last executing test programs: 6.839354028s ago: executing program 4 (id=47): r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000fdffffee0000000000000000850000002c00000095"], &(0x7f0000000040)='GPL\x00', 0x5, 0xbf, &(0x7f00000020c0)=""/191}, 0x80) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={r1, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) syz_emit_ethernet(0x3a, &(0x7f0000002180)={@local, @multicast, @val={@void, {0x8100, 0x7, 0x1, 0x1}}, {@mpls_uc={0x8847, {[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x10, 0x28, 0x65, 0x0, 0x7f, 0x6, 0x0, @dev={0xac, 0x14, 0x14, 0x23}, @loopback}, {{0x4e24, 0x4e24, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x80, 0x0, 0x0, 0x7}}}}}}}, 0x0) 6.633760984s ago: executing program 4 (id=49): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000440)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x404, &(0x7f00000003c0)={[{@nogrpid}, {@barrier}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6}}, {@errors_remount}, {@nombcache}, {@auto_da_alloc}, {@nojournal_checksum}]}, 0x3, 0x43b, &(0x7f00000012c0)="$eJzs28tvG0UYAPBv7aSlz6RVeTQtECiIiEfShFJ64AICiQNISHAox5C4VajboDpItIogIFSOqBJ3xBGJv4ATXBBwQuIKd1SpQrm0cDJaezexHTskqRMX/PtJ287MjjXzeXfsmZ04gL41mv6TROyPiN8iYqieba4wWv/v9vLizF/LizNJVKtv/pnU6t1aXpzJq+av25dnBiIKnyZxrE27lStXL0yXy6XLWX5i4eJ7E5UrV5+Zuzh9vnS+dGnqzJlTz04+f3rqua7EmcZ1a+TD+eNHX337+uszZ6+/89M3SR5/SxxdMtquMH+PHq9Wu9xcbx1oSCcDPewIm1KsD9MYrI3/oSjG6sUbilc+6WnngG1VrVar93U+vVQF/seS6HUPgN7Iv+jT9W9+7NDU465w88X6AiiN+3Z21M8MRCGrM9iyvu2m0Yg4u/T3l+kR2/McAgCgyXfp/OfpdvO/QjQ+FzqY7aEMR8ShiDgcEacj4khE3BtRq3t/RDywyfZbN0nWzn8KN7YU2Aal878Xsr2t5vlfPvuL4WKWO1CLfzA5N1cunczek7EY3J3mJ9dp4/uXf/2807nG+V96pO3nc8GsHzcGdje/ZnZ6YfpOYm508+OIkYF28ScrOwFJRByNiJEttjH35NfHO5379/jX0YV9pupXEU/Ur/9StMSfS9bfn5y4J8qlkxP5XbHWz79ce6NT+3cUfxek139v2/t/Jf7hpHG/trL5Nq79/lnHNc1W7/9dyVtNZR9MLyxcnozYlbxW73Rj+VRLvanV+mn8Yyfaj//DsfpOHIuI9CZ+MCIeioiHs74/EhGPRsSJdeL/8aXH3l1TWNlo/NsrjX92U9d/NbErWkvaJ4oXfvi2qdHh1eTGrv+pWmosK9nI51+5lK7a1+/X1u5mAAAA+O8pRMT+SArjK+lCYXy8/jf8R2JvoTxfWXjq3Pz7l2brvxEYjsFC/qRrqOF56GS2rM/zUw35YtbWoYj4orindn58Zr482+PYod/t6zD+U38Ue907YNv5vRb0L+Mf+pfxD/3L+If+1Wb87+lFP4Cd1+77/6Me9APYeS3j37Yf9BHrf+hfxj/0L+Mf+lJlzwZ+JC8hsSYRhbuiGxLbkjhY7vUnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQHf8EwAA//+IN+NT") sendmsg$ETHTOOL_MSG_COALESCE_GET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4004000) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000200)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000ffff00000000000000bd0000000000000000000000e4ec01000000004000000000fc00000000000000000000000000013da51fd47aa2e2f700000000000000000000000000000000000000000000000000000000000000060000000000000000050000000a004e200e8a34c38f36f0c7eb2700d609bcf41076d88144448ebe7994dd1b33d7c8787734cc315672f62261ceeede940774fd94d2767288cfb3a20882449d601ff878eedd3d57c9eb3a723b62102bd534c8a304a975d752e82cc8d5f969771c94a1d69cfd8694e29b9468fca5df65ece31ed7c209325604001fcd06adc3ac391f60a3523d6d0b4a8a41d39b78057b7b3c16c91cbbadefcf9ec61259915a0e5d03c1403e5fb5424d07d479b047e9a9858276c82b3829ac35ec93de49fc08ecc8ddd27dc63b63ab836f519ac4e7a2769856d1841cd2a8ac05f75453e2ea0f92b40b61f590db72592301c8407bede7cb97ad015a74f9e2b4259bed300edfd5e1d4cd16f2c9b5efc6c6f7"], 0x310) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f00000005c0)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) 6.435316368s ago: executing program 4 (id=50): syz_mount_image$ext4(&(0x7f00000005c0)='ext4\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc0ed000e, &(0x7f0000000100)={[{@min_batch_time={'min_batch_time', 0x3d, 0x9}}, {@jqfmt_vfsv0}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1}}, {@noload}, {@grpjquota_path={'grpjquota', 0x3d, '.\x02'}}, {@noblock_validity}, {@resgid}, {@nobarrier}, {@errors_remount}]}, 0xfa, 0x499, &(0x7f0000001a00)="$eJzs3M9vFFUcAPDvbLulgNiK+AMEqSKR+KOl5YccvGg04aCJiR4wnmpbSKVQQ2sihGj1gEdD4p149S8wnvRi1IsmXvVuSIjhAuJlzezM2KX7oy3dsoX9fJLdvrfzuu99Z+bNvJk3bQBdayh9SyIeiIg/ImIgy95eYCj7cfP6xYl/rl+cSKJSefvvpFruxvWLE0XR4ve2ZplKJc9valDvpfcixmdmps7l+ZH5Mx+OzJ2/8OL0mfFTU6emzo4dO3b40J6+o2NH2hJnGteNXZ/M7t55/N3Lb06cuPz+z0kpsrhjSRztMpSt3Yb2t7uyDttWk0560/f+PLf318UljfYEOqknItLNVa72/4Hoic3/LxuI1z/vaOOAdVWpVCotjsoLFeA+lkSnWwB0RnGiT69/i9ddGnpsCNdeyS6A0rhv5q9sSW+UssTe8pLr23YaiogTC7eupK9Yp/sQAAC1vk/HPy80Gv+V4tEs0Ze+PZjPoQxGxEMRsT0iHo6IHRHxSES17GMR8fgq6186Q1I//ildvePgViAd/72cz23dPv4rFUUGe/Lctmr85eTk9MzUwXydHIjyppPTydRoizp+eO33L5stq47/isH4wq0raf3FWDBvx9XeJTfoJsfnx9cSc61rn0Xs6m0Uf1KdF4h8Xm9nROy6wzqmn+ttuqx2/HuiYfwtNP/aFat8HfFstv0XYkn8haTp/OToS0fHjoz0x8zUwZFir6j3y2+X3mpW/5rib4N0+2+pxl9cC9bFP5j0R8ydv3C6Ol87t/o6Lv35RdNrmuXjv23/P74t3//7kneqH/TlCz4en58/NxrRl7xR//nY4rcV+aJ8Gv+BfY37//ZYXBNPRMTuiNgTEU+mF4V525+KiKcjYl+L+H969ZkPVh9/47vy5Rb13Ik0/smGx7+a7R+123/1iZ7TP363fPz9EdFs+x+upg7kn6zk+LfSBq5l3QEAAMC9InsGPikNL6aT4eHsGf4dsaU0Mzs3//zJ2Y/OTmbPyg9GuVTc6RqouR86mt8bLvJjS/KH8vvGX/VsruaHJ2ZnJjsdPHS5rXX9v1RK+3/qr55Otw5Yd22YRwPuUfo/dC/9H7pTsmz/b/cjR8BG4vwP3atR//+0aenhb9e1McBd5fwP3WsF/X8h+9F8VADcm5z/oXvp/9CVmv5tfGlNf/Lf1sSeb7K2tirzb/4vVDZKm+//RJQ2RDPu/0Rv639msT8ilvmecn1frgxkfSr9ZFPD3+roYQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKBt/gsAAP//90bgLQ==") rt_tgsigqueueinfo(0x0, 0x0, 0x3a, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x100, 0x52) socket$inet_udp(0x2, 0x2, 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000001140)=ANY=[]) bpf$MAP_CREATE(0x0, 0x0, 0x48) 6.143757072s ago: executing program 4 (id=54): syz_mount_image$ext4(&(0x7f0000000440)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x80c40a, &(0x7f0000000140)={[{@noblock_validity}, {@dioread_nolock}, {@init_itable_val={'init_itable', 0x3d, 0xb8f}}, {@sysvgroups}, {@inlinecrypt}, {@usrjquota, 0x2e}, {@errors_remount}, {@jqfmt_vfsold}, {@jqfmt_vfsv0}, {@mblk_io_submit}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x8}}, {@errors_remount}], [], 0x2c}, 0x81, 0x475, &(0x7f0000000900)="$eJzs3EtvG1UUAOAzk6TvklDKow8gUBARj6RJC3TBBgRSN0hIsCjLkKZVadqgJki0qkhAqCxRfwGwROIXsIINAlYgtrBHSBXqhpYFGjT2jGscO40bJ07j75Nc3zsP33PsuZM7c+0G0LOG83+SiF0R8VtEDEZEX+MGw9WnG9cvT928fnkqiSx7868k3y3+vn55qtw0KZ53FpWRNCL9JIkDTdqdu3jp7OTMzPSFoj42f+69sbmLl547c27y9PTp6fMTx44dPTL+4gsTz3ckz915rPs/nD247/jbV1+fOnH1nR+/zuPdVayvz6NqaNVtDsdw7T1p9OSqX31j2V08t8qXjSnv6/0RMVDp/4PRV6lVDcZrH3c1OGBNZVmWbV2ytDYCWMyATSyJbkcAdEf5hz6//i0f6zj86LprL1cvgPK8bxSP6pr+SIttBuqubzttOCJOLP7zef6IpvchAAA669t8/PNss/FfGg/UbXdPMTc0FBH3RsSeiLgvIvZGxP0RlW0fjIiH2mx/uKG+dPzzy/Y7SmyF8vHfS8Xc1v/Hf+XoL4b6itruSv4DyakzM9OHi/dkJAa25vXxZdr47tVfP2u1rn78lz/y9suxYBHHn/0NN+hOTs5Pribnetc+qtwDXFiaf1KbCUgiYl9E7L+D198WEWee/upgq/W3z38Z/XcQUIPsy4inqp//YjTkX0qWn58c2xYz04fHyqNiqZ9+vvJGq/ZXlX8H5J//jqbHfy3/oaR+vnau/Tau/P5py2ualvnXmm9+/G9J3qqUtxTLPpicn78wHrElWVy6fOLWvmW93D7Pf+RQk/xvZvk57t8viv0ORER+ED8cEY9ExKNF7I9FxOMRcahJbtlC9fmHV554t+3810me/8m2Pv/2C31nv/+mVfsrO/8drZRGiiUrOf+tNMDVvHcAAABwt0gr34FP0tFaOU1HR6vf4d8bO9KZ2bn5Z07Nvn/+ZPW78kMxkJZ3ugbr7oeOF/eGy/pEQ/1I5b5xlmXZ9kp9dGp2Zq3m1IGV2dmi/+f+6Ot2dMCaa2sezS+8YFPpwDw6cJfS/6F3tdP/nStgc9GnoXc16/8LETe6EAqwzm7z9//W/xIAbDrG/9C79H/oXfo/9KTV/K5/ucKe42v1yput0Lcxwmi7EGn9kvJ42gCBNSkMFNHVlqRdi6e/PoxqYWtE3GavNIrCQqxXqN07JwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTSfwEAAP//wIroBw==") mount$incfs(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x80, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r1 = openat$incfs(r0, &(0x7f00000001c0)='.pending_reads\x00', 0x22000, 0x1b4) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0xc058671e, &(0x7f00000000c0)) 5.742124981s ago: executing program 4 (id=60): syz_mount_image$exfat(&(0x7f0000000180), &(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x10000, &(0x7f0000000340)={[{@uid={'uid', 0x3d, 0xee00}}, {@dmask={'dmask', 0x3d, 0x564}}, {}, {@iocharset={'iocharset', 0x3d, 'default'}}, {@gid}, {@allow_utime={'allow_utime', 0x3d, 0x8c69}}, {@umask={'umask', 0x3d, 0xf0}}, {@namecase}, {@umask={'umask', 0x3d, 0x75}}, {@errors_continue}, {}, {@discard}, {@dmask={'dmask', 0x3d, 0x7}}, {@utf8}]}, 0x1, 0x1535, &(0x7f0000001380)="$eJzs3AucjdX6OPDnWWu9Y0jaTXIZ1lrPy04uiyTJJUkuSZIkSW4JSZIjCYkht6QhCcllSC5DSC4Tk8b9fr8kJEmTJCG5Jev/mZi/OnX+55xfnfz+Z57v57M/s55Z+1nvs+aZvfe739l802VojUY1qzYgIvhD8OKXBACIBYCBAHANAAQAUDaubFzGfHaJCX/sIOzP9VDyla6AXUnc/6yN+5+1cf+zNu5/1sb9z9q4/1kb9z9r4/4zlpVtnp7/Wr5l3Rtf/8/K+PX/v0h6ybFfrC15fVeAmH81hfv//z/8A7nc//9awb9yJ+5/1sb9z6pir3QB7H8BfvxnBdn+4Qz3P2vj/jOWlf3yWnAsXPnr0X/1DSL/yb+B+F4Xf8pXfp//cP+MMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxthf4Iy/TAFA5vhK18UYY4wxxhhjjLE/j892pStgjDHGGGOMMcbYfx6CAAkKAoiBbBAL2SEHCICYzPlrIQ6ug9xwPeSBvJAP8kM8FICCoMGABYIQCkFhiMINUARuhKJQDIpDCXBQEkrBTVAaboYycAuUhVuhHNwG5aECVIRKcDtUhjugCtwJVeEuqAbVoQbUhLuhFtwDteFeqAP3QV24H+rBA1AfHoQG8BA0hIehETwCjeFRaAJNoRk0hxb/o/wXoAe8CD2hFyRAb+gDL0Ff6Af9YQAMhJdhELwCg+FVSIQhMBReg2HwOgyHN2AEjIRR8CaMhrdgDIyFcTAekmACTIS3YRK8A5NhCkyFaZAM02EGvAszYRbMhvdgDrwPc2EezIcFkAIfwEJYBKnwISyGjyANlsBSWAbLYQWshFWwGtbAWlgH62EDbIRNsBm2wFbYBtthB+yEj2EXfAK7YQ/shU9hH3z2b+af/rv8rggIKFCgQoUxGIOxGIs5MAfmxJyYC3NhBCMYh3GYG3NjHsyD+TAfxmM8FsSCaNAgIWEhLIRRjGIRLIJFsSgWx+Lo0GEpLIWl8WYsg2WwLJbFclgOy2MFrICVsBJWxspYBatgVayK1bAa1sAaeDfejb2xNtbGOlgH62LdzMtT2AAbYENsiI2wETbGxtgEm2AzbIYtsAW2xJbYClthG2yDbbEttsN22B7bYwfsgB2xI3bCTtgZO2MX7IJdsRt2S38hG+CL+CL2wmqiN/bBPtgXE7P1xwE4AF/GQfgKvoKvYiIOwaH4Gr6Gr+NwPIUjLozEUTgKK4u3cAyORRLjMQmTcCJOxEk4CSfjFJyC0zAZp+MMnIEzcRbOwvdwDr6P7+M8nIcLMAVTcCEuwlRMxcV4GtNwCS7FZbgcV+ByXIWrcRWuxXW4FjfgBtyEm3ALbsFtuA134A78GBUAfoJ7cA8m4j7ch/txPx7AA3gQD2I6puMhPISH8TAewSN4FI/iMTyOJ/A4nsSTeApP4xk8g+fwHJ7H5+K/avhxsTWJIDIooUSMiBGxIlbkEDlETpFT5BK5RERERJyIE7lFbpFH5BH5RD4RL+JFQVFQGGEEiTDjmUJERVQUEUVEUVFUFBfFhRNOlBKlRGlRWpQRZURZcasoJ24T5UUF0dpVEpVEZdHGVRF3iqqiqqgmqosaoqaoKWqJWqK2qC3qiDqirqgr6okHRH3RG/vjQyKjM43EEGwshmIT0VTIS89QLcVwbCVaizbiCTESR2A70dK1F0+LDmIMdhR/E2PxWdFZjMcu4nnRVXQT3cULoodo5XqKXmIy9hZ9xDTsK/qJ/mKAmInVxXs4J3sN8apIFEPEUPGaWICvi+HiKjFCjBSjxJtitHhLjBFjxTgxXiSJCWKieFtMEu+IyWKKmCqmiWQxXcwQ74qZYpaYLd4Tc8T7Yq6YJ+aLBSJFfCAWikUiVXwoFouPRJpYIpaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdoqPxS7xidgt9oi94lOxT3wm9ovPxQHxhTgovhTp4itxSHwtDotvxBHxrTgqvhPHxHFxQnwvToofxClxWpwRZ8U58aM4L34SF4QXIFEKKaWSgYyR2WSszC5zyKtkThlkPv/LOHmdzC2vl3lkXplP5pfxsoAsKLU00kqSoSwkC8uovEEWkTfKorKYLC5LSCdLylLyJlla3izLyFtkWXmrLCdvk+VlBVlRVpK3y8ryDgmRi8eoJqvLGrKmvFsmwD2ytrxX1pH3ybryfllPPiDrywdlA/mQbCgflo3kI7KxfFQ2kU1lM9lctpCPyZbycdlKtpZt5BOyrXxStpNPyfbyadlB+ku/Is/KzvI52UU+L7vKbrK7/ElekF72lL0k9AbZR74k+8p+sr8cIAfKl+Ug+YocLF+ViXKIHCpfk8Pk63K4fEOOkCPlKPmmHC3fkmPkWDlOjpdJcoKcKN+Wk+Q7crKcIqfKaTJZTpf9L600W8p/mv/27+QP/vnom+RmuUVuldvkdrlD7pQfy11yl9wtd8u9cq/cJ/fJ/XK/PCAPyIPyoEyX6fKQPCQPy8PyiDwij8qj8pg8Ls/K7+VJ+YM8JU/L0/KsPCfPyfOXfgagUAkllVKBilHZVKzKrnKoq1ROdbXKpa5REXWtilPXqdzqepVH5VX5VH4Vrwqogkoro6wiFapCqrCKqhvw0i+MKq5KKKdKqlLqpn8nXxVRN6qiqtiv8jPrS/gH9bVQLVRL1VK1Uq1UG9VGtVVtVTvVTrVX7VUH1UF1VB1VJ9VJdVadVRfVRXVVXVV31V31UD1UT9VTJagE1Ue9pPqqfqq/GqAGqpdFxh4Gq8EqUSWqoWqoGqaGqeFquBqhRqhRapQarUarMWqMGqfGqSSVpCaqiWqSmqQmq8lqqpqqklWymqFmqJlqppqtZqs5ao6aq+aq+Wq+SlEpaqFaqFJVqlqsFqs0tUQtUcvUMrVCrVCr1Cq1Rq1R69Q6tUFtUGlqs9qstqqtarvarnaqnWqX2qV2q91qr9qr9ql9ar/arw6oA+qgOqjSVbo6pA6pw+qwOqKOqKPqqDqmjqkT6oQ6qU6qU+qUOqPOqHPqnDqvzqsL6kLGaV8gAhGoQAUxQUwQG8QGOYIcQc4gZ5AryBVEgkgQF8QFuYPrgzxB3iBfkD+IDwoEBQMdmMAG4lLTo8ENQZHgxqBoUCwoHpQIXFAyKBXcFJQObg7KBLcEZYNbg3LBbUH5oEJQMagU3B5UDu4IqgR3BlWDu4JqQfWgRlAzuDuoFdwT1A7uDeoE9wV1g/uDesEDQf3gwaBB8FDQMHg4aBQ8EjQOHg2aBE2DZkHzoMWfur73p/I+7nrqXjpB99Z99Eu6r+6n++sBeqB+WQ/Sr+jB+lWdqIfoofo1PUy/rofrN/QIPVKP0m/q0fotPUaP1eP0eJ2kJ+iJ+m09Sb+jJ+speqqeppP1dD1Dv6tn6ll6tn5Pz9Hv67l6np6vF+gU/YFeqBfpVP2hXqw/0ml6iV6ql+nleoVeqVfp1XqNXqvX6fV6g96oN+nNeoveqrfp7XqH3qk/1rv0J3q33qP36k/1Pv2Z3q8/1wf0F/qg/lKn66/0If21Pqy/0Uf0t/qo/k4f08d1Gf29Pql/0Kf0aX1Gn9Xn9I/6vP5JX9A+4+Q+4+XdKKNMjIkxsSbW5DA5TE6T0+QyuUzEREyciTO5TW6Tx+Qx+Uw+E2/iTUFT0GQgQ6aQKWSiJmqKmCKmqClqipvixhlnSplSprQpbcqYMqasKWvKmXKmvClvKpqK5nZzu7nD3GHuNHeau8xdprqpbmqamqaWqWVqm9qmjqlj6pq6pp6pZ+qb+qaBaWAamoamkWlkGpvGpolpYpqZZqaFaWFampamlWll2pg2pq1pa9qZdqa9aW86mA6mo+loOplOprPpbLqYLqar6Wq6m+6mh+lhepqeJsEkmD6mj+lr+pr+pr8ZaAaaQWaQGWwGm0STaIaaoWaYGWaGm+FmhBlpRmWcqJq3zBgz1owz402SSTITzUQzyUwyk81kM9VMNckm2cwwM8xMM9PMNrPNHDPHzDVzzXwz36SYFLPQLDSpJtUsNotNmkkzS81Ss9wsNyvNSrParDZrzVqzHtabjWaj2Ww2m61mq9lutpudZqfZZXaZ3Wa32Wv2mn1mn9lv9psD5oA5aA6adJNuDplD5rA5bI6YI+aoOWqOmWPmhDlhTpqT5pQ5Zc6YM+acyXvp9dKbWJvd5rBX2Zz2apvLXmP/Ps5n89t4W8AWtNrmsXl/FRtrbVFbzBa3JayzJW0pe9Nv4vK2gq1oK9nbbWV7h63ym7iWvcfWtvfaOvY+W9Pe/au4rr3f1rOP2PqIALapbWib20b2EdvYPmqb2Ka2mW1u29onbTv7lG1vn7Yd7DO/iRfaRXa1XWPX2nV2t91jz9iz9rD9xp6zP9qetpcdaF+2g+wrdrB91SbaIb+JR9k37Wj7lh1jx9pxdvxv4ql2mk220+0M+66daWf9Jk6xH9g5NtXOtfPsfLvg5zijplT7oV1sP7JpNoCldpldblfYlXbV/611md1gN9pNdpf9xG612+x2u8PuzDwRtnvsXvup3Wc/s4fs1/aA/cIetEdsuv3q5zhjf0fst/ao/c4es8ftCfu9PWl/UJnZGXv/3v5kL1hvgZCAJCkKKIayUSxlpxx0FeWkqykXXUMRupbi6DrKTddTHspL+Sg/xVMBKkiaDFkiCqkQFaYo3UCZ5RWnEuSoJJWim6g03Uxl6BYqS7dSObqNylMFqkiV6HaqTHdQFbqTqtJdVI2qUw2qSXdTLbqHatO9VIfuo7p0P9WjB6g+PUgN6CFqSA9TI3qEGtOj1ISaUjNqTi3oMWpJj1Mrak1t6AlqS09SO3qK2tPT1IGeoY70N+pEz1Jneo660PPUlbpRd3qBetCL1JN6UQL1pj70EvWlftSfBtBAepkG0Ss0mF6lRBpCQ+k1Gkav03B6g0bQSBpFb9JoeovG0FgaR+MpiSbQRHqbJtE7NJmm0FSaRsk0nWbQuzSTZtFseo/m0Ps0l+bRfFpAKfQBLaRFlEof0mL6iNJoCS2lZbScVtBKWkWraQ2tpXW0njbQRtpEm2kLbaVttJ120E76mHbRJ7Sb9tBe+pT20We0nz6nA/QFHaQvKZ2+okP0NR2mb+gIfet70Xd0jI7TCfqeTtIPdIpO0xk6S+foRzpPP9EF8gQhhiKUoQqDMCbMFsaG2cMc4VVhzvDqMFd4TRgJrw3jwuvC3OH1YZ4wb5gvzB/GhwXCgqEOTWhDCsOwUFg4jIY3hEXCG8OiYbGweFgidGHJsFR4U1g6vDksE94Slg1vDcuFt4XlwwrhI/dVCm8PK4d3hFXCO8Oq4V1htbB6WCOsGd4d1grvCWuH94Z1wvvCMuH9Yb3wgbB++GDYIHwobBg+HDYKHwkbh4+GTcKmYbOwedgifCxsGT4etgpbh23Cq8K24ZNhu/CpsH34dNghfObn+fsXZc4/8Zv5hLB32Cd8KXwp9P5eOT+6IJoS/SC6MLoomhr9MLo4+lE0LbokujS6LLo8uiK6Mroqujq6Jro2ui66ProhujG6Kep9zWzg0AknnXKBi3HZXKzL7nK4q1xOd7XL5a5xEXeti3PXudzuepfH5XX5XH4X7wq4gk4746wjF7pCrrCLuhtcEXejK+qKueKuhHOupCvlmrsWroVr6R53rVxr18Y94Z5wT7on3VPuKfe06+CecR3d31wn96zr7J5zz7nnXVfXzXV3L7gebkKui4/JBNfH9XF9XV/X3/V3A91AN8gNcoPdYJfoEt1QN9QNc8PccDfcjXAj3Cg3yo12o90YN8aNc+NckktyE91EN8lNcpPdZDfVTXXJLtnNcDPcTDfTVZ518Shz3Vw33813KS7FLXQZ54ypbrFb7NJcmlvqlrrlbrlb6Va61W61W+vWuvVuvdvoNrrNbrPb6ra67W672+l2ul1ul9vtr7m4qNvn9rv97oA74A66L126+8odcl+7w+4bd8R9646679wxd9ydcN+7k+4Hd8qddmfcWXfO/ejOu5/cBeddUmRCZGLk7cikyDuRyZEpkamRaZHkyPTIjMi7kZmRWZHZkfcicyLvR+ZG5kXmRxZEUiIfRBZGFkVSIx9GFkc+iqRFlkSWRpZFlkdWRLwvsDX0hXxhH/U3+CL+Rl/UF/PFfQnvfElfyt/kS1+sO837W305f5sv7yv4iv5R38Q39c18c9/CP+Zb+sd9K9/at/FP+Lb+Sd/OP+Xb+6d9B/+M7+j/5jv5Z31n/5zv4p/3XX03392/4Hv4F31P38sn+N6+j3/J9/X9fH8/wA/0L/tB/hU/2L/qE/0QP9S/5of51/1w/4Yf4Uf6UTFv+tGZb5FhvE/yE/xE/7af5N/xk/0UP9VP88l+up/h3/Uz/Sw/27/n5/j3/Vw/z8/3C3yK/8Av9It8qv/QL/Yf+TS/JPOisV/pV/nVfo1f69f59X6D3+g3+c1+i9/qt/ntfoff6T/2u/wnfrff4/f6T/0+/5nf7z/3B/wX/qD/0qf7r/wh/7U/7L/xR/y3/qj/zh/zx/0J/70/6X/wp/xpf8af9ef8j/68/8lf4H+zxhhjjDH2L5lweSh+PXPxcn7v38kRv7hzHwC4elv+9F/OZ5xRrs9zcdxPxMdmfH26V5eHMm/VqiUkJFy6b5qEoPA8gMy/BGX4+aMHl+Il0AaehPbQGkr/bv39RLdz9E/Wj94KkOMXORkFZcaX1/8cABN+s99+4rEnRi0sF56J+3+sPw+gaOHLOdnhcrwE2vx8faU1lPkH9edt+U/qz/5FEkCrX+TkhMvx5fpLwePwDLT/1T0ZY4wxxhhjjLGL+omKnTLff2Z+4vP33p/Hq8s52eBy/M/enzPGGGOMMcYYY+zKe7Zb96cea9++dad/f1Dlf5T1Lw8aw39qZR787sB7gMzvKAD4gwsCZAzkX7mLLX/JsRIvPXT+fmr5WR/A/45W/hmDK/zExBhjjDHGGPvTXT7p//X31ZUqiDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYy4L+iv9O7ErvkTHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGLvS/k8AAAD///P/+v8=") mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) openat(0xffffffffffffff9c, 0x0, 0x511001, 0x488) syz_open_dev$rtc(&(0x7f0000000080), 0x1, 0x80000) fstatfs(0xffffffffffffffff, 0x0) mount$bind(0x0, &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x2a05004, 0x0) 5.558859531s ago: executing program 4 (id=65): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48) close(r0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10003, 0x9, 0x1}, 0x48) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6tnl0\x00', 0x210}) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), 0x0}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f0000001800)={{r0}, &(0x7f0000001780)=0x4, 0x0}, 0x20) 5.532195947s ago: executing program 32 (id=65): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48) close(r0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10003, 0x9, 0x1}, 0x48) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6tnl0\x00', 0x210}) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), 0x0}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f0000001800)={{r0}, &(0x7f0000001780)=0x4, 0x0}, 0x20) 3.081401989s ago: executing program 2 (id=131): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev/sda\x00', 0x101042, 0x5) shutdown(0xffffffffffffffff, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 2.775287006s ago: executing program 2 (id=138): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000000)=0x1, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x100000001, 0x210000, 0x1, 0xa}, 0x1c) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x4, 0x6, 0xbaa}, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000200), 0xa7c, r1}, 0x38) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendto$packet(r0, 0x0, 0x5f, 0x24048885, &(0x7f00000000c0)={0x11, 0x11, 0x0, 0x1, 0x70, 0x6, @broadcast}, 0x14) 2.565651933s ago: executing program 2 (id=140): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000001980)={[{@data_err_abort}, {@init_itable}, {@grpjquota}, {@dax_never}, {@nodelalloc}, {@debug}], [{@defcontext={'defcontext', 0x3d, 'unconfined_u'}}]}, 0x1, 0x506, &(0x7f00000001c0)="$eJzs3cFvG1kZAPDPkzrJZtNNFlZaQMCWZaGgqnbi7karPS0XEFqthFhx4pCNEjeKYsdR7JQmVGryPyBRiQOCE2cOSBwq9cQRwQ1uvZQDUoGqqEHiYDS2k7iNnaStE7P27yeNZt7MeL73Ys28ma/uvACG1qWI2ImI0Yj4NCKmWuszrSk+bE7pfk8e3Vrce3RrMRP1+if/zES2tS7aPpN6tXXM8Yj44fcOY423xa1uba8ulErFjVY5Xyuv56tb21dXygvLxeXiWqEwNzs38/619wo9a+tb5d8+/O7KRz+6+/uvPPjzzrd/mtZ3srWtvR291PybZA/ipC5ExEdnEawPRlrtGe13RXghSUR8LiLebpz/UzHS+DZPJ3OmNQMAzkq9PhX1qfYyADDokkYOLJPkWrmAyUiSXK6Zw3sjJpJSpVq7cr2yubbUzJVNRza5vlIqzrRyhdORzaTl2dvp8mG5EE+Xr0XE6xHxs7FXGuXc4unzDABAb736TP//77Fm/w8ADLjxk3aYP596AADn58T+HwAYOPp/ABg++n8AGD76fwAYPvp/ABg29/f7/5Hn+5zX/wHAZ9QPPv44nep7rfdfL93Y2lyt3Li6VKyu5sqbi7nFysZ6brlSWS4Vc4uV8knHK1Uq67PvxubNfK1YreWrW9vz5crmWm2+8V7v+WL2XFoFABzn9bfu/TV9kN/54JXGFG1jOeirYbAl/a4A0DfPmfMHBoi3cMPw8owPnPRjnq4/Eb7zAsHqt1/gQ0CvXf6i/D8MK/l/GF7y/zC85P9heNXrmW5j/icHuwAAA0WOHzjXf/8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAATHZmKbbykmSy0VcjIjpyGaur5SKMxHxWkT8ZSw7lpZn+1pjAODlJX/PtMb/ujz1zuSzW0cz/xlrzCPiJ7/45Oc3F2q1jdl0/b8O1tfutNYXjCYOAP+Pmv10a972IP/k0a3F/ek86/PwO83BRdO4e62pueXCxcbdxJ/GIxsRE48z0X53kd6vjPQg/s5uRHyhU/szjdzI9P7Ip6NPx09jXzyz+Nkj8SceJ0/FTxrbmvP0b/H5I0ce6xrzpLFeYVjcS68/H3Y6/5O41JiPdxz8OF3Vi6ed/evf3pHr3/75Pt641nS6/l06bYx3//D9rtt2I750oVP8zEH8TJf475wy/v0vf/Xtbtvqv4q4HJ3jt8fK18rr+erW9tWV8sJycbm4VijMzc7NvH/tvUK+kaPO72eqj/rHB1de69r+30RMdIk/fkL7v3Fsq+sHF+Bf//fTH3+tW/zdiG99vfP3/8Yx8dMe4pvHxj+0MPG7rsN3p/GXmu3ffd7v/8op4z/42/bSKXcFAM5BdWt7daFUKm70dCEbPT5g20LmjOpsYcAX0vvxlz3Om62UWcd9/vjLu2+mG/ve0p4s9PnCBJy5w5O+3zUBAAAAAAAAAAAAAAC6OfP/TpT0u4UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMsv8FAAD//2Ttyfg=") setgid(0xee01) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000106a053103000000000001090224000100008000090400101c0300010009210000000122f80409058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) 2.055043255s ago: executing program 1 (id=160): r0 = socket$inet_icmp(0x2, 0x2, 0x1) sendmmsg$inet(r0, &(0x7f0000000100)=[{{&(0x7f0000000140)={0x2, 0x4e24, @local}, 0x10, 0x0}}], 0x1, 0x4800) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x9, 0x7, 0x4, 0x100, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xd, &(0x7f0000000280)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @generic={0x7a, 0xa, 0x0, 0xfffffff8}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r3, 0x0, 0xe, 0x1c, &(0x7f00000003c0)='\x00'/14, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.109155305s ago: executing program 1 (id=179): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x9801}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gre={{0x8}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x34}}, 0x0) sendto$packet(r0, &(0x7f0000000240)='?', 0x1, 0x40, &(0x7f0000000540)={0xc9, 0x0, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.054406617s ago: executing program 1 (id=181): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000000)="91cf192cf615a6bce29f05323501d77c40", 0x11, 0x20040000, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) 970.539825ms ago: executing program 1 (id=187): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x20000328) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x1600bd74, 0x0, &(0x7f00000004c0)) mremap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000ffd000/0x3000)=nil) getpgid(0x0) 762.727682ms ago: executing program 3 (id=200): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000240), 0x8) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r2, 0xaea2, 0x7a5) vmsplice(r1, &(0x7f00000001c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1000000000000181, 0x1) 691.062817ms ago: executing program 3 (id=204): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x480c0}, 0x48040) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x38, 0x40fff, 0x81, 0x180, 0x2, 0x0, 0xf1, 0x0, 0x7fffffffffffe, 0x9, 0x4005, 0x8, 0x0, 0x2, 0xfffffffffffffffd, 0xbdb], 0xffffffff, 0x1c6016}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 656.616794ms ago: executing program 3 (id=206): add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x41}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x40041) recvmmsg(r1, 0x0, 0x0, 0x40010110, 0x0) recvfrom(r1, &(0x7f00000000c0)=""/42, 0x2a, 0x2001, 0x0, 0x0) 643.507368ms ago: executing program 3 (id=207): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xe}]}) 527.095353ms ago: executing program 3 (id=210): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd27, 0x0, {{@in6=@loopback, @in6=@private2, 0x1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0xcdab, 0x2f, 0x5, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@empty, 0x0, 0x3c}, 0x2, @in6=@dev={0xfe, 0x80, '\x00', 0x3a}, 0x6, 0x4, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20}, 0x4048050) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000200)={0x6c, r3, 0x1, 0x170bd2b, 0x0, {0x3, 0x0, 0x12}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x10}, 0xf8}}, {0x20, 0x2, @in6={0xa, 0x0, 0x5, @mcast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}, 0x1, 0x300}, 0x8000) 466.270807ms ago: executing program 5 (id=213): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) fstat(r0, 0x0) setuid(0x0) getgid() openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) 409.66074ms ago: executing program 3 (id=214): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) ioctl$HIDIOCGREPORTINFO(r1, 0xc00c4809, &(0x7f0000000000)={0x1, 0x200, 0xfff}) 409.53618ms ago: executing program 5 (id=215): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x19, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f00000006c0)=ANY=[@ANYBLOB="020000000000000002000002e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000300000002004a207f"], 0x1b4) 409.40043ms ago: executing program 5 (id=216): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {}, 0xa}}, 0x26) connect$pppl2tp(r0, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0xffff, @rand_addr=0x64010100}, 0x3, 0x0, 0xffffffff}}, 0x2e) 405.8756ms ago: executing program 1 (id=218): syz_mount_image$exfat(&(0x7f0000000100), &(0x7f0000000080)='./file2\x00', 0x8, &(0x7f0000000600)=ANY=[], 0x1, 0x1520, &(0x7f0000000a40)="$eJzs3AuYjtX2APC19t7vGJP4muQy7L3XyxeDbZIkl4REkiRJkltC0iRJQmIISRqSkOskuQwhuTUmjfv9EkLS5EiTJCEhYf8fnfo7nc6pc55zzt//ObN+z/M+s9e839rf2t+a+d7LPPN93WNE3eb1ajclIviX4J+/pABALAAMAYACABAAQKX4SvGAoyGvxJR/7UnYv9d96Ze7AnY5cf9zN+5/7sb9z924/7kb9z934/7nbtz/3I37z1hutm1W0at4y73bP3P/P+73dv7h/X/g+///7/Dx/79ITvmJn28of03PfyKF+5+7cf9zN+5/7sb9z924/7kb9/+/gce/uysAqPU7mdz/3I37z1hudrnvP/N2ebfL/fPHGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYYyx3OOMvUQDwy/hy18UYY4wxxhhjjLF/H5/nL6OYv9qb//+2GMYYY4wxxhhjjP2HIAiQoCCAGMgDsZAX4uAKyAdXQn4oABG4CuLhaigI10AhKAxFoCgkQDEoDhoMWCAIoQSUhChcC6WgNCRCGSgL5cBBeUiC66ACXA8V4QaoBDdCZbgJqkBVqAbV4WaoAbdATagFteFWqAO3QV2oB7dDfbgDGsCd0BDugkZvL/Ue7oEmcC80hfugGdwPzeEBaAEPQktoBa2hDbT9vXy4Gxr/zfxnoQ88B32hH6RAfxgAz8NAGASD4QUYAi/CUHgJhsHLkArDYQS8AiPhVRgFr8FoGANj4XUYB+NhAkyESTAZ0uANmAJvwlR4C6bBdJgBMyEdZsFseBvmwFyYB+/AfHgXFsBCWASLYQm8BxmwFDLhfVgGH0AWLIcVsBJWwWpYA2thHayHDbARNsFm2AJbYRt8CNthB+yEj2AX7IY98DHshU9gH3wK2fDZX+cX+P3803+V3xMBAQUKVKgwBmMwFmMxDuMwH+bD/JgfIxjBeIzHglgQC2EhLIJFMAETsDgWR4MGCQlLYAmMYhRLYSlMxEQsi2XRocMkTMIKeD1WxIpYCSthZayMVbAqVsXqWB1rYA2siTWxNtbGOlgH62JdvB1vxzuwATbAhtgQG2EjbIyNsQk2wabYFJthM2yOzbEFtsCW2BJbY2tsi22xHbbD9tgeO2JH7ISdsDN2xmRMxi7YBbsiYjfsht2xO/bAHtgTe2EvfBafxefwOeyHdUR/HIADcCAOxMH4Ar6AL+JQfAlfwpcxFYfjCHwFX8FXcRSewtE4BsfiWKwhxuMEnIgkJmMapuEUnIJTcSpOw+k4HWdiOs7C2Tgb5+BcnIvv4Hx8F9/FhbgQF+MSXIIZuBQzMROX4WnMwuW4AlfiKlyNq3AtrsO1uAE34gbcjJtxK27FD/FD3IE7MA9+hLtxN36MH+Mn+AmmYjZm437cjwfwAB7Eg5iDOXgID+FhPIxH8AgexaN4DI/jCTyOJ/EknsLTeAbP4Fk8i+fw6YQvm+0usz4VxEVKKBEjYkSsiBVxIk7kE/lEfpFfRERExIt4UVAUFIVEIVFEFBEJIkEUF8WFEUaQCEUJUUJERVSUEqVEokgUZUVZ4YQTSSJJVBAVREVRUVQSN4rK4iZRRVQVHVx1UV3UEB1dTVFL1Ba1RR1xm6gr6ol6or6oLxqIBqKhaCgaiUaisbhHNBH9cTDeJy52prkYji3ECGwpWonWoo14FR8S7cQobC86iI7iETEGR2Nn0c4li8dFFzEBu4onxUR8SnQXk7GHeEb0FL1Eb/Gs6CPau76/3O4UM3GgGCQGixfEHLxNXOxYXfGySBXDxQjxiliMr4pR4jUxWowRY8XrYpwYLyaIiWKSmCzSxBtiinhTTBVviWliupghZop0MUvMFm+LOWKumCfeEfPFu2KBWCgWicViiXhPZIilIlO8L5aJD0SWWC5WiJVilVgt1oi1Yp1YLzaIjWKT2Cy2iK1im/hQbBc7xE7xkdgldos94mOxV3wi9olPRbb4TOwXfxIHxOfioPhC5IgvxSHxlTgsvhZHxDfiqPhWHBPHxQnxnTgpvo+cwl/W+6M4J86LC8ILkCiFlFLJQMbIPDJW5pVx8goJ8kqZXxaQEXmVjJdXy4LyGllIFpZFZFGZIIvJ4lJLI60kGcoSsqSMymtlKVlaJsoysqwsJ50sL5PkdbKCvF5WlDfISvJGWVneJKvIqrKarC5vljXkLbKmrCVry1tlHXmbrCvrydtlfXmHbCDvlA3lXbKRvFs2lvfIJvJe2VTeJ5vJ+2Vz+YBsIR+ULWUr2Vq2kW3lQ7KdfFi2lx1kR/mI7CQflZ3lYzJZPi67yCdkV/mk7Cafkt3l07KHfEb2lL1kb3leXpBe9pX9ZIrsLwfI5+VAOUgOlsHPL9BLcph8WabK4XKEfEWOlK/KUfI1OVqOkWPl63KcHC8nyIlykpws0+Qbcop8U06Vb8lpcrqcIWfKdDlLDpZD5ItyqJz3D+S/+VN+zK/yh/307FvlNvmh3C53yJ3yI7lL7pZ75B65V+6V++Q+mS2z5X65Xx6QB+RBeVDmyBx5SB6Sh+VheUQekUeblpbH5PFyIL+TJ+X38pQ8LU/LH+RZeVae+/k1AIVKKKmUClSMyqNiVV4Vp65Q+dSVKr8qoCLqKhWvrlYF1TWqkCqsiqiiKkEVU8WVVkZZRSpUJVRJFVXXqlKqtEpUZVRZVU45VV4lqev+5fw/qq+taqvaqXaqvWqvOqqOqpPqpDqrzipZJasuqovqqrqqbqqb6q66qx6qh+qpeqreqrfqo/qovqqvSlEpaoB6Xg1Ug9Rg9YIaol5UQ9VQNUwNU6kqVY1QI9RINVKNUqPUaDVajVVj1Tg1Tk1QE9QkNUmlqTQ1RU1RU9VUNU1NUzPUDJWu0tVsNVvNUXPUPDVPzVfz1QK1QC1Si9QStURlqAyVqTLVMrVMZanlarlaqVaq1Wq1WqvWqvVqvdqoNqrNarPKUtvUNrVdbVc71U61S+1Se9QetVftVfvUPpWtstV+tV8dUAfUQXVQ5agcdUgdUofVYXVEHVFH1VF1TB1TJ9QJdVKdVKfUKXVGnVFn1Vl1Tp1TF9SFi6d9gQhEoAIVxAQxQWwQG8QFcUG+IF+QP8gfRIJIEB/EBwWDa4JCQeGgSFA0SAiKBSmgAxPYgIIwKBGUDKLBtUGpoHSQGJQJygblAheUD5KC64IKwfVBxeCGoFJwY1A5uCmoElQNqgXVg5uDGsEtQc2gVlA7uDWoE9wW1A3qBbcH9YM7ggbBnUHD4K6gUXB30Di4J2gS3Bs0De4LmgX3B82DB4IWwYNBy6BV0DpoE7T9t87v/anCD7u+up9O0f31AP28HqgH6cH6BT1Ev6iH6pf0MP2yTtXD9Qj9ih6pX9Wj9Gt6tB6jx+rX9Tg9Xk/QE/UkPVmn6Tf0FP2mnqrf0tP0dD1Dz9Tpepaerd/Wc/RcPU+/o+frd/UCvVAv0ov1Ev2eztBLdaZ+Xy/TH+gsvVyv0Cv1Kr1ar9Fr9Tq9Xm/QG/UmvVlv0Vv1Nv2h3q536J36I71L79Z79Md6r/5E79Of6mz9md6v/6QP6M/1Qf2FztFf6kP6K31Yf62P6G/0Uf2tPqaP6xP6O31Sf69P6dP6jP5Bn9U/6nP6vL6g/cWT+4uHd6OMMjEmxsSaWBNn4kw+k8/kN/lNxERMvIk3BU3Bi2+YpogpYhJMgiluipuLyJApYUqYqImaUqaUSTSJpqwpa5xxJskkmQqmgqloKppKppKpbCqbKqaKqWaqmZvNzeYWc4upZWqZW82t5jZzm6ln6pn6pr5pYBqYhqahaWQamcamsWlimpimpqlpZpqZ5qa5aWFamJampWltWpu2pq1pZ9qZ9qa96Wg6mk6mk+lsOptkk2y6mC6mq+lqupluprvpbnqYHqan6Wl6m96mj+lj+pq+JsWkmAFmgBloBprBZrAZYoaYoWaoGWaGmVSTakaYEWakGWlGmVFmtBljxprXzTgz3kwwE80kM9mkmTQzxUwxU81UM81MMzPMDJNu0s1sM9vMMXPMPDPPzDfzzQKzwCwyi8wSs8RkmAyTaTLNMrPMZJkss8KsMKvMKrPGrDHrzDqzwWwwm8wms8VsMdvMNrPdbDc7zU6zy+wye8wes9fsNfvMPpNtss1+s98cMAfMQXPQ5Jgcc8gcMofNYXPEHDFHzVFzzBwzJ8wJc9KcNKfMKXPGnDFnzY/mnDlvLhhvYq2AOHuFzWevtPltARtr89qL8cUj5MW4iC1qE2wxW9xqW8gW/lVsrLWJtowta8tZZ8vbJHvdb+IqtqqtZqvbm20Ne4ut+Zu4vr3DNrB32ob2LlvP3v6ruJG92za2D9gm9kHb1LayzWwb2zx4wLawD9qWtpVtbdvYTvZR29k+ZpPt47aLfeI3cYZdatfZ9XaD3Wj32k/sGfuDPWy/tmftj7av7WeH2BftUPuSHWZftql2+G/isfZ1O86OtxPsRDvJTv5NPMPOtOl2lp1t37Zz7NzfxEvse3a+zbQL7EK7yC7+Kb5YU6Z93y6zH9gsu9yusCvtKrvarrFr/7fWlXaz3WK32j32Y7vd7rA77Ud2l939U3xxHfvspzbbfmYP2a/sAfu5PWiP2Bz75U/xxfUdsd/Yo/Zbe8wetyfsd/ak/d6esqd/Wv/FtX9nz9sL1lsgJEGSFAUUQ3kolvJSHF1B+ehKyk8FKEJXUTxdTQXpGipEhakIFaUEKkbFSZMhS0QhlaCSFKVrqRSVpkQqQ2WpHDkqT0l0HVWg66ki3UCV6EaqTDdRFapK1ag63Uw16BaqSbWoNt1KdbynulSPbqf6dAc1oDupId1Fjehuakz3UBO6l5rSfdSM7qfm9AC1oAepJbWi1tSG2tJD1I4epvbUgTrSI9SJHqXO9Bgl0+PUhZ6grvQkdaOnqDs9TT3oGepJvag3PUt96DnqS/0ohfrTAHqeBtIgGkwv0BB6kYbSSzSMXqZUGk4j6BUaSa/SKHqNRtMYGkuv0zgaTxNoIk2iyZRGb9AUepOm0ls0jabTDJpJ6TSLZtPbNIfm0jx6h+bTu7SAFtIiWkxL6D3KoKWUSe/TMvqAsmg5raCVtIpW0xpaS+toPW2gjbSJNtMW2krb6EPaTjtoJ31Eu2g37aGPaS99QvvoU8qmz2g//YkO0Od0kL6gHPqSDtFXdJi+piP0DR2lb+kYHacT9B2dpO/pFJ2mM/QDnaUf6RydpwvkCUIMRShDFQZhTJgnjA3zhnHhFWG+8Mowf1ggjIRXhfHh1WHB8JqwUFg4LBIWDRPCYmHxUIcmtCGFYVgiLBlGw2vDUmHpMDEsE5YNy4UuLB8mhdeFFcLrw4rhDWGl8MawcnhTCClVwwfuqh7eHNYIbwlrhrXC2uGtYZ3wtrBuWC+8Pawf3hE2CO8MG4Z3hRXDu8PG4T1hk/DesGl4X9gsvD9sHj4QtggfDFuGrcLWYZuwbfhQ2C58OGwfdgg7ho+EncJHw87hY2Fy+HjYJXziD/enhP3DAeHz4fOh93eKny8LohnRpdHM6PvRZdEPolnR5dEV0ZXRVdHV0TXRtdFVALAhujG6Kbo5uiW6Nep9vTzg0AknnXKBi3F5XKzL6+LcFS6fu9LldwVcxF3l4t3VrqC7xhVyhV0RV9QluGKuuNPOOOvIha6EK+mi7lpXypV2ia6MK+vKOefKuyTXxrV1bV0797Br7zq4ju4R94h71D3qHnOPucddF/eE6+qedN3cU667e9o97Z5xPV0v19s96/q451xf18+luBQ3wA1wA91AN9gNdkPcEDfUDXXD3DCX6lLdCDfCjXQj3Sg3yo12o91YN9aNc+PcBDfBTXKTXJpLc1PcFDfVTXXT3DQ3w81w6S7dzXaz3Rw3x81z89z8xPlugVvgFrlFbolb4jJchst0mW6ZW+ayXJZb4Va4VW6VW+PWuHVundvgNrhNbpPb4ra4bW6b2+62u51up9vldrk9bo/b6/a6fW6fy3bZbr/b7w64A+6g+8LluC/dIfeVO+y+dkfcN+6o+9Ydc8fdCfedO+m+d6fcaXfG/eDOuh/dOXfeXXDepUXeiEyJvBmZGnkrMi0yPTIjMjOSHpkVmR15OzInMjcyL/JOZH7k3ciCyMLIosjiyJLIe5GMyNJIZuT9yLLIB5GsyPLIisjKyKrI6oj3xbaHvoQv6aP+Wl/Kl/aJvowv68t558v7JH+dr+Cv9xX9Db6Sv9FX9jf5Kr6qr+Yf9C19K9/at/Ft/UO+nX/Yt/cdfEf/iO/kH/Wd/WM+2T/uu/gnfFf/pO/mn/Ld/dO+h3/G9/S9fG//rO/jn/N9fT+f4vv7Af55P9AP8oP9C36If9EP9S/5Yf5ln+qH+xH+FT/Sv+pH+df8aD/Gj/Wv+3F+vJ/gJ/pJfrJP82/4Kf5NP9W/5af56X6Gn+nT/Sw/27/t5/i5fp5/x8/37/oFfqFf5Bf7Jf49n+GX+kz/vl/mP/BZfrlf4Vf6VX61X+PX+nV+vd/gN/pNfrPf4rf6bf5Dv93v8Dv9R36X3+33+I/9Xv+J3+c/9dn+M7/f/8kf8J/7g/4Ln+O/9If8V/6w/9of8d/4o/5bf8wf9yf8d/6k/96f8qf9Gf+DP+t/9Of8eX+B/2eNMcYYY+wfIv9gf/+/8b0YAPjlkmgAAFy5o2jOX8+5qdCfx4NEQqcIADzer8d9v2x16qSkpPz82CwJQcmFABD59fy/xMuhIzwKydABKvzN+gaJXmfpD+aP3ggQ9xc5sXApvjT/9X9n/oceGZtROTwT/zvzLwRILHkpJy9cii/NX/HvzF+43R/Un/fzNID2f5GTDy7Fl+ZPgofhCUj+1SMZY4wxxhhjjLE/GySqdfv715/yf6/PE9SlnDxwKf6j63PGGGOMMcYYY4xdfk/16v3YQ8nJHbr9YwP8+e/S/1wWD3jw3zPI+/Ovzv+Xev5Dg8v5rsQYY4wxxhj7T7h00n+5K2GMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxnKv/4uPE7vca2SMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYut/8JAAD//4cELAw=") r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x6, 0x9, &(0x7f0000000080)={{0x3c, @multicast2, 0x4e26, 0x880002, 'rr\x00', 0x8, 0x3, 0x7d}, {@dev={0xac, 0x14, 0x14, 0x2f}, 0x4e20, 0x12007, 0x8, 0x8, 0x2000050}}, 0x44) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000c, 0x204031, 0xffffffffffffffff, 0xffffd000) getsockopt$inet_tcp_int(r0, 0x6, 0x9, 0x0, &(0x7f0000000040)) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x1, &(0x7f00000087c0)={0x0, 0x989680}) 395.261173ms ago: executing program 5 (id=219): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) write$selinux_attr(r0, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 381.754015ms ago: executing program 5 (id=220): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f0000000000)=0x3, 0x4) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) 370.765638ms ago: executing program 5 (id=221): creat(&(0x7f0000000180)='./file0\x00', 0x70) pipe(&(0x7f0000000040)={0xffffffffffffffff}) close(r0) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) r2 = epoll_create1(0x80000) mount$9p_fd(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000200), 0x4, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) 327.534058ms ago: executing program 1 (id=222): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0xffffd000) ptrace(0x10, r0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x91c6b000) ptrace$peeksig(0x4209, r0, &(0x7f00000000c0)={0x0, 0x0, 0x1}, &(0x7f00000024c0)=[{}]) 311.173081ms ago: executing program 2 (id=224): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000180)=@file={0x1}, 0x6e) listen(r0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f00000000c0)=0x8) connect$unix(r1, &(0x7f0000000280)=@file={0x1}, 0x6e) connect$unix(r1, &(0x7f0000000440)=@file={0x1}, 0x6e) 278.702298ms ago: executing program 2 (id=227): unshare(0x24020400) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, './file0\x00'}, 0x6e) keyctl$clear(0x11, 0xfffffffffffffffd) listen(r0, 0x58b) add_key$keyring(&(0x7f0000000100), 0x0, 0x0, 0x0, 0xfffffffffffffffe) listen(r0, 0x8) 225.78628ms ago: executing program 2 (id=228): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) close(r0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) r1 = socket$tipc(0x1e, 0x5, 0x0) listen(r1, 0x3) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 53.556268ms ago: executing program 0 (id=232): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000001000ffff25bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="85110a9a4e12ac44"], 0x20}, 0x1, 0x0, 0x0, 0x4000080}, 0x20048004) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15) r2 = dup(r1) write$P9_RLERRORu(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="5300000007000046009d168d6e03248e5b0a51267c78f936"], 0x53) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) 983.53µs ago: executing program 0 (id=233): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000180)=@file={0x1}, 0x6e) listen(r0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x22, &(0x7f0000000280)=0x80, 0x4) connect$unix(r1, &(0x7f0000000000)=@file={0x1}, 0x6e) accept$unix(r0, 0x0, 0x0) 815.04µs ago: executing program 0 (id=234): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001d80)=ANY=[@ANYBLOB="b70200001a140000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b70600007fffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000002b000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e6185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc5f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f659cb132b803000000661d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffff8}, 0x94) r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0x4f1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000001a00)=ANY=[@ANYBLOB="03000000000000000a004e2300000010ff010000000000000000000000000001f8ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000a004e2000000008fe8000000000000000000000000000aa05000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000010000000c0000000000000000000000000000000104000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ad94e2100000073fe8000000000000000000000000000aa09000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e210000000800000000000000000000000000000001"], 0x610) r1 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xfffffffe}}, {{0xa, 0x4e08, 0x4a3, @private2, 0x4f0}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000ac0)=ANY=[@ANYBLOB="03000000000000000a004e2300000009ff010000000000000000000000000001"], 0x90) 655.16µs ago: executing program 0 (id=235): bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x10, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x36, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x37}, 0x94) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r0, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 555.24µs ago: executing program 0 (id=236): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) connect$unix(r0, &(0x7f0000fce000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x37) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) accept(r1, &(0x7f0000000040)=@generic, &(0x7f0000000140)=0x80) 0s ago: executing program 0 (id=237): r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000240)='.\x00', 0x60000526) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x24}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0}]) openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x88040, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.83' (ED25519) to the list of known hosts. [ 23.523493][ T24] audit: type=1400 audit(1791012286.320:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.524459][ T271] cgroup: Unknown subsys name 'net' [ 23.546340][ T24] audit: type=1400 audit(1791012286.320:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.575301][ T24] audit: type=1400 audit(1791012286.350:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.575460][ T271] cgroup: Unknown subsys name 'devices' [ 23.722561][ T271] cgroup: Unknown subsys name 'hugetlb' [ 23.728237][ T271] cgroup: Unknown subsys name 'rlimit' [ 23.835578][ T24] audit: type=1400 audit(1791012286.630:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.859289][ T24] audit: type=1400 audit(1791012286.630:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.884244][ T24] audit: type=1400 audit(1791012286.630:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.888496][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.916602][ T24] audit: type=1400 audit(1791012286.720:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.942158][ T24] audit: type=1400 audit(1791012286.720:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.968898][ T24] audit: type=1400 audit(1791012286.770:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.995736][ T24] audit: type=1400 audit(1791012286.770:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.022208][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.510797][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.518117][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.525937][ T280] device bridge_slave_0 entered promiscuous mode [ 24.544215][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.551315][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.558989][ T280] device bridge_slave_1 entered promiscuous mode [ 24.595781][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.602916][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.610430][ T283] device bridge_slave_0 entered promiscuous mode [ 24.617239][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.624385][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.633301][ T279] device bridge_slave_0 entered promiscuous mode [ 24.640450][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.647744][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.655168][ T279] device bridge_slave_1 entered promiscuous mode [ 24.673005][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.680192][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.687570][ T283] device bridge_slave_1 entered promiscuous mode [ 24.744532][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.751731][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.759164][ T281] device bridge_slave_0 entered promiscuous mode [ 24.768547][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.775657][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.783231][ T281] device bridge_slave_1 entered promiscuous mode [ 24.811130][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.818195][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.825715][ T282] device bridge_slave_0 entered promiscuous mode [ 24.859122][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.866255][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.873625][ T282] device bridge_slave_1 entered promiscuous mode [ 24.915629][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.923364][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.930911][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.938076][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.981463][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.988714][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.996147][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.003186][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.046590][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.053813][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.061128][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.068467][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.083807][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.091272][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.098406][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.106223][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.113666][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.121382][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.128997][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.136714][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.158620][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.166974][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.174051][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.181925][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.190385][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.197461][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.211025][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.219107][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.227491][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.234544][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.242071][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.250390][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.257643][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.281983][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.289857][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.301645][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.312958][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.323145][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.331209][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.351568][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.359288][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.367746][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.375084][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.383325][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.391507][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.398532][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.405961][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.414151][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.421314][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.429017][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.437475][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.444530][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.468606][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.477301][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.485717][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.492772][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.500515][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.509038][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.516089][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.523503][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.531490][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.539530][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.547549][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.555833][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.564220][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.572415][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.587777][ T279] device veth0_vlan entered promiscuous mode [ 25.594629][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.603614][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.612304][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.620549][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.629212][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.637455][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.645992][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.653652][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.669800][ T281] device veth0_vlan entered promiscuous mode [ 25.679715][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.687869][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.696311][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.705012][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.713503][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.721486][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.729407][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.737202][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.749381][ T279] device veth1_macvtap entered promiscuous mode [ 25.762669][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.771743][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.780099][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.788050][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.796941][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.806075][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.815116][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.827384][ T280] device veth0_vlan entered promiscuous mode [ 25.837063][ T282] device veth0_vlan entered promiscuous mode [ 25.844112][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.852629][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.861120][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.869140][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.877351][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.886023][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.902155][ T283] device veth0_vlan entered promiscuous mode [ 25.909977][ T281] device veth1_macvtap entered promiscuous mode [ 25.917051][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.925074][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.933793][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.941445][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.949347][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.958640][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.967170][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.975937][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.983901][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.993821][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.001750][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.009360][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.017638][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.029444][ T280] device veth1_macvtap entered promiscuous mode [ 26.040709][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.049631][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.058861][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.076504][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.084978][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.093710][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.102941][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.111407][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.119743][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.128351][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.136853][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.145242][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.153703][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.164995][ T282] device veth1_macvtap entered promiscuous mode [ 26.173253][ T283] device veth1_macvtap entered promiscuous mode [ 26.186484][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.195033][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.195309][ T279] request_module fs-gadgetfs succeeded, but still no fs? [ 26.203240][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.218482][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.232877][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.241331][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.251867][ T279] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.275687][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.286905][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.296307][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.307402][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.316084][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.324742][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.401189][ T308] ====================================================== [ 26.401189][ T308] WARNING: the mand mount option is being deprecated and [ 26.401189][ T308] will be removed in v5.15! [ 26.401189][ T308] ====================================================== [ 26.449136][ T308] erofs: (device loop4): mounted with root inode @ nid 36. [ 26.592076][ T327] ip_tables: iptables: counters copy to user failed while replacing table [ 26.691200][ T331] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=331 comm=syz.0.12 [ 26.772487][ T336] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 26.838800][ T336] EXT4-fs (loop0): mounted filesystem without journal. Opts: discard,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,nodelalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue [ 26.868696][ T336] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.942234][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 26.960715][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 26.969264][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 26.977867][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 26.986742][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 26.995491][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 27.004702][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 27.013353][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 27.150950][ T53] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 27.153651][ T304] F2FS-fs (loop1): Wrong secs_per_zone / total_sections (512, 24) [ 27.171329][ T304] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 27.184545][ T304] F2FS-fs (loop1): invalid crc value [ 27.191835][ T304] F2FS-fs (loop1): Found nat_bits in checkpoint [ 27.224031][ T304] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 27.235555][ T304] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 27.249811][ T304] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 27.297794][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=ffffff00, run fsck to fix. [ 27.308038][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.318806][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.330517][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.339985][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 27.350695][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.362291][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.371971][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.381385][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.390534][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.400275][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.409931][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.415865][ T368] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 27.429489][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.438883][ T368] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 27.443574][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.448721][ T368] F2FS-fs (loop2): invalid crc value [ 27.456438][ T279] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=0, run fsck to fix. [ 27.463319][ T368] F2FS-fs (loop2): Found nat_bits in checkpoint [ 27.481034][ T284] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.505512][ T368] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 27.513305][ T368] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 27.521509][ T53] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 27.531699][ T53] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 27.533251][ T375] EXT4-fs (loop4): mounted filesystem without journal. Opts: dioread_lock,,errors=continue [ 27.671602][ T7] attempt to access beyond end of device [ 27.671602][ T7] loop2: rw=1, want=81920, limit=40427 [ 27.700928][ T53] usb 4-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 27.704530][ T7] attempt to access beyond end of device [ 27.704530][ T7] loop2: rw=1, want=53248, limit=40427 [ 27.710237][ T53] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.726413][ T284] usb 1-1: Using ep0 maxpacket: 8 [ 27.735933][ T53] usb 4-1: Product: syz [ 27.737340][ T7] attempt to access beyond end of device [ 27.737340][ T7] loop2: rw=1, want=58024, limit=40427 [ 27.741195][ T53] usb 4-1: Manufacturer: syz [ 27.767035][ T53] usb 4-1: SerialNumber: syz [ 27.871046][ T284] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.882333][ T284] usb 1-1: too many endpoints for config 1 interface 1 altsetting 0: 253, using maximum allowed: 30 [ 27.893371][ T284] usb 1-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 253 [ 27.950257][ T409] tipc: Started in network mode [ 27.955452][ T409] tipc: Own node identity 821e11dd24f8, cluster identity 4711 [ 27.963340][ T409] tipc: Enabled bearer , priority 1 [ 27.970049][ T300] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 27.977977][ T407] tipc: Resetting bearer [ 27.988826][ T407] tipc: Disabling bearer [ 28.011416][ T416] FAULT_INJECTION: forcing a failure. [ 28.011416][ T416] name failslab, interval 1, probability 0, space 0, times 1 [ 28.025315][ T416] CPU: 1 PID: 416 Comm: syz.1.39 Not tainted syzkaller #0 [ 28.032328][ T53] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 28.032559][ T416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 28.053852][ T416] Call Trace: [ 28.057141][ T416] __dump_stack+0x21/0x24 [ 28.061471][ T416] dump_stack_lvl+0x1a7/0x208 [ 28.066165][ T416] ? show_regs_print_info+0x18/0x18 [ 28.071354][ T416] ? mutex_trylock+0xb0/0xb0 [ 28.075945][ T416] dump_stack+0x15/0x1c [ 28.080131][ T416] should_fail+0x3ab/0x500 [ 28.084570][ T416] ? __se_sys_setgroups+0xf0/0x4d0 [ 28.089714][ T416] __should_failslab+0xa4/0xe0 [ 28.094499][ T416] should_failslab+0x9/0x20 [ 28.099002][ T416] __kmalloc+0x60/0x330 [ 28.103501][ T416] ? mutex_unlock+0x1c/0x40 [ 28.108028][ T416] __se_sys_setgroups+0xf0/0x4d0 [ 28.113000][ T416] ? __kasan_check_read+0x11/0x20 [ 28.118110][ T416] __x64_sys_setgroups+0x5b/0x70 [ 28.123171][ T416] do_syscall_64+0x31/0x40 [ 28.127615][ T416] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.133601][ T416] RIP: 0033:0x7f7173193159 [ 28.138200][ T416] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.158019][ T416] RSP: 002b:00007f7171bec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 28.166664][ T416] RAX: ffffffffffffffda RBX: 00007f717341afa0 RCX: 00007f7173193159 [ 28.174667][ T416] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.182631][ T416] RBP: 00007f717322a06b R08: 0000000000000000 R09: 0000000000000000 [ 28.190838][ T416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.198903][ T416] R13: 00007f717341b038 R14: 00007f717341afa0 R15: 00007ffd22668918 [ 28.220969][ T284] usb 1-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 28.230154][ T284] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.238521][ T284] usb 1-1: Product: syz [ 28.243027][ T284] usb 1-1: Manufacturer: syz [ 28.248032][ T284] usb 1-1: SerialNumber: syz [ 28.331075][ T300] usb 5-1: config 0 has an invalid interface number: 42 but max is 8 [ 28.339631][ T300] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 28.348539][ T300] usb 5-1: config 0 has no interface number 0 [ 28.354732][ T300] usb 5-1: New USB device found, idVendor=04cb, idProduct=0100, bcdDevice= 0.bb [ 28.363805][ T300] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.372558][ T300] usb 5-1: config 0 descriptor?? [ 28.464686][ T411] usb 4-1: USB disconnect, device number 2 [ 28.471695][ T411] usblp0: removed [ 28.480910][ T25] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 28.530910][ T20] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 28.612435][ T24] kauditd_printk_skb: 91 callbacks suppressed [ 28.612446][ T24] audit: type=1400 audit(1791012291.410:165): avc: denied { create } for pid=385 comm="syz.4.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 28.639298][ T24] audit: type=1400 audit(1791012291.410:166): avc: denied { create } for pid=385 comm="syz.4.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 28.660975][ T300] usb 5-1: string descriptor 0 read error: -71 [ 28.667576][ T300] usb-storage 5-1:0.42: USB Mass Storage device detected [ 28.675871][ T300] usb-storage 5-1:0.42: Quirks match for vid 04cb pid 0100: 9 [ 28.683622][ T300] usb-storage 5-1:0.42: This device (04cb,0100,00bb S 04 P 99) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 28.683622][ T300] Please send a copy of this message to and [ 28.722291][ T300] usb 5-1: USB disconnect, device number 2 [ 28.740951][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 28.880981][ T25] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 28.889217][ T25] usb 3-1: config 0 has no interface number 0 [ 28.895407][ T25] usb 3-1: config 0 interface 184 has no altsetting 0 [ 29.061023][ T20] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 29.070570][ T25] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 29.079755][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.088109][ T20] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.096548][ T25] usb 3-1: Product: syz [ 29.100960][ T20] usb 2-1: Product: syz [ 29.105197][ T25] usb 3-1: Manufacturer: syz [ 29.109920][ T20] usb 2-1: Manufacturer: syz [ 29.114679][ T25] usb 3-1: SerialNumber: syz [ 29.119592][ T20] usb 2-1: SerialNumber: syz [ 29.124951][ T284] usb 1-1: 1:1: cannot get freq (v2/v3): err -71 [ 29.131426][ T284] usb 1-1: 1:1: freq mismatch (RO clock): req 48000, clock runs @0 [ 29.140784][ T25] usb 3-1: config 0 descriptor?? [ 29.160094][ T24] audit: type=1400 audit(1791012291.950:167): avc: denied { create } for pid=429 comm="syz.4.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 29.180928][ T284] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 29.190625][ T25] smsc75xx v1.0.0 [ 29.199782][ T284] usb 1-1: clock source 0 is not valid, cannot use [ 29.230891][ T284] usb 1-1: 1:1: cannot get freq (v2/v3): err -71 [ 29.240130][ T284] usb 1-1: 1:1: freq mismatch (RO clock): req 48000, clock runs @0 [ 29.249633][ T24] audit: type=1400 audit(1791012292.050:168): avc: denied { connect } for pid=429 comm="syz.4.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 29.268062][ T284] usb 1-1: USB disconnect, device number 2 [ 29.382746][ T24] audit: type=1400 audit(1791012292.180:169): avc: denied { setopt } for pid=435 comm="syz.4.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 29.402550][ T436] tpacket_rcv: packet too big, clamped from 54 to 4294967286. macoff=82 [ 29.407679][ T24] audit: type=1400 audit(1791012292.200:170): avc: denied { mount } for pid=421 comm="syz.1.42" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 29.433813][ T24] audit: type=1400 audit(1791012292.200:171): avc: denied { read write } for pid=421 comm="syz.1.42" name="control" dev="devtmpfs" ino=260 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 29.458049][ T24] audit: type=1400 audit(1791012292.200:172): avc: denied { open } for pid=421 comm="syz.1.42" path="/10/dev/mapper/control" dev="devtmpfs" ino=260 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 29.486385][ T24] audit: type=1400 audit(1791012292.200:173): avc: denied { ioctl } for pid=421 comm="syz.1.42" path="/10/dev/mapper/control" dev="devtmpfs" ino=260 ioctlcmd=0xfd04 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 29.513740][ T432] udevd[432]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.613958][ T438] Illegal XDP return value 4294967274, expect packet loss! [ 29.734513][ T444] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 29.760242][ T444] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 29.768139][ T24] audit: type=1400 audit(1791012292.550:174): avc: denied { create } for pid=441 comm="syz.0.48" dev="anon_inodefs" ino=15852 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 29.793116][ T444] EXT4-fs (loop4): 1 truncate cleaned up [ 29.798796][ T444] EXT4-fs (loop4): mounted filesystem without journal. Opts: nogrpid,barrier,debug_want_extra_isize=0x0000000000000006,errors=remount-ro,nombcache,auto_da_alloc,nojournal_checksum, [ 29.969729][ T452] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -2 [ 29.981177][ T452] EXT4-fs error (device loop4): ext4_iget_extra_inode:4692: inode #15: comm syz.4.50: corrupted in-inode xattr [ 30.004229][ T452] EXT4-fs (loop4): Remounting filesystem read-only [ 30.026712][ T452] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.50: couldn't read orphan inode 15 (err -117) [ 30.026786][ T453] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a802c018, mo2=0002] [ 30.046935][ T452] EXT4-fs (loop4): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000009,jqfmt=vfsv0,max_dir_size_kb=0x0000000000000001,noload,grpjquota=.,noblock_validity,resgid=0x0000000000000000,nobarrier,errors=remount-ro, [ 30.080991][ T25] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 30.100951][ T25] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 30.106083][ T453] System zones: 1-3, 19-19, 35-36 [ 30.119298][ T449] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 30.127389][ T449] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 30.130983][ T25] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 30.137008][ T449] F2FS-fs (loop0): invalid crc value [ 30.147571][ T453] EXT4-fs (loop3): mounted filesystem without journal. Opts: journal_ioprio=0x0000000000000004,debug,,errors=continue [ 30.165819][ T25] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 30.177409][ T453] ext4 filesystem being mounted at /4/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 30.201619][ T449] F2FS-fs (loop0): Found nat_bits in checkpoint [ 30.226760][ T25] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 30.237092][ T25] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 30.246795][ T25] smsc75xx: probe of 3-1:0.184 failed with error -71 [ 30.251426][ T449] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 30.278374][ T25] usb 3-1: USB disconnect, device number 2 [ 30.285155][ T449] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 30.311978][ T469] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 30.331516][ T469] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 30.350436][ T469] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 30.362959][ T469] EXT4-fs error (device loop4): ext4_free_branches:1026: inode #13: comm syz.4.54: invalid indirect mapped block 2683928664 (level 1) [ 30.372597][ T449] attempt to access beyond end of device [ 30.372597][ T449] loop0: rw=2049, want=40976, limit=40427 [ 30.377419][ T469] EXT4-fs (loop4): 1 truncate cleaned up [ 30.395079][ T469] EXT4-fs (loop4): mounted filesystem without journal. Opts: noblock_validity,dioread_nolock,init_itable=0x0000000000000b8f,sysvgroups,inlinecrypt,usrjquota=.errors=remount-ro,jqfmt=vfsold,jqfmt=vfsv0,mblk_io_submit,debug_want_extra_isize=0x0000000000000008,errors=remount-ro,,,errors=continue [ 30.512470][ T469] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:476: comm syz.4.54: Invalid block bitmap block 3 in block_group 0 [ 30.518439][ T475] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 30.534071][ T280] EXT4-fs error (device loop4): htree_dirblock_to_tree:1092: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len % 4 != 0 - offset=108, inode=4294901777, rec_len=65535, size=1024 fake=0 [ 30.592153][ T280] EXT4-fs error (device loop4): ext4_iget_extra_inode:4692: inode #15: comm syz-executor: corrupted in-inode xattr [ 30.656740][ T280] EXT4-fs error (device loop4): ext4_iget_extra_inode:4692: inode #15: comm syz-executor: corrupted in-inode xattr [ 30.820455][ T501] packet size is too long (100663297 > 2016) [ 30.882420][ T502] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.895036][ T502] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.903160][ T502] device bridge_slave_0 entered promiscuous mode [ 30.910285][ T502] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.921447][ T502] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.928960][ T502] device bridge_slave_1 entered promiscuous mode [ 31.014737][ T502] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.021849][ T502] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.029331][ T502] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.036545][ T502] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.063136][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.072320][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.079737][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.108717][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.120421][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.127650][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.135599][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.144521][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.151601][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.171442][ T482] F2FS-fs (loop3): Test dummy encryption mode enabled [ 31.176358][ T502] device veth0_vlan entered promiscuous mode [ 31.186080][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.190176][ T482] F2FS-fs (loop3): invalid crc value [ 31.194734][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.208766][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.217372][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.224063][ T482] F2FS-fs (loop3): Found nat_bits in checkpoint [ 31.225329][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.239627][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.265358][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.275260][ T502] device veth1_macvtap entered promiscuous mode [ 31.277475][ T527] ip_tables: iptables: counters copy to user failed while replacing table [ 31.286835][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.322793][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.334037][ T482] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 31.366915][ T535] EXT4-fs (loop5): Ignoring removed orlov option [ 31.387718][ T9] device bridge_slave_1 left promiscuous mode [ 31.394120][ T482] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 31.402485][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.404581][ T535] EXT4-fs (loop5): mounted filesystem without journal. Opts: grpquota,orlov,inode_readahead_blks=0x0000000000000100,,errors=continue [ 31.423950][ T9] device bridge_slave_0 left promiscuous mode [ 31.425092][ T535] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.442910][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.457920][ T9] device veth1_macvtap left promiscuous mode [ 31.464921][ T9] device veth0_vlan left promiscuous mode [ 31.540975][ T20] rtl8150 2-1:1.0: couldn't reset the device [ 31.548692][ T20] rtl8150: probe of 2-1:1.0 failed with error -5 [ 31.568443][ T20] usb 2-1: USB disconnect, device number 2 [ 31.847942][ T565] xt_hashlimit: size too large, truncated to 1048576 [ 31.869767][ T567] netlink: 4 bytes leftover after parsing attributes in process `syz.2.88'. [ 32.224013][ T601] ip_tables: iptables: counters copy to user failed while replacing table [ 32.303563][ T609] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 32.308217][ T612] process 'syz.3.104' launched './file0' with NULL argv: empty string added [ 32.322313][ T614] serio: Serial port ptm1 [ 32.328447][ T609] EXT4-fs (loop0): 1 truncate cleaned up [ 32.334394][ T609] EXT4-fs (loop0): mounted filesystem without journal. Opts: debug_want_extra_isize=0x000000000000002e,min_batch_time=0x0000000000000fff,jqfmt=vfsv0,stripe=0x0000000000004000,errors=remount-ro,max_batch_time=0x0000000000000004, [ 32.482493][ T614] serio: Serial port ptm1 [ 32.567764][ T650] input: syz0 as /devices/virtual/input/input4 [ 32.642306][ T659] 9pnet: p9_errstr2errno: server reported unknown error dev/pts 136 0-1048575 pty:slave [ 32.642306][ T659] pty_master /dev/ptm [ 32.672532][ T663] ip_tables: iptables: counters copy to user failed while replacing table [ 33.233070][ T679] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 33.239396][ T665] F2FS-fs (loop3): Test dummy encryption mode enabled [ 33.243191][ T679] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 33.257843][ T665] F2FS-fs (loop3): invalid crc value [ 33.258230][ T679] F2FS-fs (loop5): invalid crc value [ 33.277228][ T665] F2FS-fs (loop3): Found nat_bits in checkpoint [ 33.307899][ T679] F2FS-fs (loop5): Found nat_bits in checkpoint [ 33.350420][ T665] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 33.374298][ T679] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 33.389497][ T679] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 33.472610][ T711] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 33.485215][ T711] ext4 filesystem being mounted at /35/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 33.585611][ T720] attempt to access beyond end of device [ 33.585611][ T720] loop5: rw=2049, want=55464, limit=40427 [ 33.601702][ T720] attempt to access beyond end of device [ 33.601702][ T720] loop5: rw=2049, want=57344, limit=40427 [ 33.626087][ T720] attempt to access beyond end of device [ 33.626087][ T720] loop5: rw=2049, want=51856, limit=40427 [ 33.678973][ T24] kauditd_printk_skb: 99 callbacks suppressed [ 33.678982][ T24] audit: type=1400 audit(1791012296.470:274): avc: denied { read } for pid=724 comm="syz.1.139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 33.696847][ T720] attempt to access beyond end of device [ 33.696847][ T720] loop5: rw=2049, want=53248, limit=40427 [ 33.746811][ T720] attempt to access beyond end of device [ 33.746811][ T720] loop5: rw=2049, want=62360, limit=40427 [ 33.762924][ T727] EXT4-fs (loop2): dax option not supported [ 33.933416][ T502] attempt to access beyond end of device [ 33.933416][ T502] loop5: rw=2049, want=40968, limit=40427 [ 33.949076][ T738] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 34.072835][ T24] audit: type=1400 audit(1791012296.870:275): avc: denied { write } for pid=760 comm="syz.1.153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 34.089559][ T763] netlink: 'syz.1.154': attribute type 4 has an invalid length. [ 34.135295][ T758] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 34.143654][ T644] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 34.236755][ T24] audit: type=1400 audit(1791012297.030:276): avc: denied { write } for pid=777 comm="syz.1.160" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 34.316255][ T24] audit: type=1400 audit(1791012297.110:277): avc: denied { create } for pid=783 comm="syz.0.162" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 34.341055][ T786] netlink: 'syz.0.163': attribute type 3 has an invalid length. [ 34.355380][ T786] netlink: 'syz.0.163': attribute type 3 has an invalid length. [ 34.359137][ T24] audit: type=1400 audit(1791012297.110:278): avc: denied { setopt } for pid=783 comm="syz.0.162" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 34.396739][ T24] audit: type=1400 audit(1791012297.120:279): avc: denied { bind } for pid=783 comm="syz.0.162" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 34.416173][ T24] audit: type=1400 audit(1791012297.180:280): avc: denied { read } for pid=790 comm="syz.3.165" name="ppp" dev="devtmpfs" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 34.420872][ T644] usb 3-1: Using ep0 maxpacket: 16 [ 34.439371][ T24] audit: type=1400 audit(1791012297.180:281): avc: denied { open } for pid=790 comm="syz.3.165" path="/dev/ppp" dev="devtmpfs" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 34.469126][ T24] audit: type=1400 audit(1791012297.180:282): avc: denied { ioctl } for pid=790 comm="syz.3.165" path="/dev/ppp" dev="devtmpfs" ino=153 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 34.611025][ T644] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.633581][ T644] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.655010][ T644] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 34.670295][ T644] usb 3-1: config 0 interface 0 has no altsetting 0 [ 34.682688][ T644] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 34.700932][ T644] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.712050][ T644] usb 3-1: config 0 descriptor?? [ 34.815265][ T805] EXT4-fs (loop3): Test dummy encryption mode enabled [ 34.834398][ T805] EXT4-fs (loop3): Ignoring removed orlov option [ 34.847063][ T805] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 34.860330][ T805] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=284ec1a8, mo2=0003] [ 34.868787][ T805] System zones: 0-5 [ 34.873744][ T805] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,test_dummy_encryption=v1,inlinecrypt,delalloc,noinit_itable,norecovery,minixdf,orlov,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000008, [ 34.901184][ T805] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 35.193217][ T644] hid (null): unknown global tag 0xd [ 35.201275][ T644] hid (null): invalid report_size -1934631279 [ 35.217366][ T644] hid (null): unknown global tag 0xfe [ 35.228599][ T644] hid (null): unknown global tag 0xf1 [ 35.234755][ T644] hid (null): unknown global tag 0xc [ 35.250002][ T24] audit: type=1400 audit(1791012298.040:283): avc: denied { name_bind } for pid=827 comm="syz.3.182" src=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 35.425565][ T850] 9pnet: p9_errstr2errno: server reported unknown error n$[ [ 35.425565][ T850] Q&|x6 [ 35.425565][ T850] N [ 35.471103][ T410] usb 3-1: USB disconnect, device number 3 [ 35.785286][ T896] tipc: Started in network mode [ 35.803916][ T896] tipc: Own node identity fe80000000000000000000000000001, cluster identity 4711 [ 35.814296][ T896] tipc: Enabled bearer , priority 10 [ 35.921225][ T908] exFAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 35.932419][ T908] exFAT-fs (loop1): Medium has reported failures. Some data may be lost. [ 35.943648][ T908] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000ff98, chksum : 0x84a6b859, utbl_chksum : 0xe619d30d) [ 36.012161][ T928] xt_hashlimit: size too large, truncated to 1048576 [ 36.121009][ T410] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 36.224318][ T944] 9pnet: p9_errstr2errno: server reported unknown error n$[ [ 36.224318][ T944] Q&|x6 [ 36.224318][ T944] ND [ 36.368973][ T520] ================================================================== [ 36.369106][ T942] ------------[ cut here ]------------ [ 36.377096][ T520] BUG: KASAN: use-after-free in l2tp_tunnel_del_work+0xcd/0x3d0 [ 36.377111][ T520] Read of size 8 at addr ffff888127f3a080 by task kworker/u4:4/520 [ 36.377114][ T520] [ 36.377126][ T520] CPU: 0 PID: 520 Comm: kworker/u4:4 Not tainted syzkaller #0 [ 36.377131][ T520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 36.377141][ T520] Workqueue: l2tp l2tp_tunnel_del_work [ 36.377149][ T520] Call Trace: [ 36.377160][ T520] __dump_stack+0x21/0x24 [ 36.377169][ T520] dump_stack_lvl+0x1a7/0x208 [ 36.377178][ T520] ? show_regs_print_info+0x18/0x18 [ 36.377189][ T520] ? thaw_kernel_threads+0x220/0x220 [ 36.377199][ T520] print_address_description+0x7f/0x2c0 [ 36.377207][ T520] ? l2tp_tunnel_del_work+0xcd/0x3d0 [ 36.377217][ T520] kasan_report+0x100/0x140 [ 36.377226][ T520] ? __switch_to_asm+0x3a/0x60 [ 36.377235][ T520] ? l2tp_tunnel_del_work+0xcd/0x3d0 [ 36.377247][ T520] __asan_report_load8_noabort+0x14/0x20 [ 36.377256][ T520] l2tp_tunnel_del_work+0xcd/0x3d0 [ 36.377267][ T520] process_one_work+0x6fd/0xbc0 [ 36.377277][ T520] worker_thread+0xa8e/0x13c0 [ 36.377290][ T520] kthread+0x324/0x3b0 [ 36.377299][ T520] ? worker_clr_flags+0x190/0x190 [ 36.377309][ T520] ? kthread_blkcg+0xd0/0xd0 [ 36.377318][ T520] ret_from_fork+0x1f/0x30 [ 36.377323][ T520] [ 36.377337][ T520] Allocated by task 941: [ 36.388607][ T942] WARNING: CPU: 1 PID: 942 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.390777][ T520] __kasan_kmalloc+0xd4/0x100 [ 36.398966][ T942] Modules linked in: [ 36.401192][ T520] __kmalloc+0x19f/0x330 [ 36.401201][ T520] l2tp_session_create+0x39/0xb60 [ 36.401210][ T520] pppol2tp_connect+0xbf5/0x1640 [ 36.401225][ T520] __sys_connect+0x3ce/0x450 [ 36.408677][ T942] [ 36.418718][ T520] __x64_sys_connect+0x7a/0x90 [ 36.418729][ T520] do_syscall_64+0x31/0x40 [ 36.418739][ T520] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 36.418742][ T520] [ 36.418747][ T520] Freed by task 941: [ 36.418762][ T520] kasan_set_track+0x4a/0x70 [ 36.424286][ T942] CPU: 1 PID: 942 Comm: syz.0.231 Not tainted syzkaller #0 [ 36.427579][ T520] kasan_set_free_info+0x23/0x40 [ 36.432039][ T942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 36.436689][ T520] ____kasan_slab_free+0x125/0x160 [ 36.436697][ T520] __kasan_slab_free+0x11/0x20 [ 36.436712][ T520] slab_free_freelist_hook+0xc5/0x190 [ 36.442110][ T942] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.447360][ T520] kfree+0xc0/0x270 [ 36.453057][ T942] Code: 5d c3 e8 cc 5e 35 fd be 02 00 00 00 eb 0a e8 c0 5e 35 fd be 01 00 00 00 4c 89 f7 e8 b3 cc 0e fe e9 0f ff ff ff e8 a9 5e 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 98 5e 35 fd 4c 89 f7 be 03 [ 36.458629][ T520] l2tp_session_put+0xb2/0x1a0 [ 36.463197][ T942] RSP: 0018:ffffc90000dbfc40 EFLAGS: 00010293 [ 36.467967][ T520] pppol2tp_ioctl+0x748/0x960 [ 36.473281][ T942] [ 36.478948][ T520] pppox_ioctl+0x1e4/0x320 [ 36.486408][ T942] RAX: ffffffff842f56a7 RBX: ffff888107df2000 RCX: ffff88810e8de400 [ 36.488902][ T520] sock_do_ioctl+0xda/0x380 [ 36.493602][ T942] RDX: 0000000000000000 RSI: 000000000ceedd20 RDI: 000000000c04eb7d [ 36.497630][ T520] sock_ioctl+0x472/0x740 [ 36.497640][ T520] __se_sys_ioctl+0x121/0x1a0 [ 36.497648][ T520] __x64_sys_ioctl+0x7b/0x90 [ 36.497665][ T520] do_syscall_64+0x31/0x40 [ 36.502887][ T942] RBP: ffffc90000dbfc60 R08: ffff888107df2083 R09: 1ffff11020fbe410 [ 36.507256][ T520] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 36.511785][ T942] R10: dffffc0000000000 R11: ffffed1020fbe411 R12: dffffc0000000000 [ 36.514057][ T520] [ 36.514067][ T520] The buggy address belongs to the object at ffff888127f3a000 [ 36.514067][ T520] which belongs to the cache kmalloc-512 of size 512 [ 36.514077][ T520] The buggy address is located 128 bytes inside of [ 36.514077][ T520] 512-byte region [ffff888127f3a000, ffff888127f3a200) [ 36.514088][ T520] The buggy address belongs to the page: [ 36.518365][ T942] R13: dffffc0000000000 R14: 000000000ceedd20 R15: ffff888127f3a000 [ 36.528407][ T520] page:ffffea00049fce00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x127f38 [ 36.528416][ T520] head:ffffea00049fce00 order:2 compound_mapcount:0 compound_pincount:0 [ 36.528425][ T520] flags: 0x4000000000010200(slab|head) [ 36.528439][ T520] raw: 4000000000010200 ffffea00049fca00 0000000400000004 ffff888100043080 [ 36.528451][ T520] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 36.528455][ T520] page dumped because: kasan: bad access detected [ 36.528460][ T520] page_owner tracks the page as allocated [ 36.528474][ T520] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 283, ts 26255846876, free_ts 0 [ 36.528492][ T520] prep_new_page+0x176/0x190 [ 36.533373][ T942] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 36.537762][ T520] get_page_from_freelist+0x225f/0x23f0 [ 36.542167][ T942] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.547088][ T520] __alloc_pages_nodemask+0x29a/0x640 [ 36.547097][ T520] new_slab+0x84/0x3f0 [ 36.547105][ T520] ___slab_alloc+0x2f8/0x4c0 [ 36.547119][ T520] __slab_alloc+0x63/0xa0 [ 36.552117][ T942] CR2: 00007ffe4341d028 CR3: 00000001255b0000 CR4: 00000000003506a0 [ 36.556904][ T520] __kmalloc_track_caller+0x1e4/0x310 [ 36.559229][ T942] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.564184][ T520] __alloc_skb+0xdc/0x520 [ 36.564193][ T520] netlink_sendmsg+0x693/0xb70 [ 36.564202][ T520] __sys_sendto+0x467/0x620 [ 36.564210][ T520] __x64_sys_sendto+0xe5/0x100 [ 36.564220][ T520] do_syscall_64+0x31/0x40 [ 36.564230][ T520] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 36.564234][ T520] page_owner free stack trace missing [ 36.564244][ T520] [ 36.568726][ T942] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.575050][ T520] Memory state around the buggy address: [ 36.575060][ T520] ffff888127f39f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.575068][ T520] ffff888127f3a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.575076][ T520] >ffff888127f3a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.575080][ T520] ^ [ 36.575087][ T520] ffff888127f3a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.575098][ T520] ffff888127f3a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.577431][ T942] Call Trace: [ 36.581310][ T520] ================================================================== [ 36.581314][ T520] Disabling lock debugging due to kernel taint [ 37.039257][ T410] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 37.039308][ T942] pppol2tp_release+0x150/0x2b0 [ 37.050456][ T410] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.055914][ T942] sock_close+0xb8/0x200 [ 37.066656][ T410] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.066674][ T410] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 37.071264][ T284] tipc: 32-bit node address hash set to 100080fe [ 37.088800][ T942] ? sock_mmap+0xa0/0xa0 [ 37.106931][ T942] __fput+0x2dc/0x730 [ 37.115025][ T942] ____fput+0x15/0x20 [ 37.119273][ T942] task_work_run+0x127/0x190 [ 37.124356][ T942] do_exit+0xa7c/0x24e0 [ 37.128668][ T942] ? __kasan_check_write+0x14/0x20 [ 37.133985][ T942] ? switch_fpu_return+0x19c/0x330 [ 37.139227][ T942] ? put_task_struct+0x90/0x90 [ 37.144148][ T410] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 37.144231][ T942] ? fpu__clear_all+0x20/0x20 [ 37.153231][ T410] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 37.158226][ T942] ? __kasan_check_read+0x11/0x20 [ 37.166177][ T410] usb 4-1: Manufacturer: syz [ 37.166852][ T410] usb 4-1: config 0 descriptor?? [ 37.180870][ T942] __x64_sys_exit+0x40/0x40 [ 37.185579][ T942] do_syscall_64+0x31/0x40 [ 37.190261][ T942] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 37.196227][ T942] RIP: 0033:0x7fb1bd64e159 [ 37.200652][ T942] Code: Unable to access opcode bytes at RIP 0x7fb1bd64e12f. [ 37.208203][ T942] RSP: 002b:00007fb1bc0a6ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 37.216863][ T942] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fb1bd64e159 [ 37.225294][ T942] RDX: 00007fb1bc0a79c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 37.233301][ T942] RBP: 00007fb1bd6e506b R08: 0000000000000000 R09: 0000000000000058 [ 37.242069][ T942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 37.250253][ T942] R13: 00007fb1bd8d6038 R14: 00007fb1bd8d5fa0 R15: 00007ffe4341ccc8 [ 37.258451][ T942] ---[ end trace cf96535ed5aac218 ]--- [ 37.671548][ T410] appleir 0003:05AC:8243.0002: unknown main item tag 0x0 [ 37.678779][ T410] appleir 0003:05AC:8243.0002: No inputs registered, leaving [ 37.687582][ T410] appleir 0003:05AC:8243.0002: hiddev96,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 39.150900][ T284] usb 4-1: reset high-speed USB device number 3 using dummy_hcd [ 40.051215][ T410] usb 4-1: USB disconnect, device number 3