(0x7f0000000b40)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xae>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\xb7\xbe`\'\xcb\xb6\xaf\xdc\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xf8\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\xb0\xc0:\x8f|\x8f\x06\xf8T\x826`M\x11\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\"\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b1\x9c\t\xa7\x80\x1b:\xbb\x04\xd7\xd1\x06\xa0\xe9\xbah\xb6\xb2\xea/{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DY\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~\xc1\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9d\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96cu\x97\xe7\xc7a\tm\xe8F\xc7j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xdfx\x1cPl\t#\xc1\x8e\xddW\x00'/668, 0x6) ioctl$FS_IOC_RESVSP(r2, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r3}, 0x10) execve(0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001240)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 1.198215818s ago: executing program 0 (id=185): epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r4}, 0x10) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0}, 0x18) perf_event_open(&(0x7f0000000800)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x10a010, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_clone(0x4021400, 0x0, 0x9000, 0x0, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r5}, 0x10) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r6], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_clone(0x11, 0x0, 0x10100, 0x0, 0x0, 0x0) r7 = fsopen(0x0, 0x1) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) 1.139153741s ago: executing program 2 (id=186): bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000020001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = msgget$private(0x0, 0x1f3) msgrcv(r2, 0x0, 0x0, 0x3, 0x2000) msgsnd(r2, &(0x7f00000008c0)=ANY=[@ANYBLOB="ba"], 0x8, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)={0x1c, 0x0, 0x0, 0x0, 0x25dfdbfb}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 1.1386939s ago: executing program 4 (id=187): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x9, 0x690bb, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x9, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket(0x10, 0x3, 0x0) socket$packet(0x11, 0xa, 0x300) socket$packet(0x11, 0xa, 0x300) socket$packet(0x11, 0x3, 0x300) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000410"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000000)='kmem_cache_free\x00', r3}, 0x18) r4 = socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r2}, 0x4) bind$inet(r4, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket(0x11, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0x2e, &(0x7f0000000040)=0x3, 0x4) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000080)={0xa0179e08}) r7 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r7, &(0x7f0000000880)={&(0x7f0000000000)={0xa, 0x4e20, 0x2, @remote, 0x9}, 0x1c, &(0x7f0000000100)=[{&(0x7f00000001c0)="8000e8beec9dbc13", 0x8}], 0x1, &(0x7f00000004c0)=ANY=[@ANYBLOB='(\x00\x00Q'], 0x28}, 0x4004000) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='tlb_flush\x00', r8}, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) r9 = io_uring_setup(0xc01, &(0x7f0000000000)={0x0, 0x2003, 0x40, 0x2, 0x276}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r9, 0xb, &(0x7f0000000380)=[@ioring_restriction_register_op={0x0, 0x19}], 0x1) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r9, 0xc, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILE_ALLOC_RANGE(r9, 0x19, &(0x7f0000000080)={0xd340, 0xaca3, 0x4}, 0x0) 1.012625286s ago: executing program 2 (id=188): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000240)='kfree\x00', r1, 0x0, 0x4ab}, 0x18) syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000480)='./bus\x00', 0x21081e, &(0x7f00000004c0)={[], [{@fowner_lt}, {@fowner_lt}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@smackfsdef={'smackfsdef', 0x3d, 'quota'}}]}, 0x0, 0x528, &(0x7f0000000f00)="$eJzs3c9vHFcdAPDvTLy2k7h1WnoABG1oCwFFWcebNkI9QDkhhCoQPYJIjb2xLO96Le+61CYSzpkrEpE4wZE/gHNP3LkguHEpB6QCFqhG4jBoZsfOxt71jyb2Wt7PRxrNe/PG+30vzrw383a9L4CRdT0itiJiPCLei4jp8nhSbvF2d8vP+2T7wfzO9oP5JLLs3X8mRXl+LHp+Jne1fM3JiPjBtyN+khyM297YXJ5rNOprZX6m01ydaW9s3lpqzi3WF+srtdrd2bu3v37nzdoJWjN5aOkrzfEy9cWP/rj1tZ/l1Zoqj/S241nqNr2yFyc3FhHfPY1gQ3CpbM/4sCvCp5JGxIsR8Wpx/U/HpeK3CQBcZFk2Hdl0b/4EkpOdDgCcD2kxB5ak1XIuYCrStFrtzuG9FFfSRqvduXm/tb6y0J0ruxaV9P5So367nCu8FpUkz88W6cf52r78nYh4ISJ+OXG5yFfnW42FYd74AMAIu7pv/P/PRHf8BwAuuMM/NgMAXETGfwAYPcZ/ABg9xn8AGD3d8f/ySX8sy7Kfn0Z1AIAz4PkfAEaP8R8ARsr333kn37Kd8vuvF97fWF9uvX9rod5erjbX56vzrbXV6mKrtVh8Z0/zqNdrtFqrs2/E+gfXvrHa7sy0NzbvNVvrK517xfd636tXirO2zqBlAMAgL7zy4V+SfER+63KxRc9aDpWh1gw4bemwKwAMzaVhVwAYGqt9weh6/Ix/4g8BmB6Ai+FRnyV6nzDZ7w+EsizLTq9OwCm78Tnz/zCqeub/fQoYRsxR8//F2sDeJIQLyfw/jK4TLOIfVvsHgIvhkDn+a2d5HwIMz4D3/18s978r3xz40cL+Mx6dZq0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgfNtd/7daLvM7FWlarUY8VywAVEnuLzXqtyPi+Yj480RlIs/PDrnOAMDTSv+elOt/3Zh+feqJopev7iXHI+Knv373Vx/MdTprf4oYT/41sXu886g8Xjsy2ORptAAAONzuOF3sex7kP9l+ML+7nWV9Pv5W964gj7uzPR47e/HHYqzYT0YlIq78OynzXUnP3MXT2HoYEZ/t1/4kpoo5kO4ty/74eeznzjR++kT8tFygOS3/LT7zDOoCo+bDvP95u9/1l8b1Yt//+p8seqinV/Z/+UvN7xR94OP4u/3fpQH93/XjxnjjD9/ppi4fLHsY8fmxiN3YOz39z278ZED8148Z/69fePnVQWXZbyJuRP/4vbFmOs3VmfbG5q2l5txifbG+Uqvdnb2bxp03azPFHPXM4NHgH2/dfH5Q2ccPvzd2ZUD8ySPa/+Vjtv+3/3vvh18aGD/iq6/1i5/GS4fEz8fErxwz/tyV3w987s7jLxxsf3Kc3//NY8b/6G+bB5YNBwCGp72xuTzXaNTXJEY08eM4F9U4XiL/L3sOqtE38c2zijUe/Yt+8Vr3mt5XlGWfKtagHuNZzLoB58HeRR8R/x12ZQAAAAAAAAAAAAAAgL7O4i+Wht1GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALq7/BwAA///fVNHL") 694.97326ms ago: executing program 0 (id=189): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0xf, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000180)='kfree\x00', r1}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={0xffffffffffffffff, 0x0, 0x44, 0x0, &(0x7f0000000080)="f6f4e9a10000502468da5eb1c6b2feff8833c0000000000000c548dc7914cb11ad63bf3707164aac031971c4be105eb953f86fbc6b204e076aa7a493e796123bbbd8e3b7e62d8fd097cf21d6d431a069ebc0aefd5fce80cc99fb38c771fa46e2c32a95fe99", 0x0, 0x86, 0x0, 0xffffffffffffff80, 0x0, &(0x7f0000000000)="daf9e846ab156efc71b59652333536dbfd26a6d0546366e36eb77dd0aaa2dbe567d168904cf0d5bce1771889c98ffc0abf", 0x0}, 0x15) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='team_slave_1\x00', 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) getuid() r3 = syz_clone(0x0, 0x0, 0x9, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x40000000, 0x0) ptrace(0x10, r3) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000180)={0x0, 0x1, 0x86, 0x80000000}) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0xfffc, 0x2fd, 0x1, 0x101}}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x22020600) getsockopt$inet6_buf(r5, 0x29, 0x6, 0x0, &(0x7f00000005c0)) syslog(0x2, &(0x7f0000000040)=""/5, 0x5) setxattr$trusted_overlay_origin(0x0, &(0x7f0000000140), &(0x7f00000001c0), 0x2, 0x2) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000e7ffff1f00000000000000000000000000000079f88eef5f67d1186f8d80fddfeba27c4c75005c2d833cc6e74a83ee219d1698dae9a0f5cb0a389f8d951f60a31680d1745b63e9ec1756243ba0cf6e2ecee816fc83334986ec7f5c8100a4075ed2aa5e429fa42c846d2e0c630e27bb10001f915dde0e6e63ebed00000000"], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0xfffffffffffffe3b, 0x0, 0x40f00, 0x50, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='spmi_read_begin\x00', r6, 0x0, 0xfffffffffffff70e}, 0x18) 616.482293ms ago: executing program 1 (id=190): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001400001cb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x80) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0xe}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}}, 0x24048010) 606.995584ms ago: executing program 2 (id=191): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, &(0x7f0000000040)=""/155, 0x1000000, 0x9b, 0x1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x19, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1a"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) syz_clone(0x40042700, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000a40)={0x24, r0, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@NL802154_ATTR_NETNS_FD={0x8}, @NL802154_ATTR_WPAN_PHY={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)=@bridge_getvlan={0x58, 0x72, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x40c0}, 0x1000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYRESOCT=0x0], 0x4c}}, 0x200040c0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000500)=ANY=[@ANYRES64=r5, @ANYRES64=r5, @ANYRES64=0x0], 0xa4}, 0x1, 0x0, 0x0, 0x4994}, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000100)='attr\x00') getdents(r6, 0x0, 0x0) r7 = socket(0x2c, 0x3, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r8, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r7}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1900000004000000050200001e00000000000000", @ANYRES32, @ANYBLOB="050000000000800000ffffffff00800000000100", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r8, &(0x7f0000000200), &(0x7f0000001500)=@tcp=r7}, 0x20) setsockopt$bt_l2cap_L2CAP_LM(r7, 0x6, 0x3, &(0x7f0000000140)=0x12, 0x4) close(r7) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0x2) ioctl$AUTOFS_DEV_IOCTL_READY(r6, 0xc0189376, &(0x7f0000000540)={{0x1, 0x1, 0x18, r9, {0xc2b6}}, '.\x00'}) ioctl$sock_inet_tcp_SIOCOUTQ(r10, 0x5411, &(0x7f0000000580)) 454.79472ms ago: executing program 1 (id=192): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x18, 0x7, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000e50003000000000085100000fcffffff250000001000000006000000faffffff95"], &(0x7f0000000140)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000}, 0x94) (fail_nth: 7) 40.278508ms ago: executing program 1 (id=193): r0 = perf_event_open(&(0x7f00000004c0)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2, 0x0, 0x7fff}, 0x18) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300030d0000002cbd7000fbdbdf2503000900800000001cdc0dca1d9f68846960e56de43944af030006000000000002004e22ac1414bb000100000000000002000100000000000000070c01000000030005000000000002004e21ac1e01010000000000000000"], 0x68}, 0x1, 0x7}, 0x0) 39.816738ms ago: executing program 2 (id=194): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000016000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1, 0x0, 0x7fff}, 0x18) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300030d0000002cbd7000fbdbdf2503000900800000001cdc0dca1d9f68846960e56de43944af030006000000000002004e22ac1414bb000100000000000002000100000000000000070c01000000030005000000000002004e21ac1e01010000000000000000"], 0x68}, 0x1, 0x7}, 0x0) 35.925608ms ago: executing program 0 (id=195): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x5c}}, 0x20050800) 12.54816ms ago: executing program 0 (id=196): bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x68, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xb0}}, 0x20050800) 0s ago: executing program 1 (id=197): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000100000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x6c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='kfree\x00', r1}, 0x10) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x800448d2, &(0x7f0000000040)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.114' (ED25519) to the list of known hosts. [ 24.867142][ T29] audit: type=1400 audit(1764192577.943:62): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.890147][ T29] audit: type=1400 audit(1764192577.963:63): avc: denied { mount } for pid=3303 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.891007][ T3303] cgroup: Unknown subsys name 'net' [ 24.917754][ T29] audit: type=1400 audit(1764192577.993:64): avc: denied { unmount } for pid=3303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.031177][ T3303] cgroup: Unknown subsys name 'cpuset' [ 25.037309][ T3303] cgroup: Unknown subsys name 'rlimit' [ 25.146244][ T29] audit: type=1400 audit(1764192578.223:65): avc: denied { setattr } for pid=3303 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.169574][ T29] audit: type=1400 audit(1764192578.223:66): avc: denied { create } for pid=3303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.190094][ T29] audit: type=1400 audit(1764192578.223:67): avc: denied { write } for pid=3303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.210522][ T29] audit: type=1400 audit(1764192578.223:68): avc: denied { read } for pid=3303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.217265][ T3307] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.230790][ T29] audit: type=1400 audit(1764192578.243:69): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.264108][ T29] audit: type=1400 audit(1764192578.243:70): avc: denied { mount } for pid=3303 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.287451][ T29] audit: type=1400 audit(1764192578.323:71): avc: denied { relabelto } for pid=3307 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.323000][ T3303] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.471621][ T3327] chnl_net:caif_netlink_parms(): no params data found [ 26.491136][ T3313] chnl_net:caif_netlink_parms(): no params data found [ 26.573277][ T3327] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.580396][ T3327] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.587543][ T3327] bridge_slave_0: entered allmulticast mode [ 26.594020][ T3327] bridge_slave_0: entered promiscuous mode [ 26.613451][ T3317] chnl_net:caif_netlink_parms(): no params data found [ 26.621695][ T3327] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.628822][ T3327] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.636093][ T3327] bridge_slave_1: entered allmulticast mode [ 26.642495][ T3327] bridge_slave_1: entered promiscuous mode [ 26.656149][ T3313] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.663292][ T3313] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.670417][ T3313] bridge_slave_0: entered allmulticast mode [ 26.676780][ T3313] bridge_slave_0: entered promiscuous mode [ 26.690888][ T3321] chnl_net:caif_netlink_parms(): no params data found [ 26.699846][ T3313] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.706935][ T3313] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.714232][ T3313] bridge_slave_1: entered allmulticast mode [ 26.720640][ T3313] bridge_slave_1: entered promiscuous mode [ 26.745541][ T3327] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.767329][ T3313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.776505][ T3314] chnl_net:caif_netlink_parms(): no params data found [ 26.785457][ T3327] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.802341][ T3313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.850021][ T3327] team0: Port device team_slave_0 added [ 26.860735][ T3313] team0: Port device team_slave_0 added [ 26.873895][ T3327] team0: Port device team_slave_1 added [ 26.884606][ T3313] team0: Port device team_slave_1 added [ 26.890367][ T3317] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.897445][ T3317] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.904552][ T3317] bridge_slave_0: entered allmulticast mode [ 26.911000][ T3317] bridge_slave_0: entered promiscuous mode [ 26.936500][ T3317] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.943784][ T3317] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.951050][ T3317] bridge_slave_1: entered allmulticast mode [ 26.957295][ T3317] bridge_slave_1: entered promiscuous mode [ 26.963648][ T3321] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.970783][ T3321] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.977982][ T3321] bridge_slave_0: entered allmulticast mode [ 26.984400][ T3321] bridge_slave_0: entered promiscuous mode [ 26.997357][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.004406][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.030336][ T3313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.045268][ T3321] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.052433][ T3321] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.059564][ T3321] bridge_slave_1: entered allmulticast mode [ 27.065809][ T3321] bridge_slave_1: entered promiscuous mode [ 27.076849][ T3327] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.083842][ T3327] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.109785][ T3327] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.121038][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.127991][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.153967][ T3313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.179310][ T3327] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.186278][ T3327] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.212237][ T3327] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.226746][ T3317] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.240888][ T3314] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.247955][ T3314] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.255247][ T3314] bridge_slave_0: entered allmulticast mode [ 27.261600][ T3314] bridge_slave_0: entered promiscuous mode [ 27.270286][ T3314] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.277399][ T3314] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.284609][ T3314] bridge_slave_1: entered allmulticast mode [ 27.291189][ T3314] bridge_slave_1: entered promiscuous mode [ 27.298717][ T3317] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.308799][ T3321] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.323420][ T3321] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.357257][ T3321] team0: Port device team_slave_0 added [ 27.373491][ T3314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.383221][ T3317] team0: Port device team_slave_0 added [ 27.389671][ T3321] team0: Port device team_slave_1 added [ 27.401635][ T3314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.417304][ T3313] hsr_slave_0: entered promiscuous mode [ 27.423330][ T3313] hsr_slave_1: entered promiscuous mode [ 27.429794][ T3317] team0: Port device team_slave_1 added [ 27.450282][ T3327] hsr_slave_0: entered promiscuous mode [ 27.456306][ T3327] hsr_slave_1: entered promiscuous mode [ 27.462228][ T3327] debugfs: 'hsr0' already exists in 'hsr' [ 27.467990][ T3327] Cannot create hsr debugfs directory [ 27.482914][ T3321] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.489901][ T3321] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.515812][ T3321] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.527183][ T3321] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.534195][ T3321] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.560186][ T3321] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.578271][ T3314] team0: Port device team_slave_0 added [ 27.590864][ T3317] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.597975][ T3317] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.623875][ T3317] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.634965][ T3317] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.641935][ T3317] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.667838][ T3317] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.686390][ T3314] team0: Port device team_slave_1 added [ 27.725075][ T3321] hsr_slave_0: entered promiscuous mode [ 27.730959][ T3321] hsr_slave_1: entered promiscuous mode [ 27.736760][ T3321] debugfs: 'hsr0' already exists in 'hsr' [ 27.742509][ T3321] Cannot create hsr debugfs directory [ 27.779208][ T3317] hsr_slave_0: entered promiscuous mode [ 27.785694][ T3317] hsr_slave_1: entered promiscuous mode [ 27.791617][ T3317] debugfs: 'hsr0' already exists in 'hsr' [ 27.797325][ T3317] Cannot create hsr debugfs directory [ 27.803184][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.810105][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.836049][ T3314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.860481][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.867451][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.893424][ T3314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.965015][ T3314] hsr_slave_0: entered promiscuous mode [ 27.971031][ T3314] hsr_slave_1: entered promiscuous mode [ 27.976750][ T3314] debugfs: 'hsr0' already exists in 'hsr' [ 27.982478][ T3314] Cannot create hsr debugfs directory [ 28.072028][ T3327] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 28.080906][ T3327] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 28.102434][ T3327] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 28.119981][ T3327] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 28.144397][ T3313] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 28.152952][ T3313] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 28.163272][ T3313] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 28.171840][ T3313] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 28.197779][ T3321] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 28.207160][ T3321] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 28.222276][ T3321] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 28.244030][ T3321] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 28.266864][ T3317] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 28.275831][ T3317] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 28.285122][ T3317] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 28.295493][ T3327] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.311643][ T3317] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 28.333402][ T3314] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 28.344925][ T3314] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 28.353619][ T3314] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 28.366970][ T3314] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 28.382624][ T3327] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.395946][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.403727][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.412371][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.419417][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.434992][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.464217][ T3313] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.479394][ T3317] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.496019][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.503091][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.519236][ T383] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.526329][ T383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.550409][ T3321] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.566763][ T3317] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.593107][ T3317] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 28.603566][ T3317] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 28.622521][ T3314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.631529][ T3321] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.639704][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.646746][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.655990][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.663026][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.685069][ T3313] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 28.706584][ T3314] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.714658][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.721719][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.730148][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.737276][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.758191][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.765283][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.776233][ T3327] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.793922][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.801006][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.821647][ T3317] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.838633][ T3313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.863320][ T3321] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 28.873801][ T3321] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 28.913566][ T3314] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 28.924016][ T3314] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 28.973979][ T3327] veth0_vlan: entered promiscuous mode [ 28.994312][ T3327] veth1_vlan: entered promiscuous mode [ 29.001777][ T3317] veth0_vlan: entered promiscuous mode [ 29.014253][ T3321] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.023070][ T3317] veth1_vlan: entered promiscuous mode [ 29.035455][ T3327] veth0_macvtap: entered promiscuous mode [ 29.059421][ T3317] veth0_macvtap: entered promiscuous mode [ 29.067312][ T3327] veth1_macvtap: entered promiscuous mode [ 29.079573][ T3313] veth0_vlan: entered promiscuous mode [ 29.093994][ T3317] veth1_macvtap: entered promiscuous mode [ 29.104019][ T3327] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.115622][ T3313] veth1_vlan: entered promiscuous mode [ 29.124915][ T3327] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.139012][ T3317] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.153658][ T3313] veth0_macvtap: entered promiscuous mode [ 29.169568][ T3314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.177006][ T31] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.187295][ T3317] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.194855][ T31] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.203909][ T3313] veth1_macvtap: entered promiscuous mode [ 29.230199][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.237702][ T31] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.262784][ T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.279964][ T3321] veth0_vlan: entered promiscuous mode [ 29.287450][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.301887][ T3321] veth1_vlan: entered promiscuous mode [ 29.302568][ T3317] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 29.317040][ T3321] veth0_macvtap: entered promiscuous mode [ 29.338791][ T31] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.353672][ T3321] veth1_macvtap: entered promiscuous mode [ 29.374621][ T31] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.387014][ T3321] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.397925][ T31] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.408322][ T3321] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.430036][ T31] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.439416][ T3314] veth0_vlan: entered promiscuous mode [ 29.456678][ T61] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.474080][ T3314] veth1_vlan: entered promiscuous mode [ 29.502797][ T61] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.530022][ T3314] veth0_macvtap: entered promiscuous mode [ 29.539139][ T42] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.549853][ T3314] veth1_macvtap: entered promiscuous mode [ 29.558135][ T42] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.571384][ T42] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.583953][ T42] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.594495][ T42] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.603868][ T42] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.623994][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.633503][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.652639][ T42] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.831521][ T3507] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2'. [ 29.841852][ T3507] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2'. [ 29.850735][ T3507] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2'. [ 29.860480][ T42] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.871246][ T3508] can0: slcan on ptm0. [ 29.890685][ T29] kauditd_printk_skb: 35 callbacks suppressed [ 29.890698][ T29] audit: type=1400 audit(1764192582.963:107): avc: denied { read } for pid=3043 comm="dhcpcd" name="n25" dev="tmpfs" ino=558 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 29.918425][ T29] audit: type=1400 audit(1764192582.963:108): avc: denied { open } for pid=3043 comm="dhcpcd" path="/run/udev/data/n25" dev="tmpfs" ino=558 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 29.949150][ T42] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.971967][ T42] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.008356][ T29] audit: type=1400 audit(1764192583.023:109): avc: denied { getattr } for pid=3043 comm="dhcpcd" path="/run/udev/data/n25" dev="tmpfs" ino=558 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 30.031507][ T29] audit: type=1400 audit(1764192583.053:110): avc: denied { module_load } for pid=3524 comm="syz.3.7" path="/sys/kernel/notes" dev="sysfs" ino=213 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 30.102404][ T29] audit: type=1400 audit(1764192583.153:111): avc: denied { write } for pid=3523 comm="syz.0.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 30.213282][ T3541] netlink: 'syz.0.11': attribute type 10 has an invalid length. [ 30.228877][ T3541] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.233279][ T29] audit: type=1400 audit(1764192583.213:112): avc: denied { create } for pid=3534 comm="syz.3.9" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.236342][ T3541] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.256357][ T29] audit: type=1400 audit(1764192583.213:113): avc: denied { allowed } for pid=3534 comm="GPL" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 30.282098][ T29] audit: type=1400 audit(1764192583.213:114): avc: denied { create } for pid=3534 comm="GPL" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 30.302824][ T29] audit: type=1400 audit(1764192583.213:115): avc: denied { map } for pid=3534 comm="GPL" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4770 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 30.326360][ T29] audit: type=1400 audit(1764192583.213:116): avc: denied { read write } for pid=3534 comm="GPL" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4770 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 30.333799][ T3541] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.357458][ T3541] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.364806][ T3541] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.371904][ T3541] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.414541][ T3541] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 30.428002][ T3545] pim6reg: entered allmulticast mode [ 30.433688][ T3546] pim6reg: left allmulticast mode [ 30.445285][ T3543] can1: slcan on ptm1. [ 30.580827][ T3506] can0 (unregistered): slcan off ptm0. [ 30.598312][ T3548] can0: slcan on ptm0. [ 30.661009][ T3541] syz.0.11 (3541) used greatest stack depth: 10480 bytes left [ 31.101301][ T3587] can2: slcan on ptm2. [ 31.191146][ T3542] can1 (unregistered): slcan off ptm1. [ 31.334332][ T3599] SELinux: policydb table sizes (0,0) do not match mine (6,6) [ 31.385953][ T3599] SELinux: failed to load policy [ 31.489857][ T3606] loop0: detected capacity change from 0 to 4096 [ 31.496852][ T3547] can0 (unregistered): slcan off ptm0. [ 31.526438][ T3606] EXT4-fs: Ignoring removed nomblk_io_submit option [ 31.555690][ T3619] netlink: 4 bytes leftover after parsing attributes in process `syz.4.39'. [ 31.591165][ T3612] usb usb4: usbfs: interface 0 claimed by hub while 'syz.4.39' sets config #0 [ 31.610207][ T3606] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.617144][ T3624] can0: slcan on ptm0. [ 31.656486][ T3619] usb usb4: usbfs: interface 0 claimed by hub while 'syz.4.39' sets config #1 [ 31.980570][ T3586] can2 (unregistered): slcan off ptm2. [ 32.061994][ T3631] pim6reg: entered allmulticast mode [ 32.079676][ T3631] pim6reg: left allmulticast mode [ 32.560660][ T3620] can0 (unregistered): slcan off ptm0. [ 32.566030][ T3653] can0: slcan on ptm1. [ 32.655070][ T3658] Zero length message leads to an empty skb [ 32.922429][ T3678] netlink: 28 bytes leftover after parsing attributes in process `syz.2.64'. [ 32.931300][ T3678] netlink: 32 bytes leftover after parsing attributes in process `syz.2.64'. [ 32.940087][ T3678] netlink: 28 bytes leftover after parsing attributes in process `syz.2.64'. [ 33.270504][ T3699] netlink: 28 bytes leftover after parsing attributes in process `syz.2.70'. [ 33.279391][ T3699] netlink: 28 bytes leftover after parsing attributes in process `syz.2.70'. [ 33.288221][ T3699] netlink: 12 bytes leftover after parsing attributes in process `syz.2.70'. [ 33.333141][ T3701] can1: slcan on ptm0. [ 33.385941][ T3327] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.440685][ T3652] can0 (unregistered): slcan off ptm1. [ 34.190587][ T3700] can1 (unregistered): slcan off ptm0. [ 34.269809][ T3773] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 34.277283][ T3773] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 34.289922][ T3773] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 34.297383][ T3773] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 34.521730][ T3800] FAULT_INJECTION: forcing a failure. [ 34.521730][ T3800] name failslab, interval 1, probability 0, space 0, times 1 [ 34.534531][ T3800] CPU: 0 UID: 0 PID: 3800 Comm: syz.3.108 Not tainted syzkaller #0 PREEMPT(voluntary) [ 34.534557][ T3800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 34.534569][ T3800] Call Trace: [ 34.534575][ T3800] [ 34.534628][ T3800] __dump_stack+0x1d/0x30 [ 34.534648][ T3800] dump_stack_lvl+0xe8/0x140 [ 34.534666][ T3800] dump_stack+0x15/0x1b [ 34.534732][ T3800] should_fail_ex+0x265/0x280 [ 34.534778][ T3800] should_failslab+0x8c/0xb0 [ 34.534795][ T3800] __kmalloc_noprof+0xa5/0x570 [ 34.534812][ T3800] ? security_task_alloc+0x4d/0x120 [ 34.534876][ T3800] security_task_alloc+0x4d/0x120 [ 34.534898][ T3800] copy_process+0xbf2/0x2000 [ 34.534914][ T3800] ? kstrtouint+0x76/0xc0 [ 34.534940][ T3800] kernel_clone+0x16c/0x5c0 [ 34.534956][ T3800] ? vfs_write+0x7e8/0x960 [ 34.535046][ T3800] __x64_sys_clone+0xe6/0x120 [ 34.535066][ T3800] x64_sys_call+0x119c/0x3000 [ 34.535079][ T3800] do_syscall_64+0xd2/0x200 [ 34.535091][ T3800] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 34.535140][ T3800] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 34.535159][ T3800] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 34.535171][ T3800] RIP: 0033:0x7f41f2b3f749 [ 34.535181][ T3800] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 34.535250][ T3800] RSP: 002b:00007f41f15a6fe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 34.535267][ T3800] RAX: ffffffffffffffda RBX: 00007f41f2d95fa0 RCX: 00007f41f2b3f749 [ 34.535319][ T3800] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000003000000 [ 34.535327][ T3800] RBP: 00007f41f15a7090 R08: 0000000000000000 R09: 0000000000000000 [ 34.535334][ T3800] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001 [ 34.535341][ T3800] R13: 00007f41f2d96038 R14: 00007f41f2d95fa0 R15: 00007ffd3f4816a8 [ 34.535386][ T3800] [ 34.738614][ T3782] netlink: 'syz.1.102': attribute type 10 has an invalid length. [ 34.751523][ T3782] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 34.762703][ T3804] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3804 comm=syz.4.109 [ 34.821082][ T3799] usb usb4: usbfs: interface 0 claimed by hub while 'syz.0.107' sets config #0 [ 34.881535][ T3802] usb usb4: usbfs: interface 0 claimed by hub while 'syz.0.107' sets config #1 [ 34.997990][ T29] kauditd_printk_skb: 92 callbacks suppressed [ 34.998031][ T29] audit: type=1400 audit(1764192588.073:209): avc: denied { execute } for pid=3812 comm="syz.4.112" path="/33/cpu.stat" dev="tmpfs" ino=185 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 35.182239][ T3817] netlink: 'syz.2.114': attribute type 10 has an invalid length. [ 35.190392][ T3817] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.197608][ T3817] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.208341][ T3817] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.215474][ T3817] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.222920][ T3817] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.229990][ T3817] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.238572][ T3817] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 35.298962][ T3828] loop4: detected capacity change from 0 to 128 [ 35.307425][ T3828] EXT4-fs: Ignoring removed nobh option [ 35.315552][ T3828] EXT4-fs error (device loop4): __ext4_fill_super:5512: inode #2: comm syz.4.118: iget: checksum invalid [ 35.334732][ T3828] EXT4-fs (loop4): get root inode failed [ 35.340510][ T3828] EXT4-fs (loop4): mount failed [ 35.362381][ T29] audit: type=1400 audit(1764192588.443:210): avc: granted { setsecparam } for pid=3824 comm="syz.4.118" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 35.392802][ T3828] loop4: detected capacity change from 0 to 2048 [ 35.414636][ T3828] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.427670][ T29] audit: type=1400 audit(1764192588.503:211): avc: denied { read write open } for pid=3824 comm="syz.4.118" path="/37/file1/bus" dev="loop4" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 35.461240][ T3321] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.518830][ T3846] __nla_validate_parse: 8 callbacks suppressed [ 35.518846][ T3846] netlink: 28 bytes leftover after parsing attributes in process `syz.0.121'. [ 35.534646][ T3846] netlink: 28 bytes leftover after parsing attributes in process `syz.0.121'. [ 35.543617][ T3846] netlink: 12 bytes leftover after parsing attributes in process `syz.0.121'. [ 35.553199][ T3848] netlink: 360 bytes leftover after parsing attributes in process `syz.1.124'. [ 35.566262][ T29] audit: type=1400 audit(1764192588.643:212): avc: denied { create } for pid=3847 comm="syz.1.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 35.569027][ T3848] loop1: detected capacity change from 0 to 1024 [ 35.585577][ T29] audit: type=1400 audit(1764192588.643:213): avc: denied { bind } for pid=3847 comm="syz.1.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 35.592504][ T3848] EXT4-fs: Ignoring removed orlov option [ 35.674820][ T3848] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.717749][ T3848] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1016 sclass=netlink_route_socket pid=3848 comm=syz.1.124 [ 35.733685][ T3857] netlink: 'syz.3.128': attribute type 10 has an invalid length. [ 35.741868][ T3857] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.749094][ T3857] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.758306][ T29] audit: type=1400 audit(1764192588.833:214): avc: denied { getopt } for pid=3847 comm="syz.1.124" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.773302][ T3857] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.785567][ T3857] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.792931][ T3857] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.799974][ T3857] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.810599][ T3857] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 35.811430][ T3848] netlink: 4 bytes leftover after parsing attributes in process `syz.1.124'. [ 35.863943][ T3848] x_tables: duplicate underflow at hook 1 [ 35.871331][ T29] audit: type=1400 audit(1764192588.943:215): avc: denied { write } for pid=3865 comm="syz.3.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 35.891566][ T29] audit: type=1400 audit(1764192588.943:216): avc: denied { read } for pid=3865 comm="syz.3.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 35.917481][ T29] audit: type=1400 audit(1764192588.993:217): avc: denied { append } for pid=3865 comm="syz.3.131" name="mISDNtimer" dev="devtmpfs" ino=248 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.940549][ T29] audit: type=1400 audit(1764192588.993:218): avc: denied { open } for pid=3865 comm="syz.3.131" path="/dev/mISDNtimer" dev="devtmpfs" ino=248 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.987753][ T3313] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.061675][ T3878] loop3: detected capacity change from 0 to 128 [ 36.086528][ T3878] syz.3.133: attempt to access beyond end of device [ 36.086528][ T3878] loop3: rw=2049, sector=138, nr_sectors = 8 limit=128 [ 36.111508][ T3878] syz.3.133: attempt to access beyond end of device [ 36.111508][ T3878] loop3: rw=2049, sector=146, nr_sectors = 6 limit=128 [ 36.126122][ T3878] syz.3.133: attempt to access beyond end of device [ 36.126122][ T3878] loop3: rw=2049, sector=150, nr_sectors = 2 limit=128 [ 36.139539][ T3878] Buffer I/O error on dev loop3, logical block 75, lost async page write [ 36.180491][ T3878] syz.3.133: attempt to access beyond end of device [ 36.180491][ T3878] loop3: rw=2049, sector=152, nr_sectors = 2 limit=128 [ 36.193858][ T3878] Buffer I/O error on dev loop3, logical block 76, lost async page write [ 36.238329][ T3878] syz.3.133: attempt to access beyond end of device [ 36.238329][ T3878] loop3: rw=2049, sector=138, nr_sectors = 8 limit=128 [ 36.351181][ T3899] netlink: 92 bytes leftover after parsing attributes in process `syz.4.140'. [ 36.381428][ T3899] netlink: 32 bytes leftover after parsing attributes in process `syz.4.140'. [ 36.415560][ T3868] syz.3.133: attempt to access beyond end of device [ 36.415560][ T3868] loop3: rw=2049, sector=186, nr_sectors = 2 limit=128 [ 37.362955][ T3926] netlink: 28 bytes leftover after parsing attributes in process `syz.0.148'. [ 37.371912][ T3926] netlink: 28 bytes leftover after parsing attributes in process `syz.0.148'. [ 37.380785][ T3926] netlink: 12 bytes leftover after parsing attributes in process `syz.0.148'. [ 37.469315][ T3929] FAULT_INJECTION: forcing a failure. [ 37.469315][ T3929] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 37.482624][ T3929] CPU: 1 UID: 0 PID: 3929 Comm: syz.3.150 Not tainted syzkaller #0 PREEMPT(voluntary) [ 37.482654][ T3929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 37.482675][ T3929] Call Trace: [ 37.482683][ T3929] [ 37.482690][ T3929] __dump_stack+0x1d/0x30 [ 37.482715][ T3929] dump_stack_lvl+0xe8/0x140 [ 37.482738][ T3929] dump_stack+0x15/0x1b [ 37.482756][ T3929] should_fail_ex+0x265/0x280 [ 37.482842][ T3929] should_fail_alloc_page+0xf2/0x100 [ 37.482870][ T3929] __alloc_frozen_pages_noprof+0xff/0x360 [ 37.482977][ T3929] alloc_pages_mpol+0xb3/0x260 [ 37.482996][ T3929] vma_alloc_folio_noprof+0x1aa/0x300 [ 37.483086][ T3929] do_wp_page+0xf60/0x2510 [ 37.483109][ T3929] ? __rcu_read_lock+0x37/0x50 [ 37.483137][ T3929] handle_mm_fault+0x77d/0x2be0 [ 37.483160][ T3929] ? __rcu_read_unlock+0x4f/0x70 [ 37.483249][ T3929] ? mt_find+0x21b/0x330 [ 37.483274][ T3929] do_user_addr_fault+0x3fe/0x1080 [ 37.483325][ T3929] ? plist_check_list+0x1e4/0x210 [ 37.483356][ T3929] exc_page_fault+0x62/0xa0 [ 37.483466][ T3929] asm_exc_page_fault+0x26/0x30 [ 37.483488][ T3929] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 37.483519][ T3929] Code: f9 01 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 0f f9 01 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 37.483612][ T3929] RSP: 0018:ffffc90011107ae0 EFLAGS: 00050206 [ 37.483626][ T3929] RAX: ffff888102972ba0 RBX: ffff88811dfa2000 RCX: 0000000000000800 [ 37.483638][ T3929] RDX: 0000000000000000 RSI: ffff88811dfa2800 RDI: 0000200000001000 [ 37.483652][ T3929] RBP: 0000200000000800 R08: 000000000000056d R09: 0000000000000000 [ 37.483666][ T3929] R10: 000188811dfa2000 R11: 000188811dfa2fff R12: 0000200000001800 [ 37.483678][ T3929] R13: ffffc90011107d98 R14: 0000000000001000 R15: 00007ffffffff000 [ 37.483737][ T3929] _copy_to_iter+0x141/0xe70 [ 37.483761][ T3929] ? __list_del_entry_valid_or_report+0x65/0x130 [ 37.483796][ T3929] ? _raw_spin_unlock_irqrestore+0x2b/0x60 [ 37.483822][ T3929] ? __mutex_lock+0x25d/0xcc0 [ 37.483895][ T3929] copy_page_to_iter+0x18f/0x2d0 [ 37.483954][ T3929] anon_pipe_read+0x236/0x750 [ 37.483985][ T3929] do_iter_readv_writev+0x4a1/0x540 [ 37.484018][ T3929] vfs_readv+0x1ea/0x690 [ 37.484074][ T3929] do_readv+0xe7/0x210 [ 37.484151][ T3929] __x64_sys_readv+0x45/0x50 [ 37.484180][ T3929] x64_sys_call+0x29fc/0x3000 [ 37.484205][ T3929] do_syscall_64+0xd2/0x200 [ 37.484228][ T3929] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 37.484346][ T3929] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 37.484381][ T3929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 37.484534][ T3929] RIP: 0033:0x7f41f2b3f749 [ 37.484549][ T3929] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 37.484564][ T3929] RSP: 002b:00007f41f1586038 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 37.484583][ T3929] RAX: ffffffffffffffda RBX: 00007f41f2d96090 RCX: 00007f41f2b3f749 [ 37.484597][ T3929] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000005 [ 37.484610][ T3929] RBP: 00007f41f1586090 R08: 0000000000000000 R09: 0000000000000000 [ 37.484677][ T3929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 37.484688][ T3929] R13: 00007f41f2d96128 R14: 00007f41f2d96090 R15: 00007ffd3f4816a8 [ 37.484703][ T3929] [ 37.947085][ T3939] FAULT_INJECTION: forcing a failure. [ 37.947085][ T3939] name failslab, interval 1, probability 0, space 0, times 0 [ 37.959830][ T3939] CPU: 0 UID: 0 PID: 3939 Comm: syz.3.153 Not tainted syzkaller #0 PREEMPT(voluntary) [ 37.959862][ T3939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 37.959944][ T3939] Call Trace: [ 37.959951][ T3939] [ 37.959959][ T3939] __dump_stack+0x1d/0x30 [ 37.959990][ T3939] dump_stack_lvl+0xe8/0x140 [ 37.960077][ T3939] dump_stack+0x15/0x1b [ 37.960110][ T3939] should_fail_ex+0x265/0x280 [ 37.960144][ T3939] should_failslab+0x8c/0xb0 [ 37.960170][ T3939] __kmalloc_node_track_caller_noprof+0xa5/0x580 [ 37.960198][ T3939] ? sidtab_sid2str_get+0xa0/0x130 [ 37.960287][ T3939] kmemdup_noprof+0x2b/0x70 [ 37.960468][ T3939] sidtab_sid2str_get+0xa0/0x130 [ 37.960498][ T3939] security_sid_to_context_core+0x1eb/0x2e0 [ 37.960600][ T3939] security_sid_to_context+0x27/0x40 [ 37.960625][ T3939] selinux_lsmprop_to_secctx+0x67/0xf0 [ 37.960659][ T3939] security_lsmprop_to_secctx+0x1a3/0x1c0 [ 37.960717][ T3939] audit_log_subj_ctx+0xa4/0x3e0 [ 37.960737][ T3939] ? skb_put+0xa9/0xf0 [ 37.960767][ T3939] audit_log_task_context+0x48/0x70 [ 37.960793][ T3939] audit_log_task+0xf4/0x250 [ 37.960905][ T3939] ? kstrtouint+0x76/0xc0 [ 37.960976][ T3939] audit_seccomp+0x61/0x100 [ 37.961003][ T3939] ? __seccomp_filter+0x82d/0x1250 [ 37.961032][ T3939] __seccomp_filter+0x83e/0x1250 [ 37.961137][ T3939] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 37.961164][ T3939] ? vfs_write+0x7e8/0x960 [ 37.961195][ T3939] __secure_computing+0x82/0x150 [ 37.961224][ T3939] syscall_trace_enter+0xcf/0x1e0 [ 37.961261][ T3939] do_syscall_64+0xac/0x200 [ 37.961280][ T3939] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 37.961314][ T3939] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 37.961349][ T3939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 37.961368][ T3939] RIP: 0033:0x7f41f2b3f749 [ 37.961383][ T3939] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 37.961455][ T3939] RSP: 002b:00007f41f15a7038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ac [ 37.961510][ T3939] RAX: ffffffffffffffda RBX: 00007f41f2d95fa0 RCX: 00007f41f2b3f749 [ 37.961525][ T3939] RDX: 0000000000001100 RSI: 0000000000000000 RDI: ffffffffffffffff [ 37.961537][ T3939] RBP: 00007f41f15a7090 R08: 0000000000000000 R09: 0000000000000000 [ 37.961566][ T3939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 37.961580][ T3939] R13: 00007f41f2d96038 R14: 00007f41f2d95fa0 R15: 00007ffd3f4816a8 [ 37.961600][ T3939] [ 38.207903][ T3943] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3943 comm=syz.1.157 [ 38.234493][ T3950] loop4: detected capacity change from 0 to 512 [ 38.286843][ T3950] vfat: Unknown parameter 's†ortname' [ 38.304315][ T3953] openvswitch: netlink: Key 6 has unexpected len 4 expected 2 [ 38.320840][ T3949] loop4: detected capacity change from 0 to 512 [ 38.334122][ T3962] can0: slcan on ptm0. [ 38.338522][ T3960] syz.2.164 uses obsolete (PF_INET,SOCK_PACKET) [ 39.170708][ T3961] can0 (unregistered): slcan off ptm0. [ 39.196039][ T3995] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3995 comm=syz.4.172 [ 39.607626][ T4004] loop4: detected capacity change from 0 to 2048 [ 39.662594][ T4004] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.680549][ T4004] ext4 filesystem being mounted at /55/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.685359][ T4010] SELinux: failed to load policy [ 39.762154][ T3321] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.862850][ T4027] netlink: 'syz.1.184': attribute type 10 has an invalid length. [ 39.871055][ T4027] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.878219][ T4027] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.893728][ T4027] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.900895][ T4027] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.908330][ T4027] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.915451][ T4027] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.970935][ T4031] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4031 comm=syz.2.186 [ 40.036402][ T4036] loop2: detected capacity change from 0 to 512 [ 40.047429][ T4027] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 40.110512][ T4036] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 40.396643][ T29] kauditd_printk_skb: 147 callbacks suppressed [ 40.396656][ T29] audit: type=1400 audit(1764192593.473:365): avc: denied { create } for pid=4041 comm="syz.0.189" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 40.525391][ T29] audit: type=1400 audit(1764192593.523:366): avc: denied { setopt } for pid=4041 comm="syz.0.189" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 40.637394][ T4051] FAULT_INJECTION: forcing a failure. [ 40.637394][ T4051] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 40.650500][ T4051] CPU: 1 UID: 0 PID: 4051 Comm: syz.1.192 Not tainted syzkaller #0 PREEMPT(voluntary) [ 40.650529][ T4051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 40.650575][ T4051] Call Trace: [ 40.650582][ T4051] [ 40.650590][ T4051] __dump_stack+0x1d/0x30 [ 40.650610][ T4051] dump_stack_lvl+0xe8/0x140 [ 40.650634][ T4051] dump_stack+0x15/0x1b [ 40.650654][ T4051] should_fail_ex+0x265/0x280 [ 40.650699][ T4051] should_fail+0xb/0x20 [ 40.650716][ T4051] should_fail_usercopy+0x1a/0x20 [ 40.650783][ T4051] strncpy_from_user+0x25/0x230 [ 40.650869][ T4051] strncpy_from_bpfptr+0x43/0x50 [ 40.650892][ T4051] bpf_prog_load+0x883/0x1100 [ 40.650917][ T4051] ? security_bpf+0x2b/0x90 [ 40.650953][ T4051] __sys_bpf+0x469/0x7c0 [ 40.650979][ T4051] __x64_sys_bpf+0x41/0x50 [ 40.651010][ T4051] x64_sys_call+0x2aee/0x3000 [ 40.651070][ T4051] do_syscall_64+0xd2/0x200 [ 40.651089][ T4051] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 40.651118][ T4051] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 40.651151][ T4051] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 40.651191][ T4051] RIP: 0033:0x7f0dff81f749 [ 40.651204][ T4051] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 40.651222][ T4051] RSP: 002b:00007f0dfe287038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 40.651242][ T4051] RAX: ffffffffffffffda RBX: 00007f0dffa75fa0 RCX: 00007f0dff81f749 [ 40.651256][ T4051] RDX: 0000000000000094 RSI: 0000200000000380 RDI: 0000000000000005 [ 40.651269][ T4051] RBP: 00007f0dfe287090 R08: 0000000000000000 R09: 0000000000000000 [ 40.651299][ T4051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 40.651310][ T4051] R13: 00007f0dffa76038 R14: 00007f0dffa75fa0 R15: 00007ffc0076c608 [ 40.651325][ T4051] [ 40.859226][ T29] audit: type=1400 audit(1764192593.733:367): avc: denied { create } for pid=4045 comm="syz.2.191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 40.930442][ T29] audit: type=1400 audit(1764192593.973:368): avc: denied { setopt } for pid=4045 comm="syz.2.191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 40.994792][ T29] audit: type=1400 audit(1764192594.043:369): avc: denied { setopt } for pid=4032 comm="syz.4.187" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 41.100710][ T3500] ================================================================== [ 41.108830][ T3500] BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet [ 41.117869][ T3500] [ 41.120190][ T3500] write to 0xffff8881044ab560 of 8 bytes by task 4063 on cpu 1: [ 41.127813][ T3500] rxrpc_send_data_packet+0x1593/0x1df0 [ 41.133383][ T3500] rxrpc_transmit_some_data+0x63c/0x8b0 [ 41.138950][ T3500] rxrpc_input_call_event+0x8bb/0xf30 [ 41.144332][ T3500] rxrpc_io_thread+0x1c1e/0x21c0 [ 41.149286][ T3500] kthread+0x489/0x510 [ 41.153442][ T3500] ret_from_fork+0x122/0x1b0 [ 41.158027][ T3500] ret_from_fork_asm+0x1a/0x30 [ 41.162780][ T3500] [ 41.165086][ T3500] read to 0xffff8881044ab560 of 8 bytes by task 3500 on cpu 0: [ 41.172611][ T3500] rxrpc_peer_keepalive_worker+0x44e/0x800 [ 41.178404][ T3500] process_scheduled_works+0x4ce/0x9d0 [ 41.183862][ T3500] worker_thread+0x582/0x770 [ 41.188444][ T3500] kthread+0x489/0x510 [ 41.192514][ T3500] ret_from_fork+0x122/0x1b0 [ 41.197102][ T3500] ret_from_fork_asm+0x1a/0x30 [ 41.201881][ T3500] [ 41.204186][ T3500] value changed: 0x0000000000000000 -> 0x0000000000000029 [ 41.211272][ T3500] [ 41.213574][ T3500] Reported by Kernel Concurrency Sanitizer on: [ 41.219708][ T3500] CPU: 0 UID: 0 PID: 3500 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(voluntary) [ 41.229584][ T3500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 41.239625][ T3500] Workqueue: krxrpcd rxrpc_peer_keepalive_worker [ 41.245952][ T3500] ==================================================================