last executing test programs: 6.368304195s ago: executing program 3 (id=127): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') syz_mount_image$ext4(&(0x7f0000001140)='ext4\x00', &(0x7f00000007c0)='./file1\x00', 0x410c84, &(0x7f0000000340), 0x1, 0x775, &(0x7f0000001180)="$eJzs3c9rXNUeAPDvnSRNm/a95MGD9+oqIGigdGJqbBVcVFyIYKGga9thMg01k0zJTEoTAlpEcCOouBB007U/6s6tP7b6X7gQS9W0WHEhkTu5t502M2mSJpnqfD5wM+fceyfnfOf+OGfmHu4NoGeNpn8KEYcj4t0kYjibn0TEQDPVH3Fybb1bK8vldEpidfXlX5LmOjdXlsvR8p7UwSzz/4j45q2II4X15dYXl2ZK1WplPsuPN2YvjNcXl46eny1NV6Yrc8cnJiePnXjqxPGdi/W375cOXXvvhcc/P/nHm/+7+s63SZyMQ9my1jh2ymiMZp/JQPoR3uX5nS6sy5JuV4BtSQ/NvrWjPA7HcPQ1UwDAP9nrEbEKAPSYRPsPAD0m/x3g5spyOZ+6+4vE3rr+XETsX4s/v765tqQ/u2a3v3kddOhmcteVkSQiRnag/NGI+PjLVz9Np9il65AA7bxxOSLOjoyuP/8n68YsbNUTGyzbl72O3jPf+Q/2zldp/+fpdv2/wu3+T7Tp/wy2OXa3477H/4EdKGQDaf/v2Zaxbbda4s+M9GW5fzX7fAPJufPVSnpu+3dEjMXAYJqf2KCMsRt/3ui0rLX/9+v7r32Slp++3lmj8FP/4N3vmSo1Sg8Sc6vrlyMe6W8Xf3J7+ycd+r+nN1nGi8+8/VGnZWn8abz5tD7+yEYn7Y7VKxGPtd3+d0a0JRuOTxxv7g7j+U7Rxhc/fDjUqfzW7Z9Oafn5d4G9kG7/oY3jH0lax2vWt17Gd1eGv+607P7xt9//9yWvNNN5P+JSqdGYn4jYl7y0fv6xO+/N8/n6afxjj7Y//jfa/9PvhGc3GX//tZ8/2378uyuNf2pL23/riau3Zvo6lb+57T/ZTI1lczZz/ttsBR/kswMAAAAAAAAAAAAAAAAAAAAAAACAzSpExKFICsXb6UKhWFx7hvd/Y6hQrdUbR87VFuamovms7JEYKOS3uhxuuR/qRHY//Dx/7J78kxHxn4j4YPBAkt9HcarLsQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA7mCH5/+nfhzsdu0AgF2zv9sVAAD2nPYfAHqP9h8Aeo/2HwB6j/YfAHqP9h8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBddvrUqXRa/X1luZzmpy4uLszULh6dqtRnirML5WK5Nn+hOF2rTVcrxXJt9n7/r1qrXZiMuYVL441KvTFeX1w6M1tbmGucOT9bmq6cqQzsSVQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsDX1xaWZUrVamZfYRmL14ahG9xN92e70sNRnTxPJw1GNHU50+cQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8DfxVwAAAP//02Ii/w==") r1 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r1, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x1001f0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) fallocate(r1, 0x3, 0x1000, 0x10000) pread64(r0, &(0x7f0000004180)=""/4096, 0x1000, 0x0) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r1, 0x6628) r2 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x0) pwritev2(r2, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x6700}], 0x1, 0x33000, 0x0, 0x0) 5.66766484s ago: executing program 3 (id=150): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000001040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r0}, 0x18) r1 = socket(0x10, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffdfe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000480)=@gcm_256={{0x303}, '\x00', "e123c5876ff425b1ebe2060000000f586058ff85b07ce696322bff00", "7e25837b", "5ce55765f1ae136f"}, 0x38) write$binfmt_script(r2, &(0x7f0000000500)={'#! ', './file0'}, 0xb) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd87}, &(0x7f0000000240)=0x40) writev(r2, &(0x7f0000000100)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1) close_range(r1, r2, 0x0) 5.259695157s ago: executing program 3 (id=156): openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xae, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7ffd}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x26) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r0}, 0x10) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0xa007ca, &(0x7f00000002c0)={[{@nojournal_checksum}, {@journal_dev={'journal_dev', 0x3d, 0xff}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x58}}, {@nouid32}, {@resgid}, {@acl}, {@init_itable_val={'init_itable', 0x3d, 0x8d55}}]}, 0x0, 0x483, &(0x7f0000001040)="$eJzs28tvVNUfAPDvvX0APx7tD/EBolaJSaOxpQWVhRuNJsZgNNEFLms7kIaBGlqNIJFiDG5MDImujUujf4E7Y2LUlYlb3bgyJETZALqpuXfuLdNpp1A6ZWrn80lue869Z+ac79zXuefMBNCxBrI/ScS2iPg1Ivpq2YUFBmr/rl05O379ytnxJObmXvszyctdvXJ2vCxavm5rkRlMI9IPk6KShaZPnzk+Vq1WThX54ZkTbw1Pnz7zxDsnxo5VjlVOjh46dPDAyNNPjT7ZkjizuK7ueX9q7+4X37j48viRi2/++HXW3m3F9vo4WmUgC/yvuVzd6vxjerTVlbXZ9rp00t3GhrAiXRGR7a6e/Pzvi664sfP64oUP2to4YE1l96ZNzTfPzgEbWBLtbgHQHuWNPnv+LZc71PVYFy4/W3sAyuK+Viy1Ld2RFmV6Gp5vW2kgIo7M/v15tsQajUMAANT7ePyzw70R8d71r17K+h5981vSuCf//3v+d0cxh9IfEf+PiJ0RcVdE7IqIuyPysvdGxH2rbM/i/k96aZVvuays//dMMbe1sP9X9v6iv6vIbc/j70mOTlYr+4vPZDB6NmX5kWXq+Pb5Xz5ptq2+/5ctWf1lX7Box6XuhgG6ibGZsbxT2gKXz0fs6V4q/mR+JiCJiN0RsWdlb72jTEw+9uXeZoVuHv8yWjDPNPdFFt5sFv9sNMRfSurnJycXzU8Ob45qZf9weVQs9tPPF15tVv9AzN1+/C1wuRL/xMLjv7FIf1I/Xzu98jou/PZR02ea2zz+097k9XyeubdY9+7YzMypkYje5HCeX7B+9MZry3xZPjv+B/ctff7vLF6TxX9/RGQH8QMR8WBEPFS0/eGIeCQi9i0T/w/PNd9Wxh9pm/b/+YiJJa9/88d/w/5feaLr+PffNKv/1vb/wTw1WKzJr383sVRzsstFYwNX89kBAADAf0Wafwc+SYfm02k6NFT7Dv+u+F9anZqeefzo1NsnJ2rfle+PnrQc6eorxkOrk9XKSDJbvGNtfHS0GCsux0sPFOPGn3ZtyfND41PViTbHDp1ua5PzP/NHV7tbB6yxLUuuHe294w0B2qBxHj1dmD33SrgYwEbl99rQuZqf/5tjcXcA2Ejc/6FzLXX+n2vImwuAjcn9HzqX8x86VPpdu1sAtJH7P3Sk1fyufw0Tm9dHM9qTWK87JU9ElIl0XbRHYqWJLbdWuN1XJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgNb4NwAA///Xm+pu") 4.855410164s ago: executing program 3 (id=176): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000000)=@framed={{}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r1}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2007, &(0x7f0000000980)=0x0) r4 = eventfd2(0x6, 0x800) io_getevents(r3, 0x1, 0x1, &(0x7f0000000180)=[{}], 0x0) io_submit(r3, 0x1, &(0x7f00000000c0)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x7, 0x0, r2, 0x0, 0x0, 0x40, 0x0, 0x3, r4}]) 4.624734575s ago: executing program 3 (id=186): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r0, &(0x7f00000016c0)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd52a44fec4f6f1a6f65158bb6911c295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd4829bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2971f29d9364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7d9f455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bccdf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b80d8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e807df4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48610ee39fb4171103df2e09d7cfdb0c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681a03007e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fb9bbcd92d47098ae27a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee4c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22f3bb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7c5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7f87030000000000008992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cf8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46070039116694765658bae64b312715a8216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a1626dffe49d0c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d5807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c949ca930e7a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4bc700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f00000013c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f0000000140)=0x40) 4.624391265s ago: executing program 3 (id=188): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000440)={0x1, &(0x7f0000000280)=[{0x6}]}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bind$bt_hci(r0, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB, @ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x18) r2 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xf) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000008da4b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r4}, 0xf) ioctl$TCFLSH(r3, 0x400455c8, 0x0) 3.239607142s ago: executing program 4 (id=237): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009e0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='sys_enter\x00', r1}, 0x18) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) mincore(&(0x7f0000197000/0x1000)=nil, 0x1000, &(0x7f0000001140)=""/172) 3.083723967s ago: executing program 4 (id=242): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x1000410, &(0x7f0000000100)={[{@grpid}, {@grpquota}]}, 0x4, 0x4f8, &(0x7f0000000bc0)="$eJzs3c9vVFsdAPDvnXZoX9/wylMWalQQUTSE6Q+gIbgQNhpDSIzElQuo7dA0nWGaTou0sihL9yaSuNI/wZ0LE1Yu3LnTnRtcmKASDTVxMebeubRDO9NWaDvQ+XyS23vPOdP5njPDOWfugeEE0LfORsR6RJyIiHsRMZrnJ/kRN1pH+rhXLx/PbLx8PJNEs3nnH0lWnuZF2++kPs6fczgifvDdiB8nO+M2VtcWpqvVylKeHluuLY41VtcuzRfynMmpianxa5evTh5YW8/UfvPiO/O3fvi7337p+R/Xv/nTtFqln53MytrbcZBaTS9GqS1vMCJuHUawHhnM//zw4Ul722ci4lzW/0djIHs3AYDjrNkcjeZoexoAOO7S+/9SJIVyvhZQikKhXG6t4Z2OkUK13li+OFpfeTAb2RrWqSgW7s9XK+P5WuGpKCZpeiK73kpPbktfjohPI+LnQx9l6fJMvTrbyw8+ANDHPt42//97qDX/AwDH3HCvKwAAHDnzPwD0H/M/APSf/2P+9+1AADgm3P8DQP8x/wNA/9lz/n9yNPUAAI7E92/fTo/mRv7/X88+XF35VunhpdlKY6FcW5kpz9SXFstz9fpctVKeaTb3er5qvb44cWUz2Vhdu1urrzxYvjtfm56r3K0UD7k9AMDePj3z7M9JRKxf/yg7om0vB3M1HG+FXlcA6JmBXlcA6Bnf54H+1eEef2jvhwDHSYctet/Q9Z8IPbX5K3yoLnze+j/0K+v/0L/ebv3/2wdeD+DoWf+H/tVsJvb8B4A+Y40feKe//wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA+VcqOpFDO9gJfT38WyuWIkxFxKorJ/flqZTwiPomIPw0Vh9L0RK8rDQC8o8Lfknz/rwuj50vbS08k/xnKzhHxk1/e+cWj6eXlpYk0/5+b+ctP8/zJE71oAADQ7sbOrNY8nZ/bbuRfvXw88/o4yiq+uNnaXDSNu5EfrZLBGMzOw1GMiJF/JXm6Jf28MnAA8defRMTnttr/qC1CKVsDae18uj1+GvvkIcTfev23xy+8Eb+QlaXnYvZafPYA6gL95tnN1jiZ9720i+X9rxBns3Pn/j+cjVDv7vX4t7Fj/Ctsjn8DO+InWZ8/u5nevSYvrvz+ezsym6OtsicRXxjsFD/ZjJ90GX/P77ONf/nil891K2v+KuJCdI7fUsuG2bHl2uJYY3Xt0nxteq4yV3kwOTk1MTV+7fLVybFsjbr18w+dYvz9+sVPusVP2z/SJf7wHu3/Wlszdmv/r/9770df2SX+N77a+f0/vUv8dE78+m5B20yP3Oi6fXcaf7ZL+/d6/y/uM/7zv67N7vOhAMARaKyuLUxXq5WlPS7Sz5odiyL28+su3uOLWI94D6rh4iAvXnfwt36e3o5LwOHb6vS9rgkAAAAAAAAAAAAAANBNY3VtYSgO99tIvW4jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAx9f/AgAA//8Bp8ue") mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x0) pwritev2(r2, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0xfffffdd6}], 0x1, 0x9c00, 0x0, 0x3) 2.974920917s ago: executing program 4 (id=243): r0 = syz_open_dev$loop(&(0x7f00000000c0), 0x9, 0x200) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000100)) ioctl$IOC_PR_RESERVE(r0, 0x401070c9, 0x0) 2.909016053s ago: executing program 4 (id=244): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000010850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000a80)='kfree\x00', r2, 0x0, 0x3}, 0x18) r3 = dup(r0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="640000000206030000000000fffff0000000000016000300686173683a6e65742c706f72742c6e6574000000050004000000000005000500020000000900020073797a3200000000050001000700000014000780080013400000000008001240"], 0x64}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000003060101000000003e0000000200000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x4) 2.855829947s ago: executing program 4 (id=245): syz_emit_ethernet(0x56, &(0x7f0000000580)={@broadcast, @link_local={0x17, 0x80, 0xc2, 0x6, 0x5}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "182325", 0x20, 0x2c, 0x0, @remote, @local, {[@routing={0x2b, 0x2, 0x2, 0x41, 0x0, [@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3b}}]}, @srh={0x73, 0x0, 0x4, 0x0, 0x4, 0x20, 0x800}]}}}}}, 0x0) syz_emit_ethernet(0x8e, &(0x7f00000021c0)={@multicast, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "0300", 0x58, 0x2c, 0xff, @remote, @local, {[@routing={0x6, 0xa, 0x2, 0x8, 0x0, [@ipv4={'\x00', '\xff\xff', @loopback}, @private1, @private1={0xfc, 0x1, '\x00', 0x1}, @private2, @private0]}]}}}}}, 0x0) 2.855690387s ago: executing program 4 (id=246): bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000efffffff850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='sys_enter\x00', r0}, 0x10) time(0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0xc, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e7c0a92dd701a07, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, 0x0, 0x4008840) syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a3"], 0x0) r1 = openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x138) r2 = socket$vsock_stream(0x28, 0x1, 0x0) listen(r2, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r4 = accept4(r2, 0x0, 0x0, 0x0) sendto(r4, &(0x7f0000000000)="00c881d76049ac562e4e5094890b55e5ea113389145c57e7b3479bf3f2cf8ac5d94a71e37b8bc9f4e71c8b097042535f04d39b07b6e29be0a2734c7332f8", 0x3e, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f00000001c0)=""/62, 0x3e, 0x10120, 0x0, 0x0) 1.893985196s ago: executing program 0 (id=270): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000002c0)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000001040)=@raw={'raw\x00', 0x3c1, 0x3, 0x360, 0x0, 0x12, 0x600, 0x1c0, 0x202, 0x290, 0x2e8, 0x2e8, 0x290, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth1_to_bond\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "0000000000000019b5115c2aee68d23a465cd431e150c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baeb8989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b500", 0x2}}, @common=@inet=@socket2={{0x28}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c0) 878.890149ms ago: executing program 0 (id=276): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB="02000000040000000500"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 878.771469ms ago: executing program 0 (id=277): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8ff20c2c10f0093d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000540)={{r0}, &(0x7f0000000500), &(0x7f00000002c0)='%+9llu \x00'}, 0x20) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="0b00000073790101000000000000000000000000000af7f4f0c55de8ca0000000000000000000000000000000000000000f3c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00000000000000000000000000000020000000000000030000000000000000000000004119202532aeecfcdbb73887feb3"], 0x138) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000f00)='kfree\x00', r2, 0x0, 0x4}, 0x18) write$UHID_DESTROY(r1, &(0x7f0000000340), 0x4) 647.72266ms ago: executing program 0 (id=281): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x3, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) r2 = epoll_create1(0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_usb_connect(0x6, 0x24, &(0x7f0000000a00)={{0x12, 0x1, 0x110, 0x69, 0xad, 0x98, 0xdf, 0x1b3d, 0x16f, 0xacd0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x5, 0x6, 0x30, 0x0, [{{0x9, 0x4, 0xe1, 0x81, 0x0, 0xe3, 0x5b, 0x31, 0x9}}]}}]}}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 621.734303ms ago: executing program 2 (id=285): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000b28000)=0x3) fcntl$setsig(r1, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r2}], 0x2c, 0xffffffffffbffff8) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000015c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000010000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) dup2(r1, r2) fcntl$setown(r1, 0x8, r0) tkill(r0, 0x13) bpf$PROG_LOAD(0x5, 0x0, 0x0) nanosleep(&(0x7f0000000300), 0x0) 478.369395ms ago: executing program 2 (id=291): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kmem_cache_free\x00', r1}, 0x18) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x14, 0x453, 0x4, 0x70bd2b, 0x25dfdbfb, "c241"}, 0x14}, 0x1, 0x0, 0x0, 0x40004}, 0x80) 470.903956ms ago: executing program 2 (id=293): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020100030a0000000000000000000000030006002b20000002004e24ac1414aa0000000000000000030005000000000002000a01000000000000000000000000020013"], 0x50}, 0x1, 0x7}, 0x20000000) 399.769023ms ago: executing program 2 (id=295): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x3, &(0x7f0000000600)=@framed, &(0x7f0000000300)='GPL\x00', 0x8, 0xff8, &(0x7f0000001e00)=""/4088}, 0x94) 399.529203ms ago: executing program 2 (id=297): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000280)={0x1, &(0x7f0000000780)=[{0x200000000006, 0xf, 0x6, 0x7ffc1ffb}]}) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001000)={&(0x7f0000000140)='kmem_cache_free\x00', r0, 0x0, 0x2}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) process_mrelease(0xffffffffffffffff, 0x0) 396.641563ms ago: executing program 2 (id=298): r0 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000181100", @ANYRES32, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x37e2f4aba9289b81, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000040)={r0}, &(0x7f0000000680)={'enc=', 'oaep', ' hash=', {'sha224-generic\x00'}}, &(0x7f0000001080), &(0x7f0000000240)) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$ITER_CREATE(0x21, 0x0, 0x0) recvfrom$unix(r2, 0x0, 0x0, 0x40000000, &(0x7f0000000840)=@file={0x0, './file0\x00'}, 0x6e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1, 0x0, 0x3}, 0x18) r3 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x553, &(0x7f0000001ac0)=ANY=[@ANYBLOB="12010003b006bf10fd0b0b00464e010203010902410501000220960904038e0bb74dd60d09210800000122a90d09050502200009050109050b032000240905cb0510e0f3acac2abb5457d2771ea07b20c0b19150cec49109cd51578f98753ea3ee30f78fe898342410896a9f688bab2ee2cdf8c3217507b407df5a61cd21f39c3a112584f4cb8cbaddeee4b4eb07b55e7a633ef497d4726f43d08a767b772424fa59b3674ba46a17495b39b340f5e37e51d22355cba0b633fdd847353dcaa98bdf0954f8eb862f98775aae2dac30b400c69c60a369b13ac298d0d2d5f09a60f5a061cc7489d2c98962b013a99d5a707baf326906c4c9c1e3016faa03bf8ae7456dba0dc2dcbff546598609050700100007070007250100ff070009050a004000200b0209050b001000e0ff12090506020800080e020725010101ff7fbc30c16ee1031b08dd774e3c3c3982afde675969255cfb2639e8bc8f0c1804120f1d93a598705eb02c2f17521308555765e15d07dd00705c97a9c2a219dc9b43678cfb631dd70fcde9846719932d144f4a324978ae9134f31d735f1991895ee69a7affbbacd8558d0e1d3f72d82718dd79945cc23c0c21ebb43a6bf861c5596dda3b29103ebc7e9004fbf8d716a979e8fb3ee095acdcb5a742cbf79eb5292bb154ffc7e9de7dd52f66870b0c2e33f85ef98c880c926782e3d7fc9caf0905ed1010007a0506f20b7ec0532fb001790ab791e567af14c94d5f7c92cc73a4458773957b4d5c3aac1724906a9ba8c109e096295de147d302c7ff12d0331398c61083614dc2ec4e47f305970729f4ea5b5ec34314f75f74dc3f8741d382843520fba40df1f73a0c50e912655763af512f7d35125dad25bae20420881731c2353428d231dc884e038b282df6ff635749e813154d8f61a61cd745a8468ce1a985faa36e0b4f81c70a26c410c203a9828f1eeca5baf9962b42cad58905df1e4a048dcec26179598d91989951115b0e1eae0795b882b799d6b51389af2f4c37e2f24347005288ba43bd3af412a8cdbf3f3c51ed3251bd3c39805b7f09050c0210000c090907250100ff0006f930c92b4e8a7013bde6b7a8af1da986b56605334cfdb58074b712e85bf30b8146fbe749f44e3b29c14909c3fb3f936f5c9eeb9fff9b55d03cc9c49b43d4841b5f7dfa229a97b584b1b5c094fd7cc89fcc554f0ec502a017777b51e523a31f0f3a8371650bb38b67b65cf44e89f2269d400678202d52a170c3b07cde19a43d0dd99c4db77761a7e6a9682da211335f412b52c10582553dfdb73d2ef26115ad07cf6ca761f076c9a4bfda1047e2464f2b920d202641e19e3351b4ce368784d946ff31b61f276b6534d81afc301fc9b9747aa74a4ff7aa2a1774a96bbe6c54a2fc3920c13cae26b01d11305b5a2f0625f02da12fe0e08d8072cd09050d030004070501090509080800000006bf23f095e967557c85664b69998929412e10472861e6f0909de8f3f031c8d950fe982489a9adec786ba74974193f7b64b657b7b8d54a06d2b2cea0daafa9628c56b3e611f99ecabb3525b1154d0337bdb19b28722ed4405aa86e9bb336927b93fa75e3b070a887d3622f7bf7e0bb5db60992d7e33bf83fd83d79c5cc2fe8080746459d9814a5226eb5a387bb0a975d15c2682d5e40a29fc26fa932705a9c2abe34c94b4992664d05488ed66de24a33719d8a9e"], &(0x7f0000001000)={0xa, &(0x7f0000000400)={0xa, 0x6, 0x201, 0x7, 0x3, 0x3, 0x40}, 0x88, &(0x7f0000000e40)={0x5, 0xf, 0x88, 0x4, [@generic={0x1a, 0x10, 0x4, "76b9ff7606fb8d5a1623168fdbd9883f3cf2940a779b53"}, @generic={0x31, 0x10, 0x1, "95874b926e143169d4997fac731dc7f263b3056ab7e218e99b9336acb5ea558df3aece528332f1dc8a8d6d3b8b51"}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "f40d46aef0eaf84ad87a25ea4dac669e"}, @ssp_cap={0x24, 0x10, 0xa, 0xfa, 0x6, 0x1, 0xff00, 0x4, [0x0, 0xff0000, 0xff0000, 0xc000, 0x30, 0xc000]}]}, 0x6, [{0x49, &(0x7f0000000f00)=@string={0x49, 0x3, "96959cb2056d019b1ee9eb838288bb800caa0560c330a2f58e760853cd8ad95e186ee1b994c4e54e241542482510344cbe5df23822f41f786031ee9657d811e1775c6e7f10182c"}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0xf4ff}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x2009}}, {0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x402}}, {0x4, &(0x7f0000000f80)=@lang_id={0x4, 0x3, 0x80a}}, {0x4, &(0x7f0000000fc0)=@lang_id={0x4, 0x3, 0xf8ff}}]}) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x3}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4000c00) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{}, &(0x7f0000000000), &(0x7f00000005c0)=r5}, 0x20) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001340)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0x70bd2d, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x0, 0x300}, 0x93}, [{0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x0, 0x0, 0x0, 0x3000000, 0x40000000}, {0x1, 0x0, 0x0, 0x4000000, 0x7, 0x80000}, {0x8000, 0x5, 0x0, 0xfffffffc, 0x5}, {0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x800000, 0x0, 0x6}, {0x0, 0xc3}, {0x0, 0x5}, {0x5}, {}, {0x0, 0x10}, {0x0, 0x470a, 0x0, 0x8000000}, {}, {0x2, 0x0, 0x0, 0x0, 0x6, 0x6}, {}, {}, {0x0, 0x0, 0x0, 0x1, 0x0, 0xfff}, {0x0, 0x0, 0x0, 0x8000000}, {}, {0x0, 0x0, 0x0, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {}, {0x0, 0x0, 0x0, 0xfffffffc}, {0x20000}, {}, {0x0, 0x7, 0x0, 0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x3}, {0x0, 0x8000, 0x0, 0x0, 0x5}, {0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x60569add}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2b25}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0xffffffff, 0x9}, {0x0, 0x0, 0x0, 0x0, 0xfffff800}, {0x3}, {}, {0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0xfffffffd}, {}, {0x0, 0x9, 0x0, 0xffffffff, 0x0, 0x2}, {}, {0x80}, {0x80}, {0x0, 0x0, 0x0, 0x5, 0x5}, {}, {0x0, 0x0, 0x8}, {0x0, 0x2, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x8, 0x0, 0x3}, {}, {0x0, 0x5}, {0x0, 0x0, 0x0, 0x8510}, {0xffff}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0xfffefffd}, {0x0, 0x0, 0x0, 0x1}, {}, {0x5}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, {0x0, 0x7}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, {0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x9}, {0x0, 0xfffffffc, 0x200}, {0x0, 0x0, 0x0, 0x200}, {}, {0x4}, {}, {0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x101, 0x0, 0x0, 0x0, 0xffffffff}, {}, {0x3, 0xfffffffe}, {0x0, 0x0, 0x0, 0x4, 0x9}, {}, {0x0, 0x0, 0x0, 0x0, 0x1, 0x7}, {0x0, 0xb}, {0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x1}, {}, {0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x56}, {0x0, 0x0, 0x0, 0xec33, 0x0, 0x4}, {}, {0xb, 0x0, 0x0, 0x0, 0x0, 0xfe1}, {0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0xff7ffffc}, {}, {0x0, 0xfffffffd}, {0x6}, {0x7f}, {}, {0x0, 0x8, 0x0, 0x0, 0xfffffffe}, {0x4, 0x2, 0x2000000, 0x2, 0x0, 0xfffffffe}, {0x0, 0x0, 0x0, 0x0, 0xe9d, 0x58a}, {0x2}, {0x2, 0x9, 0x20000000}, {0xfffffffc}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x292}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0xe600, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, {0x0, 0x5, 0x0, 0x7, 0x1}, {0x0, 0x5, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x80}, {0x10000000, 0x0, 0x0, 0x0, 0x1, 0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0x3}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {}, {}, {0xfffffffb, 0x0, 0x0, 0x0, 0x8000}, {0x6, 0xffffffff, 0x0, 0x0, 0x0, 0xfffffffe}, {0x2d, 0x0, 0x10000}, {0x0, 0x0, 0x8000}, {0x0, 0x8000, 0x0, 0xe}, {0x3, 0x0, 0x10000, 0x0, 0xffffffff}, {0x0, 0x80000000, 0x0, 0x7fff800, 0x4}, {0x0, 0x3}, {0xffffffff, 0x0, 0x0, 0x0, 0xd}], [{}, {}, {0x0, 0x1}, {0x1}, {}, {0x3}, {}, {0x0, 0x1}, {}, {}, {0x2}, {}, {}, {}, {0x0, 0x1}, {}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5, 0x1}, {0x0, 0x1}, {0x4}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {0x4}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x1}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x0, 0x1}, {0x2}, {0x5}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {0x1}, {}, {0x5}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x2, 0x1}, {}, {}, {}, {}, {0x5, 0x1}, {}, {0x1}, {}, {0x2}, {}, {}, {0x4}, {0x3}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000300)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@uname={'uname', 0x3d, '\xd0\xae\xde\xc1\xaa \xff\xd8\x1d\x1b\xf8\x93)!|\xb0X\xa3\x96\xed\xa2\xab@\xa2m\x93\xdd\b<\x00t\xdc\xabl\xab!\xae\x16\xc4\xcd\xf9{\xdc5_;A\xd2{eC\x014\\\xb3\xc4\xce\xc3yS2-\x01\xbe\xaarW\x96O\xd3\x0f\xe2\xd7/\x17\x1d\xa7.8\x9f8-\xea<\x8d\x91\x90j\xea\xd5\xd5\xae\xcc\xc0\x97\xef\x10\x92\xea\x98|+\x00\x00\x00\x00\x00\x00\x00\x00'}}]}}) ptrace(0x10, r7) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000200)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) ptrace(0x11, r7) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r6, 0x8983, &(0x7f0000000000)={0x0, 'geneve0\x00', {0x2}}) 171.546314ms ago: executing program 1 (id=302): io_setup(0xffff, &(0x7f0000002e40)) 153.641416ms ago: executing program 0 (id=303): syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000001240)='./file0\x00', 0x10, &(0x7f0000000a80)=ANY=[@ANYBLOB="00e789da34e04a1ffbc2f05cefeb4ee6d5ae1071124b2c2fb684f5c7ac05000000c7880f67e775c748f6381a3e01e7f93330b30b90bbb4d2b697899a16f2df4fa2a8f06ac2c5352ddcae2b83672ef3d9f532e55f4e798924ac6332751e737383f6890d2dcfcbdbd41940a64c7b4374674e7bb6dd0d1b8d3d62f6d77b0282e166e2ce4c353d2d4d315a81146bf46a1508ef0d2ddc7d0b447fe17b85b292d13cea2256a16cab12d75a852bc680da7ea837480feb2e0500001e0000000000003bc18c52d0351cd285197b0641569048b5b416ba1c570000000000100083794afff0a9eed63b1226b18c4b455ab222d7ae1be52a22e8ec8bf2c0c7d99770415863f50aa18bcb66061a29bc55105f3482ed752f882d224a386b51836c1b437036b677156e22e174ff516dbab0b2cdf52bee43c4ffffffffffffffffd9487b8663a339b98df63b4bf3e97f02d6f1e7e65f968dd90841506355d9ac40f1b434c8a9b5bd91a70c53a5aadbebd9ed9d0a55bd47a967163e0c02753f8895bfbf1b41b5490667c241068d59983ae1d0f03e650f5357425284b76d793e25a2558fa437e38b8200000000630000000000000000000000000000000000000000000000e911000000000066e073c14bb74617079e0b6ecfc830db14244567fd8f4e4e5903eaf983786e28295783f130b95dc37f59a658000e88047db7783ce8a9cba6c255902cfb83946ea3f5f7a8cee911b2b37ae4b01e65ea86d5ea7ae17b2a9bc250c9b8fc9fbc04617939bdd13457954172d18701768f8a461bee740f2d82ae566d2e30a93ad2b201a6d16a93c75a950cc437e7f25d3aadddb8edd028d84490b6bafd636aa4fb482a8a4b3987dafe58e742448c4b36b03790090198145dee533257bb9050554f8cace210a5bc5c768f83e99019f7c00ff9ca679768dbba3f7d21c545c99c2f7688f7030fe37121d625d1f81018feb74c9d48eebdf1702550b097271ab9bd38c62f4b31fd9482c05ba0", @ANYRES16], 0x1, 0x11dc, &(0x7f0000001280)="$eJzs3MGLG1UcB/Bf19rW1N2sWqstiA+96GVo9uBFL0G2IA0obSO0gjB1JxoyJiETFiJi9eTVv0M8ehPEm1724t/gbS8eexBHTNR2l3hYdDewfD6X/OD3vuQ9BgbeMG/23/jq40Gvynr5NNbOnIm1cUR6kCLFWvzt83j19R9/euHWnbs32p3O9s2Urrdvt15LKW28+P17n37z0g/Ti+9+u/Hd+djbfH//161f9i7vXdn//fZH/Sr1qzQcTVOe7o1G0/xeWaSdfjXIUnqnLPKqSP1hVUwO9HvlaDyepXy4s94YT4qqSvlwlgbFLE1HaTqZpfzDvD9MWZal9UbwX3S/flDXdURdPx7noq7r+oloxMV4MtZjI5qxGU/F0/FMXIpn43I8F8/HlfmoVc8bAAAAAAAAAAAAAAAAAAAAThfn/wEAAAAAAAAAAAAAAAAAAGD1bt25e6Pd6WzfTOlCRPnlbne3u/hd9Nu96EcZRVyLZvwW89P/C4v6+lud7WtpbjO+KO//lb+/233sYL41/5zA0nxrkU8H8+ej8Wh+K5pxaXl+a2n+Qrzy8iP5LJrx8wcxijJ24s/sw/xnrZTefLtzKH91Pg4AAABOgyz9Y+n+Pcv+rb/IH+H5wKH99dm4ena1ayeimn0yyMuymBxbcS6O/S8UCsX/XKz6zsRJeHjRVz0TAAAAAAAAAAAAjuIkXidc9RoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA/2IFjAQAAAABh/tZpdGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBVAAAA//8xgdSv") r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00"/13, @ANYBLOB], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xf, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00', r1}, 0x10) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x143042, 0x0) pwritev2(r2, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5405, 0x0, 0x0) 81.296582ms ago: executing program 1 (id=304): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000000)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10010000, 0x1, 0x20000008}, 0x1c) 19.806757ms ago: executing program 1 (id=305): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="31830000000000000000190000002000018014000200", @ANYRESDEC], 0x34}, 0x1, 0x0, 0x0, 0x8800}, 0x40010) 19.671968ms ago: executing program 1 (id=306): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000002c0000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x60, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x18) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="0500"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\a'], 0x48}}, 0x0) 19.552137ms ago: executing program 1 (id=307): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], 0x0, 0xfff, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xcb3a}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r0, 0x0, 0xfffffffffffffffc}, 0x18) unshare(0x20060400) syz_clone(0x6a000000, 0x0, 0x0, 0x0, 0x0, 0x0) 8.407719ms ago: executing program 0 (id=308): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f0000000080)='kmem_cache_free\x00', r1, 0x0, 0x100000000}, 0x18) truncate(&(0x7f0000000000)='./bus\x00', 0x9471) 0s ago: executing program 1 (id=309): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x18, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000ac0000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000004000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x62, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x18) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x13) ioctl$TCSETSW2(r2, 0x402c542c, &(0x7f00000000c0)={0xfffffff8, 0x0, 0xfffbfffd, 0x982, 0x47, "0441920887e8d2b791f19dd026d76d7fcb3678", 0x4, 0x200}) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000180)=0x4) 0s ago: executing program 0 (id=311): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {}, {0x8, 0xa}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x10001, 0x3, 0xfffffffc, 0x8}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x1, 0x1}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.126' (ED25519) to the list of known hosts. [ 20.623109][ T24] audit: type=1400 audit(1767269936.020:64): avc: denied { mounton } for pid=267 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.624426][ T267] cgroup: Unknown subsys name 'net' [ 20.645910][ T24] audit: type=1400 audit(1767269936.020:65): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.673309][ T24] audit: type=1400 audit(1767269936.050:66): avc: denied { unmount } for pid=267 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.673575][ T267] cgroup: Unknown subsys name 'devices' [ 20.872009][ T267] cgroup: Unknown subsys name 'hugetlb' [ 20.877761][ T267] cgroup: Unknown subsys name 'rlimit' [ 21.052453][ T24] audit: type=1400 audit(1767269936.450:67): avc: denied { setattr } for pid=267 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.075691][ T24] audit: type=1400 audit(1767269936.450:68): avc: denied { mounton } for pid=267 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.086293][ T269] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.100693][ T24] audit: type=1400 audit(1767269936.450:69): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.132435][ T24] audit: type=1400 audit(1767269936.500:70): avc: denied { relabelto } for pid=269 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.157940][ T24] audit: type=1400 audit(1767269936.500:71): avc: denied { write } for pid=269 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.158303][ T267] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.183573][ T24] audit: type=1400 audit(1767269936.530:72): avc: denied { read } for pid=267 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.218021][ T24] audit: type=1400 audit(1767269936.530:73): avc: denied { open } for pid=267 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.885712][ T275] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.892879][ T275] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.900902][ T275] device bridge_slave_0 entered promiscuous mode [ 22.910195][ T277] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.917235][ T277] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.924950][ T277] device bridge_slave_0 entered promiscuous mode [ 22.932066][ T277] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.939100][ T277] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.946760][ T277] device bridge_slave_1 entered promiscuous mode [ 22.953399][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.960594][ T275] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.968049][ T275] device bridge_slave_1 entered promiscuous mode [ 23.006263][ T276] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.013341][ T276] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.020902][ T276] device bridge_slave_0 entered promiscuous mode [ 23.046938][ T276] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.054070][ T276] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.061598][ T276] device bridge_slave_1 entered promiscuous mode [ 23.072971][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.080132][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.087540][ T279] device bridge_slave_0 entered promiscuous mode [ 23.096689][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.103832][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.111276][ T279] device bridge_slave_1 entered promiscuous mode [ 23.175679][ T278] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.182812][ T278] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.190402][ T278] device bridge_slave_0 entered promiscuous mode [ 23.197274][ T278] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.204568][ T278] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.212041][ T278] device bridge_slave_1 entered promiscuous mode [ 23.292906][ T277] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.299997][ T277] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.307265][ T277] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.314422][ T277] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.343823][ T276] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.351248][ T276] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.358510][ T276] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.365580][ T276] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.390517][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.397675][ T275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.404965][ T275] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.412273][ T275] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.425758][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.432923][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.440243][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.447274][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.472938][ T278] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.480025][ T278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.487406][ T278] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.494464][ T278] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.515540][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.523421][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.530808][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.537979][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.545655][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.553343][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.560724][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.567897][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.575508][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.582729][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.590475][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.597925][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.606799][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.615133][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.622183][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.645631][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.653601][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.661694][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.669875][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.676936][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.685056][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.693831][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.701172][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.708647][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.716967][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.724025][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.731491][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.739877][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.747129][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.754624][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.762955][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.769997][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.796243][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.804876][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.813896][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.822648][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.830745][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.838979][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.846111][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.853468][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.861860][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.868940][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.882836][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.890337][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.908858][ T275] device veth0_vlan entered promiscuous mode [ 23.916774][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.924967][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.935114][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.943599][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.952714][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.960914][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.968937][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.977194][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.985199][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.993209][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.001438][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.009515][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.017695][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.025316][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.040276][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.048513][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.056741][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.065286][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.073556][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.080601][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.088040][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.096442][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.104677][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.111728][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.126698][ T275] device veth1_macvtap entered promiscuous mode [ 24.136799][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.145442][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.154309][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.168383][ T279] device veth0_vlan entered promiscuous mode [ 24.175917][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.184333][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.193028][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.201215][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.209248][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.216779][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.225172][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.233639][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.254029][ T276] device veth0_vlan entered promiscuous mode [ 24.260584][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.268943][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.278129][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.287085][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.295491][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.303538][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.311674][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.319828][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.328343][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.336443][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.344740][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.352453][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.370643][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.379096][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.388118][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.397098][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.416511][ T276] device veth1_macvtap entered promiscuous mode [ 24.425066][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.433162][ T275] request_module fs-gadgetfs succeeded, but still no fs? [ 24.433852][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.449214][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.459381][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.467651][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.476150][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.484477][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.494918][ T275] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.506718][ T278] device veth0_vlan entered promiscuous mode [ 24.524590][ T277] device veth0_vlan entered promiscuous mode [ 24.531616][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.539296][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.547008][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.555121][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.563773][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.572345][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.581686][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.590387][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.598871][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.607506][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.617884][ T279] device veth1_macvtap entered promiscuous mode [ 24.628244][ T278] device veth1_macvtap entered promiscuous mode [ 24.642240][ T277] device veth1_macvtap entered promiscuous mode [ 24.651957][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.661109][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.662983][ T307] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.669731][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.694431][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.725804][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.735115][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.743924][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.753337][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.762261][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.770947][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.779738][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.788674][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.797917][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.807011][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.815958][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.824537][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.937302][ T319] APIC base relocation is unsupported by KVM [ 25.343856][ T366] SELinux: failed to load policy [ 25.414575][ T368] EXT4-fs (loop3): Mount option "journal_path=./bus" incompatible with ext2 [ 25.543777][ T309] hid-generic 0000:3000000:0000.0001: unknown main item tag 0x4 [ 25.552183][ T309] hid-generic 0000:3000000:0000.0001: unknown main item tag 0x2 [ 25.560657][ T309] hid-generic 0000:3000000:0000.0001: unknown main item tag 0x3 [ 25.570415][ T309] hid-generic 0000:3000000:0000.0001: hidraw0: HID v0.00 Device [sy] on syz0 [ 25.630767][ T24] kauditd_printk_skb: 512 callbacks suppressed [ 25.630780][ T24] audit: type=1326 audit(1767269941.030:586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=327 comm="syz.0.12" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fbeae9bc005 code=0x7ffc0000 [ 25.630835][ T400] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17 sclass=netlink_audit_socket pid=400 comm=syz.1.44 [ 25.638309][ T24] audit: type=1326 audit(1767269941.030:587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=327 comm="syz.0.12" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fbeae9bc005 code=0x7ffc0000 [ 25.721572][ T24] audit: type=1326 audit(1767269941.030:588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=327 comm="syz.0.12" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fbeae9bc005 code=0x7ffc0000 [ 25.748724][ T403] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 25.773535][ T24] audit: type=1400 audit(1767269941.080:589): avc: denied { audit_write } for pid=399 comm="syz.1.44" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 25.789527][ T405] fido_id[405]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 25.812029][ T24] audit: type=1107 audit(1767269941.080:590): pid=399 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 25.826835][ T24] audit: type=1326 audit(1767269941.090:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=327 comm="syz.0.12" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fbeae9bc005 code=0x7ffc0000 [ 25.850834][ T24] audit: type=1326 audit(1767269941.090:592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=327 comm="syz.0.12" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fbeae9bc005 code=0x7ffc0000 [ 25.874034][ T24] audit: type=1326 audit(1767269941.100:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=327 comm="syz.0.12" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fbeae9bc005 code=0x7ffc0000 [ 25.900938][ T24] audit: type=1326 audit(1767269941.100:594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=327 comm="syz.0.12" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fbeae9bc005 code=0x7ffc0000 [ 25.925720][ T24] audit: type=1326 audit(1767269941.100:595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=327 comm="syz.0.12" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fbeae9bc005 code=0x7ffc0000 [ 26.117887][ T431] netlink: 16 bytes leftover after parsing attributes in process `syz.1.57'. [ 26.143396][ T431] netlink: 4 bytes leftover after parsing attributes in process `syz.1.57'. [ 26.155860][ T437] serio: Serial port ttyS3 [ 26.241753][ T448] ====================================================== [ 26.241753][ T448] WARNING: the mand mount option is being deprecated and [ 26.241753][ T448] will be removed in v5.15! [ 26.241753][ T448] ====================================================== [ 26.340604][ T448] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 26.358631][ T448] ext4 filesystem being mounted at /19/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 26.424579][ T458] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouid32,nodioread_nolock,noquota,auto_da_alloc,journal_dev=0x0000000000000009,lazytime,,errors=continue [ 26.445760][ T458] ext4 filesystem being mounted at /8/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 26.501639][ T480] hub 8-0:1.0: USB hub found [ 26.509632][ T480] hub 8-0:1.0: 1 port detected [ 26.560867][ T487] netlink: 'wޣ': attribute type 13 has an invalid length. [ 26.592261][ T487] gretap0: refused to change device tx_queue_len [ 26.598930][ T487] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 26.620483][ T498] hub 9-0:1.0: USB hub found [ 26.632857][ T498] hub 9-0:1.0: 1 port detected [ 26.677134][ T510] tipc: Started in network mode [ 26.678792][ T497] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 26.682640][ T510] tipc: Own node identity 4, cluster identity 4711 [ 26.698234][ T510] tipc: 32-bit node address hash set to 4 [ 26.746412][ T506] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=8856c01c, mo2=0002] [ 26.758963][ T506] EXT4-fs (loop2): orphan cleanup on readonly fs [ 26.767037][ T506] EXT4-fs warning (device loop2): ext4_enable_quotas:6489: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 26.782475][ T506] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 26.789321][ T506] EXT4-fs error (device loop2): ext4_ext_check_inode:500: inode #13: comm syz.2.86: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 26.807749][ T506] EXT4-fs error (device loop2): ext4_orphan_get:1400: comm syz.2.86: couldn't read orphan inode 13 (err -117) [ 26.819818][ T506] EXT4-fs (loop2): mounted filesystem without journal. Opts: sysvgroups,noblock_validity,min_batch_time=0x000000000000082f,grpquota,debug,journal_dev=0x0000000000000001,grpid,inode_readahead_blks=0x0000000000002000,,errors=continue [ 26.892355][ T506] EXT4-fs (loop2): warning: mounting fs with errors, running e2fsck is recommended [ 26.916882][ T537] usb usb1: usbfs: interface 0 claimed by hub while 'syz.1.98' sets config #1 [ 26.944273][ T539] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 26.958131][ T506] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=8856c01c, mo2=0002] [ 26.972678][ T544] xt_CT: You must specify a L4 protocol and not use inversions on it [ 27.001397][ T506] EXT4-fs warning (device loop2): ext4_enable_quotas:6489: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 27.111265][ T550] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=802c018, mo2=0002] [ 27.119871][ T550] EXT4-fs (loop3): mounted filesystem without journal. Opts: acl,barrier,minixdf,noblock_validity,debug_want_extra_isize=0x0000000000000080,bsddf,debug,acl,noinit_itable,,errors=continue [ 27.150814][ T557] SELinux: failed to load policy [ 27.167190][ T550] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm syz.3.106: bg 0: block 88: padding at end of block bitmap is not set [ 27.181824][ T550] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2816: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 27.291964][ T579] syz.2.117[579] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 27.292029][ T579] syz.2.117[579] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 27.372089][ T585] EXT4-fs (loop0): mounted filesystem without journal. Opts: noauto_da_alloc,nojournal_checksum,,errors=continue [ 27.396063][ T585] ext4 filesystem being mounted at /16/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 27.408332][ T585] EXT4-fs error (device loop0): ext4_xattr_block_get:546: inode #12: comm syz.0.116: corrupted xattr block 6 [ 27.420306][ T585] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop0 ino=12 [ 27.429277][ T585] EXT4-fs error (device loop0): ext4_xattr_block_get:546: inode #12: comm syz.0.116: corrupted xattr block 6 [ 27.441347][ T585] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop0 ino=12 [ 27.450467][ T585] EXT4-fs error (device loop0): ext4_xattr_block_get:546: inode #12: comm syz.0.116: corrupted xattr block 6 [ 27.462352][ T585] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop0 ino=12 [ 27.471563][ T585] EXT4-fs error (device loop0): ext4_xattr_block_get:546: inode #12: comm syz.0.116: corrupted xattr block 6 [ 27.483661][ T585] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop0 ino=12 [ 27.492756][ T585] EXT4-fs error (device loop0): ext4_xattr_block_get:546: inode #12: comm syz.0.116: corrupted xattr block 6 [ 27.504546][ T585] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop0 ino=12 [ 27.514394][ T585] EXT4-fs error (device loop0): ext4_xattr_block_get:546: inode #12: comm syz.0.116: corrupted xattr block 6 [ 28.143868][ T591] mmap: syz.1.122 (591) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 28.337882][ T605] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 28.433295][ T631] syz.0.140 (631) used obsolete PPPIOCDETACH ioctl [ 28.500025][ T628] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option [ 28.507413][ T628] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 28.524644][ T628] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 28.541926][ T628] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3342: comm syz.2.139: Allocating blocks 41-42 which overlap fs metadata [ 28.556399][ T628] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:3342: comm syz.2.139: Allocating blocks 41-42 which overlap fs metadata [ 28.587931][ T628] EXT4-fs error (device loop2): ext4_acquire_dquot:6224: comm syz.2.139: Failed to acquire dquot type 1 [ 28.613178][ T633] EXT4-fs (loop4): 1 truncate cleaned up [ 28.618891][ T633] EXT4-fs (loop4): mounted filesystem without journal. Opts: jqfmt=vfsv1,,errors=continue [ 28.633865][ T628] EXT4-fs error (device loop2): mb_free_blocks:1524: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 28.675371][ T628] EXT4-fs error (device loop2) in ext4_do_update_inode:5350: error 27 [ 28.690170][ T628] EXT4-fs error (device loop2): ext4_dirty_inode:6157: inode #12: comm syz.2.139: mark_inode_dirty error [ 28.719016][ T628] EXT4-fs error (device loop2) in ext4_do_update_inode:5350: error 27 [ 28.735345][ T628] EXT4-fs error (device loop2): __ext4_ext_dirty:182: inode #12: comm syz.2.139: mark_inode_dirty error [ 28.758686][ T628] EXT4-fs error (device loop2) in ext4_do_update_inode:5350: error 27 [ 28.762574][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.771776][ T628] EXT4-fs error (device loop2) in ext4_orphan_del:3292: error 27 [ 28.774842][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.788675][ T628] EXT4-fs error (device loop2) in ext4_do_update_inode:5350: error 27 [ 28.789584][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.805784][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.805826][ T628] EXT4-fs error (device loop2): ext4_truncate:4396: inode #12: comm syz.2.139: mark_inode_dirty error [ 28.813673][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.825144][ T628] EXT4-fs error (device loop2) in ext4_orphan_cleanup:3108: error 27 [ 28.832009][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.840857][ T628] EXT4-fs (loop2): 1 truncate cleaned up [ 28.847654][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.853149][ T628] EXT4-fs (loop2): mounted filesystem without journal. Opts: nomblk_io_submit,noblock_validity,inode_readahead_blks=0x0000000000200000,jqfmt=vfsold,noinit_itable,quota,noauto_da_alloc,sysvgroups,resgid=0x00000000000000002,errors=continue [ 28.860564][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.896604][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.899571][ T628] EXT4-fs (loop2): re-mounted. Opts: (null) [ 28.904662][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.917862][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.925754][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.933329][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.940756][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.948145][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.955598][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.963557][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.970991][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.978413][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.985981][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 28.993407][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.001159][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.008584][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.016081][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.023658][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.031082][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.038571][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.046102][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.053529][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.061103][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.068600][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.076042][ T309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 29.085159][ T309] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [sy] on syz0 [ 29.132367][ T659] fido_id[659]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 29.277704][ T668] FAT-fs (loop2): error, fat_free_clusters: deleting FAT entry beyond EOF [ 29.286777][ T668] FAT-fs (loop2): Filesystem has been set read-only [ 29.513134][ T673] EXT4-fs error (device loop3) in ext4_do_update_inode:5350: error 27 [ 29.522697][ T673] EXT4-fs error (device loop3): ext4_dirty_inode:6157: inode #15: comm syz.3.156: mark_inode_dirty error [ 29.550218][ T673] EXT4-fs error (device loop3) in ext4_do_update_inode:5350: error 27 [ 29.573140][ T673] EXT4-fs error (device loop3): ext4_xattr_delete_inode:2960: inode #15: comm syz.3.156: mark_inode_dirty error [ 29.595923][ T705] netlink: 288 bytes leftover after parsing attributes in process `syz.2.171'. [ 29.600036][ T673] EXT4-fs error (device loop3): ext4_xattr_delete_inode:2963: inode #15: comm syz.3.156: mark inode dirty (error -27) [ 29.625023][ T707] capability: warning: `syz.4.172' uses deprecated v2 capabilities in a way that may be insecure [ 29.625715][ T673] EXT4-fs warning (device loop3): ext4_evict_inode:303: xattr delete (err -27) [ 29.645397][ T673] EXT4-fs (loop3): 1 orphan inode deleted [ 29.651579][ T673] EXT4-fs (loop3): mounted filesystem without journal. Opts: nojournal_checksum,journal_dev=0x00000000000000ff,debug_want_extra_isize=0x0000000000000058,nouid32,resgid=0x0000000000000000,acl,init_itable=0x0000000000008d55,,errors=continue [ 29.765730][ T722] tipc: Started in network mode [ 29.777862][ T722] tipc: Own node identity 7a997df6521, cluster identity 4711 [ 29.787403][ T722] tipc: Enabled bearer , priority 0 [ 29.830841][ T722] device syzkaller0 entered promiscuous mode [ 29.843485][ T720] tipc: Resetting bearer [ 29.865230][ T720] tipc: Disabling bearer [ 29.957038][ T741] syz.3.188[741] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 29.957122][ T741] syz.3.188[741] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 30.015410][ T752] netlink: 64 bytes leftover after parsing attributes in process `syz.0.190'. [ 30.036732][ T745] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 30.054218][ T745] EXT4-fs (loop4): 1 truncate cleaned up [ 30.060239][ T745] EXT4-fs (loop4): mounted filesystem without journal. Opts: jqfmt=vfsold,usrjquota="errors=continue,noload,data_err=ignore,usrjquota="errors=continue,noinit_itable,noblock_validity,,errors=continue [ 30.081987][ T745] EXT4-fs (loop4): re-mounted. Opts: (null) [ 30.198039][ T761] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 30.229151][ T761] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 30.249256][ T761] EXT4-fs (loop0): 1 truncate cleaned up [ 30.255036][ T761] EXT4-fs (loop0): mounted filesystem without journal. Opts: quota,resuid=0x000000000000ee01,barrier=0x0000000000000003,debug_want_extra_isize=0x0000000000000080,block_validity,jqfmt=vfsv1,,errors=continue [ 30.300696][ T781] netlink: 8 bytes leftover after parsing attributes in process `syz.1.202'. [ 30.442545][ T800] netlink: 32 bytes leftover after parsing attributes in process `syz.4.214'. [ 30.603763][ T829] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option [ 30.639030][ T829] EXT4-fs (loop2): mounted filesystem without journal. Opts: nomblk_io_submit,inode_readahead_blks=0x0000000000100000,discard,,errors=continue [ 30.653918][ T829] ext4 filesystem being mounted at /50/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 30.674833][ T829] __quota_error: 343 callbacks suppressed [ 30.674846][ T829] Quota error (device loop2): find_block_dqentry: Quota for id 0 referenced but not present [ 30.690956][ T829] Quota error (device loop2): qtree_read_dquot: Can't read quota structure for id 0 [ 30.700649][ T829] EXT4-fs error (device loop2): ext4_acquire_dquot:6224: comm syz.2.227: Failed to acquire dquot type 1 [ 30.831461][ T839] loop1: p1 < > p3 p4 < > [ 30.837154][ T839] loop1: p3 start 4284289 is beyond EOD, truncated [ 30.853192][ T24] audit: type=1400 audit(1767269946.250:935): avc: denied { mounton } for pid=838 comm="syz.1.230" path="/dev/loop1p1" dev="devtmpfs" ino=555 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 30.913582][ T24] audit: type=1400 audit(1767269946.310:936): avc: denied { read } for pid=841 comm="syz.1.231" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 30.957448][ T317] udevd[317]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 30.962015][ T383] udevd[383]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 30.982151][ T317] udevd[317]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 30.985289][ T383] udevd[383]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 30.998310][ T24] audit: type=1400 audit(1767269946.390:937): avc: denied { read write } for pid=836 comm="syz.2.229" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.025207][ T24] audit: type=1400 audit(1767269946.390:938): avc: denied { open } for pid=836 comm="syz.2.229" path="/dev/raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.049417][ T24] audit: type=1400 audit(1767269946.390:939): avc: denied { ioctl } for pid=836 comm="syz.2.229" path="/dev/raw-gadget" dev="devtmpfs" ino=253 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.112336][ T24] audit: type=1326 audit(1767269946.510:940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=848 comm="syz.1.233" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9c91d2b749 code=0x7ffc0000 [ 31.116545][ T849] syz.1.233[849] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 31.135816][ T24] audit: type=1326 audit(1767269946.510:941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=848 comm="syz.1.233" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9c91d2b749 code=0x7ffc0000 [ 31.135838][ T849] syz.1.233[849] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 31.147824][ T24] audit: type=1326 audit(1767269946.510:942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=848 comm="syz.1.233" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f9c91d2b749 code=0x7ffc0000 [ 31.320043][ T297] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 31.465767][ T867] EXT4-fs (loop1): 1 truncate cleaned up [ 31.471723][ T867] EXT4-fs (loop1): mounted filesystem without journal. Opts: jqfmt=vfsv1,,errors=continue [ 31.558943][ T872] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue [ 31.569321][ T872] ext4 filesystem being mounted at /40/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.599969][ T297] usb 3-1: device descriptor read/64, error -71 [ 31.959986][ T15] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 31.990002][ T297] usb 3-1: device descriptor read/64, error -71 [ 32.209950][ T15] usb 5-1: Using ep0 maxpacket: 8 [ 32.250473][ T15] usb 5-1: no configurations [ 32.255265][ T15] usb 5-1: can't read configurations, error -22 [ 32.270059][ T297] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 32.296693][ T897] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869) [ 32.310517][ T897] EXT4-fs error (device loop1): ext4_get_journal_inode:5241: inode #32: comm syz.1.251: iget: special inode unallocated [ 32.323291][ T897] EXT4-fs (loop1): no journal found [ 32.328530][ T897] EXT4-fs (loop1): can't get journal size [ 32.335086][ T897] EXT4-fs error (device loop1): ext4_protect_reserved_inode:160: inode #32: comm syz.1.251: iget: special inode unallocated [ 32.348508][ T897] EXT4-fs (loop1): failed to initialize system zone (-117) [ 32.356089][ T897] EXT4-fs (loop1): mount failed [ 32.371710][ T906] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpquota,inode_readahead_blks=0x0000000000000800,minixdf,,errors=continue [ 32.385704][ T906] ext4 filesystem being mounted at /47/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 32.420000][ T15] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 32.539974][ T297] usb 3-1: device descriptor read/64, error -71 [ 32.655549][ T937] netlink: 'syz.1.269': attribute type 13 has an invalid length. [ 32.672179][ T15] usb 5-1: Using ep0 maxpacket: 8 [ 32.704242][ T937] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.711517][ T937] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.718958][ T15] usb 5-1: no configurations [ 32.724040][ T15] usb 5-1: can't read configurations, error -22 [ 32.730532][ T15] usb usb5-port1: attempt power cycle [ 32.853243][ T945] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 32.970007][ T297] usb 3-1: device descriptor read/64, error -71 [ 33.090221][ T297] usb usb3-port1: attempt power cycle [ 33.150018][ T15] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 33.183505][ T948] process 'syz.1.272' launched '/dev/fd/3' with NULL argv: empty string added [ 33.250066][ T15] usb 5-1: Using ep0 maxpacket: 8 [ 33.290184][ T15] usb 5-1: no configurations [ 33.295009][ T15] usb 5-1: can't read configurations, error -22 [ 33.449996][ T15] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 33.500004][ T297] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 33.533992][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.544944][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 33.553023][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.563947][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 33.571898][ T15] usb 5-1: Using ep0 maxpacket: 8 [ 33.577304][ T955] loop6: unable to read partition table [ 33.584450][ T955] loop_reread_partitions: partition scan of loop6 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊5) failed (rc=-5) [ 33.597935][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.597949][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 33.617090][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.628010][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 33.641277][ T15] usb 5-1: no configurations [ 33.645915][ T15] usb 5-1: can't read configurations, error -22 [ 33.652226][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.652239][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 33.673337][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x4 [ 33.675499][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.682456][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x2 [ 33.692266][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 33.693012][ C0] blk_update_request: I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.701003][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.707822][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 33.718870][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.742174][ T15] usb usb5-port1: unable to enumerate USB device [ 33.749996][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.757805][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.765793][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.773607][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.781535][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.789366][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.797388][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.805484][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.814623][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.823082][ T297] usb 3-1: device descriptor read/8, error -71 [ 33.829567][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.837835][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.845628][ T20] hid-generic 0000:3000000:0000.0003: unknown main item tag 0x0 [ 33.854179][ T20] hid-generic 0000:3000000:0000.0003: hidraw0: HID v0.00 Device [sy] on syz0 [ 33.887736][ T969] fido_id[969]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 34.000361][ T985] syz.1.288 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 34.030065][ T297] usb 3-1: device descriptor read/8, error -71 [ 34.049495][ T990] netlink: 44 bytes leftover after parsing attributes in process `syz.1.290'. [ 34.058928][ T990] netlink: 43 bytes leftover after parsing attributes in process `syz.1.290'. [ 34.068337][ T990] netlink: 'syz.1.290': attribute type 6 has an invalid length. [ 34.076327][ T990] netlink: 'syz.1.290': attribute type 5 has an invalid length. [ 34.084260][ T990] netlink: 43 bytes leftover after parsing attributes in process `syz.1.290'. [ 34.139166][ T1000] xt_hashlimit: size too large, truncated to 1048576 [ 34.520207][ T297] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 34.620034][ T297] usb 3-1: Using ep0 maxpacket: 16 [ 34.671548][ T1034] ================================================================== [ 34.679677][ T1034] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x842/0x3280 [ 34.687916][ T1034] Read of size 8 at addr ffff888114ee7ec0 by task syz.0.311/1034 [ 34.695648][ T1034] [ 34.698189][ T1034] CPU: 0 PID: 1034 Comm: syz.0.311 Not tainted syzkaller #0 [ 34.705479][ T1034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 34.715630][ T1034] Call Trace: [ 34.718941][ T1034] __dump_stack+0x21/0x24 [ 34.723288][ T1034] dump_stack_lvl+0x169/0x1d8 [ 34.727968][ T1034] ? show_regs_print_info+0x18/0x18 [ 34.733174][ T1034] ? thaw_kernel_threads+0x220/0x220 [ 34.738466][ T1034] print_address_description+0x7f/0x2c0 [ 34.744105][ T1034] ? tc_setup_flow_action+0x842/0x3280 [ 34.749914][ T1034] kasan_report+0xe2/0x130 [ 34.754416][ T1034] ? flow_action_cookie_create+0x28/0x90 [ 34.760054][ T1034] ? tc_setup_flow_action+0x842/0x3280 [ 34.765685][ T1034] __asan_report_load8_noabort+0x14/0x20 [ 34.771334][ T1034] tc_setup_flow_action+0x842/0x3280 [ 34.776623][ T1034] ? __kmalloc+0x1a7/0x330 [ 34.781040][ T1034] ? flow_rule_alloc+0x32/0x2c0 [ 34.785891][ T1034] mall_replace_hw_filter+0x293/0x810 [ 34.791266][ T1034] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 34.797333][ T1034] ? mall_set_parms+0x410/0x410 [ 34.802183][ T1034] ? tcf_exts_destroy+0xb0/0xb0 [ 34.807033][ T1034] ? pcpu_alloc+0xf8a/0x16b0 [ 34.811632][ T1034] ? mall_set_parms+0x19d/0x410 [ 34.816474][ T1034] mall_change+0x528/0x750 [ 34.820886][ T1034] ? __kasan_check_write+0x14/0x20 [ 34.825995][ T1034] ? mall_get+0xa0/0xa0 [ 34.830153][ T1034] ? tcf_chain_tp_insert_unique+0xac1/0xc10 [ 34.836037][ T1034] ? nla_strcmp+0xf4/0x140 [ 34.840449][ T1034] tc_new_tfilter+0x13f6/0x1a10 [ 34.845304][ T1034] ? mall_get+0xa0/0xa0 [ 34.849597][ T1034] ? tcf_gate_entry_destructor+0x20/0x20 [ 34.855263][ T1034] ? security_capable+0x87/0xb0 [ 34.860164][ T1034] ? ns_capable+0x8c/0xf0 [ 34.864503][ T1034] ? netlink_net_capable+0x125/0x160 [ 34.869892][ T1034] ? tcf_gate_entry_destructor+0x20/0x20 [ 34.875553][ T1034] rtnetlink_rcv_msg+0x800/0xb90 [ 34.880512][ T1034] ? rtnetlink_bind+0x80/0x80 [ 34.885236][ T1034] ? arch_stack_walk+0xee/0x140 [ 34.890088][ T1034] ? stack_trace_save+0x98/0xe0 [ 34.894937][ T1034] ? stack_trace_snprint+0xf0/0xf0 [ 34.900046][ T1034] ? memcpy+0x56/0x70 [ 34.904027][ T1034] ? avc_has_perm+0x234/0x360 [ 34.908708][ T1034] ? __kasan_slab_alloc+0xbd/0xf0 [ 34.913762][ T1034] ? slab_post_alloc_hook+0x5d/0x2f0 [ 34.919060][ T1034] ? ___sys_sendmsg+0x1f0/0x260 [ 34.923999][ T1034] ? avc_has_perm_noaudit+0x240/0x240 [ 34.929372][ T1034] ? selinux_nlmsg_lookup+0x3fb/0x4a0 [ 34.934771][ T1034] netlink_rcv_skb+0x1e0/0x430 [ 34.939543][ T1034] ? rtnetlink_bind+0x80/0x80 [ 34.944226][ T1034] ? netlink_ack+0xb80/0xb80 [ 34.948822][ T1034] ? __netlink_lookup+0x387/0x3b0 [ 34.953867][ T1034] rtnetlink_rcv+0x1c/0x20 [ 34.958292][ T1034] netlink_unicast+0x876/0xa40 [ 34.963149][ T1034] netlink_sendmsg+0x88d/0xb30 [ 34.967915][ T1034] ? netlink_getsockopt+0x530/0x530 [ 34.973115][ T1034] ? security_socket_sendmsg+0x82/0xa0 [ 34.978572][ T1034] ? netlink_getsockopt+0x530/0x530 [ 34.983818][ T1034] ____sys_sendmsg+0x5a2/0x8c0 [ 34.988576][ T1034] ? __sys_sendmsg_sock+0x40/0x40 [ 34.993607][ T1034] ? import_iovec+0x7c/0xb0 [ 34.998106][ T1034] ___sys_sendmsg+0x1f0/0x260 [ 35.002795][ T1034] ? __sys_sendmsg+0x250/0x250 [ 35.007610][ T1034] ? __fdget+0x1a1/0x230 [ 35.012018][ T1034] __x64_sys_sendmsg+0x1e2/0x2a0 [ 35.016948][ T1034] ? ___sys_sendmsg+0x260/0x260 [ 35.021798][ T1034] ? syscall_trace_enter+0x108/0x170 [ 35.027079][ T1034] do_syscall_64+0x31/0x40 [ 35.031494][ T1034] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.037375][ T1034] RIP: 0033:0x7fbeae989749 [ 35.041786][ T1034] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 35.061384][ T1034] RSP: 002b:00007fbead3f1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 35.069795][ T1034] RAX: ffffffffffffffda RBX: 00007fbeaebdffa0 RCX: 00007fbeae989749 [ 35.077764][ T1034] RDX: 0000000020000000 RSI: 0000200000000580 RDI: 0000000000000004 [ 35.085731][ T1034] RBP: 00007fbeaea0df91 R08: 0000000000000000 R09: 0000000000000000 [ 35.093694][ T1034] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.101662][ T1034] R13: 00007fbeaebe0038 R14: 00007fbeaebdffa0 R15: 00007fff90a774c8 [ 35.109637][ T1034] [ 35.111969][ T1034] Allocated by task 1034: [ 35.116313][ T1034] __kasan_kmalloc+0xda/0x110 [ 35.121008][ T1034] __kmalloc+0x1a7/0x330 [ 35.125253][ T1034] tcf_idr_create+0x5f/0x790 [ 35.129850][ T1034] tcf_idr_create_from_flags+0x61/0x70 [ 35.135408][ T1034] tcf_gact_init+0x2b4/0x520 [ 35.140187][ T1034] tcf_action_init_1+0x3e1/0x670 [ 35.145124][ T1034] tcf_action_init+0x1e6/0x700 [ 35.149881][ T1034] tcf_exts_validate+0x215/0x510 [ 35.154820][ T1034] mall_set_parms+0x4b/0x410 [ 35.159403][ T1034] mall_change+0x45c/0x750 [ 35.163809][ T1034] tc_new_tfilter+0x13f6/0x1a10 [ 35.168658][ T1034] rtnetlink_rcv_msg+0x800/0xb90 [ 35.173614][ T1034] netlink_rcv_skb+0x1e0/0x430 [ 35.178375][ T1034] rtnetlink_rcv+0x1c/0x20 [ 35.182788][ T1034] netlink_unicast+0x876/0xa40 [ 35.187564][ T1034] netlink_sendmsg+0x88d/0xb30 [ 35.192333][ T1034] ____sys_sendmsg+0x5a2/0x8c0 [ 35.197092][ T1034] ___sys_sendmsg+0x1f0/0x260 [ 35.201772][ T1034] __x64_sys_sendmsg+0x1e2/0x2a0 [ 35.206707][ T1034] do_syscall_64+0x31/0x40 [ 35.211120][ T1034] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.217000][ T1034] [ 35.219334][ T1034] The buggy address belongs to the object at ffff888114ee7e00 [ 35.219334][ T1034] which belongs to the cache kmalloc-192 of size 192 [ 35.233516][ T1034] The buggy address is located 0 bytes to the right of [ 35.233516][ T1034] 192-byte region [ffff888114ee7e00, ffff888114ee7ec0) [ 35.247130][ T1034] The buggy address belongs to the page: [ 35.252774][ T1034] page:ffffea000453b9c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114ee7 [ 35.263106][ T1034] flags: 0x4000000000000200(slab) [ 35.268133][ T1034] raw: 4000000000000200 ffffea00044f4140 0000000400000004 ffff888100043380 [ 35.276808][ T1034] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 35.285396][ T1034] page dumped because: kasan: bad access detected [ 35.291982][ T1034] page_owner tracks the page as allocated [ 35.297722][ T1034] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 97, ts 6096142280, free_ts 0 [ 35.312765][ T1034] prep_new_page+0x179/0x180 [ 35.317372][ T1034] get_page_from_freelist+0x2235/0x23d0 [ 35.322957][ T1034] __alloc_pages_nodemask+0x268/0x5f0 [ 35.328477][ T1034] new_slab+0x84/0x3f0 [ 35.332550][ T1034] ___slab_alloc+0x2a6/0x450 [ 35.337142][ T1034] __slab_alloc+0x63/0xa0 [ 35.341469][ T1034] kmem_cache_alloc_trace+0x1b3/0x2e0 [ 35.346844][ T1034] kernfs_fop_open+0x343/0xb30 [ 35.351701][ T1034] do_dentry_open+0x793/0x1090 [ 35.356465][ T1034] vfs_open+0x73/0x80 [ 35.360451][ T1034] path_openat+0x27ad/0x3160 [ 35.365039][ T1034] do_filp_open+0x1b3/0x3e0 [ 35.369636][ T1034] do_sys_openat2+0x14c/0x6d0 [ 35.374332][ T1034] __x64_sys_openat+0x136/0x160 [ 35.379193][ T1034] do_syscall_64+0x31/0x40 [ 35.383629][ T1034] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.389524][ T1034] page_owner free stack trace missing [ 35.394921][ T1034] [ 35.397249][ T1034] Memory state around the buggy address: [ 35.402878][ T1034] ffff888114ee7d80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.410948][ T1034] ffff888114ee7e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.419015][ T1034] >ffff888114ee7e80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 35.427072][ T1034] ^ [ 35.433227][ T1034] ffff888114ee7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.441378][ T1034] ffff888114ee7f80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 35.449433][ T1034] ================================================================== [ 35.457490][ T1034] Disabling lock debugging due to kernel taint [ 35.600050][ T297] usb 3-1: config 0 has an invalid interface number: 3 but max is 0 [ 35.608281][ T297] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 35.618539][ T297] usb 3-1: config 0 has no interface number 0 [ 35.624818][ T297] usb 3-1: config 0 interface 3 altsetting 142 bulk endpoint 0x5 has invalid maxpacket 32 [ 35.634773][ T297] usb 3-1: config 0 interface 3 altsetting 142 endpoint 0xB has an invalid bInterval 36, changing to 9 [ 35.645948][ T297] usb 3-1: config 0 interface 3 altsetting 142 has an invalid endpoint with address 0x10, skipping [ 35.656682][ T297] usb 3-1: config 0 interface 3 altsetting 142 has a duplicate endpoint with address 0xB, skipping [ 35.667509][ T297] usb 3-1: config 0 interface 3 altsetting 142 bulk endpoint 0x6 has invalid maxpacket 8 [ 35.677399][ T297] usb 3-1: config 0 interface 3 altsetting 142 has an invalid endpoint with address 0xED, skipping [ 35.688149][ T297] usb 3-1: config 0 interface 3 altsetting 142 bulk endpoint 0xC has invalid maxpacket 16 [ 35.698179][ T297] usb 3-1: config 0 interface 3 has no altsetting 0 [ 35.860088][ T297] usb 3-1: New USB device found, idVendor=0bfd, idProduct=000b, bcdDevice=4e.46 [ 35.869215][ T297] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.877657][ T297] usb 3-1: Product:   [ 35.881852][ T297] usb 3-1: Manufacturer:  [ 35.886443][ T297] usb 3-1: SerialNumber: Ђ [ 35.892179][ T297] usb 3-1: config 0 descriptor?? [ 35.910079][ T1006] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 35.917289][ T1006] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 35.924442][ T1006] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 36.150497][ T1006] netlink: 'syz.2.298': attribute type 13 has an invalid length. [ 36.185822][ T1006] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.193092][ T1006] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.228139][ T1006] 9pnet: Insufficient options for proto=fd [ 36.234865][ T24] kauditd_printk_skb: 290 callbacks suppressed [ 36.234878][ T24] audit: type=1326 audit(1767269951.630:1233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1005 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fd8cc780829 code=0x7ffc0000 [ 36.264724][ T24] audit: type=1326 audit(1767269951.630:1234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1005 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8cc7e4749 code=0x7ffc0000 [ 36.288060][ T24] audit: type=1326 audit(1767269951.630:1235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1005 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=101 compat=0 ip=0x7fd8cc7e4749 code=0x7ffc0000 [ 36.311414][ T24] audit: type=1326 audit(1767269951.630:1236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1005 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8cc7e4749 code=0x7ffc0000 [ 36.334764][ T24] audit: type=1326 audit(1767269951.630:1237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1005 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd8cc7e4749 code=0x7ffc0000 [ 36.358333][ T24] audit: type=1400 audit(1767269951.630:1238): avc: denied { ioctl } for pid=1005 comm="syz.2.298" path="socket:[16874]" dev="sockfs" ino=16874 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 36.383069][ T24] audit: type=1326 audit(1767269951.630:1239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1005 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8cc7e4749 code=0x7ffc0000 [ 36.406440][ T24] audit: type=1326 audit(1767269951.630:1240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1005 comm="syz.2.298" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8cc7e4749 code=0x7ffc0000 [ 36.472262][ T297] usb 3-1: USB disconnect, device number 5