last executing test programs: 3m2.418723976s ago: executing program 3 (id=150): mknod$loop(&(0x7f0000000140)='./file0\x00', 0x1, 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000220000000000000000000000850000006d00000018", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000021007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) pipe2$9p(&(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff018004000800395032303030"], 0x15) r4 = dup(r3) write$P9_RLERRORu(r4, &(0x7f0000000540)=ANY=[@ANYBLOB="8b"], 0x53) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) write$binfmt_elf64(r4, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c4600073f034b0b00000000000003003e00ffffffe93501"], 0x7c8) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x2004000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[], [], 0x6b}}) 3m2.19375957s ago: executing program 3 (id=151): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000010100008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000001dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setopts(0x4200, r2, 0x58880000000, 0x300051) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x2d) syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f00000002c0)='./bus\x00', 0x404, &(0x7f0000000580)={[{@orlov}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}]}, 0x1, 0x5ec, &(0x7f00000016c0)="$eJzs3c9vVFUbAOD3TqelpXxfCzEqLqSJMZAoLS1giHEBW0Ma/BE3bqy0IFKgoTVaNKEkuDExbowxceVC/C+UyJaVrly4cWVIiBo2JiaOudN7S6e909KBztTe50mmc+85c+acm+nbe+7pOXcCKK2h9EclYm9EzCQRA8nCUl41ssyhxdfd+/Oj0+kjiVrttd+TSLK0/PVJ9tyfFe6NiB9/SGJP1+p6Z+evnJ+Ynp66nO2PzF2YGZmdv3Lw3IWJs1Nnpy6OvTB27OiRo8dGD7V0XFcL0k5ef/f9gU/G3/zmq7+T0W9/GU/ieLycvXD5cTRIWqq+biiG6sUL3qL/WOtvu6V0Zb8nyz/ipNrBBrEh+efXHRFPxEB0xf0PbyA+fqWjjQM2VS2JqAEllYh/KKm8H5Bf26+8Dq50pFcCtMPdE4sDAKvjv7o4Nhi99bGBnfeSWD6sk0REayNzjXZFxO1b49fP3Bq/HmuNwwGP3MK1iHiyKP6TevwPRm8M1uO/0hD/ab/gVPacpr/aYv0rh4rFP7TPYvz3rhn/0ST+31oW/2+3WP/Q/c13+hriv6/VQwIAAAAAAIDSunkiIp4v+v9/ZWn+TxTM/+mPiOOPoP6hFfur//9fubNgPRlsirsnIl4qnP9byWf/DnZlW/+rzwfoTs6cm546FBH/j4gD0b0j3R9do46Dn+75slneUDb/L3+k9d/O5gJm7bhT3dFYZnJibuJhjxuIuHst4qnC+b/J0vk/KTj/p38PZh6wjj3P3jjVLG/9+Ac2S+3riP2F5//7d61I1r4/x0i9PzCS9wpWe/rDz75rVn+r8e+SAB5eev7fuXb8DybL79czu/E6Ds9Xa83yWu3/9ySv128505OlfTAxN3d5NKInOdmVpjakj228zbAd5fGQPvdm8X/gmbXH/4r6/30RsbDivZM/GtcU5x7/p//XZu3R/4fOSeN/ckPn/41vjN0Y/L5Z/Q92/j9SP9cfyFKM/8GiL/Iw7WlMLwjHalFWu9sLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANtBJSJ2RVIZXtquVIaHI/oj4rHYWZm+NDv33JlL712cTPPq3/9fyb/pd2BxP8m//39w2f7Yiv3DEbE7Ij7v6qvvD5++ND3Z6YMHAAAAAAAAAAAAAAAAAACALaK/yfr/1G9d6xSutKOFwKaqdroBQMcUxP9PnWgH0H7O/1Be4h/KS/xDeYl/KC/xD+Ul/qG8xD+Ul/gHAAAAAIBtZfe+mz8nEbHwYl/9kerJ8ro72jJgs7mFB5TXerf4AbYvU3+gvFzjA8k6+b1NC61Xci0zpx+iMAAAAAAAAAAAAACUzv691v9DWVn/D+Vl/T+UV77+f1+H2wG0n2t8INZZyV+4/n/dUgAAAAAAAAAAAADAozQ7f+X8xPT01GUbb2yNZrRzo1arXU1/C7ZKe/5jG9UVQZRPhe94w5Y2/qotqqfkzX2w4p35ewQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKz2bwAAAP//amolyg==") r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x4040, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1202, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(r4, r3, 0x0, 0x3ffff) sendfile(r4, r3, 0x0, 0x7ffff000) 3m1.483249071s ago: executing program 3 (id=156): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000040000000400000001"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000001b80)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='sched_switch\x00', r1, 0x0, 0x9}, 0x18) perf_event_open(&(0x7f0000000e00)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x40000, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tkill(0x0, 0xe) r2 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, 0x0, 0xc0) process_vm_writev(0x0, &(0x7f0000000000)=[{&(0x7f0000000780)=""/247, 0xf7}], 0x1, &(0x7f0000000d00)=[{&(0x7f0000000580)=""/29, 0x1d}, {&(0x7f00000005c0)=""/57, 0x39}, {&(0x7f0000000880)=""/16, 0x10}, {&(0x7f00000008c0)=""/32, 0x20}, {0x0}, {&(0x7f0000000a40)=""/138, 0x8a}, {&(0x7f0000000bc0)=""/157, 0x9d}, {&(0x7f0000000c80)=""/101, 0x65}], 0x8, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000202300800000000025ad9835850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) pipe2$9p(0x0, 0x0) r4 = socket(0x200000000000011, 0x2, 0x1) bind$packet(r4, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x6a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa424e1aa2e0d408004500001402"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x43}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3, 0x0, 0x4}, 0x18) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r0, 0xe0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd4, 0x8, 0x0, 0x0}}, 0x10) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff3d) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed074479000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000003c0)='sched_switch\x00', r6}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x5f}, 0x18) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000014c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x54c, 0x42f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x80, 0x20, 0x8, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x1, 0x3, 0x2, {0x9, 0x21, 0x0, 0x3, 0x1, {0x22, 0xcda}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x3, 0x3, 0x31}}}}}]}}]}}, 0x0) close_range(r7, 0xffffffffffffffff, 0x200000000000000) 3m0.1837691s ago: executing program 3 (id=174): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x4a) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x36, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x10000, 0x0, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000240)='./file2\x00', 0x2000410, &(0x7f0000000080), 0x80, 0x7a5, &(0x7f0000000f80)="$eJzs3c9rXNUeAPDvnfxq0r6XPHjwXl0FBA2UTkyNrYKLigsRLBR0bRsm01AzyZTMpDQh0BYR3AgqLgTddO2PunPrj63+Fy6kpWparLiQkTuZSSbNTJq0mZlgPh+4uefcc2/O+c65P87MvcwEcGCNpn8yEUcj4v0kYri2PImIvmqqN+L02nr3V1dy6ZREpfL6r0l1nXurK7lo2CZ1uJb5f0R8907EsczWektLy7NThUJ+oZYfL89dGi8tLR+/ODc1k5/Jz5+cmJw8ceq5Uyf3Ltbff1w+cvuDV57+8vSfb//v5nvfJ3E6jtTKGuPYK6MxWntN+tKXcJOX97qyLku63QAeSXpo9qwd5XE0hqOnmmphsJMtAwDa5WpEVACAAyZx/QeAA6b+OcC91ZVcferuJxKddeeliDi0Fn/9/uZaSW/tnt2h6n3QoXvJpjsjSUSM7EH9oxHx6ddvfp5O0ab7kADNXLseEedHRree/5Mtzyzs1jPbFVYGqrPRBxY7/0HnfJOOf55vNv7LrI9/osn4Z6DJsfsoHn78Z27tQTUtpeO/FxuebbvfEH/NSE8t96/qmK8vuXCxkE/Pbf+OiLHoG0jzE9VVmz8FNXb3r7ut6m8c//324VufpfWn8401Mrd6BzZvMz1VnnrcuOvuXI94ordZ/Ml6/yctxr9nd1jHqy+8+0mrsjT+NN76tDX+9qrciHiqaf9v9GWy7fOJ49XdYby+UzTx1U8fD7Wqf6P/B6rztP76e4FOSPt/aPv4R5LG5zVLu6/jhxvD37Yqa9z/m8fffP/vT96opvtry65MlcsLExH9yWtbl5/Y2Laer6+fxj/2ZPPjv9X+n6k9G3t+Pbe93tu/fFH7V03jr7rWKv72SuOf3lX/b5Oo1LZ5oOjm/dmeVvXvrP8nq6mx2pKdnP8e0tLH2JsBAAAAAAAAAAAAAAAAAAAAAAAAYPcyEXEkkkx2PZ3JZLNrv+H93xjKFIql8rELxcX56aj+VvZI9GXqX3U53PB9qBO178Ov5088kH82Iv4TER8NDFbz2VyxMN3t4AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg5vDm3/+/ms6y2bWynwe63ToAoG0OdbsBAEDHuf4DwMGzu+v/YNvaAQB0zq7f/1eS9jQEAOiYHV//z7e3HQBA57j/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQJudPXMmnSp/rK7k0vz05aXF2eLl49P50mx2bjGXzRUXLmVnisWZQj6bK861/EfX1maFYvHSZMwvXhkv50vl8dLS8rm54uJ8+dzFuamZ/Ll8X8ciAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICdKy0tz04VCvkFiW0Tg/ujGfsm0Rv7ohn/+ER/12pvPEsMdu8EBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDP/R0AAP//aHclQg==") r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000009900000001"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x2, &(0x7f0000000200)=[{0x2, 0x40, 0x0, 0x7ffc1dfb}, {0x9, 0x80, 0x9, 0x6}]}) set_mempolicy_home_node(&(0x7f0000349000/0xa000)=nil, 0xa000, 0x0, 0x0) arch_prctl$ARCH_REQ_XCOMP_GUEST_PERM(0x1025, 0x11) set_mempolicy(0x6005, 0x0, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_clone(0x42000000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='blkio.bfq.dequeue\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) r4 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000080), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLom1bZCqiyCoICJaKHUTXOokFKQUEUGFioiL0gq1xa11cnHQWaWTSxE3q6N0KS6K4FS1Q10ELQ4WBx0iybVSbUT50i/38d3vB5fcJe97//e4e94kw5EAjTWTZCFJK8lskk6S4mKD+6pl5mxzZ/JgJen1nvqlGLSrtivn/aaTbCd5NMl+WeSVdrK599zxb4dPPPj2RueBD/eenRzrQZ45OT568vSDpbc+WXxk86tvfloqspDu347r6hVDXmsXyR3Xo9gNomjXPQL+j+U3Pv62n/s7k9w/yH8nZaqT9876LfudPPz+v/V99+ev7x7nWIGr1+t1+p+B2z2gccok3RTlXJJqvSzn5qrv8N+1pspX19Zfn315bWP1pbpnKuCqDH73fjbx6fQ/8v9jq8o/cPPqJkdPL+9+318/bdU9GmCc+vmffWHrocg/NI78Q3PJPzSX/ENzyT80l/xDc8k/NJf8Q3PJPzSX/ENzXcw/ANAsvYm670AG6lL3/AMAAAAAAAAAAAAAAAAAAFy2M3mwcr6Mq+YX7yUnjydpD6vfGvwfcXLr4HHq16Lf7C9F1W0kz9874g5G9FHNd1/f9kO99b+8p976W6vJ9ptJ5tvty9dfcXb9Xbvb/+P9zosjFhjRY8/UW/+P3XrrLx4mn/fnn/lh80+ZuwbPw+efbv/8jVj/td9H3AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABj82cAAAD//4TDbAU=") signalfd(r4, &(0x7f0000000840)={[0xe]}, 0x8) bpf$OBJ_GET_MAP(0x7, &(0x7f00000008c0)=@o_path={&(0x7f0000000880)='mnt\x00', 0x0, 0x4010, r4}, 0x18) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) syz_clone(0x3000, 0x0, 0x0, &(0x7f0000000800), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001740)=@delchain={0x2638, 0x65, 0x10, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xffff, 0x6}, {0xfff2, 0x10}, {0x4, 0x3}}, [@filter_kind_options=@f_fw={{0x7}, {0x192c, 0x2, [@TCA_FW_POLICE={0x41c, 0x2, [@TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_RESULT={0x8, 0x5, 0x7}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x8, 0x6, 0xa8, 0xe, 0x2, 0x10, 0x8, 0x1ff, 0x0, 0x9, 0xcb, 0x7, 0x81, 0x6, 0x3, 0x7f, 0x10001, 0x1, 0x7, 0x3, 0x2, 0x9, 0xba0, 0x8, 0x40, 0xb66, 0x3, 0x2, 0x6, 0x5, 0xa, 0x338, 0xece4, 0x8, 0x1, 0x1, 0x3, 0x4, 0xffffffb7, 0x4, 0x0, 0x2217, 0x0, 0x2, 0x300, 0x6953, 0x8f6c, 0x7fff, 0x1, 0x2, 0x6, 0x40, 0xd, 0x1, 0x9, 0x5, 0x8, 0x6, 0x2, 0xf0, 0x7, 0x6, 0x8, 0x0, 0x2266, 0x1, 0x1, 0x2, 0x80000000, 0x4, 0xd0bb, 0xd9, 0xfffeffff, 0x645b, 0x8, 0xe58, 0x8, 0x1, 0x1, 0x4, 0x4, 0xd1f, 0x0, 0x9, 0x2, 0x5c0, 0x3, 0x5, 0x2, 0x9, 0x6, 0x10001, 0x40, 0xfc000000, 0x7ff, 0x2, 0xc, 0x80000001, 0x8, 0x7f, 0x1, 0x0, 0x1, 0x4, 0x4000000, 0x0, 0x2, 0x7c38, 0x5, 0xfffffffe, 0x0, 0x3, 0x1, 0x400, 0x4, 0x3, 0xb4, 0xf6, 0x5, 0x9, 0x5, 0x1, 0xc, 0x3, 0xad, 0x9, 0x6, 0x2, 0x5, 0x6, 0x8001, 0x5, 0x8, 0x480f, 0x2, 0x5, 0x5e, 0x6, 0xa524, 0x6, 0xc, 0x6, 0x1, 0x10001, 0xfffffc00, 0x80000001, 0x7, 0x4, 0x5, 0x3, 0x5, 0x40, 0x0, 0x1, 0x7, 0x5, 0x2, 0x6da, 0x335, 0x6, 0x8001, 0x2, 0x7fff, 0x9, 0xb8, 0x800, 0x76, 0x81, 0x1ff, 0x2, 0x4, 0x200, 0x40, 0x0, 0x1, 0xff, 0x8, 0x9, 0x7, 0x0, 0xe06, 0x5, 0x0, 0x2, 0xfffffff4, 0x7, 0x1ff, 0x4, 0x0, 0x9148, 0x3, 0x7, 0x2, 0x5, 0x5c6, 0x0, 0x8, 0x2, 0x7f, 0x200, 0xe, 0x5, 0x3, 0x6, 0x9, 0x1, 0x63909e43, 0x0, 0x5460, 0x8, 0x3, 0xfffffcb0, 0xa, 0xff, 0x0, 0xffffffff, 0x10, 0x2, 0xcd, 0x8, 0x3ff, 0x3ff, 0x9, 0xfff, 0x1, 0xf, 0x2, 0x1, 0x7fff, 0x8, 0xffffffff, 0x3, 0x7, 0x316be93c, 0x17ce, 0x1, 0xd, 0x6a, 0x1000, 0x449609ff, 0x3, 0x2, 0x0, 0x5, 0xd, 0x6, 0x7, 0x74, 0x101, 0x6, 0x7, 0x81, 0x8, 0x3, 0xfffffffa, 0xe0]}]}, @TCA_FW_POLICE={0x86c, 0x2, [@TCA_POLICE_AVRATE={0x8, 0x4, 0xf}, @TCA_POLICE_TBF={0x3c, 0x1, {0x80000000, 0xffffffffffffffff, 0xfffffffe, 0x8, 0x6, {0x0, 0x1, 0xfffa, 0x0, 0x75, 0x8cd}, {0x2, 0x0, 0xff, 0x3, 0x2, 0x2}, 0x3, 0x400, 0x80000001}}, @TCA_POLICE_RATE={0x404, 0x2, [0x5, 0x3, 0x368a862e, 0x2, 0x0, 0x3, 0x4, 0xc, 0x8, 0x9, 0xde, 0x1, 0x8, 0x2, 0x2, 0x2, 0x7, 0x8, 0x8, 0x9, 0x2, 0x138, 0xc91, 0x0, 0xffff8000, 0x10, 0x6, 0x0, 0xdc0, 0xfffff000, 0x4, 0x23, 0x3, 0x9, 0x10000, 0x830b, 0x0, 0x80000000, 0x6, 0x2, 0xb, 0x7, 0x9, 0xfffffff8, 0x0, 0x8, 0x3ff, 0x8, 0x7, 0x5, 0x3, 0x80000001, 0x4, 0x8001, 0x7ff, 0x1000, 0x1000, 0x0, 0x5, 0x0, 0x8, 0x512, 0x2, 0xaa8, 0xffff, 0x4, 0x1, 0x4, 0x9, 0xfffffffd, 0x7ff, 0xf0, 0x101, 0x7, 0x800, 0xe5b, 0xc, 0x0, 0x5, 0x3, 0x3, 0xde4e, 0x5, 0x1000, 0x14000, 0x1, 0x2, 0xa7, 0x3, 0x5, 0x7, 0x4, 0x9, 0xffff, 0x8e9b, 0x3, 0x5, 0x7fffffff, 0x9, 0x3, 0x1, 0x3, 0x9, 0x3, 0x2, 0xc6, 0x100, 0x8, 0x7, 0x80000000, 0xfff, 0x7, 0x7, 0x9, 0x0, 0x400000, 0x63, 0x10000, 0x3, 0x400, 0x0, 0x7, 0x7f, 0x0, 0x27, 0x9, 0x8, 0x7, 0x6, 0x2, 0x200, 0x6, 0x4, 0x1, 0xf2a5, 0x8000, 0x8e, 0x1, 0x5, 0x26, 0x6abf, 0x9, 0x1, 0xc3, 0x7fffffff, 0x0, 0x7, 0x6, 0x6, 0x800, 0x1, 0x400, 0x10001, 0xdd0, 0x1, 0x8001, 0x4, 0x9, 0x7f, 0x3, 0x426d, 0x1e7, 0x7fff, 0x1000, 0xffff3182, 0x5, 0x0, 0x4, 0x3, 0x5, 0x8, 0x1, 0x9, 0xfffffff7, 0x3, 0x10000000, 0x6, 0xd5cc, 0x6, 0x3b, 0x4, 0x0, 0x5, 0x10000, 0x0, 0x7, 0x4, 0x0, 0x5, 0x3, 0x6, 0x5c, 0x0, 0x8, 0x7, 0x3, 0x10, 0x6, 0xb, 0x5515, 0x9, 0xe30, 0x3, 0x3, 0x0, 0x8, 0x3, 0x0, 0x7, 0x4, 0x80000001, 0x5, 0x1, 0xc, 0x7, 0x8, 0x4dd, 0x4, 0x9, 0x3, 0xd3b4, 0x7, 0x5, 0x6, 0xe, 0x80000001, 0x2, 0x5, 0x3, 0x6, 0x0, 0x4, 0xfffffff7, 0x1, 0x8001, 0x200, 0x6, 0xffffffff, 0x7, 0xb7, 0x80000000, 0x9, 0x401, 0xfffffa95, 0x10, 0x8, 0xffffffcc, 0x6, 0x2, 0x9, 0x6, 0x472, 0x1, 0x0, 0x2, 0x1]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xdd8, 0x1000, 0x1, 0x6, 0x9, 0x0, 0x8000, 0xc4bf, 0x3, 0x2, 0x80000001, 0x2, 0x81, 0x1, 0xfffffffc, 0xfffffffe, 0x5, 0x3, 0x7, 0x9, 0x5, 0x1000, 0xfffffffb, 0x6, 0x677a, 0x6, 0x4, 0x8b, 0x8001, 0x1, 0x5, 0x2, 0x8, 0x204291bb, 0x6, 0x6, 0xc, 0x8000, 0xf1, 0x2, 0x6, 0x8, 0x200, 0x8, 0x40, 0x9, 0x8, 0x8, 0x8000, 0x2, 0x7, 0x3, 0x200, 0x4, 0xd70, 0x3, 0x7, 0x9, 0x7fff, 0x2, 0x4, 0x9, 0x5, 0x7, 0xfffffffc, 0x5, 0x2, 0x10001, 0x2, 0x8, 0x0, 0xfffffeff, 0x9, 0x498d86e8, 0x40, 0x2, 0xff, 0x0, 0x3, 0x0, 0x6, 0x8001, 0x31, 0x8, 0xffffffff, 0x1, 0x3a, 0x101, 0x0, 0x6, 0xd, 0x5, 0x400, 0x3, 0x30, 0x9, 0x4, 0xfffffff9, 0x4, 0x8, 0xffffffff, 0x400, 0x7, 0x4, 0x9, 0x800, 0x0, 0xc23c, 0x401, 0x5793, 0x9, 0x0, 0x0, 0x676, 0x5, 0x9, 0xb, 0x4, 0x1, 0x10, 0x401, 0x5, 0x40, 0x1, 0x8, 0x5, 0x7b, 0x5, 0x80000000, 0x1ff, 0x10001, 0x1, 0x8001, 0x5a97, 0xcd6, 0x3, 0x6, 0xe, 0xfffffe00, 0x7, 0x1, 0x6, 0x2, 0xbe7, 0x2, 0x7da9, 0x1, 0x2, 0x5, 0x6, 0x1, 0x3, 0x1, 0x2, 0x2, 0xffffba4c, 0x81, 0x7, 0x3, 0x3, 0x4e29d3d5, 0xc7, 0x7fff, 0x80, 0x8, 0x664, 0x2, 0x0, 0x3ff, 0x98d, 0x1, 0x5, 0x8, 0x4, 0x401, 0x5, 0x9, 0x1, 0x3b, 0x81, 0x5, 0xfffffff8, 0x4, 0x6, 0x6, 0x10, 0x8, 0x5, 0x1, 0x8001, 0xe, 0x8, 0x3, 0x1000, 0x9, 0x3, 0x6, 0x5, 0x2, 0x50e07c01, 0x4, 0xfff, 0x7fffffff, 0x7, 0x8, 0x7, 0x5, 0xb6, 0x5, 0x7, 0x9, 0x10000, 0xe, 0x7, 0x5, 0x3, 0x3, 0x7, 0x9, 0x400, 0xa, 0x3, 0x1ff, 0x4bf1353a, 0x99, 0x40, 0x3, 0x8, 0x3, 0x3, 0x4, 0x9, 0x3, 0x7, 0xf, 0xc, 0xffffffff, 0x3, 0x4, 0x6, 0xf, 0x6, 0xa626, 0x9, 0x3, 0x4, 0xb5a1, 0x962, 0x5, 0x1, 0x6, 0x8, 0x8, 0x3e00, 0x1, 0x9]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x2}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xfff}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x5}]}, @TCA_FW_MASK={0x8, 0x5, 0x35a}, @TCA_FW_MASK={0x8, 0x5, 0x9}, @TCA_FW_POLICE={0xc80, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0x8}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x5}, @TCA_POLICE_PEAKRATE64={0xc}, @TCA_POLICE_RATE64={0xc, 0x8, 0x100000000}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1, 0x3, 0x100, 0x6, 0x5, 0xfff, 0x40, 0x8, 0x6, 0xc0d7, 0x0, 0x0, 0xeae, 0xfff, 0xc, 0x810, 0xa, 0xffffffff, 0x101, 0x6, 0x0, 0x1ff, 0x8, 0x10000, 0x9, 0x48, 0x9, 0x3, 0x4, 0xcf, 0x7, 0x0, 0x8, 0x8, 0x3, 0xff, 0x2, 0xffff, 0x14e, 0x4, 0x79a9dc21, 0x0, 0x69, 0xf97, 0xca, 0x100, 0xe, 0x1, 0x2, 0x2, 0x40, 0x0, 0x9, 0x1, 0x4, 0x8, 0x1eea, 0x797e, 0x8, 0x2, 0xfffffff8, 0x4, 0x0, 0x3, 0x1, 0x2, 0x7, 0x2, 0xfffffffc, 0xa, 0x4, 0x8, 0x3, 0x80000001, 0x0, 0x4, 0x3, 0x6, 0x46, 0x3, 0x101, 0x4, 0x5, 0x6, 0x6, 0x70724220, 0x5, 0x2, 0x3, 0x6, 0x91cd, 0x0, 0xffffff4c, 0x5, 0xffff6792, 0x5, 0xff, 0x0, 0x6, 0x6, 0x0, 0x4, 0x401, 0x10, 0x0, 0x2, 0x6, 0x4, 0xf, 0xff, 0x7, 0x7, 0x5, 0x5, 0x4, 0x5f2, 0xf60, 0x6, 0x7fff, 0x8, 0x246907e7, 0x80000001, 0x2, 0x7, 0x7, 0x2e, 0xbb2, 0x7, 0xfffffffa, 0x401, 0x8, 0x5, 0x9, 0x10000, 0x9, 0xb, 0xa6bb, 0x1, 0x9, 0x2, 0x1, 0x7, 0x2, 0x1, 0xa227, 0x4, 0x8, 0x0, 0x1, 0x400, 0x3, 0x9, 0x7, 0x91, 0x1, 0x3af6, 0x80000001, 0x3, 0x40, 0x0, 0x0, 0xfffffffa, 0xc8d, 0x4, 0xc, 0x1000, 0x800, 0x4000000, 0x8, 0xc, 0x3, 0x7, 0x5, 0x1, 0x7ff, 0xffffffff, 0x8, 0xa6e, 0x8, 0x5, 0x1ff, 0x10000, 0x7, 0x4, 0x10, 0x2, 0x3, 0x8, 0xac4, 0xffff, 0x7a6, 0x3ff, 0x400, 0x7f, 0x4, 0x401, 0x902, 0x1, 0xfffffff8, 0x2, 0xff, 0x0, 0x2, 0x1, 0x8, 0x2, 0x3, 0x5, 0xa64f19e4, 0x3, 0x8, 0x5, 0x4, 0x4, 0xffffffff, 0x7, 0xaa, 0x8, 0x89e3, 0x100, 0x67, 0xfffffff9, 0x40, 0x6, 0x0, 0xa97, 0x50f, 0x7, 0xfff, 0x7, 0x7ff, 0x60af, 0x631, 0x1, 0x800, 0xad8, 0xd4, 0x9, 0x800, 0x6, 0x7, 0x9, 0x1, 0x3, 0x800, 0x7, 0xfffffff4, 0x7, 0x7, 0x401, 0x9, 0x9a61, 0x2, 0x80000000, 0xffffffff, 0x1]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfff, 0x1, 0xffffffff, 0x8, 0x6, {0x38, 0x2, 0xffb0, 0x2, 0x3, 0x6506}, {0x2, 0x1, 0xc, 0x1, 0x8, 0x6}, 0x1ec0000, 0x5, 0xfff}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1, 0x7ff, 0x8, 0x238f, 0x2, 0x6, 0x4, 0x1, 0xd, 0x6, 0x7, 0x97, 0x3, 0xfffff721, 0x4d, 0x3, 0x6, 0x5, 0x9, 0x80000001, 0x1, 0x5, 0x7f, 0xb, 0x10, 0x5, 0x14, 0x0, 0xff, 0x800, 0x4b8f, 0x2, 0x10000, 0x7, 0x7ff, 0x4, 0x315, 0xf56, 0x8001, 0x6, 0x1, 0x6133, 0x80000, 0x9, 0x80, 0x10001, 0x6, 0x1, 0x8, 0x6, 0x1, 0x3, 0x4, 0x40, 0xca, 0x0, 0x26, 0xb, 0x2, 0x80000000, 0x7, 0xd5, 0xdc3, 0x7fffffff, 0x2, 0x4, 0x6, 0x7, 0x6, 0x80, 0xe, 0x3, 0x40, 0x8, 0x9, 0x5, 0x7, 0x1, 0x8000, 0x8, 0x60, 0x10, 0x400, 0x10001, 0x3, 0x3, 0x8, 0x2, 0xd7a, 0xd, 0x8, 0x3, 0x3f8, 0x10, 0x5, 0x5, 0x3ff, 0x1, 0x8, 0x8400000, 0xfeb, 0x9818, 0x7, 0x6, 0x3, 0x41, 0x5, 0x4, 0xfff, 0x2, 0x5, 0x10000, 0x4, 0x6, 0x4, 0x3, 0xd519, 0x2, 0x6, 0xd, 0xfffffffa, 0x10, 0x80000000, 0x101, 0xfff, 0x6, 0x4, 0xe6, 0x401, 0xfffffff9, 0x1, 0x1, 0x800, 0xf8, 0xe, 0x39b, 0x8, 0x2, 0x6, 0x8, 0x5, 0x2, 0xe, 0x7, 0x5, 0x2000000, 0xe, 0x8954, 0xc4, 0xf, 0xad, 0x5, 0x9, 0x5, 0x9, 0xd, 0xc, 0xffffffff, 0xa, 0x33aa173c, 0x0, 0x7fb, 0x1ff, 0xf9, 0x2, 0x8, 0x0, 0x4, 0x6, 0x8, 0x7fff, 0x5, 0x5, 0xfffffffc, 0x2, 0x6, 0x997, 0x7, 0x3c1, 0x9, 0x0, 0x6eea, 0x2, 0x6, 0x4, 0x0, 0x38d, 0x2, 0x6, 0x5565, 0x6649, 0x3, 0x4, 0x1000, 0x7e, 0x3, 0x74, 0xe9, 0x1627da2a, 0x4, 0x0, 0x2, 0xd, 0x9057, 0x400, 0x8, 0x2, 0xfffff001, 0x9, 0x7, 0x6, 0x0, 0x3440, 0x81, 0x8, 0xa, 0x2a, 0x2, 0x0, 0x8, 0x154, 0x7, 0x80000001, 0x3d01492a, 0x3, 0x5, 0x1, 0x6, 0x7fffffff, 0xc, 0x8, 0x10, 0x8, 0x0, 0x8000, 0xe, 0xffff, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffff, 0x2, 0x9, 0x8, 0xffff, 0xa863, 0xf8000000, 0x8000, 0x1, 0x8, 0x2, 0xfffffffd, 0x800, 0x3ff]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x7}, @TCA_POLICE_RATE={0x404, 0x2, [0x40, 0x3, 0x200, 0x7fff, 0x2, 0x6, 0x2, 0x3, 0x0, 0x7f, 0x1, 0x0, 0x4, 0xff, 0xffffffff, 0x1ff, 0x4, 0x5, 0x80000000, 0xfffffc01, 0x4, 0x6, 0x5, 0x7, 0x8, 0x6, 0x2, 0x7ff, 0xc2c, 0x10d, 0x9, 0x6, 0x2c9, 0x3, 0x8a, 0x7fffffff, 0xfff, 0xe7, 0x4, 0x3, 0x2, 0x7f, 0x101, 0x57ac, 0x8, 0xffff, 0x0, 0x7, 0x2, 0x8, 0x9, 0xfff, 0x6, 0xc32a, 0x7fff, 0x400, 0x3ff, 0x4, 0x0, 0x9, 0x18000000, 0xb, 0x3ff, 0x3, 0x7, 0x4, 0x8, 0x1, 0x3, 0x2, 0x80, 0x4, 0x80000000, 0x0, 0x8, 0x8, 0x4, 0x6, 0x8, 0x79, 0x3, 0x48ea, 0x4, 0x7, 0x5, 0x3, 0x6, 0x1000, 0x1, 0x0, 0x5, 0x10, 0x8, 0x100, 0x3, 0x40, 0x9, 0x6, 0x8, 0x5, 0x97, 0x7, 0x7, 0x80000000, 0x0, 0x101, 0x7448, 0xc, 0x3, 0x2, 0xde50, 0x5, 0x1, 0x1, 0x4, 0x2, 0x1, 0x5, 0xe, 0x3, 0xa, 0x1, 0x1, 0x200, 0xb90, 0x4, 0x5, 0x9, 0x8, 0x6, 0x1f, 0x7, 0x10001, 0xf7, 0x200, 0x9, 0x3, 0x200, 0x0, 0xb760, 0x1, 0x2, 0x6, 0x8, 0x4415, 0x2c, 0x10, 0x9, 0x2ed6b41e, 0xff, 0x7, 0x4, 0x10000, 0x5, 0x5, 0x1000, 0x9, 0x7, 0x7fffffff, 0xbf, 0x0, 0x6, 0x1, 0x3, 0x3, 0x2, 0x85, 0x8000, 0x1, 0x0, 0x5, 0x8, 0x10, 0x2, 0x6, 0x77b5, 0x0, 0x9, 0x1, 0x10000, 0xff, 0xffffffaf, 0x8, 0x152, 0x81, 0x8, 0x31ea, 0x6f3b, 0x2b, 0x6fb, 0x1, 0x7, 0x0, 0x3, 0x1000, 0x3, 0xbedf, 0xcea, 0x4681, 0x3, 0x2, 0x80000000, 0x2, 0xfff, 0x100, 0x1000, 0x7, 0xffff8001, 0x400, 0x4, 0x9, 0x9, 0xe, 0x2, 0x1, 0x9, 0x8, 0x9, 0x7, 0x9, 0xa, 0x9, 0x1, 0x9, 0x56, 0x7, 0x3, 0x9, 0x7, 0x5, 0x0, 0x5, 0xfffffffd, 0x9, 0x8, 0x789, 0x1, 0x6, 0x0, 0xbf07, 0xe84, 0x0, 0x60000000, 0xff, 0x5, 0x4, 0x6, 0x1, 0xfffffff2, 0x5, 0x9, 0xffff4648, 0x0, 0x4d01, 0x8, 0x5]}]}, @TCA_FW_MASK={0x8, 0x5, 0x7}, @TCA_FW_CLASSID={0x8, 0x1, {0xfff1, 0x8}}]}}, @filter_kind_options=@f_fw={{0x7}, {0xcc0, 0x2, [@TCA_FW_INDEV={0x14, 0x3, 'wg1\x00'}, @TCA_FW_POLICE={0x418, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0xbfa8}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x8000, 0xd0, 0x9, 0x0, 0x4, 0x8000, 0x9, 0x81, 0x2, 0x3, 0x1, 0xff, 0x1, 0xd, 0x2, 0x88f, 0x8, 0xfc, 0x8, 0x18, 0x2, 0xa00, 0xc8, 0x1, 0xeff, 0xfffffff8, 0x5, 0x400, 0x9, 0x8000, 0x4, 0x2, 0xb, 0x6, 0x3, 0xfffffff9, 0x8, 0x6, 0xff, 0x0, 0x1, 0x3a53, 0x6b, 0x4, 0x5, 0x8, 0x7, 0x3, 0x101, 0x7, 0x3, 0x3, 0x7, 0x5, 0x1, 0x0, 0x101, 0x5, 0x5, 0xfffffff7, 0x7, 0x6, 0x1, 0x3, 0x0, 0xf, 0x6, 0x1ff, 0x1000, 0x400, 0x80, 0x7, 0x4, 0x8, 0x9, 0x80000000, 0x5, 0x9, 0xffffffff, 0x6, 0x1, 0xb16, 0x7fff, 0x8, 0x1000, 0xd63, 0x7, 0x401, 0x2, 0xd, 0x10000, 0x0, 0x8001, 0x2, 0xfffffffb, 0x10000, 0x0, 0x4, 0x6, 0x8, 0x3, 0xfffffffc, 0x4, 0x6, 0x4, 0x193, 0xffffffff, 0x4, 0x5, 0x10000, 0x9e, 0x59c, 0x7, 0x100, 0x10000, 0x4, 0x4, 0x489a, 0xf, 0x1, 0x7ff, 0x3, 0x400, 0x2, 0x29, 0xa8d, 0xc94, 0x7, 0x0, 0x7, 0x4040155, 0x2, 0x2, 0xe1, 0x9, 0x4, 0x3, 0x3, 0x8000, 0x3, 0x401, 0x5, 0xd, 0xff, 0xfffff001, 0x4, 0x1ff, 0x7, 0x0, 0x9, 0x3, 0xe9c, 0x7, 0x5, 0x0, 0x8, 0x0, 0x1f, 0x1, 0x9501, 0x9, 0xaf, 0x4, 0x307, 0x7ff, 0x0, 0x2, 0x6, 0x1, 0x7, 0x1, 0x4, 0xdce, 0x2, 0x0, 0xfd, 0x1000, 0x7, 0x33, 0x4e, 0x2, 0x8, 0x8, 0x52, 0x0, 0x8, 0x80000001, 0x7, 0xe729, 0x10001, 0xc, 0x2, 0x5f55, 0x8, 0x531, 0x7f, 0x5, 0x360f2900, 0x9, 0x9, 0x3, 0x5, 0x3ff, 0x398e, 0x6, 0x7f, 0xe981, 0x0, 0x8, 0xffffffff, 0xc7, 0x1000, 0x2, 0x6, 0xffff, 0xf71, 0x3ff, 0x6b6af36f, 0x9, 0x7344, 0x0, 0x6, 0x7, 0x8ffd, 0x1, 0xffff09fa, 0x101, 0xb, 0xff, 0x1, 0x5, 0x9, 0x3, 0xffff97a5, 0x4, 0x6d5, 0xc, 0x81, 0x0, 0x5, 0xf0, 0x80000001, 0xfffffffa, 0xfffffffa, 0x3ff, 0x9, 0x2, 0x8, 0x4, 0x3, 0x4, 0x2, 0xd, 0xa7e, 0x5]}, @TCA_POLICE_RESULT={0x8}]}, @TCA_FW_POLICE={0x850, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x80, 0xcb, 0x1a, 0x1, 0x8, 0x2, 0x3, 0xfffffff7, 0x9, 0x6, 0x7f83, 0xe, 0x988d, 0x3, 0x40ca, 0x2, 0xf19, 0x6, 0x7, 0x8, 0x24, 0x5, 0x349, 0x3, 0x6, 0x2cd, 0xfffff5e1, 0x30e3, 0x3ec2, 0x8000, 0x0, 0x101, 0x9, 0x4, 0xd8, 0x1, 0x9, 0x9, 0xfffffff9, 0x5, 0x63e277a3, 0x7, 0x6, 0x0, 0x8000, 0x69d, 0x7fff, 0x2, 0xfffffff1, 0x1, 0x7, 0x3d54, 0x1, 0x2, 0x9b0, 0x2, 0x9, 0x7, 0x1ff, 0x80000001, 0x64a, 0x8, 0x0, 0xd, 0x2, 0x9, 0x14, 0xae, 0x8, 0x2, 0x8, 0x54d, 0x3, 0x7, 0x9175, 0x1, 0x2, 0x9, 0x9, 0x2, 0x101, 0x4, 0xa0cc, 0x7, 0x8, 0x4, 0x0, 0xffffffff, 0x91, 0x9cbc, 0x1, 0x0, 0x81, 0x9, 0x2, 0x8522, 0x80000000, 0x6, 0xc, 0x2, 0x2, 0x6, 0x7, 0x9, 0x5, 0x6, 0x80000000, 0xfff, 0x7ff, 0x10, 0x1, 0x5, 0x0, 0x2, 0x7, 0x6, 0x6, 0x2, 0xa81f, 0x7, 0x8, 0x6, 0x4, 0x579f81e1, 0x0, 0x0, 0x4, 0x401, 0x2, 0x9b10, 0x6, 0x7, 0x4, 0x7, 0x1, 0x492, 0x101, 0xffff, 0x6, 0x3ff, 0x0, 0x7, 0x8, 0x5, 0xffff, 0x101, 0x6, 0x5, 0x5, 0x3, 0xff, 0x5, 0x3, 0x7fffffff, 0x4, 0xf, 0x8, 0x9, 0x7, 0x3, 0x9, 0x0, 0x0, 0xfff, 0x77, 0x1, 0x10, 0x8, 0x7, 0x3, 0x2d, 0x9, 0x4c, 0x7, 0x25d375cc, 0x5, 0x5c2, 0x6, 0x0, 0xb5e, 0x7, 0xffffffff, 0xfd72, 0x2, 0xe, 0xffff, 0x3, 0x8001, 0x0, 0xa, 0x9, 0x80000001, 0x6, 0x6d2, 0xfffffff7, 0x2, 0x7f, 0x4, 0x80000001, 0x10000, 0x0, 0x7, 0x3, 0x7, 0x46c, 0x9ed, 0x0, 0x4, 0xfffffff8, 0x7, 0x4, 0x0, 0x0, 0x2, 0x6, 0x6, 0x2, 0x1, 0x8, 0x9, 0xfda, 0x2, 0xffffffcf, 0x7, 0x9, 0x7, 0x3, 0x4, 0x1, 0x200, 0x10001, 0x2, 0xdc4, 0x8, 0x606, 0x25a6fb83, 0x8, 0x9, 0xbb5e, 0x4, 0x0, 0x5e, 0x1, 0x1, 0x800, 0x80, 0x6, 0x2800, 0x9, 0x4ba, 0x1, 0xc000, 0xfe8, 0xff, 0xff, 0x1]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x800}, @TCA_POLICE_RATE={0x404, 0x2, [0x5, 0xc, 0x1, 0x96e7, 0xfffffff8, 0x6, 0x9a1, 0xb66e, 0x1, 0x0, 0x8000, 0x9, 0xb54, 0x8, 0x3bb, 0x4, 0x8, 0x0, 0x10, 0x4, 0xfffffffb, 0x5, 0x98, 0x9, 0xf3, 0x8001, 0xd, 0x7, 0x7, 0x3, 0x5, 0x3, 0x8000, 0x2, 0x9, 0x9, 0x6, 0x8, 0x0, 0x2, 0x0, 0x3, 0x0, 0x6, 0x6, 0xec, 0x80000001, 0x100, 0x10, 0x9, 0x9, 0x92ac, 0x923, 0xa007, 0xfd1c, 0x7, 0xe5, 0x0, 0x1, 0xf12, 0x2, 0x4, 0xc, 0x1, 0x6, 0x9, 0x1f37, 0xbae, 0x56, 0x412, 0x80000001, 0xfff, 0x5, 0x8, 0x59, 0xf80, 0x3, 0x5, 0x600, 0xe877, 0xa401, 0x5, 0x2, 0xf4, 0x1, 0x0, 0xffffffff, 0x8, 0x9604, 0x5, 0x800, 0x3, 0x4, 0x400, 0x7, 0xffff, 0x2, 0xd, 0xae24, 0xf4, 0x1, 0x8, 0xf, 0x7, 0xff, 0x8, 0x4, 0xa, 0x4, 0x5, 0x6, 0x8001, 0xfffffffa, 0x5, 0x9, 0x5, 0x5d4b, 0x5, 0x400, 0x80000000, 0x738, 0xffff, 0xfa7, 0xffff, 0x0, 0x2, 0xffff8000, 0x5, 0xeaf, 0x8, 0x6, 0x7, 0x9, 0x1, 0x8, 0x2, 0x7fffffff, 0x3, 0xfae, 0xffffffc4, 0x8001, 0x80000000, 0x3, 0x9422, 0x80000001, 0x1, 0x5, 0x1, 0x7fff, 0xd, 0x101, 0x81, 0x3, 0x1000, 0xffffff3f, 0x80000000, 0x8001, 0x1, 0xfffffffe, 0x1ff, 0x75, 0xf41, 0x100, 0x1, 0xfffffff8, 0x639, 0x5, 0x400, 0x3, 0x62ee, 0x7, 0x6, 0x2, 0x6, 0x6, 0x1, 0x4b94, 0x3, 0x6, 0xb15f, 0x401, 0x5, 0x2, 0x3a37, 0x2, 0xe717, 0x6, 0x6, 0x6, 0x8, 0x4, 0x54, 0x2, 0x9, 0x8, 0x2, 0x1e, 0xfffffff8, 0xd, 0x3, 0x3, 0x1, 0x9, 0xbc07, 0xfffffff6, 0xa7a, 0xfffffffe, 0x9, 0x6, 0x81, 0x80000000, 0x54e9efb6, 0x1, 0x9, 0xff, 0x2, 0x4, 0x2, 0x0, 0x6d02, 0x6, 0x0, 0x9, 0x10, 0xa65, 0xfffffff7, 0x1b78, 0x12, 0x9, 0x10001, 0x548, 0xfffffffd, 0xf59, 0x8, 0x101, 0xe, 0x3, 0x84, 0xfff, 0x2, 0x9, 0x2, 0xffff8000, 0x7, 0x78e, 0x2, 0x780, 0x3, 0x6, 0x5, 0x3, 0x3, 0x3b, 0x4, 0x6, 0x40]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x7, 0xfd, 0x3, 0xf4, {0x2f, 0x2, 0x6, 0x4, 0xa66, 0xe628}, {0x2, 0x2, 0x6, 0x1, 0x40, 0x5}, 0xffff6720, 0x5, 0x3}}]}, @TCA_FW_POLICE={0x10, 0x2, [@TCA_POLICE_RATE64={0xc, 0x8, 0x5}]}, @TCA_FW_INDEV={0x14, 0x3, 'veth1_vlan\x00'}, @TCA_FW_INDEV={0x14, 0x3, 'veth0_to_batadv\x00'}, @TCA_FW_MASK={0x8, 0x5, 0x2}]}}, @TCA_CHAIN={0x8, 0xb, 0x3}, @TCA_RATE={0x6, 0x5, {0x5, 0xf7}}, @TCA_RATE={0x6, 0x5, {0x2, 0x2}}]}, 0x2638}, 0x1, 0x0, 0x0, 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x19, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffea4, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='sys_enter\x00', r6, 0x0, 0x4}, 0x18) get_robust_list(0x0, &(0x7f0000000580)=0x0, &(0x7f00000005c0)) ioctl$TCFLSH(r0, 0x540b, 0x1) 2m59.937078794s ago: executing program 3 (id=176): socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) r0 = add_key$keyring(0x0, &(0x7f0000001100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000300)="300e30", 0x3, r0) add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc3}, 0x0, 0x0, r0) fsopen(&(0x7f0000000040)='bdev\x00', 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = open(&(0x7f0000000040)='./bus\x00', 0x145142, 0x0) sendfile(r2, r2, 0x0, 0x800000009) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_timeval(r5, 0x1, 0x15, &(0x7f0000000740)={0x77359400}, 0x10) setns(0xffffffffffffffff, 0x2000000) r6 = gettid() r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed074479000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = gettid() capget(&(0x7f0000000000)={0x20071026, r8}, &(0x7f0000000040)={0x5, 0x7, 0x4, 0x5, 0x0, 0x7}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000040)='sched_switch\x00', r7, 0x0, 0x2000000005}, 0x18) socketpair(0x18, 0x0, 0x2, &(0x7f0000000000)) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x500, 0x0, 0x2000040}, 0xc, &(0x7f0000000240)={&(0x7f0000000800)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000ffdbdf2514000000080001000100000008000300", @ANYRES32=0x0, @ANYBLOB="08001c00", @ANYRES32=r6], 0x2c}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000000) unshare(0x24020400) r9 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$RTC_WKALM_SET(r9, 0x40187014, 0x0) 2m58.826758341s ago: executing program 3 (id=187): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) r3 = syz_open_dev$vcsa(&(0x7f0000000080), 0x9, 0x80200) getpid() socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, &(0x7f00000001c0)={[{@nodiscard}]}, 0xff, 0x257, &(0x7f0000000500)="$eJzs3U9oFFccB/DfzO42TbKUtL0USv9AKaUNhPRW6CW9tBAoIZRSaAsppfSiJEJM8JZ48uJBj6KSk5cg3oweJZfgRRE8Rc0hXgQNHgweVFjZnQTyTxOzmx1xPh+YzEzy5v3eMPN9ExaGDaCweiJiICJKEdEbEZWISDY2+DJbetZ2ZzoXRiJqtd8eJ4122X5m/bjuiJiOiB8iYj5N4lA5YnLur+Wni798c3Ki8vWFuT8723qSa1aWl35dPT904vLg95M3bz8cSmIgqpvOq/WSHX5XTiI+Oohib4mknPcI2IvhY5fu1HP/cUR81ch/JdLILt6p8ffmK/HduVcde/rRrU/bOVag9Wq1Sv0ZOF0DCieNiGokaV9EZNtp2teX/Q9/t9SVHh4bP9r7/9jE6H95z1RAq1Qjln6+2nGle0v+H5Sy/APvqOxDqaXfh2fv1TdWS3kPCGiLz7JV/fnf+8/UtyH/UDjyD8Ul/1Bc8g/FJf9QXPIPxSX/UFzyD8Ul/1Bc+87/mRcHNyigLTbmHwAollrHvt4abv2LyEDb5T3/AAAAAAAAAAAAAAAAAAAA2810LoysL63psbxri+tnI1Z+yppur19qfB9xxPuNn11Pkk09Jnuq8Hp/f9FkB026mPPb1x/cz7f+jc/zrT81GjF9PCL6y+Xt91+ydv/t34e7/L3yb5MF3lCyZf/HP9pbf6vns/nWH1yMuFaff/p3mn/S+KSx3nn+qdavX5P1jzxrsgMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADa5mUAAAD//7FLbdg=") r4 = open(&(0x7f0000000080)='./file0\x00', 0x40c5, 0x130) r5 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x51) write$9p(r4, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117", 0x59) sendfile(r4, r5, 0x0, 0x400000000e063) creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x803, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000004c0)=@generic={&(0x7f0000000480)='./file0\x00', 0x0, 0x8}, 0x18) ioctl$IOC_PR_PREEMPT_ABORT(r3, 0x401870cc, &(0x7f0000000100)={0x7d33, 0x3, 0x17f1, 0x8}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r1}, &(0x7f0000000800), &(0x7f0000000840)=r2}, 0x20) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000002c0)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) kexec_load(0x3e00, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[], 0xec}, 0x1, 0x0, 0x0, 0x4085}, 0x24000050) 2m58.82650975s ago: executing program 32 (id=187): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) r3 = syz_open_dev$vcsa(&(0x7f0000000080), 0x9, 0x80200) getpid() socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, &(0x7f00000001c0)={[{@nodiscard}]}, 0xff, 0x257, &(0x7f0000000500)="$eJzs3U9oFFccB/DfzO42TbKUtL0USv9AKaUNhPRW6CW9tBAoIZRSaAsppfSiJEJM8JZ48uJBj6KSk5cg3oweJZfgRRE8Rc0hXgQNHgweVFjZnQTyTxOzmx1xPh+YzEzy5v3eMPN9ExaGDaCweiJiICJKEdEbEZWISDY2+DJbetZ2ZzoXRiJqtd8eJ4122X5m/bjuiJiOiB8iYj5N4lA5YnLur+Wni798c3Ki8vWFuT8723qSa1aWl35dPT904vLg95M3bz8cSmIgqpvOq/WSHX5XTiI+Oohib4mknPcI2IvhY5fu1HP/cUR81ch/JdLILt6p8ffmK/HduVcde/rRrU/bOVag9Wq1Sv0ZOF0DCieNiGokaV9EZNtp2teX/Q9/t9SVHh4bP9r7/9jE6H95z1RAq1Qjln6+2nGle0v+H5Sy/APvqOxDqaXfh2fv1TdWS3kPCGiLz7JV/fnf+8/UtyH/UDjyD8Ul/1Bc8g/FJf9QXPIPxSX/UFzyD8Ul/1Bc+87/mRcHNyigLTbmHwAollrHvt4abv2LyEDb5T3/AAAAAAAAAAAAAAAAAAAA2810LoysL63psbxri+tnI1Z+yppur19qfB9xxPuNn11Pkk09Jnuq8Hp/f9FkB026mPPb1x/cz7f+jc/zrT81GjF9PCL6y+Xt91+ydv/t34e7/L3yb5MF3lCyZf/HP9pbf6vns/nWH1yMuFaff/p3mn/S+KSx3nn+qdavX5P1jzxrsgMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADa5mUAAAD//7FLbdg=") r4 = open(&(0x7f0000000080)='./file0\x00', 0x40c5, 0x130) r5 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x51) write$9p(r4, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117", 0x59) sendfile(r4, r5, 0x0, 0x400000000e063) creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x803, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000004c0)=@generic={&(0x7f0000000480)='./file0\x00', 0x0, 0x8}, 0x18) ioctl$IOC_PR_PREEMPT_ABORT(r3, 0x401870cc, &(0x7f0000000100)={0x7d33, 0x3, 0x17f1, 0x8}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r1}, &(0x7f0000000800), &(0x7f0000000840)=r2}, 0x20) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000002c0)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) kexec_load(0x3e00, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[], 0xec}, 0x1, 0x0, 0x0, 0x4085}, 0x24000050) 2m36.432644945s ago: executing program 5 (id=553): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000001ec0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r4}, 0x10) mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) 2m36.369901965s ago: executing program 5 (id=557): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000040000000400000001"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000001b80)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r1, 0x0, 0x9}, 0x18) perf_event_open(&(0x7f0000000e00)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x40000, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tkill(0x0, 0xe) r2 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f0000001440)=ANY=[], 0xc0) process_vm_writev(0x0, &(0x7f0000000000)=[{&(0x7f0000000780)=""/247, 0xf7}], 0x1, &(0x7f0000000d00)=[{&(0x7f0000000580)=""/29, 0x1d}, {&(0x7f00000005c0)=""/57, 0x39}, {&(0x7f0000000880)=""/16, 0x10}, {&(0x7f00000008c0)=""/32, 0x20}, {0x0}, {&(0x7f0000000a40)=""/138, 0x8a}, {&(0x7f0000000bc0)=""/157, 0x9d}, {&(0x7f0000000c80)=""/101, 0x65}], 0x8, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000202300800000000025ad9835850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) pipe2$9p(0x0, 0x0) r4 = socket(0x200000000000011, 0x2, 0x1) bind$packet(r4, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x6a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa424e1aa2e0d408004500001402"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x43}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3, 0x0, 0x4}, 0x18) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r0, 0xe0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd4, 0x8, 0x0, 0x0}}, 0x10) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff3d) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x5f}, 0x18) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000014c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x54c, 0x42f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x80, 0x20, 0x8, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x1, 0x3, 0x2, {0x9, 0x21, 0x0, 0x3, 0x1, {0x22, 0xcda}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x3, 0x3, 0x31}}}}}]}}]}}, 0x0) close_range(r6, 0xffffffffffffffff, 0x200000000000000) 2m35.257086482s ago: executing program 5 (id=574): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x1000410, &(0x7f0000000100)={[{@grpid}, {@grpquota}]}, 0x44, 0x4eb, &(0x7f0000000540)="$eJzs3c9vVFsdAPDvnXZoKQMFZaFGBRFFQ5j+ABqCC2GjMYTESFy5gNoOTdMZpum0SCuLsnRvIokr/RPcuTBh5cKdO925wYUJKnkv9CVvMS/3zqUd2g7te7Qd6Hw+ye2955xhvufMcM6Ze2B6AuhZZyNiNSKORMS9iBjO85P8iButI33cq5ePp9ZePp5Kotm8878kK0/zou3PpI7lzzkYET/7ccQvk61xG8src5PVamUhT48s1uZHGssrl2YLec74xNjE6LXLV8f3rK1nan968aPZWz//y5+/8fzvq9//dVqt0m+OZ2Xt7dhLraYXo9SW1x8Rt/YjWJf0539/+PCkve1LEXEu6//D0Ze9mwDAYdZsDkdzuD0NABx26f1/KZJCOV8LKEWhUC631vBOx1ChWm8sXhyuLz2YjmwN62QUC/dnq5XRfK3wZBSTND2WXW+kxzelL0fEqYj47cDRLF2eqlenu/nBBwB62LFN8//HA635HwA45Aa7XQEA4MCZ/wGg95j/AaD3fI7537cDAeCQcP8PAL3H/A8AvWfH+f/JwdQDADgQP719Oz2aa/nvv55+uLz0g9LDS9OVxly5tjRVnqovzJdn6vWZaqU81Wzu9HzVen1+7Mp6srG8crdWX3qweHe2NjlTuVsp7nN7AICdnTrz7J9JRKxeP5od0baXg7kaDrdCtysAdE1ftysAdI3v80Dv2sU9vmUAOOS22aL3DR3/i9BTm7/Ch+rCV63/Q6+y/g+964ut//9wz+sBHDzr/9C7ms3Env8A0GOs8QPv9O//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0KNK2ZEUytle4Kvpz0K5HHE8Ik5GMbk/W62MRsSJiPjHQHEgTY91u9IAwDsq/CfJ9/+6MHy+tLn0SPLJQHaOiF/9/s7vHk0uLi6Mpfn/X89ffJrnjx/pRgMAgHY3tma15un83HYj/+rl46nXx0FW8cXN1uaiady1/GiV9Ed/dh6MYkQMfZTk6Zb080rfHsRffRIRX9lo/6O2CKVsDaS18+nm+Gns4/sQf+P13xy/8Eb8QlaWnovZa/HlPagL9JpnN1vjZN730i6W979CnM3O2/f/wWyEenevx7+1LeNfYX3869sSP8n6/Nn19Ntr8uLKX3+yJbM53Cp7EvG1/u3iJ+vxkw7j7/ldtvFfX//muU5lzT9EXIjt47fUsmF2ZLE2P9JYXrk0W5ucqcxUHoyPT4xNjF67fHV8JFujbv3823Yx/nv94olO8dP2D3WIP7hD+7+zy/b/8dN7v/jWW+J/79vbv/+n3xI/nRO/u8v4k0M3Om7fncaf7tD+nd7/i7uM//zfK9O7fCgAcAAayytzk9VqZWGHi/Sz5k6PcfFhXsRqxHtQDRfv1UW3RyZgv210+m7XBAAAAAAAAAAAAAAA6KSxvDI3EPv7daJutxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDD67MAAAD//w/PzvM=") mkdirat(0xffffffffffffff9c, &(0x7f0000001dc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) rename(0x0, &(0x7f0000000200)='./file0\x00') 2m35.165863114s ago: executing program 5 (id=577): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000de0000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r0}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) io_cancel(0x0, &(0x7f00000006c0)={0x0, 0x300, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x400}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) r2 = perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30004, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x100000001, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x9, 0x4, 0x8, 0xe, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00'}, 0x10) r3 = syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1148889, &(0x7f0000000640)={[{@nodioread_nolock}, {@dax_never}, {@sysvgroups}, {@commit={'commit', 0x3d, 0x3}}, {@lazytime}]}, 0x5, 0x4f3, &(0x7f000001b440)="$eJzs3d1rW+cZAPBHku3YibN8bIwkgyWQQfZBLH8wYm+DsattF4GxwG42yDxb8TLLkbHkLDa5cLa7XOxibLRQetH7/gW9aa4aAqXXLb3tVUloUxfakoKKjiTHH5KjtraU+Px+cKJzzqvoeV/Zz+uj97xHJ4DUOlf7JxMxHBHvRMSx+ubWJ5yrP6w/vj1TWzJRrV75KJM8r7bdfGrz/x2JiLWIGIyIP/424m+ZnXHLK6vz08ViYamxna8sLObLK6sXry9MzxXmCjfGJi9NTU2OToxP7Vlb7/7nH3cvv/H7gdc/+/fD+/99681atYYbZZvbsZfqTe+PE5v29UXEr/YjWA/kGu0Z6nVF+EZqP7/vRsT5JP+PRS75aXbmyb7WDNhv1Wq1+mX1ULvitSpwYGWTY+BMdiQi6uvZ7MhI/Rj+e3E4WyyVKz+7Vlq+MVs/Vj4e/dlr14uF0cZnhePRn6ltjyXrT7fHt21PRCTHwP/LDSXbIzOl4mx3uzpgmyPb8v/TXD3/gZTo/CM/cNDIf0gv+Q/pJf8hveQ/pJf8h/SS/5Be8h/SS/5DerXK/6M9qAfQfbv9/R/oYj2ArvrD5cu1pdq8/n325sryfOnmxdlCeX5kYXlmZKa0tDgyVyrNJdfsLDzr9Yql0uLYz2P5Vr5SKFfy5ZXVqwul5RuVq8l1/VcL/V1pFdCJE2fvvZeJiLVfDCVLbPqTL1fhYKtWM9Hra5CB3sj1ugMCesapP0ivr/EZv+2XhAEvthZf0bth8Ejbol/H4r5UB+iC7G6FTx50ryJA11047fwfpJXxf0gv4/+QXo7xgd3G/6NxL7+WjP/DC2vX8X/gQBtuc/+vo5vu3TUaEd+JiHdz/Yea9/oCDoLsh5nG8f+FYz8a3l46kPk8OUUwEBH/fOXKS7emK5Wlsdr+jzf2V15u7B/vRf2B9raO8DXztJnHAEB6rT++PdNcuhn30W/qkxB2xu9rjE0OJkcwh9czW+YqZPZo7sLanYg41Sp+pnG/8/qZj8PruR3xTzYeM/WXSOrbl9w3vTvxT2+K/8NN8c9863cF0uFerf8ZbZV/2SSnYyP/tvY/w3s0d6LZ/zXnXG+O3+z/cm36v7Mdxvj7q/9qdXo3mez96E7EmZb9bzPeYBJre/xa3S50GP/hX/70/XZl1dfqr9MqflNtLV9ZWMyXV1YvXm/WYvLS1NTk6MT4VD4Zo843R6p3+uWpt++3i19rf0Ob9r+/o/1DjTr9pMP2f/GDB38+t0v8H59v/ft3Mnnc9v5Xqxt1+GmH8T8Z/+Cv7cpq8WfbvP/ZVvGjWRox0WH88v9/59phAHiOlFdW56eLxcKSFStWnu+Vvuhi0Gf1HGvd6aCAffM06XtdEwAAAAAAAAAAAKBT7Wb/3tvD6cS9biMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwEHwVQAAAP//QUvQlg==") name_to_handle_at(r3, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x2dd99d9078f89baf) syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000280)='./bus\x00', 0x810408, 0x0, 0xff, 0x0, &(0x7f00000007c0)) rename(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='./file0\x00') ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f00000003c0)={0x1800, 0x2, 0x2}) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x10, &(0x7f0000000140)={[{@block_validity}, {@prjquota}, {@noblock_validity}, {@nobarrier}, {@auto_da_alloc}, {@mblk_io_submit}, {@nodelalloc}]}, 0xfe, 0x4bb, &(0x7f0000001180)="$eJzs3M1vVFUbAPDnTj/4pry8vLzvy4dU0dj40dKCysLEaHSniYkucGNS20KQgRpaEiFEqjG4NCTujStj9C9wpRuirkzc6t6QECUY0IWMuXPvHaal09JhPoD+fsnAOb1n5pxnzv0495yZCWDVGkz/SSI2RsTPETGQZecXGMz+u37l7MSfV85OJFGpvPZbUi137crZiaJo8bwNeWaoFFH6MMkrmW/m9Jlj4+Xy1Mk8PzJ7/J2RmdNnnjx6fPzI1JGpE2MHDx7YP/rM02NPtSTONK5rO96b3pX0vnHhlYlDF976/qveiNi+O9teH8cdKW2oJQfTwH+vVC0s9khLKrt7bKpLJ71dbAgr0hMRaXf1VY//geiJm503EC990Oh5fZ1qINA26bVpTePNczcqwP0riW63AOiO4kKf3v8Wjw4NPe4Kl5/PboDSuK/nj2xLb5TyMu281/lfRBya++vT9BF5P/y9sY0VAgCr3jfp+OeJxcZ/pdheV25zvoayJSL+FRFbI+LfEbEtIv4TUS3733w8sxLZ0lBPLX/r+LN0qengbkM6/ns2X9uaP/7LRn+VSuVGT57bVI2/Lzl8tDy1L39PhqJvTZofXaKOb1/86eNG2wbrxn/pI62/GAvm7bjUu2CCbnJ8drxVg9LL70fs6F0s/qS2EpBExP8jYsfKXnpzkTj62Be7GhVaPv4ltGCdqfJZxKNZ/8/FgvgLydLrkyNrozy1b6TYK271w4/nX21U/x3F3wJp/6+fv/8vKDFwNalfr51ZeR3nf/mo4T1ls/t/f/J6dc26P//bu+OzsydHI/qTl6v5/nN1fx+7+dwiX5RP4x/aW4t/Tf3xvzVLXEzj3xkR6U68OyIeiIg9edsfjIiHImJvowDXRXz3wsNvNxP/Hx24D0zjn1z0/Ffb/7fM7/+VJ3qOXfy6mfgzaf8fqKaG8vNw9fy3jMbNifJUelpvem8GAACAe096P70xktJwLV0qDQ9nn+HfFutL5emZ2ccPT586MZl9R2BL9JWKma6BfD40vdseTebyV8zmR8fyueJivnR/Pm/8Sc+6an54Yro82eXYYbXb0OD4T/3a0+3WAW3n+1qwei08/ktdagfQea7/sHo1c/w/14Z2AJ3n+g+rV93x/+Wp8zuriezz03tqGxZdC1jil0OAe0P99f9MF9sBdN7y4//77ecqgUJx/C+/7ne17W0BOqvZ+b/TLW4H0FF38r3+5hP90f66+lv3grG2k2/U533d6ZQVJqK0VJk3o+MNi7vibbmNRP7Tm+duq3Cy5I9ZtDHR7TMTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAa/wTAAD//9QP9q0=") r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000100)={0xf1e5b317, 0x800000, 0x0, 0xfffffffc, 0x40001000}) newfstatat(0xffffffffffffff9c, &(0x7f00000004c0)='.\x00', &(0x7f0000005280), 0x0) pread64(r4, &(0x7f0000001240)=""/102400, 0x19000, 0x3) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x30046, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0200000500000002000000001000000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000280), 0x4) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000ac0)={0x0, @in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x33}}}, [0x5, 0x10000, 0x4, 0xeb, 0xd303, 0x9, 0xb3f, 0x59f5, 0x1, 0x3, 0x5, 0x81, 0x9, 0x3ff, 0x8]}, &(0x7f0000000480)=0x100) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000004c0)=@assoc_value={r6, 0x5cfd}, &(0x7f0000000540)=0x8) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0xa, 0xa, 0xfffffff8) 2m35.029077746s ago: executing program 5 (id=581): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000001ec0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r4}, 0x10) mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) 2m34.918568987s ago: executing program 5 (id=583): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000002000000000000000018090000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r1}, 0x10) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r2, &(0x7f0000000040)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) socketpair(0x9, 0x4, 0x81, &(0x7f0000000400)) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) sendmsg$inet(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x20008084) sendmmsg$inet_sctp(r2, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000300)='5', 0x1}], 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c"], 0x30}], 0x1, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x2}, 0x8) sendto$inet6(r5, &(0x7f00000000c0)="1a", 0x1, 0x0, &(0x7f0000000280)={0xa, 0x4e23, 0xfffffffd, @loopback, 0x10000}, 0x1c) sendmmsg$sock(r5, &(0x7f00000004c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000080)="d7", 0x1}], 0x1}}], 0x1, 0x40448c0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000dd0000000000003b810000850000006d000000a50000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0xd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000000c0)='kfree\x00'}, 0x18) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xb0a54e68b1cd2fdb, 0x103) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065fffff53000000800395032303030"], 0x15) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r7, &(0x7f0000000300)=ANY=[], 0x15) r8 = dup(r7) write$P9_RLERRORu(r8, &(0x7f0000000540)=ANY=[@ANYBLOB="8b"], 0x53) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r8]) 2m19.834502263s ago: executing program 33 (id=583): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000002000000000000000018090000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r1}, 0x10) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r2, &(0x7f0000000040)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) socketpair(0x9, 0x4, 0x81, &(0x7f0000000400)) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) sendmsg$inet(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x20008084) sendmmsg$inet_sctp(r2, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000300)='5', 0x1}], 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c"], 0x30}], 0x1, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x2}, 0x8) sendto$inet6(r5, &(0x7f00000000c0)="1a", 0x1, 0x0, &(0x7f0000000280)={0xa, 0x4e23, 0xfffffffd, @loopback, 0x10000}, 0x1c) sendmmsg$sock(r5, &(0x7f00000004c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000080)="d7", 0x1}], 0x1}}], 0x1, 0x40448c0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000dd0000000000003b810000850000006d000000a50000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0xd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000000c0)='kfree\x00'}, 0x18) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xb0a54e68b1cd2fdb, 0x103) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065fffff53000000800395032303030"], 0x15) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r7, &(0x7f0000000300)=ANY=[], 0x15) r8 = dup(r7) write$P9_RLERRORu(r8, &(0x7f0000000540)=ANY=[@ANYBLOB="8b"], 0x53) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r8]) 3.658755155s ago: executing program 6 (id=3541): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e00000000000000001801", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000200)='cpuset.mem_hardwall\x00', 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6tnl0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080)) 3.565130087s ago: executing program 6 (id=3546): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0100000004000000080000000b"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x2008042, &(0x7f00000000c0), 0x1, 0x571, &(0x7f0000000780)="$eJzs3c+PG1cdAPDvzP5yk7SbQA9QAQlQCCiKnXXaqOql5QJCVSVExQFxSJddZ7XEjkPsLd0lUrd/A0ggcYI/gQMSB6SeOHDjiMQBEOWAVCACJUgcBs3Yu+ts7MSNvXaz/nykybyZN+Pve/bOvOdnxy+AmXUuInYjYjEi3oyI5e7+pLvEq50lP+7undtr9+7cXksiy974Z1Lk5/ui55zcye5jliLim1+L+G7yYNzW9s711Xq9dqu7XWk3blZa2zsXNxurG7WN2o1q9crKlUsvXX6xOra6nm388oOvbr72rd/8+tPv/373yz/Mi3Wqm9dbj3HqVH1hP05uPiJeO4pgUzDXXS9OuRw8njQiPhYRnyuu/+WYK/46AYDjLMuWI1vu3QYAjru0GANL0nJEpGm3E1DujOE9GyfSerPVvnCtuXVjvTNWdjoW0mub9dqlM0t//H5x8EKSb68UeUV+sV09tH05Is5ExI+Xniq2y2vN+vp0ujwAMPNO9rb/EfGfpTQtl4c6tc+negDAE6M07QIAABOn/QeA2aP9B4DZM0T73/2wf/fIywIATIb3/wAwe7T/ADB7tP8AMFO+8frr+ZLd6/7+9fpb21vXm29dXK+1rpcbW2vlteatm+WNZnOj+M2exqMer95s3lx5IbberrRrrXaltb1ztdHcutG+Wvyu99XawkRqBQA8zJmz7/0hiYjdl58qluiZy0FbDcdbOsajgCfL3Cgn6yDAE81sXzC7hmrCi07C7468LMB09P0x71Lf5P1++iGC+J4RfKSc/+Tw4//meIbjxcg+zK7HG/9/ZezlACbvscf//zzecgCTl2XJ4Tn/F/ezAIBjaYSv8GXvjKsTAkzVoybzHsvn/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHDMnIqI70WSlou5wNP837Rcjng6Ik7HQnJts167FBHPxNmIWFjKt1emXWgAYETp35Pu/F/nl58/dTh3MfnvUrGOiB/87I2fvL3abt9ayff/a3//0t70YdWD80aYVxAAGN5fhzmoaL+r3XXPG/m7d26v7S1HWMYHfPCV/clH1+7duV0snZz5yLIsiygVfYkT/05ivntOKSKei4i5McTffTciPtGv/kkxNnK6O/Npb/zoxn56ovHT++KnRV5nnT99Hx9DWWDWvJfff149fP3NFVfWueKI/td/qbhDja64/5Ui9u59B/e/veu9VJTmcPz8mj83bIwXfvv1B3Zmy528dyOem+8XP9mPnwyI//yQ8f/0qc/86JUBednPI85H//i9sSrtxs1Ka3vn4mZjdaO2UbtRrV5ZuXLppcsvVivFGHVlb6T6Qf94+cIzg8qW1//EgPidV/7kofov7p/7hSHr/4v/vfmdzx5sLh2O/6XP93/9ny3W/Z//vE384pDxV0/8auD03Xn89QH1f9Trf2HI+O//bWd9yEMBgAlobe9cX63Xa7dGSuTvQj/8WVmWvZOX4SHH5NnDPeBed3G06vwlisTB05JEEqM/P/cn8s7YMAcvjFyd+xJ7wyXjrk6fxPx+X3G8j/zth/+1DEosjhI0HXstHicRp7uJu5MKOpXbETBBBxf9tEsCAAAAAAAAAAAAAAAMMon/wzTtOgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB8/T8AAP//Z1e+LQ==") mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 3.496821788s ago: executing program 4 (id=3547): bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0600000004000000080000000a"], 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32], 0x30}}, 0x94) unshare(0x66000080) 3.212052952s ago: executing program 6 (id=3550): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0, @exit, @alu={0x6, 0x0, 0x3, 0xa, 0x0, 0x2}, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) 3.163436072s ago: executing program 4 (id=3552): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000001b80)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='sched_switch\x00', r0, 0x0, 0x9}, 0x18) perf_event_open(&(0x7f0000000e00)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x40000, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tkill(0x0, 0xe) r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000001440)=ANY=[], 0xc0) process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000580)=""/29, 0x1d}, {&(0x7f00000005c0)=""/57, 0x39}, {&(0x7f0000000880)=""/16, 0x10}, {&(0x7f00000008c0)=""/32, 0x20}, {0x0}, {&(0x7f0000000a40)=""/138, 0x8a}, {&(0x7f0000000bc0)=""/157, 0x9d}, {&(0x7f0000000c80)=""/101, 0x65}], 0x8, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000202300800000000025ad9835850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) pipe2$9p(0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x43}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2.793456828s ago: executing program 4 (id=3556): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x36, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x10000, 0x0, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = syz_io_uring_setup(0x35c0, &(0x7f0000000280)={0x0, 0x1756, 0x8, 0x2, 0x20f}, &(0x7f0000000340), &(0x7f00000004c0)) io_uring_setup(0x6fa5, &(0x7f0000000500)={0x0, 0x7983, 0x8000, 0x0, 0x20a, 0x0, r1}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xb, &(0x7f0000000180)=ANY=[@ANYRES8=r0], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_open_dev$sg(&(0x7f0000000080), 0x4, 0x30000) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000002400), 0x1, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r6}, 0x10) write$selinux_validatetrans(r4, 0x0, 0x72) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r7, 0x80047437, &(0x7f0000001f00)) sendmmsg(r7, &(0x7f0000001d00)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000007c0)="0281", 0x2}], 0x1}}], 0x34000, 0x24005805) syz_pidfd_open(r3, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000380)={[{@init_itable_val}, {@jqfmt_vfsold}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@max_batch_time={'max_batch_time', 0x3d, 0x131}}, {@mblk_io_submit}, {@quota}]}, 0x3, 0x437, &(0x7f0000000d80)="$eJzs281vG0UbAPBn7aR9+/UmVOWjaYFAQUR8JE1aSg9cikDiABISHMoxJGkV6jaoCRKtIggIlSOqxB1xROIv4AQXBJyQuMIdVapQLi2cjNbeTRzHdhPHiQP+/aRtZ3bHmnm8M/bMThxAzxpO/0kiDkbEbxExUM2uLTBc/e/u8uLUX8uLU0mUy2/+mVTK3VlenMqL5q87kGf6IgqfJnGsQb3z165fmiyVZq5m+bGFy++NzV+7/tzs5cmLMxdnrkycPXv61PgLZyae70icaVx3hj6cO3701bdvvj51/uY7P32T5PHXxdGmvrr8cKvCT5bLW6xudzlUk07q3wl2rWLWcfsr438gijXdeCBe+aSrjQO2VblcLj/Q/PJSGfgPS6LbLQC6I/+iT9e/+bFDU49d4fa56gIojftudlSv9EUhK9Nft77tpOGIOL/095fpEZ15DgEA0NJ36fzn2Ubzv0LUPhf6f7aHMhgR90XE4Yg4ExFHIuL+iErZByPioU3WX79Jsn7+U7jVVmAblM7/Xsz2ttbO//LZXwwWs9yhSvz9yYXZ0szJ7D0Zif69aX68RR3fv/zr582u1c7/0iOtP58LZu241bd37WumJxcmtxJzrdsfRwz1NYo/WdkJSCLiaEQMtVnH7NNfH2927d7xt9CBfabyVxFPVe//UtTFn0ta70+O/S9KMyfH8l6x3s+/3HijWf1bir8D0vu/v2H/X4l/MKndr53ffB03fv+s6Zqm3f6/J3lrzbkPJhcWro5H7Eleqza69vxEXbmJ1fJp/CMnGo//w7H6ThyLiLQTPxwRj0TEo1nbH4uIxyPiRIv4f3zpiXfbj397pfFPb+r+ryb2RP2ZxonipR++XVPp4GbiT+//6UpqJDuzkc+/jbSrvd4MAAAA/z6FiDgYSWF0JV0ojI5W/4b/SOwvlObmF565MPf+lenqbwQGo7+QP+kaqHkeOp4t6/P8RF3+VPbc+Ivivkp+dGquNN3t4KHHHWgy/lN/FLvdOmDb+b0W9C7jH3qX8Q+9y/iH3tVg/O/rRjuAndfo+/+jLrQD2Hl149+2H/QQ63/oXQ3G/7lutAPYeb7/oSfN74t7/0heQmJdIgq7ohkS25To9icTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAZ/wTAAD//+e45xo=") lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./file1\x00', &(0x7f0000000300), &(0x7f0000000040)=ANY=[], 0xfe37, 0x0) unlink(&(0x7f0000000180)='./file1\x00') 2.574935481s ago: executing program 4 (id=3558): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0600000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x37e2f4aba9289b81, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) open(0x0, 0x0, 0x0) unshare(0x66000080) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x0) 2.168579577s ago: executing program 2 (id=3565): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000001b80)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='sched_switch\x00', r0, 0x0, 0x9}, 0x18) perf_event_open(&(0x7f0000000e00)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x40000, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tkill(0x0, 0xe) r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000001440)=ANY=[], 0xc0) process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000580)=""/29, 0x1d}, {&(0x7f00000005c0)=""/57, 0x39}, {&(0x7f0000000880)=""/16, 0x10}, {&(0x7f00000008c0)=""/32, 0x20}, {0x0}, {&(0x7f0000000a40)=""/138, 0x8a}, {&(0x7f0000000bc0)=""/157, 0x9d}, {&(0x7f0000000c80)=""/101, 0x65}], 0x8, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000202300800000000025ad9835850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) pipe2$9p(0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x43}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2.129595508s ago: executing program 4 (id=3567): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000040000000400000001"], 0x48) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='sched_switch\x00', 0xffffffffffffffff, 0x0, 0x9}, 0x18) perf_event_open(&(0x7f0000000e00)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x40000, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tkill(0x0, 0xe) r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000001440)=ANY=[], 0xc0) process_vm_writev(0x0, &(0x7f0000000000)=[{&(0x7f0000000780)=""/247, 0xf7}], 0x1, &(0x7f0000000d00)=[{&(0x7f0000000580)=""/29, 0x1d}, {&(0x7f00000005c0)=""/57, 0x39}, {&(0x7f0000000880)=""/16, 0x10}, {&(0x7f00000008c0)=""/32, 0x20}, {0x0}, {&(0x7f0000000a40)=""/138, 0x8a}, {&(0x7f0000000bc0)=""/157, 0x9d}], 0x7, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000202300800000000025ad9835850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) pipe2$9p(0x0, 0x0) r3 = socket(0x200000000000011, 0x2, 0x1) bind$packet(r3, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x6a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa424e1aa2e0d408004500001402"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x43}, 0x94) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2, 0x0, 0x4}, 0x18) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r0, 0xe0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd4, 0x8, 0x0, 0x0}}, 0x10) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff3d) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x5f}, 0x18) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000014c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x54c, 0x42f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x80, 0x20, 0x8, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x1, 0x3, 0x2, {0x9, 0x21, 0x0, 0x3, 0x1, {0x22, 0xcda}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x3, 0x3, 0x31}}}}}]}}]}}, 0x0) close_range(r5, 0xffffffffffffffff, 0x200000000000000) 1.762923523s ago: executing program 2 (id=3569): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000040000000400000001"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000001b80)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='sched_switch\x00', r1, 0x0, 0x9}, 0x18) tkill(0x0, 0xe) r2 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f0000001440)=ANY=[], 0xc0) process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000580)=""/29, 0x1d}, {&(0x7f00000005c0)=""/57, 0x39}, {&(0x7f0000000880)=""/16, 0x10}, {&(0x7f00000008c0)=""/32, 0x20}, {0x0}, {&(0x7f0000000a40)=""/138, 0x8a}, {&(0x7f0000000bc0)=""/157, 0x9d}, {&(0x7f0000000c80)=""/101, 0x65}], 0x8, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000202300800000000025ad9835850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) pipe2$9p(0x0, 0x0) r4 = socket(0x200000000000011, 0x2, 0x1) bind$packet(r4, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x6a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa424e1aa2e0d408004500001402"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x43}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3, 0x0, 0x4}, 0x18) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r0, 0xe0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd4, 0x8, 0x0, 0x0}}, 0x10) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff3d) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed074479000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000003c0)='sched_switch\x00', r6}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x5f}, 0x18) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000014c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x54c, 0x42f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x80, 0x20, 0x8, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x1, 0x3, 0x2, {0x9, 0x21, 0x0, 0x3, 0x1, {0x22, 0xcda}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x3, 0x3, 0x31}}}}}]}}]}}, 0x0) close_range(r7, 0xffffffffffffffff, 0x200000000000000) 1.632130865s ago: executing program 1 (id=3570): mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='tracefs\x00', 0xc2, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x4, &(0x7f0000000240)=ANY=[], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ffd}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x38, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0, 0xd}, 0x0, 0x10000, 0x1, 0x1, 0x8, 0x20005, 0x2b, 0x0, 0x0, 0x0, 0xffffffffffffff7f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000480)={0x0, &(0x7f00000000c0)}) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x7, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) r1 = syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x40, &(0x7f00000000c0), 0x0, 0x4f7, &(0x7f0000000540)="$eJzs3c9vI1cdAPDvTOJNmqZNCpUKCOhSCgtarZ1426jqqVxAqKqEqDhxSEPijaLYcRQ7pQkrNfkfkKjEAcGJMwckDpV64ojgBre9LAekBVagDRIHo/GPbHZjJ2HXsVX785FGM2/eeL7vrTXveb9J/AIYW1cj4iAirkTEexEx1z6ftLd4q7Vl1z24f3v16P7t1SQajXf/kTTrs3Nx4jWZZ9v3nI6I738n4kfJ6bi1vf3NlXK5tNMuF+qV7UJtb//GRmVlvbRe2ioWlxaXFt64+Xqxb319ufKbe9/eePsHH//uS3f/dPDNn2TNmm3XnexHP7W6njuOk5mMiLcvI9gQTLT7c2XYDeGJpBHxmYh4pfn8z8VE8928mC6PNQDwKdBozEVj7mQZABh1aTMHlqT5di5gNtI0n2/l8F6MmbRcrdWv36rubq21cmXzkUtvbZRLC+1c4Xzkkqy8+GF2/LBcjEfLNyPihYj46dQzzXJ+9eJ5BgCgv559bP7/91Rr/gcARtz0eRcsD6YdAMDgnDv/AwAjx/wPAOPH/A8A48f8DwDjx/wPAOPmTmf+nxh2SwCAgfjeO+9kW+Oo/f3Xa+/v7W5W37+xVqpt5iu7q/nV6s52fr1aXS+X8qvVynn3K1er24uvxe4HhXqpVi/U9vaXK9Xdrfpy83u9l0u5gfQKADjLCy9/8pckIg7efKa5xYm1HMzVMNrSYTcAGBo5fxhfvoUbxpf/4wPnreXZ81eEP3qCYI0Pn+BFQL9d+7z8P4wr+X8YX/L/ML7k/2F8NRpJrzX/0+NLAICRIscPDPTn/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAiZpvb/IlymubzEc9FxHzkklsb5dJCRDwfEX+eyk1l5cWhthgAeHrp35L2+l/X5l6dfbz2SvKfqeY+In7883d/9sFKvb6zmJ3/5/H5+kft88VhtB8AOE9nnu7M4x0P7t9e7WyDbM+9b7UWF83iHrW3Vs1kTGa7P05HLiJm/pW0ym3Z55WJPsQ/OIyIz3Xrf9LMjcy3Vz59PH4W+7mBxk8fiZ8261r77N/is6fuPNUz5nlrvcK4+CQbf97q9vylcbW5n+66+PF0c4R6ep3x7+jU+Nd53qebY0238e/qRWO89vvv9qw7jPjCZLf4yXH8pEf8Vy8Y/84Xv/xKr7rGLyOuRff4J2MV6pXtQm1v/8ZGZWW9tF7aKhaXFpcW3rj5erHQzFEXOpnq0/7+5vXne/b/1xEzPeJPn9P/r53Z68bxAPyr/773w6/0in8Y8Y2vdn//XzwjfjYnfv3M+A+tzPy25/LdWfy1Vv8P/9/3//oF49/96/7aBS8FAAagtre/uVIul3b6epCLPt/wxEFySW12MOIH2efxp73PS+2UWddr/vCLj1/KKofe074cDHlgAi7dw4d+2C0BAAAAAAAAAAAAAAB6ufQ/J0qH3UMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABG2f8CAAD//zwQyy8=") pwritev2(r1, &(0x7f0000000d40), 0x0, 0x4, 0x8, 0x12) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000dc0)={0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2f, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) r3 = open(&(0x7f0000000540)='./bus\x00', 0x4000, 0x0) preadv2(r3, &(0x7f00000000c0)=[{&(0x7f0000001200)=""/4096, 0x1000}], 0x2, 0x0, 0x0, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f00000019c0)={'ip6gre0\x00', &(0x7f0000002640)={'syztnl0\x00', 0x0, 0x29, 0x5, 0x3e, 0x5, 0x5121e59afcdff86d, @empty, @mcast2, 0x7800, 0x96602ec4e0b44a1e}}) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r6 = gettid() timer_create(0x8, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMIWAIT(r7, 0x545c, 0x3000000) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) openat$full(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) 1.251541461s ago: executing program 0 (id=3572): bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, 0x0, &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x65, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000180)=0x7, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x2008042, &(0x7f00000000c0), 0x1, 0x571, &(0x7f0000000780)="$eJzs3c+PG1cdAPDvzP5yk7SbQA9QAQlQCCiKnXXaqOql5QJCVSVExQFxSJddZ7XEjkPsLd0lUrd/A0ggcYI/gQMSB6SeOHDjiMQBEOWAVCACJUgcBs3Yu+ts7MSNvXaz/nykybyZN+Pve/bOvOdnxy+AmXUuInYjYjEi3oyI5e7+pLvEq50lP+7undtr9+7cXksiy974Z1Lk5/ui55zcye5jliLim1+L+G7yYNzW9s711Xq9dqu7XWk3blZa2zsXNxurG7WN2o1q9crKlUsvXX6xOra6nm388oOvbr72rd/8+tPv/373yz/Mi3Wqm9dbj3HqVH1hP05uPiJeO4pgUzDXXS9OuRw8njQiPhYRnyuu/+WYK/46AYDjLMuWI1vu3QYAjru0GANL0nJEpGm3E1DujOE9GyfSerPVvnCtuXVjvTNWdjoW0mub9dqlM0t//H5x8EKSb68UeUV+sV09tH05Is5ExI+Xniq2y2vN+vp0ujwAMPNO9rb/EfGfpTQtl4c6tc+negDAE6M07QIAABOn/QeA2aP9B4DZM0T73/2wf/fIywIATIb3/wAwe7T/ADB7tP8AMFO+8frr+ZLd6/7+9fpb21vXm29dXK+1rpcbW2vlteatm+WNZnOj+M2exqMer95s3lx5IbberrRrrXaltb1ztdHcutG+Wvyu99XawkRqBQA8zJmz7/0hiYjdl58qluiZy0FbDcdbOsajgCfL3Cgn6yDAE81sXzC7hmrCi07C7468LMB09P0x71Lf5P1++iGC+J4RfKSc/+Tw4//meIbjxcg+zK7HG/9/ZezlACbvscf//zzecgCTl2XJ4Tn/F/ezAIBjaYSv8GXvjKsTAkzVoybzHsvn/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHDMnIqI70WSlou5wNP837Rcjng6Ik7HQnJts167FBHPxNmIWFjKt1emXWgAYETp35Pu/F/nl58/dTh3MfnvUrGOiB/87I2fvL3abt9ayff/a3//0t70YdWD80aYVxAAGN5fhzmoaL+r3XXPG/m7d26v7S1HWMYHfPCV/clH1+7duV0snZz5yLIsiygVfYkT/05ivntOKSKei4i5McTffTciPtGv/kkxNnK6O/Npb/zoxn56ovHT++KnRV5nnT99Hx9DWWDWvJfff149fP3NFVfWueKI/td/qbhDja64/5Ui9u59B/e/veu9VJTmcPz8mj83bIwXfvv1B3Zmy528dyOem+8XP9mPnwyI//yQ8f/0qc/86JUBednPI85H//i9sSrtxs1Ka3vn4mZjdaO2UbtRrV5ZuXLppcsvVivFGHVlb6T6Qf94+cIzg8qW1//EgPidV/7kofov7p/7hSHr/4v/vfmdzx5sLh2O/6XP93/9ny3W/Z//vE384pDxV0/8auD03Xn89QH1f9Trf2HI+O//bWd9yEMBgAlobe9cX63Xa7dGSuTvQj/8WVmWvZOX4SHH5NnDPeBed3G06vwlisTB05JEEqM/P/cn8s7YMAcvjFyd+xJ7wyXjrk6fxPx+X3G8j/zth/+1DEosjhI0HXstHicRp7uJu5MKOpXbETBBBxf9tEsCAAAAAAAAAAAAAAAMMon/wzTtOgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB8/T8AAP//Z1e+LQ==") mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 1.095577753s ago: executing program 0 (id=3573): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x70, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], 0x0, 0xfff, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xcb3a}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1d, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x25, 0x2000, @fd, 0xb, 0x5, 0x8020, 0x7, 0x1, {0x2}}) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5393, &(0x7f0000000000)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000040)='kmem_cache_free\x00', r0, 0x0, 0x2}, 0x18) eventfd(0x8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x40200, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r5) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000280)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee01}}, './file0\x00'}) ioctl$TUNSETGROUP(r3, 0x400454ce, r8) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r6, @ANYBLOB="0180000000000000000001000000000000000b00000000030014"], 0x28}}, 0x40000) ioctl$TUNSETLINK(r7, 0x400454cd, 0x335) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r11, {0x0, 0xffe0}, {}, {0xa}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x2}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) utime(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0xee97, 0x2}) close_range(r2, 0xffffffffffffffff, 0x0) 1.052131124s ago: executing program 2 (id=3574): mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='tracefs\x00', 0xc2, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x4, &(0x7f0000000240)=ANY=[], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ffd}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000480)={0x0, &(0x7f00000000c0)}) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x7, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x40, &(0x7f00000000c0), 0x0, 0x4f7, &(0x7f0000000540)="$eJzs3c9vI1cdAPDvTOJNmqZNCpUKCOhSCgtarZ1426jqqVxAqKqEqDhxSEPijaLYcRQ7pQkrNfkfkKjEAcGJMwckDpV64ojgBre9LAekBVagDRIHo/GPbHZjJ2HXsVX785FGM2/eeL7vrTXveb9J/AIYW1cj4iAirkTEexEx1z6ftLd4q7Vl1z24f3v16P7t1SQajXf/kTTrs3Nx4jWZZ9v3nI6I738n4kfJ6bi1vf3NlXK5tNMuF+qV7UJtb//GRmVlvbRe2ioWlxaXFt64+Xqxb319ufKbe9/eePsHH//uS3f/dPDNn2TNmm3XnexHP7W6njuOk5mMiLcvI9gQTLT7c2XYDeGJpBHxmYh4pfn8z8VE8928mC6PNQDwKdBozEVj7mQZABh1aTMHlqT5di5gNtI0n2/l8F6MmbRcrdWv36rubq21cmXzkUtvbZRLC+1c4Xzkkqy8+GF2/LBcjEfLNyPihYj46dQzzXJ+9eJ5BgCgv559bP7/91Rr/gcARtz0eRcsD6YdAMDgnDv/AwAjx/wPAOPH/A8A48f8DwDjx/wPAOPmTmf+nxh2SwCAgfjeO+9kW+Oo/f3Xa+/v7W5W37+xVqpt5iu7q/nV6s52fr1aXS+X8qvVynn3K1er24uvxe4HhXqpVi/U9vaXK9Xdrfpy83u9l0u5gfQKADjLCy9/8pckIg7efKa5xYm1HMzVMNrSYTcAGBo5fxhfvoUbxpf/4wPnreXZ81eEP3qCYI0Pn+BFQL9d+7z8P4wr+X8YX/L/ML7k/2F8NRpJrzX/0+NLAICRIscPDPTn/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAiZpvb/IlymubzEc9FxHzkklsb5dJCRDwfEX+eyk1l5cWhthgAeHrp35L2+l/X5l6dfbz2SvKfqeY+In7883d/9sFKvb6zmJ3/5/H5+kft88VhtB8AOE9nnu7M4x0P7t9e7WyDbM+9b7UWF83iHrW3Vs1kTGa7P05HLiJm/pW0ym3Z55WJPsQ/OIyIz3Xrf9LMjcy3Vz59PH4W+7mBxk8fiZ8261r77N/is6fuPNUz5nlrvcK4+CQbf97q9vylcbW5n+66+PF0c4R6ep3x7+jU+Nd53qebY0238e/qRWO89vvv9qw7jPjCZLf4yXH8pEf8Vy8Y/84Xv/xKr7rGLyOuRff4J2MV6pXtQm1v/8ZGZWW9tF7aKhaXFpcW3rj5erHQzFEXOpnq0/7+5vXne/b/1xEzPeJPn9P/r53Z68bxAPyr/773w6/0in8Y8Y2vdn//XzwjfjYnfv3M+A+tzPy25/LdWfy1Vv8P/9/3//oF49/96/7aBS8FAAagtre/uVIul3b6epCLPt/wxEFySW12MOIH2efxp73PS+2UWddr/vCLj1/KKofe074cDHlgAi7dw4d+2C0BAAAAAAAAAAAAAAB6ufQ/J0qH3UMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABG2f8CAAD//zwQyy8=") r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000dc0)={0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2f, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) r2 = open(&(0x7f0000000540)='./bus\x00', 0x4000, 0x0) preadv2(r2, &(0x7f00000000c0)=[{&(0x7f0000001200)=""/4096, 0x1000}], 0x2, 0x0, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = gettid() timer_create(0x8, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMIWAIT(r4, 0x545c, 0x3000000) 1.012671664s ago: executing program 0 (id=3575): r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x2f6, 0x210000) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070002000000000000260018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f60000008500000043"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x200000000000035a, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 969.142195ms ago: executing program 4 (id=3576): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0xc, 0xc, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYRES64=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r2, 0x0, 0x4000) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x48) ioctl(0xffffffffffffffff, 0x8b22, &(0x7f0000000040)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000080)='sched_switch\x00', r3, 0x0, 0x3}, 0x18) syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="790200000000000000007e0008"], 0x14}}, 0x4000054) 905.341436ms ago: executing program 0 (id=3577): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x36, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x10000, 0x0, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = syz_io_uring_setup(0x35c0, &(0x7f0000000280)={0x0, 0x1756, 0x8, 0x2, 0x20f}, &(0x7f0000000340), &(0x7f00000004c0)) io_uring_setup(0x6fa5, &(0x7f0000000500)={0x0, 0x7983, 0x8000, 0x0, 0x20a, 0x0, r1}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xb, &(0x7f0000000180)=ANY=[@ANYRES8=r0], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_open_dev$sg(&(0x7f0000000080), 0x4, 0x30000) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000002400), 0x1, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[], 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r6}, 0x10) write$selinux_validatetrans(r4, 0x0, 0x72) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r7, 0x80047437, &(0x7f0000001f00)) sendmmsg(r7, &(0x7f0000001d00)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000007c0)="0281", 0x2}], 0x1}}], 0x34000, 0x24005805) syz_pidfd_open(r3, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000380)={[{@init_itable_val}, {@jqfmt_vfsold}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@max_batch_time={'max_batch_time', 0x3d, 0x131}}, {@mblk_io_submit}, {@quota}]}, 0x3, 0x437, &(0x7f0000000d80)="$eJzs281vG0UbAPBn7aR9+/UmVOWjaYFAQUR8JE1aSg9cikDiABISHMoxJGkV6jaoCRKtIggIlSOqxB1xROIv4AQXBJyQuMIdVapQLi2cjNbeTRzHdhPHiQP+/aRtZ3bHmnm8M/bMThxAzxpO/0kiDkbEbxExUM2uLTBc/e/u8uLUX8uLU0mUy2/+mVTK3VlenMqL5q87kGf6IgqfJnGsQb3z165fmiyVZq5m+bGFy++NzV+7/tzs5cmLMxdnrkycPXv61PgLZyae70icaVx3hj6cO3701bdvvj51/uY7P32T5PHXxdGmvrr8cKvCT5bLW6xudzlUk07q3wl2rWLWcfsr438gijXdeCBe+aSrjQO2VblcLj/Q/PJSGfgPS6LbLQC6I/+iT9e/+bFDU49d4fa56gIojftudlSv9EUhK9Nft77tpOGIOL/095fpEZ15DgEA0NJ36fzn2Ubzv0LUPhf6f7aHMhgR90XE4Yg4ExFHIuL+iErZByPioU3WX79Jsn7+U7jVVmAblM7/Xsz2ttbO//LZXwwWs9yhSvz9yYXZ0szJ7D0Zif69aX68RR3fv/zr582u1c7/0iOtP58LZu241bd37WumJxcmtxJzrdsfRwz1NYo/WdkJSCLiaEQMtVnH7NNfH2927d7xt9CBfabyVxFPVe//UtTFn0ta70+O/S9KMyfH8l6x3s+/3HijWf1bir8D0vu/v2H/X4l/MKndr53ffB03fv+s6Zqm3f6/J3lrzbkPJhcWro5H7Eleqza69vxEXbmJ1fJp/CMnGo//w7H6ThyLiLQTPxwRj0TEo1nbH4uIxyPiRIv4f3zpiXfbj397pfFPb+r+ryb2RP2ZxonipR++XVPp4GbiT+//6UpqJDuzkc+/jbSrvd4MAAAA/z6FiDgYSWF0JV0ojI5W/4b/SOwvlObmF565MPf+lenqbwQGo7+QP+kaqHkeOp4t6/P8RF3+VPbc+Ivivkp+dGquNN3t4KHHHWgy/lN/FLvdOmDb+b0W9C7jH3qX8Q+9y/iH3tVg/O/rRjuAndfo+/+jLrQD2Hl149+2H/QQ63/oXQ3G/7lutAPYeb7/oSfN74t7/0heQmJdIgq7ohkS25To9icTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAZ/wTAAD//+e45xo=") lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./file1\x00', &(0x7f0000000300), &(0x7f0000000040)=ANY=[], 0xfe37, 0x0) unlink(&(0x7f0000000180)='./file1\x00') 795.682877ms ago: executing program 1 (id=3578): r0 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f00000001c0)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300", 0xfffffffb}, 0x48, 0xffffffffffffffff) r1 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f0000000340)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x48, 0xffffffffffffffff) r2 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @desc2}, &(0x7f00000002c0)={0x0, "6035ae1e0fe721441705322225930e6c1e3e2a51a92fd780bc34d7cf6e0236805b4377f7ab1a9b01c103a4c6a7ef54e6763fd7264c39ea00c508ba6062696138", 0x18}, 0x48, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x4, r2, r1, r1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000003000000850000"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r4}, 0x10) keyctl$KEYCTL_MOVE(0x4, r0, r0, 0x0, 0x0) 782.257538ms ago: executing program 6 (id=3555): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="140100002800010004000000fcdbdf250401f2800c00180008ac0f0000000000140001"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 706.491629ms ago: executing program 1 (id=3579): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x54, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x12600, 0x10000, 0x0, 0x1, 0x8, 0x20005, 0x9, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180100000100a706000000000030b200850000007b00000095f98e2c3677cd4a02901234192412c24039cfbedca1e8e550db01e2e3bf44dfc5f09e531dd84d451c7f09ba6acb9d3b16ee00212121172b7e13b43a37d94214cd50d28524e11cfd8b2a4ab74e9ee2f4032318ae62e0920202df97a7e490b46fddb6e059d87bdb89875fc9c51f1a499bdd51ff2bd5b2e491d542da0a1d1e5553095d8f6c9809e6d9ccfdbf946ffbc95aed6cb729c70124c360dda42148ccdbea5a34b17762cc112b26be2c2dee8b47a9c0a62c3c9de8102c5409b94d3cd2d77d937371a7b32b1705a6b2574a98ad385206e4752f3b8c075618447f"], &(0x7f0000000300)='syzkaller\x00', 0x7fffffff, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) keyctl$chown(0x4, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000160a0500000000000000000002000000300003802c00038004000100776732000000000000000000000000001400010076657468315f746f5f627269646765000900020073797a30000000000900010073797a30"], 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000) r3 = socket(0x18, 0x0, 0x0) connect$pppoe(r3, &(0x7f0000000080)={0x18, 0x0, {0x4, @random="45e3f364e554", 'sit0\x00'}}, 0x1e) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000010900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000025940000000c0a01030000000000000000070000080900020073797a31000000000900010073797a30000000006800038064000080080003400000000258000b802c0001800a0001006c696d69740000001c0002800c00014000000000000000030c0002400000000000000010140001800c0001"], 0x118}}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYRESHEX=0x0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000340)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x9, 0x4, 0x7ffc0002}]}) inotify_init() bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r6}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', 0xffffffffffffffff, 0x0, 0x3}, 0x18) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000440)='system.posix_acl_default\x00', &(0x7f0000001400)=ANY=[@ANYBLOB="0200000001000000000000000400000000000000100000000000000020"], 0x24, 0x0) chdir(&(0x7f0000000240)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) 639.67824ms ago: executing program 6 (id=3580): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TRIM(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x3f6, 0x200, 0x70bd29, 0x25dfdbfe, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x1f6b98c7c6571e0e}, 0x4000000) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xe) ioctl$TCGETS2(r0, 0x802c542a, &(0x7f0000000080)) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) syz_clone3(&(0x7f0000000740)={0x8180080, &(0x7f0000000000)=0xffffffffffffffff, &(0x7f0000000200), &(0x7f00000002c0), {0x39}, &(0x7f0000000300)=""/37, 0x25, &(0x7f00000004c0)=""/237, &(0x7f00000005c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3}, 0x58) timer_create(0x7, &(0x7f0000000600)={0x0, 0x1c, 0x4, @thr={&(0x7f0000000ac0)="7ba9ee042569dae6a11a32b078ffa572dd31d13b1bd29df4b7d9750be32f46405745be5d2440732ff175502014f8b9e9b07ac65903c961c39f24f744751b4f288af57a2239674714b092341374a9b7783490b447098d01518f15c497ed41d44d73fd527adb331d52ea43acc7cb5e9410180463fd743e779e880b7b4fdad668c82a55aa01c7f925b8d85139a5ab8774f6109ef456e2692e9c31a0e7e074d7082a68d16287d046cb07856b65e8fd19603703528b77c877e541124faa6bb08a6e88955a74585ef6f3cd7e275199326493b02a66049d5ae35b71f44afe", &(0x7f0000002480)="1ab44e6edf46ca633cc69ad70c452564b314c312f695a6fe582ca73fd77dccadc69db698a6de953728047d3dbef5c18377b6fd17754fc20cb492ffec619a46791a08f2aa11aac97dac0c702ab42dca606bbab05b15ba938b3ca763be472ca84e2e5c96ac365a8ff608e35daf9f74e80762a5b7988ffdae212001994671ef357eb0aa1682612846f9a8cc3643b4e76a92fd001408792726f96ca544393901092c0d762cda8b8b0d667e4264992ec995f132a0302fe201912259c49a305699a40bd3f408e13b46ac4bd2bb7cf70af74b85f1f6532b0d0413bb950da5cd0d6db68fe97e6347f13fe0faf6e60068654a5dc4237f5615a2fd87694f854c1ce7887f82be9cc4311c3d3744b0c2ab0aa005ed4a1ca6474827d852541a6a2a8625f8f25eb27fa6b215ec377e7d6a6cbe5829aeb59cd5f4ee7775a8b3da9fdb97e025b97fa23346f6165ad5adf7b5dcabdea2281a14d08d635ce4c47995ae1fb4f1ac06705397c8cc8345ed8211455579599356c959faa43c9837e31edfb014fdf0679ed1e2dd4ea59cb5668908c21bccf7e9efdbf18edce8bd7dfbe3ed60a5ab4f9816b0d25446d3659d6899285e1a94594ef9c216bdf0f3348f556f291e665bdda4e4e419bc96ab511c68d9360957cf44cb425b830785bd2945d4ae9d62d1418ff8391fd265f3a5a6e938300e7f515195d8cc4a9f0282c644657e58987ff27cb74020c68c4dd400176af6ac2228d685c29210f379ce3ab888fea766e0e26293ea14dcf6758578a9cff71f1e5c9fd68f6e23125396b6d2312ade631cc090b9162a09b41d3d31306947d66c9b8059c62d3112894c30cc9a4b94703d311fec00db8cec2542ce623e6daa2748003f2f852cf91611b98517aabf61294346aeb8852cf726401d6710924a1a2d6e0c225cedd2f2b2eb1687e0f5c4f55ec21a1c07ae7d663d6309e3e339ed9387faa8ef5e8a5ad91af9826b83b05b8df929a5408c1c62c1019c281fad6a264ec4855d5286ce06cfc6ab468ad05425a9003d88dad04fc9bf7949f3069a8ae6e5703e7d7ad3a68629f98a361fe76d6dcdcde2a4d552b88b539e05d9c1ccdd0e5152ccfc9afc1920454d315366bd7cb701a98c4f71bc592d1e669ee3e882b076ff354a7a215dda6c8a359aceecc9b186ade2b3b42c016ce3fd25b3fbd1f9fdc4710bd85a02c0f91e6187cdd79c9446d267ce40bc20cc75adb6b09447e9f5feb789ccb5eef3caf6a1e07a3742e915ab6545fc7c636b6ab6ab25eb75c4392bcabfab98a8c1b01a77dd56a5dbdcf35cfe0ac0c2e049abfef4cdf7ab328d49ced60b1ecb0cbad0f8b38c208e5877d9704795d257008f570f127c06df8a4d19334f33a07b7b3bea960576f518cbf522c3e9025e32e2650d6684be6e6e978d24d876f1da1089454af69c47b3ae553a81e2824863e1532cde207ef51f3faa5c8a65bbd30b35670b03efe711d94d611b96b2c0119ea6c1f61a0058f6c42a324a0ffc68ced36a82c358c98c9df861c221eb6d3fdabbd4e4e7dcf29e6964c3556c33df6e576fe612c1337d5301bbc97053fe54bf4229ef6370d9f43cb15e814d592471955e3c5d7b62e4f651383fc6a40e1624ad87b6303295d1555de1b5bd70adc762be7a5d641bd90241fa24cf373e0b7a0b5df49d0fb468526931a2e70ac2190d24c545e02d5d60a2722b25df81f8635ae4196b7b5cfc2ba6d1d3407945d127da17def1bd1a5840bfdd3c0b9218991064c4f2b05ce4c22af46fc3fd9c36353205b40e032fcc3f05c1fb39767159841f6d199d6b4f9c2ba54df973038516b7381ebad016cf5d89438a687a580f18c115df3bc149cd34dba8971f52a813767580c800d90fd52403147ce80727bd6f70bc1b642111ce10f25d93a8924b174255c8bc7654244afa515eba8378c763eff97454a14d3b25528be713eb08a6a0c0a23120db621194f6ecfe6df31582fe90d4b416a1289707c9acec1f3d24709fdda98d90c69badbc00aa53f2abc2e716508b5d7678e86c5c101947da6f25f8498333100477cfce00766ab7284b889229b4e25fad54f62c1420e97e2c181fe1d674c9e258599ba237304beff59d72b4bab187bb3c857d24ee397dc3ab758961f708dcd23c2e839e4904a672456b4d19a37713298e04bfcfc61015ea04b6c83122a3e7ceee4424bb375c56fb9e00869391dd8e91a96650a26dd0ede0529de581389a65db482e6e62c44970c53e9d9548c1de6c9744b2033742b889117b01a7759654fd95949256fc2258563c532ff046f96c7dd6ab3fbeb7059d262f7f397897070d4b84da0f7458718c5e8ed7fafde2f301dc39e4e1ed00b756ec06fec5e9d9ac30dae4b07f70fc01898c05b6abdb1dd262ff95facfa15681a0e78745911427aa6bbcbf3de4d058536fd14cc52d71e0c1b9d73164c4b9f9be63e744ac65fce714770e07d043b3338a8f83ce757e505fa87a82df0706e051d369c61c45537e28712a5e4e1dfb00da880a128005a59a5899361356de992321aefd6df9dc760d34246691214d544a9ffc2371b75d2fdba8b21b0641b207b0a0183387fdcc7240ffd8630469a987570dbcc511acbd8fa9789ad1abca9f3bdfcb4786736435019b327ff711724c52b5320481bd4b0cb47718cf1b746bae31fea5994dfea336c633755db1a49b917b558e148fe1b198fa9188afc8222bbf9c58418d4d34f5ad29a211586882a53abdf0c324bb6a69ef06eda7481decf649d2903e0cf3e71fad49f6f25f272bbc0b4ef4eb51d3ffa20abe587716a4e011618a20f5abde57e438cdd411a164ebf80cc7d54ef0aa625437c1e7fa77e92c24a8f9dabafd367ca20b99eff03d510712a6a2b39d517ebcb9c8083b9578fd88d4c706685deba251edef2a9de3dccc4618ceae68239818b59544650937e907c53f7644815ec0e6a29dcf7d11b21c7bfd5e9b4eaae7d163237d9a3f27fbb0601e41ef26ab46473a89bc2146f0a08076a4e7f823da28d0eef9b8cf821b3eaa9220a0760b217b43196cc101d5e69abcb7e962b0d2ed3501f0489da4bc5ac453ec424e02e11ec35f016f344e7d7bc92315a46b5a2dff1c8bfd127393437264f0c4ffc6573df4327baecde56a977c83fb46b280899fcfb39763303a4f9d8ff05fddfed6fbc906fa8978037edb83555f856228bb20d6e29282096c2edf35b0c7137e9ecfd9fac78da5dcb1601a219a932a52cddca318f5db44893c324ee6b6c1523de702e147f9353d3905024adc2fe50135bdc5b9985fbbccbcee171b610b5f9db4fdabdd88a827877f5c61fb414c1daff70e968229780bee43b4171c20ddb92c9f5b05647b9f7e51978068d0196798250faf3c3cef0134505abb8e61bb9f89d794cd82811c4588263de7d62fddb740a43bb46ef4c1aa1e9fb4d1c9f1dd7d98b5c3f99c6a6073066989ed1510e4bb33285755ecd559eedb8870ae2dc3f7f5159bcee043a73af947a3fe6248742e75f15b01364b190c70f8b439f9da9ae2af4c9f70b260b287456800960666018313eca104798f5251581a896b299c786d0c0528a88ee758781870dfb7ff1a58824708309523d88ccabdec490f45a16707c8e3b1164917af345702cf2ba9e97b44d916e97dfaf251d6334a093ddb10c0a354468ae2461e4fda8d0a9a24a126e5ef73adc388ac0a72b3d698d1e9d39322e33bc406db1bb78f5ce375426ae6bfb10b111b0b34b201a71818f1fc0e5148700bafdf95ade47642a54dedd6a147abb9ff9f7c561eac9b30ea40dda1dbd32b3b3815a0476a7b2ab275206b044152a146038f9a14b32194ea1548446a8c06885437df6c9347994513819f3615122cd073b498768c3fb6d9678162c9359db731cb906c1f837ba1ad573a88b31220fafab0807c6c0388d26233a0bd47594833aa225b4766d8e4527b707114b71cf99f7819f437301bcc13e8155795a36ef22a925ecae637cc305c7a1681fd389a17f5af38e48bc42a6397d2b77ee7ef65ff65f9870b3438f3e854f6bc57d0bdc20cbcb6941602daa9b29d66f4326d10130653805c95b7862b615886043a417b74834aedb5bd776617d4b8bfd0843827ff7e9c34a667cd6358f3369449a04d562a01109c25a0f1b01453729e0ea1611aaac5b8630cc55e3d3054c98a23d911c75cfd3dcf6d8856c4985500fd532a810eafb8596ec123bdbb3a70b9860f8a9399dceaf4d7a2bcd0057b4283d63415b6ef90d1a18d8c133e700a59c138f5ac0a89071c73e60f82d0115b38e9966e02592867e4e9ecd72e19322ffc253cc3a6a726d0475e448fde8f70be2ed028d45f4c9d27cb2662700f0ad2fffb10bb230e9e39a1d03b9ec0d3bc4139037c7587877ab17193f29091e8302a34dcc34a5afce7e7856c66667c9bf8d63c6c77a74714725928eca83424a01c2b82379af5df0ca24dc71220ab02a39de71c4e3ae450c2268b8bba24b2f57da1287d60eb67f428860753a8681879807eb7e153e5886a7deb56940612d13f7ae67b925b72c2789cacfb3e4bec9e527f7221c5dc5f3b3dfa71e3b1309160b2a84d5da0b40c905a37a0c37896780a7ad33ec9f0ec72609f287c8fa72d3365e3519c65b360b9c67b82028d91d77c5a8c2b8f948eb7f5f2223589ab65da48af1f2423177cd6629c0b8e6d5d6ab98530ef66c82ee6519010510bea11b2d7d0b37b6f4b22b75773e4aa749562af539b9a1709869611b6d5773d85d8d3d65802062e2df340bddbb0d3af0f3b8dd16c8ea2100e5433b3063ef7eb17444030b91789c2c401d1ba8fe7e8185ccc8f52c764c2295bd137f79620af4d74b0103ff1a57f76e9db6a1778c851664efac1a281695d968041cb8b1532a2e5db17eb07b8a2f024adb9719f3549a2df3a3aae6350bda6e84154902e30c166f4e6acbf0191cc483309069d831d6264757f76e666fc1e461d290f64325873dc14925f9f4115ca1f72483697bc2780bb01ed7fa791b8c95805d501b1b926fec767dc9cac524a3a881feb68bfe8584118cb34fde6a9a2a9b53776e9bb6d7cd4b6c78d9c1d15c3284753ad22039e9fd8a09be4a4c6fca7ae72704b75c7653a2da8f96063253351e127ae557990f0d3eeca23470fdff0493f1189ff3f4f78a7711fd50838a271bb5865d02a40842fd843019d923e15878ffea6685134bf008bb7bc4764faf35a792ad4d2332dd033075143beecad51e07a906652322a146d93ed4fd8e1ff6c549411fb45c6aa75a74f608d9fcdc39d576d1f1f8b1c83f5de17dc91b75293639a0c85e147046cd6c7c826a173963373d2223dcfecd0f122ebbe02b3269c0a01a08bae13c3be528dc41dbf67059a9ab247a92e449ff0ff17eaa1afea39ed4413ada38a09d3ec51940c2be8776414d7dbf83ee88d08910d2e9c47947f133d18af163b025c5e84d38970790d2eed675015b38ecea21a927612ef100077c917744cf42f0c92c40cb129271e00a82afcedf5fdafab6e523dea0847e5c51100adf274ba38f85e36ad16bb25da437dad4266a25cf6eb48cc995827d5c0e9950d88a3f0ec57437a16b374ec17736f6130ddc6aa47f51342de58ca3e86087f8ec997bf84aae281bf934672e8f01d679d5f146ed1d9e33622099af95d7be6464ba5e30df4576ef7e1e38cee3e85c6fff4ed83e1e62affceae3c183c646de778731623a7736478a1b4b8c83a089ab4106901215dad830ae84494058adda2f7c0a5431c86a16aea9952f158629f4d33448f24739ba7636a49724a277c7fc4ce92dd5d10d4d96cc4871b970e2f904cffab0afe89237fab358120856de806e1e35621"}}, &(0x7f00000007c0)) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000080)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x2}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000bc0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{}, [@TCA_NETEM_RATE={0x14, 0xd}]}}}]}, 0x60}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5, {0x7}}, './file0/file0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x7, 0x12, &(0x7f0000000380)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0xee5, 0x0, 0x0, 0x0, 0x2}, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000240)='GPL\x00', 0x2, 0x40, &(0x7f0000000680)=""/64, 0x41100, 0x40, '\x00', 0x0, @fallback=0x15, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000840)={0x2, 0x0, 0x8, 0x1}, 0x10, 0x0, r5, 0x2, &(0x7f0000000900)=[r4], &(0x7f0000000940)=[{0x0, 0x3, 0xa, 0xa}, {0x5, 0x4, 0x2, 0x1}], 0x10, 0xfffffffc}, 0x94) mremap(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000, 0x0, &(0x7f00008b5000/0x1000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000200)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) mincore(&(0x7f0000ff5000/0x4000)=nil, 0x4000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x112046, &(0x7f00000006c0)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}], [{@subj_user={'subj_user', 0x3d, 'memory'}}]}) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00', r7}, 0x10) symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f00000017c0)='./file0\x00') mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000800)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) openat$cgroup(r8, &(0x7f0000000340)='syz0\x00', 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x9, 0x18, &(0x7f0000000bc0)=ANY=[@ANYBLOB="c49801000000000000120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000018230000", @ANYRES64=r7, @ANYBLOB="f3d8b258717f000000000500", @ANYRES32, @ANYBLOB="00dfffffff0000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000018120000", @ANYRESHEX=0x0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000018120000", @ANYRES32=r4, @ANYBLOB="00000000000018400000fdffffff0000000000000000"], &(0x7f0000000880)='syzkaller\x00', 0x5, 0x5, &(0x7f00000008c0)=""/5, 0x41100, 0x56, '\x00', 0x0, @cgroup_sock=0x22, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000e40)={0x0, 0x6, 0x3, 0xffffffec}, 0x10, 0x0, 0xffffffffffffffff, 0x4, &(0x7f0000001040)=[0xffffffffffffffff, r4, r4, 0xffffffffffffffff, r4, r3, r4, r4, r4], &(0x7f0000001080)=[{0x2, 0x2, 0x9, 0xa}, {0x4, 0x4, 0xf, 0x4}, {0x4, 0x3, 0xf, 0xc}, {0x2, 0x4, 0x9, 0x3}], 0x10, 0x8}, 0x94) mount(0x0, &(0x7f0000000640)='./file0\x00', 0x0, 0x2086420, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 389.941434ms ago: executing program 6 (id=3581): r0 = socket$netlink(0x10, 0x3, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x17, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff0000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kmem_cache_free\x00', r2}, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), r0) 357.332644ms ago: executing program 0 (id=3582): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0600000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x37e2f4aba9289b81, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) open(0x0, 0x0, 0x0) unshare(0x66000080) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x0) 282.690535ms ago: executing program 1 (id=3583): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x37, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x4c58, 0x10000, 0x0, 0x1, 0x8, 0x20002, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x7], 0x0, 0x0, 0x1}}, 0x40) 239.272256ms ago: executing program 0 (id=3584): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000040000000400000001"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000001b80)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) perf_event_open(&(0x7f0000000e00)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x40000, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) tkill(0x0, 0xe) r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000001440)=ANY=[], 0xc0) process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000580)=""/29, 0x1d}, {&(0x7f00000005c0)=""/57, 0x39}, {&(0x7f0000000880)=""/16, 0x10}, {&(0x7f00000008c0)=""/32, 0x20}, {0x0}, {&(0x7f0000000a40)=""/138, 0x8a}, {&(0x7f0000000bc0)=""/157, 0x9d}, {&(0x7f0000000c80)=""/101, 0x65}], 0x8, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000202300800000000025ad9835850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) pipe2$9p(0x0, 0x0) r3 = socket(0x200000000000011, 0x2, 0x1) bind$packet(r3, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x6a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa424e1aa2e0d408004500001402"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x43}, 0x94) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2, 0x0, 0x4}, 0x18) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r0, 0xe0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd4, 0x8, 0x0, 0x0}}, 0x10) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff3d) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed074479000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000003c0)='sched_switch\x00', r5}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0x5f}, 0x18) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000014c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x54c, 0x42f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x80, 0x20, 0x8, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x1, 0x3, 0x2, {0x9, 0x21, 0x0, 0x3, 0x1, {0x22, 0xcda}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x3, 0x3, 0x31}}}}}]}}]}}, 0x0) close_range(r6, 0xffffffffffffffff, 0x200000000000000) 177.050587ms ago: executing program 2 (id=3585): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001400a685b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00, 0x49, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) ustat(0x9, &(0x7f0000000000)) 134.773368ms ago: executing program 1 (id=3586): r0 = open(&(0x7f00009e1000)='./file1\x00', 0x60840, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_dev$evdev(&(0x7f00000002c0), 0x3371, 0x36bac2) fcntl$setlease(r0, 0x400, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0a000000070000000300000001"], 0x50) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r1, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000020d0039000000000000b4a518110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='leases_conflict\x00', r3}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) socket$netlink(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r6], 0x20}, 0x1, 0x0, 0x0, 0x80d5}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b708000000000e007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000020850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', r6, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r7}, 0x10) 94.266858ms ago: executing program 2 (id=3587): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000001afc180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b703000000090000850000000400000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0x3) ioctl$TCSETSW2(r2, 0x5408, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x2, 0x0, "23f555d9adb42d4408020e90d1beaa82dc1ecf"}) fremovexattr(r1, &(0x7f00000002c0)=@known='system.advise\x00') ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYRES64, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00dfcdb5aa288e6a67000000000000000000000000000000000000003b3dc64a9aae056bb05cf1f199c243300dab5e50"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r3}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1200000001000000080000000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000001000000000000000000000000f78b7770de997f6bfbcba9c4ad871c435469eb36689dca1bb0edd06f1f4c0e51c1518c911f4fc04b9d253835991a64835574be156c830b5d1c9742ee249d8f57b0b8f1d301aff20ebdf40700ee371f88547fecaec695385954a48475a52a3124cd14b22569325e9aa331f72b56df85df44570f7716ca33a1821d4d5675e3c70017dfc2833d371f35b9496597da9f410fbed01e32390ca954bb17000a81cf49bead116555ecaf1c9e8804f7dc7f2647e4e7f8bc7a45e1ea40a6f1feda7cd4389ce8fd6198"], 0x48) r5 = socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r4, &(0x7f00000001c0), &(0x7f0000000280)=@udp=r5}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r4, &(0x7f0000000640)="b4", &(0x7f0000000180)=@udp=r5}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000018110000ddffffffffffffff00", @ANYRES8=r5, @ANYBLOB="0000000000000000b7080000930882a07b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="140100002800010004000000fcdbdf250401f2800c00180008ac0f0000000000140001"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x37, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x4c58, 0x10000, 0x0, 0x1, 0x8, 0x20002, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket(0x10, 0x2, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x0, 0xc, &(0x7f0000000300)=ANY=[@ANYRES8=r6], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) setsockopt$inet6_tcp_int(r9, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) connect$inet6(r9, &(0x7f0000000340)={0xa, 0x3, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r9, 0x6, 0x1f, &(0x7f0000000840), 0x4) setsockopt$inet6_tcp_TLS_TX(r9, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "fbffffffffffffff", "1fd33c81cf7995313c09de00fd6ded74", '\x00', "1e00040000000100"}, 0x28) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000240)=0x40) 1.03242ms ago: executing program 1 (id=3588): perf_event_open(&(0x7f00000000c0)={0x6, 0x80, 0x3, 0xff, 0x5e, 0xb, 0x0, 0x3, 0x8b008, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x1, @perf_bp={0x0, 0x8}, 0x400, 0x81, 0xffffffff, 0x6, 0x8, 0x204002, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0x40, 0xffffffffffffffff, 0x9) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000000780)={0x0, {'syz1\x00', 'syz0\x00', 'syz1\x00', &(0x7f00000000c0)=""/43, 0x2b, 0x0, 0x0, 0x0, 0x800}}, 0x120) write$UHID_DESTROY(r0, &(0x7f0000000080), 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r1}, 0x10) 0s ago: executing program 2 (id=3589): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4f}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) socket(0x10, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc9ffb}]}) creat(&(0x7f00000000c0)='./file0\x00', 0x9c) utime(0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x3d, 0x1, 0x0, 0x0, 0x0, 0x8005, 0x62000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, @perf_bp={0x0, 0xd}, 0x100000, 0x0, 0x0, 0x9, 0x3, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x4f0, 0x340, 0x25, 0x148, 0x0, 0x60, 0x458, 0x2a8, 0x2a8, 0x458, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'geneve0\x00', {0x44, 0x0, 0x9, 0x0, 0x0, 0xffffffff, 0x7}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x0, 0x6, './file0\x00'}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz0\x00'}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'veth1_to_bond\x00', 'veth0\x00', {0xff}}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@unspec=@cgroup0={{0x28}, {0x4}}, @common=@unspec=@statistic={{0x38}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x8000, 'syz0\x00', {0x481c}}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x550) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x13f, 0x5}}, 0x20) stat(&(0x7f0000001c40)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="38000000031401002dbd7000000000000900020073797a30000000000800410073697700140033006c6f"], 0xffaf}, 0x1, 0x0, 0x0, 0x854}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000580)=@proc={0x10, 0x0, 0x25dfdbfd, 0x40}, 0xc, 0x0, 0x0, 0x0, 0x50, 0x24040094}, 0x80) lchown(&(0x7f0000000000)='./file0\x00', 0x0, r4) r6 = getegid() fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000b00)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYBLOB="02000400", @ANYBLOB="020002", @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="0ffe0500", @ANYRES64, @ANYBLOB="02000000", @ANYRES8, @ANYBLOB="02000300", @ANYRES64, @ANYBLOB="02000200", @ANYRES32=0xee00, @ANYRES8=r5, @ANYBLOB="7de0de6148d7d44c4d01eeff92df69b773e9c6727f8fbda7576c2a151378b664926695450adc68e74593831c634553c00cb92a5f09f1c013283b5c41e9b48b6df05700293ee4dfd9070d460cc6774ad5cb408f22ce", @ANYRESDEC, @ANYRES32=0x0, @ANYBLOB="080006", @ANYRES32=r4, @ANYBLOB="08000300", @ANYRES32=0xee00, @ANYBLOB="08000400", @ANYRES32=r6, @ANYBLOB="10000400000000002000000000000000"], 0x94, 0x1) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=@delchain={0x3c, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x8, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}]}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4000) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'geneve1\x00'}) kernel console output (not intermixed with test programs): 0832][T14835] team0: Port device dummy0 added [ 188.127644][T14838] netlink: 'syz.6.2990': attribute type 10 has an invalid length. [ 188.158261][T14838] team0: Port device dummy0 removed [ 188.166591][T14838] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 188.259813][T14845] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.274499][T14844] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2993'. [ 188.284709][T14845] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.350744][T14858] loop1: detected capacity change from 0 to 512 [ 188.380490][T14861] netlink: 'syz.6.2995': attribute type 10 has an invalid length. [ 188.413311][ T3303] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 188.423754][T14861] bond0: (slave dummy0): Releasing backup interface [ 188.433473][T14866] netlink: 'syz.6.2995': attribute type 10 has an invalid length. [ 188.442875][T14858] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 188.470276][T14861] team0: Port device dummy0 added [ 188.488098][T14870] lo speed is unknown, defaulting to 1000 [ 188.502929][T14858] ext4 filesystem being mounted at /2/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 188.530851][T14866] team0: Port device dummy0 removed [ 188.538470][T14866] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 188.631383][T14893] bridge0: entered promiscuous mode [ 188.637906][T14893] bridge0: port 3(macsec1) entered blocking state [ 188.644457][T14893] bridge0: port 3(macsec1) entered disabled state [ 188.659822][T14893] macsec1: entered allmulticast mode [ 188.665124][T14893] bridge0: entered allmulticast mode [ 188.687327][T14893] macsec1: left allmulticast mode [ 188.692463][T14893] bridge0: left allmulticast mode [ 188.704475][T14893] bridge0: left promiscuous mode [ 188.721199][T14901] lo speed is unknown, defaulting to 1000 [ 188.795427][T14930] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3001'. [ 188.833315][T14933] loop6: detected capacity change from 0 to 512 [ 188.843645][T14935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.853214][T14935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.872510][T14933] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 188.887574][T14933] ext4 filesystem being mounted at /454/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 188.900797][T14933] EXT4-fs error (device loop6): ext4_do_update_inode:5568: inode #2: comm syz.6.3002: corrupted inode contents [ 188.915415][T14933] EXT4-fs error (device loop6): ext4_dirty_inode:6459: inode #2: comm syz.6.3002: mark_inode_dirty error [ 188.927577][T14933] EXT4-fs error (device loop6): ext4_do_update_inode:5568: inode #2: comm syz.6.3002: corrupted inode contents [ 188.940289][T14933] EXT4-fs error (device loop6): __ext4_ext_dirty:206: inode #2: comm syz.6.3002: mark_inode_dirty error [ 188.973962][ T6110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 189.159149][T14963] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3006'. [ 189.258881][T14974] netlink: 'syz.6.3007': attribute type 10 has an invalid length. [ 189.280463][T14959] lo speed is unknown, defaulting to 1000 [ 189.287041][T14229] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 189.319369][T15001] FAULT_INJECTION: forcing a failure. [ 189.319369][T15001] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 189.332488][T15001] CPU: 0 UID: 0 PID: 15001 Comm: syz.1.3008 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) [ 189.332575][T15001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 189.332586][T15001] Call Trace: [ 189.332594][T15001] [ 189.332600][T15001] __dump_stack+0x1d/0x30 [ 189.332643][T15001] dump_stack_lvl+0xe8/0x140 [ 189.332681][T15001] dump_stack+0x15/0x1b [ 189.332698][T15001] should_fail_ex+0x265/0x280 [ 189.332737][T15001] should_fail+0xb/0x20 [ 189.332761][T15001] should_fail_usercopy+0x1a/0x20 [ 189.332806][T15001] _copy_to_user+0x20/0xa0 [ 189.332827][T15001] simple_read_from_buffer+0xb5/0x130 [ 189.332856][T15001] proc_fail_nth_read+0x100/0x140 [ 189.332954][T15001] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 189.332980][T15001] vfs_read+0x1a0/0x6f0 [ 189.333009][T15001] ? __rcu_read_unlock+0x4f/0x70 [ 189.333029][T15001] ? __fget_files+0x184/0x1c0 [ 189.333125][T15001] ksys_read+0xda/0x1a0 [ 189.333150][T15001] __x64_sys_read+0x40/0x50 [ 189.333174][T15001] x64_sys_call+0x2d77/0x2fb0 [ 189.333242][T15001] do_syscall_64+0xd2/0x200 [ 189.333260][T15001] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 189.333283][T15001] ? clear_bhb_loop+0x40/0x90 [ 189.333303][T15001] ? clear_bhb_loop+0x40/0x90 [ 189.333346][T15001] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 189.333362][T15001] RIP: 0033:0x7f0a3e41d33c [ 189.333379][T15001] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 189.333440][T15001] RSP: 002b:00007f0a3ca87030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 189.333462][T15001] RAX: ffffffffffffffda RBX: 00007f0a3e645fa0 RCX: 00007f0a3e41d33c [ 189.333475][T15001] RDX: 000000000000000f RSI: 00007f0a3ca870a0 RDI: 0000000000000004 [ 189.333490][T15001] RBP: 00007f0a3ca87090 R08: 0000000000000000 R09: 0000000000000000 [ 189.333503][T15001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 189.333545][T15001] R13: 0000000000000000 R14: 00007f0a3e645fa0 R15: 00007ffc17393c48 [ 189.333563][T15001] [ 189.573591][T14959] chnl_net:caif_netlink_parms(): no params data found [ 189.596002][ T29] kauditd_printk_skb: 542 callbacks suppressed [ 189.596016][ T29] audit: type=1326 audit(2000000063.729:26225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15080 comm="syz.0.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f539202e929 code=0x7ffc0000 [ 189.625915][ T29] audit: type=1326 audit(2000000063.729:26226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15080 comm="syz.0.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f539202e929 code=0x7ffc0000 [ 189.649577][ T29] audit: type=1326 audit(2000000063.729:26227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15080 comm="syz.0.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=136 compat=0 ip=0x7f539202e929 code=0x7ffc0000 [ 189.673389][ T29] audit: type=1326 audit(2000000063.729:26228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15080 comm="syz.0.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f539202e929 code=0x7ffc0000 [ 189.697058][ T29] audit: type=1326 audit(2000000063.729:26229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15080 comm="syz.0.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f539202e929 code=0x7ffc0000 [ 189.729311][T15114] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3013'. [ 189.752232][T15127] loop1: detected capacity change from 0 to 512 [ 189.771235][T14959] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.778314][T14959] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.787242][T14959] bridge_slave_0: entered allmulticast mode [ 189.787604][T15127] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 189.794012][T14959] bridge_slave_0: entered promiscuous mode [ 189.806150][T15127] ext4 filesystem being mounted at /4/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 189.815467][T14959] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.828980][T14959] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.836797][T15127] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.3014: corrupted inode contents [ 189.849044][T15127] EXT4-fs error (device loop1): ext4_dirty_inode:6459: inode #2: comm syz.1.3014: mark_inode_dirty error [ 189.860964][T15127] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.3014: corrupted inode contents [ 189.873098][T14959] bridge_slave_1: entered allmulticast mode [ 189.886684][T15127] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.3014: mark_inode_dirty error [ 189.900449][T14959] bridge_slave_1: entered promiscuous mode [ 189.924556][ T339] bridge_slave_1: left allmulticast mode [ 189.930235][ T339] bridge_slave_1: left promiscuous mode [ 189.935912][ T339] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.943916][ T339] bridge_slave_0: left allmulticast mode [ 189.944226][T14229] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 189.949604][ T339] bridge_slave_0: left promiscuous mode [ 189.949827][ T339] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.067093][T15175] netlink: 'syz.4.3019': attribute type 10 has an invalid length. [ 190.118236][T15176] netlink: 'syz.4.3019': attribute type 10 has an invalid length. [ 190.141110][ T339] bond0 (unregistering): (slave çÿ): Releasing backup interface [ 190.151172][ T339] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 190.160923][ T339] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 190.170896][ T339] bond0 (unregistering): Released all slaves [ 190.235825][T15160] lo speed is unknown, defaulting to 1000 [ 190.278206][T14959] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 190.290741][T14959] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 190.318089][T15169] lo speed is unknown, defaulting to 1000 [ 190.327002][T15175] bond0: (slave dummy0): Releasing backup interface [ 190.335565][T15175] team0: Port device dummy0 added [ 190.343374][T15176] team0: Port device dummy0 removed [ 190.350303][T15176] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 190.411921][ T29] audit: type=1326 audit(2000000064.559:26230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.4.3021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8bc340e929 code=0x7ffc0000 [ 190.438412][ T29] audit: type=1326 audit(2000000064.559:26231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.4.3021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8bc340e929 code=0x7ffc0000 [ 190.462097][ T29] audit: type=1326 audit(2000000064.559:26232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.4.3021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=136 compat=0 ip=0x7f8bc340e929 code=0x7ffc0000 [ 190.485724][ T29] audit: type=1326 audit(2000000064.559:26233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.4.3021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8bc340e929 code=0x7ffc0000 [ 190.544614][ T339] hsr_slave_0: left promiscuous mode [ 190.551365][ T339] hsr_slave_1: left promiscuous mode [ 190.576479][ T339] team0 (unregistering): Port device team_slave_1 removed [ 190.585952][ T339] team0 (unregistering): Port device team_slave_0 removed [ 190.611977][T14959] team0: Port device team_slave_0 added [ 190.631220][T14959] team0: Port device team_slave_1 added [ 190.663628][T15279] lo speed is unknown, defaulting to 1000 [ 190.672496][T14959] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 190.679561][T14959] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 190.705519][ T29] audit: type=1326 audit(2000000064.829:26234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15277 comm="syz.4.3025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8bc340e929 code=0x7ffc0000 [ 190.705564][T14959] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 190.747922][T15282] loop4: detected capacity change from 0 to 164 [ 190.766279][T14959] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 190.773271][T14959] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 190.799339][T14959] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 190.870507][T15364] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 190.879239][T15364] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 190.935893][T14959] hsr_slave_0: entered promiscuous mode [ 190.947025][T14959] hsr_slave_1: entered promiscuous mode [ 190.953555][T14959] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 190.961388][T14959] Cannot create hsr debugfs directory [ 190.969532][T15349] lo speed is unknown, defaulting to 1000 [ 191.007622][T15405] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 191.016592][T15405] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.091352][T15426] netlink: 'syz.6.3030': attribute type 10 has an invalid length. [ 191.274404][T15479] loop6: detected capacity change from 0 to 512 [ 191.281639][T15479] EXT4-fs: Ignoring removed mblk_io_submit option [ 191.288378][T15479] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 191.326424][T15479] EXT4-fs (loop6): 1 truncate cleaned up [ 191.333016][T15479] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 191.400687][ T6110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 191.473710][T15499] loop6: detected capacity change from 0 to 512 [ 191.483350][T15499] EXT4-fs: dax option not supported [ 191.605535][T14959] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 191.622610][T14959] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 191.631555][T14959] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 191.640541][T14959] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 191.672554][T14959] 8021q: adding VLAN 0 to HW filter on device bond0 [ 191.684280][T14959] 8021q: adding VLAN 0 to HW filter on device team0 [ 191.705830][T14959] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 191.716264][T14959] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 191.737566][ T339] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.744768][ T339] bridge0: port 1(bridge_slave_0) entered forwarding state [ 191.753663][ T339] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.760731][ T339] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.858220][T14959] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 191.892623][T15544] loop6: detected capacity change from 0 to 1024 [ 191.994767][T15544] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 192.058161][T14959] veth0_vlan: entered promiscuous mode [ 192.074891][T14959] veth1_vlan: entered promiscuous mode [ 192.082238][ T6110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 192.087197][T14959] veth0_macvtap: entered promiscuous mode [ 192.098433][T14959] veth1_macvtap: entered promiscuous mode [ 192.114168][T14959] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 192.128576][T15565] loop6: detected capacity change from 0 to 512 [ 192.131651][T15558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 192.143914][T15558] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 192.163225][T14959] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 192.178282][T14959] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.187139][T14959] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.196029][T14959] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.204762][T14959] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.216034][T15565] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 192.231029][T15565] ext4 filesystem being mounted at /472/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 192.275007][T15573] bridge0: entered promiscuous mode [ 192.281493][T15573] bridge0: port 3(macsec1) entered blocking state [ 192.288017][T15573] bridge0: port 3(macsec1) entered disabled state [ 192.294673][T15573] macsec1: entered allmulticast mode [ 192.300036][T15573] bridge0: entered allmulticast mode [ 192.312578][T15573] macsec1: left allmulticast mode [ 192.317760][T15573] bridge0: left allmulticast mode [ 192.329827][T15573] bridge0: left promiscuous mode [ 192.474164][T15588] lo speed is unknown, defaulting to 1000 [ 192.503293][T15597] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3045'. [ 192.740411][T15642] lo speed is unknown, defaulting to 1000 [ 192.913291][T15764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 192.924441][T15764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 192.933262][ T57] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 192.948431][T15642] chnl_net:caif_netlink_parms(): no params data found [ 192.983158][ T6110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 193.019120][ T57] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.067382][T15784] bridge0: entered promiscuous mode [ 193.074036][T15784] bridge0: port 3(macsec1) entered blocking state [ 193.080519][T15784] bridge0: port 3(macsec1) entered disabled state [ 193.087762][T15784] macsec1: entered allmulticast mode [ 193.093133][T15784] bridge0: entered allmulticast mode [ 193.102796][T15784] macsec1: left allmulticast mode [ 193.107847][T15784] bridge0: left allmulticast mode [ 193.118336][T15784] bridge0: left promiscuous mode [ 193.185560][ T57] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.228513][T15642] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.235649][T15642] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.243093][T15642] bridge_slave_0: entered allmulticast mode [ 193.249755][T15642] bridge_slave_0: entered promiscuous mode [ 193.262117][ T57] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.275875][T15642] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.283369][T15642] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.290601][T15642] bridge_slave_1: entered allmulticast mode [ 193.296880][T15642] bridge_slave_1: entered promiscuous mode [ 193.303291][T15819] lo speed is unknown, defaulting to 1000 [ 193.323768][T15642] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 193.337348][T15642] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 193.376423][T15642] team0: Port device team_slave_0 added [ 193.384182][T15897] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3058'. [ 193.389693][T15642] team0: Port device team_slave_1 added [ 193.427635][T15642] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 193.434701][T15642] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 193.460625][T15642] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 193.474031][T15642] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 193.481039][T15642] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 193.506985][T15642] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 193.577884][ T57] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 193.588085][ T57] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 193.599843][ T57] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 193.610608][ T57] bond0 (unregistering): Released all slaves [ 193.644161][T15642] hsr_slave_0: entered promiscuous mode [ 193.650836][T15642] hsr_slave_1: entered promiscuous mode [ 193.656716][T15642] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 193.664402][T15642] Cannot create hsr debugfs directory [ 193.780416][ T57] hsr_slave_0: left promiscuous mode [ 193.786476][ T57] hsr_slave_1: left promiscuous mode [ 193.793354][ T57] veth1_macvtap: left promiscuous mode [ 193.799087][ T57] veth0_macvtap: left promiscuous mode [ 193.841728][T16042] loop2: detected capacity change from 0 to 512 [ 193.848412][ T57] team0 (unregistering): Port device team_slave_1 removed [ 193.857738][ T57] team0 (unregistering): Port device team_slave_0 removed [ 193.868629][T16042] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 193.881939][T16042] ext4 filesystem being mounted at /4/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 193.896566][T16042] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #2: comm syz.2.3067: corrupted inode contents [ 193.909523][T16042] EXT4-fs error (device loop2): ext4_dirty_inode:6459: inode #2: comm syz.2.3067: mark_inode_dirty error [ 193.922352][T16042] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #2: comm syz.2.3067: corrupted inode contents [ 193.923595][T16040] bridge0: entered promiscuous mode [ 193.935804][T16042] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #2: comm syz.2.3067: mark_inode_dirty error [ 193.942643][T16040] bridge0: port 3(macsec1) entered blocking state [ 193.957104][T16040] bridge0: port 3(macsec1) entered disabled state [ 193.965737][T16040] macsec1: entered allmulticast mode [ 193.971072][T16040] bridge0: entered allmulticast mode [ 193.977222][T16040] macsec1: left allmulticast mode [ 193.977516][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 193.982298][T16040] bridge0: left allmulticast mode [ 193.996558][T16040] bridge0: left promiscuous mode [ 194.017578][ T3385] lo speed is unknown, defaulting to 1000 [ 194.023471][ T3385] infiniband syz0: ib_query_port failed (-19) [ 194.251189][T16104] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.260321][T16104] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.347862][T15642] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 194.362705][T15642] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 194.384060][T15642] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 194.413580][T15642] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 194.485513][T15642] 8021q: adding VLAN 0 to HW filter on device bond0 [ 194.517005][T15642] 8021q: adding VLAN 0 to HW filter on device team0 [ 194.537944][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.545042][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 194.569846][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.577007][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 194.595921][T15642] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 194.606389][T15642] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 194.671709][T15642] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 194.691196][T16148] loop6: detected capacity change from 0 to 164 [ 194.705702][T16154] loop1: detected capacity change from 0 to 512 [ 194.717897][T16148] syz.6.3076: attempt to access beyond end of device [ 194.717897][T16148] loop6: rw=524288, sector=263328, nr_sectors = 4 limit=164 [ 194.732200][T16148] syz.6.3076: attempt to access beyond end of device [ 194.732200][T16148] loop6: rw=0, sector=263328, nr_sectors = 4 limit=164 [ 194.753996][T16154] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 194.769953][T16154] ext4 filesystem being mounted at /14/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 194.781728][T16154] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.3077: corrupted inode contents [ 194.795015][T16154] EXT4-fs error (device loop1): ext4_dirty_inode:6459: inode #2: comm syz.1.3077: mark_inode_dirty error [ 194.803863][T15642] veth0_vlan: entered promiscuous mode [ 194.809235][T16154] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.3077: corrupted inode contents [ 194.815321][T15642] veth1_vlan: entered promiscuous mode [ 194.831003][T16154] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.3077: mark_inode_dirty error [ 194.849977][T15642] veth0_macvtap: entered promiscuous mode [ 194.856997][T15642] veth1_macvtap: entered promiscuous mode [ 194.867526][T15642] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 194.878026][T15642] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 194.886473][T15642] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 194.891975][T14229] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 194.895370][T15642] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 194.895395][T15642] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 194.895420][T15642] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 194.958475][T16177] loop0: detected capacity change from 0 to 512 [ 194.985661][T16177] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 195.010108][T16177] ext4 filesystem being mounted at /54/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 195.037145][T16177] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #2: comm syz.0.3080: corrupted inode contents [ 195.068385][T16177] EXT4-fs error (device loop0): ext4_dirty_inode:6459: inode #2: comm syz.0.3080: mark_inode_dirty error [ 195.090249][T16210] bridge0: entered promiscuous mode [ 195.097083][T16210] bridge0: port 3(macsec1) entered blocking state [ 195.103619][T16210] bridge0: port 3(macsec1) entered disabled state [ 195.106838][T16177] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #2: comm syz.0.3080: corrupted inode contents [ 195.110217][T16210] macsec1: entered allmulticast mode [ 195.127187][T16210] bridge0: entered allmulticast mode [ 195.135999][T16177] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #2: comm syz.0.3080: mark_inode_dirty error [ 195.149204][T16210] macsec1: left allmulticast mode [ 195.154296][T16210] bridge0: left allmulticast mode [ 195.160948][T16210] bridge0: left promiscuous mode [ 195.194425][ T29] kauditd_printk_skb: 372 callbacks suppressed [ 195.194439][ T29] audit: type=1400 audit(2000000069.339:26607): avc: denied { getopt } for pid=16219 comm="syz.6.3084" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 195.196886][T16220] vlan0: entered allmulticast mode [ 195.207019][T12600] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 195.220771][T16220] dummy0: entered allmulticast mode [ 195.321682][T16240] netlink: 'syz.4.3090': attribute type 10 has an invalid length. [ 195.347721][T16240] team0: Port device dummy0 added [ 195.369797][T16232] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3087'. [ 195.382674][T16240] netlink: 'syz.4.3090': attribute type 10 has an invalid length. [ 195.396408][T16240] team0: Port device dummy0 removed [ 195.404340][T16240] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 195.447349][T16249] netlink: 'syz.0.3092': attribute type 10 has an invalid length. [ 195.466821][T16249] bond0: (slave dummy0): Releasing backup interface [ 195.492158][T16249] team0: Port device dummy0 added [ 195.526311][T16255] netlink: 'syz.0.3092': attribute type 10 has an invalid length. [ 195.554124][T16255] team0: Port device dummy0 removed [ 195.650984][ T29] audit: type=1326 audit(2000000069.749:26608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16246 comm="syz.6.3091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 195.674737][ T29] audit: type=1326 audit(2000000069.759:26609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16246 comm="syz.6.3091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 195.698447][ T29] audit: type=1326 audit(2000000069.759:26610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16246 comm="syz.6.3091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 195.722064][ T29] audit: type=1326 audit(2000000069.759:26611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16246 comm="syz.6.3091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 195.736083][T16255] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 195.745635][ T29] audit: type=1326 audit(2000000069.759:26612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16246 comm="syz.6.3091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 195.745660][ T29] audit: type=1326 audit(2000000069.759:26613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16246 comm="syz.6.3091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 195.745681][ T29] audit: type=1326 audit(2000000069.759:26614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16246 comm="syz.6.3091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 195.825131][ T29] audit: type=1326 audit(2000000069.759:26615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16246 comm="syz.6.3091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 195.848745][ T29] audit: type=1326 audit(2000000069.759:26616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16246 comm="syz.6.3091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 195.923144][T16269] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3093'. [ 195.943043][T16269] hsr_slave_1 (unregistering): left promiscuous mode [ 196.019972][T16251] SELinux: syz.4.3093 (16251) wrote to /sys/fs/selinux/user! This will not be supported in the future; please update your userspace. [ 196.038982][T16251] loop4: detected capacity change from 0 to 512 [ 196.045988][T16251] ext4: Unknown parameter 'smackfshat' [ 196.079406][T16303] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3101'. [ 196.091785][T16303] gtp0: entered promiscuous mode [ 196.096947][T16303] gtp0: entered allmulticast mode [ 196.179210][T16312] netlink: 'syz.6.3104': attribute type 10 has an invalid length. [ 196.253799][T16304] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 196.282693][T16304] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 196.321852][T16324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 196.350633][T16324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 196.561733][T16337] ip6gretap0: entered promiscuous mode [ 196.572872][T16337] loop1: detected capacity change from 0 to 128 [ 196.582539][T16337] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 196.595105][T16337] ext4 filesystem being mounted at /19/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 196.620632][T14229] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 197.070267][ T23] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 197.082427][T16357] loop6: detected capacity change from 0 to 1024 [ 197.092112][ T23] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 197.099060][T16357] EXT4-fs: Ignoring removed nomblk_io_submit option [ 197.116477][T16357] EXT4-fs (loop6): can't mount with journal_checksum, fs mounted w/o journal [ 197.352292][T16427] loop2: detected capacity change from 0 to 512 [ 197.391033][T16427] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 197.403913][T16427] ext4 filesystem being mounted at /12/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 197.433547][T16427] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #2: comm syz.2.3117: corrupted inode contents [ 197.448619][T16427] EXT4-fs error (device loop2): ext4_dirty_inode:6459: inode #2: comm syz.2.3117: mark_inode_dirty error [ 197.461511][T16427] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #2: comm syz.2.3117: corrupted inode contents [ 197.473880][T16427] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #2: comm syz.2.3117: mark_inode_dirty error [ 197.520975][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 197.793669][T16474] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3122'. [ 197.962503][T16500] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3124'. [ 197.974039][T16500] gtp0: entered promiscuous mode [ 197.979027][T16500] gtp0: entered allmulticast mode [ 198.051336][T16511] loop2: detected capacity change from 0 to 512 [ 198.079792][T16511] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 198.092825][T16513] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3126'. [ 198.094882][T16511] ext4 filesystem being mounted at /18/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 198.108129][T16513] netdevsim netdevsim0: Direct firmware load for ./file0 failed with error -2 [ 198.136340][T16511] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #2: comm syz.2.3128: corrupted inode contents [ 198.148244][T16523] loop4: detected capacity change from 0 to 512 [ 198.149339][T16511] EXT4-fs error (device loop2): ext4_dirty_inode:6459: inode #2: comm syz.2.3128: mark_inode_dirty error [ 198.166928][T16511] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #2: comm syz.2.3128: corrupted inode contents [ 198.179388][T16511] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #2: comm syz.2.3128: mark_inode_dirty error [ 198.199641][T16527] loop0: detected capacity change from 0 to 512 [ 198.215623][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 198.227740][T16523] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 198.242859][T16523] ext4 filesystem being mounted at /10/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 198.260983][T16527] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 198.268992][T16538] FAULT_INJECTION: forcing a failure. [ 198.268992][T16538] name failslab, interval 1, probability 0, space 0, times 0 [ 198.274054][T16537] loop2: detected capacity change from 0 to 512 [ 198.286060][T16538] CPU: 0 UID: 0 PID: 16538 Comm: syz.6.3134 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) [ 198.286086][T16538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 198.286099][T16538] Call Trace: [ 198.286106][T16538] [ 198.286195][T16538] __dump_stack+0x1d/0x30 [ 198.286217][T16538] dump_stack_lvl+0xe8/0x140 [ 198.286237][T16538] dump_stack+0x15/0x1b [ 198.286253][T16538] should_fail_ex+0x265/0x280 [ 198.286281][T16538] should_failslab+0x8c/0xb0 [ 198.286364][T16538] kmem_cache_alloc_node_noprof+0x57/0x320 [ 198.286391][T16538] ? __alloc_skb+0x101/0x320 [ 198.286446][T16538] __alloc_skb+0x101/0x320 [ 198.286521][T16538] ? audit_log_start+0x365/0x6c0 [ 198.286550][T16538] audit_log_start+0x380/0x6c0 [ 198.286580][T16538] audit_seccomp+0x48/0x100 [ 198.286605][T16538] ? __seccomp_filter+0x68c/0x10d0 [ 198.286734][T16538] __seccomp_filter+0x69d/0x10d0 [ 198.286756][T16538] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 198.286787][T16538] ? vfs_write+0x75e/0x8e0 [ 198.286855][T16538] __secure_computing+0x82/0x150 [ 198.286876][T16538] syscall_trace_enter+0xcf/0x1e0 [ 198.286898][T16538] do_syscall_64+0xac/0x200 [ 198.286948][T16538] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 198.286971][T16538] ? clear_bhb_loop+0x40/0x90 [ 198.287070][T16538] ? clear_bhb_loop+0x40/0x90 [ 198.287087][T16538] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.287107][T16538] RIP: 0033:0x7f4aa00ee929 [ 198.287122][T16538] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 198.287139][T16538] RSP: 002b:00007f4a9e757038 EFLAGS: 00000246 ORIG_RAX: 00000000000001cd [ 198.287234][T16538] RAX: ffffffffffffffda RBX: 00007f4aa0315fa0 RCX: 00007f4aa00ee929 [ 198.287246][T16538] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 00002000000005c0 [ 198.287333][T16538] RBP: 00007f4a9e757090 R08: 0000000000000000 R09: 0000000000000000 [ 198.287345][T16538] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 198.287357][T16538] R13: 0000000000000000 R14: 00007f4aa0315fa0 R15: 00007ffef4a31198 [ 198.287373][T16538] [ 198.300904][T16527] ext4 filesystem being mounted at /67/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 198.309426][T16523] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #2: comm syz.4.3131: corrupted inode contents [ 198.342469][T16537] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 198.343784][T16523] EXT4-fs error (device loop4): ext4_dirty_inode:6459: inode #2: comm syz.4.3131: mark_inode_dirty error [ 198.352442][T16537] ext4 filesystem being mounted at /19/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 198.354435][T16523] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #2: comm syz.4.3131: corrupted inode contents [ 198.572878][T16523] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #2: comm syz.4.3131: mark_inode_dirty error [ 198.602597][T16549] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 198.621041][T16549] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 198.647857][T15642] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 199.127122][T12600] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 199.168071][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 199.582133][T16624] loop1: detected capacity change from 0 to 512 [ 199.608175][T16624] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 199.621827][T16624] ext4 filesystem being mounted at /31/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 199.638580][T16624] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.3156: corrupted inode contents [ 199.650568][T16624] EXT4-fs error (device loop1): ext4_dirty_inode:6459: inode #2: comm syz.1.3156: mark_inode_dirty error [ 199.665887][T16639] netlink: 'syz.2.3159': attribute type 13 has an invalid length. [ 199.683935][T16624] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.3156: corrupted inode contents [ 199.713569][T16639] gretap0: refused to change device tx_queue_len [ 199.719978][T16639] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 199.751929][T16624] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.3156: mark_inode_dirty error [ 199.813899][T14229] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 199.856435][T16647] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 199.865090][T16647] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 199.879617][T16650] loop4: detected capacity change from 0 to 164 [ 199.921551][T16650] syz.4.3164: attempt to access beyond end of device [ 199.921551][T16650] loop4: rw=524288, sector=263328, nr_sectors = 4 limit=164 [ 199.952217][T16650] syz.4.3164: attempt to access beyond end of device [ 199.952217][T16650] loop4: rw=0, sector=263328, nr_sectors = 4 limit=164 [ 200.193920][T16689] netlink: 'syz.2.3171': attribute type 10 has an invalid length. [ 200.205331][T16689] team0: Port device dummy0 added [ 200.260576][T16692] loop1: detected capacity change from 0 to 512 [ 200.269541][T16693] netlink: 'syz.2.3171': attribute type 10 has an invalid length. [ 200.310537][T16692] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 200.332628][T16693] team0: Port device dummy0 removed [ 200.339681][T16692] ext4 filesystem being mounted at /35/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 200.353787][T16693] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 200.364804][T16692] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.3172: corrupted inode contents [ 200.377887][T16692] EXT4-fs error (device loop1): ext4_dirty_inode:6459: inode #2: comm syz.1.3172: mark_inode_dirty error [ 200.411124][T16692] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.3172: corrupted inode contents [ 200.446818][T16692] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.3172: mark_inode_dirty error [ 200.505289][T14229] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 200.575747][T16726] loop4: detected capacity change from 0 to 512 [ 200.604588][T16726] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 200.618411][T16726] ext4 filesystem being mounted at /17/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 200.631624][T16733] FAULT_INJECTION: forcing a failure. [ 200.631624][T16733] name failslab, interval 1, probability 0, space 0, times 0 [ 200.644357][T16733] CPU: 1 UID: 0 PID: 16733 Comm: syz.2.3178 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) [ 200.644386][T16733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 200.644467][T16733] Call Trace: [ 200.644474][T16733] [ 200.644481][T16733] __dump_stack+0x1d/0x30 [ 200.644521][T16733] dump_stack_lvl+0xe8/0x140 [ 200.644541][T16733] dump_stack+0x15/0x1b [ 200.644608][T16733] should_fail_ex+0x265/0x280 [ 200.644633][T16733] ? resv_map_alloc+0x57/0x190 [ 200.644655][T16733] should_failslab+0x8c/0xb0 [ 200.644756][T16733] __kmalloc_cache_noprof+0x4c/0x320 [ 200.644785][T16733] resv_map_alloc+0x57/0x190 [ 200.644808][T16733] hugetlbfs_get_inode+0x67/0x370 [ 200.644833][T16733] hugetlb_file_setup+0x192/0x3d0 [ 200.644914][T16733] ksys_mmap_pgoff+0x157/0x310 [ 200.644942][T16733] x64_sys_call+0x1602/0x2fb0 [ 200.644961][T16733] do_syscall_64+0xd2/0x200 [ 200.644980][T16733] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 200.645079][T16733] ? clear_bhb_loop+0x40/0x90 [ 200.645101][T16733] ? clear_bhb_loop+0x40/0x90 [ 200.645123][T16733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.645215][T16733] RIP: 0033:0x7f74236fe929 [ 200.645231][T16733] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 200.645250][T16733] RSP: 002b:00007f7421d67038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 200.645269][T16733] RAX: ffffffffffffffda RBX: 00007f7423925fa0 RCX: 00007f74236fe929 [ 200.645334][T16733] RDX: 0000000000000002 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 200.645437][T16733] RBP: 00007f7421d67090 R08: ffffffffffffffff R09: 0000000027fa7000 [ 200.645449][T16733] R10: 000000000004c831 R11: 0000000000000246 R12: 0000000000000001 [ 200.645460][T16733] R13: 0000000000000000 R14: 00007f7423925fa0 R15: 00007fffa59dd348 [ 200.645541][T16733] [ 200.863962][T16737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.899100][T16737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.908938][ T29] kauditd_printk_skb: 1051 callbacks suppressed [ 200.908953][ T29] audit: type=1326 audit(2000000075.049:27666): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16748 comm="syz.2.3180" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74236fe929 code=0x7ffc0000 [ 200.946044][ T29] audit: type=1326 audit(2000000075.089:27667): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16748 comm="syz.2.3180" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f74236fd290 code=0x7ffc0000 [ 200.970010][ T29] audit: type=1326 audit(2000000075.089:27668): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16748 comm="syz.2.3180" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74236fe929 code=0x7ffc0000 [ 200.993648][ T29] audit: type=1326 audit(2000000075.089:27669): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16748 comm="syz.2.3180" exe="/root/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f74236fe929 code=0x7ffc0000 [ 201.015080][T16749] loop2: detected capacity change from 0 to 512 [ 201.017113][ T29] audit: type=1326 audit(2000000075.089:27670): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16752 comm="syz.2.3180" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f74237311e5 code=0x7ffc0000 [ 201.025077][T16749] EXT4-fs: Ignoring removed mblk_io_submit option [ 201.047026][ T29] audit: type=1400 audit(2000000075.149:27672): avc: denied { create } for pid=16753 comm="syz.6.3181" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 201.073075][ T29] audit: type=1400 audit(2000000075.149:27673): avc: denied { ioctl } for pid=16753 comm="syz.6.3181" path="socket:[35672]" dev="sockfs" ino=35672 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 201.097839][ T29] audit: type=1326 audit(2000000075.089:27671): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16748 comm="syz.2.3180" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74236fe929 code=0x7ffc0000 [ 201.121461][ T29] audit: type=1326 audit(2000000075.149:27674): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16748 comm="syz.2.3180" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74236fe929 code=0x7ffc0000 [ 201.145301][ T29] audit: type=1326 audit(2000000075.149:27675): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16748 comm="syz.2.3180" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f74236fe929 code=0x7ffc0000 [ 201.146296][T16749] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 201.191002][T16749] EXT4-fs (loop2): 1 truncate cleaned up [ 201.197177][T16749] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 201.221458][T16765] 9pnet_fd: Insufficient options for proto=fd [ 201.239569][T16765] loop6: detected capacity change from 0 to 512 [ 201.246939][T16765] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 201.269853][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 201.302926][T16778] loop2: detected capacity change from 0 to 512 [ 201.330311][T16782] loop0: detected capacity change from 0 to 512 [ 201.338833][T16778] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 201.351627][T16778] ext4 filesystem being mounted at /29/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 201.364343][T16782] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 201.364812][T16778] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #2: comm syz.2.3185: corrupted inode contents [ 201.389607][T16778] EXT4-fs error (device loop2): ext4_dirty_inode:6459: inode #2: comm syz.2.3185: mark_inode_dirty error [ 201.398862][T16782] ext4 filesystem being mounted at /73/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 201.413951][T16782] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #2: comm syz.0.3187: corrupted inode contents [ 201.426002][T16778] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #2: comm syz.2.3185: corrupted inode contents [ 201.438669][T16782] EXT4-fs error (device loop0): ext4_dirty_inode:6459: inode #2: comm syz.0.3187: mark_inode_dirty error [ 201.458861][T16778] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #2: comm syz.2.3185: mark_inode_dirty error [ 201.470198][T16782] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #2: comm syz.0.3187: corrupted inode contents [ 201.482565][T15642] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 201.482586][T16782] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #2: comm syz.0.3187: mark_inode_dirty error [ 201.534181][T12600] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 201.565587][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 201.649332][T16828] loop6: detected capacity change from 0 to 512 [ 201.656605][T16828] EXT4-fs: Ignoring removed mblk_io_submit option [ 201.663440][T16828] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 201.676367][T16828] EXT4-fs (loop6): 1 truncate cleaned up [ 201.683306][T16828] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 201.729843][ T6110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 201.737129][T16845] netlink: 'syz.2.3199': attribute type 10 has an invalid length. [ 201.755518][T16845] bond0: (slave dummy0): Releasing backup interface [ 201.764224][T16845] team0: Port device dummy0 added [ 201.792076][T16845] netlink: 'syz.2.3199': attribute type 10 has an invalid length. [ 201.823251][T16860] loop4: detected capacity change from 0 to 164 [ 201.823750][T16855] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3202'. [ 201.838966][T16845] team0: Port device dummy0 removed [ 201.846186][T16845] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 201.858899][T16860] syz.4.3203: attempt to access beyond end of device [ 201.858899][T16860] loop4: rw=524288, sector=263328, nr_sectors = 4 limit=164 [ 201.890794][T16871] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=16871 comm=syz.0.3207 [ 201.905813][T16860] syz.4.3203: attempt to access beyond end of device [ 201.905813][T16860] loop4: rw=0, sector=263328, nr_sectors = 4 limit=164 [ 201.934438][T16874] loop1: detected capacity change from 0 to 512 [ 201.941593][T16874] EXT4-fs: Ignoring removed mblk_io_submit option [ 201.948486][T16874] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 201.960676][T16874] EXT4-fs (loop1): 1 truncate cleaned up [ 201.966651][T16874] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 201.977163][T16876] FAULT_INJECTION: forcing a failure. [ 201.977163][T16876] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 201.992277][T16876] CPU: 0 UID: 0 PID: 16876 Comm: syz.6.3209 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) [ 201.992305][T16876] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 201.992316][T16876] Call Trace: [ 201.992384][T16876] [ 201.992392][T16876] __dump_stack+0x1d/0x30 [ 201.992412][T16876] dump_stack_lvl+0xe8/0x140 [ 201.992433][T16876] dump_stack+0x15/0x1b [ 201.992450][T16876] should_fail_ex+0x265/0x280 [ 201.992521][T16876] should_fail+0xb/0x20 [ 201.992546][T16876] should_fail_usercopy+0x1a/0x20 [ 201.992648][T16876] _copy_to_iter+0xcf/0xe30 [ 201.992719][T16876] ? __pfx_woken_wake_function+0x10/0x10 [ 201.992744][T16876] tty_read+0x1a9/0x470 [ 201.992765][T16876] ? __import_iovec+0x428/0x540 [ 201.992786][T16876] do_iter_readv_writev+0x421/0x4c0 [ 201.992811][T16876] vfs_readv+0x1ea/0x690 [ 201.992848][T16876] do_readv+0xe7/0x210 [ 201.992868][T16876] __x64_sys_readv+0x45/0x50 [ 201.992883][T16876] x64_sys_call+0x29af/0x2fb0 [ 201.992962][T16876] do_syscall_64+0xd2/0x200 [ 201.992980][T16876] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 201.993002][T16876] ? clear_bhb_loop+0x40/0x90 [ 201.993022][T16876] ? clear_bhb_loop+0x40/0x90 [ 201.993077][T16876] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.993097][T16876] RIP: 0033:0x7f4aa00ee929 [ 201.993141][T16876] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 201.993159][T16876] RSP: 002b:00007f4a9e757038 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 201.993179][T16876] RAX: ffffffffffffffda RBX: 00007f4aa0315fa0 RCX: 00007f4aa00ee929 [ 201.993267][T16876] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000005 [ 201.993280][T16876] RBP: 00007f4a9e757090 R08: 0000000000000000 R09: 0000000000000000 [ 201.993292][T16876] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 201.993304][T16876] R13: 0000000000000000 R14: 00007f4aa0315fa0 R15: 00007ffef4a31198 [ 201.993383][T16876] [ 202.253890][T14229] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 202.285802][T16901] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3216'. [ 202.322447][T16905] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3217'. [ 202.389803][T16906] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 202.398296][T16917] netlink: 'syz.2.3221': attribute type 10 has an invalid length. [ 202.398447][T16906] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 202.407672][T16915] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3219'. [ 202.443463][T16929] netlink: 'syz.2.3221': attribute type 10 has an invalid length. [ 202.461347][T16921] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.492705][T16917] bond0: (slave dummy0): Releasing backup interface [ 202.507728][T16917] team0: Port device dummy0 added [ 202.537207][T16929] team0: Port device dummy0 removed [ 202.555323][T16929] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 202.583774][T16921] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.623213][T16938] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3224'. [ 202.632217][T16938] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3224'. [ 202.647213][T16942] loop2: detected capacity change from 0 to 512 [ 202.653773][T16938] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3224'. [ 202.664022][T16942] EXT4-fs: Ignoring removed mblk_io_submit option [ 202.679398][T16942] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 202.689323][T16938] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3224'. [ 202.698197][T16938] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3224'. [ 202.707298][T16938] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3224'. [ 202.718490][T16921] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.731641][T16942] EXT4-fs (loop2): 1 truncate cleaned up [ 202.737964][T16942] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 202.790175][T16921] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.826192][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 202.887659][T16921] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.900872][T16921] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.924656][T16921] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.956850][T16979] netlink: 'syz.6.3232': attribute type 10 has an invalid length. [ 202.957329][T16921] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.976362][T16979] bond0: (slave dummy0): Releasing backup interface [ 202.986087][T16979] team0: Port device dummy0 added [ 202.993420][T16983] netlink: 'syz.0.3233': attribute type 10 has an invalid length. [ 203.004022][T16983] bond0: (slave dummy0): Releasing backup interface [ 203.012532][T16979] netlink: 'syz.6.3232': attribute type 10 has an invalid length. [ 203.023986][T16983] team0: Port device dummy0 added [ 203.035383][T16983] netlink: 'syz.0.3233': attribute type 10 has an invalid length. [ 203.045832][T16979] team0: Port device dummy0 removed [ 203.052841][T16979] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 203.064216][T16983] team0: Port device dummy0 removed [ 203.082961][T16983] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 203.115598][T16989] loop1: detected capacity change from 0 to 512 [ 203.131103][T16989] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 203.148309][T16989] ext4 filesystem being mounted at /45/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 203.167045][T16997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 203.176433][T16997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 203.683721][T17089] loop4: detected capacity change from 0 to 512 [ 203.700343][T17089] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 203.712940][T17089] ext4 filesystem being mounted at /30/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 203.725495][T17089] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #2: comm syz.4.3250: corrupted inode contents [ 203.738502][T17089] EXT4-fs error (device loop4): ext4_dirty_inode:6459: inode #2: comm syz.4.3250: mark_inode_dirty error [ 203.758248][T17089] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #2: comm syz.4.3250: corrupted inode contents [ 203.761289][T17098] vlan0: entered allmulticast mode [ 203.772846][T17089] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #2: comm syz.4.3250: mark_inode_dirty error [ 203.775583][T17098] dummy0: entered allmulticast mode [ 203.802799][T15642] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 203.804150][T17096] vlan0: entered allmulticast mode [ 203.912721][T17123] loop0: detected capacity change from 0 to 512 [ 203.949350][T17124] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 203.965243][T17123] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 203.979350][T17123] ext4 filesystem being mounted at /86/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 203.992847][T17123] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #2: comm syz.0.3258: corrupted inode contents [ 204.006853][T17127] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 204.016136][T17127] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 204.024147][T17123] EXT4-fs error (device loop0): ext4_dirty_inode:6459: inode #2: comm syz.0.3258: mark_inode_dirty error [ 204.036456][T17123] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #2: comm syz.0.3258: corrupted inode contents [ 204.049369][T17123] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #2: comm syz.0.3258: mark_inode_dirty error [ 204.073101][T17124] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.112371][T12600] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 204.134010][T14229] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 204.169442][T17124] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.225467][T17124] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.297001][T17170] netlink: 'syz.6.3267': attribute type 10 has an invalid length. [ 204.310390][T17124] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.324810][T17124] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.349199][T17195] netlink: 'syz.6.3267': attribute type 10 has an invalid length. [ 204.357354][T17170] bond0: (slave dummy0): Releasing backup interface [ 204.380263][T17170] team0: Port device dummy0 added [ 204.389405][T17195] team0: Port device dummy0 removed [ 204.406664][T17195] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 204.427522][T17124] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.444599][T17124] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.466052][T17205] loop6: detected capacity change from 0 to 512 [ 204.494873][T17205] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 204.508494][T17205] ext4 filesystem being mounted at /535/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 204.523692][T17205] EXT4-fs error (device loop6): ext4_do_update_inode:5568: inode #2: comm syz.6.3270: corrupted inode contents [ 204.535996][T17205] EXT4-fs error (device loop6): ext4_dirty_inode:6459: inode #2: comm syz.6.3270: mark_inode_dirty error [ 204.549138][T17205] EXT4-fs error (device loop6): ext4_do_update_inode:5568: inode #2: comm syz.6.3270: corrupted inode contents [ 204.563675][T17205] EXT4-fs error (device loop6): __ext4_ext_dirty:206: inode #2: comm syz.6.3270: mark_inode_dirty error [ 205.167061][T17292] loop0: detected capacity change from 0 to 512 [ 205.174981][T17292] EXT4-fs: Ignoring removed mblk_io_submit option [ 205.182373][T17292] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 205.213129][T17292] EXT4-fs (loop0): 1 truncate cleaned up [ 205.220225][T17294] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 205.230005][T17294] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 205.273179][T17311] loop4: detected capacity change from 0 to 512 [ 205.282891][T17311] EXT4-fs (loop4): orphan cleanup on readonly fs [ 205.290879][T17311] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.3293: bg 0: block 248: padding at end of block bitmap is not set [ 205.319939][T17311] EXT4-fs error (device loop4): ext4_acquire_dquot:6933: comm syz.4.3293: Failed to acquire dquot type 1 [ 205.326084][T17317] loop0: detected capacity change from 0 to 512 [ 205.332739][T17311] EXT4-fs (loop4): 1 truncate cleaned up [ 205.358956][T17317] ext4 filesystem being mounted at /92/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 205.370241][T17311] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 205.389757][T17311] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 205.399994][T17311] EXT4-fs error (device loop4): ext4_lookup:1791: inode #2: comm syz.4.3293: deleted inode referenced: 12 [ 205.586131][T17357] loop6: detected capacity change from 0 to 512 [ 205.604368][T17357] ext4 filesystem being mounted at /540/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 205.616837][T17357] EXT4-fs error (device loop6): ext4_do_update_inode:5568: inode #2: comm syz.6.3299: corrupted inode contents [ 205.628983][T17357] EXT4-fs error (device loop6): ext4_dirty_inode:6459: inode #2: comm syz.6.3299: mark_inode_dirty error [ 205.644606][T17357] EXT4-fs error (device loop6): ext4_do_update_inode:5568: inode #2: comm syz.6.3299: corrupted inode contents [ 205.656585][T17357] EXT4-fs error (device loop6): __ext4_ext_dirty:206: inode #2: comm syz.6.3299: mark_inode_dirty error [ 205.724730][T17374] loop2: detected capacity change from 0 to 512 [ 205.732295][T17374] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 205.800653][T17387] af_packet: tpacket_rcv: packet too big, clamped from 2902 to 4294967272. macoff=96 [ 205.860248][T17392] SELinux: syz.6.3309 (17392) wrote to /sys/fs/selinux/user! This will not be supported in the future; please update your userspace. [ 205.933902][T17387] unsupported nla_type 65024 [ 206.016169][ T29] kauditd_printk_skb: 577 callbacks suppressed [ 206.016188][ T29] audit: type=1326 audit(2000000080.159:28251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17419 comm="syz.6.3314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 206.063099][ T29] audit: type=1326 audit(2000000080.189:28252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17419 comm="syz.6.3314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=27 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 206.086803][ T29] audit: type=1326 audit(2000000080.189:28253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17419 comm="syz.6.3314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 206.110485][ T29] audit: type=1326 audit(2000000080.189:28254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17419 comm="syz.6.3314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 206.134070][ T29] audit: type=1326 audit(2000000080.189:28255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17419 comm="syz.6.3314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 206.157698][ T29] audit: type=1326 audit(2000000080.189:28256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17419 comm="syz.6.3314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 206.181360][ T29] audit: type=1326 audit(2000000080.189:28257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17419 comm="syz.6.3314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 206.204976][ T29] audit: type=1326 audit(2000000080.189:28258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17419 comm="syz.6.3314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 206.228660][ T29] audit: type=1326 audit(2000000080.189:28259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17419 comm="syz.6.3314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 206.252252][ T29] audit: type=1326 audit(2000000080.189:28260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17419 comm="syz.6.3314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4aa00ee929 code=0x7ffc0000 [ 206.329369][T17429] loop0: detected capacity change from 0 to 512 [ 206.340694][T17429] ext4 filesystem being mounted at /93/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 206.401456][T17444] bond0: (slave dummy0): Releasing backup interface [ 206.419829][T17444] team0: Port device dummy0 added [ 206.440253][T17444] team0: Port device dummy0 removed [ 206.452386][T17444] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 206.682876][T17484] loop1: detected capacity change from 0 to 512 [ 206.700502][T17484] ext4 filesystem being mounted at /65/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 207.241692][T17507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.253271][T17507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 207.555376][T17559] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 207.562058][T17559] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 207.569698][T17558] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(8) [ 207.576209][T17558] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 207.583932][T17559] vhci_hcd vhci_hcd.0: Device attached [ 207.583965][T17558] vhci_hcd vhci_hcd.0: Device attached [ 207.603875][T17558] loop4: detected capacity change from 0 to 1024 [ 207.615038][T17558] /dev/loop4: Can't open blockdev [ 207.627288][T17559] sd 0:0:1:0: device reset [ 207.656064][T17575] __nla_validate_parse: 24 callbacks suppressed [ 207.656120][T17575] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3345'. [ 207.671829][T17575] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3345'. [ 207.680971][T17575] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3345'. [ 207.696509][T17575] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3345'. [ 207.705631][T17575] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3345'. [ 207.714877][T17575] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3345'. [ 207.736233][T17575] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3345'. [ 207.745261][T17575] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3345'. [ 207.754626][T17575] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3345'. [ 207.849910][T17588] loop0: detected capacity change from 0 to 512 [ 207.857701][T17588] EXT4-fs: Ignoring removed mblk_io_submit option [ 207.864068][T17610] loop6: detected capacity change from 0 to 512 [ 207.870947][T17588] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 207.871234][ T23] usb 10-1: SetAddress Request (2) to port 0 [ 207.883421][T17610] ext4 filesystem being mounted at /559/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 207.887100][ T23] usb 10-1: new SuperSpeed USB device number 2 using vhci_hcd [ 207.905328][T17588] EXT4-fs (loop0): 1 truncate cleaned up [ 208.134600][T17645] loop2: detected capacity change from 0 to 512 [ 208.141568][T17645] EXT4-fs: Ignoring removed mblk_io_submit option [ 208.148352][T17645] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 208.160949][T17645] EXT4-fs (loop2): 1 truncate cleaned up [ 208.190017][T17652] loop2: detected capacity change from 0 to 512 [ 208.199935][T17652] ext4 filesystem being mounted at /65/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 208.211400][T17652] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #2: comm syz.2.3353: corrupted inode contents [ 208.223394][T17652] EXT4-fs error (device loop2): ext4_dirty_inode:6459: inode #2: comm syz.2.3353: mark_inode_dirty error [ 208.235145][T17652] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #2: comm syz.2.3353: corrupted inode contents [ 208.247226][T17652] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #2: comm syz.2.3353: mark_inode_dirty error [ 208.372738][T17664] loop1: detected capacity change from 0 to 512 [ 208.383801][T17666] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3357'. [ 208.392993][T17561] vhci_hcd: connection closed [ 208.393094][T17560] vhci_hcd: connection reset by peer [ 208.393580][ T51] vhci_hcd: stop threads [ 208.401185][T17664] ext4 filesystem being mounted at /67/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 208.403166][ T51] vhci_hcd: release socket [ 208.411863][T17664] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.3356: corrupted inode contents [ 208.417491][ T51] vhci_hcd: disconnect device [ 208.422139][T17664] EXT4-fs error (device loop1): ext4_dirty_inode:6459: inode #2: comm syz.1.3356: mark_inode_dirty error [ 208.445505][ T51] vhci_hcd: stop threads [ 208.450476][T17664] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.3356: corrupted inode contents [ 208.453913][ T51] vhci_hcd: release socket [ 208.453927][ T51] vhci_hcd: disconnect device [ 208.466255][T17664] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.3356: mark_inode_dirty error [ 208.607996][T17680] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.616752][T17680] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.633599][T17685] team0 (unregistering): Port device team_slave_0 removed [ 208.655037][T17685] team0 (unregistering): Port device team_slave_1 removed [ 208.705143][T17692] batadv1: entered promiscuous mode [ 208.710511][T17692] batadv1: entered allmulticast mode [ 208.882300][T17736] loop6: detected capacity change from 0 to 512 [ 208.890178][T17736] EXT4-fs: Ignoring removed mblk_io_submit option [ 208.906351][T17736] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 208.927771][T17736] EXT4-fs (loop6): 1 truncate cleaned up [ 208.975965][T17764] 9pnet_fd: Insufficient options for proto=fd [ 209.014990][T17764] loop4: detected capacity change from 0 to 512 [ 209.035604][T17764] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 209.062731][T17774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 209.071256][T17774] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 209.084447][T17785] validate_nla: 2 callbacks suppressed [ 209.084462][T17785] netlink: 'syz.6.3369': attribute type 10 has an invalid length. [ 209.123511][T17785] bond0: (slave dummy0): Releasing backup interface [ 209.137036][T17791] netlink: 'syz.6.3369': attribute type 10 has an invalid length. [ 209.149811][T17785] team0: Port device dummy0 added [ 209.161743][T17791] team0: Port device dummy0 removed [ 209.172126][T17791] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 209.203288][T17795] loop6: detected capacity change from 0 to 512 [ 209.227090][T17795] ext4 filesystem being mounted at /564/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 209.590642][T17806] lo speed is unknown, defaulting to 1000 [ 209.596484][T17806] lo speed is unknown, defaulting to 1000 [ 209.603027][T17806] lo speed is unknown, defaulting to 1000 [ 209.609625][T17806] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 209.619499][T17806] lo speed is unknown, defaulting to 1000 [ 209.625734][T17806] lo speed is unknown, defaulting to 1000 [ 209.631922][T17806] lo speed is unknown, defaulting to 1000 [ 209.637992][T17806] lo speed is unknown, defaulting to 1000 [ 209.644074][T17806] lo speed is unknown, defaulting to 1000 [ 209.650218][T17806] lo speed is unknown, defaulting to 1000 [ 209.704034][T17817] lo speed is unknown, defaulting to 1000 [ 209.743541][T17828] bridge_slave_1: left allmulticast mode [ 209.749319][T17828] bridge_slave_1: left promiscuous mode [ 209.755095][T17828] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.763025][T17828] bridge_slave_0: left allmulticast mode [ 209.768706][T17828] bridge_slave_0: left promiscuous mode [ 209.774396][T17828] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.930158][T17853] lo speed is unknown, defaulting to 1000 [ 209.952382][T17863] loop2: detected capacity change from 0 to 512 [ 209.973281][T17863] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 210.000272][T17863] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 210.026000][T17863] EXT4-fs (loop2): 1 truncate cleaned up [ 210.140245][T17891] lo speed is unknown, defaulting to 1000 [ 210.218431][T17910] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.278944][T17910] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.302448][T17931] netlink: 'syz.6.3391': attribute type 10 has an invalid length. [ 210.323968][T17931] bond0: (slave dummy0): Releasing backup interface [ 210.336083][T17931] team0: Port device dummy0 added [ 210.351500][T17931] netlink: 'syz.6.3391': attribute type 10 has an invalid length. [ 210.376089][T17931] team0: Port device dummy0 removed [ 210.384061][T17931] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 210.472187][T17944] netlink: 'syz.4.3395': attribute type 1 has an invalid length. [ 210.483391][T17942] 9pnet_fd: Insufficient options for proto=fd [ 210.493089][T17942] loop0: detected capacity change from 0 to 512 [ 210.500384][T17942] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 210.541561][T17948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.550503][T17948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.733538][T17971] loop4: detected capacity change from 0 to 512 [ 210.825301][T17971] ext4 filesystem being mounted at /55/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 210.837911][T17971] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #2: comm syz.4.3398: corrupted inode contents [ 210.850150][T17971] EXT4-fs error (device loop4): ext4_dirty_inode:6459: inode #2: comm syz.4.3398: mark_inode_dirty error [ 210.867004][T17971] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #2: comm syz.4.3398: corrupted inode contents [ 210.895676][T17971] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #2: comm syz.4.3398: mark_inode_dirty error [ 211.020127][ T29] kauditd_printk_skb: 1343 callbacks suppressed [ 211.020140][ T29] audit: type=1326 audit(2000000085.169:29604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17982 comm="syz.4.3400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f4c378558e7 code=0x7ffc0000 [ 211.026569][T17994] loop1: detected capacity change from 0 to 164 [ 211.049953][ T29] audit: type=1326 audit(2000000085.169:29605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17982 comm="syz.4.3400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4c377fab19 code=0x7ffc0000 [ 211.050174][ T29] audit: type=1326 audit(2000000085.169:29606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17982 comm="syz.4.3400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=276 compat=0 ip=0x7f4c3785e929 code=0x7ffc0000 [ 211.095718][T17994] syz.1.3403: attempt to access beyond end of device [ 211.095718][T17994] loop1: rw=524288, sector=263328, nr_sectors = 4 limit=164 [ 211.103392][ T29] audit: type=1326 audit(2000000085.199:29607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17982 comm="syz.4.3400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f4c378558e7 code=0x7ffc0000 [ 211.119147][T17994] syz.1.3403: attempt to access beyond end of device [ 211.119147][T17994] loop1: rw=0, sector=263328, nr_sectors = 4 limit=164 [ 211.140522][ T29] audit: type=1326 audit(2000000085.199:29608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17982 comm="syz.4.3400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4c377fab19 code=0x7ffc0000 [ 211.177558][ T29] audit: type=1326 audit(2000000085.199:29609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17982 comm="syz.4.3400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=276 compat=0 ip=0x7f4c3785e929 code=0x7ffc0000 [ 211.201207][ T29] audit: type=1326 audit(2000000085.229:29610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17982 comm="syz.4.3400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f4c378558e7 code=0x7ffc0000 [ 211.224727][ T29] audit: type=1326 audit(2000000085.229:29611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17982 comm="syz.4.3400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4c377fab19 code=0x7ffc0000 [ 211.248209][ T29] audit: type=1326 audit(2000000085.229:29612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17982 comm="syz.4.3400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=276 compat=0 ip=0x7f4c3785e929 code=0x7ffc0000 [ 211.271802][ T29] audit: type=1326 audit(2000000085.229:29613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17982 comm="syz.4.3400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f4c378558e7 code=0x7ffc0000 [ 211.440425][T18013] loop0: detected capacity change from 0 to 512 [ 211.470214][T18013] ext4 filesystem being mounted at /112/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 211.483782][T18013] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #2: comm syz.0.3410: corrupted inode contents [ 211.496470][T18013] EXT4-fs error (device loop0): ext4_dirty_inode:6459: inode #2: comm syz.0.3410: mark_inode_dirty error [ 211.508191][T18013] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #2: comm syz.0.3410: corrupted inode contents [ 211.520435][T18013] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #2: comm syz.0.3410: mark_inode_dirty error [ 211.553382][T18023] lo speed is unknown, defaulting to 1000 [ 211.578883][T18028] loop1: detected capacity change from 0 to 512 [ 211.641029][T18028] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 211.699747][T18028] EXT4-fs (loop1): 1 truncate cleaned up [ 211.969291][T18070] loop0: detected capacity change from 0 to 164 [ 211.982529][T18070] syz.0.3419: attempt to access beyond end of device [ 211.982529][T18070] loop0: rw=524288, sector=263328, nr_sectors = 4 limit=164 [ 212.000131][T18070] syz.0.3419: attempt to access beyond end of device [ 212.000131][T18070] loop0: rw=0, sector=263328, nr_sectors = 4 limit=164 [ 212.039959][T18076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.049091][T18080] FAULT_INJECTION: forcing a failure. [ 212.049091][T18080] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 212.062171][T18080] CPU: 0 UID: 0 PID: 18080 Comm: syz.4.3421 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) [ 212.062250][T18080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 212.062334][T18080] Call Trace: [ 212.062340][T18080] [ 212.062347][T18080] __dump_stack+0x1d/0x30 [ 212.062370][T18080] dump_stack_lvl+0xe8/0x140 [ 212.062390][T18080] dump_stack+0x15/0x1b [ 212.062407][T18080] should_fail_ex+0x265/0x280 [ 212.062450][T18080] should_fail+0xb/0x20 [ 212.062477][T18080] should_fail_usercopy+0x1a/0x20 [ 212.062506][T18080] _copy_from_user+0x1c/0xb0 [ 212.062527][T18080] ___sys_recvmsg+0xaa/0x370 [ 212.062579][T18080] ? _parse_integer+0x27/0x40 [ 212.062672][T18080] do_recvmmsg+0x1ef/0x540 [ 212.062713][T18080] ? fput+0x8f/0xc0 [ 212.062741][T18080] __x64_sys_recvmmsg+0xe5/0x170 [ 212.062806][T18080] x64_sys_call+0x1c6a/0x2fb0 [ 212.062828][T18080] do_syscall_64+0xd2/0x200 [ 212.062881][T18080] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 212.062978][T18080] ? clear_bhb_loop+0x40/0x90 [ 212.062996][T18080] ? clear_bhb_loop+0x40/0x90 [ 212.063032][T18080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.063053][T18080] RIP: 0033:0x7f4c3785e929 [ 212.063072][T18080] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 212.063089][T18080] RSP: 002b:00007f4c35ec7038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 212.063109][T18080] RAX: ffffffffffffffda RBX: 00007f4c37a85fa0 RCX: 00007f4c3785e929 [ 212.063122][T18080] RDX: 0000000000000220 RSI: 00002000000002c0 RDI: 0000000000000003 [ 212.063192][T18080] RBP: 00007f4c35ec7090 R08: 0000000000000000 R09: 0000000000000000 [ 212.063204][T18080] R10: 0000000000000100 R11: 0000000000000246 R12: 0000000000000001 [ 212.063217][T18080] R13: 0000000000000000 R14: 00007f4c37a85fa0 R15: 00007ffc13886418 [ 212.063237][T18080] [ 212.066258][T18076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.366019][T18100] lo speed is unknown, defaulting to 1000 [ 212.388466][T18111] 9pnet_fd: Insufficient options for proto=fd [ 212.397597][T18111] loop1: detected capacity change from 0 to 512 [ 212.404364][T18111] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 212.544683][T18137] loop1: detected capacity change from 0 to 512 [ 212.576223][T18137] EXT4-fs: Ignoring removed mblk_io_submit option [ 212.604973][T18144] netlink: 'syz.2.3432': attribute type 27 has an invalid length. [ 212.627134][T18137] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 212.718087][T18137] EXT4-fs (loop1): 1 truncate cleaned up [ 212.739146][T18155] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.767093][T18155] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.812301][T18164] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 212.812301][T18164] The task syz.2.3432 (18164) triggered the difference, watch for misbehavior. [ 212.850066][T18163] __nla_validate_parse: 33 callbacks suppressed [ 212.850149][T18163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3435'. [ 212.865326][T18163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3435'. [ 212.888720][T18163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3435'. [ 212.918274][T18163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3435'. [ 212.927296][T18163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3435'. [ 212.938143][T18163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3435'. [ 212.958782][ T23] usb 10-1: device descriptor read/8, error -110 [ 212.982673][T18163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3435'. [ 212.991676][T18163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3435'. [ 213.000890][T18163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3435'. [ 213.031738][T18179] lo speed is unknown, defaulting to 1000 [ 213.066014][T18200] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3439'. [ 213.078972][ T23] usb 10-1: new SuperSpeed USB device number 2 using vhci_hcd [ 213.098680][ T23] usb 10-1: enqueue for inactive port 0 [ 213.108064][ T23] usb 10-1: enqueue for inactive port 0 [ 213.114004][ T23] usb 10-1: enqueue for inactive port 0 [ 213.155743][T18212] team0 (unregistering): Port device team_slave_0 removed [ 213.164612][T18212] team0 (unregistering): Port device team_slave_1 removed [ 213.186389][T18214] lo speed is unknown, defaulting to 1000 [ 213.230948][T18271] loop1: detected capacity change from 0 to 512 [ 213.238110][T18271] EXT4-fs: Ignoring removed mblk_io_submit option [ 213.245069][T18271] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 213.256520][T18271] EXT4-fs (loop1): 1 truncate cleaned up [ 213.267039][T18276] loop0: detected capacity change from 0 to 512 [ 213.275853][T18276] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 213.287331][T18276] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 213.302052][T18276] EXT4-fs (loop0): 1 truncate cleaned up [ 213.335568][T18286] loop0: detected capacity change from 0 to 512 [ 213.363836][T18286] ext4 filesystem being mounted at /123/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 213.388984][T18296] FAULT_INJECTION: forcing a failure. [ 213.388984][T18296] name failslab, interval 1, probability 0, space 0, times 0 [ 213.401775][T18296] CPU: 0 UID: 0 PID: 18296 Comm: syz.1.3451 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) [ 213.401799][T18296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 213.401809][T18296] Call Trace: [ 213.401815][T18296] [ 213.401821][T18296] __dump_stack+0x1d/0x30 [ 213.401853][T18296] dump_stack_lvl+0xe8/0x140 [ 213.401874][T18296] dump_stack+0x15/0x1b [ 213.401891][T18296] should_fail_ex+0x265/0x280 [ 213.401922][T18296] should_failslab+0x8c/0xb0 [ 213.401945][T18296] kmem_cache_alloc_noprof+0x50/0x310 [ 213.401979][T18296] ? audit_log_start+0x365/0x6c0 [ 213.402010][T18296] audit_log_start+0x365/0x6c0 [ 213.402122][T18296] audit_seccomp+0x48/0x100 [ 213.402149][T18296] ? __seccomp_filter+0x68c/0x10d0 [ 213.402168][T18296] __seccomp_filter+0x69d/0x10d0 [ 213.402192][T18296] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 213.402265][T18296] ? vfs_write+0x75e/0x8e0 [ 213.402291][T18296] ? __rcu_read_unlock+0x4f/0x70 [ 213.402381][T18296] ? __fget_files+0x184/0x1c0 [ 213.402403][T18296] __secure_computing+0x82/0x150 [ 213.402423][T18296] syscall_trace_enter+0xcf/0x1e0 [ 213.402488][T18296] do_syscall_64+0xac/0x200 [ 213.402505][T18296] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 213.402525][T18296] ? clear_bhb_loop+0x40/0x90 [ 213.402547][T18296] ? clear_bhb_loop+0x40/0x90 [ 213.402601][T18296] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.402620][T18296] RIP: 0033:0x7f0a3e41e929 [ 213.402636][T18296] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 213.402692][T18296] RSP: 002b:00007f0a3ca87038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 213.402711][T18296] RAX: ffffffffffffffda RBX: 00007f0a3e645fa0 RCX: 00007f0a3e41e929 [ 213.402724][T18296] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 213.402736][T18296] RBP: 00007f0a3ca87090 R08: 0000000000000000 R09: 0000000000000000 [ 213.402747][T18296] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 213.402773][T18296] R13: 0000000000000000 R14: 00007f0a3e645fa0 R15: 00007ffc17393c48 [ 213.402792][T18296] [ 213.651879][T18304] netlink: 'syz.4.3454': attribute type 10 has an invalid length. [ 213.662725][T18304] bond0: (slave dummy0): Releasing backup interface [ 213.672671][T18304] team0: Port device dummy0 added [ 213.680029][T18304] netlink: 'syz.4.3454': attribute type 10 has an invalid length. [ 213.690615][T18304] team0: Port device dummy0 removed [ 213.698033][T18304] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 213.755050][T18312] lo speed is unknown, defaulting to 1000 [ 213.762399][T18317] loop6: detected capacity change from 0 to 512 [ 213.769955][T18317] EXT4-fs: Ignoring removed mblk_io_submit option [ 213.777544][T18317] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 213.801084][T18317] EXT4-fs (loop6): 1 truncate cleaned up [ 213.814882][T18344] netlink: 'syz.4.3459': attribute type 10 has an invalid length. [ 213.835565][T18344] bond0: (slave dummy0): Releasing backup interface [ 213.851960][T18344] team0: Port device dummy0 added [ 213.867985][T18344] netlink: 'syz.4.3459': attribute type 10 has an invalid length. [ 213.873964][T18350] lo speed is unknown, defaulting to 1000 [ 213.882500][T18344] team0: Port device dummy0 removed [ 213.889534][T18344] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 213.923186][T18368] sd 0:0:1:0: device reset [ 213.936342][T18368] loop4: detected capacity change from 0 to 2048 [ 213.952765][T18368] EXT4-fs (loop4): shut down requested (0) [ 213.960197][T18368] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 213.969159][T18368] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 213.978254][T18368] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=12 [ 213.992290][T18368] IPv6: Can't replace route, no match found [ 214.130251][T18393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 214.139166][T18393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 214.161851][T18391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 214.182946][T18391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 214.246116][T18415] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 214.255026][ T23] usb usb10-port1: attempt power cycle [ 214.260984][T18415] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 214.316177][T18426] lo speed is unknown, defaulting to 1000 [ 214.605938][T18460] loop2: detected capacity change from 0 to 512 [ 214.613706][T18460] EXT4-fs: Ignoring removed mblk_io_submit option [ 214.622463][T18460] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 214.642841][T18460] EXT4-fs (loop2): 1 truncate cleaned up [ 214.656571][T18470] loop0: detected capacity change from 0 to 164 [ 214.668452][T18470] syz.0.3474: attempt to access beyond end of device [ 214.668452][T18470] loop0: rw=524288, sector=263328, nr_sectors = 4 limit=164 [ 214.692697][T18470] syz.0.3474: attempt to access beyond end of device [ 214.692697][T18470] loop0: rw=0, sector=263328, nr_sectors = 4 limit=164 [ 214.739489][T18477] loop2: detected capacity change from 0 to 512 [ 214.748587][T18477] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 214.769405][T18477] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8042c118, mo2=0002] [ 214.783583][T18477] EXT4-fs error (device loop2): ext4_iget_extra_inode:5035: inode #15: comm syz.2.3475: corrupted in-inode xattr: e_value size too large [ 214.809457][T18477] EXT4-fs error (device loop2): ext4_orphan_get:1398: comm syz.2.3475: couldn't read orphan inode 15 (err -117) [ 214.860306][T18494] netlink: 'syz.0.3478': attribute type 10 has an invalid length. [ 214.870083][T18494] bond0: (slave dummy0): Releasing backup interface [ 214.873162][T18496] loop2: detected capacity change from 0 to 512 [ 214.885105][T18494] netlink: 'syz.0.3478': attribute type 10 has an invalid length. [ 214.895642][T18494] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 214.908270][T18499] netlink: 'syz.1.3480': attribute type 10 has an invalid length. [ 214.918963][T18499] bond0: (slave dummy0): Releasing backup interface [ 214.919985][T18496] ext4 filesystem being mounted at /85/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 214.937853][T18499] team0: Port device dummy0 added [ 214.950143][T18499] netlink: 'syz.1.3480': attribute type 10 has an invalid length. [ 214.959970][T18499] team0: Port device dummy0 removed [ 214.966922][T18499] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 215.412737][T18528] loop4: detected capacity change from 0 to 512 [ 215.431090][T18528] ext4 filesystem being mounted at /73/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 215.714392][T18556] FAULT_INJECTION: forcing a failure. [ 215.714392][T18556] name failslab, interval 1, probability 0, space 0, times 0 [ 215.727116][T18556] CPU: 1 UID: 0 PID: 18556 Comm: syz.2.3499 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) [ 215.727144][T18556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 215.727163][T18556] Call Trace: [ 215.727169][T18556] [ 215.727177][T18556] __dump_stack+0x1d/0x30 [ 215.727199][T18556] dump_stack_lvl+0xe8/0x140 [ 215.727224][T18556] dump_stack+0x15/0x1b [ 215.727240][T18556] should_fail_ex+0x265/0x280 [ 215.727270][T18556] should_failslab+0x8c/0xb0 [ 215.727293][T18556] kmem_cache_alloc_lru_noprof+0x55/0x310 [ 215.727338][T18556] ? alloc_inode+0x9a/0x170 [ 215.727366][T18556] ? _raw_spin_unlock+0x26/0x50 [ 215.727455][T18556] alloc_inode+0x9a/0x170 [ 215.727529][T18556] alloc_anon_inode+0x1e/0x170 [ 215.727636][T18556] __se_sys_memfd_secret+0xf3/0x2b0 [ 215.727743][T18556] __x64_sys_memfd_secret+0x1f/0x30 [ 215.727771][T18556] x64_sys_call+0x2b30/0x2fb0 [ 215.727791][T18556] do_syscall_64+0xd2/0x200 [ 215.727809][T18556] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 215.727843][T18556] ? clear_bhb_loop+0x40/0x90 [ 215.727865][T18556] ? clear_bhb_loop+0x40/0x90 [ 215.728023][T18556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.728042][T18556] RIP: 0033:0x7f74236fe929 [ 215.728059][T18556] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 215.728077][T18556] RSP: 002b:00007f7421d67038 EFLAGS: 00000246 ORIG_RAX: 00000000000001bf [ 215.728097][T18556] RAX: ffffffffffffffda RBX: 00007f7423925fa0 RCX: 00007f74236fe929 [ 215.728111][T18556] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 215.728174][T18556] RBP: 00007f7421d67090 R08: 0000000000000000 R09: 0000000000000000 [ 215.728185][T18556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 215.728198][T18556] R13: 0000000000000000 R14: 00007f7423925fa0 R15: 00007fffa59dd348 [ 215.728217][T18556] [ 215.939371][T18563] loop2: detected capacity change from 0 to 512 [ 215.950928][T18563] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 215.966540][T18563] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 216.021485][T18563] EXT4-fs (loop2): 1 truncate cleaned up [ 216.068542][T18563] EXT4-fs mount: 54 callbacks suppressed [ 216.068558][T18563] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 216.106178][ T29] kauditd_printk_skb: 880 callbacks suppressed [ 216.106194][ T29] audit: type=1326 audit(2000000090.239:30492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18566 comm="syz.0.3504" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f539202e929 code=0x0 [ 216.232071][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 216.255753][ T29] audit: type=1326 audit(2000000090.399:30493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18573 comm="syz.1.3507" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 216.279410][ T29] audit: type=1326 audit(2000000090.399:30494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18573 comm="syz.1.3507" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 216.303070][ T29] audit: type=1326 audit(2000000090.399:30495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18573 comm="syz.1.3507" exe="/root/syz-executor" sig=0 arch=c000003e syscall=253 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 216.326635][ T29] audit: type=1326 audit(2000000090.399:30496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18573 comm="syz.1.3507" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 216.350235][ T29] audit: type=1326 audit(2000000090.399:30497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18573 comm="syz.1.3507" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 216.373812][ T29] audit: type=1326 audit(2000000090.399:30498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18573 comm="syz.1.3507" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 216.397422][ T29] audit: type=1326 audit(2000000090.399:30499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18573 comm="syz.1.3507" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 216.421079][ T29] audit: type=1326 audit(2000000090.399:30500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18573 comm="syz.1.3507" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 216.444735][ T29] audit: type=1326 audit(2000000090.399:30501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18573 comm="syz.1.3507" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 216.469239][ T23] usb usb10-port1: unable to enumerate USB device [ 216.488364][T15642] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 216.517527][T18590] loop1: detected capacity change from 0 to 512 [ 216.531316][T18590] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 216.543954][T18590] ext4 filesystem being mounted at /105/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 216.606386][T18599] FAULT_INJECTION: forcing a failure. [ 216.606386][T18599] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 216.619508][T18599] CPU: 1 UID: 0 PID: 18599 Comm: syz.4.3509 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) [ 216.619564][T18599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 216.619576][T18599] Call Trace: [ 216.619583][T18599] [ 216.619591][T18599] __dump_stack+0x1d/0x30 [ 216.619669][T18599] dump_stack_lvl+0xe8/0x140 [ 216.619727][T18599] dump_stack+0x15/0x1b [ 216.619743][T18599] should_fail_ex+0x265/0x280 [ 216.619777][T18599] should_fail+0xb/0x20 [ 216.619803][T18599] should_fail_usercopy+0x1a/0x20 [ 216.619833][T18599] _copy_from_user+0x1c/0xb0 [ 216.619888][T18599] ___sys_sendmsg+0xc1/0x1d0 [ 216.620011][T18599] __sys_sendmmsg+0x178/0x300 [ 216.620080][T18599] __x64_sys_sendmmsg+0x57/0x70 [ 216.620104][T18599] x64_sys_call+0x2f2f/0x2fb0 [ 216.620151][T18599] do_syscall_64+0xd2/0x200 [ 216.620169][T18599] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 216.620193][T18599] ? clear_bhb_loop+0x40/0x90 [ 216.620214][T18599] ? clear_bhb_loop+0x40/0x90 [ 216.620236][T18599] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.620335][T18599] RIP: 0033:0x7f4c3785e929 [ 216.620351][T18599] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 216.620369][T18599] RSP: 002b:00007f4c35ea6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 216.620462][T18599] RAX: ffffffffffffffda RBX: 00007f4c37a86080 RCX: 00007f4c3785e929 [ 216.620495][T18599] RDX: 0400000000000181 RSI: 00002000000030c0 RDI: 0000000000000009 [ 216.620506][T18599] RBP: 00007f4c35ea6090 R08: 0000000000000000 R09: 0000000000000000 [ 216.620516][T18599] R10: 9200000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 216.620526][T18599] R13: 0000000000000000 R14: 00007f4c37a86080 R15: 00007ffc13886418 [ 216.620541][T18599] [ 217.356877][T18612] netlink: 'syz.4.3518': attribute type 1 has an invalid length. [ 217.377618][T14229] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 217.393262][T18614] loop4: detected capacity change from 0 to 512 [ 217.411528][T18614] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 217.417913][T18621] lo speed is unknown, defaulting to 1000 [ 217.438111][T18614] ext4 filesystem being mounted at /76/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 217.492876][T18648] netlink: 'syz.2.3523': attribute type 10 has an invalid length. [ 217.503243][T18648] bond0: (slave dummy0): Releasing backup interface [ 217.515966][T18648] netlink: 'syz.2.3523': attribute type 10 has an invalid length. [ 217.526863][T18648] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 217.569221][T18654] netlink: 'syz.2.3525': attribute type 10 has an invalid length. [ 217.601561][T18654] bond0: (slave dummy0): Releasing backup interface [ 217.611884][T18654] netlink: 'syz.2.3525': attribute type 10 has an invalid length. [ 217.621700][T18654] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 217.702449][T18656] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.711314][T18656] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.722650][T18673] loop2: detected capacity change from 0 to 512 [ 217.730223][T18669] netlink: 'syz.6.3529': attribute type 10 has an invalid length. [ 217.739858][T18669] bond0: (slave dummy0): Releasing backup interface [ 217.741314][T18673] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 217.759380][T18673] ext4 filesystem being mounted at /97/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 217.761711][T18669] team0: Port device dummy0 added [ 217.789422][T18669] team0: Port device dummy0 removed [ 217.797087][T18669] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 217.851633][T18688] lo speed is unknown, defaulting to 1000 [ 217.869371][T18699] loop6: detected capacity change from 0 to 512 [ 217.876457][T18699] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 217.902992][T18716] loop0: detected capacity change from 0 to 512 [ 217.910014][T18716] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 217.938027][T18718] loop6: detected capacity change from 0 to 512 [ 217.950109][T18718] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 217.963387][T18718] ext4 filesystem being mounted at /595/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 217.977376][T18718] EXT4-fs error (device loop6): ext4_do_update_inode:5568: inode #2: comm syz.6.3536: corrupted inode contents [ 217.981274][T18723] 9pnet: Could not find request transport: 0xffffffffffffffff [ 217.989898][T18718] EXT4-fs error (device loop6): ext4_dirty_inode:6459: inode #2: comm syz.6.3536: mark_inode_dirty error [ 218.009320][T18718] EXT4-fs error (device loop6): ext4_do_update_inode:5568: inode #2: comm syz.6.3536: corrupted inode contents [ 218.021493][T18718] EXT4-fs error (device loop6): __ext4_ext_dirty:206: inode #2: comm syz.6.3536: mark_inode_dirty error [ 218.055063][ T6110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 218.091534][T18738] lo speed is unknown, defaulting to 1000 [ 218.232360][T15642] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 218.286788][T18777] lo speed is unknown, defaulting to 1000 [ 218.292086][T18786] loop6: detected capacity change from 0 to 512 [ 218.311098][T18786] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 218.325418][T18807] FAULT_INJECTION: forcing a failure. [ 218.325418][T18807] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 218.338591][T18807] CPU: 1 UID: 0 PID: 18807 Comm: syz.1.3544 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) [ 218.338626][T18786] ext4 filesystem being mounted at /598/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 218.338661][T18807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 218.338674][T18807] Call Trace: [ 218.338681][T18807] [ 218.338689][T18807] __dump_stack+0x1d/0x30 [ 218.338709][T18807] dump_stack_lvl+0xe8/0x140 [ 218.338728][T18807] dump_stack+0x15/0x1b [ 218.338786][T18807] should_fail_ex+0x265/0x280 [ 218.338828][T18807] should_fail+0xb/0x20 [ 218.338858][T18807] should_fail_usercopy+0x1a/0x20 [ 218.338889][T18807] _copy_from_user+0x1c/0xb0 [ 218.338965][T18807] __x64_sys_epoll_ctl+0x92/0x100 [ 218.339120][T18807] x64_sys_call+0x26ef/0x2fb0 [ 218.339142][T18807] do_syscall_64+0xd2/0x200 [ 218.339161][T18807] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 218.339230][T18807] ? clear_bhb_loop+0x40/0x90 [ 218.339251][T18807] ? clear_bhb_loop+0x40/0x90 [ 218.339272][T18807] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.339293][T18807] RIP: 0033:0x7f0a3e41e929 [ 218.339309][T18807] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 218.339392][T18807] RSP: 002b:00007f0a3ca66038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 218.339412][T18807] RAX: ffffffffffffffda RBX: 00007f0a3e646080 RCX: 00007f0a3e41e929 [ 218.339425][T18807] RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000006 [ 218.339477][T18807] RBP: 00007f0a3ca66090 R08: 0000000000000000 R09: 0000000000000000 [ 218.339490][T18807] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 218.339503][T18807] R13: 0000000000000000 R14: 00007f0a3e646080 R15: 00007ffc17393c48 [ 218.339522][T18807] [ 218.522349][T18784] lo speed is unknown, defaulting to 1000 [ 218.533976][T18786] EXT4-fs error (device loop6): ext4_do_update_inode:5568: inode #2: comm syz.6.3546: corrupted inode contents [ 218.554498][T18811] lo speed is unknown, defaulting to 1000 [ 218.562492][T18786] EXT4-fs error (device loop6): ext4_dirty_inode:6459: inode #2: comm syz.6.3546: mark_inode_dirty error [ 218.574838][T18786] EXT4-fs error (device loop6): ext4_do_update_inode:5568: inode #2: comm syz.6.3546: corrupted inode contents [ 218.596471][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 218.605691][T18786] EXT4-fs error (device loop6): __ext4_ext_dirty:206: inode #2: comm syz.6.3546: mark_inode_dirty error [ 218.637464][ T6110] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 218.723813][T18872] loop2: detected capacity change from 0 to 512 [ 218.743082][T18872] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 218.765722][T18872] ext4 filesystem being mounted at /100/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 218.823509][T18882] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.851526][T18882] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.928257][T18889] lo speed is unknown, defaulting to 1000 [ 219.003301][T18889] chnl_net:caif_netlink_parms(): no params data found [ 219.034265][ T51] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.074274][ T51] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.085678][T18889] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.092793][T18889] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.100498][T18889] bridge_slave_0: entered allmulticast mode [ 219.106867][T18889] bridge_slave_0: entered promiscuous mode [ 219.113137][T19038] loop4: detected capacity change from 0 to 512 [ 219.113596][T18889] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.126552][T18889] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.128257][T19038] EXT4-fs: Ignoring removed mblk_io_submit option [ 219.133876][T18889] bridge_slave_1: entered allmulticast mode [ 219.146537][T18889] bridge_slave_1: entered promiscuous mode [ 219.153913][T19038] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 219.166422][T19038] EXT4-fs (loop4): 1 truncate cleaned up [ 219.166921][ T51] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.172741][T19038] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 219.207748][T18889] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 219.218388][T18889] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 219.236574][ T51] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.254201][T18889] team0: Port device team_slave_0 added [ 219.261203][T18889] team0: Port device team_slave_1 added [ 219.275680][T15642] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.290490][T19117] __nla_validate_parse: 21 callbacks suppressed [ 219.290559][T19117] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3559'. [ 219.314070][T18889] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 219.321110][T18889] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 219.347099][T18889] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 219.358668][T18889] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 219.365697][T18889] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 219.391749][T18889] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 219.411245][T19145] lo speed is unknown, defaulting to 1000 [ 219.449130][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.464143][T18889] hsr_slave_0: entered promiscuous mode [ 219.478110][T18889] hsr_slave_1: entered promiscuous mode [ 219.490848][T19204] bond0: (slave dummy0): Releasing backup interface [ 219.499705][ T51] bridge_slave_1: left allmulticast mode [ 219.505440][ T51] bridge_slave_1: left promiscuous mode [ 219.511528][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.520553][ T51] bridge_slave_0: left allmulticast mode [ 219.526311][ T51] bridge_slave_0: left promiscuous mode [ 219.532058][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.631270][ T51] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 219.641403][ T51] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 219.652394][ T51] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 219.661824][ T51] bond0 (unregistering): Released all slaves [ 219.677630][T19204] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 219.724434][ T51] hsr_slave_0: left promiscuous mode [ 219.738203][ T51] hsr_slave_1: left promiscuous mode [ 219.755189][T19233] loop0: detected capacity change from 0 to 512 [ 219.764070][ T51] veth1_macvtap: left promiscuous mode [ 219.770039][ T51] veth0_macvtap: left promiscuous mode [ 219.780828][T19233] EXT4-fs error (device loop0): ext4_orphan_get:1393: inode #15: comm syz.0.3566: casefold flag without casefold feature [ 219.802691][T19233] EXT4-fs error (device loop0): ext4_orphan_get:1398: comm syz.0.3566: couldn't read orphan inode 15 (err -117) [ 219.817124][T19233] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 219.911577][T19253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.925777][T19253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.926522][ T51] team0 (unregistering): Port device team_slave_1 removed [ 219.952102][ T51] team0 (unregistering): Port device team_slave_0 removed [ 220.182027][T19315] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 220.195648][T19323] loop1: detected capacity change from 0 to 512 [ 220.209039][T19315] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 220.227465][T19323] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 220.242364][T19323] ext4 filesystem being mounted at /114/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 220.541936][T18889] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 220.550798][T18889] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 220.558740][T12600] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 220.559372][T18889] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 220.576946][T18889] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 220.609689][T19372] loop0: detected capacity change from 0 to 512 [ 220.614150][T18889] 8021q: adding VLAN 0 to HW filter on device bond0 [ 220.627412][T18889] 8021q: adding VLAN 0 to HW filter on device team0 [ 220.630439][T19372] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 220.647758][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.652498][T19372] ext4 filesystem being mounted at /152/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 220.654813][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 220.668534][T19372] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #2: comm syz.0.3572: corrupted inode contents [ 220.674005][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.685480][T19372] EXT4-fs error (device loop0): ext4_dirty_inode:6459: inode #2: comm syz.0.3572: mark_inode_dirty error [ 220.690999][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 220.710094][T19372] EXT4-fs error (device loop0): ext4_do_update_inode:5568: inode #2: comm syz.0.3572: corrupted inode contents [ 220.722169][T19372] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #2: comm syz.0.3572: mark_inode_dirty error [ 220.743046][T18889] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 220.753809][T12600] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 220.806051][T19395] loop2: detected capacity change from 0 to 512 [ 220.821316][T19395] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 220.836239][T19395] ext4 filesystem being mounted at /105/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 220.851915][T19402] validate_nla: 4 callbacks suppressed [ 220.851931][T19402] netlink: 'syz.0.3575': attribute type 10 has an invalid length. [ 220.871048][T19402] bond0: (slave dummy0): Releasing backup interface [ 220.886980][T19402] netlink: 'syz.0.3575': attribute type 10 has an invalid length. [ 220.894148][T18889] veth0_vlan: entered promiscuous mode [ 220.904815][T19402] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 220.917897][T18889] veth1_vlan: entered promiscuous mode [ 220.934614][T18889] veth0_macvtap: entered promiscuous mode [ 220.942194][T18889] veth1_macvtap: entered promiscuous mode [ 220.956109][T18889] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 220.967994][T18889] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 220.979875][T18889] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.988625][T18889] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.997490][T18889] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.006265][T18889] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.041004][T19410] loop0: detected capacity change from 0 to 512 [ 221.048253][T19410] EXT4-fs: Ignoring removed mblk_io_submit option [ 221.055243][T14229] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.072189][T19410] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 221.072200][T19415] netlink: 'syz.6.3555': attribute type 1 has an invalid length. [ 221.072213][T19415] netlink: 224 bytes leftover after parsing attributes in process `syz.6.3555'. [ 221.113801][T19421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3579'. [ 221.122770][T19421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3579'. [ 221.133534][ T29] kauditd_printk_skb: 294 callbacks suppressed [ 221.133546][ T29] audit: type=1326 audit(2000000095.279:30796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19411 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=c000003e syscall=60 compat=0 ip=0x7f539202e929 code=0x7ffc0000 [ 221.148887][T19421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3579'. [ 221.164949][T19410] EXT4-fs (loop0): 1 truncate cleaned up [ 221.181631][ T29] audit: type=1326 audit(2000000095.329:30797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19420 comm="syz.1.3579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 221.210232][T19410] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 221.215788][ T29] audit: type=1326 audit(2000000095.359:30798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19420 comm="syz.1.3579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=253 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 221.223022][T19421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3579'. [ 221.246244][ T29] audit: type=1326 audit(2000000095.359:30799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19420 comm="syz.1.3579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 221.255100][T19421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3579'. [ 221.287609][ T29] audit: type=1326 audit(2000000095.359:30800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19420 comm="syz.1.3579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 221.311256][ T29] audit: type=1326 audit(2000000095.359:30801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19420 comm="syz.1.3579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 221.334915][ T29] audit: type=1326 audit(2000000095.359:30802): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19420 comm="syz.1.3579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 221.358492][ T29] audit: type=1326 audit(2000000095.359:30803): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19420 comm="syz.1.3579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 221.382085][ T29] audit: type=1326 audit(2000000095.359:30804): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19420 comm="syz.1.3579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 221.397511][T19421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3579'. [ 221.405677][ T29] audit: type=1326 audit(2000000095.359:30805): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19420 comm="syz.1.3579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a3e41e929 code=0x7ffc0000 [ 221.457473][T19421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3579'. [ 221.466435][T19421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3579'. [ 221.492836][T12600] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.531300][T19437] lo speed is unknown, defaulting to 1000 [ 221.662467][T14959] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.701766][T19465] team0 (unregistering): Port device team_slave_0 removed [ 221.746731][T19465] team0 (unregistering): Port device team_slave_1 removed [ 221.761526][T19475] netlink: 'syz.2.3587': attribute type 1 has an invalid length. [ 221.785919][T19469] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.795119][T19469] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.885653][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 221.893151][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 221.900563][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 221.907975][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 221.915494][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 221.922912][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 221.930332][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 221.937824][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 221.945308][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 221.952715][T19518] siw: device registration error -23 [ 221.952843][ T3392] ================================================================== [ 221.952873][ T3392] BUG: KCSAN: data-race in _prb_read_valid / data_alloc [ 221.952914][ T3392] [ 221.952920][ T3392] write to 0xffffffff8686ead8 of 8 bytes by task 19518 on cpu 0: [ 221.952934][ T3392] data_alloc+0x271/0x2b0 [ 221.952959][ T3392] prb_reserve+0x808/0xaf0 [ 221.952982][ T3392] vprintk_store+0x56d/0x860 [ 221.952997][ T3392] vprintk_emit+0x178/0x650 [ 221.953013][ T3392] vprintk_default+0x26/0x30 [ 221.953030][ T3392] vprintk+0x1d/0x30 [ 221.953052][ T3392] _printk+0x79/0xa0 [ 221.953078][ T3392] siw_newlink+0x665/0x680 [ 221.953099][ T3392] nldev_newlink+0x369/0x3f0 [ 221.953118][ T3392] rdma_nl_rcv+0x479/0x5a0 [ 221.953138][ T3392] netlink_unicast+0x5a1/0x670 [ 221.953166][ T3392] netlink_sendmsg+0x58b/0x6b0 [ 221.953183][ T3392] __sock_sendmsg+0x145/0x180 [ 221.953204][ T3392] ____sys_sendmsg+0x31e/0x4e0 [ 221.953232][ T3392] ___sys_sendmsg+0x17b/0x1d0 [ 221.953259][ T3392] __x64_sys_sendmsg+0xd4/0x160 [ 221.953286][ T3392] x64_sys_call+0x2999/0x2fb0 [ 221.953306][ T3392] do_syscall_64+0xd2/0x200 [ 221.953320][ T3392] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.953343][ T3392] [ 221.953348][ T3392] read to 0xffffffff8686ead8 of 16 bytes by task 3392 on cpu 1: [ 221.953361][ T3392] _prb_read_valid+0x1bc/0x920 [ 221.953387][ T3392] prb_read_valid+0x3c/0x60 [ 221.953413][ T3392] printk_get_next_message+0xc8/0x510 [ 221.953433][ T3392] console_flush_all+0x290/0x730 [ 221.953453][ T3392] console_unlock+0xa1/0x330 [ 221.953471][ T3392] vprintk_emit+0x388/0x650 [ 221.953487][ T3392] dev_vprintk_emit+0x242/0x2a0 [ 221.953504][ T3392] dev_printk_emit+0x84/0xb0 [ 221.953520][ T3392] __dev_printk+0xf3/0x110 [ 221.953543][ T3392] _dev_warn+0x9b/0xd0 [ 221.953562][ T3392] hid_parser_main+0x6ff/0x750 [ 221.953582][ T3392] hid_open_report+0x48e/0x7a0 [ 221.953601][ T3392] hid_generic_probe+0x33/0x70 [ 221.953622][ T3392] hid_device_probe+0x2c5/0x490 [ 221.953646][ T3392] really_probe+0x1bc/0x5a0 [ 221.953666][ T3392] __driver_probe_device+0x121/0x190 [ 221.953684][ T3392] driver_probe_device+0x37/0x2f0 [ 221.953703][ T3392] __device_attach_driver+0x205/0x310 [ 221.953726][ T3392] bus_for_each_drv+0x1bd/0x230 [ 221.953754][ T3392] __device_attach+0x1c7/0x290 [ 221.953774][ T3392] device_initial_probe+0x1a/0x30 [ 221.953796][ T3392] bus_probe_device+0x143/0x1d0 [ 221.953823][ T3392] device_add+0x5c9/0x770 [ 221.953840][ T3392] hid_add_device+0x273/0x2f0 [ 221.953863][ T3392] uhid_device_add_worker+0x2b/0xa0 [ 221.953885][ T3392] process_scheduled_works+0x4cb/0x9d0 [ 221.953911][ T3392] worker_thread+0x582/0x770 [ 221.953936][ T3392] kthread+0x489/0x510 [ 221.953953][ T3392] ret_from_fork+0xda/0x150 [ 221.953968][ T3392] ret_from_fork_asm+0x1a/0x30 [ 221.953985][ T3392] [ 221.953988][ T3392] Reported by Kernel Concurrency Sanitizer on: [ 221.953998][ T3392] CPU: 1 UID: 0 PID: 3392 Comm: kworker/1:4 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) [ 221.954021][ T3392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 221.954035][ T3392] Workqueue: events uhid_device_add_worker [ 221.954058][ T3392] ================================================================== [ 222.270356][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.277811][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.285195][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.369257][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.376800][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.384193][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.391723][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.399295][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.406695][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.414076][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.421462][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.428897][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.436306][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.443705][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.451086][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.458469][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.465897][ T3392] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 222.473943][ T3392] hid-generic 0000:0000:0000.0003: hidraw0: HID v8.00 Device [syz1] on syz0