last executing test programs: 2.546165911s ago: executing program 4 (id=424): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x3f, &(0x7f00000001c0)={&(0x7f0000000000)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r4}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) 2.392229163s ago: executing program 4 (id=426): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000006"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) syz_usbip_server_init(0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) socket$igmp(0x2, 0x3, 0x2) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 1.888196461s ago: executing program 1 (id=433): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b70200001400000bb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000700)='kfree\x00', r2}, 0x18) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r5}, 0x10) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000600)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@version_9p2000}]}}) 1.823873962s ago: executing program 1 (id=435): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x30000c6, &(0x7f0000000180), 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r0 = open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x21) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x78c00}], 0x1, 0x7abff, 0x0, 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000030000000000000000000400b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000380)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r3, 0x0, 0x5}, 0x18) fallocate(r1, 0x0, 0x0, 0x8000c62) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) pwritev2(r4, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x0) 1.729279783s ago: executing program 4 (id=441): ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0x511e36599023629, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r0, 0x0) r1 = syz_io_uring_setup(0x247a, &(0x7f0000000580)={0x0, 0xa3f6, 0x10100}, &(0x7f0000000380)=0x0, &(0x7f0000000680)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB='2'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r4, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_READ_FIXED) io_uring_enter(r1, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 1.656361074s ago: executing program 1 (id=442): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000080000000000000010000009400000007ad4160850000000f00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='netlink_extack\x00', r0}, 0x10) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0xe08, 0x0, 0x2, 0x1, 0x80000000}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x8000) syz_emit_ethernet(0x6a, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000000aaaaaa"], 0x0) write$binfmt_misc(r2, &(0x7f0000000000), 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe6, 0x0) 1.519561817s ago: executing program 4 (id=444): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000008002b000000000000000018040000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r0}, 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_read_part_table(0x60d, &(0x7f0000002200)="$eJzs3D9olHcYB/DvJbmcUTAdnFxqHDoJRXE0Q5XkqlgIp1IIDvYfIs0UIXDSw5Q4tBkUM0jHLlK4DhonYwYnRaFzEQeLkMGlYBepHXLl7l6SOyjF0oRS/HyGe353PDzf94F3/V34XxtIuTi1Kp3y/qd/298a3TzP50xzYvJ4q9VqnU5KOZtyxsq7l5MMpX9q9icZ7plz8/udq9/+9mG5+fTUq/fOPVgc2JhZyTtJdvU2Z+SvHqXyzzZlO9wafzi6cGW2erX9pdpYW/84uf1yorZycnFp+UT52Oft3y8nj4r+7osxkoup51K+zCdDbxz19eax1Jc/386vj194Um2sfdd8fnB9b3Xw7vkjr/etXrt/KJlrR0yl87JvGv6Xi/fkL/Tkz41dn15qHD1wZ8+Nw/V7j2svBn9vdRWR5a3JBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABge9xqf1yZrV6tj194Um2sffPzTx/dfjlRWzm5uLR8YvjYs6LvUVGHinox9VxKOclMZvJFZt88crrUmz/+cHRhI/+Pncnzg+t7q82754+8nly9dv9Qp6uUqXYZ2IqN+/XnN9bmxq5PLzWOHriz58bh+r3HtReD3b6ZSj7rrJuksvWPAQAAAAAAAAAAAAAAAAAAwFtuYvL4vqkPaqeTUs7uSPLrV51b9q3KyI/p3Lzv2l/UZ5Vkd5KbO7r/BdB8eurV8LkHi78Ul+LnU8l8kl0/rJxJ3t3IudwfW96czH/pzwAAAP//gTiR5w==") creat(&(0x7f0000000200)='./bus\x00', 0x10) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x0) pwritev2(r1, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x78c00}], 0x1, 0x1200, 0x30, 0x3) 1.395110628s ago: executing program 4 (id=445): bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000440)=0xcf7f, 0x4) lstat(0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000080), 0x4) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) 1.394156998s ago: executing program 0 (id=456): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc, 0x3, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x1}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000c00) 1.313405109s ago: executing program 0 (id=447): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000202300800000000000000000850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0x0) fchdir(r2) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) 1.106408493s ago: executing program 0 (id=449): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) bind$vsock_stream(r1, &(0x7f0000000940), 0x10) close(0x3) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) writev(r2, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x20000081}], 0x1) ioctl$INCFS_IOC_CREATE_FILE(r0, 0xc058671e, 0x0) 953.614005ms ago: executing program 4 (id=455): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000021"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70300001d000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x18) close(r1) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$cgroup_devices(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="5e0308003c5ca601d77045"], 0xffdd) 952.964255ms ago: executing program 2 (id=457): bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYRES64], 0x48) creat(&(0x7f0000000000)='./bus\x00', 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000a00)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000680)='./bus\x00', 0xa2000061) close(r2) 936.002095ms ago: executing program 0 (id=458): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='cdg\x00', 0x4) dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001000000000000000640000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000e0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='kfree\x00', r2}, 0x18) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close(r0) 931.216036ms ago: executing program 2 (id=459): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000080)=0x9, 0x8, 0x0) mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0) mbind(&(0x7f0000673000/0x1000)=nil, 0x1000, 0x3, &(0x7f00000009c0)=0x7, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) 887.210336ms ago: executing program 0 (id=460): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) r2 = timerfd_create(0x0, 0x0) timerfd_settime(r2, 0x3, &(0x7f0000000440)={{0x0, 0x989680}}, 0x0) read(r2, &(0x7f0000000240)=""/123, 0x7b) clock_adjtime(0x0, &(0x7f0000000040)={0xd51, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x201, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xe438, 0x0, 0x3}) 713.047569ms ago: executing program 2 (id=461): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) ioprio_set$uid(0x3, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0xf3a, 0x0) write(r0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) getpeername$l2tp(r2, &(0x7f0000000000), &(0x7f0000000040)=0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)={0x1c, r4, 0x9c3fa077fa966179, 0x4, 0x25dfdbfb, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) 712.217369ms ago: executing program 1 (id=471): socket$packet(0x11, 0x2, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001000390400"/20, @ANYRES32=r3, @ANYBLOB="059900f3ffffff111800128008000100677470000c000280050005"], 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x8000) sendto$packet(r0, &(0x7f0000000540)='\x00', 0x1, 0xfc77c4484dd0652e, &(0x7f0000000200)={0x11, 0x1, r3}, 0x14) 681.402599ms ago: executing program 1 (id=462): syz_read_part_table(0x634, &(0x7f0000000000)="$eJzs3DFoXVUYB/D/Td+7L2mhreLUpdVZLHY2NSDpo9Kp0q1LVZBQcYhTxJIX6WKGDA7OLkXIUuuioYODtoiTOIUOasVVkKJSi/bIfffmvUQQxLaD8PsNued895zvO1/uXd8N/2sz6SfVeDhIL8nxl/+2Yi07CzLbrE9S+t29c5uLp06XUkrVrDmffp78/OC1JL1uSzVJU0pZnUxO5soH+6+/W436m7eaojfW9zXhufYYh5OnD9Sz4zRNzWmKPQcbPMz/A//N1fmbVXW57mZP/XJ/Ifno58WzW2fW37v2YhdeTb5Mmuf/TvNG7Kx+KxePXeiNh81TfnN33l/bSz2NTB/3XHp7zjC6vDzcWJhf2t4JHBlufvrac78fu55yIl/VvZmdG9U0X52MHrz9pv9Dzdu/sTK/tD28NDe58cT7j3+Ro93kTik53JR8LP0sPISyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8IlfnbyYZDTeSpe3hoIsunt06s14neeHV2S50fPeufd31Yi7cbq6rWU5++CT93Yuq5s84MpP+Qhv7/mh5Zjzo7dQfzLWDlT9LKff2J7efvX9k2O7Kjc9OTMutTjJv5fludLe0xpO1f2qyK1EOtVW/vre7/6qXLA83VuaXtoeXfqx6bcMfV6PJMWeSvD7IK20z5W7d7f1j2gYAAAAAAAAAAAAAAAAAAAA8kMVTp9+4043Pzyb56e2ZZlwG7a/cq/3VnvXfDpK5k8mV2VSjhSS3Xvqt/ubg+nfdpwNGGWSU5MCHa+e6LfWeBJNPBFQp9aPsjH/jrwAAAP//8Ap8jg==") r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x474c, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000040)=0x6aba, 0x4) setsockopt$inet_int(r0, 0x0, 0x7, &(0x7f0000000180)=0x40000000, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@private1, 0xfffc, 0x0, 0xfffd, 0xfffe, 0xa}, {0xffff, 0x0, 0x0, 0x0, 0x0, 0x9, 0x60}, {0x0, 0x7fffffffffffffff, 0x4}, 0x4, 0x0, 0x1, 0x1}, {{@in=@rand_addr=0x64010101, 0x0, 0x33}, 0xa, @in=@empty, 0x0, 0x4, 0x0, 0x0, 0x200}}, 0xe8) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 681.118359ms ago: executing program 3 (id=463): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000480)='kfree\x00', r1, 0x0, 0x7}, 0x18) r2 = inotify_init1(0x800) inotify_add_watch(r2, &(0x7f0000000040)='.\x00', 0x24000420) r3 = syz_io_uring_setup(0x4169, &(0x7f0000000200)={0x0, 0x0, 0x10100}, &(0x7f0000000480)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x4000, @fd=r2, 0x4, &(0x7f0000000080)=""/164, 0xa4, 0x14, 0x1}) io_uring_enter(r3, 0x48e9, 0x8daf, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) unshare(0x68040200) 601.47462ms ago: executing program 2 (id=464): sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xfff3}}}, 0x24}}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000004c0)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1a, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000000000000000000000002001801000020646c4300000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x3a, '\x00', r2, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000280)='sched_switch\x00', r3, 0x0, 0x2}, 0x18) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) 601.199ms ago: executing program 3 (id=465): timerfd_settime(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r0 = getpid() r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='kfree\x00', r1}, 0x18) open(0x0, 0x80140, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000a5e000/0x1000)=nil, 0x1000, 0x17) process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) 468.563062ms ago: executing program 3 (id=466): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000002c0)='sched_switch\x00', r1}, 0x18) r2 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r2, &(0x7f0000000040)={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0xc) r3 = syz_io_uring_setup(0x497, &(0x7f00000004c0)={0x0, 0x4661, 0x800, 0x3, 0x20e}, &(0x7f0000000540)=0x0, &(0x7f0000000680)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r2, 0x0, 0x0}) io_uring_enter(r3, 0x40f9, 0x217, 0xa5, 0x0, 0x0) 427.241453ms ago: executing program 1 (id=467): getpid() r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020700000000000002030207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000001"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f00000002c0)='./bus\x00', 0x404, &(0x7f0000000580)={[{@orlov}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}]}, 0x1, 0x5d8, &(0x7f00000012c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x3ffff) sendfile(r2, r1, 0x0, 0x7ffff000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='sched_switch\x00', r0}, 0x10) 378.547414ms ago: executing program 2 (id=468): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./file2\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x6, 0x360, &(0x7f0000000b00)="$eJzs3c1rO0UYwPEnaZImKW1yEEVBOtiLXpY2ehaDtCAELG0jtoKwbTcasiYlG6oRse3Jq3j3JHgovVnwUND+A71404sI3noRPFhBXdm3ZPPWl5g0/trvB0omM/PszmQn5dm0m718+/MPKiVLK+kNiSaVRERErkSyEpVAxH+MuuWEhB3KSzO///j8+mYx6VWolfzGyzml1Nz8dx9+kvK7nU3LRfbdy99yv148ffHs5T8b75ctVbZUtdZQutqu/dzQt01D7ZatiqbUqmnolqHKVcuoe+3f+Nsxa3t7TaVXd2fTe3XDspRebaqK0VSNmmrUm0p/Ty9XlaZpajYtuEnxeG1Nzw8ZvDPiwWBM6vW8PiUiqZ6W4vFEBgQAACaqO/+POin9MPn/lswVCstryunczv9PXjhvzLx1Oufn/2eJfvn/Kz952+rI/53TiXb+X/POD0o35/9fyh3y/96M6HEZOv/PjmEwGM58oqcq0vHMyf/T/vvXdfTOyaJbIP8HAAAAAAAAAAAAAAAAAAAAAOBJcGXbGdu2M8Fj8NO+hMB/jgdp0PGfFpGkc/Rtjv9Dtr65JUn3wj3nGJuf7Rf3i96j3+FcREwx/ra7OWsjuPJIObLyvXngxx/sF6fclnxJyk68LElGsu56CsXb9sobheUl5fHjW5cppcPxOcnIU+H4b93V6cTnOuP9/SfkxYVQvCYZ+WFHamLKrhvZ3v+nS0q9/mahKz7l9hORX+79oAAAAAAAMGKaaul7/q5pg9q9bxnJl9yPiQxZlIz81f/8frHv+Xks81xs0rMHAAAAAOBxsJofV3SJGnW3YJr9CikZ2DSCQqyjJi4ifTsnumri1215KjTD244nId4dTP7rvL4KXtW7RAX/SOEMvNXk31FFhhtPMH+3JhJrNf1513lFDsVdAIfhpqjcIjzWPfh5p0L17bwwcDtH/kRaNcHHRokBr7Os9m4nes1KiPfU2JHhFsAzX3z9x+jeIK+e+ivgo5s7H5mGfSC3OShdBWcXvU3xsf/iAQAAAHDv2kl/UPNauDl8I5HwzXL4yz0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAACM0lq/06ypMeo4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA/8W/AQAA//9/d/Qh") r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x105042, 0x80) mmap$IORING_OFF_SQ_RING(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x100000b, 0x13, r2, 0x0) write$cgroup_subtree(r2, 0x0, 0x32600) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040), 0x208e24b) 378.305224ms ago: executing program 3 (id=469): r0 = io_uring_setup(0x1946, &(0x7f0000000a80)={0x0, 0xa94d, 0x1, 0xfffffffd, 0x179}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000500)={0xa, 0x2, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendto$inet6(r1, &(0x7f00000000c0)="04", 0x1, 0x20000845, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e24, 0x0, @loopback, 0x1}}, 0x0, 0x0, 0x6, 0x0, "10baa70a93289349d889de25b87376f64276337642b890d33cb5b592e66e6229bc5c7ac135fee1b3871b7ef6619db5b2a94edb6f73ea08b02aa3b47debd38b6d889a8c986b33eb49c3157f1f370dfd67"}, 0xd8) r2 = dup(r1) sendmsg$IPSET_CMD_TYPE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x24008000}, 0x20000001) close_range(r0, 0xffffffffffffffff, 0x0) 258.994035ms ago: executing program 3 (id=470): bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYRES64], 0x48) creat(&(0x7f0000000000)='./bus\x00', 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000a00)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000680)='./bus\x00', 0xa2000061) close(r2) 254.272056ms ago: executing program 2 (id=473): r0 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f00000006c0)={0x0, 0xffffffffffffff16, 0x0}, 0x44080) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0x11, 0xc, &(0x7f0000001940)=ANY=[@ANYBLOB="18000000ed074479000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x6c, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000003c0)='sched_switch\x00', r1}, 0x18) r2 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) ioctl$MON_IOCX_MFETCH(r2, 0xc0109207, &(0x7f00000005c0)={0x0}) syz_open_dev$usbfs(&(0x7f0000000580), 0x205, 0x8401) sendmsg(r0, &(0x7f0000003680)={0x0, 0x0, &(0x7f0000003140)=[{&(0x7f0000002d80)="0f", 0x1}, {0x0, 0x2}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0, 0x4d}, {0x0}], 0x9}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910950000000000730ae8ff00000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) recvmmsg(r0, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1, &(0x7f0000000200)=""/172, 0xac}}, {{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000002c0)=""/68, 0x44}, {&(0x7f0000000340)=""/222, 0xde}, {&(0x7f0000000440)=""/138, 0x8a}, {&(0x7f00000005c0)=""/59, 0x3b}, {&(0x7f0000000700)=""/162, 0xa2}, {&(0x7f00000007c0)=""/206, 0xce}], 0x6}}], 0x2, 0x40000020, 0x0) 767.3µs ago: executing program 0 (id=474): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x30000c6, &(0x7f0000000180), 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r0 = open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x21) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x78c00}], 0x1, 0x7abff, 0x0, 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000030000000000000000000400b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000380)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r3, 0x0, 0x5}, 0x18) fallocate(r1, 0x0, 0x0, 0x8000c62) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) pwritev2(r4, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x0) 0s ago: executing program 3 (id=484): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3ff, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a310000000014000780050015000c00000008001240000000000500050002000000050004000000000010000300686173683a69702c6d6163"], 0x5c}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004810}, 0x840) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.10.28' (ED25519) to the list of known hosts. [ 21.356659][ T29] audit: type=1400 audit(1750239452.750:62): avc: denied { mounton } for pid=3279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.357555][ T3279] cgroup: Unknown subsys name 'net' [ 21.379380][ T29] audit: type=1400 audit(1750239452.750:63): avc: denied { mount } for pid=3279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.406741][ T29] audit: type=1400 audit(1750239452.780:64): avc: denied { unmount } for pid=3279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.555162][ T3279] cgroup: Unknown subsys name 'cpuset' [ 21.561312][ T3279] cgroup: Unknown subsys name 'rlimit' [ 21.730158][ T29] audit: type=1400 audit(1750239453.120:65): avc: denied { setattr } for pid=3279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.753867][ T29] audit: type=1400 audit(1750239453.120:66): avc: denied { create } for pid=3279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.774317][ T29] audit: type=1400 audit(1750239453.120:67): avc: denied { write } for pid=3279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.794769][ T29] audit: type=1400 audit(1750239453.120:68): avc: denied { read } for pid=3279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.815384][ T29] audit: type=1400 audit(1750239453.150:69): avc: denied { mounton } for pid=3279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.822413][ T3298] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.840220][ T29] audit: type=1400 audit(1750239453.150:70): avc: denied { mount } for pid=3279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.872099][ T29] audit: type=1400 audit(1750239453.240:71): avc: denied { relabelto } for pid=3298 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.908692][ T3279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.633163][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 23.657540][ T3311] chnl_net:caif_netlink_parms(): no params data found [ 23.731226][ T3305] chnl_net:caif_netlink_parms(): no params data found [ 23.746701][ T3306] chnl_net:caif_netlink_parms(): no params data found [ 23.766321][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.773439][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.780779][ T3307] bridge_slave_0: entered allmulticast mode [ 23.787235][ T3307] bridge_slave_0: entered promiscuous mode [ 23.810599][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.817769][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.825017][ T3307] bridge_slave_1: entered allmulticast mode [ 23.831362][ T3307] bridge_slave_1: entered promiscuous mode [ 23.843006][ T3313] chnl_net:caif_netlink_parms(): no params data found [ 23.862855][ T3311] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.870094][ T3311] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.877425][ T3311] bridge_slave_0: entered allmulticast mode [ 23.883786][ T3311] bridge_slave_0: entered promiscuous mode [ 23.892822][ T3311] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.899915][ T3311] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.907125][ T3311] bridge_slave_1: entered allmulticast mode [ 23.913395][ T3311] bridge_slave_1: entered promiscuous mode [ 23.931404][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 23.961404][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 23.971783][ T3311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 23.981987][ T3311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 24.013471][ T3305] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.020611][ T3305] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.028278][ T3305] bridge_slave_0: entered allmulticast mode [ 24.034762][ T3305] bridge_slave_0: entered promiscuous mode [ 24.055997][ T3305] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.063211][ T3305] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.070511][ T3305] bridge_slave_1: entered allmulticast mode [ 24.077078][ T3305] bridge_slave_1: entered promiscuous mode [ 24.085920][ T3307] team0: Port device team_slave_0 added [ 24.092219][ T3311] team0: Port device team_slave_0 added [ 24.098100][ T3306] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.105259][ T3306] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.112409][ T3306] bridge_slave_0: entered allmulticast mode [ 24.118993][ T3306] bridge_slave_0: entered promiscuous mode [ 24.134868][ T3307] team0: Port device team_slave_1 added [ 24.141541][ T3311] team0: Port device team_slave_1 added [ 24.151977][ T3306] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.159204][ T3306] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.166564][ T3306] bridge_slave_1: entered allmulticast mode [ 24.173046][ T3306] bridge_slave_1: entered promiscuous mode [ 24.202199][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.209446][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.235469][ T3311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.251778][ T3305] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 24.261102][ T3313] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.268235][ T3313] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.275580][ T3313] bridge_slave_0: entered allmulticast mode [ 24.281824][ T3313] bridge_slave_0: entered promiscuous mode [ 24.288377][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.295387][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.321446][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.332567][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.339600][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.365680][ T3311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.384227][ T3305] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 24.393526][ T3313] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.400621][ T3313] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.407798][ T3313] bridge_slave_1: entered allmulticast mode [ 24.414086][ T3313] bridge_slave_1: entered promiscuous mode [ 24.420683][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.427723][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.454008][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.475860][ T3306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 24.502913][ T3306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 24.514120][ T3311] hsr_slave_0: entered promiscuous mode [ 24.520330][ T3311] hsr_slave_1: entered promiscuous mode [ 24.550305][ T3305] team0: Port device team_slave_0 added [ 24.557011][ T3313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 24.567879][ T3313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 24.578991][ T3307] hsr_slave_0: entered promiscuous mode [ 24.585018][ T3307] hsr_slave_1: entered promiscuous mode [ 24.590868][ T3307] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 24.598932][ T3307] Cannot create hsr debugfs directory [ 24.609062][ T3306] team0: Port device team_slave_0 added [ 24.615715][ T3306] team0: Port device team_slave_1 added [ 24.621956][ T3305] team0: Port device team_slave_1 added [ 24.661337][ T3313] team0: Port device team_slave_0 added [ 24.668033][ T3313] team0: Port device team_slave_1 added [ 24.685964][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.692933][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.718990][ T3306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.729996][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.737041][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.763086][ T3305] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.785975][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.793083][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.819039][ T3313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.835585][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.842639][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.868714][ T3306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.879664][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.886649][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.913486][ T3305] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.926621][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.933620][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.959630][ T3313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 25.013358][ T3306] hsr_slave_0: entered promiscuous mode [ 25.019448][ T3306] hsr_slave_1: entered promiscuous mode [ 25.025349][ T3306] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 25.032896][ T3306] Cannot create hsr debugfs directory [ 25.056207][ T3305] hsr_slave_0: entered promiscuous mode [ 25.062303][ T3305] hsr_slave_1: entered promiscuous mode [ 25.068226][ T3305] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 25.075810][ T3305] Cannot create hsr debugfs directory [ 25.106853][ T3313] hsr_slave_0: entered promiscuous mode [ 25.112923][ T3313] hsr_slave_1: entered promiscuous mode [ 25.118952][ T3313] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 25.126539][ T3313] Cannot create hsr debugfs directory [ 25.225930][ T3311] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 25.234909][ T3311] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 25.256768][ T3311] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 25.265489][ T3311] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 25.305324][ T3307] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 25.321128][ T3307] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 25.329681][ T3307] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 25.343794][ T3307] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 25.367064][ T3306] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 25.376171][ T3306] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 25.394074][ T3306] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 25.403196][ T3306] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 25.432020][ T3311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.447375][ T3305] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 25.460047][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.468278][ T3305] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 25.477268][ T3305] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 25.486618][ T3305] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 25.510429][ T3311] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.520729][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.540500][ T1026] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.547584][ T1026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.557302][ T1026] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.564492][ T1026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.574364][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.581430][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.590535][ T3313] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 25.599832][ T3313] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 25.608866][ T3313] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 25.623323][ T3311] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 25.633843][ T3311] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 25.647579][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.654673][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.672046][ T3313] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 25.700012][ T3307] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 25.710502][ T3307] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 25.741734][ T3306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.765143][ T3306] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.778530][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.785744][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.801885][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.808987][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.839194][ T3306] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 25.849671][ T3306] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 25.871232][ T3305] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.883982][ T3311] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 25.902807][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 25.916526][ T3305] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.929601][ T1026] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.936720][ T1026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.946424][ T1026] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.953590][ T1026] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.982868][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.006577][ T3313] 8021q: adding VLAN 0 to HW filter on device team0 [ 26.018550][ T3306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.031367][ T3311] veth0_vlan: entered promiscuous mode [ 26.039886][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.046989][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.061585][ T3311] veth1_vlan: entered promiscuous mode [ 26.089744][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.096923][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.117499][ T3311] veth0_macvtap: entered promiscuous mode [ 26.154483][ T3307] veth0_vlan: entered promiscuous mode [ 26.160595][ T3311] veth1_macvtap: entered promiscuous mode [ 26.181056][ T3307] veth1_vlan: entered promiscuous mode [ 26.197382][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.210875][ T3305] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.229614][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.242919][ T3307] veth0_macvtap: entered promiscuous mode [ 26.262485][ T3311] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.271367][ T3311] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.280320][ T3311] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.289148][ T3311] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.308653][ T3313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.332227][ T3307] veth1_macvtap: entered promiscuous mode [ 26.353223][ T3306] veth0_vlan: entered promiscuous mode [ 26.364542][ T29] kauditd_printk_skb: 10 callbacks suppressed [ 26.364555][ T29] audit: type=1400 audit(1750239457.750:82): avc: denied { mount } for pid=3311 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 26.395747][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.405330][ T3306] veth1_vlan: entered promiscuous mode [ 26.418224][ T3306] veth0_macvtap: entered promiscuous mode [ 26.428919][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.438555][ T3311] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.445467][ T3307] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.461846][ T3307] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.463158][ T29] audit: type=1400 audit(1750239457.770:83): avc: denied { mounton } for pid=3311 comm="syz-executor" path="/root/syzkaller.sPGVGh/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 26.470801][ T3307] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.496348][ T29] audit: type=1400 audit(1750239457.770:84): avc: denied { mount } for pid=3311 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 26.505026][ T3307] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.535937][ T29] audit: type=1400 audit(1750239457.770:85): avc: denied { mounton } for pid=3311 comm="syz-executor" path="/root/syzkaller.sPGVGh/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 26.567270][ T29] audit: type=1400 audit(1750239457.770:86): avc: denied { mounton } for pid=3311 comm="syz-executor" path="/root/syzkaller.sPGVGh/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4552 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 26.595195][ T29] audit: type=1400 audit(1750239457.770:87): avc: denied { unmount } for pid=3311 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 26.614693][ T29] audit: type=1400 audit(1750239457.780:88): avc: denied { mounton } for pid=3311 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 26.637419][ T29] audit: type=1400 audit(1750239457.790:89): avc: denied { mount } for pid=3311 comm="syz-executor" name="/" dev="gadgetfs" ino=4554 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 26.667413][ T3306] veth1_macvtap: entered promiscuous mode [ 26.676114][ T29] audit: type=1400 audit(1750239458.060:90): avc: denied { read write } for pid=3311 comm="syz-executor" name="loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 26.700450][ T29] audit: type=1400 audit(1750239458.060:91): avc: denied { open } for pid=3311 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 26.746745][ T3305] veth0_vlan: entered promiscuous mode [ 26.758859][ T3313] veth0_vlan: entered promiscuous mode [ 26.769959][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.779494][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.791898][ T3306] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.800788][ T3306] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.809578][ T3306] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.818510][ T3306] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.828703][ T3305] veth1_vlan: entered promiscuous mode [ 26.844222][ T3305] veth0_macvtap: entered promiscuous mode [ 26.861078][ T3305] veth1_macvtap: entered promiscuous mode [ 26.868855][ C0] hrtimer: interrupt took 48101 ns [ 26.878496][ T3313] veth1_vlan: entered promiscuous mode [ 26.880913][ T3479] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6'. [ 26.892712][ T3479] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6'. [ 26.901769][ T3479] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6'. [ 26.922476][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.936160][ T3313] veth0_macvtap: entered promiscuous mode [ 26.948482][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.965459][ T3313] veth1_macvtap: entered promiscuous mode [ 26.982208][ T3305] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.991085][ T3305] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.999922][ T3305] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.008833][ T3305] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.023374][ T3486] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5'. [ 27.032611][ T3484] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7'. [ 27.065065][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 27.082920][ T3488] syz.1.8 uses obsolete (PF_INET,SOCK_PACKET) [ 27.086306][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 27.125513][ T3313] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.134320][ T3313] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.143182][ T3313] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.152072][ T3313] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.232706][ T3496] syzkaller0: entered promiscuous mode [ 27.238407][ T3496] syzkaller0: entered allmulticast mode [ 27.300723][ T3503] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 27.314380][ T3501] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4'. [ 27.431224][ T3512] loop2: detected capacity change from 0 to 512 [ 27.438356][ T3512] ======================================================= [ 27.438356][ T3512] WARNING: The mand mount option has been deprecated and [ 27.438356][ T3512] and is ignored by this kernel. Remove the mand [ 27.438356][ T3512] option from the mount to silence this warning. [ 27.438356][ T3512] ======================================================= [ 27.519879][ T3512] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 27.533106][ T3512] ext4 filesystem being mounted at /6/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 27.587267][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 27.587792][ T3510] syz.3.15 (3510) used greatest stack depth: 10248 bytes left [ 27.631264][ T3519] netlink: 4 bytes leftover after parsing attributes in process `syz.3.18'. [ 27.640125][ T3519] netlink: 16 bytes leftover after parsing attributes in process `syz.3.18'. [ 27.652298][ T3519] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 27.661107][ T3519] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 27.669985][ T3519] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 27.678813][ T3519] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 27.702468][ T3519] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 27.711632][ T3519] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 27.720627][ T3519] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 27.729551][ T3519] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 27.814787][ T3519] Zero length message leads to an empty skb [ 28.081812][ T3537] netlink: 2028 bytes leftover after parsing attributes in process `syz.3.25'. [ 28.090860][ T3537] netlink: 12 bytes leftover after parsing attributes in process `syz.3.25'. [ 28.550642][ T3547] loop0: detected capacity change from 0 to 128 [ 28.560941][ T3547] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 28.574707][ T3547] ext4 filesystem being mounted at /1/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 28.609718][ T3503] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 28.628929][ T3305] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 28.680610][ T3552] loop2: detected capacity change from 0 to 1024 [ 28.695119][ T3552] EXT4-fs: Ignoring removed orlov option [ 28.710324][ T3552] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 28.970430][ T3576] SELinux: failed to load policy [ 29.007677][ T3580] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3580 comm=syz.4.42 [ 29.084628][ T3586] loop3: detected capacity change from 0 to 1024 [ 29.116341][ T3586] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 29.176419][ T3586] EXT4-fs error (device loop3): mb_free_blocks:1948: group 0, inode 15: block 433:freeing already freed block (bit 27); block bitmap corrupt. [ 29.198418][ T3586] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 28 [ 29.210758][ T3586] EXT4-fs (loop3): This should not happen!! Data will be lost [ 29.210758][ T3586] [ 29.220489][ T3586] EXT4-fs (loop3): Total free blocks count 0 [ 29.226523][ T3586] EXT4-fs (loop3): Free/Dirty block details [ 29.232504][ T3586] EXT4-fs (loop3): free_blocks=16 [ 29.237626][ T3586] EXT4-fs (loop3): dirty_blocks=0 [ 29.242669][ T3586] EXT4-fs (loop3): Block reservation details [ 29.248724][ T3586] EXT4-fs (loop3): i_reserved_data_blocks=0 [ 29.292314][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 29.438296][ T3503] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 29.492908][ T3615] 9pnet_fd: Insufficient options for proto=fd [ 29.525243][ T3503] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 29.656891][ T3503] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.676487][ T3503] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.695977][ T3503] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.719085][ T3503] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.759305][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 29.817404][ T3637] loop1: detected capacity change from 0 to 512 [ 29.838272][ T3637] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 29.854539][ T3637] ext4 filesystem being mounted at /4/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 29.946390][ T3659] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 29.959294][ T3659] bridge_slave_1: left allmulticast mode [ 29.965158][ T3659] bridge_slave_1: left promiscuous mode [ 29.970944][ T3659] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.981666][ T3659] bridge_slave_0: left allmulticast mode [ 29.987395][ T3659] bridge_slave_0: left promiscuous mode [ 29.993134][ T3659] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.122418][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 30.206844][ T3681] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 30.329149][ T3695] loop1: detected capacity change from 0 to 512 [ 30.337164][ T3695] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 30.357933][ T3695] EXT4-fs error (device loop1): ext4_orphan_get:1419: comm syz.1.89: bad orphan inode 15 [ 30.391598][ T3695] ext4_test_bit(bit=14, block=18) = 1 [ 30.397194][ T3695] is_bad_inode(inode)=0 [ 30.397203][ T3695] NEXT_ORPHAN(inode)=1023 [ 30.397210][ T3695] max_ino=32 [ 30.397216][ T3695] i_nlink=0 [ 30.398865][ T3695] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0009-000000000000 r/w without journal. Quota mode: none. [ 30.413118][ T3695] ext2 filesystem being mounted at /8/éq‰Y’3aK supports timestamps until 2038-01-19 (0x7fffffff) [ 30.591018][ T3726] IPv4: Oversized IP packet from 127.202.26.0 [ 30.646392][ T3732] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 30.687906][ T3732] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 30.715202][ T3736] capability: warning: `syz.2.106' uses deprecated v2 capabilities in a way that may be insecure [ 30.731091][ T3732] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 30.777973][ T3732] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 30.845725][ T3732] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.857908][ T3732] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.871209][ T3732] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.891165][ T3732] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.182351][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0009-000000000000. [ 31.201393][ T3762] loop1: detected capacity change from 0 to 512 [ 31.219660][ T3762] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.237651][ T3762] ext4 filesystem being mounted at /9/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.258605][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.357686][ T3771] loop4: detected capacity change from 0 to 1024 [ 31.368466][ T3771] EXT4-fs: inline encryption not supported [ 31.374867][ T3771] EXT4-fs: Ignoring removed bh option [ 31.391090][ T3771] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.417414][ T3306] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.448966][ T29] kauditd_printk_skb: 166 callbacks suppressed [ 31.448980][ T29] audit: type=1400 audit(1750239975.839:258): avc: denied { accept } for pid=3780 comm="syz.1.126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 31.475049][ T29] audit: type=1400 audit(1750239975.839:259): avc: denied { read } for pid=3780 comm="syz.1.126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 31.547074][ T29] audit: type=1400 audit(1750239975.939:260): avc: denied { read } for pid=3790 comm="syz.4.130" dev="nsfs" ino=4026532630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 31.574322][ T29] audit: type=1400 audit(1750239975.939:261): avc: denied { open } for pid=3790 comm="syz.4.130" path="net:[4026532630]" dev="nsfs" ino=4026532630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 31.617156][ T29] audit: type=1400 audit(1750239976.009:262): avc: denied { create } for pid=3790 comm="syz.4.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 31.617817][ T3791] smc: net device bond0 applied user defined pnetid SYZ0 [ 31.703582][ T3791] smc: net device bond0 erased user defined pnetid SYZ0 [ 31.795700][ T3792] mmap: syz.1.128 (3792) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 31.937925][ T3828] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3828 comm=syz.3.144 [ 31.958151][ T3827] __nla_validate_parse: 10 callbacks suppressed [ 31.958166][ T3827] netlink: 14528 bytes leftover after parsing attributes in process `syz.2.143'. [ 32.000109][ T3828] netlink: 8 bytes leftover after parsing attributes in process `syz.3.144'. [ 32.009021][ T3828] netlink: 28 bytes leftover after parsing attributes in process `syz.3.144'. [ 32.018210][ T29] audit: type=1400 audit(1750239976.389:263): avc: denied { mount } for pid=3831 comm="syz.0.146" name="/" dev="ramfs" ino=5464 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 32.047443][ T3828] vlan2: entered allmulticast mode [ 32.052611][ T3828] hsr0: entered allmulticast mode [ 32.057680][ T3828] hsr_slave_0: entered allmulticast mode [ 32.063475][ T3828] hsr_slave_1: entered allmulticast mode [ 32.070655][ T29] audit: type=1400 audit(1750239976.419:264): avc: denied { unmount } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 32.122175][ T29] audit: type=1326 audit(1750239976.509:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3838 comm="syz.3.150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f314780e929 code=0x7ffc0000 [ 32.145657][ T29] audit: type=1326 audit(1750239976.509:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3838 comm="syz.3.150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f314780e929 code=0x7ffc0000 [ 32.169219][ T29] audit: type=1326 audit(1750239976.509:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3838 comm="syz.3.150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f314780e929 code=0x7ffc0000 [ 32.206443][ T3845] loop0: detected capacity change from 0 to 512 [ 32.243904][ T3845] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 32.253954][ T3845] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 32.266381][ T3845] EXT4-fs error (device loop0): __ext4_get_inode_loc:4792: comm syz.0.151: Invalid inode table block 0 in block_group 0 [ 32.289147][ T3845] EXT4-fs (loop0): get root inode failed [ 32.294984][ T3845] EXT4-fs (loop0): mount failed [ 32.414038][ T3862] xt_hashlimit: size too large, truncated to 1048576 [ 33.239183][ T3876] loop3: detected capacity change from 0 to 2048 [ 33.421078][ T3845] Set syz1 is full, maxelem 65536 reached [ 33.477721][ T3876] loop3: p1 < > p3 [ 33.489448][ T3876] loop3: p3 size 134217728 extends beyond EOD, truncated [ 33.690845][ T3918] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4 sclass=netlink_route_socket pid=3918 comm=syz.3.175 [ 34.667341][ T3958] loop1: detected capacity change from 0 to 512 [ 34.692995][ T3958] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 34.706246][ T3958] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 34.806208][ T3958] EXT4-fs (loop1): 1 truncate cleaned up [ 34.812373][ T3958] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 34.862563][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.923465][ T3983] loop1: detected capacity change from 0 to 1024 [ 34.935755][ T3975] syz.3.198 (3975) used greatest stack depth: 10192 bytes left [ 34.950450][ T3983] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.054200][ T3983] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4113: comm syz.1.200: Allocating blocks 385-513 which overlap fs metadata [ 35.123523][ T3983] EXT4-fs (loop1): pa ffff888106a71150: logic 16, phys. 129, len 24 [ 35.131614][ T3983] EXT4-fs error (device loop1): ext4_mb_release_inode_pa:5364: group 0, free 0, pa_free 8 [ 35.167382][ T3983] syz.1.200 (3983) used greatest stack depth: 9576 bytes left [ 35.221082][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.287864][ T4008] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 35.306469][ T4010] loop3: detected capacity change from 0 to 1024 [ 35.330569][ T4010] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 35.357167][ T4010] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:4113: comm syz.3.211: Allocating blocks 497-513 which overlap fs metadata [ 35.399288][ T4009] EXT4-fs (loop3): pa ffff8881057b7460: logic 128, phys. 273, len 15 [ 35.407666][ T4009] EXT4-fs error (device loop3): ext4_mb_release_inode_pa:5364: group 0, free 0, pa_free 1 [ 35.460007][ T4023] loop2: detected capacity change from 0 to 1024 [ 35.475460][ T4023] EXT4-fs: Ignoring removed orlov option [ 35.495175][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.508116][ T4023] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.623297][ T4036] netlink: 'syz.3.220': attribute type 1 has an invalid length. [ 35.631015][ T4036] netlink: 224 bytes leftover after parsing attributes in process `syz.3.220'. [ 35.647904][ T4038] netlink: 4 bytes leftover after parsing attributes in process `syz.0.221'. [ 35.657668][ T4038] netlink: 12 bytes leftover after parsing attributes in process `syz.0.221'. [ 35.846627][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.228928][ T4047] Set syz1 is full, maxelem 65536 reached [ 36.373983][ T4102] netlink: 'syz.3.234': attribute type 10 has an invalid length. [ 36.381957][ T4102] netlink: 40 bytes leftover after parsing attributes in process `syz.3.234'. [ 36.412968][ T4102] dummy0: entered promiscuous mode [ 36.427587][ T4102] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 36.462177][ T4108] loop4: detected capacity change from 0 to 512 [ 36.463629][ T29] kauditd_printk_skb: 76 callbacks suppressed [ 36.463642][ T29] audit: type=1400 audit(1750239980.849:344): avc: denied { mount } for pid=4110 comm="syz.1.236" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 36.484674][ T4108] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 36.518215][ T29] audit: type=1400 audit(1750239980.899:345): avc: denied { unmount } for pid=3307 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 36.539351][ T4108] EXT4-fs (loop4): warning: mounting unchecked fs, running e2fsck is recommended [ 36.563259][ T4108] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.235: invalid indirect mapped block 4294967295 (level 1) [ 36.578949][ T4108] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.235: invalid indirect mapped block 4294967295 (level 1) [ 36.593103][ T4120] loop3: detected capacity change from 0 to 512 [ 36.593816][ T4108] EXT4-fs (loop4): 2 truncates cleaned up [ 36.614110][ T4108] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 36.635449][ T4120] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 36.649418][ T4120] ext4 filesystem being mounted at /54/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 36.659691][ T29] audit: type=1400 audit(1750239981.049:346): avc: denied { read } for pid=4126 comm="syz.1.238" name="ptp0" dev="devtmpfs" ino=246 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 36.682560][ T29] audit: type=1400 audit(1750239981.049:347): avc: denied { open } for pid=4126 comm="syz.1.238" path="/dev/ptp0" dev="devtmpfs" ino=246 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 36.731034][ T29] audit: type=1400 audit(1750239981.119:348): avc: denied { append } for pid=4119 comm="wg1" name="file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 36.839592][ T3306] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.859292][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.878512][ T29] audit: type=1326 audit(1750239981.269:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4163 comm="syz.2.240" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5c08ce929 code=0x7ffc0000 [ 36.901798][ T29] audit: type=1326 audit(1750239981.269:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4163 comm="syz.2.240" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7fd5c08ce929 code=0x7ffc0000 [ 36.925258][ T29] audit: type=1326 audit(1750239981.269:351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4163 comm="syz.2.240" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5c08ce929 code=0x7ffc0000 [ 36.948515][ T29] audit: type=1326 audit(1750239981.269:352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4163 comm="syz.2.240" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7fd5c08ce929 code=0x7ffc0000 [ 36.971651][ T29] audit: type=1326 audit(1750239981.269:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4163 comm="syz.2.240" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd5c08ce929 code=0x7ffc0000 [ 37.108394][ T4187] -1: renamed from syzkaller0 [ 37.391795][ T4215] SELinux: Context system_u:object_r:fsadm_exec_t:s0 is not valid (left unmapped). [ 37.529335][ T4225] pimreg: entered allmulticast mode [ 37.543107][ T4225] pimreg: left allmulticast mode [ 37.834991][ T4255] loop2: detected capacity change from 0 to 512 [ 37.852278][ T4255] EXT4-fs (loop2): too many log groups per flexible block group [ 37.860063][ T4255] EXT4-fs (loop2): failed to initialize mballoc (-12) [ 37.877210][ T4255] EXT4-fs (loop2): mount failed [ 38.062678][ T4330] netlink: 32 bytes leftover after parsing attributes in process `syz.0.284'. [ 38.071658][ T4330] netlink: 32 bytes leftover after parsing attributes in process `syz.0.284'. [ 38.206911][ T4336] loop3: detected capacity change from 0 to 8192 [ 38.940777][ T4359] loop3: detected capacity change from 0 to 128 [ 38.951916][ T4359] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000100) [ 38.959974][ T4359] FAT-fs (loop3): Filesystem has been set read-only [ 38.967674][ T4359] syz.3.294: attempt to access beyond end of device [ 38.967674][ T4359] loop3: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 38.981620][ T4359] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000100) [ 38.989607][ T4359] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000100) [ 39.006084][ T4359] syz.3.294: attempt to access beyond end of device [ 39.006084][ T4359] loop3: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 39.040835][ T4359] syz.3.294: attempt to access beyond end of device [ 39.040835][ T4359] loop3: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 39.079693][ T4369] netlink: 'syz.2.299': attribute type 4 has an invalid length. [ 39.129062][ T4369] netlink: 'syz.2.299': attribute type 4 has an invalid length. [ 39.427794][ T4390] loop1: detected capacity change from 0 to 2048 [ 39.496078][ T4390] loop1: p1 < > p4 [ 39.500418][ T4390] loop1: p4 size 8388608 extends beyond EOD, truncated [ 39.555549][ T4401] netlink: 4 bytes leftover after parsing attributes in process `syz.4.313'. [ 39.575890][ T4405] xt_hashlimit: max too large, truncated to 1048576 [ 39.576787][ T4403] ip6gre1: entered allmulticast mode [ 40.238663][ T4430] netlink: 20 bytes leftover after parsing attributes in process `syz.2.324'. [ 40.506885][ T4445] loop3: detected capacity change from 0 to 512 [ 40.542789][ T4447] wg2: entered promiscuous mode [ 40.547749][ T4447] wg2: entered allmulticast mode [ 40.575958][ T4445] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.647223][ T4454] netlink: 87 bytes leftover after parsing attributes in process `syz.1.335'. [ 40.871498][ T4465] 9pnet_fd: Insufficient options for proto=fd [ 40.911439][ T4469] netlink: 4 bytes leftover after parsing attributes in process `syz.2.341'. [ 41.031935][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.088303][ T4480] netlink: 197276 bytes leftover after parsing attributes in process `syz.3.343'. [ 41.192412][ T4486] syz.3.347 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 41.557517][ T29] kauditd_printk_skb: 152 callbacks suppressed [ 41.557531][ T29] audit: type=1400 audit(41.542:506): avc: denied { write } for pid=4511 comm="syz.1.358" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 41.664555][ T29] audit: type=1400 audit(41.542:507): avc: denied { open } for pid=4511 comm="syz.1.358" path="/50/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 41.685870][ T29] audit: type=1400 audit(41.572:508): avc: denied { setopt } for pid=4513 comm="syz.3.359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 41.704516][ T29] audit: type=1400 audit(41.622:509): avc: denied { read } for pid=4517 comm="syz.3.362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 41.789766][ T4527] netlink: 96 bytes leftover after parsing attributes in process `syz.3.365'. [ 41.819018][ T4530] netlink: 'syz.3.367': attribute type 10 has an invalid length. [ 41.833182][ T4530] batman_adv: batadv0: Adding interface: team0 [ 41.839560][ T4530] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 41.864801][ T4530] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 41.924483][ T4532] loop1: detected capacity change from 0 to 512 [ 41.935833][ T4532] EXT4-fs (loop1): orphan cleanup on readonly fs [ 41.962545][ T4532] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.368: bg 0: block 248: padding at end of block bitmap is not set [ 41.988916][ T4532] Quota error (device loop1): write_blk: dquota write failed [ 41.996610][ T4532] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 42.006568][ T4532] EXT4-fs error (device loop1): ext4_acquire_dquot:6933: comm syz.1.368: Failed to acquire dquot type 1 [ 42.006839][ T4542] netlink: 2564 bytes leftover after parsing attributes in process `syz.3.372'. [ 42.019686][ T4532] EXT4-fs (loop1): 1 truncate cleaned up [ 42.044606][ T4532] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 42.118018][ T29] audit: type=1400 audit(42.102:510): avc: denied { read } for pid=4541 comm="syz.3.372" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 42.138663][ T4532] EXT4-fs (loop1): warning: mounting fs with errors, running e2fsck is recommended [ 42.175683][ T4532] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 42.186271][ T4558] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.198600][ T4553] Quota error (device loop1): do_check_range: Getting block 1536 out of range 0-5 [ 42.228744][ T4532] syz.1.368 (4532) used greatest stack depth: 9304 bytes left [ 42.228744][ T29] audit: type=1400 audit(42.212:511): avc: denied { mount } for pid=4562 comm="syz.2.380" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 42.260909][ T29] audit: type=1400 audit(42.242:512): avc: denied { mounton } for pid=4562 comm="syz.2.380" path="/70/file0" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:devpts_t tclass=dir permissive=1 [ 42.287281][ T4558] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.304269][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.356756][ T4558] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.442760][ T4574] loop2: detected capacity change from 0 to 2048 [ 42.450087][ T4578] loop4: detected capacity change from 0 to 512 [ 42.458178][ T4578] EXT4-fs: inline encryption not supported [ 42.458814][ T4558] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.473926][ T4578] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 42.501040][ T4574] EXT4-fs (loop2): failed to initialize system zone (-117) [ 42.509800][ T4574] EXT4-fs (loop2): mount failed [ 42.573210][ T4583] netlink: 'syz.4.388': attribute type 16 has an invalid length. [ 42.581164][ T4583] netlink: 'syz.4.388': attribute type 17 has an invalid length. [ 42.595055][ T4583] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 42.620036][ T4558] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.633507][ T4558] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.660382][ T4558] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.669133][ T4585] netlink: 96 bytes leftover after parsing attributes in process `syz.4.389'. [ 42.686072][ T4558] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.128122][ T4621] netlink: 'syz.3.406': attribute type 10 has an invalid length. [ 43.135998][ T4621] netlink: 'syz.3.406': attribute type 19 has an invalid length. [ 43.143784][ T4621] netlink: 156 bytes leftover after parsing attributes in process `syz.3.406'. [ 43.217431][ T4623] wg2: entered promiscuous mode [ 43.222384][ T4623] wg2: entered allmulticast mode [ 43.324223][ T4632] loop2: detected capacity change from 0 to 1024 [ 43.349985][ T4632] EXT4-fs: Ignoring removed bh option [ 43.355497][ T4632] EXT4-fs: Ignoring removed nomblk_io_submit option [ 43.380134][ T4632] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.439916][ T4639] loop3: detected capacity change from 0 to 512 [ 43.447798][ T4639] EXT4-fs: inline encryption not supported [ 43.454085][ T4639] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 43.501215][ T4642] ip6gre1: entered allmulticast mode [ 43.648654][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.691218][ T4648] loop2: detected capacity change from 0 to 1024 [ 43.709606][ T4648] EXT4-fs: Ignoring removed orlov option [ 43.742128][ T4648] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.785721][ T4661] wg2: entered promiscuous mode [ 43.790643][ T4661] wg2: entered allmulticast mode [ 43.809753][ T4663] loop1: detected capacity change from 0 to 512 [ 43.833492][ T4663] EXT4-fs: Ignoring removed bh option [ 43.841289][ T4666] netlink: 24 bytes leftover after parsing attributes in process `syz.4.424'. [ 43.853943][ T4663] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 43.863139][ T4663] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 43.877705][ T4663] EXT4-fs (loop1): warning: mounting unchecked fs, running e2fsck is recommended [ 43.887454][ T4663] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 43.894747][ T4666] netlink: 4 bytes leftover after parsing attributes in process `syz.4.424'. [ 43.896888][ T4663] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 43.946624][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.004559][ T4671] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 44.011199][ T4671] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 44.018794][ T4671] vhci_hcd vhci_hcd.0: Device attached [ 44.039671][ T4671] netlink: 'syz.4.426': attribute type 4 has an invalid length. [ 44.068091][ T3311] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.081690][ T4672] vhci_hcd: connection closed [ 44.084693][ T4262] vhci_hcd: stop threads [ 44.093802][ T4262] vhci_hcd: release socket [ 44.098280][ T4262] vhci_hcd: disconnect device [ 44.556647][ T4696] loop1: detected capacity change from 0 to 1024 [ 44.576616][ T4696] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.618443][ T4696] EXT4-fs error (device loop1): mb_free_blocks:1948: group 0, inode 15: block 433:freeing already freed block (bit 27); block bitmap corrupt. [ 44.641565][ T4696] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 28 [ 44.653932][ T4696] EXT4-fs (loop1): This should not happen!! Data will be lost [ 44.653932][ T4696] [ 44.663684][ T4696] EXT4-fs (loop1): Total free blocks count 0 [ 44.669713][ T4696] EXT4-fs (loop1): Free/Dirty block details [ 44.675663][ T4696] EXT4-fs (loop1): free_blocks=16 [ 44.680712][ T4696] EXT4-fs (loop1): dirty_blocks=0 [ 44.685792][ T4696] EXT4-fs (loop1): Block reservation details [ 44.691813][ T4696] EXT4-fs (loop1): i_reserved_data_blocks=0 [ 44.715811][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.723538][ T4694] loop2: detected capacity change from 0 to 1024 [ 44.729503][ T4704] netlink: 'syz.0.438': attribute type 7 has an invalid length. [ 44.733320][ T4694] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 44.739439][ T4704] netlink: 8 bytes leftover after parsing attributes in process `syz.0.438'. [ 44.778126][ T4694] netlink: 32 bytes leftover after parsing attributes in process `syz.2.434'. [ 44.877808][ T4716] loop4: detected capacity change from 0 to 2048 [ 44.924800][ T4716] loop4: p1 < > p4 [ 44.930168][ T4716] loop4: p4 size 8388608 extends beyond EOD, truncated [ 44.988992][ T4718] netlink: 'syz.0.456': attribute type 13 has an invalid length. [ 45.002753][ T4722] netlink: 24 bytes leftover after parsing attributes in process `syz.2.446'. [ 45.013428][ T4718] gretap0: refused to change device tx_queue_len [ 45.019890][ T4718] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 45.038641][ T4721] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.063584][ T4722] netlink: 4 bytes leftover after parsing attributes in process `syz.2.446'. [ 45.097144][ T4721] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.183005][ T4721] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.254905][ T4721] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.312534][ T4721] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.323977][ T4721] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.336445][ T4721] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.349202][ T4721] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.669069][ T4758] gtp0: entered promiscuous mode [ 45.700845][ T4764] loop1: detected capacity change from 0 to 2048 [ 45.746892][ T4764] loop1: p1 < > p3 [ 45.751904][ T4764] loop1: p3 size 134217728 extends beyond EOD, truncated [ 45.781212][ T4770] netlink: 4 bytes leftover after parsing attributes in process `syz.2.464'. [ 45.804501][ T4770] bridge_slave_1: left allmulticast mode [ 45.810293][ T4770] bridge_slave_1: left promiscuous mode [ 45.816134][ T4770] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.846030][ T4770] bridge_slave_0: left allmulticast mode [ 45.851853][ T4770] bridge_slave_0: left promiscuous mode [ 45.857571][ T4770] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.969170][ T4776] loop1: detected capacity change from 0 to 1024 [ 45.976391][ T4776] EXT4-fs: Ignoring removed orlov option [ 45.983835][ T4776] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.010450][ T4781] loop2: detected capacity change from 0 to 128 [ 46.020261][ T4781] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 46.028162][ T4781] FAT-fs (loop2): Filesystem has been set read-only [ 46.034891][ T4781] syz.2.468: attempt to access beyond end of device [ 46.034891][ T4781] loop2: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 46.048591][ T4781] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 46.056887][ T4781] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 46.064886][ T4781] syz.2.468: attempt to access beyond end of device [ 46.064886][ T4781] loop2: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 46.078261][ T4781] syz.2.468: attempt to access beyond end of device [ 46.078261][ T4781] loop2: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 46.706265][ T4776] ================================================================== [ 46.714406][ T4776] BUG: KCSAN: data-race in filemap_splice_read / filemap_splice_read [ 46.722597][ T4776] [ 46.724929][ T4776] write to 0xffff88811869f9a8 of 8 bytes by task 4783 on cpu 1: [ 46.732563][ T4776] filemap_splice_read+0x47e/0x6b0 [ 46.737709][ T4776] ext4_file_splice_read+0x8f/0xb0 [ 46.742926][ T4776] splice_direct_to_actor+0x26c/0x680 [ 46.748327][ T4776] do_splice_direct+0xda/0x150 [ 46.753104][ T4776] do_sendfile+0x380/0x650 [ 46.757521][ T4776] __x64_sys_sendfile64+0x105/0x150 [ 46.762725][ T4776] x64_sys_call+0xb39/0x2fb0 [ 46.767330][ T4776] do_syscall_64+0xd2/0x200 [ 46.771887][ T4776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 46.777788][ T4776] [ 46.780114][ T4776] write to 0xffff88811869f9a8 of 8 bytes by task 4776 on cpu 0: [ 46.787748][ T4776] filemap_splice_read+0x47e/0x6b0 [ 46.793031][ T4776] ext4_file_splice_read+0x8f/0xb0 [ 46.798182][ T4776] splice_direct_to_actor+0x26c/0x680 [ 46.803575][ T4776] do_splice_direct+0xda/0x150 [ 46.808465][ T4776] do_sendfile+0x380/0x650 [ 46.812988][ T4776] __x64_sys_sendfile64+0x105/0x150 [ 46.818206][ T4776] x64_sys_call+0xb39/0x2fb0 [ 46.822823][ T4776] do_syscall_64+0xd2/0x200 [ 46.827343][ T4776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 46.833253][ T4776] [ 46.835585][ T4776] value changed: 0x0000000000001179 -> 0x000000000000117a [ 46.842785][ T4776] [ 46.845141][ T4776] Reported by Kernel Concurrency Sanitizer on: [ 46.851311][ T4776] CPU: 0 UID: 0 PID: 4776 Comm: syz.1.467 Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(voluntary) [ 46.863735][ T4776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 46.873819][ T4776] ================================================================== [ 47.084028][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.