last executing test programs: 4m13.434814335s ago: executing program 32 (id=144): r0 = io_uring_setup(0x1, &(0x7f00000002c0)={0x0, 0x0, 0x3800}) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r0, 0x20, 0x0, 0x1) 3m37.578796705s ago: executing program 33 (id=837): r0 = add_key(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000240)='asymmetric\x00', 0x0, &(0x7f0000000300)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db595", 0x114, r0) 3m33.581555562s ago: executing program 6 (id=992): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='10', 0x2) syz_open_procfs$pagemap(0x0, 0x0) add_key$keyring(&(0x7f0000000400), &(0x7f0000000440)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./my_configfs\x00', &(0x7f00000002c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/usb_gadget/g1\x00', 0x1ff) 3m33.496451831s ago: executing program 6 (id=995): sendmsg$NFT_MSG_GETTABLE(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x5c, 0x1, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x20040800) 3m33.424433318s ago: executing program 6 (id=998): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='27', 0x2) umount2(0x0, 0x1) r1 = shmget$private(0x0, 0x800000, 0x54003f00, &(0x7f0000800000/0x800000)=nil) shmat(r1, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000007, 0x20031, 0xffffffffffffffff, 0xffffe000) mbind(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x8, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x24}}, 0x0) timer_create(0x1, &(0x7f0000000840)={0x0, 0x21, 0x4}, 0x0) 3m33.392747172s ago: executing program 34 (id=997): r0 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r0, 0x5) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r1, 0x638) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e24, 0x6bb, @remote, 0x9}, 0x1c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000280)={0xa, 0x0, 0x3, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r6, 0x14) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) r8 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r8, 0x0, 0x4044) 3m33.387876772s ago: executing program 6 (id=1001): syz_mount_image$ext4(&(0x7f0000002bc0)='ext4\x00', &(0x7f0000002c00)='./file2\x00', 0x2000410, &(0x7f0000002c40)={[{@noinit_itable}, {@jqfmt_vfsv1}]}, 0xc1, 0x7eb, &(0x7f0000002c80)="$eJzs3ctrG9sdAODfyA/ZTlq7UGiTlaHQGkLkOnWTFrpI6aIUGgi06yZGVkxq2QqWHGJjiLModFNoSxeFdpN1H+mi0G0f2/afKHdxSQj3Oubmri66zEjyU1L8loO/D8ZzzsyZOefMOTNzrBmkAC6s8fRPLuJKRPw6iRhtLk8iYiAL9UfcbqR7u7FWTKck6vWffJRkaf5+aXtfSXN+qRn5akT8+xcR13J7cx1uzsulpWZosrbwaLK6snr94cLMXGmutHhzanr6xq1v37q5f6uj+uR/q5df/eaH3/jr7f74yotf/SeJ23G5uW5zY614zN3vMx7jzWMykB7CXX5w0pn1WNLrAnAk6anZ1zjL40qMRl8W6uC4JyAAcC48jYg6AHDBJO7/AHDBtD4H2NxYK7am3n4icbZefz8ihhr1bz3fbKzpbz6zG8qeg45sJruejCQRMXYC+Y9HxB//8bM/p1Mc8jlk4qkbcAzrzyLi/tj45kZ+z/U/Sa9/g+/eQ77jmm9226ze2G58z+KLdv+BXvpnOv75zv7x39WtocVQ9nfP+Gco3+bcPYp3n/+5lx02PcC16d3S8d/3drzbtj3+23ppbayvGftCNuYbSB48LJfSa9sXI2IiBvJpfCpL2n48NvHmszed8t85/vv4tz//U5p/Ot9OkXvZn4964728RlvMztRmTqLuqdfPIq72t6t/sjX+TTqMf+923OvupvnRd3/5h04p0/qn9W1N++t/uurPI77etv232zLp+n7iZNYdJludoo2/ffD7kU75b7d/Ppun+bf+FzgLafuPdK//WBqqrqzOz5TLpaXq4fP47/PRf3Vat7P/t69/1v93Sfv/YPLTLNzqaU9marWlqYjB5Mf7l9/Y3rYVb6VP6z/xtfbnf6f+n2u+G3t/K9Zd/6vBvzR31bb+mfVO9e82wjq+tP6zh2r/VqB1NLaXVOvNbfYkfvF2vq9T/gdr/+ksNNFccpDr386Sdgsc6aABAAAAAAAAAAAAAAAAAAAAAAAAwCHlIuJyJLnCVjiXKxQav+H95RjJlSvV2rUHleXF2ch+K3ssBnKtr7oc3fF9qFPN78NvxW/siX8rIr4UEb/LD2fxQrFSnu115QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg6dLu3/9/ms4Khca6D/O9Lh0AcGqGel0AAODMuf8DwMVzuPv/8KmVAwA4O4f+/7+enE5BAIAzc+D7//3TLQcAcHY8/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCU3b1zJ53qn26sFdP47OOV5fnK4+uzpep8YWG5WChWlh4V5iqVuXKpUKwsdNzRemNWrlQeTcfi8pPJWqlam6yurN5bqCwv1u49XJiZK90rDZxZzQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg4Korq/Mz5XJpSaBLYLg0fB6KcY4C/XEuirEvsP7/gaxfd00cY+9N5x/skiY5ybyG9y7ZeZUY7sm1CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOB98HkAAAD//yofFO0=") bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000003480)='./file1\x00', 0x80042, 0x121) mkdirat(0xffffffffffffff9c, &(0x7f00000034c0)='./proc\x00', 0x4) mount(0x0, &(0x7f0000003500)='./proc\x00', &(0x7f0000003540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000003580)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write$cgroup_int(r1, &(0x7f00000035c0)=0x8, 0x12) pwrite64(r0, &(0x7f0000003600)='\"', 0xe7d, 0xe7c) 3m33.034632888s ago: executing program 6 (id=1010): mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, 0x0, 0x0) r1 = syz_create_resource$futex(0x0) r2 = syz_create_resource$futex(&(0x7f0000000780)=0x2) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) futex(r1, 0xb, 0x1, 0x0, r2, 0x1) 3m32.927133409s ago: executing program 3 (id=1013): capset(0x0, &(0x7f0000000540)={0x200002, 0x200003, 0x2, 0x4, 0x7, 0xfffffffd}) setns(0xc9, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) r0 = socket(0x8, 0x5, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x400261f2, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 3m32.739406188s ago: executing program 3 (id=1016): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r0, &(0x7f0000000300)={0xfc, {"fce3ad0eed0d07f91b50091887f70706d0f0e7ff7fc6e5539b0d3d0a8b089b3f383163030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f01f319520100ffe8d178708c523c921b1b5b3107200773090acd3b78130daa61d8e8040040005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a91e0dad47f36fd9f73c152a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fc4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae1587e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab9662038ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19cad7f8ea283010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432709001ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a7b5e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc24a78a79ec889b3956222f77ec05c01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e1c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d21406000200000000000000bee96e3a726eafe2fdfaa78d1f48c13b64df11847754400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e30400f7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa4e262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddba02635478d8ac2dfad2ba3a504767b6b01a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f79400000000ddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26ba5678a674dfc95df04b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfe4c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e785419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731be13bff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd502ac8044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88e4facfd4c735a20307c737afa2d60399473296b831dbd933d93990f00064279b10ea0c5833f41f157ea2302993dbe97fb1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea10c00a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ff000000004b8e3737fbb42913777c06376f799eba367e21f94c3508705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c00de0093b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeee964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1017aef0948a68cf255d349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e52126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed5fdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e42df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f83428569b5125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43410ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed62480ec43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e069160f59554e502dcea39cb313b1aec000000000000c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df076f0ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b779400d64ebf9e47a08d367e5f87296ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec869c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) 3m32.594480343s ago: executing program 3 (id=1017): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xd, &(0x7f00000006c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, [@call={0x85, 0x0, 0x0, 0x2a}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000740)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r1, 0x2000012, 0xe, 0x0, &(0x7f0000000800)="63ec4da252ee20b25ca981ef9b5e", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 3m32.537551709s ago: executing program 6 (id=1018): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000040)=0x4, 0x4) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) getsockname$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg(r0, &(0x7f0000000240)=[{{&(0x7f0000000280)=@xdp={0x2c, 0xa888, r2, 0x7}, 0x14, 0x0}}], 0x1, 0x80) 3m32.421396561s ago: executing program 35 (id=1018): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000040)=0x4, 0x4) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) getsockname$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg(r0, &(0x7f0000000240)=[{{&(0x7f0000000280)=@xdp={0x2c, 0xa888, r2, 0x7}, 0x14, 0x0}}], 0x1, 0x80) 3m32.32995049s ago: executing program 3 (id=1020): syz_mount_image$ext4(&(0x7f0000002bc0)='ext4\x00', &(0x7f0000002c00)='./file2\x00', 0x2000410, &(0x7f0000002c40)={[{@noinit_itable}, {@jqfmt_vfsv1}]}, 0xc1, 0x7eb, &(0x7f0000002c80)="$eJzs3ctrG9sdAODfyA/ZTlq7UGiTlaHQGkLkOnWTFrpI6aIUGgi06yZGVkxq2QqWHGJjiLModFNoSxeFdpN1H+mi0G0f2/afKHdxSQj3Oubmri66zEjyU1L8loO/D8ZzzsyZOefMOTNzrBmkAC6s8fRPLuJKRPw6iRhtLk8iYiAL9UfcbqR7u7FWTKck6vWffJRkaf5+aXtfSXN+qRn5akT8+xcR13J7cx1uzsulpWZosrbwaLK6snr94cLMXGmutHhzanr6xq1v37q5f6uj+uR/q5df/eaH3/jr7f74yotf/SeJ23G5uW5zY614zN3vMx7jzWMykB7CXX5w0pn1WNLrAnAk6anZ1zjL40qMRl8W6uC4JyAAcC48jYg6AHDBJO7/AHDBtD4H2NxYK7am3n4icbZefz8ihhr1bz3fbKzpbz6zG8qeg45sJruejCQRMXYC+Y9HxB//8bM/p1Mc8jlk4qkbcAzrzyLi/tj45kZ+z/U/Sa9/g+/eQ77jmm9226ze2G58z+KLdv+BXvpnOv75zv7x39WtocVQ9nfP+Gco3+bcPYp3n/+5lx02PcC16d3S8d/3drzbtj3+23ppbayvGftCNuYbSB48LJfSa9sXI2IiBvJpfCpL2n48NvHmszed8t85/vv4tz//U5p/Ot9OkXvZn4964728RlvMztRmTqLuqdfPIq72t6t/sjX+TTqMf+923OvupvnRd3/5h04p0/qn9W1N++t/uurPI77etv232zLp+n7iZNYdJludoo2/ffD7kU75b7d/Ppun+bf+FzgLafuPdK//WBqqrqzOz5TLpaXq4fP47/PRf3Vat7P/t69/1v93Sfv/YPLTLNzqaU9marWlqYjB5Mf7l9/Y3rYVb6VP6z/xtfbnf6f+n2u+G3t/K9Zd/6vBvzR31bb+mfVO9e82wjq+tP6zh2r/VqB1NLaXVOvNbfYkfvF2vq9T/gdr/+ksNNFccpDr386Sdgsc6aABAAAAAAAAAAAAAAAAAAAAAAAAwCHlIuJyJLnCVjiXKxQav+H95RjJlSvV2rUHleXF2ch+K3ssBnKtr7oc3fF9qFPN78NvxW/siX8rIr4UEb/LD2fxQrFSnu115QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg6dLu3/9/ms4Khca6D/O9Lh0AcGqGel0AAODMuf8DwMVzuPv/8KmVAwA4O4f+/7+enE5BAIAzc+D7//3TLQcAcHY8/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCU3b1zJ53qn26sFdP47OOV5fnK4+uzpep8YWG5WChWlh4V5iqVuXKpUKwsdNzRemNWrlQeTcfi8pPJWqlam6yurN5bqCwv1u49XJiZK90rDZxZzQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg4Korq/Mz5XJpSaBLYLg0fB6KcY4C/XEuirEvsP7/gaxfd00cY+9N5x/skiY5ybyG9y7ZeZUY7sm1CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOB98HkAAAD//yofFO0=") bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000003480)='./file1\x00', 0x80042, 0x121) mkdirat(0xffffffffffffff9c, &(0x7f00000034c0)='./proc\x00', 0x4) mount(0x0, &(0x7f0000003500)='./proc\x00', &(0x7f0000003540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000003580)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write$cgroup_int(r1, &(0x7f00000035c0)=0x8, 0x12) pwrite64(r0, &(0x7f0000003600)='\"', 0xe7d, 0xe7c) 3m32.13830015s ago: executing program 3 (id=1021): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="020000000400000008000000"], 0xe) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x19, 0x4, 0x8, 0x100, 0x0, 0x1, 0x3adc, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1, 0x8, &(0x7f0000000080)=@framed={{}, [@map_fd={0x18, 0x1, 0x1, 0x0, r1}, @map_val={0x18, 0x2, 0x2, 0x0, r0}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3m31.605486604s ago: executing program 3 (id=1027): mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, 0x0, 0x0) r1 = syz_create_resource$futex(0x0) r2 = syz_create_resource$futex(&(0x7f0000000780)=0x2) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) futex(r1, 0xb, 0x1, 0x0, r2, 0x1) 3m31.587302076s ago: executing program 36 (id=1027): mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, 0x0, 0x0) r1 = syz_create_resource$futex(0x0) r2 = syz_create_resource$futex(&(0x7f0000000780)=0x2) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) futex(r1, 0xb, 0x1, 0x0, r2, 0x1) 3m18.854162736s ago: executing program 8 (id=1253): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='100', 0x3) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_open_dev$usbmon(&(0x7f00000008c0), 0x80000001, 0x82002) 3m18.660020505s ago: executing program 8 (id=1255): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000640)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x14, 0x1, 0xa, 0x5, 0x0, 0x0, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x20040800) 3m18.533609998s ago: executing program 8 (id=1257): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'dummy0\x00'}) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) 3m18.393096253s ago: executing program 8 (id=1259): r0 = syz_mount_image$ext4(&(0x7f0000002bc0)='ext4\x00', &(0x7f0000002c00)='./file2\x00', 0x2000410, &(0x7f0000002c40)={[{@noinit_itable}, {@jqfmt_vfsv1}]}, 0xc1, 0x7eb, &(0x7f0000002c80)="$eJzs3ctrG9sdAODfyA/ZTlq7UGiTlaHQGkLkOnWTFrpI6aIUGgi06yZGVkxq2QqWHGJjiLModFNoSxeFdpN1H+mi0G0f2/afKHdxSQj3Oubmri66zEjyU1L8loO/D8ZzzsyZOefMOTNzrBmkAC6s8fRPLuJKRPw6iRhtLk8iYiAL9UfcbqR7u7FWTKck6vWffJRkaf5+aXtfSXN+qRn5akT8+xcR13J7cx1uzsulpWZosrbwaLK6snr94cLMXGmutHhzanr6xq1v37q5f6uj+uR/q5df/eaH3/jr7f74yotf/SeJ23G5uW5zY614zN3vMx7jzWMykB7CXX5w0pn1WNLrAnAk6anZ1zjL40qMRl8W6uC4JyAAcC48jYg6AHDBJO7/AHDBtD4H2NxYK7am3n4icbZefz8ihhr1bz3fbKzpbz6zG8qeg45sJruejCQRMXYC+Y9HxB//8bM/p1Mc8jlk4qkbcAzrzyLi/tj45kZ+z/U/Sa9/g+/eQ77jmm9226ze2G58z+KLdv+BXvpnOv75zv7x39WtocVQ9nfP+Gco3+bcPYp3n/+5lx02PcC16d3S8d/3drzbtj3+23ppbayvGftCNuYbSB48LJfSa9sXI2IiBvJpfCpL2n48NvHmszed8t85/vv4tz//U5p/Ot9OkXvZn4964728RlvMztRmTqLuqdfPIq72t6t/sjX+TTqMf+923OvupvnRd3/5h04p0/qn9W1N++t/uurPI77etv232zLp+n7iZNYdJludoo2/ffD7kU75b7d/Ppun+bf+FzgLafuPdK//WBqqrqzOz5TLpaXq4fP47/PRf3Vat7P/t69/1v93Sfv/YPLTLNzqaU9marWlqYjB5Mf7l9/Y3rYVb6VP6z/xtfbnf6f+n2u+G3t/K9Zd/6vBvzR31bb+mfVO9e82wjq+tP6zh2r/VqB1NLaXVOvNbfYkfvF2vq9T/gdr/+ksNNFccpDr386Sdgsc6aABAAAAAAAAAAAAAAAAAAAAAAAAwCHlIuJyJLnCVjiXKxQav+H95RjJlSvV2rUHleXF2ch+K3ssBnKtr7oc3fF9qFPN78NvxW/siX8rIr4UEb/LD2fxQrFSnu115QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg6dLu3/9/ms4Khca6D/O9Lh0AcGqGel0AAODMuf8DwMVzuPv/8KmVAwA4O4f+/7+enE5BAIAzc+D7//3TLQcAcHY8/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCU3b1zJ53qn26sFdP47OOV5fnK4+uzpep8YWG5WChWlh4V5iqVuXKpUKwsdNzRemNWrlQeTcfi8pPJWqlam6yurN5bqCwv1u49XJiZK90rDZxZzQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg4Korq/Mz5XJpSaBLYLg0fB6KcY4C/XEuirEvsP7/gaxfd00cY+9N5x/skiY5ybyG9y7ZeZUY7sm1CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOB98HkAAAD//yofFO0=") bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000003480)='./file1\x00', 0x80042, 0x121) mkdirat(0xffffffffffffff9c, &(0x7f00000034c0)='./proc\x00', 0x4) mount(0x0, &(0x7f0000003500)='./proc\x00', &(0x7f0000003540)='proc\x00', 0x0, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f00000035c0)=0x8, 0x12) getsockname$packet(r0, 0x0, 0x0) pwrite64(r1, &(0x7f0000003600)='\"', 0xe7d, 0xe7c) 3m18.328073939s ago: executing program 8 (id=1261): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='27', 0x2) r1 = shmget$private(0x0, 0x800000, 0x54003f00, &(0x7f0000800000/0x800000)=nil) shmat(r1, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000007, 0x20031, 0xffffffffffffffff, 0xffffe000) mbind(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x8, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x24}}, 0x0) timer_create(0x1, &(0x7f0000000840)={0x0, 0x21, 0x4}, 0x0) 3m18.02381002s ago: executing program 8 (id=1269): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) 3m17.965034786s ago: executing program 37 (id=1269): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) 3m12.574573956s ago: executing program 9 (id=1374): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000002c0)={0xffffffffffffffff}, 0x106, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, &(0x7f0000000300)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0xf, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x18}, r0}}, 0x30) 3m12.463991817s ago: executing program 9 (id=1377): r0 = syz_mount_image$ext4(&(0x7f0000002bc0)='ext4\x00', &(0x7f0000002c00)='./file2\x00', 0x2000410, &(0x7f0000002c40)={[{@noinit_itable}, {@jqfmt_vfsv1}]}, 0xc1, 0x7eb, &(0x7f0000002c80)="$eJzs3ctrG9sdAODfyA/ZTlq7UGiTlaHQGkLkOnWTFrpI6aIUGgi06yZGVkxq2QqWHGJjiLModFNoSxeFdpN1H+mi0G0f2/afKHdxSQj3Oubmri66zEjyU1L8loO/D8ZzzsyZOefMOTNzrBmkAC6s8fRPLuJKRPw6iRhtLk8iYiAL9UfcbqR7u7FWTKck6vWffJRkaf5+aXtfSXN+qRn5akT8+xcR13J7cx1uzsulpWZosrbwaLK6snr94cLMXGmutHhzanr6xq1v37q5f6uj+uR/q5df/eaH3/jr7f74yotf/SeJ23G5uW5zY614zN3vMx7jzWMykB7CXX5w0pn1WNLrAnAk6anZ1zjL40qMRl8W6uC4JyAAcC48jYg6AHDBJO7/AHDBtD4H2NxYK7am3n4icbZefz8ihhr1bz3fbKzpbz6zG8qeg45sJruejCQRMXYC+Y9HxB//8bM/p1Mc8jlk4qkbcAzrzyLi/tj45kZ+z/U/Sa9/g+/eQ77jmm9226ze2G58z+KLdv+BXvpnOv75zv7x39WtocVQ9nfP+Gco3+bcPYp3n/+5lx02PcC16d3S8d/3drzbtj3+23ppbayvGftCNuYbSB48LJfSa9sXI2IiBvJpfCpL2n48NvHmszed8t85/vv4tz//U5p/Ot9OkXvZn4964728RlvMztRmTqLuqdfPIq72t6t/sjX+TTqMf+923OvupvnRd3/5h04p0/qn9W1N++t/uurPI77etv232zLp+n7iZNYdJludoo2/ffD7kU75b7d/Ppun+bf+FzgLafuPdK//WBqqrqzOz5TLpaXq4fP47/PRf3Vat7P/t69/1v93Sfv/YPLTLNzqaU9marWlqYjB5Mf7l9/Y3rYVb6VP6z/xtfbnf6f+n2u+G3t/K9Zd/6vBvzR31bb+mfVO9e82wjq+tP6zh2r/VqB1NLaXVOvNbfYkfvF2vq9T/gdr/+ksNNFccpDr386Sdgsc6aABAAAAAAAAAAAAAAAAAAAAAAAAwCHlIuJyJLnCVjiXKxQav+H95RjJlSvV2rUHleXF2ch+K3ssBnKtr7oc3fF9qFPN78NvxW/siX8rIr4UEb/LD2fxQrFSnu115QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg6dLu3/9/ms4Khca6D/O9Lh0AcGqGel0AAODMuf8DwMVzuPv/8KmVAwA4O4f+/7+enE5BAIAzc+D7//3TLQcAcHY8/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCU3b1zJ53qn26sFdP47OOV5fnK4+uzpep8YWG5WChWlh4V5iqVuXKpUKwsdNzRemNWrlQeTcfi8pPJWqlam6yurN5bqCwv1u49XJiZK90rDZxZzQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg4Korq/Mz5XJpSaBLYLg0fB6KcY4C/XEuirEvsP7/gaxfd00cY+9N5x/skiY5ybyG9y7ZeZUY7sm1CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOB98HkAAAD//yofFO0=") bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000003480)='./file1\x00', 0x80042, 0x121) mount(0x0, &(0x7f0000003500)='./proc\x00', &(0x7f0000003540)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000003580)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write$cgroup_int(r2, &(0x7f00000035c0)=0x8, 0x12) getsockname$packet(r0, 0x0, 0x0) pwrite64(r1, &(0x7f0000003600)='\"', 0xe7d, 0xe7c) 3m12.393163075s ago: executing program 9 (id=1379): bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000380), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) r1 = syz_open_dev$hidraw(&(0x7f0000000500), 0x0, 0xbb42) ioctl$HIDIOCGFEATURE(r1, 0xc0404807, &(0x7f0000000540)={0x5, "1f7f67491b5a90eeaddb94a4031a82687063ba6e44f7b91d902d0008424ad04b9634bef178be4ba64223a1d6da6d232b4ea6a453724e5a9c45a204ec36715596"}) write$UHID_GET_REPORT_REPLY(r0, &(0x7f00000005c0)={0xa, {0x1, 0x3, 0xff}}, 0x5) 3m12.207987194s ago: executing program 9 (id=1380): syz_mount_image$ext4(&(0x7f0000000a00)='ext4\x00', &(0x7f0000000a40)='./file0\x00', 0x1810714, &(0x7f0000000a80)={[{@test_dummy_encryption}, {@init_itable_val}, {@dioread_nolock}, {@resuid}, {@nojournal_checksum}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0xa18}}, {@errors_remount}, {@lazytime}, {@test_dummy_encryption}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}, {@nogrpid}]}, 0xdf, 0x475, &(0x7f0000000b80)="$eJzs289vFFUcAPDvTLeAgGxFREGQKpo0/mhpQeVgYjSaeNDERA94rG0hyEINrYmQRqsxeDQk3o1HE/8CT56MejLxikcTQ0KUmIheXDO7M6VddssubNna/XySoe/NvHk/dubNvn2PCaBvDWf/JBHbI+JSRJTr0ZUJhut/rl1dmPr76sJUEtXqG78ntXR/XV2YquaK87bleY6kEeknSV5IDC7Pdu7c+VOTlcrM2Tw+Nn/63bG5c+efOnl68sTMiZkzE0ePHjk8/uwzE083qfWvFztq5ED+d+8Hs/v2vPLWxdemjl18+4evs/ru3l8/lLWjozzbMJw1/I/6Z9N47LFuF9Zj/1avtzMp9bo2tCvrGqW8c16KcgzE9YtXjpc/7mnlgDWVPbM3tz68WAU2sCR6XQOgN4ov+uz3b7HdoaHHunDlhfoPoKzd1/KtfqQUaZ5mcA3LH46IY4v/fJFt0TAPUW0ybwAAcLu+zcY/TzYb/6Wxe1m6Hfna0FBE3BMROyPi3ojYFRH3RdTS3h8RD3RY/nBD/MbxZ3r5lhrWpmz891y+trVy/FeM/mJoII/dXWv/YHL8ZGXmUP6ZjMTg5iw+3izzIouXfv6sVfnLx3/ZlpVfjAXzTC6X6hN0W4o905Pzk90alF75KGJvqVn7k6WVgCQi9kTE3s6y3lEETj7+1b5WiW7e/lV0YZ2p+mWRycJiNLS/kKy+Pjm2JSozh8aKu+JGP/504fVW5d9W+7sgu/5bV97/DSnKfybL12vnlg48324ZF375tOVvylL79/+S7P7flLxZW7PelO97f3J+/ux4xKbk1Vp8xf6J6+cW8SJ91v6Rg837/878nKz9D0ZEdhPvj4iHIuJAfu0ejohHIuLgKu3//sVH32l1bD1c/+mmz7+l+39o5fXvPDBw6rtvWpXf3vPvSC00ku+pPf9uonV1isdotufY3K1+bgAAAPB/kkbE9kjS0aVwmo6O1v8P/67YmlZm5+afOD773pnp+jsCQzGYFjNd5WXzoePJYp5jPT6RzxUXxw/n88afD9xVi49OzVame9x26HfbWvT/zG8Dva4dsOa8rwX9q7H/pz2qB3Dn+f6H/qX/Q/+6of97IEDfaNbdP2yIWwuAjaha7vgUE4SwYRjuQ//S/6F/6f/Ql27nvf61CpRWeXtfoMeBrRFRC0S6LuqzbgIH1lFvKnWhd/f4wQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAl/wUAAP//xgL2dQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x10) 3m12.207763444s ago: executing program 9 (id=1381): r0 = socket$inet_sctp(0x2, 0x1, 0x84) close(0x3) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f00000000c0)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000180)=0x84) sendmmsg$inet_sctp(r1, &(0x7f00000001c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000001f40)={0x0, 0x4}, 0x8) 3m11.897091196s ago: executing program 9 (id=1390): setns(0xc9, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6}]}}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) 3m11.897013596s ago: executing program 38 (id=1390): setns(0xc9, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6}]}}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) 3m8.768752745s ago: executing program 2 (id=1441): r0 = syz_open_procfs(0x0, 0x0) r1 = openat(r0, &(0x7f0000000440)='auth.unix.ip/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000480)='nf ::7.0.0.1 2\\000000\\00l\\calhost\n', 0x24) 3m8.747522277s ago: executing program 2 (id=1442): mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='27', 0x2) umount2(0x0, 0x1) r1 = shmget$private(0x0, 0x800000, 0x54003f00, &(0x7f0000800000/0x800000)=nil) shmat(r1, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000007, 0x20031, 0xffffffffffffffff, 0xffffe000) mbind(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x8, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x24}}, 0x0) timer_create(0x1, &(0x7f0000000840)={0x0, 0x21, 0x4}, 0x0) 3m8.747090837s ago: executing program 2 (id=1443): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100', 0x3) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000680), 0x40a01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) socket$inet6(0xa, 0x3, 0xff) lsetxattr$security_evm(0x0, 0x0, 0x0, 0x0, 0x0) socket$kcm(0x2, 0xa, 0x2) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000006c0)={{0x1, 0x1, 0x18, r1}, './proc\x00'}) openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x10, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}, @uuid={'LVM-syz', 0x0, '2\x00'}}}) 3m8.734374038s ago: executing program 2 (id=1444): r0 = syz_mount_image$ext4(&(0x7f0000002bc0)='ext4\x00', &(0x7f0000002c00)='./file2\x00', 0x2000410, &(0x7f0000002c40)={[{@noinit_itable}, {@jqfmt_vfsv1}]}, 0xc1, 0x7eb, &(0x7f0000002c80)="$eJzs3ctrG9sdAODfyA/ZTlq7UGiTlaHQGkLkOnWTFrpI6aIUGgi06yZGVkxq2QqWHGJjiLModFNoSxeFdpN1H+mi0G0f2/afKHdxSQj3Oubmri66zEjyU1L8loO/D8ZzzsyZOefMOTNzrBmkAC6s8fRPLuJKRPw6iRhtLk8iYiAL9UfcbqR7u7FWTKck6vWffJRkaf5+aXtfSXN+qRn5akT8+xcR13J7cx1uzsulpWZosrbwaLK6snr94cLMXGmutHhzanr6xq1v37q5f6uj+uR/q5df/eaH3/jr7f74yotf/SeJ23G5uW5zY614zN3vMx7jzWMykB7CXX5w0pn1WNLrAnAk6anZ1zjL40qMRl8W6uC4JyAAcC48jYg6AHDBJO7/AHDBtD4H2NxYK7am3n4icbZefz8ihhr1bz3fbKzpbz6zG8qeg45sJruejCQRMXYC+Y9HxB//8bM/p1Mc8jlk4qkbcAzrzyLi/tj45kZ+z/U/Sa9/g+/eQ77jmm9226ze2G58z+KLdv+BXvpnOv75zv7x39WtocVQ9nfP+Gco3+bcPYp3n/+5lx02PcC16d3S8d/3drzbtj3+23ppbayvGftCNuYbSB48LJfSa9sXI2IiBvJpfCpL2n48NvHmszed8t85/vv4tz//U5p/Ot9OkXvZn4964728RlvMztRmTqLuqdfPIq72t6t/sjX+TTqMf+923OvupvnRd3/5h04p0/qn9W1N++t/uurPI77etv232zLp+n7iZNYdJludoo2/ffD7kU75b7d/Ppun+bf+FzgLafuPdK//WBqqrqzOz5TLpaXq4fP47/PRf3Vat7P/t69/1v93Sfv/YPLTLNzqaU9marWlqYjB5Mf7l9/Y3rYVb6VP6z/xtfbnf6f+n2u+G3t/K9Zd/6vBvzR31bb+mfVO9e82wjq+tP6zh2r/VqB1NLaXVOvNbfYkfvF2vq9T/gdr/+ksNNFccpDr386Sdgsc6aABAAAAAAAAAAAAAAAAAAAAAAAAwCHlIuJyJLnCVjiXKxQav+H95RjJlSvV2rUHleXF2ch+K3ssBnKtr7oc3fF9qFPN78NvxW/siX8rIr4UEb/LD2fxQrFSnu115QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg6dLu3/9/ms4Khca6D/O9Lh0AcGqGel0AAODMuf8DwMVzuPv/8KmVAwA4O4f+/7+enE5BAIAzc+D7//3TLQcAcHY8/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCU3b1zJ53qn26sFdP47OOV5fnK4+uzpep8YWG5WChWlh4V5iqVuXKpUKwsdNzRemNWrlQeTcfi8pPJWqlam6yurN5bqCwv1u49XJiZK90rDZxZzQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg4Korq/Mz5XJpSaBLYLg0fB6KcY4C/XEuirEvsP7/gaxfd00cY+9N5x/skiY5ybyG9y7ZeZUY7sm1CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOB98HkAAAD//yofFO0=") bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000034c0)='./proc\x00', 0x4) mount(0x0, &(0x7f0000003500)='./proc\x00', &(0x7f0000003540)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000003580)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write$cgroup_int(r1, &(0x7f00000035c0)=0x8, 0x12) getsockname$packet(r0, 0x0, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000003600)='\"', 0xe7d, 0xe7c) 3m8.649383277s ago: executing program 2 (id=1445): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='100', 0x3) openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x40241, 0x0) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x82) socket$packet(0x11, 0x2, 0x300) fchdir(r2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) 3m8.454124677s ago: executing program 2 (id=1446): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='27', 0x2) umount2(0x0, 0x1) r1 = shmget$private(0x0, 0x800000, 0x54003f00, &(0x7f0000800000/0x800000)=nil) shmat(r1, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000007, 0x20031, 0xffffffffffffffff, 0xffffe000) mremap(&(0x7f0000ff6000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffc000/0x1000)=nil) mbind(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x8, 0x2) mbind(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x7f, 0x3) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x24}}, 0x0) timer_create(0x1, &(0x7f0000000840)={0x0, 0x21, 0x4}, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f00000008c0)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) 3m8.448673917s ago: executing program 39 (id=1446): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='27', 0x2) umount2(0x0, 0x1) r1 = shmget$private(0x0, 0x800000, 0x54003f00, &(0x7f0000800000/0x800000)=nil) shmat(r1, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000007, 0x20031, 0xffffffffffffffff, 0xffffe000) mremap(&(0x7f0000ff6000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffc000/0x1000)=nil) mbind(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x8, 0x2) mbind(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x7f, 0x3) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x24}}, 0x0) timer_create(0x1, &(0x7f0000000840)={0x0, 0x21, 0x4}, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f00000008c0)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) 6.225311504s ago: executing program 0 (id=5488): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)={0x14, r1, 0x303, 0x40000, 0x25dfdbfd, {0x3d}}, 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x4000000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) 3.254840298s ago: executing program 0 (id=5591): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010029bd7000fedbdf25170000004800068008000600000000003c0004"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4000800) 3.197255293s ago: executing program 0 (id=5595): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r0, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000700)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x1, 0x8, 0x1014}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x16, 0x11, &(0x7f0000000b00)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000fbffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000ed008500000082000000", @ANYRES32=r1, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={r3, 0x0, 0xe, 0x0, &(0x7f0000000c80)='\x00'/14, 0x0, 0x80000004, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.12881782s ago: executing program 0 (id=5599): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abf7001ffdbdf251400000018000180140002006e657464657673696d3000000000f20705000c0022ffffff0500"], 0x3c}, 0x1, 0x0, 0x0, 0x4920}, 0x44860) 3.107874242s ago: executing program 0 (id=5600): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000006c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f00000008c0), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000900)={0x0, 0x15, &(0x7f0000000940)={&(0x7f0000000980)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, 0x0, 0x0) 3.042789149s ago: executing program 7 (id=5602): io_setup(0x8f0, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000040)=0x1, 0x4) bind$inet(r0, 0x0, 0x0) sendmmsg$inet(r0, &(0x7f00000000c0)=[{{&(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000180)="b9", 0x1}], 0x1}}], 0x1, 0x20008080) io_submit(0x0, 0x1, &(0x7f00000001c0)=[&(0x7f0000000200)={0x2002000000, 0x4, 0x0, 0x1, 0x0, r0, &(0x7f0000000240), 0x0, 0x0, 0x0, 0x2}]) 3.010962672s ago: executing program 7 (id=5604): r0 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f0000000280)={'/sys/block/md', @num=0x0, '/md/', @array='new_dev\x00'}, 0x1, 0x0) write$md_sysfs(r0, &(0x7f00000000c0)=@str='1', 0x1) 2.973944386s ago: executing program 5 (id=5606): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x1, 0x5}, 0x8) 2.973692886s ago: executing program 7 (id=5607): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000680)=@mangle={'mangle\x00', 0x2, 0x6, 0x608, 0x0, 0x440, 0x350, 0x440, 0x0, 0x560, 0x560, 0x560, 0x560, 0x560, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [0xffffff00], [], 'wg2\x00', 'macvtap0\x00', {}, {}, 0x21}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x18}, @local, @private2}}, @common=@inet=@multiport={{0x50}, {0x40}}]}, @HL={0x28}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x2a}, @dev, [], [], 'veth1_macvtap\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x5, 0x0, 0x52}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x2, 0xf}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'netdevsim0\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0, 0x48000000}, @HL={0x28, 'HL\x00', 0x0, {0x3}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@loopback, 0xfc}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x5}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x668) 2.973614706s ago: executing program 5 (id=5608): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fedbdf25170000004800068008000600000000003c0004"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4000800) 2.973282916s ago: executing program 7 (id=5609): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r2) getsockname$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x24, r1, 0x1, 0x70bd2c, 0xe, {}, [@GTPA_LINK={0x8, 0x1, r3}, @GTPA_VERSION={0x8, 0x2, 0x8}]}, 0x24}}, 0x20004000) 2.962391647s ago: executing program 5 (id=5610): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r0, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000700)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x1, 0x8, 0x1014}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x16, 0x11, &(0x7f0000000b00)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000fbffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000ed008500000082000000", @ANYRES32=r1, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={r3, 0x0, 0xe, 0x0, &(0x7f0000000c80)='\x00'/14, 0x0, 0x80000004, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.907037653s ago: executing program 5 (id=5611): syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x200000, &(0x7f0000000600)={[{@bsdgroups}, {@nobarrier}, {@noinit_itable}]}, 0xfc, 0x574, &(0x7f0000000640)="$eJzs3c9rHFUcAPDvbJI2/aFJoRT1IIEerNRumsQfFTzUk4gWC3qvS7INJZtuyW5KEwu2B3vxIkUQsSB69+6x+A/4VxS0UKQEPXiJzGY2XZPZNNlumm3384Fp35uZzZvvvvm+fbOzywbQt8bSfwoRL0fEN0nESMu2wcg2jq3tt/Lw+nS6JLG6+ulfSSTZuub+Sfb/oazyUkT89lXEycLmdmtLy3OlSqW8kNXH6/NXxmtLy6cuzZdmy7Ply5NTU2fempp89523uxbr6+f/+f6Tux+e+fr4yne/3D9yO4mzcTjb1hrHE7jRWhmLsew5GYqzG3ac6EJjvSTZ6wOgIwNZng9FOgaMxECW9blWR57moQG77Ms0rYE+lch/6FPNeUDz2r5L18HPjAfvr10AbY5/cO29kRhuXBsdXEn+d2WUXu+OdqH9tI1f/7xzO12i3fsQ+7vQEMAGN25GxOnBwc3jX5KNf507vY19NrbRb68/sJfupvOfN/LmP4X1+U/kzH8O5eRuJx6f/4X7XWimrXT+917u/Hf9ptXoQFZ7oTHnG0ouXqqU07HtxYg4EUP70/pERHyQfxPk88LKvdV27bfO/9Ilbb85F8yO4/7ghvnfTKleevLI1zy4GfFK7vw3We//JKf/0+fj/DbbOFa+82q7bY+Pf3et/hTxWm7/P+rMZOv7k+ON82G8eVZs9vetY7+3a3+v40/7/+DW8Y8mrfdraztv48fhf8vttnV6/u9LPmuU92XrrpXq9YWJiH3Jx5vXTz56bLPe3D+N/8Txrce/vPP/QJrY24z/1tFbrbsO7yz+3ZXGP7Oj/t954d5HX/zQrv3t9f+bjdKJbM12xr/tHuCTPHcAAAAAAADQawoRcTiSQnG9XCgUi2uf7zgaBwuVaq1+8mJ18fJMNL4rOxpDhead7pGWz0NMZJ+HbdYnN9SnIuJIRHw7cKBRL05XKzN7HTwAAAAAAAAAAAAAAAAAAAD0iEMRw3nf/0/9MZD/mDargWfRFj/5DTzn2ud/tqUbv/QE9CSv/9C/5D/0L/kP/Uv+Q/+S/9C/5D/0L/kP/Wsn+f/zuV08EAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg+nD93Ll1WVx5en07rM1eXFueqV0/NlGtzxfnF6eJ0deFKcbZana2Ui9PV+cf9vUq1emViMhavjdfLtfp4bWn5wnx18XL9wqX50mz5QnnoqUQFAAAAAAAAAAAAAAAAAAAAz5ba0vJcqVIpLygodFQY7I3D6MFCoTcOo8PCXo9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDIfwEAAP//wGE62g==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000bc0)='./file1\x00', 0x143042, 0x0) pwritev2(r0, &(0x7f0000000c00)=[{&(0x7f0000000c40)="8c84da23bbe1666437c4bf0a73597c75a093e9221ecfe7af80979fe095656e9760973d1666c9e208a356f0395a40ae9fc28535c2240899578b2768e8cf1017f8951df03e90a878b890f8ac8a2c21d597619e4616ef254fbb16f7fafe75eed8a1b75fa5cdbd3c18a0e6ebec48d2d13a7f9b935975a21fb3257daabfc3338e811777d9f950a7c1331b9fed85e4aa9ba0ade2fe3ce724d014104ffece664703ab47138774a1f4a737a403cf18fc5aeaf83b7299a0f224e3bc629f1484449ad123eea19a1aef692128003a54c554e696e3a7c6da223fe6fa34afa0197d66c5bbecde5412be0eed26cf8f184e230b05817280cec79abfe641e5f39b4bf9cb3bca1a61ba81930be847b91b33ad2199f6f848e686b40f2a60769a2eb1fabe600fcbdc1034b697e60ca4995654cf4fca6be97c44674173438949913ae9d79f2ccf4f8e365628b3cce51a6d3cfc640286c2b5c8d97a81a94dfe995eb957ecbe8dee4119c4dee21d4800db150ad67ffac00b697c94d753fdadfb7088f4140bbfbe8fdbfc33", 0x180}], 0x1, 0xe7b, 0x0, 0x86) r1 = openat(0xffffffffffffff9c, &(0x7f0000003340)='./file1\x00', 0x143042, 0x0) sendfile(r1, r1, 0x0, 0x7a680000) 2.906089443s ago: executing program 5 (id=5613): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000240), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x60, r4, 0x405, 0x70bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r5}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x4c004) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f00000003c0)={'team0\x00', 0x0}) socket(0x1d, 0x2, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x3c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000500)={0x0, 0xa1ff, &(0x7f0000000540)={&(0x7f0000000580)={0x34, r1, 0x1, 0x0, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x0) 2.458650288s ago: executing program 4 (id=5625): syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x200000, &(0x7f0000000600)={[{@bsdgroups}, {@nobarrier}, {@noinit_itable}]}, 0xfc, 0x574, &(0x7f0000000640)="$eJzs3c9rHFUcAPDvbJI2/aFJoRT1IIEerNRumsQfFTzUk4gWC3qvS7INJZtuyW5KEwu2B3vxIkUQsSB69+6x+A/4VxS0UKQEPXiJzGY2XZPZNNlumm3384Fp35uZzZvvvvm+fbOzywbQt8bSfwoRL0fEN0nESMu2wcg2jq3tt/Lw+nS6JLG6+ulfSSTZuub+Sfb/oazyUkT89lXEycLmdmtLy3OlSqW8kNXH6/NXxmtLy6cuzZdmy7Ply5NTU2fempp89523uxbr6+f/+f6Tux+e+fr4yne/3D9yO4mzcTjb1hrHE7jRWhmLsew5GYqzG3ac6EJjvSTZ6wOgIwNZng9FOgaMxECW9blWR57moQG77Ms0rYE+lch/6FPNeUDz2r5L18HPjAfvr10AbY5/cO29kRhuXBsdXEn+d2WUXu+OdqH9tI1f/7xzO12i3fsQ+7vQEMAGN25GxOnBwc3jX5KNf507vY19NrbRb68/sJfupvOfN/LmP4X1+U/kzH8O5eRuJx6f/4X7XWimrXT+917u/Hf9ptXoQFZ7oTHnG0ouXqqU07HtxYg4EUP70/pERHyQfxPk88LKvdV27bfO/9Ilbb85F8yO4/7ghvnfTKleevLI1zy4GfFK7vw3We//JKf/0+fj/DbbOFa+82q7bY+Pf3et/hTxWm7/P+rMZOv7k+ON82G8eVZs9vetY7+3a3+v40/7/+DW8Y8mrfdraztv48fhf8vttnV6/u9LPmuU92XrrpXq9YWJiH3Jx5vXTz56bLPe3D+N/8Txrce/vPP/QJrY24z/1tFbrbsO7yz+3ZXGP7Oj/t954d5HX/zQrv3t9f+bjdKJbM12xr/tHuCTPHcAAAAAAADQawoRcTiSQnG9XCgUi2uf7zgaBwuVaq1+8mJ18fJMNL4rOxpDhead7pGWz0NMZJ+HbdYnN9SnIuJIRHw7cKBRL05XKzN7HTwAAAAAAAAAAAAAAAAAAAD0iEMRw3nf/0/9MZD/mDargWfRFj/5DTzn2ud/tqUbv/QE9CSv/9C/5D/0L/kP/Uv+Q/+S/9C/5D/0L/kP/Wsn+f/zuV08EAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg+nD93Ll1WVx5en07rM1eXFueqV0/NlGtzxfnF6eJ0deFKcbZana2Ui9PV+cf9vUq1emViMhavjdfLtfp4bWn5wnx18XL9wqX50mz5QnnoqUQFAAAAAAAAAAAAAAAAAAAAz5ba0vJcqVIpLygodFQY7I3D6MFCoTcOo8PCXo9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDIfwEAAP//wGE62g==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000bc0)='./file1\x00', 0x143042, 0x0) pwritev2(r0, &(0x7f0000000c00)=[{&(0x7f0000000c40)="8c84da23bbe1666437c4bf0a73597c75a093e9221ecfe7af80979fe095656e9760973d1666c9e208a356f0395a40ae9fc28535c2240899578b2768e8cf1017f8951df03e90a878b890f8ac8a2c21d597619e4616ef254fbb16f7fafe75eed8a1b75fa5cdbd3c18a0e6ebec48d2d13a7f9b935975a21fb3257daabfc3338e811777d9f950a7c1331b9fed85e4aa9ba0ade2fe3ce724d014104ffece664703ab47138774a1f4a737a403cf18fc5aeaf83b7299a0f224e3bc629f1484449ad123eea19a1aef692128003a54c554e696e3a7c6da223fe6fa34afa0197d66c5bbecde5412be0eed26cf8f184e230b05817280cec79abfe641e5f39b4bf9cb3bca1a61ba81930be847b91b33ad2199f6f848e686b40f2a60769a2eb1fabe600fcbdc1034b697e60ca4995654cf4fca6be97c44674173438949913ae9d79f2ccf4f8e365628b3cce51a6d3cfc640286c2b5c8d97a81a94dfe995eb957ecbe8dee4119c4dee21d4800db150ad67ffac00b697c94d753fdadfb7088f4140bbfbe8fdbfc33", 0x180}], 0x1, 0xe7b, 0x0, 0x86) r1 = openat(0xffffffffffffff9c, &(0x7f0000003340)='./file1\x00', 0x143042, 0x0) sendfile(r1, r1, 0x0, 0x7a680000) 2.44507085s ago: executing program 4 (id=5627): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000005f00)={0x10, 0x0, 0x25dfdbfe, 0x2ffffffff}, 0xc) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x3c1, 0x3, 0x388, 0x1f8, 0xc8, 0x8, 0x1f8, 0x5803, 0x2e0, 0x2e8, 0x2e8, 0x2e0, 0x2e8, 0x3, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x22}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff, 0x0, 0xff, 0xff000000], [0xff, 0xffffff00, 0x0, 0xff], 'dvmrp0\x00', 'batadv0\x00', {}, {}, 0x3a, 0xbb, 0x6, 0x20}, 0x0, 0x168, 0x1d0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0xea, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1, 0x1}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0xe, 0x3, 0x21, '\x00', 'syz1\x00', {0xffffffffffff8001}}}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, [0xff000000, 0xffffff00, 0xffffff00, 0xffffffff], [0xffffff00, 0x0, 0xff000000, 0xffffffff], 'bridge0\x00', 'veth0_to_bond\x00', {}, {}, 0x3c, 0x8, 0x0, 0x8}, 0x0, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x4, {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) 2.280395947s ago: executing program 4 (id=5631): openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x40042, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000400)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000440)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000540), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000580), 0x4000087, 0x2, 0x0) unshare(0x62000000) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x8, 0x3, 0x370, 0x238, 0x11, 0x148, 0x238, 0x0, 0x2d8, 0x2a8, 0x2a8, 0x2d8, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1f0, 0x238, 0x0, {}, [@common=@inet=@socket2={{0x28}}, @common=@inet=@hashlimit3={{0x158}, {'bridge0\x00', {0x6, 0x6, 0x40, 0x6, 0x0, 0x3, 0x5, 0x8, 0x0, 0x20}, {0x5}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0xfffffffe}}}, {{@ip={@multicast2, @remote, 0x0, 0x0, 'vlan0\x00', 'macvlan1\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3d0) 819.562176ms ago: executing program 4 (id=5646): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="01002abf7001ffdbdf251400000018000180140002006e657464657673696d3000000000f20705000c0022ffffff050018"], 0x3c}, 0x1, 0x0, 0x0, 0x4920}, 0x44860) 791.950769ms ago: executing program 1 (id=5648): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$BLKALIGNOFF(0xffffffffffffffff, 0x127a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001440)=0x3) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001480), 0x123000, 0x0) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f00000014c0)=0x1) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, 0x0) 737.292815ms ago: executing program 1 (id=5649): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x2, 0x0, 0x1}}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x7}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newqdisc={0x6c, 0x24, 0x41f, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}]}}]}, 0x6c}}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f00000006c0)={'syzkaller0\x00', 0x1}) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000700)='syzkaller0\x00', 0xb) sendto$inet(r6, 0x0, 0x0, 0x0, &(0x7f0000000740)={0x2, 0x4e20, @loopback}, 0x10) 722.478766ms ago: executing program 1 (id=5650): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000000)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000100)='l', 0x1, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)='|Z', 0x2, 0x4010, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000200)="87", 0x1, 0x20004000, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000280)='<', 0x1, 0x24044010, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000240), 0x8) 709.302317ms ago: executing program 1 (id=5651): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$inet6(r0, 0x0, 0x48043) r1 = socket$inet_tcp(0x2, 0x1, 0x0) close(r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000240)={0xa, 0x4e22, 0xd, @loopback, 0xa}, 0x1c) connect$inet6(r2, &(0x7f0000000680)={0xa, 0x4e22, 0x20, @loopback, 0x23}, 0x1c) setsockopt$inet6_int(r2, 0x29, 0xb, &(0x7f00000006c0)=0x7fff, 0x4) sendto$inet(r1, &(0x7f0000000700)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r1, &(0x7f00000008c0)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 653.385833ms ago: executing program 1 (id=5652): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newlink={0x20, 0x10, 0x401, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x190, 0x5230}}, 0x20}}, 0x0) setns(0xc9, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x10f) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000000240), 0x12) listen(r1, 0x1) write$tun(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="000008050000010b007e0b0a43b820a8e8c9881db642"], 0x97) 653.119033ms ago: executing program 1 (id=5653): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x210000, &(0x7f0000000100), 0xfc, 0x56f, &(0x7f0000000300)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") prlimit64(0x0, 0xe, &(0x7f0000000880)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000008c0)=0x8) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./bus\x00', 0x40, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./bus\x00', 0x1c1002, 0x12) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) write(r1, &(0x7f0000000980)="c7", 0x1) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7ffff000) 72.845482ms ago: executing program 7 (id=5654): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/printk_devkmsg\x00', 0x2, 0x0) pwritev2(r0, &(0x7f0000000200)=[{&(0x7f0000000240)='M', 0x1}], 0x1, 0x9, 0x20003, 0x10) 58.978783ms ago: executing program 5 (id=5655): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r0, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000700)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x1, 0x8, 0x1014}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x16, 0x11, &(0x7f0000000b00)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000fbffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000ed0085000000820000001811", @ANYRES32=r1, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={r3, 0x0, 0xe, 0x0, &(0x7f0000000c80)='\x00'/14, 0x0, 0x80000004, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 55.751224ms ago: executing program 4 (id=5656): mremap(&(0x7f00009a1000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000fef000/0x4000)=nil) 374.3µs ago: executing program 0 (id=5657): openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0xc0686611, &(0x7f00000001c0)=0xe8) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101801, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x2}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f00000000c0)=ANY=[], 0x128) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000100)=0x1) 170.56µs ago: executing program 4 (id=5658): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) sendmsg$802154_dgram(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="230000006d0200000300000022bf000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280), &(0x7f00000002c0), 0x401, r0, 0x0, 0xa002a0}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340), &(0x7f0000000380), 0x1, r0}, 0x38) 0s ago: executing program 7 (id=5659): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000100)=[@in={0x2, 0x4e24, @empty}], 0x10) sendmsg$inet6(r0, &(0x7f0000000140)={&(0x7f0000000180)={0xa, 0x4e24, 0x0, @loopback, 0x4}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000280)="dc", 0x1}], 0x1}, 0x48843) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000002c0)={0x0, 0x5, 0x10}, 0xc) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000300)='ip6gretap0\x00', 0x10) write$P9_RLOPEN(r1, &(0x7f0000000b00)={0x18, 0xd, 0x2, {{0x20, 0x3, 0x2}, 0x4}}, 0x18) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000bc0)={'#! ', './file0', [], 0xa, "5775ebb77549afc496bc5cc558c52be63e203db628daa190b16cc7216b9bfb1b0bd22d03f5e1cd7a3da150be3434e1d6c83af706cea87fffe560d236a8c26a760289f80eaa398ae77b0d26197822dd25b01733bd602efae482eced2ed31ee6ce67c841c25dfefcd739990462ff3626423e0e3ba7a4d4a86469f8cf3ac3d81d4f63be7d17a6caf4a8b071298bc35fdea671ea0025460ccfed3040fe1945a0d089bba38204ca6631e158a7717cf420623fad22082e3ae1b8e38748772095513a3f5028fb76790ef01caab610421c1ae48ffd68b5aefd4f399b8d28edddd9dde0d8afa1fd2df0d8c6ebbcf9493daea96589ee90969516953c83d70124dc91b26e3287986fdc096eda61a819b88e28facf71a064600e69747ab08f0379afde05c2b558f6058e2ef5c3a36ab3171bd99960ebb980380b7f76f8fce6987cf5eafb1384cefd64e1d214b14cff8f9ae739db32fb1e54d01856a3b277c3f02aeebe7f58f0708f4487afe3674a0a412461a9de083979f9c380a9336893f77c19f740aed24764a0165a52fa2d8152bb55f49fe1c1a52977f9244fdf648ef55acdbaab7827a33e5c66592b97b2b4ccf4d642d75a23a0bf43cb9dd6d4156cc58636f4d68d0370d827d0c6a0b0a3fb818e36d6716a49ec3bac8da32f9a8bd74c499768a4c62822d018ef9f7982ddf15e655670f9cec0162460e4b9a83a5f1cfd99dcb5dfe680039d9b9ee28132545ce12ff1f32c6ecf9181688260da9d4d610567eacf0c399e85c974fc752333c7d0ac1ba8e0213f07884fc77b0ba82aa058e596f04b7d44b409cd4a1fab3b3c0d4217493196f62e2cf9e4d9834e7f966ca42b76100ef5f6fa89700a0b4661056849331fb583b3e9659711ae466c61507319b7d1638ffca5f9130ca7fdb86276ada534473b4d2c21859a825ba6e502d2f912e224f1fdb70a57c42e2185a45edac6e09c1c7446dc889dd8ba711ac687257b35a1b923a960be298b680106299cd3ac4e06cae9352bfdd0427e13ce759b48140df351c8f9ae8fb9acabb9c3346e23433c4875d45ac7836d990cd13d35ac48700e315d7e9b11ca587cb9a764af1fda1bb8c36f15d1d642252e26a5c9d9c33a16dca4584f864467ad20b97ddffc6fcbbaf71716aa07e9f0c99bee7e22fac55dcf54f99af981bd0217b72a4cf46ce46f165d512fd49ff4e3cea29a63e0354177bfe5433b25c3496461b39153b68cbc5af714bde4043909c4679aedd01875badbb6f74cadcf9488769ebe8e173c746225f3decccfed3d295d90b29444b27c2e5a72943eb03d254940a65398e63d78f9b41ef8a17c0c2bd8e9057619ff39dc47105189d0c70a32c535790e68fff9c9a9ef708576c51bcc8868f8a2842b82af5c0466a3cb1fc229e3fd4434e2956d206fc8ca66c8494567db7034e223a4dd1313d3b2399616307fd3ef"}, 0x409) kernel console output (not intermixed with test programs): devsim0 [ 265.170245][T16583] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 265.172283][T16583] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 265.172602][T16583] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 265.173124][T16762] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=16762 comm=syz.0.4631 [ 265.203953][ T29] audit: type=1400 audit(1793623560.436:1392): avc: denied { write } for pid=16749 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 265.239276][ T29] audit: type=1400 audit(1793623560.466:1393): avc: denied { write } for pid=16769 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 265.268486][T16583] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 265.268931][T16583] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 265.271706][T16583] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 265.370047][T16795] loop0: detected capacity change from 0 to 512 [ 265.372234][T16583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 265.373674][T16795] EXT4-fs error (device loop0): ext4_orphan_get:1404: inode #15: comm syz.0.4637: inode has both inline data and extents flags [ 265.373702][T16795] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 265.373824][T16795] EXT4-fs error (device loop0): ext4_orphan_get:1409: comm syz.0.4637: couldn't read orphan inode 15 (err -117) [ 265.373850][T16795] loop0: lost filesystem error report for type 5 error -117 [ 265.380468][T16583] 8021q: adding VLAN 0 to HW filter on device team0 [ 265.382691][ T618] bridge0: port 1(bridge_slave_0) entered blocking state [ 265.382754][ T618] bridge0: port 1(bridge_slave_0) entered forwarding state [ 265.386362][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 265.386394][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 265.432892][T16795] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 265.480634][T13098] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 265.552895][T16817] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=16817 comm=syz.0.4641 [ 265.558730][T16816] syzkaller0: entered promiscuous mode [ 265.558750][T16816] syzkaller0: entered allmulticast mode [ 265.612301][T16825] bridge0: port 1(syz_tun) entered blocking state [ 265.612332][T16825] bridge0: port 1(syz_tun) entered disabled state [ 265.612473][T16825] syz_tun: entered allmulticast mode [ 265.613085][T16825] syz_tun: entered promiscuous mode [ 265.615583][T16825] bridge0: port 1(syz_tun) entered blocking state [ 265.615617][T16825] bridge0: port 1(syz_tun) entered forwarding state [ 265.633578][T16583] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 265.832800][T16870] loop0: detected capacity change from 0 to 512 [ 265.845490][T16870] EXT4-fs error (device loop0): ext4_orphan_get:1404: inode #15: comm syz.0.4653: inode has both inline data and extents flags [ 265.845591][T16870] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 265.845736][T16870] EXT4-fs error (device loop0): ext4_orphan_get:1409: comm syz.0.4653: couldn't read orphan inode 15 (err -117) [ 265.845764][T16870] loop0: lost filesystem error report for type 5 error -117 [ 265.846321][T16870] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 265.871293][T16583] veth0_vlan: entered promiscuous mode [ 265.880349][T16583] veth1_vlan: entered promiscuous mode [ 265.900732][T16583] veth0_macvtap: entered promiscuous mode [ 265.903767][T16583] veth1_macvtap: entered promiscuous mode [ 265.915564][T16583] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 265.919945][T16583] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 265.925739][ T53] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.925846][ T53] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.925911][ T53] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.925944][ T53] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.927100][T16877] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=16877 comm=syz.5.4655 [ 265.983702][T13098] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 265.998459][T16879] syzkaller0: entered promiscuous mode [ 265.998478][T16879] syzkaller0: entered allmulticast mode [ 266.062145][T16889] FAULT_INJECTION: forcing a failure. [ 266.062145][T16889] name fail_futex, interval 1, probability 0, space 0, times 0 [ 266.062178][T16889] CPU: 1 UID: 0 PID: 16889 Comm: syz.0.4658 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 266.062283][T16889] Tainted: [W]=WARN [ 266.062291][T16889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 266.062371][T16889] Call Trace: [ 266.062383][T16889] [ 266.062392][T16889] __dump_stack+0x1d/0x30 [ 266.062416][T16889] dump_stack_lvl+0x95/0xd0 [ 266.062445][T16889] dump_stack+0x15/0x1b [ 266.062474][T16889] should_fail_ex+0x259/0x270 [ 266.062553][T16889] should_fail+0xb/0x20 [ 266.062575][T16889] get_futex_key+0x12c/0xc40 [ 266.062594][T16889] ? hrtimer_start_range_ns_common+0x4c5/0x7d0 [ 266.062631][T16889] futex_wake+0x89/0x400 [ 266.062727][T16889] do_futex+0x3f8/0x460 [ 266.062754][T16889] __se_sys_futex+0x2f6/0x370 [ 266.062831][T16889] __x64_sys_futex+0x78/0x90 [ 266.062853][T16889] x64_sys_call+0x22e2/0x2550 [ 266.062878][T16889] do_syscall_64+0x112/0x360 [ 266.062990][T16889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.063014][T16889] RIP: 0033:0x7f8efee3fb19 [ 266.063032][T16889] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 266.063107][T16889] RSP: 002b:00007f8efd8970e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 266.063131][T16889] RAX: ffffffffffffffda RBX: 00007f8eff0c5fa8 RCX: 00007f8efee3fb19 [ 266.063148][T16889] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f8eff0c5fac [ 266.063164][T16889] RBP: 00007f8eff0c5fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 266.063177][T16889] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 266.063199][T16889] R13: 00007f8eff0c6038 R14: 00007fff835e3670 R15: 00007fff835e3758 [ 266.063215][T16889] [ 266.101217][T16891] syz_tun: entered allmulticast mode [ 266.101624][T16891] syz_tun: left allmulticast mode [ 266.112767][T16889] bridge0: port 3(syz_tun) entered blocking state [ 266.112800][T16889] bridge0: port 3(syz_tun) entered disabled state [ 266.112895][T16889] syz_tun: entered allmulticast mode [ 266.114919][T16889] syz_tun: entered promiscuous mode [ 266.115132][T16889] bridge0: port 3(syz_tun) entered blocking state [ 266.115162][T16889] bridge0: port 3(syz_tun) entered forwarding state [ 266.176296][ T7722] bridge0: port 1(syz_tun) entered disabled state [ 266.187958][ T7722] syz_tun (unregistering): left allmulticast mode [ 266.187978][ T7722] syz_tun (unregistering): left promiscuous mode [ 266.188027][ T7722] bridge0: port 1(syz_tun) entered disabled state [ 266.353847][T16915] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=16915 comm=syz.7.4666 [ 266.387590][T16919] loop7: detected capacity change from 0 to 512 [ 266.401445][T16899] rxe_eth0 speed is unknown, defaulting to 1000 [ 266.402614][T16919] EXT4-fs error (device loop7): ext4_orphan_get:1404: inode #15: comm syz.7.4668: inode has both inline data and extents flags [ 266.402658][T16919] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 266.403231][ C0] EXT4-fs (loop7): error count since last fsck: 1 [ 266.403249][ C0] EXT4-fs (loop7): initial error at time 1793623561: ext4_orphan_get:1404: inode 15 [ 266.403278][ C0] EXT4-fs (loop7): last error at time 1793623561: ext4_orphan_get:1404: inode 15 [ 266.404803][T16919] EXT4-fs error (device loop7): ext4_orphan_get:1409: comm syz.7.4668: couldn't read orphan inode 15 (err -117) [ 266.404831][T16919] loop7: lost filesystem error report for type 5 error -117 [ 266.411863][T16919] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 266.438482][T16899] lo speed is unknown, defaulting to 1000 [ 266.508562][T16583] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 266.575573][T16933] FAULT_INJECTION: forcing a failure. [ 266.575573][T16933] name fail_futex, interval 1, probability 0, space 0, times 0 [ 266.575634][T16933] CPU: 1 UID: 0 PID: 16933 Comm: syz.4.4673 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 266.575668][T16933] Tainted: [W]=WARN [ 266.575676][T16933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 266.575733][T16933] Call Trace: [ 266.575740][T16933] [ 266.575747][T16933] __dump_stack+0x1d/0x30 [ 266.575809][T16933] dump_stack_lvl+0x95/0xd0 [ 266.575837][T16933] dump_stack+0x15/0x1b [ 266.575856][T16933] should_fail_ex+0x259/0x270 [ 266.575887][T16933] should_fail+0xb/0x20 [ 266.575983][T16933] get_futex_key+0x12c/0xc40 [ 266.576007][T16933] ? should_fail_ex+0xdb/0x270 [ 266.576035][T16933] ? should_failslab+0x8c/0xb0 [ 266.576111][T16933] futex_wake+0x89/0x400 [ 266.576137][T16933] ? selinux_file_alloc_security+0xaa/0xd0 [ 266.576161][T16933] do_futex+0x3f8/0x460 [ 266.576259][T16933] __se_sys_futex+0x2f6/0x370 [ 266.576289][T16933] __x64_sys_futex+0x78/0x90 [ 266.576381][T16933] x64_sys_call+0x22e2/0x2550 [ 266.576411][T16933] do_syscall_64+0x112/0x360 [ 266.576447][T16933] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.576532][T16933] RIP: 0033:0x7f5e83fdfb19 [ 266.576550][T16933] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 266.576570][T16933] RSP: 002b:00007f5e82a2f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 266.576629][T16933] RAX: ffffffffffffffda RBX: 00007f5e84265fa8 RCX: 00007f5e83fdfb19 [ 266.576646][T16933] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5e84265fac [ 266.576662][T16933] RBP: 00007f5e84265fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 266.576678][T16933] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 266.576692][T16933] R13: 00007f5e84266038 R14: 00007ffc178c1390 R15: 00007ffc178c1478 [ 266.576709][T16933] [ 266.582594][T16928] syzkaller0: entered promiscuous mode [ 266.582666][T16928] syzkaller0: entered allmulticast mode [ 266.640327][T16899] bridge0: port 1(bridge_slave_0) entered blocking state [ 266.640359][T16899] bridge0: port 1(bridge_slave_0) entered disabled state [ 266.640480][T16899] bridge_slave_0: entered allmulticast mode [ 266.642925][T16899] bridge_slave_0: entered promiscuous mode [ 266.647788][T16899] bridge0: port 2(bridge_slave_1) entered blocking state [ 266.647829][T16899] bridge0: port 2(bridge_slave_1) entered disabled state [ 266.648012][T16899] bridge_slave_1: entered allmulticast mode [ 266.648817][T16899] bridge_slave_1: entered promiscuous mode [ 266.649349][T16933] bridge0: port 1(syz_tun) entered blocking state [ 266.649402][T16933] bridge0: port 1(syz_tun) entered disabled state [ 266.649532][T16933] syz_tun: entered allmulticast mode [ 266.650041][T16933] syz_tun: entered promiscuous mode [ 266.650216][T16933] bridge0: port 1(syz_tun) entered blocking state [ 266.650245][T16933] bridge0: port 1(syz_tun) entered forwarding state [ 266.688951][T16899] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 266.690402][T16899] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 266.721761][T16899] team0: Port device team_slave_0 added [ 266.722647][T16899] team0: Port device team_slave_1 added [ 266.750197][T16899] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 266.750212][T16899] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 266.750241][T16899] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 266.750932][T16899] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 266.750944][T16899] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 266.751026][T16899] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 266.797998][T16899] hsr_slave_0: entered promiscuous mode [ 266.798388][T16899] hsr_slave_1: entered promiscuous mode [ 266.798598][T16899] debugfs: 'hsr0' already exists in 'hsr' [ 266.798610][T16899] Cannot create hsr debugfs directory [ 266.911627][T16949] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=16949 comm=syz.4.4679 [ 267.071939][T16899] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.087058][T16958] loop4: detected capacity change from 0 to 512 [ 267.093581][T16958] EXT4-fs error (device loop4): ext4_orphan_get:1404: inode #15: comm syz.4.4682: inode has both inline data and extents flags [ 267.093610][T16958] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 267.103236][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 267.103255][ C1] EXT4-fs (loop4): initial error at time 1793623562: ext4_orphan_get:1404: inode 15 [ 267.103285][ C1] EXT4-fs (loop4): last error at time 1793623562: ext4_orphan_get:1404: inode 15 [ 267.161717][T16958] EXT4-fs error (device loop4): ext4_orphan_get:1409: comm syz.4.4682: couldn't read orphan inode 15 (err -117) [ 267.161749][T16958] loop4: lost filesystem error report for type 5 error -117 [ 267.162079][T16958] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 267.211583][T14436] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 267.232887][T16899] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.297148][T16899] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.351990][T16899] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.435660][T16899] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 267.437359][T16899] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 267.437914][T16899] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 267.439850][T16899] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 267.440302][T16899] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 267.442313][T16899] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 267.442707][T16899] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 267.497946][T16899] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 267.540276][T16899] 8021q: adding VLAN 0 to HW filter on device bond0 [ 267.553633][T16899] 8021q: adding VLAN 0 to HW filter on device team0 [ 267.556263][ T618] bridge0: port 1(bridge_slave_0) entered blocking state [ 267.556299][ T618] bridge0: port 1(bridge_slave_0) entered forwarding state [ 267.560210][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 267.560244][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 267.720200][T16899] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 267.852442][T16899] veth0_vlan: entered promiscuous mode [ 267.861815][T16899] veth1_vlan: entered promiscuous mode [ 267.881054][T16899] veth0_macvtap: entered promiscuous mode [ 267.889505][T16899] veth1_macvtap: entered promiscuous mode [ 267.902732][T16899] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 267.916646][T16899] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 267.933847][ T53] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.938198][ T297] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.938233][ T297] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.938275][ T297] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.033014][T16994] ip_tables: iptables: counters copy to user failed while replacing table [ 268.149967][T17008] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=17008 comm=syz.0.4689 [ 268.206274][T17014] loop0: detected capacity change from 0 to 512 [ 268.219118][T17014] EXT4-fs error (device loop0): ext4_orphan_get:1404: inode #15: comm syz.0.4692: inode has both inline data and extents flags [ 268.219144][T17014] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 268.219238][T17014] EXT4-fs error (device loop0): ext4_orphan_get:1409: comm syz.0.4692: couldn't read orphan inode 15 (err -117) [ 268.219260][T17014] loop0: lost filesystem error report for type 5 error -117 [ 268.219559][T17014] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 268.307067][T13098] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 268.324279][T17017] FAULT_INJECTION: forcing a failure. [ 268.324279][T17017] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 268.324313][T17017] CPU: 1 UID: 0 PID: 17017 Comm: syz.5.4693 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 268.324347][T17017] Tainted: [W]=WARN [ 268.324354][T17017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 268.324440][T17017] Call Trace: [ 268.324445][T17017] [ 268.324453][T17017] __dump_stack+0x1d/0x30 [ 268.324482][T17017] dump_stack_lvl+0x95/0xd0 [ 268.324506][T17017] dump_stack+0x15/0x1b [ 268.324527][T17017] should_fail_ex+0x259/0x270 [ 268.324561][T17017] should_fail+0xb/0x20 [ 268.324597][T17017] should_fail_usercopy+0x1a/0x20 [ 268.324660][T17017] _copy_from_user+0x1c/0xb0 [ 268.324692][T17017] kstrtouint_from_user+0x69/0xf0 [ 268.324719][T17017] ? avc_policy_seqno+0x15/0x30 [ 268.324768][T17017] proc_fail_nth_write+0x50/0x160 [ 268.324796][T17017] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 268.324832][T17017] vfs_write+0x24f/0x990 [ 268.324866][T17017] ? __fget_files+0x184/0x1c0 [ 268.324963][T17017] ? mutex_lock+0x52/0x90 [ 268.324991][T17017] ksys_write+0xdc/0x1a0 [ 268.325043][T17017] __x64_sys_write+0x40/0x50 [ 268.325078][T17017] x64_sys_call+0x154e/0x2550 [ 268.325108][T17017] do_syscall_64+0x112/0x360 [ 268.325209][T17017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.325234][T17017] RIP: 0033:0x7f14a5fdfb19 [ 268.325253][T17017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 268.325274][T17017] RSP: 002b:00007f14a4a2f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 268.325316][T17017] RAX: ffffffffffffffda RBX: 00007f14a6265fa0 RCX: 00007f14a5fdfb19 [ 268.325333][T17017] RDX: 0000000000000020 RSI: 00002000000001c0 RDI: 0000000000000003 [ 268.325351][T17017] RBP: 00007f14a6077af8 R08: 0000000000000000 R09: 0000000000000000 [ 268.325366][T17017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 268.325381][T17017] R13: 00007f14a6266038 R14: 00007f14a6265fa0 R15: 00007fff6c7a38b8 [ 268.325403][T17017] [ 268.566862][T17035] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=17035 comm=syz.1.4702 [ 268.594621][T17039] FAULT_INJECTION: forcing a failure. [ 268.594621][T17039] name failslab, interval 1, probability 0, space 0, times 0 [ 268.594655][T17039] CPU: 1 UID: 0 PID: 17039 Comm: syz.5.4703 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 268.594691][T17039] Tainted: [W]=WARN [ 268.594699][T17039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 268.594713][T17039] Call Trace: [ 268.594721][T17039] [ 268.594729][T17039] __dump_stack+0x1d/0x30 [ 268.594761][T17039] dump_stack_lvl+0x95/0xd0 [ 268.594791][T17039] dump_stack+0x15/0x1b [ 268.594811][T17039] should_fail_ex+0x259/0x270 [ 268.594840][T17039] ? __rdma_create_id+0x48/0x3e0 [ 268.594860][T17039] should_failslab+0x8c/0xb0 [ 268.594889][T17039] __kmalloc_cache_noprof+0x5d/0x3e0 [ 268.594918][T17039] ? __rdma_create_id+0x48/0x3e0 [ 268.594952][T17039] ? __xa_alloc+0x291/0x300 [ 268.594968][T17039] ? __pfx_ucma_event_handler+0x10/0x10 [ 268.595052][T17039] ? __pfx_ucma_event_handler+0x10/0x10 [ 268.595122][T17039] __rdma_create_id+0x48/0x3e0 [ 268.595140][T17039] ? __pfx_ucma_event_handler+0x10/0x10 [ 268.595172][T17039] rdma_create_user_id+0x5a/0xa0 [ 268.595191][T17039] ucma_create_id+0x19c/0x280 [ 268.595210][T17039] ? __pfx_ucma_create_id+0x10/0x10 [ 268.595230][T17039] ucma_write+0x1c9/0x260 [ 268.595298][T17039] ? __pfx_ucma_write+0x10/0x10 [ 268.595316][T17039] vfs_write+0x24f/0x990 [ 268.595342][T17039] ? __fget_files+0x184/0x1c0 [ 268.595432][T17039] ksys_write+0xdc/0x1a0 [ 268.595460][T17039] __x64_sys_write+0x40/0x50 [ 268.595489][T17039] x64_sys_call+0x154e/0x2550 [ 268.595560][T17039] do_syscall_64+0x112/0x360 [ 268.595587][T17039] ? generic_smp_call_function_single_interrupt+0x13/0x20 [ 268.595697][T17039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.595716][T17039] RIP: 0033:0x7f14a5fdfb19 [ 268.595730][T17039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 268.595754][T17039] RSP: 002b:00007f14a4a2f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 268.595772][T17039] RAX: ffffffffffffffda RBX: 00007f14a6265fa0 RCX: 00007f14a5fdfb19 [ 268.595790][T17039] RDX: 0000000000000020 RSI: 0000200000000280 RDI: 0000000000000003 [ 268.595803][T17039] RBP: 00007f14a6077af8 R08: 0000000000000000 R09: 0000000000000000 [ 268.595874][T17039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 268.595885][T17039] R13: 00007f14a6266038 R14: 00007f14a6265fa0 R15: 00007fff6c7a38b8 [ 268.595903][T17039] [ 268.969123][T17065] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=17065 comm=syz.4.4715 [ 268.970107][T17060] loop0: detected capacity change from 0 to 8192 [ 269.050417][T17072] netlink: 'syz.4.4718': attribute type 1 has an invalid length. [ 269.065063][T17072] 8021q: adding VLAN 0 to HW filter on device bond7 [ 269.068427][T17072] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4718'. [ 269.070190][T17072] bond7: (slave dummy0): making interface the new active one [ 269.070620][T17072] bond7: (slave dummy0): Enslaving as an active interface with an up link [ 269.071965][T17072] netlink: 'syz.4.4718': attribute type 10 has an invalid length. [ 269.071982][T17072] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4718'. [ 269.072016][T17072] dummy0: entered promiscuous mode [ 269.128987][T17072] bond7: (slave dummy0): Releasing active interface [ 269.171971][T17075] FAULT_INJECTION: forcing a failure. [ 269.171971][T17075] name failslab, interval 1, probability 0, space 0, times 0 [ 269.172050][T17075] CPU: 0 UID: 0 PID: 17075 Comm: syz.7.4719 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 269.172093][T17075] Tainted: [W]=WARN [ 269.172101][T17075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 269.172161][T17075] Call Trace: [ 269.172169][T17075] [ 269.172191][T17075] __dump_stack+0x1d/0x30 [ 269.172354][T17075] dump_stack_lvl+0x95/0xd0 [ 269.172380][T17075] dump_stack+0x15/0x1b [ 269.172405][T17075] should_fail_ex+0x259/0x270 [ 269.172433][T17075] ? __rdma_create_id+0x48/0x3e0 [ 269.172485][T17075] should_failslab+0x8c/0xb0 [ 269.172520][T17075] __kmalloc_cache_noprof+0x5d/0x3e0 [ 269.172556][T17075] ? __rdma_create_id+0x48/0x3e0 [ 269.172601][T17075] ? __xa_alloc+0x291/0x300 [ 269.172618][T17075] ? __pfx_ucma_event_handler+0x10/0x10 [ 269.172691][T17075] ? __pfx_ucma_event_handler+0x10/0x10 [ 269.172713][T17075] __rdma_create_id+0x48/0x3e0 [ 269.172732][T17075] ? __pfx_ucma_event_handler+0x10/0x10 [ 269.172758][T17075] rdma_create_user_id+0x5a/0xa0 [ 269.172840][T17075] ucma_create_id+0x19c/0x280 [ 269.172862][T17075] ? __pfx_ucma_create_id+0x10/0x10 [ 269.172890][T17075] ucma_write+0x1c9/0x260 [ 269.172914][T17075] ? __pfx_ucma_write+0x10/0x10 [ 269.172938][T17075] vfs_write+0x24f/0x990 [ 269.172971][T17075] ? __fget_files+0x184/0x1c0 [ 269.173007][T17075] ksys_write+0xdc/0x1a0 [ 269.173035][T17075] __x64_sys_write+0x40/0x50 [ 269.173118][T17075] x64_sys_call+0x154e/0x2550 [ 269.173147][T17075] do_syscall_64+0x112/0x360 [ 269.173183][T17075] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.173205][T17075] RIP: 0033:0x7f0f1d03fb19 [ 269.173233][T17075] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 269.173261][T17075] RSP: 002b:00007f0f1ba97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 269.173283][T17075] RAX: ffffffffffffffda RBX: 00007f0f1d2c5fa0 RCX: 00007f0f1d03fb19 [ 269.173359][T17075] RDX: 0000000000000020 RSI: 0000200000000280 RDI: 0000000000000003 [ 269.173371][T17075] RBP: 00007f0f1d0d7af8 R08: 0000000000000000 R09: 0000000000000000 [ 269.173383][T17075] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 269.173457][T17075] R13: 00007f0f1d2c6038 R14: 00007f0f1d2c5fa0 R15: 00007fffa030cf28 [ 269.173475][T17075] [ 269.549546][T17091] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=17091 comm=syz.4.4727 [ 269.600500][T17097] syzkaller0: entered promiscuous mode [ 269.600554][T17097] syzkaller0: entered allmulticast mode [ 269.683884][T17101] loop5: detected capacity change from 0 to 1024 [ 269.717290][T17101] EXT4-fs (loop5): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 269.717386][T17101] ext4 filesystem being mounted at /11/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 269.778642][T17101] netlink: 44 bytes leftover after parsing attributes in process `syz.5.4731'. [ 270.197238][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 270.197271][ T29] audit: type=1400 audit(1793623565.426:1403): avc: denied { write } for pid=17100 comm="syz.5.4731" name="/" dev="loop5" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 270.237160][T17109] EXT4-fs error (device loop5): ext4_free_blocks:6717: comm syz.5.4731: Freeing blocks not in datazone - block = 0, count = 16 [ 270.676154][T17109] EXT4-fs error (device loop5): ext4_validate_block_bitmap:445: comm syz.5.4731: bg 0: block 112: padding at end of block bitmap is not set [ 270.678889][T17109] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2048 with error 28 [ 270.678919][T17109] EXT4-fs (loop5): This should not happen!! Data will be lost [ 270.678919][T17109] [ 270.678933][T17109] EXT4-fs (loop5): Total free blocks count 0 [ 270.678947][T17109] EXT4-fs (loop5): Free/Dirty block details [ 270.678967][T17109] EXT4-fs (loop5): free_blocks=0 [ 270.678980][T17109] EXT4-fs (loop5): dirty_blocks=18560 [ 270.678992][T17109] EXT4-fs (loop5): Block reservation details [ 270.679003][T17109] EXT4-fs (loop5): i_reserved_data_blocks=1160 [ 270.767751][ T53] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 2052 with max blocks 2048 with error 28 [ 270.809300][T16899] EXT4-fs warning (device loop5): ext4_evict_inode:261: inode #15: comm syz-executor: data will be lost [ 270.877047][T17133] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=17133 comm=syz.7.4744 [ 270.911584][T17137] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 270.956300][T17143] tmpfs: Bad value for 'mpol' [ 270.958228][ T3382] sony 0005:054C:03D5.001C: UNIQ does not contain a MAC address; duplicate check skipped [ 270.961723][ T3382] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.001C/input/input8 [ 270.962479][ T3382] sony 0005:054C:03D5.001C: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 271.036913][T17147] fido_id[17147]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 271.094209][T17162] loop7: detected capacity change from 0 to 1024 [ 271.130132][ T29] audit: type=1400 audit(1793623566.366:1404): avc: denied { write } for pid=17148 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 271.153435][T17162] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 271.155191][ T29] audit: type=1400 audit(1793623566.396:1405): avc: denied { write } for pid=17161 comm="syz.7.4754" name="/" dev="loop7" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 271.195373][ T29] audit: type=1400 audit(1793623566.436:1406): avc: denied { write } for pid=17177 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 271.205931][T16583] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 271.226763][T17181] loop0: detected capacity change from 0 to 512 [ 271.255111][T17181] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 271.255208][T17181] ext4 filesystem being mounted at /260/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 271.256794][ T29] audit: type=1400 audit(1793623566.496:1407): avc: denied { write } for pid=17180 comm="syz.0.4760" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 271.257780][T17183] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=17183 comm=syz.5.4757 [ 271.259073][ T29] audit: type=1400 audit(1793623566.496:1408): avc: denied { setattr } for pid=17180 comm="syz.0.4760" name="freezer.parent_freezing" dev="loop0" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 271.296550][T17189] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 271.305840][T13098] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 271.459648][T17223] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=17223 comm=syz.4.4772 [ 271.481163][ T29] audit: type=1400 audit(1793623566.716:1409): avc: denied { write } for pid=17185 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 271.536895][T17232] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 271.554173][ T29] audit: type=1400 audit(1793623566.796:1410): avc: denied { write } for pid=17235 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 271.592185][ T29] audit: type=1400 audit(1793623566.826:1411): avc: denied { setcurrent } for pid=17241 comm="syz.5.4780" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 271.653723][ T3397] sony 0005:054C:03D5.001D: UNIQ does not contain a MAC address; duplicate check skipped [ 271.656668][ T3397] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.001D/input/input9 [ 271.662440][ T3397] sony 0005:054C:03D5.001D: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 271.715425][T17261] fido_id[17261]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 271.776017][T17273] loop4: detected capacity change from 0 to 2048 [ 271.798226][T17273] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 271.798289][T17273] ext4 filesystem being mounted at /232/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 271.819658][T17273] EXT4-fs (loop4): resizing filesystem from 256 to 0 blocks [ 271.819733][T17273] EXT4-fs warning (device loop4): ext4_resize_fs:2044: can't shrink FS - resize aborted [ 271.840785][T14436] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 271.953916][ T9] sony 0005:054C:03D5.001E: UNIQ does not contain a MAC address; duplicate check skipped [ 271.960162][ T9] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.001E/input/input10 [ 271.963760][ T9] sony 0005:054C:03D5.001E: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 272.027520][T17300] fido_id[17300]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 272.110890][T17318] FAULT_INJECTION: forcing a failure. [ 272.110890][T17318] name failslab, interval 1, probability 0, space 0, times 0 [ 272.110923][T17318] CPU: 0 UID: 0 PID: 17318 Comm: syz.4.4812 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 272.110988][T17318] Tainted: [W]=WARN [ 272.110994][T17318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 272.111008][T17318] Call Trace: [ 272.111016][T17318] [ 272.111024][T17318] __dump_stack+0x1d/0x30 [ 272.111053][T17318] dump_stack_lvl+0x95/0xd0 [ 272.111139][T17318] dump_stack+0x15/0x1b [ 272.111161][T17318] should_fail_ex+0x259/0x270 [ 272.111187][T17318] ? security_sb_alloc+0x48/0x100 [ 272.111271][T17318] should_failslab+0x8c/0xb0 [ 272.111302][T17318] __kmalloc_noprof+0xb6/0x4b0 [ 272.111400][T17318] ? should_failslab+0x8c/0xb0 [ 272.111433][T17318] ? security_sb_alloc+0x48/0x100 [ 272.111508][T17318] security_sb_alloc+0x48/0x100 [ 272.111536][T17318] sget_fc+0x5bf/0x1030 [ 272.111559][T17318] ? __pfx_set_anon_super_fc+0x10/0x10 [ 272.111589][T17318] ? __kmalloc_cache_noprof+0x17e/0x3e0 [ 272.111653][T17318] ? mqueue_init_fs_context+0x38/0x2c0 [ 272.111694][T17318] ? __pfx_mqueue_fill_super+0x10/0x10 [ 272.111716][T17318] get_tree_nodev+0x2a/0x100 [ 272.111772][T17318] mqueue_get_tree+0x5d/0x80 [ 272.111855][T17318] vfs_get_tree+0x57/0x1d0 [ 272.111906][T17318] fc_mount_longterm+0x18/0xb0 [ 272.111938][T17318] mq_init_ns+0x2db/0x370 [ 272.111957][T17318] copy_ipcs+0x26d/0x460 [ 272.111982][T17318] create_new_namespaces+0x121/0x420 [ 272.112052][T17318] unshare_nsproxy_namespaces+0x115/0x150 [ 272.112128][T17318] ksys_unshare+0x3a3/0x690 [ 272.112161][T17318] __x64_sys_unshare+0x1f/0x30 [ 272.112192][T17318] x64_sys_call+0x1e33/0x2550 [ 272.112222][T17318] do_syscall_64+0x112/0x360 [ 272.112296][T17318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.112320][T17318] RIP: 0033:0x7f5e83fdfb19 [ 272.112339][T17318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 272.112360][T17318] RSP: 002b:00007f5e82a2f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 272.112431][T17318] RAX: ffffffffffffffda RBX: 00007f5e84265fa0 RCX: 00007f5e83fdfb19 [ 272.112499][T17318] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002e000480 [ 272.112511][T17318] RBP: 00007f5e84077af8 R08: 0000000000000000 R09: 0000000000000000 [ 272.112551][T17318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 272.112567][T17318] R13: 00007f5e84266038 R14: 00007f5e84265fa0 R15: 00007ffc178c1478 [ 272.112589][T17318] [ 272.137820][T17316] loop7: detected capacity change from 0 to 4096 [ 272.161238][T17316] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 272.175284][ T29] audit: type=1400 audit(1793623567.416:1412): avc: denied { write } for pid=17315 comm="syz.7.4811" name="/" dev="loop7" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 272.207324][T16583] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 272.292351][T17324] loop4: detected capacity change from 0 to 1024 [ 272.306173][T17324] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 272.415231][T14436] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 272.474531][ T3464] sony 0005:054C:03D5.001F: UNIQ does not contain a MAC address; duplicate check skipped [ 272.476730][ T3464] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.001F/input/input11 [ 272.478711][ T3464] sony 0005:054C:03D5.001F: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 272.575148][T17338] fido_id[17338]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 272.898182][T17389] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=17389 comm=syz.5.4836 [ 272.917145][T17386] loop7: detected capacity change from 0 to 2048 [ 272.930754][T17386] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 272.930934][T17386] ext4 filesystem being mounted at /42/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 272.991789][T16583] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 273.060735][T17411] syzkaller0: entered promiscuous mode [ 273.060755][T17411] syzkaller0: entered allmulticast mode [ 273.090653][T17415] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 273.116117][T17417] syz_tun: entered allmulticast mode [ 273.116392][T17417] syz_tun: left allmulticast mode [ 273.250703][T17437] loop7: detected capacity change from 0 to 2048 [ 273.265078][T17437] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 273.265142][T17437] ext4 filesystem being mounted at /51/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 273.301721][T16583] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 273.416865][T17454] netlink: 'syz.7.4859': attribute type 1 has an invalid length. [ 273.421512][T17454] 8021q: adding VLAN 0 to HW filter on device bond1 [ 273.431023][T17454] bond1: (slave dummy0): making interface the new active one [ 273.438036][T17454] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 273.442496][T17454] netlink: 'syz.7.4859': attribute type 10 has an invalid length. [ 273.442563][T17454] netlink: 40 bytes leftover after parsing attributes in process `syz.7.4859'. [ 273.442599][T17454] dummy0: entered promiscuous mode [ 273.447427][T17454] bond1: (slave dummy0): Releasing active interface [ 273.555601][T17465] loop7: detected capacity change from 0 to 2048 [ 273.575678][T17465] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 273.603718][T16583] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 273.682329][ T3464] sony 0005:054C:03D5.0020: UNIQ does not contain a MAC address; duplicate check skipped [ 273.686761][ T3464] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.0020/input/input12 [ 273.690281][ T3464] sony 0005:054C:03D5.0020: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 273.789063][T17476] fido_id[17476]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 273.857706][T17484] netlink: 'syz.1.4871': attribute type 1 has an invalid length. [ 273.889978][T17484] 8021q: adding VLAN 0 to HW filter on device bond2 [ 273.906351][T17484] dummy0: left promiscuous mode [ 273.908213][T17484] bond2: (slave dummy0): making interface the new active one [ 273.908571][T17484] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 273.911148][T17484] netlink: 'syz.1.4871': attribute type 10 has an invalid length. [ 273.911243][T17484] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4871'. [ 273.911279][T17484] dummy0: entered promiscuous mode [ 273.911919][T17484] bond2: (slave dummy0): Releasing active interface [ 273.969783][T17496] loop1: detected capacity change from 0 to 2048 [ 273.991445][T17496] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 274.028702][T15467] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 274.077654][T17509] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=17509 comm=syz.1.4879 [ 274.162882][T17522] netlink: 'syz.7.4886': attribute type 1 has an invalid length. [ 274.182545][T17522] 8021q: adding VLAN 0 to HW filter on device bond2 [ 274.194410][T17522] dummy0: left promiscuous mode [ 274.196719][T17522] bond2: (slave dummy0): making interface the new active one [ 274.197134][T17522] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 274.198398][T17522] netlink: 'syz.7.4886': attribute type 10 has an invalid length. [ 274.198463][T17522] netlink: 40 bytes leftover after parsing attributes in process `syz.7.4886'. [ 274.198495][T17522] dummy0: entered promiscuous mode [ 274.201985][T17522] bond2: (slave dummy0): Releasing active interface [ 274.384776][T17549] FAULT_INJECTION: forcing a failure. [ 274.384776][T17549] name failslab, interval 1, probability 0, space 0, times 0 [ 274.384870][T17549] CPU: 0 UID: 0 PID: 17549 Comm: syz.7.4898 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 274.384899][T17549] Tainted: [W]=WARN [ 274.384943][T17549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 274.384958][T17549] Call Trace: [ 274.384966][T17549] [ 274.384976][T17549] __dump_stack+0x1d/0x30 [ 274.385004][T17549] dump_stack_lvl+0x95/0xd0 [ 274.385031][T17549] dump_stack+0x15/0x1b [ 274.385130][T17549] should_fail_ex+0x259/0x270 [ 274.385162][T17549] ? __request_module+0x1df/0x3c0 [ 274.385245][T17549] should_failslab+0x8c/0xb0 [ 274.385279][T17549] __kmalloc_node_track_caller_noprof+0xb6/0x4d0 [ 274.385400][T17549] ? __request_module+0x1c4/0x3c0 [ 274.385428][T17549] ? __request_module+0x1df/0x3c0 [ 274.385503][T17549] ? __kmalloc_cache_noprof+0x17e/0x3e0 [ 274.385575][T17549] kstrdup+0x3e/0xd0 [ 274.385596][T17549] __request_module+0x1df/0x3c0 [ 274.385704][T17549] dev_load+0xa3/0xc0 [ 274.385771][T17549] dev_ioctl+0x4fe/0x960 [ 274.385797][T17549] sock_do_ioctl+0x1aa/0x230 [ 274.385856][T17549] sock_ioctl+0x439/0x610 [ 274.385879][T17549] ? __pfx_sock_ioctl+0x10/0x10 [ 274.385903][T17549] __se_sys_ioctl+0xce/0x140 [ 274.386046][T17549] __x64_sys_ioctl+0x43/0x50 [ 274.386080][T17549] x64_sys_call+0x239d/0x2550 [ 274.386108][T17549] do_syscall_64+0x112/0x360 [ 274.386146][T17549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.386244][T17549] RIP: 0033:0x7f0f1d03fb19 [ 274.386259][T17549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 274.386276][T17549] RSP: 002b:00007f0f1ba97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 274.386314][T17549] RAX: ffffffffffffffda RBX: 00007f0f1d2c5fa0 RCX: 00007f0f1d03fb19 [ 274.386327][T17549] RDX: 0000200000000040 RSI: 0000000000008933 RDI: 0000000000000003 [ 274.386339][T17549] RBP: 00007f0f1d0d7af8 R08: 0000000000000000 R09: 0000000000000000 [ 274.386398][T17549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 274.386413][T17549] R13: 00007f0f1d2c6038 R14: 00007f0f1d2c5fa0 R15: 00007fffa030cf28 [ 274.386460][T17549] [ 274.627552][T17565] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 274.671942][T16583] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 274.711881][T17577] set_capacity_and_notify: 1 callbacks suppressed [ 274.711897][T17577] loop1: detected capacity change from 0 to 2048 [ 274.732093][T17577] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 274.732169][T17577] ext4 filesystem being mounted at /140/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 274.771459][T15467] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 274.806242][T17586] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 274.916427][T17598] netlink: 144 bytes leftover after parsing attributes in process `syz.7.4918'. [ 274.925064][T17598] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 274.927683][T17601] loop5: detected capacity change from 0 to 1024 [ 274.934801][T17602] loop1: detected capacity change from 0 to 2048 [ 274.950073][T17601] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 274.964380][T17602] loop1: p1 < > p4 [ 274.965097][T17602] loop1: p4 size 722688 extends beyond EOD, truncated [ 274.983643][T16899] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 275.059728][T17607] netlink: 'syz.4.4922': attribute type 1 has an invalid length. [ 275.099341][T17607] 8021q: adding VLAN 0 to HW filter on device bond8 [ 275.111872][T17607] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4922'. [ 275.111981][T17607] dummy0: left promiscuous mode [ 275.114158][T17607] bond8: (slave dummy0): making interface the new active one [ 275.123443][T17607] bond8: (slave dummy0): Enslaving as an active interface with an up link [ 275.148789][T17616] loop4: detected capacity change from 0 to 512 [ 275.153864][T17616] EXT4-fs: dax option not supported [ 275.466509][T17633] loop0: detected capacity change from 0 to 1024 [ 275.486454][T17633] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 275.489842][ T29] kauditd_printk_skb: 16 callbacks suppressed [ 275.489857][ T29] audit: type=1400 audit(1793623571.725:1429): avc: denied { write } for pid=17632 comm="syz.0.4932" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 275.582703][T13098] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 275.641639][ T9] sony 0005:054C:03D5.0021: UNIQ does not contain a MAC address; duplicate check skipped [ 275.644958][ T9] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.0021/input/input13 [ 275.645958][ T9] sony 0005:054C:03D5.0021: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 275.699842][T17657] fido_id[17657]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 275.802717][T17670] loop0: detected capacity change from 0 to 2048 [ 275.820505][T17670] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 275.820581][T17670] ext4 filesystem being mounted at /283/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 275.860605][T13098] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 276.032216][T17690] netlink: 'syz.1.4953': attribute type 1 has an invalid length. [ 276.038865][T17690] 8021q: adding VLAN 0 to HW filter on device bond3 [ 276.049165][T17690] dummy0: left promiscuous mode [ 276.051143][T17690] bond3: (slave dummy0): making interface the new active one [ 276.051455][T17690] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 276.052686][T17690] netlink: 'syz.1.4953': attribute type 10 has an invalid length. [ 276.052702][T17690] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4953'. [ 276.053111][T17690] dummy0: entered promiscuous mode [ 276.066573][T17690] bond3: (slave dummy0): Releasing active interface [ 276.282279][ T3345] sony 0005:054C:03D5.0022: UNIQ does not contain a MAC address; duplicate check skipped [ 276.284829][ T3345] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.0022/input/input14 [ 276.304671][ T3345] sony 0005:054C:03D5.0022: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 276.332672][T17700] fido_id[17700]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 276.610412][T17708] loop4: detected capacity change from 0 to 2048 [ 276.647787][T17708] loop4: p1 < > p4 [ 276.649650][T17708] loop4: p4 size 722688 extends beyond EOD, truncated [ 276.805121][T17717] loop4: detected capacity change from 0 to 2048 [ 276.832399][T17717] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 276.832606][T17717] ext4 filesystem being mounted at /252/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 276.846000][T17720] loop7: detected capacity change from 0 to 1024 [ 276.879620][T17720] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 276.881589][ T29] audit: type=1400 audit(1793623573.115:1430): avc: denied { write } for pid=17719 comm="syz.7.4966" name="/" dev="loop7" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 276.917968][T16583] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 276.920673][T14436] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 277.168343][T17748] netlink: 'syz.1.4979': attribute type 1 has an invalid length. [ 277.184229][T17748] 8021q: adding VLAN 0 to HW filter on device bond4 [ 277.192155][T17748] dummy0: left promiscuous mode [ 277.209756][T17751] loop7: detected capacity change from 0 to 1024 [ 277.224854][T17748] bond4: (slave dummy0): making interface the new active one [ 277.225249][T17748] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 277.253370][T17751] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 277.271758][ T29] audit: type=1400 audit(1793623573.505:1431): avc: denied { write } for pid=17750 comm="syz.7.4980" name="/" dev="loop7" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 277.327849][T16583] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 277.399833][T17764] netlink: 'syz.7.4985': attribute type 1 has an invalid length. [ 277.414478][T17764] 8021q: adding VLAN 0 to HW filter on device bond3 [ 277.422588][T17764] netlink: 28 bytes leftover after parsing attributes in process `syz.7.4985'. [ 277.422743][T17764] dummy0: left promiscuous mode [ 277.448055][T17764] bond3: (slave dummy0): making interface the new active one [ 277.448606][T17764] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 277.451078][T17764] netlink: 'syz.7.4985': attribute type 10 has an invalid length. [ 277.451113][T17764] netlink: 40 bytes leftover after parsing attributes in process `syz.7.4985'. [ 277.451148][T17764] dummy0: entered promiscuous mode [ 277.451749][T17764] bond3: (slave dummy0): Releasing active interface [ 277.546527][ T29] audit: type=1400 audit(1793623573.785:1432): avc: denied { setopt } for pid=17772 comm="syz.7.4988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 277.556190][ T29] audit: type=1400 audit(1793623573.795:1433): avc: denied { create } for pid=17772 comm="syz.7.4988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 277.561142][ T29] audit: type=1400 audit(1793623573.795:1434): avc: denied { ioctl } for pid=17772 comm="syz.7.4988" path="socket:[53894]" dev="sockfs" ino=53894 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 277.577284][ T29] audit: type=1400 audit(1793623573.815:1435): avc: denied { write } for pid=17772 comm="syz.7.4988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 277.654395][T17776] loop1: p1 < > p4 [ 277.663356][T17776] loop1: p4 size 8388608 extends beyond EOD, truncated [ 277.754954][T17782] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 277.756296][ T29] audit: type=1400 audit(1793623573.995:1436): avc: denied { write } for pid=17781 comm="syz.7.4992" name="/" dev="loop7" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 277.795942][T16583] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 277.835392][T17790] syzkaller0: entered promiscuous mode [ 277.835411][T17790] syzkaller0: entered allmulticast mode [ 277.887744][T17793] EXT4-fs error (device loop4): ext4_orphan_get:1404: inode #15: comm syz.4.4996: inode has both inline data and extents flags [ 277.887785][T17793] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 277.887876][T17793] EXT4-fs error (device loop4): ext4_orphan_get:1409: comm syz.4.4996: couldn't read orphan inode 15 (err -117) [ 277.887902][T17793] loop4: lost filesystem error report for type 5 error -117 [ 277.888355][T17793] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 277.923581][T14436] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 278.064929][T17804] syzkaller0: entered promiscuous mode [ 278.064949][T17804] syzkaller0: entered allmulticast mode [ 278.192246][ T29] audit: type=1400 audit(1793623574.425:1437): avc: denied { write } for pid=17811 comm="syz.0.5005" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 278.194643][T17816] netlink: 144 bytes leftover after parsing attributes in process `syz.1.5007'. [ 278.198583][T17816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 278.290007][T17822] syzkaller0: entered promiscuous mode [ 278.290028][T17822] syzkaller0: entered allmulticast mode [ 278.329116][T17824] EXT4-fs error (device loop0): ext4_orphan_get:1404: inode #15: comm syz.0.5009: inode has both inline data and extents flags [ 278.329148][T17824] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 278.329216][T17824] EXT4-fs error (device loop0): ext4_orphan_get:1409: comm syz.0.5009: couldn't read orphan inode 15 (err -117) [ 278.329241][T17824] loop0: lost filesystem error report for type 5 error -117 [ 278.379508][T17831] netlink: 'syz.5.5013': attribute type 1 has an invalid length. [ 278.393725][T17831] 8021q: adding VLAN 0 to HW filter on device bond1 [ 278.434026][T17831] bond1: (slave dummy0): making interface the new active one [ 278.434412][T17831] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 278.479065][T17840] syzkaller0: entered promiscuous mode [ 278.479086][T17840] syzkaller0: entered allmulticast mode [ 278.483028][ T29] audit: type=1326 audit(1793623574.715:1438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17843 comm="syz.0.5019" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8efee3fb19 code=0x7ffc0000 [ 278.489450][T17842] FAULT_INJECTION: forcing a failure. [ 278.489450][T17842] name failslab, interval 1, probability 0, space 0, times 0 [ 278.489481][T17842] CPU: 1 UID: 0 PID: 17842 Comm: syz.5.5018 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 278.489513][T17842] Tainted: [W]=WARN [ 278.489521][T17842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 278.489562][T17842] Call Trace: [ 278.489568][T17842] [ 278.489630][T17842] __dump_stack+0x1d/0x30 [ 278.489725][T17842] dump_stack_lvl+0x95/0xd0 [ 278.489791][T17842] dump_stack+0x15/0x1b [ 278.489813][T17842] should_fail_ex+0x259/0x270 [ 278.489953][T17842] ? call_usermodehelper_setup+0x72/0x190 [ 278.489975][T17842] should_failslab+0x8c/0xb0 [ 278.490038][T17842] __kmalloc_cache_noprof+0x5d/0x3e0 [ 278.490073][T17842] ? call_usermodehelper_setup+0x72/0x190 [ 278.490095][T17842] ? __pfx_free_modprobe_argv+0x10/0x10 [ 278.490207][T17842] call_usermodehelper_setup+0x72/0x190 [ 278.490228][T17842] __request_module+0x264/0x3c0 [ 278.490259][T17842] ? capable+0x81/0xb0 [ 278.490286][T17842] dev_load+0x61/0xc0 [ 278.490374][T17842] dev_ioctl+0x4fe/0x960 [ 278.490408][T17842] sock_do_ioctl+0x1aa/0x230 [ 278.490508][T17842] sock_ioctl+0x439/0x610 [ 278.490533][T17842] ? __pfx_sock_ioctl+0x10/0x10 [ 278.490556][T17842] __se_sys_ioctl+0xce/0x140 [ 278.490589][T17842] __x64_sys_ioctl+0x43/0x50 [ 278.490642][T17842] x64_sys_call+0x239d/0x2550 [ 278.490742][T17842] do_syscall_64+0x112/0x360 [ 278.490776][T17842] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.490799][T17842] RIP: 0033:0x7f14a5fdfb19 [ 278.490815][T17842] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.490835][T17842] RSP: 002b:00007f14a4a2f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 278.490908][T17842] RAX: ffffffffffffffda RBX: 00007f14a6265fa0 RCX: 00007f14a5fdfb19 [ 278.490987][T17842] RDX: 0000200000000040 RSI: 0000000000008933 RDI: 0000000000000003 [ 278.491002][T17842] RBP: 00007f14a6077af8 R08: 0000000000000000 R09: 0000000000000000 [ 278.491016][T17842] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 278.491030][T17842] R13: 00007f14a6266038 R14: 00007f14a6265fa0 R15: 00007fff6c7a38b8 [ 278.491050][T17842] [ 278.671838][T17852] tmpfs: Bad value for 'mpol' [ 278.727770][T17854] syzkaller0: entered promiscuous mode [ 278.727821][T17854] syzkaller0: entered allmulticast mode [ 278.742483][T17857] EXT4-fs error (device loop5): ext4_orphan_get:1404: inode #15: comm syz.5.5023: inode has both inline data and extents flags [ 278.742514][T17857] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 278.743574][T17857] EXT4-fs error (device loop5): ext4_orphan_get:1409: comm syz.5.5023: couldn't read orphan inode 15 (err -117) [ 278.743604][T17857] loop5: lost filesystem error report for type 5 error -117 [ 278.747088][ T994] sony 0005:054C:03D5.0023: UNIQ does not contain a MAC address; duplicate check skipped [ 278.751997][ T994] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.0023/input/input15 [ 278.786400][ T994] sony 0005:054C:03D5.0023: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 278.848763][T17859] fido_id[17859]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 278.889395][ T3397] hid_parser_main: 10 callbacks suppressed [ 278.889460][ T3397] hid-generic 0000:0000:0000.0024: unknown main item tag 0x0 [ 278.890345][ T3397] hid-generic 0000:0000:0000.0024: hidraw0: HID v0.00 Device [syz1] on syz0 [ 278.893617][T17864] FAULT_INJECTION: forcing a failure. [ 278.893617][T17864] name failslab, interval 1, probability 0, space 0, times 0 [ 278.893648][T17864] CPU: 1 UID: 0 PID: 17864 Comm: syz.4.5026 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 278.893700][T17864] Tainted: [W]=WARN [ 278.893707][T17864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 278.893719][T17864] Call Trace: [ 278.893725][T17864] [ 278.893732][T17864] __dump_stack+0x1d/0x30 [ 278.893771][T17864] dump_stack_lvl+0x95/0xd0 [ 278.893790][T17864] dump_stack+0x15/0x1b [ 278.893811][T17864] should_fail_ex+0x259/0x270 [ 278.893860][T17864] ? uhid_hid_stop+0x66/0x180 [ 278.893885][T17864] should_failslab+0x8c/0xb0 [ 278.893976][T17864] __kmalloc_cache_noprof+0x5d/0x3e0 [ 278.894010][T17864] ? __pfx_device_release+0x10/0x10 [ 278.894039][T17864] ? uhid_hid_stop+0x66/0x180 [ 278.894135][T17864] uhid_hid_stop+0x66/0x180 [ 278.894172][T17864] hid_hw_stop+0x154/0x160 [ 278.894265][T17864] hid_device_remove+0x94/0x100 [ 278.894292][T17864] ? __pfx_hid_device_remove+0x10/0x10 [ 278.894320][T17864] device_release_driver_internal+0x2bb/0x510 [ 278.894349][T17864] device_release_driver+0x19/0x20 [ 278.894458][T17864] bus_remove_device+0x2fa/0x320 [ 278.894494][T17864] device_del+0x35f/0x790 [ 278.894518][T17864] ? __pfx_uhid_char_release+0x10/0x10 [ 278.894540][T17864] hid_destroy_device+0x54/0x120 [ 278.894585][T17864] uhid_char_release+0x76/0x3c0 [ 278.894607][T17864] __fput+0x286/0x610 [ 278.894632][T17864] ____fput+0x1c/0x30 [ 278.894656][T17864] task_work_run+0x133/0x190 [ 278.894701][T17864] exit_to_user_mode_loop+0x1e4/0x8c0 [ 278.894728][T17864] ? ksys_dup3+0x14a/0x1b0 [ 278.894757][T17864] do_syscall_64+0x212/0x360 [ 278.894827][T17864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.894850][T17864] RIP: 0033:0x7f5e83fdfb19 [ 278.894867][T17864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.894887][T17864] RSP: 002b:00007f5e82a2f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000124 [ 278.894955][T17864] RAX: 0000000000000007 RBX: 00007f5e84265fa0 RCX: 00007f5e83fdfb19 [ 278.894969][T17864] RDX: 0000000000080000 RSI: 0000000000000007 RDI: 0000000000000008 [ 278.894983][T17864] RBP: 00007f5e84077af8 R08: 0000000000000000 R09: 0000000000000000 [ 278.894997][T17864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 278.895011][T17864] R13: 00007f5e84266038 R14: 00007f5e84265fa0 R15: 00007ffc178c1478 [ 278.895035][T17864] [ 278.926382][T17867] fido_id[17867]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 279.116337][T17886] tmpfs: Bad value for 'mpol' [ 279.211373][ T3345] sony 0005:054C:03D5.0025: UNIQ does not contain a MAC address; duplicate check skipped [ 279.215357][ T3345] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.0025/input/input16 [ 279.233696][ T3345] sony 0005:054C:03D5.0025: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 279.281187][T17901] fido_id[17901]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 279.402451][T17915] netlink: 'syz.5.5048': attribute type 1 has an invalid length. [ 279.415885][T17915] 8021q: adding VLAN 0 to HW filter on device bond2 [ 279.419192][T17915] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5048'. [ 279.433211][T17915] bond1: (slave dummy0): Releasing active interface [ 279.455621][T17915] bond2: (slave dummy0): making interface the new active one [ 279.462496][T17915] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 279.481555][T17920] No such timeout policy "syz1" [ 279.535164][T17924] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=17924 comm=syz.5.5053 [ 279.575790][ T994] sony 0005:054C:03D5.0026: UNIQ does not contain a MAC address; duplicate check skipped [ 279.577789][ T994] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.0026/input/input17 [ 279.578681][ T994] sony 0005:054C:03D5.0026: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 279.642367][T17935] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 279.657162][T17933] fido_id[17933]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 279.697186][T17939] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5059'. [ 279.749278][T17949] netlink: 'syz.5.5064': attribute type 1 has an invalid length. [ 279.762920][T17949] 8021q: adding VLAN 0 to HW filter on device bond3 [ 279.773212][T17949] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5064'. [ 279.779305][T17949] bond2: (slave dummy0): Releasing active interface [ 279.801155][T17949] bond3: (slave dummy0): making interface the new active one [ 279.810736][T17949] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 279.837578][T17952] syzkaller0: entered promiscuous mode [ 279.837596][T17952] syzkaller0: entered allmulticast mode [ 279.877165][ T3397] sony 0005:054C:03D5.0027: UNIQ does not contain a MAC address; duplicate check skipped [ 279.879214][ T3397] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.0027/input/input18 [ 279.880361][ T3397] sony 0005:054C:03D5.0027: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 279.901243][T17964] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 279.912824][T17960] netlink: 144 bytes leftover after parsing attributes in process `syz.5.5068'. [ 279.930296][T17960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 279.944293][T17965] fido_id[17965]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 280.089958][T17982] netlink: 'syz.1.5079': attribute type 1 has an invalid length. [ 280.120055][T17982] 8021q: adding VLAN 0 to HW filter on device bond5 [ 280.135239][T17982] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5079'. [ 280.155753][T17982] bond4: (slave dummy0): Releasing active interface [ 280.159636][T17982] bond5: (slave dummy0): making interface the new active one [ 280.160044][T17982] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 280.205122][T17992] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 280.282869][ T994] sony 0005:054C:03D5.0028: UNIQ does not contain a MAC address; duplicate check skipped [ 280.300824][ T994] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.0028/input/input19 [ 280.305389][ T994] sony 0005:054C:03D5.0028: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 280.314347][T17997] syzkaller0: entered promiscuous mode [ 280.314366][T17997] syzkaller0: entered allmulticast mode [ 280.420851][T18000] fido_id[18000]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 280.476349][T18005] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 280.497403][T18007] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 280.603773][T18015] netlink: 'syz.5.5093': attribute type 1 has an invalid length. [ 280.623812][T18015] 8021q: adding VLAN 0 to HW filter on device bond4 [ 280.627998][T18015] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5093'. [ 280.636932][T18015] bond3: (slave dummy0): Releasing active interface [ 280.666404][T18015] bond4: (slave dummy0): making interface the new active one [ 280.669021][T18015] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 280.691523][T18020] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 280.866803][T18036] set_capacity_and_notify: 7 callbacks suppressed [ 280.866893][T18036] loop1: detected capacity change from 0 to 1024 [ 280.887368][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 280.887384][ T29] audit: type=1400 audit(1793623577.125:1448): avc: denied { write } for pid=18034 comm="syz.1.5103" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 280.888384][T18036] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1315: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 280.888483][T18036] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 280.888573][T18036] EXT4-fs (loop1): This should not happen!! Data will be lost [ 280.888573][T18036] [ 280.888588][T18036] EXT4-fs (loop1): Total free blocks count 0 [ 280.888603][T18036] EXT4-fs (loop1): Free/Dirty block details [ 280.888617][T18036] EXT4-fs (loop1): free_blocks=68451041280 [ 280.888632][T18036] EXT4-fs (loop1): dirty_blocks=16 [ 280.888646][T18036] EXT4-fs (loop1): Block reservation details [ 280.888659][T18036] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 280.892970][T18036] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 28 [ 280.892992][T18036] EXT4-fs (loop1): This should not happen!! Data will be lost [ 280.892992][T18036] [ 280.930922][T18045] netlink: 144 bytes leftover after parsing attributes in process `syz.7.5105'. [ 280.951829][T18045] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 281.295480][T18052] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18052 comm=syz.7.5108 [ 281.381777][T18057] syz_tun: left allmulticast mode [ 281.381831][T18057] syz_tun: left promiscuous mode [ 281.381904][T18057] bridge0: port 1(syz_tun) entered disabled state [ 281.395107][T18057] bond5: (slave dummy0): Releasing active interface [ 281.420419][T18057] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 281.431113][T18057] team0: No ports can be present during mode change [ 281.439149][ T32] tipc: Resetting bearer [ 281.453166][T18057] tipc: Enabling of bearer rejected, already enabled [ 281.590297][T18080] loop1: detected capacity change from 0 to 1024 [ 281.606538][ T29] audit: type=1400 audit(1793623577.845:1449): avc: denied { write } for pid=18079 comm="syz.1.5121" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 281.607217][T18080] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1315: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 281.607307][T18080] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 281.607371][T18080] EXT4-fs (loop1): This should not happen!! Data will be lost [ 281.607371][T18080] [ 281.607387][T18080] EXT4-fs (loop1): Total free blocks count 0 [ 281.607417][T18080] EXT4-fs (loop1): Free/Dirty block details [ 281.607431][T18080] EXT4-fs (loop1): free_blocks=68451041280 [ 281.607517][T18080] EXT4-fs (loop1): dirty_blocks=16 [ 281.607696][T18080] EXT4-fs (loop1): Block reservation details [ 281.607711][T18080] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 281.608147][T18080] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 28 [ 281.608176][T18080] EXT4-fs (loop1): This should not happen!! Data will be lost [ 281.608176][T18080] [ 281.879144][T18104] tmpfs: Bad value for 'mpol' [ 281.932147][T18108] netlink: 144 bytes leftover after parsing attributes in process `syz.4.5132'. [ 281.940016][T18108] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 282.067851][T18117] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5136'. [ 282.348571][T18149] loop0: detected capacity change from 0 to 1024 [ 282.367277][T18147] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5149'. [ 282.378685][ T29] audit: type=1400 audit(1793623578.615:1450): avc: denied { write } for pid=18148 comm="syz.0.5148" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 282.411254][T18149] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1315: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 282.411470][T18149] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 282.411497][T18149] EXT4-fs (loop0): This should not happen!! Data will be lost [ 282.411497][T18149] [ 282.411512][T18149] EXT4-fs (loop0): Total free blocks count 0 [ 282.411526][T18149] EXT4-fs (loop0): Free/Dirty block details [ 282.411587][T18149] EXT4-fs (loop0): free_blocks=68451041280 [ 282.411602][T18149] EXT4-fs (loop0): dirty_blocks=16 [ 282.411616][T18149] EXT4-fs (loop0): Block reservation details [ 282.411629][T18149] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 282.414723][T18149] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 28 [ 282.414824][T18149] EXT4-fs (loop0): This should not happen!! Data will be lost [ 282.414824][T18149] [ 282.498704][T18160] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18160 comm=syz.0.5153 [ 282.735147][T18176] bridge_slave_0: left allmulticast mode [ 282.735248][T18176] bridge_slave_0: left promiscuous mode [ 282.735367][T18176] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.752354][T18189] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18189 comm=syz.1.5164 [ 282.779190][T18176] bridge_slave_1: left allmulticast mode [ 282.779215][T18176] bridge_slave_1: left promiscuous mode [ 282.779422][T18176] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.795956][T18176] bond0: (slave bond_slave_0): Releasing backup interface [ 282.810940][T18176] bond0: (slave bond_slave_1): Releasing backup interface [ 282.821895][T18176] team0: Port device team_slave_0 removed [ 282.824229][T18176] team0: Port device team_slave_1 removed [ 282.825100][T18176] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 282.825230][T18176] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 282.830491][T18176] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 282.830507][T18176] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 282.838392][T18186] team0: Mode changed to "loadbalance" [ 282.859963][T18193] vlan0: entered promiscuous mode [ 282.877108][T18193] team0: Port device vlan0 added [ 282.890559][T18176] tipc: Started in network mode [ 282.890587][T18176] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 282.890679][T18176] tipc: Enabled bearer , priority 0 [ 282.930161][T18206] No such timeout policy "syz1" [ 282.984837][T18218] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18218 comm=syz.0.5175 [ 283.020033][T18222] tmpfs: Bad value for 'mpol' [ 283.088489][T18234] No such timeout policy "syz1" [ 283.152314][T18242] loop4: detected capacity change from 0 to 512 [ 283.152928][T18242] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 283.161387][T18242] EXT4-fs (loop4): 1 truncate cleaned up [ 283.259806][T18248] net_ratelimit: 2 callbacks suppressed [ 283.259869][T18248] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 283.271022][T18249] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18249 comm=syz.1.5189 [ 283.328107][T18250] GUP no longer grows the stack in syz.4.5188 (18250): 200000004000-20000000a000 (200000002000) [ 283.328157][T18250] CPU: 1 UID: 0 PID: 18250 Comm: syz.4.5188 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 283.328193][T18250] Tainted: [W]=WARN [ 283.328200][T18250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 283.328212][T18250] Call Trace: [ 283.328218][T18250] [ 283.328225][T18250] __dump_stack+0x1d/0x30 [ 283.328314][T18250] dump_stack_lvl+0x95/0xd0 [ 283.328334][T18250] dump_stack+0x15/0x1b [ 283.328358][T18250] __get_user_pages+0x1bd9/0x1ea0 [ 283.328387][T18250] ? _raw_spin_unlock+0x9/0x30 [ 283.328409][T18250] ? __rcu_read_unlock+0x4e/0x70 [ 283.328538][T18250] get_user_pages_remote+0x1d0/0x6c0 [ 283.328628][T18250] __access_remote_vm+0x156/0x4d0 [ 283.328652][T18250] access_remote_vm+0x32/0x40 [ 283.328699][T18250] proc_pid_cmdline_read+0x334/0x710 [ 283.328726][T18250] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 283.328750][T18250] vfs_readv+0x417/0x6d0 [ 283.328777][T18250] do_preadv+0x110/0x1d0 [ 283.328875][T18250] __x64_sys_preadv+0x58/0x70 [ 283.328904][T18250] x64_sys_call+0x20e8/0x2550 [ 283.328929][T18250] do_syscall_64+0x112/0x360 [ 283.328998][T18250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 283.329020][T18250] RIP: 0033:0x7f5e83fdfb19 [ 283.329035][T18250] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 283.329109][T18250] RSP: 002b:00007f5e82a0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 283.329131][T18250] RAX: ffffffffffffffda RBX: 00007f5e84266090 RCX: 00007f5e83fdfb19 [ 283.329144][T18250] RDX: 0000000000000001 RSI: 0000200000000a00 RDI: 0000000000000006 [ 283.329220][T18250] RBP: 00007f5e84077af8 R08: 00000000fffffff9 R09: 0000000000000000 [ 283.329256][T18250] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000000 [ 283.329272][T18250] R13: 00007f5e84266128 R14: 00007f5e84266090 R15: 00007ffc178c1478 [ 283.329299][T18250] [ 283.472361][T18272] No such timeout policy "syz1" [ 283.481774][T18274] syz_tun: entered allmulticast mode [ 283.483319][T18274] syz_tun: left allmulticast mode [ 283.543878][T18276] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18276 comm=syz.5.5201 [ 283.587098][T18284] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 283.631166][ T29] audit: type=1400 audit(1793623579.865:1451): avc: denied { write } for pid=18259 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 283.655180][T18295] loop5: detected capacity change from 0 to 1024 [ 283.662506][ T29] audit: type=1400 audit(1793623579.895:1452): avc: denied { mounton } for pid=18294 comm="syz.5.5206" path="/102/file0" dev="tmpfs" ino=545 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 283.665871][T18295] EXT4-fs (loop5): warning: mounting unchecked fs, running e2fsck is recommended [ 283.666417][T18295] EXT4-fs (loop5): Errors on filesystem, clearing orphan list. [ 283.729943][ T29] audit: type=1400 audit(1793623579.965:1453): avc: denied { write } for pid=18297 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 283.803280][T18311] netlink: 'syz.5.5209': attribute type 1 has an invalid length. [ 283.829621][T18311] 8021q: adding VLAN 0 to HW filter on device bond5 [ 283.850147][ T29] audit: type=1400 audit(1793623580.085:1454): avc: denied { write } for pid=18303 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 283.885408][T18311] bond4: (slave dummy0): Releasing active interface [ 283.891115][T18311] bond5: (slave dummy0): making interface the new active one [ 283.893076][T18311] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 283.900855][ T29] audit: type=1400 audit(1793623580.135:1455): avc: denied { write } for pid=18322 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 283.944895][T18330] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 283.982165][ T3382] sony 0005:054C:03D5.0029: UNIQ does not contain a MAC address; duplicate check skipped [ 283.986451][ T3382] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.0029/input/input20 [ 284.014287][ T3464] tipc: Node number set to 11578026 [ 284.044358][T18339] netlink: 'syz.7.5217': attribute type 1 has an invalid length. [ 284.053051][T18339] 8021q: adding VLAN 0 to HW filter on device bond4 [ 284.069014][ T3382] sony 0005:054C:03D5.0029: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 284.072188][T18339] dummy0: left promiscuous mode [ 284.074007][T18339] bond4: (slave dummy0): making interface the new active one [ 284.074475][T18339] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 284.109001][T18339] netlink: 'syz.7.5217': attribute type 10 has an invalid length. [ 284.109046][T18339] dummy0: entered promiscuous mode [ 284.126149][T18339] bond4: (slave dummy0): Releasing active interface [ 284.143468][T18346] fido_id[18346]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 284.172661][ T29] audit: type=1400 audit(1793623580.405:1456): avc: denied { write } for pid=18328 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 284.221187][ T29] audit: type=1400 audit(1793623580.455:1457): avc: denied { write } for pid=18357 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 284.506890][ T3464] sony 0005:054C:03D5.002A: UNIQ does not contain a MAC address; duplicate check skipped [ 284.509180][ T3464] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.002A/input/input21 [ 284.510512][ T3464] sony 0005:054C:03D5.002A: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 284.674651][T18401] __nla_validate_parse: 6 callbacks suppressed [ 284.674675][T18401] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5233'. [ 284.869039][T18408] syzkaller0: entered promiscuous mode [ 284.869236][T18408] syzkaller0: entered allmulticast mode [ 285.031113][T18415] FAULT_INJECTION: forcing a failure. [ 285.031113][T18415] name failslab, interval 1, probability 0, space 0, times 0 [ 285.031148][T18415] CPU: 0 UID: 0 PID: 18415 Comm: syz.7.5239 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 285.031260][T18415] Tainted: [W]=WARN [ 285.031267][T18415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 285.031279][T18415] Call Trace: [ 285.031285][T18415] [ 285.031291][T18415] __dump_stack+0x1d/0x30 [ 285.031318][T18415] dump_stack_lvl+0x95/0xd0 [ 285.031374][T18415] dump_stack+0x15/0x1b [ 285.031489][T18415] should_fail_ex+0x259/0x270 [ 285.031520][T18415] ? radix_tree_node_alloc+0xa0/0x200 [ 285.031555][T18415] should_failslab+0x8c/0xb0 [ 285.031586][T18415] kmem_cache_alloc_noprof+0x5e/0x3d0 [ 285.031687][T18415] ? radix_tree_node_alloc+0xa0/0x200 [ 285.031787][T18415] radix_tree_node_alloc+0xa0/0x200 [ 285.031879][T18415] radix_tree_insert+0x17b/0x3c0 [ 285.031908][T18415] uapi_add_get_elm+0x4f/0x110 [ 285.031941][T18415] uapi_merge_def+0x64c/0xd50 [ 285.031972][T18415] ? pcpu_block_update_hint_alloc+0x637/0x650 [ 285.032052][T18415] uapi_merge_def+0x206/0xd50 [ 285.032085][T18415] ? should_failslab+0x8c/0xb0 [ 285.032197][T18415] uverbs_alloc_api+0xbf/0x1420 [ 285.032228][T18415] ? ida_alloc_range+0x6f4/0x730 [ 285.032266][T18415] ib_uverbs_add_one+0x2b9/0x450 [ 285.032302][T18415] add_client_context+0x297/0x550 [ 285.032341][T18415] enable_device_and_get+0x116/0x260 [ 285.032386][T18415] ib_register_device+0x8c9/0xa40 [ 285.032446][T18415] siw_newlink+0x62d/0x670 [ 285.032467][T18415] nldev_newlink+0x3a8/0x430 [ 285.032528][T18415] ? __pfx_nldev_newlink+0x10/0x10 [ 285.032601][T18415] rdma_nl_rcv+0x439/0x570 [ 285.032631][T18415] ? selinux_nlmsg_lookup+0x9b/0x870 [ 285.032678][T18415] netlink_unicast+0x665/0x740 [ 285.032757][T18415] netlink_sendmsg+0x5ef/0x740 [ 285.032784][T18415] ? __pfx_netlink_sendmsg+0x10/0x10 [ 285.032806][T18415] ____sys_sendmsg+0x54a/0x590 [ 285.032828][T18415] ___sys_sendmsg+0x195/0x1e0 [ 285.032871][T18415] __x64_sys_sendmsg+0xd4/0x160 [ 285.032898][T18415] x64_sys_call+0x22ab/0x2550 [ 285.032922][T18415] do_syscall_64+0x112/0x360 [ 285.033028][T18415] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.033048][T18415] RIP: 0033:0x7f0f1d03fb19 [ 285.033064][T18415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 285.033081][T18415] RSP: 002b:00007f0f1ba97028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 285.033177][T18415] RAX: ffffffffffffffda RBX: 00007f0f1d2c5fa0 RCX: 00007f0f1d03fb19 [ 285.033218][T18415] RDX: 000000000000c000 RSI: 0000200000000440 RDI: 0000000000000005 [ 285.033296][T18415] RBP: 00007f0f1d0d7af8 R08: 0000000000000000 R09: 0000000000000000 [ 285.033318][T18415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 285.033331][T18415] R13: 00007f0f1d2c6038 R14: 00007f0f1d2c5fa0 R15: 00007fffa030cf28 [ 285.033392][T18415] [ 285.356613][T18432] netlink: 'syz.7.5245': attribute type 1 has an invalid length. [ 285.364885][T18432] 8021q: adding VLAN 0 to HW filter on device bond5 [ 285.369939][T18432] netlink: 28 bytes leftover after parsing attributes in process `syz.7.5245'. [ 285.370055][T18432] dummy0: left promiscuous mode [ 285.396269][T18432] bond5: (slave dummy0): making interface the new active one [ 285.396841][T18432] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 285.407225][T18432] netlink: 'syz.7.5245': attribute type 10 has an invalid length. [ 285.407244][T18432] netlink: 40 bytes leftover after parsing attributes in process `syz.7.5245'. [ 285.407343][T18432] dummy0: entered promiscuous mode [ 285.411896][T18432] bond5: (slave dummy0): Releasing active interface [ 285.432604][T18439] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 285.477472][ T3345] sony 0005:054C:03D5.002B: UNIQ does not contain a MAC address; duplicate check skipped [ 285.483583][ T3345] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.002B/input/input22 [ 285.497294][ T3345] sony 0005:054C:03D5.002B: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 285.548927][T18445] fido_id[18445]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 285.691529][T18454] loop1: detected capacity change from 0 to 2048 [ 285.692052][T18454] EXT4-fs: Ignoring removed nomblk_io_submit option [ 285.743889][T18452] syzkaller0: entered promiscuous mode [ 285.743910][T18452] syzkaller0: entered allmulticast mode [ 285.826900][T18470] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 285.861552][T18476] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18476 comm=syz.1.5263 [ 285.981234][T18491] syzkaller0: entered promiscuous mode [ 285.981254][T18491] syzkaller0: entered allmulticast mode [ 286.009830][T18499] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 286.061059][T18509] loop4: detected capacity change from 0 to 1024 [ 286.083672][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 286.083687][ T29] audit: type=1400 audit(1793623582.325:1462): avc: denied { write } for pid=18507 comm="syz.4.5277" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 286.086764][T18509] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1315: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 286.086906][T18509] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 286.086932][T18509] EXT4-fs (loop4): This should not happen!! Data will be lost [ 286.086932][T18509] [ 286.086964][T18509] EXT4-fs (loop4): Total free blocks count 0 [ 286.086979][T18509] EXT4-fs (loop4): Free/Dirty block details [ 286.086992][T18509] EXT4-fs (loop4): free_blocks=68451041280 [ 286.087008][T18509] EXT4-fs (loop4): dirty_blocks=16 [ 286.087056][T18509] EXT4-fs (loop4): Block reservation details [ 286.087069][T18509] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 286.087665][T18509] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 28 [ 286.087730][T18509] EXT4-fs (loop4): This should not happen!! Data will be lost [ 286.087730][T18509] [ 286.251782][T18531] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5288'. [ 286.312916][T18540] loop4: detected capacity change from 0 to 1024 [ 286.330498][ T29] audit: type=1400 audit(1793623582.565:1463): avc: denied { write } for pid=18539 comm="syz.4.5292" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 286.332634][T18540] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1315: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 286.332734][T18540] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 286.332803][T18540] EXT4-fs (loop4): This should not happen!! Data will be lost [ 286.332803][T18540] [ 286.332815][T18540] EXT4-fs (loop4): Total free blocks count 0 [ 286.332830][T18540] EXT4-fs (loop4): Free/Dirty block details [ 286.332841][T18540] EXT4-fs (loop4): free_blocks=68451041280 [ 286.332853][T18540] EXT4-fs (loop4): dirty_blocks=16 [ 286.332887][T18540] EXT4-fs (loop4): Block reservation details [ 286.332898][T18540] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 286.345176][T18535] syzkaller0: entered promiscuous mode [ 286.345195][T18535] syzkaller0: entered allmulticast mode [ 286.348724][T18540] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 28 [ 286.348826][T18540] EXT4-fs (loop4): This should not happen!! Data will be lost [ 286.348826][T18540] [ 286.356941][T18536] FAULT_INJECTION: forcing a failure. [ 286.356941][T18536] name failslab, interval 1, probability 0, space 0, times 0 [ 286.356973][T18536] CPU: 0 UID: 0 PID: 18536 Comm: syz.0.5289 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 286.357003][T18536] Tainted: [W]=WARN [ 286.357010][T18536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 286.357023][T18536] Call Trace: [ 286.357099][T18536] [ 286.357108][T18536] __dump_stack+0x1d/0x30 [ 286.357135][T18536] dump_stack_lvl+0x95/0xd0 [ 286.357156][T18536] dump_stack+0x15/0x1b [ 286.357192][T18536] should_fail_ex+0x259/0x270 [ 286.357230][T18536] ? __kernfs_new_node+0x70/0x440 [ 286.357255][T18536] should_failslab+0x8c/0xb0 [ 286.357311][T18536] kmem_cache_alloc_noprof+0x5e/0x3d0 [ 286.357373][T18536] ? __kernfs_new_node+0x70/0x440 [ 286.357398][T18536] __kernfs_new_node+0x70/0x440 [ 286.357423][T18536] ? __rcu_read_unlock+0x4e/0x70 [ 286.357449][T18536] ? up_write+0x19/0x60 [ 286.357472][T18536] ? kernfs_link_sibling+0x2f5/0x320 [ 286.357511][T18536] ? __rcu_read_unlock+0x4e/0x70 [ 286.357575][T18536] kernfs_new_node+0x107/0x140 [ 286.357607][T18536] __kernfs_create_file+0x4b/0x180 [ 286.357637][T18536] ? __pfx_dev_attr_show+0x10/0x10 [ 286.357746][T18536] ? __pfx_dev_attr_store+0x10/0x10 [ 286.357795][T18536] sysfs_add_file_mode_ns+0x132/0x1b0 [ 286.357829][T18536] sysfs_merge_group+0xed/0x1c0 [ 286.357852][T18536] dpm_sysfs_add+0xaf/0x1e0 [ 286.357933][T18536] device_add+0x3bc/0x790 [ 286.357954][T18536] netdev_register_kobject+0x127/0x240 [ 286.357998][T18536] register_netdevice+0xc68/0x13f0 [ 286.358034][T18536] tun_set_iff+0x603/0x880 [ 286.358087][T18536] __tun_chr_ioctl+0x682/0x1550 [ 286.358119][T18536] ? selinux_file_ioctl+0x333/0x3b0 [ 286.358143][T18536] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 286.358202][T18536] tun_chr_ioctl+0x27/0x40 [ 286.358230][T18536] __se_sys_ioctl+0xce/0x140 [ 286.358263][T18536] __x64_sys_ioctl+0x43/0x50 [ 286.358360][T18536] x64_sys_call+0x239d/0x2550 [ 286.358388][T18536] do_syscall_64+0x112/0x360 [ 286.358491][T18536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.358515][T18536] RIP: 0033:0x7f8efee3fb19 [ 286.358533][T18536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 286.358626][T18536] RSP: 002b:00007f8efd897028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 286.358726][T18536] RAX: ffffffffffffffda RBX: 00007f8eff0c5fa0 RCX: 00007f8efee3fb19 [ 286.358742][T18536] RDX: 0000200000000580 RSI: 00000000400454ca RDI: 0000000000000004 [ 286.358796][T18536] RBP: 00007f8efeed7af8 R08: 0000000000000000 R09: 0000000000000000 [ 286.358808][T18536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 286.358822][T18536] R13: 00007f8eff0c6038 R14: 00007f8eff0c5fa0 R15: 00007fff835e3758 [ 286.358872][T18536] [ 286.531959][T18552] loop7: detected capacity change from 0 to 2048 [ 286.578739][T18555] device-mapper: table: 252:5: raid: unknown target type [ 286.578755][T18555] device-mapper: ioctl: error adding target to table [ 286.578944][ T3464] sony 0005:054C:03D5.002C: UNIQ does not contain a MAC address; duplicate check skipped [ 286.596888][ T3464] input: syz0 as /devices/virtual/misc/uhid/0005:054C:03D5.002C/input/input23 [ 286.623901][ T3464] sony 0005:054C:03D5.002C: input,hidraw0: BLUETOOTH HID v0.00 Joystick [syz0] on syz0 [ 286.699599][T18564] netlink: 'syz.5.5302': attribute type 1 has an invalid length. [ 286.721649][T18561] fido_id[18561]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 286.726670][T18564] 8021q: adding VLAN 0 to HW filter on device bond6 [ 286.757154][T18564] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5302'. [ 286.790742][T18564] bond5: (slave dummy0): Releasing active interface [ 286.820951][T18576] netlink: 'syz.5.5302': attribute type 10 has an invalid length. [ 286.820968][T18576] netlink: 40 bytes leftover after parsing attributes in process `syz.5.5302'. [ 286.827581][T18564] bond6: (slave dummy0): making interface the new active one [ 286.867309][T18564] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 286.876694][T18581] netlink: 16 bytes leftover after parsing attributes in process `syz.7.5306'. [ 286.879392][T18576] dummy0: entered promiscuous mode [ 286.880189][T18576] bond6: (slave dummy0): Releasing active interface [ 286.916687][T18583] netlink: 'syz.7.5307': attribute type 1 has an invalid length. [ 286.922942][T18583] 8021q: adding VLAN 0 to HW filter on device bond6 [ 286.925867][T18586] syz_tun: entered allmulticast mode [ 286.926302][T18586] SELinux: failure in sel_netif_sid_slow(), invalid network interface (0) [ 286.926318][T18586] mroute: pending queue full, dropping entries [ 286.926756][T18586] syz_tun: left allmulticast mode [ 286.933125][T18583] netlink: 28 bytes leftover after parsing attributes in process `syz.7.5307'. [ 286.934084][T18583] bond6: entered promiscuous mode [ 286.934100][T18583] bond6: entered allmulticast mode [ 287.021522][T18589] syzkaller0: entered promiscuous mode [ 287.021547][T18589] syzkaller0: entered allmulticast mode [ 287.062009][T18599] syzkaller0: entered promiscuous mode [ 287.062032][T18599] syzkaller0: entered allmulticast mode [ 287.095816][T18605] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=18605 comm=syz.5.5317 [ 287.127304][T18608] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5318'. [ 287.140982][T18612] syz_tun: entered allmulticast mode [ 287.143095][T18612] syz_tun: left allmulticast mode [ 287.172079][T18609] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5319'. [ 287.202132][T18621] netlink: 'syz.1.5324': attribute type 2 has an invalid length. [ 287.319041][T18625] syzkaller0: entered promiscuous mode [ 287.319064][T18625] syzkaller0: entered allmulticast mode [ 287.527285][T18638] syzkaller0: entered promiscuous mode [ 287.527490][T18638] syzkaller0: entered allmulticast mode [ 288.100257][T18670] syzkaller0: entered promiscuous mode [ 288.100349][T18670] syzkaller0: entered allmulticast mode [ 288.235258][T18683] netlink: 'syz.7.5348': attribute type 1 has an invalid length. [ 288.240676][T18683] 8021q: adding VLAN 0 to HW filter on device bond7 [ 288.258297][T18683] bond7: entered promiscuous mode [ 288.258318][T18683] bond7: entered allmulticast mode [ 288.465231][T18712] netlink: 'syz.0.5361': attribute type 1 has an invalid length. [ 288.470989][T18712] 8021q: adding VLAN 0 to HW filter on device bond5 [ 288.474458][T18712] bond5: entered promiscuous mode [ 288.474478][T18712] bond5: entered allmulticast mode [ 288.514198][T18715] loop0: detected capacity change from 0 to 2048 [ 288.545464][T18715] loop0: p1 < > p4 [ 288.546372][T18715] loop0: p4 size 722688 extends beyond EOD, truncated [ 288.568276][ T2981] loop0: p1 < > p4 [ 288.568845][ T2981] loop0: p4 size 722688 extends beyond EOD, truncated [ 288.602386][T10990] udevd[10990]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 288.603488][T10992] udevd[10992]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 288.768434][T18736] netlink: 'syz.0.5372': attribute type 1 has an invalid length. [ 288.784963][T18736] 8021q: adding VLAN 0 to HW filter on device bond6 [ 288.786378][T18734] syz_tun: entered allmulticast mode [ 288.786998][T18734] syz_tun: left allmulticast mode [ 288.800191][T18736] bond6: entered promiscuous mode [ 288.800208][T18736] bond6: entered allmulticast mode [ 288.842449][T18741] loop7: detected capacity change from 0 to 2048 [ 288.887115][T18741] loop7: p1 < > p4 [ 288.887793][T18741] loop7: p4 size 722688 extends beyond EOD, truncated [ 288.891845][ T2981] loop7: p1 < > p4 [ 288.892322][ T2981] loop7: p4 size 722688 extends beyond EOD, truncated [ 288.935180][T18751] loop1: detected capacity change from 0 to 512 [ 288.937110][T18751] EXT4-fs: The data=journal mount option is deprecated and support will be removed in January 2028 [ 288.937125][T18751] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 288.939012][T18751] EXT4-fs error (device loop1): __ext4_iget:6490: inode #11: block 2: comm syz.1.5379: invalid block [ 288.939040][T18751] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 288.939181][T18751] EXT4-fs error (device loop1): ext4_orphan_get:1409: comm syz.1.5379: couldn't read orphan inode 11 (err -117) [ 288.939207][T18751] loop1: lost filesystem error report for type 5 error -117 [ 288.939785][T18751] EXT4-fs mount: 24 callbacks suppressed [ 288.939798][T18751] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 289.011337][T15467] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 289.036335][ T6252] udevd[6252]: inotify_add_watch(7, /dev/loop7p4, 10) failed: No such file or directory [ 289.044996][T10992] udevd[10992]: inotify_add_watch(7, /dev/loop7p1, 10) failed: No such file or directory [ 289.067707][T18763] syz_tun: entered allmulticast mode [ 289.068323][T18763] syz_tun: left allmulticast mode [ 289.191605][T18780] loop0: detected capacity change from 0 to 2048 [ 289.215501][T18780] loop0: p1 < > p4 [ 289.216779][T18780] loop0: p4 size 722688 extends beyond EOD, truncated [ 289.312064][ T29] audit: type=1400 audit(1793623585.545:1464): avc: denied { connect } for pid=18785 comm="syz.5.5394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 289.912302][T18798] syz_tun: entered allmulticast mode [ 289.912789][T18798] syz_tun: left allmulticast mode [ 290.052648][T18819] loop1: detected capacity change from 0 to 2048 [ 290.089311][T18819] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 290.105908][ T29] audit: type=1400 audit(1793623586.345:1465): avc: denied { write } for pid=18817 comm="syz.1.5406" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 290.108511][T18819] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1315: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 290.108664][T18819] EXT4-fs (loop1): Remounting filesystem read-only [ 290.129532][T15467] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 290.132008][T18832] loop5: detected capacity change from 0 to 128 [ 290.148394][T18832] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 290.150062][T18832] ext4 filesystem being mounted at /152/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 290.180421][ T29] audit: type=1400 audit(1793623586.395:1466): avc: denied { write } for pid=18830 comm="syz.5.5408" name="/" dev="loop5" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 290.180454][ T29] audit: type=1400 audit(1793623586.405:1467): avc: denied { write } for pid=18830 comm="syz.5.5408" name="/" dev="loop5" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 290.180499][ T29] audit: type=1400 audit(1793623586.405:1468): avc: denied { write } for pid=18830 comm="syz.5.5408" name="/" dev="loop5" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 290.180565][ T29] audit: type=1400 audit(1793623586.405:1469): avc: denied { write } for pid=18830 comm="syz.5.5408" name="/" dev="loop5" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 290.213274][ T29] audit: type=1400 audit(1793623586.435:1470): avc: denied { write } for pid=18818 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 290.232402][T16899] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 290.292398][ T29] audit: type=1400 audit(1793623586.525:1471): avc: denied { write } for pid=18844 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 290.385612][ T7586] bridge_slave_1: left allmulticast mode [ 290.385635][ T7586] bridge_slave_1: left promiscuous mode [ 290.385803][ T7586] bridge0: port 2(bridge_slave_1) entered disabled state [ 290.386490][ T7586] bridge_slave_0: left allmulticast mode [ 290.386509][ T7586] bridge_slave_0: left promiscuous mode [ 290.386585][ T7586] bridge0: port 1(bridge_slave_0) entered disabled state [ 290.396716][ T7586] pim6reg: left allmulticast mode [ 290.424679][ T7586] bridge_slave_1: left allmulticast mode [ 290.424700][ T7586] bridge_slave_1: left promiscuous mode [ 290.424823][ T7586] bridge0: port 2(bridge_slave_1) entered disabled state [ 290.449029][ T7586] bridge_slave_0: left allmulticast mode [ 290.449100][ T7586] bridge_slave_0: left promiscuous mode [ 290.449215][ T7586] bridge0: port 1(bridge_slave_0) entered disabled state [ 290.628654][ T7586] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 290.629894][ T7586] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 290.630699][ T7586] bond0 (unregistering): Released all slaves [ 290.632268][ T7586] bond1 (unregistering): (slave veth0_to_bond): Releasing active interface [ 290.632976][ T7586] bond1 (unregistering): Released all slaves [ 290.635776][ T7586] bond2 (unregistering): Released all slaves [ 290.638431][ T7586] bond3 (unregistering): Released all slaves [ 290.641224][ T7586] bond4 (unregistering): Released all slaves [ 290.645730][ T7586] bond5 (unregistering): Released all slaves [ 290.652022][ T7586] bond6 (unregistering): Released all slaves [ 290.656514][ T7586] bond7 (unregistering): Released all slaves [ 290.659669][ T7586] bond8 (unregistering): Released all slaves [ 290.662312][ T7586] bond9 (unregistering): Released all slaves [ 290.669321][ T7586] bond10 (unregistering): Released all slaves [ 290.672403][ T7586] bond11 (unregistering): Released all slaves [ 290.675279][ T7586] bond12 (unregistering): Released all slaves [ 290.678358][ T7586] bond13 (unregistering): Released all slaves [ 290.681138][ T7586] bond14 (unregistering): Released all slaves [ 290.733744][ T7586] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 290.760761][ T7586] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 290.761874][ T7586] bond0 (unregistering): Released all slaves [ 290.763645][ T7586] bond1 (unregistering): Released all slaves [ 290.766948][ T7586] bond2 (unregistering): Released all slaves [ 290.769755][ T7586] bond3 (unregistering): Released all slaves [ 290.772936][ T7586] bond4 (unregistering): Released all slaves [ 290.775943][ T7586] bond5 (unregistering): Released all slaves [ 290.779051][ T7586] bond6 (unregistering): Released all slaves [ 290.781753][ T7586] bond7 (unregistering): Released all slaves [ 290.785085][ T7586] bond8 (unregistering): Released all slaves [ 290.788158][ T7586] bond9 (unregistering): Released all slaves [ 290.790943][ T7586] bond10 (unregistering): Released all slaves [ 290.794052][ T7586] bond11 (unregistering): Released all slaves [ 290.872151][ T7586] tipc: Left network mode [ 290.889275][ T7586] tipc: Left network mode [ 290.917995][T18912] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 291.067122][ T7586] hsr_slave_0: left promiscuous mode [ 291.072531][ T7586] hsr_slave_1: left promiscuous mode [ 291.095957][ T7586] hsr_slave_0: left promiscuous mode [ 291.096408][ T7586] hsr_slave_1: left promiscuous mode [ 291.102389][ T7586] veth1_macvtap: left promiscuous mode [ 291.102524][ T7586] veth0_macvtap: left promiscuous mode [ 291.102568][ T7586] veth1_vlan: left promiscuous mode [ 291.102603][ T7586] veth0_vlan: left promiscuous mode [ 291.136500][ T7586] veth1_macvtap: left promiscuous mode [ 291.136529][ T7586] veth0_macvtap: left promiscuous mode [ 291.136578][ T7586] veth1_vlan: left promiscuous mode [ 291.136615][ T7586] veth0_vlan: left promiscuous mode [ 291.198105][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 291.198119][ T29] audit: type=1400 audit(1793623594.433:1476): avc: denied { write } for pid=18934 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 291.247683][ T29] audit: type=1326 audit(1793623594.483:1477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18969 comm="syz.0.5440" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8efee3fb19 code=0x7ffc0000 [ 291.248629][ T29] audit: type=1326 audit(1793623594.483:1478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18969 comm="syz.0.5440" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8efee3fb19 code=0x7ffc0000 [ 291.248923][ T29] audit: type=1326 audit(1793623594.483:1479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18969 comm="syz.0.5440" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f8efee3fb19 code=0x7ffc0000 [ 291.249362][ T29] audit: type=1326 audit(1793623594.483:1480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18969 comm="syz.0.5440" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8efee3fb19 code=0x7ffc0000 [ 291.250081][ T29] audit: type=1326 audit(1793623594.483:1481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18969 comm="syz.0.5440" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8efee3fb19 code=0x7ffc0000 [ 291.250247][ T29] audit: type=1326 audit(1793623594.483:1482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18969 comm="syz.0.5440" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8efee3fb19 code=0x7ffc0000 [ 291.250340][ T29] audit: type=1326 audit(1793623594.483:1483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18969 comm="syz.0.5440" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8efee3fb19 code=0x7ffc0000 [ 291.250572][ T29] audit: type=1326 audit(1793623594.483:1484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18969 comm="syz.0.5440" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f8efee3fb19 code=0x7ffc0000 [ 291.251568][ T29] audit: type=1326 audit(1793623594.483:1485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18969 comm="syz.0.5440" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8efee3fb19 code=0x7ffc0000 [ 291.517499][ T7586] team0 (unregistering): Port device team_slave_1 removed [ 291.519971][ T7586] team0 (unregistering): Port device team_slave_0 removed [ 291.555446][T18997] FAULT_INJECTION: forcing a failure. [ 291.555446][T18997] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 291.555479][T18997] CPU: 0 UID: 0 PID: 18997 Comm: syz.4.5451 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 291.555530][T18997] Tainted: [W]=WARN [ 291.555538][T18997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 291.555553][T18997] Call Trace: [ 291.555560][T18997] [ 291.555568][T18997] __dump_stack+0x1d/0x30 [ 291.555655][T18997] dump_stack_lvl+0x95/0xd0 [ 291.555678][T18997] dump_stack+0x15/0x1b [ 291.555697][T18997] should_fail_ex+0x259/0x270 [ 291.555725][T18997] should_fail+0xb/0x20 [ 291.555856][T18997] should_fail_usercopy+0x1a/0x20 [ 291.555890][T18997] _copy_from_iter+0xcc/0xe80 [ 291.555914][T18997] ? __kmalloc_large_node_noprof+0x18/0xa0 [ 291.555948][T18997] ? bcm_tx_setup+0x350/0xee0 [ 291.555997][T18997] ? bcm_tx_setup+0x4b8/0xee0 [ 291.556020][T18997] bcm_tx_setup+0x425/0xee0 [ 291.556044][T18997] bcm_sendmsg+0x38c/0x4c0 [ 291.556156][T18997] ? __pfx_bcm_sendmsg+0x10/0x10 [ 291.556191][T18997] ____sys_sendmsg+0x54a/0x590 [ 291.556242][T18997] ___sys_sendmsg+0x195/0x1e0 [ 291.556278][T18997] __x64_sys_sendmsg+0xd4/0x160 [ 291.556307][T18997] x64_sys_call+0x22ab/0x2550 [ 291.556352][T18997] do_syscall_64+0x112/0x360 [ 291.556384][T18997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 291.556405][T18997] RIP: 0033:0x7f5e83fdfb19 [ 291.556424][T18997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 291.556443][T18997] RSP: 002b:00007f5e82a2f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 291.556543][T18997] RAX: ffffffffffffffda RBX: 00007f5e84265fa0 RCX: 00007f5e83fdfb19 [ 291.556560][T18997] RDX: 0000000000000001 RSI: 0000200000000440 RDI: 0000000000000004 [ 291.556575][T18997] RBP: 00007f5e84077af8 R08: 0000000000000000 R09: 0000000000000000 [ 291.556589][T18997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 291.556601][T18997] R13: 00007f5e84266038 R14: 00007f5e84265fa0 R15: 00007ffc178c1478 [ 291.556618][T18997] [ 291.573919][ T9513] smc: removing ib device sz1 [ 291.711147][T19008] FAULT_INJECTION: forcing a failure. [ 291.711147][T19008] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 291.711235][T19008] CPU: 1 UID: 0 PID: 19008 Comm: syz.4.5456 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 291.711268][T19008] Tainted: [W]=WARN [ 291.711276][T19008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 291.711290][T19008] Call Trace: [ 291.711297][T19008] [ 291.711306][T19008] __dump_stack+0x1d/0x30 [ 291.711373][T19008] dump_stack_lvl+0x95/0xd0 [ 291.711476][T19008] dump_stack+0x15/0x1b [ 291.711572][T19008] should_fail_ex+0x259/0x270 [ 291.711601][T19008] should_fail+0xb/0x20 [ 291.711661][T19008] should_fail_usercopy+0x1a/0x20 [ 291.711773][T19008] _copy_from_iter+0xcc/0xe80 [ 291.711799][T19008] ? __pfx_futex_wake_mark+0x10/0x10 [ 291.711914][T19008] write_pool_user+0x75/0x200 [ 291.711948][T19008] ? __pfx_random_write_iter+0x10/0x10 [ 291.712017][T19008] random_write_iter+0x15/0x20 [ 291.712046][T19008] vfs_write+0x57a/0x990 [ 291.712081][T19008] ksys_write+0xdc/0x1a0 [ 291.712167][T19008] __x64_sys_write+0x40/0x50 [ 291.712198][T19008] x64_sys_call+0x154e/0x2550 [ 291.712294][T19008] do_syscall_64+0x112/0x360 [ 291.712327][T19008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 291.712401][T19008] RIP: 0033:0x7f5e83fdfb19 [ 291.712493][T19008] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 291.712514][T19008] RSP: 002b:00007f5e82a2f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 291.712535][T19008] RAX: ffffffffffffffda RBX: 00007f5e84265fa0 RCX: 00007f5e83fdfb19 [ 291.712639][T19008] RDX: 0000000000010010 RSI: 0000200000000280 RDI: 0000000000000004 [ 291.712654][T19008] RBP: 00007f5e84077af8 R08: 0000000000000000 R09: 0000000000000000 [ 291.712709][T19008] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 291.712722][T19008] R13: 00007f5e84266038 R14: 00007f5e84265fa0 R15: 00007ffc178c1478 [ 291.712742][T19008] [ 291.801174][ T7586] team0 (unregistering): Port device team_slave_1 removed [ 291.840933][ T7586] team0 (unregistering): Port device team_slave_0 removed [ 292.002931][T19019] loop4: detected capacity change from 0 to 2048 [ 292.028856][T19019] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 292.032042][ T23] infiniband sz1: ib_query_port failed (-19) [ 292.072455][T14436] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 292.607378][T19060] loop1: detected capacity change from 0 to 2048 [ 292.641735][T19060] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 292.699945][T15467] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 292.728072][T19084] __nla_validate_parse: 4 callbacks suppressed [ 292.728090][T19084] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5482'. [ 292.935966][T19132] device-mapper: table: 252:15: multipath: unknown target type [ 292.936040][T19132] device-mapper: ioctl: error adding target to table [ 293.069152][T19163] loop5: detected capacity change from 0 to 2048 [ 293.089573][T19163] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 293.113707][T19173] loop4: detected capacity change from 0 to 1024 [ 293.115763][T19173] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 293.118602][T16899] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 293.192134][T19184] netlink: 'syz.5.5506': attribute type 3 has an invalid length. [ 293.348993][T19206] netlink: 'syz.5.5517': attribute type 1 has an invalid length. [ 293.354478][T19206] 8021q: adding VLAN 0 to HW filter on device bond7 [ 293.357570][T19206] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5517'. [ 293.357638][T19206] bond7: entered promiscuous mode [ 293.357654][T19206] bond7: entered allmulticast mode [ 293.358858][T19206] netlink: 'syz.5.5517': attribute type 10 has an invalid length. [ 293.358913][T19206] netlink: 40 bytes leftover after parsing attributes in process `syz.5.5517'. [ 293.593402][T19224] loop5: detected capacity change from 0 to 1024 [ 293.604471][T19224] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 293.606826][T19224] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1315: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 293.606884][T19224] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 293.606905][T19224] EXT4-fs (loop5): This should not happen!! Data will be lost [ 293.606905][T19224] [ 293.606916][T19224] EXT4-fs (loop5): Total free blocks count 0 [ 293.606928][T19224] EXT4-fs (loop5): Free/Dirty block details [ 293.606981][T19224] EXT4-fs (loop5): free_blocks=68451041280 [ 293.606996][T19224] EXT4-fs (loop5): dirty_blocks=16 [ 293.607009][T19224] EXT4-fs (loop5): Block reservation details [ 293.607020][T19224] EXT4-fs (loop5): i_reserved_data_blocks=1 [ 293.607619][T19224] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 28 [ 294.440166][T19261] netlink: 'syz.4.5542': attribute type 1 has an invalid length. [ 294.444592][T19261] 8021q: adding VLAN 0 to HW filter on device bond9 [ 294.448131][T19261] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5542'. [ 294.448171][T19261] bond9: entered promiscuous mode [ 294.448187][T19261] bond9: entered allmulticast mode [ 294.503437][ T618] bond8: (slave dummy0): link status definitely down, disabling slave [ 294.503517][ T618] bond8: now running without any active interface! [ 294.898277][T19281] syzkaller0: entered promiscuous mode [ 294.898297][T19281] syzkaller0: entered allmulticast mode [ 295.008513][T19287] netlink: 'syz.5.5554': attribute type 1 has an invalid length. [ 295.012783][T19287] 8021q: adding VLAN 0 to HW filter on device bond8 [ 295.016492][T19287] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5554'. [ 295.016549][T19287] bond8: entered promiscuous mode [ 295.016564][T19287] bond8: entered allmulticast mode [ 295.017751][T19287] dummy0: left promiscuous mode [ 295.770815][T19093] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 295.821178][ T9] hid-generic 0000:0000:0000.002D: unknown main item tag 0x0 [ 295.825021][ T9] hid-generic 0000:0000:0000.002D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 295.877299][T19372] loop5: detected capacity change from 0 to 1024 [ 295.897254][T19372] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 295.912876][T19372] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1315: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 295.912952][T19372] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 295.912975][T19372] EXT4-fs (loop5): This should not happen!! Data will be lost [ 295.912975][T19372] [ 295.912988][T19372] EXT4-fs (loop5): Total free blocks count 0 [ 295.913003][T19372] EXT4-fs (loop5): Free/Dirty block details [ 295.913014][T19372] EXT4-fs (loop5): free_blocks=68451041280 [ 295.913087][T19372] EXT4-fs (loop5): dirty_blocks=16 [ 295.913097][T19372] EXT4-fs (loop5): Block reservation details [ 295.913109][T19372] EXT4-fs (loop5): i_reserved_data_blocks=1 [ 295.916698][T19372] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 28 [ 295.976744][T19389] loop7: detected capacity change from 0 to 128 [ 295.981414][T19389] FAT-fs (loop7): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 296.060120][T19400] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5605'. [ 296.120550][T19412] loop5: detected capacity change from 0 to 1024 [ 296.137669][T19412] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 296.139788][T19412] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1315: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 296.139844][T19412] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 296.139883][T19412] EXT4-fs (loop5): This should not happen!! Data will be lost [ 296.139883][T19412] [ 296.139896][T19412] EXT4-fs (loop5): Total free blocks count 0 [ 296.139911][T19412] EXT4-fs (loop5): Free/Dirty block details [ 296.139924][T19412] EXT4-fs (loop5): free_blocks=68451041280 [ 296.139961][T19412] EXT4-fs (loop5): dirty_blocks=16 [ 296.139975][T19412] EXT4-fs (loop5): Block reservation details [ 296.139988][T19412] EXT4-fs (loop5): i_reserved_data_blocks=1 [ 296.140662][T19412] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 28 [ 296.218674][T19423] loop1: detected capacity change from 0 to 2048 [ 296.228187][T19423] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 296.243417][T15467] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 296.272932][T19428] netlink: 'syz.1.5616': attribute type 1 has an invalid length. [ 296.292859][T19426] bridge_slave_0: left allmulticast mode [ 296.292880][T19426] bridge_slave_0: left promiscuous mode [ 296.292966][T19426] bridge0: port 1(bridge_slave_0) entered disabled state [ 296.313026][T19426] bridge_slave_1: left allmulticast mode [ 296.313058][T19426] bridge_slave_1: left promiscuous mode [ 296.313110][T19426] bridge0: port 2(bridge_slave_1) entered disabled state [ 296.332257][T19426] bond0: (slave bond_slave_0): Releasing backup interface [ 296.340909][T19426] bond0: (slave bond_slave_1): Releasing backup interface [ 296.354319][T19426] team0: Port device team_slave_0 removed [ 296.357240][T19426] team0: Port device team_slave_1 removed [ 296.358286][T19426] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 296.358303][T19426] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 296.359735][T19426] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 296.359751][T19426] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 296.362755][T19426] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 296.395244][T19436] loop1: detected capacity change from 0 to 512 [ 296.406768][T19436] EXT4-fs error (device loop1): ext4_orphan_get:1404: inode #15: comm syz.1.5619: iget: bad i_size value: 38620345925642 [ 296.406827][T19436] loop1: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 296.406992][T19436] EXT4-fs error (device loop1): ext4_orphan_get:1409: comm syz.1.5619: couldn't read orphan inode 15 (err -117) [ 296.407018][T19436] loop1: lost filesystem error report for type 5 error -117 [ 296.407801][T19436] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 296.411008][ T29] kauditd_printk_skb: 34 callbacks suppressed [ 296.411023][ T29] audit: type=1400 audit(1793623599.643:1520): avc: denied { write } for pid=19435 comm="syz.1.5619" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 296.412474][T19436] EXT4-fs error (device loop1): ext4_validate_block_bitmap:436: comm syz.1.5619: bg 0: block 5: invalid block bitmap [ 296.425627][T19426] vlan0: entered promiscuous mode [ 296.432610][T19426] team0: Port device vlan0 added [ 296.452115][T15467] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 296.594733][T19452] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 296.595656][ T29] audit: type=1400 audit(1793623599.833:1521): avc: denied { write } for pid=19450 comm="syz.4.5625" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 296.596468][T19452] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1315: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 296.596504][T19452] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 296.596570][T19452] EXT4-fs (loop4): This should not happen!! Data will be lost [ 296.596570][T19452] [ 296.596642][T19452] EXT4-fs (loop4): Total free blocks count 0 [ 296.596650][T19452] EXT4-fs (loop4): Free/Dirty block details [ 296.596658][T19452] EXT4-fs (loop4): free_blocks=68451041280 [ 296.596666][T19452] EXT4-fs (loop4): dirty_blocks=16 [ 296.596673][T19452] EXT4-fs (loop4): Block reservation details [ 296.596680][T19452] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 296.597151][T19452] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 4 with error 28 [ 296.729701][ T29] audit: type=1400 audit(1793623599.963:1522): avc: denied { ioctl } for pid=19462 comm="syz.1.5630" path="socket:[59962]" dev="sockfs" ino=59962 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 296.736730][ T29] audit: type=1400 audit(1793623599.963:1523): avc: denied { write } for pid=19462 comm="syz.1.5630" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 296.893312][T19477] rxe_eth0 speed is unknown, defaulting to 1000 [ 298.469478][T19517] set_capacity_and_notify: 1 callbacks suppressed [ 298.469492][T19517] loop1: detected capacity change from 0 to 1024 [ 298.483735][T19517] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 298.517279][ T29] audit: type=1400 audit(1793623601.753:1524): avc: denied { write } for pid=19515 comm="syz.1.5653" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 298.970689][T19384] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 299.035133][T19517] ================================================================== [ 299.035173][T19517] BUG: KCSAN: data-race in file_write_and_wait_range / xas_set_mark [ 299.035226][T19517] [ 299.035231][T19517] write to 0xffff88811a89d29c of 4 bytes by task 19516 on cpu 0: [ 299.035247][T19517] xas_set_mark+0x12b/0x140 [ 299.035281][T19517] __folio_start_writeback+0x16b/0x370 [ 299.035313][T19517] ext4_bio_write_folio+0x5a2/0xa10 [ 299.035344][T19517] mpage_process_page_bufs+0x484/0x5e0 [ 299.035366][T19517] mpage_prepare_extent_to_map+0x836/0xc90 [ 299.035386][T19517] ext4_do_writepages+0xa69/0x2740 [ 299.035410][T19517] ext4_writepages+0x18c/0x300 [ 299.035426][T19517] do_writepages+0x1b9/0x300 [ 299.035450][T19517] file_write_and_wait_range+0x186/0x300 [ 299.035478][T19517] ext4_sync_file+0x114/0x5c0 [ 299.035505][T19517] vfs_fsync_range+0xc5/0xe0 [ 299.035528][T19517] ext4_buffered_write_iter+0x518/0x580 [ 299.035561][T19517] ext4_file_write_iter+0x36e/0x1020 [ 299.035593][T19517] iter_file_splice_write+0x6a0/0xa60 [ 299.035615][T19517] direct_splice_actor+0x153/0x270 [ 299.035634][T19517] splice_direct_to_actor+0x2f5/0x680 [ 299.035653][T19517] do_splice_direct+0x119/0x1a0 [ 299.035671][T19517] do_sendfile+0x37d/0x640 [ 299.035690][T19517] __x64_sys_sendfile64+0x105/0x150 [ 299.035719][T19517] x64_sys_call+0x1015/0x2550 [ 299.035743][T19517] do_syscall_64+0x112/0x360 [ 299.035769][T19517] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.035789][T19517] [ 299.035794][T19517] read to 0xffff88811a89d29c of 4 bytes by task 19517 on cpu 1: [ 299.035813][T19517] file_write_and_wait_range+0x139/0x300 [ 299.035846][T19517] ext4_sync_file+0x114/0x5c0 [ 299.035871][T19517] vfs_fsync_range+0xc5/0xe0 [ 299.035892][T19517] ext4_buffered_write_iter+0x518/0x580 [ 299.035919][T19517] ext4_file_write_iter+0x36e/0x1020 [ 299.035948][T19517] iter_file_splice_write+0x6a0/0xa60 [ 299.035971][T19517] direct_splice_actor+0x153/0x270 [ 299.035992][T19517] splice_direct_to_actor+0x2f5/0x680 [ 299.036011][T19517] do_splice_direct+0x119/0x1a0 [ 299.036033][T19517] do_sendfile+0x37d/0x640 [ 299.036055][T19517] __x64_sys_sendfile64+0x105/0x150 [ 299.036076][T19517] x64_sys_call+0x1015/0x2550 [ 299.036098][T19517] do_syscall_64+0x112/0x360 [ 299.036124][T19517] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.036145][T19517] [ 299.036150][T19517] value changed: 0x05000021 -> 0x02000021 [ 299.036163][T19517] [ 299.036168][T19517] Reported by Kernel Concurrency Sanitizer on: [ 299.036181][T19517] CPU: 1 UID: 0 PID: 19517 Comm: syz.1.5653 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 299.036213][T19517] Tainted: [W]=WARN [ 299.036221][T19517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 299.036234][T19517] ================================================================== [ 299.443272][T15467] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.