last executing test programs: 3.103506085s ago: executing program 3 (id=1616): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000080)='./file2\x00', 0x8000, &(0x7f0000000740)={[{@barrier}]}, 0x3, 0x542, &(0x7f0000000cc0)="$eJzs3dFrJHcdAPDvTHYvubucSdUHLViLVu6q3ubSeG3woSqIPhXUiq91TTYhZHN7JJv2EopN8Q8QRLTgiz75IvgHCNIX30Uo6LuoKFKv+qDQdmRmZ3u5vd3k4HYzsPl8YG7mNzM73+9v9uaX329n2A3g3HoyIq5FxExEPB0RC+X6tJziqDfl+71z99W1fEoiy158O4mkXNc/1mw5v1y+bC4ivvX1iO8lD8bdOzjcbrbbrd2yvNTdSd7NssPrWzvNzdZm69bKyvKzq8+t3ly9MZZ6LkbE81/9209++MuvPf/bz7/y55f+ce37eVr/y7LXYqAe49Srer04F321iNidRLCK1Ioa9tysOBcAAE6W9/c/HBGfKvr/CzFT9OYAAACAaZJ9aT7eTSIyAAAAYGqlETEfSdoon/edjzRtNHrP8H40LqXtzl73cxud/Vvr+baIxainG1vt1o3y2YHFqCd5ebl8xrZffmagvBIRj0XEjxcuFuXGWqe9XvWHHwAAAHBOXB4Y//9noTf+LxxVnBwAAAAwPotVJwAAAABMnPE/AAAATD/jfwAAAJhq33jhhXzK+r9/vf7ywf525+Xr66297cbO/lpjrbN7u7HZ6WwW39m3c9rx2p3O7S/Erf07S93WXndp7+DwpZ3OfvFb4XNnUiEAAADgAY998s0/JRFx9MWLxZS7UG6rR2Qzx3euVZEhMCnpkHUzo3b+62RzAc7W8Wv9YoV5AGdPlx7Or3rVCQCVS07ZPvLhnd+PPxcAAGAyrn589P3/tzcqTQ2YsPL+f3La+B+YPiOf9TludvJ5AGevd//v/axn2B56BjCt6if1AFz6MPXS8dz/P+VRwkSDAgAAFZsvpiRtlOOA+UjTRiPiSvGzAPVkY6vduhERH4qIPy7UZ/PycvHKRG8eAAAAAAAAAAAAAAAAAAAAAAAAAB5SliWRAQAAAFMtIv17/5e5ri48NT/4+cCF5L8LxTwiXvnZiz+90+x2d5fz9f/6YH33jXL9M1V8ggEAAAAM6o/T++N4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABind+6+utafzjLuP78SEYvD4tdirpjPRT0iLv07idqx1yURMTOG+EevR8THhsVP8rRisczivvgXItKIuDiu+EPP/wnxoxf/8hjiw3n2Zt7+fHnY9ZfGk8V8+PVXK6dHNbr9Sz9o/2ZGtH9XRh20fn/x8bd+vTQy/usRj9eGtz/9+El+vCHxP/2Qdfzutw8PR23LfhFxdVj7l9wfa6m7c3tp7+Dw+tZOc7O12bq1srL87OpzqzdXbyxtbLVb5b9DY/zoE795/17pvQfqf+mE9reo/4jz/9QJdZ49tvzeW3fufqS3OPDORD1+niW1ofHT3uyzD8bv/+37TLlXXs7PYfrGd4bm8sSv/vDEqDzz+q+PqP/cKfW/dkL9j3v6mz/4y0PuCgCcgb2Dw+1mu93atVDxQlL2eB/lOP1PRE7d+cqj5pz3O6s+Y60kkthutmfjvk3N6hPrLbxWvhvNdv9qG9ORf1f+V5lk8mfdEAEAABN3r9M/uOXeDRj3mQEAAAAAAAAAAAAAAAAAAGCyTv0asFGb0oh4yK8TG4x5VE1VAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABO9P8AAAD//xQlyxg=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x40086604, 0xfffffffffffffffe) 3.010496167s ago: executing program 3 (id=1619): r0 = syz_clone(0x11, 0x0, 0xb, 0x0, 0x0, 0x0) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) ptrace$ARCH_SET_CPUID(0x1e, r0, 0x1, 0x1012) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x560f, &(0x7f0000000040)={0x1, 0x1, 0x4000000d, 0x20, 0xb8, 0x0}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, 0xffffffffffffffff, &(0x7f0000000200)={0x2000}) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, 0xffffffffffffffff, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) unshare(0x22020400) unshare(0x60000200) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000280)={@dev={0xfe, 0x80, '\x00', 0x14}, 0x800, 0x0, 0x103, 0x1}, 0x20) r4 = socket$inet6(0xa, 0x2, 0x0) close(r4) r5 = socket$l2tp6(0xa, 0x2, 0x73) mount(&(0x7f0000000140)=@sr0, &(0x7f0000000080)='.\x00', &(0x7f00000001c0)='tracefs\x00', 0x2200890, 0x0) setsockopt$inet6_int(r4, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendmsg$inet6(r5, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @remote, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="240000000000000001"], 0x9a}, 0x3400c8d4) ioprio_set$pid(0x2, r0, 0x2007) sendmsg$inet6(r3, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e1e, 0x80000, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="120000000000000029000000", @ANYRES8=r3], 0x18}, 0x0) 2.943201769s ago: executing program 3 (id=1620): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000880)='veth0\x00', 0x6) sendto$inet6(r1, 0x0, 0xfec0, 0x0, &(0x7f0000000a00)={0xa, 0x5000, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) 2.8790008s ago: executing program 3 (id=1622): socket(0x28, 0x5, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./sys\x00', 0x1ff) perf_event_open(&(0x7f0000000000)={0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x8518}, 0x4204, 0xe7e, 0x0, 0x3, 0x800000, 0x43, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f00000002c0)='./sys/bus/serio/devices/serio0/drvctl\x00', &(0x7f0000000040)='sysfs\x00', 0x44004, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r0, &(0x7f0000006980)=[{{&(0x7f0000000040)={0xa, 0x4e22, 0x55a, @private1, 0x7}, 0x1c, &(0x7f00000007c0)=[{&(0x7f0000000300)="0018428b", 0x4}], 0x1}}], 0x1, 0xc010) sendmmsg$inet6(r0, &(0x7f00000001c0)=[{{&(0x7f0000000600)={0xa, 0x4e24, 0xfdff, @private2, 0xffffffff}, 0x1c, &(0x7f0000000680)=[{&(0x7f0000000240)="9e5f77c89fc9e583f4f109bec59a05428406dd77c51382d6ace7705b223e754ab803d9989514a5699aca95f926f0128e7492dc4bbb949d817a20b861097fe4c1d7204326968c88e55fbf76b8", 0x4c}], 0x1}}, {{&(0x7f0000000b40)={0xa, 0x4e20, 0x8081, @dev={0xfe, 0x80, '\x00', 0xc3}, 0x3}, 0x1c, &(0x7f0000000f80)=[{&(0x7f0000000b80)='S', 0x1}], 0x1}}], 0x2, 0x20044040) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600004e20590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/serio/devices/serio0/drvctl\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)='atkbd', 0x5) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r2, 0xc0505350, &(0x7f0000000240)={{0x8, 0x9e}, {0x4, 0x9b}, 0xffffffff, 0x5, 0xf9}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=@newlink={0x50, 0x10, 0xffffff1f, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x15482, 0x77288}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x31}}]}}}, @IFLA_MTU={0x8, 0x4, 0x8000008}]}, 0x50}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000e0400000000000000000000000000000d030000000000000000000002000000000000000000000002030000000000000063"], 0x0, 0x52}, 0x28) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) syz_open_dev$mouse(&(0x7f0000000180), 0x80000000000, 0x20c000) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r2, 0xc0a85322, &(0x7f0000000300)) 2.354719603s ago: executing program 1 (id=1624): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000001000000000000008018000095"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) socket(0x2d, 0x2, 0x0) perf_event_open(&(0x7f0000000540)={0x5, 0x80, 0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x100000000000000}, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000101050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e6574"], 0x5c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 2.175243267s ago: executing program 1 (id=1628): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) keyctl$invalidate(0x15, r1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000080)={r1}, 0x0, 0x0, 0x0) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000e80)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035511030c2943657274f8ff696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2c00952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef1727aafcc9ec2f73650114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd199ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603552f130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020123c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40fa7b7fb252beb178f852cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f262", 0x55a, r3) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000000c0)={r3, 0x67, 0x1000}, &(0x7f0000000140)={'enc=', 'raw', ' hash=', {'sha256-mb\x00'}}, &(0x7f0000000780)="1d01c2da87d7704f6d474588c1fa638fcc79bf1dde871bb64899484108e0b8df6efebe8deea28d017b46bd01ae214dc164227ff73b5f023a5d2da3b27b12f607f02c228f7d7d1b79f063686994d6b0ab07be48597c1585b0be1f5c677bbe6be96e62853b025566", &(0x7f0000000800)=""/4096) ioctl$SIOCSIFHWADDR(r2, 0x891c, &(0x7f0000000000)={'erspan0\x00', @random="0200ff00"}) 2.131631148s ago: executing program 1 (id=1630): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0xb8}}, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0x46d, 0x57, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x3, 0x0, 0x10, "", [{{0x9, 0x4, 0x0, 0x7f, 0x1, 0x3, 0x1, 0x0, 0x7, {0x9, 0x21, 0x9, 0xbe, 0x1, {0x22, 0xf2a}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x5, 0x81, 0x4}}}}}]}}]}}, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401f, 0x68180, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x6f, 0x1, @perf_bp={0x0, 0x1}, 0x116078, 0x0, 0x0, 0x3, 0x6, 0x8001, 0x4}, 0x0, 0xff6fbfffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0xa16ae, 0x9, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x90, 0xa4, 0x2, 0x5, 0xa1, 0x9b9b, 0x8, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x4}}, 0x0, 0x1, 0xffffffffffffffff, 0x0) futex(0x0, 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x20) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x63, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, @perf_config_ext={0xfffffffd, 0xfc}, 0x0, 0x0, 0x800000, 0x6, 0x2, 0xcb, 0xffff, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xfff7ffffffffffff, 0xffffffffffffffff, 0x1) futex(0x0, 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}], 0x1}, 0x20004080) perf_event_open(&(0x7f0000000140)={0x5, 0x80, 0x30, 0x1, 0x0, 0x3, 0x0, 0x7, 0x520, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, @perf_bp={0x0, 0xd1ec429b5ab78f3e}, 0x0, 0x1224, 0x0, 0x5, 0x8, 0x4020005, 0x0, 0x0, 0x0, 0x0, 0x200000102ffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001100010027bd7000fedbdf2500000000", @ANYRES32=r3], 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x80) r4 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x30, 0x1, 0x0, 0x0, 0x0, 0x9, 0xf40d9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_bp={0x0}, 0x204, 0x8, 0x43a1bd76, 0x3, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x200c}, 0x0, 0x4000000000, 0xffffffffffffffff, 0x8) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) timer_create(0x0, 0x0, &(0x7f0000000100)) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000380)={{{@in=@loopback, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={""/10, ""/2, @remote}}, 0x0, @in=@multicast2}}, &(0x7f0000000480)=0xe8) unshare(0x2a020480) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x2f, 0x1, 0x0, 0x0, 0x0, 0xf, 0x520, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4, @perf_config_ext={0x5, 0x8}, 0x10ed08, 0x1224, 0x0, 0x5, 0x4, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x2000001020000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_DELSETELEM={0x40, 0xe, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "cd9a"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) quotactl_fd$Q_GETFMT(r4, 0xffffffff80000401, r6, &(0x7f0000000540)) 2.104539579s ago: executing program 2 (id=1631): r0 = syz_clone(0x11, 0x0, 0xb, 0x0, 0x0, 0x0) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) ptrace$ARCH_SET_CPUID(0x1e, r0, 0x1, 0x1012) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x560f, &(0x7f0000000040)={0x1, 0x1, 0x4000000d, 0x20, 0xb8, 0x0}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, 0xffffffffffffffff, &(0x7f0000000200)={0x2000}) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, 0xffffffffffffffff, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x0, 0x10001, 0x6}, &(0x7f0000000100)=0x10) unshare(0x22020400) unshare(0x60000200) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000280)={@dev={0xfe, 0x80, '\x00', 0x14}, 0x800, 0x0, 0x103, 0x1}, 0x20) r3 = socket$inet6(0xa, 0x2, 0x0) close(r3) r4 = socket$l2tp6(0xa, 0x2, 0x73) mount(&(0x7f0000000140)=@sr0, &(0x7f0000000080)='.\x00', &(0x7f00000001c0)='tracefs\x00', 0x2200890, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendmsg$inet6(r4, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @remote, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="240000000000000001"], 0x9a}, 0x3400c8d4) ioprio_set$pid(0x2, r0, 0x2007) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e1e, 0x80000, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="120000000000000029000000", @ANYRES8], 0x18}, 0x0) 1.933716593s ago: executing program 2 (id=1632): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x109902, 0x0) r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000040)=0x1c, 0x1000) setsockopt$inet6_buf(r0, 0x29, 0x2a, &(0x7f0000000080)="0a145b83f59a5372f8b806367fdff24b7cde9f3742b4ba443a45ead8893410d2b878ae65689d6c26072b3d05f1d4ecef75d00023664760d275ce25a8774d543c897197a730c8efc211ffd12ccd56f54c58f1ee291872c49fb41d0d795e8b1e77d546fadcbf358e42b56e372194108dea532b9ee69638378b8997dfd50f2d4e3e2ba360c8c8300c3373db36fefa75ff853a18b39cba8746ea32547a0a94a98be0dc3bb67d1862898e2352d1b1cd7a16060d4104df288fd01d146dbce1d7d72be45d95555f04ce5754dc3db847b6b81a52f341978c2615ce3928e2abac4fbb67fc72e002ff3f04648268ea39f68e671350ba41e2febd", 0xf5) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x4e24, @remote}, 0x10) 1.851739615s ago: executing program 3 (id=1634): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000001980), 0x200) readv(r4, &(0x7f0000003a80)=[{&(0x7f0000000040)=""/7, 0x7}, {0x0}], 0x2) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r5) unlink(&(0x7f0000000280)='./cgroup\x00') sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x5, 0x20081, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x2, @perf_config_ext={0x4}, 0x2, 0x1, 0x7fffffff, 0x0, 0x2, 0x80000011, 0x1, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x9) set_mempolicy(0x6, &(0x7f00000003c0)=0x8000000000000001, 0xe0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000900000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r7, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000140)}, 0x20) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x6f1c, r8}, 0x38) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r9) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) epoll_pwait(r2, 0x0, 0x0, 0xffff, 0x0, 0x0) r10 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r10, 0x560a, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c000000100001080072635cf95a6e", @ANYRES32=0x0, @ANYBLOB="312000000000000004002b8008001b0000"], 0x2c}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 1.677680129s ago: executing program 4 (id=1635): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x10e0c2, 0x0, 0x40000, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, 0x0, 0x0}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x2, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0xfff9, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) 1.435672295s ago: executing program 2 (id=1636): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'gre0\x00', 0x0}) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000080)='.pending_reads\x00', 0x101200, 0x14b) r3 = accept$packet(r2, &(0x7f0000000140), &(0x7f0000000180)=0x14) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f00000001c0)={0x3, 'pimreg0\x00', {0x1}, 0x2}) write$qrtrtun(r2, &(0x7f0000000100)="234351147bc1d93e2300b9dee61b7e31b048afc9bd5434bac38f852df2b216c1e12f0d0c85b1381dd4dc4882339d1485b0417c319c", 0x35) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001000210425b970000000000000000000", @ANYRES32=r1, @ANYBLOB="00000000000001009bff08000100677200001400028006000f00a5e50000060010004e0000000000"], 0x40}}, 0x0) ioctl$XFS_IOC_READLINK_BY_HANDLE(r0, 0xc038586c, &(0x7f0000000340)={r0, &(0x7f0000000200)='\x00', 0x200041, &(0x7f0000000240)={@align=0x1, {0x9, 0x6, 0x3, 0xffffffffffffffff}}, 0xfffffffe, &(0x7f00000002c0), &(0x7f0000000300)=0x5}) 1.258731639s ago: executing program 4 (id=1637): r0 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r1, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES32=r0], 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendto$packet(r0, &(0x7f0000000600)="05d936277c6f54222002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62", 0x28, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 1.102361023s ago: executing program 4 (id=1639): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=ANY=[@ANYBLOB="3800000018000100001bbe0000000000020006100008830c0002800800018000"/41, @ANYRES8=r0, @ANYBLOB="d8c141ae0492d3e7641dbb3ebe9c08fea75fbb2d18f344ebe4437ac33f2cb32b75c9"], 0x38}}, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b40)=@newtaction={0x104, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0xf0, 0x1, [@m_mirred={0xec, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0xbe, 0x6, "fb807a57d0ca1641a4b93f8307d5c66d4bf05992af30c6bb1562d3e0e897eccca9da5b6171f156e4eb199fc2b08e2aa36060b5d23ab719624525d7847a4760e1352c18fcdf63cfb4b17160803316b0a13c7763cb79d370eeb446c1c228db0795ff5203c785fe55996ffe1745d94e18dd3e31e145a9f897c7ef0bea30d1f54c93c93619f5f9f591558551ad5458d085b4804d341e8a00e10ccf4b5ec1f5136c087d27d50336476476c5e8aa1636029c706168b3ac3db309d7333b"}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x104}, 0x1, 0x0, 0x0, 0x2404c080}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x0, 0x40}, 0xc) write$tun(r5, &(0x7f0000000cc0)=ANY=[], 0x56) r7 = syz_mount_image$ext4(&(0x7f0000000080)='ext2\x00', &(0x7f0000000040)='./tracing\x00', 0x21000e, &(0x7f0000000700), 0x1, 0x565, &(0x7f0000000180)="$eJzs3U9vHGcZAPBn1t7EblycAodSqSWiRUkFWcc1bS0ObSMQtwpQEddg2RvL8tobee02tqpqqx44IiEESJw4cUHiAyChfgRUqRK9I0CgChI4cAAGzexs4mxmE6+yfyLv7yeN9513Z+Z5Xts7+87/AKbWhYh4IyJmIuLFiFgs6ivFEO3OkE13+9a769mQvfPW35NIirqIvHjHuWK2uc5Lqdbh0fZao1HfK8aX9nduLLUOjy5v7axt1jfruysry6+svrr68uqVstk3B21n1q7XvvmXn/7oV9967XdffeeP1/526b0s6W8U7xftGLpP8p/VmeN1sxGxN4pgEzBTtKc66UQAADiRrI//2Yj4Ut7/X4yZvDeX6+3SzY0/OwAAAGAY0tcX4j9JRJp2N+9TAAAA4JR5PSIWIqnUinMBFqJSqdU65/B+Pp6oNJqt/a9cbx7sbmTv5Wd6Vq5vNepXinNqz0c1ycaX8/Ld8Zd6xlci4qmI+MnifD5eW282NiLOTnj3BwAAAEyFcz3b//9qd7b/AQAAgFPm/IDTV0aUBwAAADA6xfb/TG99MoFcAAAAgNF46PH/dDx5AAAAACPxnTffzIa0+/zrjbcPD7abb1/eqLe2azsH67X15t6N2mazuZnfs2/nYctrNJs3vha7BzeX9uut/aXW4dG1nebB7v61rdLnB7qSAAAAAMbgqS9++EkSEe2vz+dD5kyUXQxQGPReAcBja6AdcH8eXR7A+PX7mgdOv9lJJwBMTnvwWS6MIg9gYu651UdJp+D4yTv37DP4/ehyAgAAhuviF5IoO/6fP+l/0skBI+UCHJhejv/D9Brw+P9Ho8oDGL+qHgBMvfJHfdytnSu78me+z/H/M2XLStNjywIAACZgIR+SSq04FrgQlUqtFvFkfql/Nbm+1ahfiYjPRMQfFqtns/HlfM7E4wEBAAAAAAAAAAAAAAAAAAAAAAAA4ITSNIkUAAAAONUiKn+N2c6Tvi4uvrDQu3/gTPLvxSge6fXOL976WfVO/T+69cVjAPb3914a664LAAAAoI+ba53t9Px1edLZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHDa3L717np3GGfcT6/Gt+N8WfzZmMtf56IaEU/8M4nZY/MlETEzhPjt9yPi6bL4SZZWnC+y6I1fiYj54cev3n3nTvxn0zQtjX9uCPFhmn14NSLeKPv8V+JCnM3XP1Hy+Z8thkf16dX8Qx63b33QiLg3fnf9N9Nn/ffkCWM88/FvlvrGfz/imdny9V83ftIn/vNlCywmah+r+sH3jo7um66z8Eh/GXGx9PsnuSfW0v7OjaXW4dHlrZ21zfpmfXdlZfmV1VdXX169snR9q1Evfpa28cfP/vZ/PVX/TTvy9sf98X8YnT/LA9v/QlY4tsaOtDdMEezjm7c+d3913sAs/qXny///nn5A/Ox/4svF90D2/sVuud0pH/fcrz96rjSxIv5Gn9//w/7+l/ottMeL3/3gTyecFAAYg9bh0fZao1HfO1FhfpCJD4+20zSiW/PzNE0HnH1ohcFbOn2Fbu9uZCHmHpeWPgaFrG892TS+fzai7zTD2LMFAAA8bu52+k88y3sjTQgAAAAAAAAAAAAAAAAAAACmUOswKg++VViaRjzaLcd6Y7Yn01QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAf6fwAAAP//qWbJrA==") bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3c, 0x10, &(0x7f0000000880)=ANY=[@ANYRESHEX, @ANYRES32=r8, @ANYBLOB="0000000000000000b705000008000000850000006a00000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r9, 0x0, 0xdc0, 0x0, &(0x7f0000000740)="00800000000000000045a9000000", 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xf}, 0x3e) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c) syz_emit_ethernet(0x56, &(0x7f0000000980)=ANY=[@ANYRES64=r6, @ANYRES32=0x0, @ANYBLOB="0a6d1309ae6ee0dd9da846b9edd953809db3904c0d9837330211b3f388178a91675ed5713d5eeedfbfa4bf849a2c5d8ce1b8f599d1c6614cc882c894f47d7efe2e996f0710875114c3159b7dd9e03603698ddf90d3d40c0ac28b3f0c8fed1476fab2d80495fba9582fe0314bf90f96d3ddf0a5242df0c5c90edaa687f71ef4e67932974e13a9620aa4f0cf8228bfc9a141a5f14f9850434ea65c51995e36e14bc3d1f3c5b3cb5a3117dd5f5706b4d1", @ANYRESHEX], 0x0) r10 = socket$inet6_udp(0xa, 0x2, 0x0) r11 = socket(0x10, 0x803, 0x0) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r10, 0x8008f511, &(0x7f00000001c0)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000ac0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56751, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0x4}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x8, 0x0, 0x7, 0x1, 0x1, 0x0, 0x70, 0x2}}, {0x8, 0x2, [0xa, 0x1]}}]}]}, 0x4c}}, 0x0) r13 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000800)='./cgroup.net/syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r13, &(0x7f0000000840)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000007c0)={{r7}, &(0x7f0000000740), &(0x7f0000000780)='%pB \x00'}, 0x20) 1.100930903s ago: executing program 2 (id=1640): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r1, 0x0) mprotect(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r3) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000080)='4', 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r5 = io_uring_setup(0x1b80, &(0x7f0000000040)={0x0, 0x8970, 0x1f280, 0x0, 0x8000399}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) io_uring_enter(r5, 0x8ae, 0xfbb9, 0x1f, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f00000007c0)='./file1\x00', 0x200000, &(0x7f0000000380)={[{@block_validity}, {}, {@nombcache}, {@inode_readahead_blks}, {@debug}, {@errors_remount}, {@nogrpid}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x6}}, {@nodelalloc}]}, 0x3, 0x5b0, &(0x7f0000004000)="$eJzs3V1rFFcfAPD/bBI16vMYQaTtRQl4UYt189YXLQXtZWmlQntvQ7IGycaV7EZMKqgX9aY3RQqlVCj9AL3vpfQL9FMIrSBFQgvtRVMmmY2bfUk2m9Rskt8PVs+ZObP/OTlzzpzZ2WUC2LcG039yES9HxFdJxLGadb2RrRxcKbf47PZE+kpiaemT35NIsmXV8kn2/5Es81JE/PxFxJlcY9zy/ML0eLFYmM3yQ5WZG0Pl+YWz12bGpwpTheujY2Pn3hobPf/O2x3WrDHo65f//PbjRx+c+/LU4jc/Pjn+IImLcTRbV1OPpMOAqbu1mcEYzN6sLy7WFRzZQpButJU/GjunJ+vnfZGOAceiJ+v1wN53JyKWmoskSwy3KADscj2tB4C12iwG7BrVeUD12r72en49/9Rsu5s9fX/lAqix/r0rn43EoeVro8OLyZoro/R6d2Ab4qcxfvrt4YP0FXWfp9S7sw3xAKru3ouI4d7exvEvyca/zg03+xC2Tn2Mds8/wNY9Suc/bzSb/+RW5z/RZP5zpEnf7cTG/T/3ZBvCtJTO/95rOv9dHboGerLc/5bnfH3J1WvFwnBE/D8iTkffwTS/3v2cc4uPW86Va+d/6SuNX50LZvvxpPfg2m0mxyvjW6lzraf3Il55Pv9NomH8P7Q8161v//TvcbnNGCcLD19ttW7j+tfa/hnw0g8RrzVt/+d3tJL1708OLR8PQ9WjotEf90/+0ir+5uq//dL2P7x+/QeS2vu15c3H+P7Q34VW6zo9/g8kny6nD2TLbo1XKrMjEQeSjxqXjz7ftpqvlk/rf/rU+uNfs+O/PyI+a7P+90/cb1m0G9p/clPtvybR17CkSeLxh59/1yp+e+3/ZsS75+N0tqSd8a+d/ersaAYAAAAAAIDulYuIo5Hk8qvpXC6fX/l+x4k4nCuWypUzV0tz1ydj+beyA9GXq97pPlbzfYiR7Puw1fxoXX4sIo5HxNc9/cv5/ESpOLnTlQcAAAAAAAAAAAAAAAAAAIAucaTF7/9Tv/asKbrk+VOwB3nkN+xfG/b/7XjSE9CVnP9h3/prTzzJG+jI6vn/3gbrgT1H/4b9S/+H/Uv/h/0r7f89O70TwI7Y1Pm//7/bDwAAAAAAAAAAAAAAAAAAAAAAAAAAANgjLl+6lL6WFp/dnkjzkzfn56ZLN89OFsrT+Zm5ifxEafZGfqpUmioW8hOlmY3er1gq3RgZjblbQ5VCuTJUnl+4MlOau165cm1mfKpwpdD3QmoFAAAAAAAAAAAAAAAAAAAAu0t5fmF6vFgszEq0TFyIrb9P/wvZ1aQ3onFVslErX8gOhs0HPZht2Q3N1K2Ju92xG5tN7OCgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1/g0AAP//RsAwGw==") lsetxattr$security_selinux(&(0x7f00000001c0)='.\x00', &(0x7f0000000240), &(0x7f0000000280)='system_u:object_r:fsadm_exec_t:s0\x00', 0x1001, 0x0) syz_mount_image$ext4(&(0x7f0000000bc0)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x804000, &(0x7f00000000c0), 0x2, 0xbc6, &(0x7f00000027c0)="$eJzs3N1rXGUaAPDnnEwmaZvdSZdl2e7NZlmWFpadJl1StmVh26XL3ngh6K3QkE5KyPSDJFKT5mKi/4Co14I3gloUL+x1bxS99UbbW8ULoUhsFEQ0cuYjic1MmtqZnJr8fvDOed/zzszzPHOYOeeFmQlg3xrJbtKIIxFxPokoNfenEVGs9wYjao37ra4sTX67sjSZxNraU18lkUTEvZWlydZzJc3toeZgMCI+/m8Sv3tha9y5hcWZiWq1MtscH5+/dPX43MLiP6YvTVysXKxcHjv5r/ET4ydHT413rdbvPjtz85u//P+L2vdv/nDj65dfT+JMDDXnNtfRLSMxsv6abFaIiIluB8tJX7OezXUmhQc8KO1xUgAAdJRuuob7Q5SiLzYu3krx/ie5JgcAAAB0xVpfxBoAAACwxyXW/wAAALDHtb4HcG9labLV8v1Gwu66ezYihhv1rzZbY6YQtfp2MPoj4uC9JDb/rDVpPOyRjUTE53dOvZO16NHvkLdTW46IP7Y7/km9/uH6r7i31p9GxGgX4o/cN/411X+mC/Hzrh+A/enW2caJbOv5L12//ok2579Cm3PXL5H3+a91/be65fpvo/6+Dtd/T+4wxvU3Xr3WaS6r/983//d2q2Xxs+0jFfUQ7i5H/KnQrv5kvf6kQ/3ndxij9OO1Sqe5vOtfey3iaLSvvyXZ/v+Jjk9NVyujjdu2MZY/Gn+rU/y868+O/8EO9bf+/6nT8b+6wxjPnDv37paddza629effllMnq73is09z03Mz8+ORRSTJ7buP7F9Lq37tJ4jq//YX7d//7erP/tMqDVfh2wtsNzcZuPn74v5nxvX3+uUT2v9l+fxv9Dh+G+u/8PC1uP/4g5j/O2Dl451mtu8/s1aFr+1FgYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAljQihiJJy+v9NC2XIw5FxO/jYFq9Mjf/96krz16+kM1FDEd/OjVdrYxGRKkxTrLxWL2/MT5x3/ifEXE4Il4pHaiPy5NXqhfyLh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB1hyJiKJK0HBFpRKyW0rRczjsrAAAAoOuG2+1Mdz8PAAAAoHfarv8BAACAPcX6HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgB47/Odbt5OIqJ0+UG+ZYnOuP9fMgF5L804AyE1f3gkAuSnknQCQm4dc47tcgD0oecD8YMeZga7nAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDj6+iRW7eTiKidPlBvmWJzrj/XzIBeS/NOAMhN33aThd3LA9h93uKwf1njA8kD5gc37lP7+cxAz3ICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4PEzVG9JWo6IYnNfuRzxm4gYjv5karpaGY2I30bEp6X+gWw8lnPOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdN/cwuLMRLVamc06aTQ763t0NjpJ4xWrPS757IvOQET0KkSxZ8+8Fzp5fzIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJCHuYXFmYlqtTI7l3cmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQN7mFhZnJqrVymwPO3nXCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAfn4KAAD//yFUCMc=") creat(&(0x7f0000000240)='./file1\x00', 0x0) truncate(&(0x7f0000000940)='./file1\x00', 0x2fffffd) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x2e, 0x1, 0x0, 0x0, 0x0, 0x9, 0x520, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4, @perf_bp={0x0, 0x8}, 0x10ecc8, 0x1222, 0x0, 0x8, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB], &(0x7f0000000c00)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r6, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.057923454s ago: executing program 0 (id=1641): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x2400c010) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wlan0\x00'}) r2 = fsopen(0x0, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0x6, 0x100000000}, 0x0, 0x1, 0xc, 0x6, 0x4, 0x4, 0xfffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) r5 = io_uring_setup(0xf06, &(0x7f00000003c0)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x20, &(0x7f0000000000)=[0xffffffffffffffff], 0x1) getpid() r6 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r6, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x1, 0x30, 0x30, 0x0, @in6={0x1b, 0x3ffb, 0x0, @private0, 0x10080bfd}, @ib={0x1b, 0xd9, 0x6, {"4a50abf0c8ed50dd38fa0200df62917a"}, 0x2, 0x5, 0x401}}}, 0x118) r7 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, &(0x7f00000002c0)) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000380)={0x0, 0xffff}, 0x8) ioctl$sock_inet_SIOCSIFADDR(r7, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x0, @loopback=0x7f000000}}) ioctl$sock_inet_SIOCSIFADDR(r7, 0x891c, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4, @empty}}) syz_open_dev$sg(&(0x7f0000000000), 0x6f5e, 0x8000) fsconfig$FSCONFIG_SET_FLAG(r2, 0x5, &(0x7f0000000300)='async\x00', 0x0, 0x4) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) 1.027471924s ago: executing program 0 (id=1642): r0 = syz_clone(0x11, 0x0, 0xb, 0x0, 0x0, 0x0) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) ptrace$ARCH_SET_CPUID(0x1e, r0, 0x1, 0x1012) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x560f, &(0x7f0000000040)={0x1, 0x1, 0x4000000d, 0x20, 0xb8, 0x0}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, 0xffffffffffffffff, &(0x7f0000000200)={0x2000}) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, 0xffffffffffffffff, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x0, 0x10001, 0x6}, &(0x7f0000000100)=0x10) unshare(0x22020400) unshare(0x60000200) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000280)={@dev={0xfe, 0x80, '\x00', 0x14}, 0x800, 0x0, 0x103, 0x1}, 0x20) r3 = socket$inet6(0xa, 0x2, 0x0) close(r3) r4 = socket$l2tp6(0xa, 0x2, 0x73) mount(&(0x7f0000000140)=@sr0, &(0x7f0000000080)='.\x00', &(0x7f00000001c0)='tracefs\x00', 0x2200890, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendmsg$inet6(r4, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @remote, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="240000000000000001"], 0x9a}, 0x3400c8d4) ioprio_set$pid(0x2, r0, 0x2007) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e1e, 0x80000, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="120000000000000029000000", @ANYRES8], 0x18}, 0x0) 997.141586ms ago: executing program 0 (id=1643): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000680)='./file0\x00', 0x200010e, &(0x7f0000000100), 0x3, 0x46b, &(0x7f00000006c0)="$eJzs3MtvG8UfAPDvrpO06eOX/Ep59AEECiLikTRpgR44AAKJA0hIXMoxJGlV6jaoCRKtKggIlSOqxB1xROIv4AQXBJyQuMIdVaqgFwono7V3a8e13dQ4cag/H2mdmd2JZ76ZHXt2p9sABtZE9pJE7IqIXyJirJZdW2Ci9uP6tYvzf127OJ9EpfLG70m13J/XLs4XRYvf25lnJtOI9OMkDrSod/n8hdNz5fLiuTw/vXLmnenl8xeeOnVm7uTiycWzs8eOHT0y8+wzs0/3JM7/Z23d//7SwX2vvHn5tfnjl9/64aukiL8pjsK2bisbrb5OdCryaKXS7btvMWPV190Ne5KhvjWG21SKiKy7hqvjfyxKUe+8sXj5o742DthQlVybw6sV4A6WRL9bAPRH8UWfXf8W2+bNPvrv6gu1C6As7uv5VjsyFGnULoyGm65ve2kiIo6v/v15tkWb+xAAAL30TTb/ebLV/C+NexrK/S+/0z+er6XsiYi7ImJvRNwdUS17b0Tcd5v1Ny+S3Dz/Sa90Fdg6ZfO/5/K1rbXzv7QoMl7Kc7urmeHkxKny4uH8bzIZw9uy/EyHOr596edP2x1rnP9lW1Z/MRfM23FlqGkhamFuZe7fxNzo6ocR+4daxZ/cWAlIImJfROzvso5Tj395sN2x5vgrSad3en5ttgfrTJUvIh6r9f9q5PGPVI/UG5J0Xp+c3h7lxcPTxVlxsx9/uvR6u/pv3f8bK+v/HS3P/xvxjyeN67XLt1/HpV8/aXtNM9XV+V/fMZL/fG9uZeXcTMRI8mqt0Y37Z+u/W+SL8ln8k4daj/89Uf9LHIiI7CS+PyIeiIgH8757KCIejohD7QJcjfj+xUfebnd4K/T/QlP/j68t0tT/9cRINO9pnSid/u7rte9YT67n8++PbUerqcl8z3o+/9bTru7OZgAAAPjvSSNiVyTp1I10mk5N1f4N/97YkZaXlleeOLH07tmF2jMC4zGcFne6aveDa/dDZ/LL+iI/25Q/kt83/qw0Ws1PzS+VF/odPAy4nW3Gf+a3Ur9bB2w4z2vB4DL+YXAZ/zC4jH8YXC3G/2g/2gFsvlbf/x/Uk5WxzWwMsKmaxr9lPxggrv9hcBn/MLgax3/H5++BO8nyaNz6IXmJrZzYXnTl5tYe6RaIvVeJZINHwa5+B9iYKP7vz86F+/zBBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0CP/BAAA///GBug8") chdir(&(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00') syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x80c000, 0x0, 0x1, 0x0, &(0x7f0000000180)) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, 0x0) 728.251562ms ago: executing program 1 (id=1644): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000680)='./file0\x00', 0x200010e, &(0x7f0000000100), 0x3, 0x46b, &(0x7f00000006c0)="$eJzs3MtvG8UfAPDvrpO06eOX/Ep59AEECiLikTRpgR44AAKJA0hIXMoxJGlV6jaoCRKtKggIlSOqxB1xROIv4AQXBJyQuMIdVaqgFwono7V3a8e13dQ4cag/H2mdmd2JZ76ZHXt2p9sABtZE9pJE7IqIXyJirJZdW2Ci9uP6tYvzf127OJ9EpfLG70m13J/XLs4XRYvf25lnJtOI9OMkDrSod/n8hdNz5fLiuTw/vXLmnenl8xeeOnVm7uTiycWzs8eOHT0y8+wzs0/3JM7/Z23d//7SwX2vvHn5tfnjl9/64aukiL8pjsK2bisbrb5OdCryaKXS7btvMWPV190Ne5KhvjWG21SKiKy7hqvjfyxKUe+8sXj5o742DthQlVybw6sV4A6WRL9bAPRH8UWfXf8W2+bNPvrv6gu1C6As7uv5VjsyFGnULoyGm65ve2kiIo6v/v15tkWb+xAAAL30TTb/ebLV/C+NexrK/S+/0z+er6XsiYi7ImJvRNwdUS17b0Tcd5v1Ny+S3Dz/Sa90Fdg6ZfO/5/K1rbXzv7QoMl7Kc7urmeHkxKny4uH8bzIZw9uy/EyHOr596edP2x1rnP9lW1Z/MRfM23FlqGkhamFuZe7fxNzo6ocR+4daxZ/cWAlIImJfROzvso5Tj395sN2x5vgrSad3en5ttgfrTJUvIh6r9f9q5PGPVI/UG5J0Xp+c3h7lxcPTxVlxsx9/uvR6u/pv3f8bK+v/HS3P/xvxjyeN67XLt1/HpV8/aXtNM9XV+V/fMZL/fG9uZeXcTMRI8mqt0Y37Z+u/W+SL8ln8k4daj/89Uf9LHIiI7CS+PyIeiIgH8757KCIejohD7QJcjfj+xUfebnd4K/T/QlP/j68t0tT/9cRINO9pnSid/u7rte9YT67n8++PbUerqcl8z3o+/9bTru7OZgAAAPjvSSNiVyTp1I10mk5N1f4N/97YkZaXlleeOLH07tmF2jMC4zGcFne6aveDa/dDZ/LL+iI/25Q/kt83/qw0Ws1PzS+VF/odPAy4nW3Gf+a3Ur9bB2w4z2vB4DL+YXAZ/zC4jH8YXC3G/2g/2gFsvlbf/x/Uk5WxzWwMsKmaxr9lPxggrv9hcBn/MLgax3/H5++BO8nyaNz6IXmJrZzYXnTl5tYe6RaIvVeJZINHwa5+B9iYKP7vz86F+/zBBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0CP/BAAA///GBug8") chdir(&(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00') syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x80c000, 0x0, 0x1, 0x0, &(0x7f0000000180)) personality(0xfe47fef9f5ff7379) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, 0x0) 626.900114ms ago: executing program 0 (id=1645): r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, 0x0, 0x0) syz_io_uring_setup(0x3927, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x8518}, 0x201, 0xe7e, 0x0, 0x3, 0x800000, 0xb6e, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@ah={{0x30}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000001c00)={&(0x7f0000000140)={0xa, 0x2, 0x3, @remote, 0x3}, 0x1c, &(0x7f00000002c0)}, 0x30008b08) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000002000010000000000000000000a00204000000007000000001400110076657468305f746f5f6272696467650008000a00fbffffff140002"], 0x4c}, 0x1, 0x0, 0x0, 0x24040804}, 0x8014) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0x5c}}, 0x0) getsockopt(r3, 0x1, 0xb, 0x0, 0x0) r5 = openat(0xffffffffffffffff, &(0x7f0000000280)='./dev/mapper/control\x00', 0x400000, 0x1c8) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0xfd, 0x0, 0x0, 0x0, 0x4d31, 0xe6080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x5, 0x8000008}, 0x0, 0x2, 0xfffffffe, 0x0, 0x2, 0x0, 0xfffe, 0x0, 0x0, 0x0, 0x200000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x1f, 0x0, 0x0) write$char_usb(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="4400000010000104fcffffff8000000000000000", @ANYRES32=0x0, @ANYBLOB="937b0100ef0000001c0012800b0001006d616373656300000c000280050003000800000008000500", @ANYRES32=0x0, @ANYBLOB="3802ed553eaaf28f6321063ca1ec8f0f05c2ae94a1cc8ba2931eecb0996df32949830ef14f8d24a5f5112f5adb4ba953443774bdab06ac3af321af93398cbea489f421d13de7055d9eeefec9c1e2d541dac914caa2db51ad1915f85deb7bccaabb5cf2aa4f7c136cee486ea2d134bb165071073600"], 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) quotactl$Q_QUOTAON(0xffffffff80000202, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x2) memfd_create(&(0x7f0000000bc0)='\xff\x00l\x1e\xa00x0}) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x2, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0xfff9, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) 255.250333ms ago: executing program 4 (id=1648): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) io_uring_setup(0x1bc2, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002fd}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x5, &(0x7f0000000400)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x3, 0x0, 0xf00}}], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe}, 0x94) 209.443715ms ago: executing program 4 (id=1649): r0 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r1, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES32=r0], 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendto$packet(r0, &(0x7f0000000600)="05d936277c6f54222002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62", 0x28, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 171.572555ms ago: executing program 4 (id=1650): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0x1, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@gettclass={0x24, 0x2a, 0x20, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xf, 0x5}, {0xffff, 0xffff}, {0x3, 0xfff2}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x54, 0x12, 0x1, 0x0, 0x0, {0xa, 0x3, 0x0, 0x0, {0x4e23, 0x4e22, [0x10000, 0xffff], [], 0x0, [0x5, 0x3]}, 0x8}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x3, "11000000"}]}, 0x54}}, 0x20004010) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)={0x54, r4, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_SEC_DEVKEY={0x38, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_ID={0x20, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}]}, @NL802154_KEY_ID_ATTR_MODE={0x8}]}]}]}, 0x54}}, 0x0) 143.269646ms ago: executing program 2 (id=1651): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000001000000000000008018000095"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) socket(0x2d, 0x2, 0x0) perf_event_open(&(0x7f0000000540)={0x5, 0x80, 0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x100000000000000}, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000101050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e6574"], 0x5c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 112.986487ms ago: executing program 0 (id=1652): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x2400c010) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wlan0\x00'}) r2 = fsopen(0x0, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0x6, 0x100000000}, 0x0, 0x1, 0xc, 0x6, 0x4, 0x4, 0xfffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) r5 = io_uring_setup(0xf06, &(0x7f00000003c0)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) io_uring_register$IORING_REGISTER_FILES(r5, 0x20, &(0x7f0000000000)=[0xffffffffffffffff], 0x1) getpid() r6 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r6, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x1, 0x30, 0x30, 0x0, @in6={0x1b, 0x3ffb, 0x0, @private0, 0x10080bfd}, @ib={0x1b, 0xd9, 0x6, {"4a50abf0c8ed50dd38fa0200df62917a"}, 0x2, 0x5, 0x401}}}, 0x118) r7 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000280)={0x0, 0xd6e, 0xff, 0x7fff}, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000380)={r8, 0xffff}, 0x8) ioctl$sock_inet_SIOCSIFADDR(r7, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x0, @loopback=0x7f000000}}) ioctl$sock_inet_SIOCSIFADDR(r7, 0x891c, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4, @empty}}) syz_open_dev$sg(&(0x7f0000000000), 0x6f5e, 0x8000) fsconfig$FSCONFIG_SET_FLAG(r2, 0x5, &(0x7f0000000300)='async\x00', 0x0, 0x4) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) 69.942218ms ago: executing program 0 (id=1653): r0 = syz_clone(0x11, 0x0, 0xb, 0x0, 0x0, 0x0) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) ptrace$ARCH_SET_CPUID(0x1e, r0, 0x1, 0x1012) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x560f, &(0x7f0000000040)={0x1, 0x1, 0x4000000d, 0x20, 0xb8, 0x0}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, 0xffffffffffffffff, &(0x7f0000000200)={0x2000}) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, 0xffffffffffffffff, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x0, 0x10001, 0x6}, &(0x7f0000000100)=0x10) unshare(0x22020400) unshare(0x60000200) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000280)={@dev={0xfe, 0x80, '\x00', 0x14}, 0x800, 0x0, 0x103, 0x1}, 0x20) r3 = socket$inet6(0xa, 0x2, 0x0) close(r3) r4 = socket$l2tp6(0xa, 0x2, 0x73) mount(&(0x7f0000000140)=@sr0, &(0x7f0000000080)='.\x00', &(0x7f00000001c0)='tracefs\x00', 0x2200890, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendmsg$inet6(r4, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @remote, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="240000000000000001"], 0x9a}, 0x3400c8d4) ioprio_set$pid(0x2, r0, 0x2007) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e1e, 0x80000, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="120000000000000029000000", @ANYRES8], 0x18}, 0x0) 47.739788ms ago: executing program 2 (id=1654): write$binfmt_elf64(0xffffffffffffffff, 0x0, 0xe8) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48800}, 0x0) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f00000004c0)=ANY=[@ANYBLOB="1809000000000000000000000001000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r4, 0xffffffffffffffff}, &(0x7f0000000540), &(0x7f0000000580)=r5}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=@base={0xd, 0x3d6a, 0x4, 0x4004, 0x5, r6, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x8, 0x8000000}, 0x50) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x58, 0x2c, 0xd27, 0x70bd27, 0x8000, {0x0, 0x0, 0x0, r3, {0x8, 0xffff}, {}, {0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x28, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x24, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x20, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x14, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x5f}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x1}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) sendto$inet6(r1, &(0x7f0000000280)="cb64d60748fb8f10d61e3939c6ab56a925607882316613e0ce9f1f34cbd859038349dd59c3a693a66c2aea3a531a8da1246f7ce6620e83c9c081a3db688a099b9b2da5160d1a922b51ed4eea4bff7d5809ff879a4390de835c4689b161ed87a2dc537f9d4ff1b15a338f09059b61b213d30b1321b1fa2a51e66d0b73aed8735cf1170ae51a56c2de43d21b5b012177d930074a9533e9783e940aac25b45b495f47d8d445602e6477968bc5fe31ea64d3726e20e2d28aa2ae09417a52344ef8738b7e31062d6f1e3f1596df1884dab2d7f3ecff8d994ffc4cbb4cf9", 0xdb, 0x20000000, &(0x7f0000000480)={0xa, 0x4e24, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, 0x1c) r7 = perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x0, 0x5, 0x48, 0x56, 0x0, 0x6, 0x2008, 0xc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_config_ext={0x6, 0x7}, 0x2, 0x3, 0x2, 0x4, 0x4, 0x8fec, 0xffff, 0x0, 0x24, 0x0, 0xf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x5, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={&(0x7f0000000240), 0x5}, 0x7830, 0x1, 0xbd4, 0x5, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000007}, 0x0, 0xffffffffffffffff, r7, 0xb) keyctl$KEYCTL_CAPABILITIES(0x1f, 0x0, 0x0) symlink(&(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000380)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 0s ago: executing program 1 (id=1655): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000680)='./file0\x00', 0x200010e, &(0x7f0000000100), 0x3, 0x46b, &(0x7f00000006c0)="$eJzs3MtvG8UfAPDvrpO06eOX/Ep59AEECiLikTRpgR44AAKJA0hIXMoxJGlV6jaoCRKtKggIlSOqxB1xROIv4AQXBJyQuMIdVaqgFwono7V3a8e13dQ4cag/H2mdmd2JZ76ZHXt2p9sABtZE9pJE7IqIXyJirJZdW2Ci9uP6tYvzf127OJ9EpfLG70m13J/XLs4XRYvf25lnJtOI9OMkDrSod/n8hdNz5fLiuTw/vXLmnenl8xeeOnVm7uTiycWzs8eOHT0y8+wzs0/3JM7/Z23d//7SwX2vvHn5tfnjl9/64aukiL8pjsK2bisbrb5OdCryaKXS7btvMWPV190Ne5KhvjWG21SKiKy7hqvjfyxKUe+8sXj5o742DthQlVybw6sV4A6WRL9bAPRH8UWfXf8W2+bNPvrv6gu1C6As7uv5VjsyFGnULoyGm65ve2kiIo6v/v15tkWb+xAAAL30TTb/ebLV/C+NexrK/S+/0z+er6XsiYi7ImJvRNwdUS17b0Tcd5v1Ny+S3Dz/Sa90Fdg6ZfO/5/K1rbXzv7QoMl7Kc7urmeHkxKny4uH8bzIZw9uy/EyHOr596edP2x1rnP9lW1Z/MRfM23FlqGkhamFuZe7fxNzo6ocR+4daxZ/cWAlIImJfROzvso5Tj395sN2x5vgrSad3en5ttgfrTJUvIh6r9f9q5PGPVI/UG5J0Xp+c3h7lxcPTxVlxsx9/uvR6u/pv3f8bK+v/HS3P/xvxjyeN67XLt1/HpV8/aXtNM9XV+V/fMZL/fG9uZeXcTMRI8mqt0Y37Z+u/W+SL8ln8k4daj/89Uf9LHIiI7CS+PyIeiIgH8757KCIejohD7QJcjfj+xUfebnd4K/T/QlP/j68t0tT/9cRINO9pnSid/u7rte9YT67n8++PbUerqcl8z3o+/9bTru7OZgAAAPjvSSNiVyTp1I10mk5N1f4N/97YkZaXlleeOLH07tmF2jMC4zGcFne6aveDa/dDZ/LL+iI/25Q/kt83/qw0Ws1PzS+VF/odPAy4nW3Gf+a3Ur9bB2w4z2vB4DL+YXAZ/zC4jH8YXC3G/2g/2gFsvlbf/x/Uk5WxzWwMsKmaxr9lPxggrv9hcBn/MLgax3/H5++BO8nyaNz6IXmJrZzYXnTl5tYe6RaIvVeJZINHwa5+B9iYKP7vz86F+/zBBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0CP/BAAA///GBug8") chdir(&(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00') r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, 0x0) kernel console output (not intermixed with test programs): e [ 115.523570][ T7207] netlink: 'syz.1.1163': attribute type 3 has an invalid length. [ 115.549218][ T7208] loop3: detected capacity change from 0 to 512 [ 115.565767][ T7208] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 115.587732][ T7208] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #16: comm syz.3.1158: invalid indirect mapped block 4294967295 (level 0) [ 115.617407][ T7208] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 115.617721][ T7208] EXT4-fs (loop3): Remounting filesystem read-only [ 115.644397][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 115.652520][ C1] EXT4-fs (loop3): initial error at time 1787643523: ext4_free_branches:1023: inode 16 [ 115.664707][ C1] EXT4-fs (loop3): last error at time 1787643523: ext4_free_branches:1023: inode 16 [ 115.676511][ T7208] EXT4-fs (loop3): 1 orphan inode deleted [ 115.683279][ T7208] EXT4-fs (loop3): 1 truncate cleaned up [ 115.707903][ T7208] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 115.778642][ T7220] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=43559 sclass=netlink_xfrm_socket pid=7220 comm=syz.4.1166 [ 115.793899][ C1] sd 0:0:1:0: [sda] tag#2062 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 115.808242][ C1] sd 0:0:1:0: [sda] tag#2062 CDB: Write(6) 0a 00 00 00 0e 00 00 00 3e 01 00 00 [ 115.956394][ T7228] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=43559 sclass=netlink_xfrm_socket pid=7228 comm=syz.2.1170 [ 116.137666][ T7259] loop0: detected capacity change from 0 to 512 [ 116.158836][ T7257] lo: entered promiscuous mode [ 116.185515][ T7257] tunl0: entered promiscuous mode [ 116.192395][ T7259] xt_recent: hitcount (16777216) is larger than allowed maximum (65535) [ 116.217303][ T7257] gre0: entered promiscuous mode [ 116.250563][ T7259] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5138 sclass=netlink_route_socket pid=7259 comm=syz.0.1184 [ 116.298586][ T7257] gretap0: entered promiscuous mode [ 116.354902][ T7257] erspan0: entered promiscuous mode [ 116.363601][ T7257] ip_vti0: entered promiscuous mode [ 116.388462][ T7260] Process accounting resumed [ 116.418564][ T7259] bond2 (unregistering): Released all slaves [ 116.427650][ T3300] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 117.039175][ T7287] __nla_validate_parse: 5 callbacks suppressed [ 117.039192][ T7287] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1194'. [ 117.062571][ T7289] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=43559 sclass=netlink_xfrm_socket pid=7289 comm=syz.0.1196 [ 117.393960][ T7310] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1205'. [ 117.730479][ T7337] loop3: detected capacity change from 0 to 2048 [ 117.757758][ T28] kauditd_printk_skb: 243 callbacks suppressed [ 117.757776][ T28] audit: type=1400 audit(1787643525.208:5590): avc: denied { create } for pid=7340 comm="syz.1.1217" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 117.820342][ T7337] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000900 r/w without journal. Quota mode: none. [ 117.853169][ T28] audit: type=1400 audit(1787643525.258:5591): avc: denied { mount } for pid=7304 comm="syz.3.1203" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 117.880305][ T28] audit: type=1400 audit(1787643525.258:5592): avc: denied { write } for pid=7304 comm="syz.3.1203" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 117.931770][ T28] audit: type=1400 audit(1787643525.258:5593): avc: denied { add_name } for pid=7304 comm="syz.3.1203" name="blkio.bfq.io_queued" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 117.957218][ T28] audit: type=1400 audit(1787643525.258:5594): avc: denied { create } for pid=7304 comm="syz.3.1203" name="blkio.bfq.io_queued" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 117.984521][ T28] audit: type=1400 audit(1787643525.258:5595): avc: denied { read append open } for pid=7304 comm="syz.3.1203" path="/217/file2/blkio.bfq.io_queued" dev="loop3" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 118.017652][ T28] audit: type=1400 audit(1787643525.258:5596): avc: denied { tracepoint } for pid=7304 comm="syz.3.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 118.067542][ T28] audit: type=1400 audit(1787643525.378:5597): avc: denied { map_read map_write } for pid=7350 comm="syz.0.1219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 118.103563][ T28] audit: type=1400 audit(1787643525.378:5598): avc: denied { create } for pid=7350 comm="syz.0.1219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 118.121648][ T7351] netlink: 'syz.0.1219': attribute type 21 has an invalid length. [ 118.131512][ T28] audit: type=1400 audit(1787643525.508:5599): avc: denied { perfmon } for pid=7304 comm="syz.3.1203" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 118.179521][ T7351] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1219'. [ 118.195797][ T7351] netlink: 'syz.0.1219': attribute type 5 has an invalid length. [ 118.204160][ T7351] netlink: 'syz.0.1219': attribute type 6 has an invalid length. [ 118.213561][ T7351] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1219'. [ 118.215124][ T7354] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1219'. [ 118.345464][ T7356] loop2: detected capacity change from 0 to 512 [ 118.372153][ T7356] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 118.394793][ T7356] EXT4-fs (loop2): 1 truncate cleaned up [ 118.418638][ T7356] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 118.458419][ T7359] loop4: detected capacity change from 0 to 512 [ 118.558455][ T7359] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 118.614284][ T7359] EXT4-fs (loop4): 1 truncate cleaned up [ 118.623873][ T7359] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 118.903697][ T7370] loop1: detected capacity change from 0 to 1024 [ 119.035613][ T7370] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 119.179355][ T7370] EXT4-fs error (device loop1): ext4_iget_extra_inode:5210: inode #15: comm syz.1.1224: corrupted in-inode xattr: ea_inode specified without ea_inode feature enabled [ 119.278344][ T7374] EXT4-fs error (device loop1): ext4_iget_extra_inode:5210: inode #15: comm syz.1.1224: corrupted in-inode xattr: ea_inode specified without ea_inode feature enabled [ 119.340898][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 119.383043][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 119.434049][ T3861] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 119.471423][ T7372] loop0: detected capacity change from 0 to 32768 [ 119.519495][ T7330] syz.3.1203 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), order=0, oom_score_adj=1000 [ 119.546852][ T7384] netlink: 'syz.2.1228': attribute type 21 has an invalid length. [ 119.546950][ T7384] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1228'. [ 119.546989][ T7384] netlink: 'syz.2.1228': attribute type 5 has an invalid length. [ 119.547003][ T7384] netlink: 'syz.2.1228': attribute type 6 has an invalid length. [ 119.547020][ T7384] netlink: 3 bytes leftover after parsing attributes in process `syz.2.1228'. [ 119.548592][ T7384] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1228'. [ 119.608453][ T7330] CPU: 1 UID: 0 PID: 7330 Comm: syz.3.1203 Not tainted syzkaller #0 PREEMPT(lazy) [ 119.608514][ T7330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 119.608527][ T7330] Call Trace: [ 119.608534][ T7330] [ 119.608542][ T7330] __dump_stack+0x1d/0x30 [ 119.608575][ T7330] dump_stack_lvl+0x95/0xd0 [ 119.608648][ T7330] dump_stack+0x15/0x1b [ 119.608669][ T7330] dump_header+0x80/0x240 [ 119.608690][ T7330] oom_kill_process+0x294/0x420 [ 119.608710][ T7330] out_of_memory+0x981/0xbc0 [ 119.608758][ T7330] try_charge_memcg+0x624/0xa10 [ 119.608868][ T7330] __memcg_kmem_charge_page+0x19a/0x3a0 [ 119.608890][ T7330] __alloc_frozen_pages_noprof+0x21d/0x400 [ 119.608924][ T7330] alloc_pages_mpol+0xaf/0x1d0 [ 119.609011][ T7330] alloc_pages_noprof+0x94/0x140 [ 119.609031][ T7330] __vmalloc_node_range_noprof+0x9a5/0x1040 [ 119.609116][ T7330] __kvmalloc_node_noprof+0x3be/0x5c0 [ 119.609199][ T7330] ? futex_hash_allocate+0x163/0x890 [ 119.609264][ T7330] ? futex_hash_allocate+0x163/0x890 [ 119.609339][ T7330] ? futex_hash_allocate+0x163/0x890 [ 119.609433][ T7330] futex_hash_allocate+0x163/0x890 [ 119.609459][ T7330] ? cap_task_prctl+0x13f/0x6b0 [ 119.609492][ T7330] futex_hash_prctl+0xd8/0xf0 [ 119.609519][ T7330] __se_sys_prctl+0x4f4/0x13b0 [ 119.609574][ T7330] __x64_sys_prctl+0x67/0x80 [ 119.609685][ T7330] x64_sys_call+0x2421/0x2550 [ 119.609710][ T7330] do_syscall_64+0x112/0x360 [ 119.609769][ T7330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.609821][ T7330] RIP: 0033:0x7f725108e0d9 [ 119.609846][ T7330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.609863][ T7330] RSP: 002b:00007f724f682028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 119.609886][ T7330] RAX: ffffffffffffffda RBX: 00007f7251316270 RCX: 00007f725108e0d9 [ 119.609949][ T7330] RDX: 0000000001000000 RSI: 0000000000000001 RDI: 000000000000004e [ 119.609963][ T7330] RBP: 00007f7251125024 R08: 0000000000000000 R09: 0000000000000000 [ 119.610037][ T7330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.610049][ T7330] R13: 00007f7251316308 R14: 00007f7251316270 R15: 00007ffdc0e5d0a8 [ 119.610073][ T7330] [ 119.611362][ T7330] memory: usage 307200kB, limit 307200kB, failcnt 605 [ 119.890909][ T7330] memory+swap: usage 308840kB, limit 9007199254740988kB, failcnt 0 [ 119.902381][ T7330] kmem: usage 307192kB, limit 9007199254740988kB, failcnt 0 [ 119.910421][ T7330] Memory cgroup stats for /syz3: [ 119.910633][ T7330] cache 8192 [ 119.919318][ T7330] rss 0 [ 119.922142][ T7330] shmem 0 [ 119.925355][ T7330] mapped_file 0 [ 119.929188][ T7330] dirty 0 [ 119.932845][ T7330] writeback 0 [ 119.937333][ T7330] workingset_refault_anon 119 [ 119.942377][ T7330] workingset_refault_file 2307 [ 119.947759][ T7330] swap 1679360 [ 119.951916][ T7330] swapcached 2166784 [ 119.955975][ T7330] pgpgin 65136 [ 119.959435][ T7330] pgpgout 65134 [ 119.963052][ T7330] pgfault 63175 [ 119.967063][ T7330] pgmajfault 104 [ 119.967153][ T7372] loop0: p1 p3 < > [ 119.970807][ T7330] inactive_anon 0 [ 119.970820][ T7330] active_anon 0 [ 119.970827][ T7330] inactive_file 0 [ 119.970835][ T7330] active_file 8192 [ 119.970842][ T7330] unevictable 0 [ 120.009058][ T7330] hierarchical_memory_limit 314572800 [ 120.014891][ T7330] hierarchical_memsw_limit 9223372036854771712 [ 120.024845][ T7330] total_cache 8192 [ 120.029623][ T7330] total_rss 0 [ 120.033002][ T7330] total_shmem 0 [ 120.037163][ T7330] total_mapped_file 0 [ 120.041150][ T7330] total_dirty 0 [ 120.045055][ T7330] total_writeback 0 [ 120.049629][ T7330] total_workingset_refault_anon 119 [ 120.056765][ T7330] total_workingset_refault_file 2307 [ 120.063261][ T7330] total_swap 1679360 [ 120.069979][ T7330] total_swapcached 2166784 [ 120.075517][ T7330] total_pgpgin 65136 [ 120.081480][ T7330] total_pgpgout 65134 [ 120.086846][ T7330] total_pgfault 63175 [ 120.093196][ T7330] total_pgmajfault 104 [ 120.101495][ T3289] udevd[3289]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 120.121598][ T6650] udevd[6650]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 120.134380][ T7330] total_inactive_anon 0 [ 120.139006][ T7330] total_active_anon 0 [ 120.143721][ T7330] total_inactive_file 0 [ 120.148225][ T7330] total_active_file 8192 [ 120.153713][ T7330] total_unevictable 0 [ 120.158110][ T7330] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.1203,pid=7304,uid=0 [ 120.178113][ T7330] Memory cgroup out of memory: Killed process 7304 (syz.3.1203) total-vm:109072kB, anon-rss:1240kB, file-rss:34696kB, shmem-rss:0kB, UID:0 pgtables:152kB oom_score_adj:1000 [ 120.370001][ T3300] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000900. [ 120.410097][ T7398] loop4: detected capacity change from 0 to 512 [ 120.478778][ T7407] geneve2: entered promiscuous mode [ 120.491672][ T7398] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 120.504068][ T7398] EXT4-fs (loop4): 1 truncate cleaned up [ 120.515186][ T7398] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 120.591464][ T7413] loop1: detected capacity change from 0 to 512 [ 120.603752][ T7413] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 120.620195][ T7413] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #16: comm syz.1.1239: invalid indirect mapped block 4294967295 (level 0) [ 120.621095][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.636945][ T7413] loop1: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 120.646301][ T7413] EXT4-fs (loop1): Remounting filesystem read-only [ 120.655992][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 120.656013][ C1] EXT4-fs (loop1): initial error at time 1787643528: ext4_free_branches:1023: inode 16 [ 120.656043][ C1] EXT4-fs (loop1): last error at time 1787643528: ext4_free_branches:1023: inode 16 [ 120.692460][ T7413] EXT4-fs (loop1): 1 orphan inode deleted [ 120.699374][ T7413] EXT4-fs (loop1): 1 truncate cleaned up [ 120.706326][ T7413] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 120.765180][ T7425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.775063][ T7425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.792317][ T7425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.803411][ T7425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.849373][ T7421] loop2: detected capacity change from 0 to 32768 [ 120.858358][ T3861] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.906244][ T7429] loop1: detected capacity change from 0 to 512 [ 120.945801][ T7429] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 120.958642][ T7429] ext4 filesystem being mounted at /260/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 121.006150][ T7421] loop2: p1 p3 < > [ 121.247918][ T3861] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 121.417038][ T7452] ip_tables: iptables: counters copy to user failed while replacing table [ 121.430041][ T7455] Line length is too long: Should be less than 4094 [ 121.449535][ T7452] No such timeout policy "syz1" [ 121.450380][ T7452] netlink: 27 bytes leftover after parsing attributes in process `syz.3.1254'. [ 121.472530][ T7452] netlink: 'syz.3.1254': attribute type 1 has an invalid length. [ 121.487548][ T7452] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1254'. [ 121.568650][ T7463] loop1: detected capacity change from 0 to 512 [ 121.583104][ T7463] EXT4-fs error (device loop1): mb_free_blocks:2049: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt. [ 121.598438][ T7463] EXT4-fs error (device loop1): ext4_do_update_inode:5801: inode #11: comm syz.1.1251: corrupted inode contents [ 121.611685][ T7463] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 121.611944][ T7463] EXT4-fs error (device loop1): ext4_dirty_inode:6731: inode #11: comm syz.1.1251: mark_inode_dirty error [ 121.634034][ T7463] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 121.634427][ T7463] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #11: comm syz.1.1251: invalid indirect mapped block 1 (level 1) [ 121.659511][ T7463] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 121.659767][ T7463] EXT4-fs error (device loop1): ext4_do_update_inode:5801: inode #11: comm syz.1.1251: corrupted inode contents [ 121.681211][ C0] EXT4-fs (loop1): error count since last fsck: 4 [ 121.681247][ C0] EXT4-fs (loop1): initial error at time 1787643529: mb_free_blocks:2049: inode 11: block 64 [ 121.681277][ C0] EXT4-fs (loop1): last error at time 1787643529: ext4_free_branches:1023: inode 11 [ 121.722473][ T7463] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 121.724782][ T7463] EXT4-fs error (device loop1) in ext4_orphan_del:304: Corrupt filesystem [ 121.745678][ T7463] loop1: lost filesystem error report for type 5 error -117 [ 121.745923][ T7463] EXT4-fs error (device loop1): ext4_do_update_inode:5801: inode #11: comm syz.1.1251: corrupted inode contents [ 121.770772][ T7463] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 121.771149][ T7463] EXT4-fs error (device loop1): ext4_truncate:4721: inode #11: comm syz.1.1251: mark_inode_dirty error [ 121.808049][ T7463] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 121.809506][ T7463] EXT4-fs error (device loop1) in ext4_process_orphan:346: Corrupt filesystem [ 121.833213][ T7463] loop1: lost filesystem error report for type 5 error -117 [ 121.833424][ T7463] EXT4-fs (loop1): 1 truncate cleaned up [ 121.848059][ T7463] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 121.918589][ T7482] FAULT_INJECTION: forcing a failure. [ 121.918589][ T7482] name failslab, interval 1, probability 0, space 0, times 0 [ 121.934381][ T7482] CPU: 0 UID: 0 PID: 7482 Comm: syz.3.1264 Not tainted syzkaller #0 PREEMPT(lazy) [ 121.934461][ T7482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 121.934475][ T7482] Call Trace: [ 121.934483][ T7482] [ 121.934492][ T7482] __dump_stack+0x1d/0x30 [ 121.934586][ T7482] dump_stack_lvl+0x95/0xd0 [ 121.934668][ T7482] dump_stack+0x15/0x1b [ 121.934722][ T7482] should_fail_ex+0x262/0x280 [ 121.934755][ T7482] ? addr_event+0x9b/0x270 [ 121.934813][ T7482] should_failslab+0x8c/0xb0 [ 121.934838][ T7482] __kmalloc_cache_noprof+0x7a/0x400 [ 121.934866][ T7482] ? addr_event+0x9b/0x270 [ 121.934912][ T7482] ? __pfx_fib6_flush_trees+0x10/0x10 [ 121.935220][ T7482] addr_event+0x9b/0x270 [ 121.935328][ T7482] ? __pfx_inet6addr_event+0x10/0x10 [ 121.935423][ T7482] inet6addr_event+0x7b/0xa0 [ 121.935931][ T7482] atomic_notifier_call_chain+0x79/0x1a0 [ 121.936091][ T7482] ? __cancel_work+0x114/0x180 [ 121.936188][ T7482] inet6addr_notifier_call_chain+0x24/0x30 [ 121.936242][ T7482] ipv6_del_addr+0x43e/0x5a0 [ 121.936307][ T7482] inet6_addr_del+0x430/0x540 [ 121.936340][ T7482] addrconf_del_ifaddr+0xbe/0xf0 [ 121.936506][ T7482] inet6_ioctl+0x84/0x190 [ 121.936527][ T7482] ? ioctl_has_perm+0x273/0x2c0 [ 121.936618][ T7482] sock_do_ioctl+0x73/0x230 [ 121.936669][ T7482] sock_ioctl+0x439/0x610 [ 121.936696][ T7482] ? mutex_lock+0x57/0x90 [ 121.936803][ T7482] ? __pfx_sock_ioctl+0x10/0x10 [ 121.936842][ T7482] __se_sys_ioctl+0xce/0x140 [ 121.936932][ T7482] __x64_sys_ioctl+0x43/0x50 [ 121.936955][ T7482] x64_sys_call+0x239d/0x2550 [ 121.936979][ T7482] do_syscall_64+0x112/0x360 [ 121.937000][ T7482] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.937057][ T7482] RIP: 0033:0x7f725108e0d9 [ 121.937084][ T7482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.937181][ T7482] RSP: 002b:00007f724fae7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 121.937254][ T7482] RAX: ffffffffffffffda RBX: 00007f7251315fa0 RCX: 00007f725108e0d9 [ 121.937371][ T7482] RDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000004 [ 121.937385][ T7482] RBP: 00007f724fae7090 R08: 0000000000000000 R09: 0000000000000000 [ 121.937397][ T7482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 121.937408][ T7482] R13: 00007f7251316038 R14: 00007f7251315fa0 R15: 00007ffdc0e5d0a8 [ 121.937443][ T7482] [ 121.953701][ T7485] FAULT_INJECTION: forcing a failure. [ 121.953701][ T7485] name failslab, interval 1, probability 0, space 0, times 0 [ 122.306074][ T7485] CPU: 1 UID: 0 PID: 7485 Comm: syz.0.1265 Not tainted syzkaller #0 PREEMPT(lazy) [ 122.306102][ T7485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 122.306112][ T7485] Call Trace: [ 122.306120][ T7485] [ 122.306127][ T7485] __dump_stack+0x1d/0x30 [ 122.306153][ T7485] dump_stack_lvl+0x95/0xd0 [ 122.306177][ T7485] dump_stack+0x15/0x1b [ 122.306197][ T7485] should_fail_ex+0x262/0x280 [ 122.306226][ T7485] ? mas_alloc_nodes+0x1a2/0x210 [ 122.306244][ T7485] should_failslab+0x8c/0xb0 [ 122.306268][ T7485] kmem_cache_alloc_noprof+0x7c/0x3f0 [ 122.306294][ T7485] ? mas_wr_store_type+0x971/0xc90 [ 122.306315][ T7485] ? mas_alloc_nodes+0x1a2/0x210 [ 122.306338][ T7485] mas_alloc_nodes+0x1a2/0x210 [ 122.306359][ T7485] mas_preallocate+0x2ca/0x500 [ 122.306400][ T7485] __split_vma+0x248/0x670 [ 122.306423][ T7485] vms_gather_munmap_vmas+0x265/0x7f0 [ 122.306443][ T7485] mmap_region+0x7f9/0x2090 [ 122.306467][ T7485] ? _raw_spin_unlock+0x9/0x30 [ 122.306491][ T7485] ? __d_add+0x3ac/0x490 [ 122.306516][ T7485] ? __rcu_read_unlock+0x4e/0x70 [ 122.306541][ T7485] ? avc_has_perm_noaudit+0xa3/0x120 [ 122.306588][ T7485] do_mmap+0xa20/0xc70 [ 122.306619][ T7485] vm_mmap_pgoff+0x183/0x2d0 [ 122.306646][ T7485] ksys_mmap_pgoff+0xc1/0x310 [ 122.306676][ T7485] ? __x64_sys_mmap+0x49/0x70 [ 122.306706][ T7485] x64_sys_call+0x23b3/0x2550 [ 122.306733][ T7485] do_syscall_64+0x112/0x360 [ 122.306757][ T7485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.306778][ T7485] RIP: 0033:0x7fb07495e0d9 [ 122.306794][ T7485] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.306809][ T7485] RSP: 002b:00007fb0733b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 122.306831][ T7485] RAX: ffffffffffffffda RBX: 00007fb074be5fa0 RCX: 00007fb07495e0d9 [ 122.306846][ T7485] RDX: 0000000003000015 RSI: 0000000000004000 RDI: 0000200000ffa000 [ 122.306858][ T7485] RBP: 00007fb0733b7090 R08: ffffffffffffffff R09: 0000000025d81000 [ 122.306871][ T7485] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000001 [ 122.306882][ T7485] R13: 00007fb074be6038 R14: 00007fb074be5fa0 R15: 00007ffc1042da28 [ 122.306911][ T7485] [ 122.697250][ T7490] set_capacity_and_notify: 1 callbacks suppressed [ 122.697270][ T7490] loop3: detected capacity change from 0 to 512 [ 122.752839][ T7490] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 122.817754][ T7503] netlink: 'syz.1.1272': attribute type 21 has an invalid length. [ 122.818675][ T7490] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #16: comm syz.3.1266: invalid indirect mapped block 4294967295 (level 0) [ 122.825794][ T7503] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1272'. [ 122.825857][ T7503] netlink: 'syz.1.1272': attribute type 5 has an invalid length. [ 122.825872][ T7503] netlink: 'syz.1.1272': attribute type 6 has an invalid length. [ 122.825884][ T7503] netlink: 3 bytes leftover after parsing attributes in process `syz.1.1272'. [ 122.850815][ T28] kauditd_printk_skb: 149 callbacks suppressed [ 122.850829][ T28] audit: type=1326 audit(1787643530.248:5749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7496 comm="syz.4.1269" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 122.861661][ T7490] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 122.878376][ T7503] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1272'. [ 122.904370][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 122.928880][ T28] audit: type=1326 audit(1787643530.308:5750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7496 comm="syz.4.1269" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 122.933745][ C1] EXT4-fs (loop3): initial error at time 1787643530: ext4_free_branches:1023: inode 16 [ 122.933778][ C1] EXT4-fs (loop3): last error at time 1787643530: ext4_free_branches:1023 [ 122.959544][ T28] audit: type=1326 audit(1787643530.308:5751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7496 comm="syz.4.1269" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 122.959582][ T28] audit: type=1326 audit(1787643530.308:5752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7496 comm="syz.4.1269" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 122.969463][ C1] : inode 16 [ 122.982670][ T7509] loop0: detected capacity change from 0 to 512 [ 123.004227][ C1] [ 123.043926][ T7490] EXT4-fs (loop3): Remounting filesystem read-only [ 123.048844][ T28] audit: type=1326 audit(1787643530.498:5753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7496 comm="syz.4.1269" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f7f4954e90e code=0x7ffc0000 [ 123.050712][ T7490] EXT4-fs (loop3): 1 orphan inode deleted [ 123.087107][ T7509] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 123.121303][ T28] audit: type=1326 audit(1787643530.498:5754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7496 comm="syz.4.1269" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 123.131855][ T7490] EXT4-fs (loop3): 1 truncate cleaned up [ 123.166633][ T28] audit: type=1326 audit(1787643530.498:5755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7496 comm="syz.4.1269" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 123.193896][ T28] audit: type=1326 audit(1787643530.618:5756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7496 comm="syz.4.1269" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 123.204684][ T7509] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #17: comm syz.0.1273: corrupted in-inode xattr: e_name out of bounds [ 123.221450][ T28] audit: type=1326 audit(1787643530.618:5757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7496 comm="syz.4.1269" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 123.236412][ T7509] loop0: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 123.262358][ T7509] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.1273: couldn't read orphan inode 17 (err -117) [ 123.271891][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 123.271917][ C1] EXT4-fs (loop0): initial error at time 1787643530: ext4_iget_extra_inode:5210: inode 17 [ 123.271956][ C1] EXT4-fs (loop0): last error at time 1787643530: ext4_iget_extra_inode:5210: inode 17 [ 123.295657][ T7511] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.303387][ T7509] loop0: lost filesystem error report for type 5 error -117 [ 123.311526][ T7511] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 123.377303][ T7518] 8021q: VLANs not supported on wg0 [ 123.390548][ T28] audit: type=1400 audit(1787643530.778:5758): avc: denied { read } for pid=7517 comm="syz.4.1276" name="rtc0" dev="devtmpfs" ino=244 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 123.421612][ T7511] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.447154][ T7511] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 123.517011][ T7511] gretap0 speed is unknown, defaulting to 1000 [ 123.669259][ T7525] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1278'. [ 123.772582][ T7533] gretap0 speed is unknown, defaulting to 1000 [ 123.807810][ T7534] loop3: detected capacity change from 0 to 8192 [ 124.169767][ T7546] loop4: detected capacity change from 0 to 512 [ 124.237691][ T7546] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 124.286984][ T7546] EXT4-fs error (device loop4): ext4_validate_block_bitmap:445: comm syz.4.1285: bg 0: block 288: padding at end of block bitmap is not set [ 124.301525][ T7546] loop4: lost filesystem error report for type 5 error -117 [ 124.310391][ T7546] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 124.334241][ T7546] loop4: lost filesystem error report for type 5 error -117 [ 124.356610][ T7546] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #13: comm syz.4.1285: attempt to clear invalid blocks 1024 len 1 [ 124.393675][ C0] EXT4-fs (loop4): error count since last fsck: 2 [ 124.396816][ T7546] loop4: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 124.400668][ C0] EXT4-fs (loop4): initial error at time 1787643531: ext4_validate_block_bitmap:445 [ 124.400717][ C0] EXT4-fs (loop4): last error at time 1787643531: ext4_mb_clear_bb:6680 [ 124.431105][ T7546] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #13: comm syz.4.1285: invalid indirect mapped block 1819239214 (level 0) [ 124.450276][ T7546] EXT4-fs (loop4): 1 truncate cleaned up [ 124.530937][ T7558] loop1: detected capacity change from 0 to 512 [ 124.567053][ T7558] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 124.585886][ T7558] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #16: comm syz.1.1290: invalid indirect mapped block 4294967295 (level 0) [ 124.632308][ T7558] EXT4-fs (loop1): Remounting filesystem read-only [ 124.641642][ T7558] EXT4-fs (loop1): 1 orphan inode deleted [ 124.648488][ T7558] EXT4-fs (loop1): 1 truncate cleaned up [ 124.988788][ T7573] loop0: detected capacity change from 0 to 32768 [ 125.024845][ T7576] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1295'. [ 125.100139][ T7588] loop1: detected capacity change from 0 to 512 [ 125.123839][ T7591] netlink: 'syz.2.1301': attribute type 21 has an invalid length. [ 125.135556][ T7591] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1301'. [ 125.148221][ T7591] netlink: 'syz.2.1301': attribute type 5 has an invalid length. [ 125.158507][ T7591] netlink: 'syz.2.1301': attribute type 6 has an invalid length. [ 125.169088][ T7591] netlink: 3 bytes leftover after parsing attributes in process `syz.2.1301'. [ 125.194717][ T7588] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 125.216204][ T7573] loop0: p1 p3 < > [ 125.216667][ T7588] EXT4-fs error (device loop1): ext4_iget_extra_inode:5210: inode #17: comm syz.1.1299: corrupted in-inode xattr: e_name out of bounds [ 125.246638][ T7588] EXT4-fs error (device loop1): ext4_orphan_get:1408: comm syz.1.1299: couldn't read orphan inode 17 (err -117) [ 125.260030][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 125.260050][ C1] EXT4-fs (loop1): initial error at time 1787643532: ext4_iget_extra_inode:5210: inode 17 [ 125.260075][ C1] EXT4-fs (loop1): last error at time 1787643532: ext4_iget_extra_inode:5210: inode 17 [ 125.300691][ T7588] loop1: lost filesystem error report for type 5 error -117 [ 125.424573][ T7610] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1308'. [ 125.512331][ T3289] udevd[3289]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 125.549427][ T6650] udevd[6650]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 125.652938][ T7621] loop4: detected capacity change from 0 to 512 [ 125.687663][ T7615] loop3: detected capacity change from 0 to 512 [ 125.689576][ T7621] loop4: detected capacity change from 0 to 1764 [ 125.701304][ T7615] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 125.741979][ T7621] geneve3: entered promiscuous mode [ 125.851629][ T7615] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #16: comm syz.3.1307: invalid indirect mapped block 4294967295 (level 0) [ 125.868788][ T7615] fserror_report: 3 callbacks suppressed [ 125.868802][ T7615] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 125.876269][ T7615] EXT4-fs (loop3): Remounting filesystem read-only [ 125.895766][ T7615] EXT4-fs (loop3): 1 orphan inode deleted [ 125.916302][ T7615] EXT4-fs (loop3): 1 truncate cleaned up [ 125.924661][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 125.933157][ C1] EXT4-fs (loop3): initial error at time 1787643533: ext4_free_branches:1023: inode 16 [ 125.945278][ C1] EXT4-fs (loop3): last error at time 1787643533: ext4_free_branches:1023: inode 16 [ 125.990446][ T7631] ext4 filesystem being mounted at /270/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 126.050877][ T7635] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1311'. [ 126.194292][ T7637] netlink: 160 bytes leftover after parsing attributes in process `syz.1.1315'. [ 126.460469][ T7639] EXT4-fs: Ignoring removed bh option [ 126.689809][ T7649] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 126.809807][ T7655] EXT4-fs error (device loop3): ext4_get_branch:178: inode #13: block 1024: comm syz.3.1322: invalid block [ 126.830369][ T7655] loop3: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 126.830492][ T7655] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #13: comm syz.3.1322: invalid indirect mapped block 1024 (level 0) [ 126.845093][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 126.845131][ C1] EXT4-fs (loop3): initial error at time 1787643534: ext4_get_branch:178: inode 13: block 1024 [ 126.845177][ C1] EXT4-fs (loop3): last error at time 1787643534: ext4_get_branch:178: inode 13: block 1024 [ 126.905963][ T7655] loop3: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 126.913990][ T7655] EXT4-fs error (device loop3): ext4_validate_block_bitmap:445: comm syz.3.1322: bg 0: block 35: padding at end of block bitmap is not set [ 126.942949][ T7655] loop3: lost filesystem error report for type 5 error -117 [ 126.943390][ T7655] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 126.969184][ T7655] loop3: lost filesystem error report for type 5 error -117 [ 126.969436][ T7655] EXT4-fs (loop3): 1 truncate cleaned up [ 127.185142][ T7662] netlink: 'syz.0.1325': attribute type 4 has an invalid length. [ 128.108405][ T28] kauditd_printk_skb: 121 callbacks suppressed [ 128.108570][ T28] audit: type=1400 audit(1787643535.548:5878): avc: denied { read } for pid=7676 comm="syz.0.1328" dev="nsfs" ino=4026532737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 128.161467][ T28] audit: type=1400 audit(1787643535.548:5879): avc: denied { open } for pid=7676 comm="syz.0.1328" path="net:[4026532737]" dev="nsfs" ino=4026532737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 128.197798][ T28] audit: type=1400 audit(1787643535.588:5880): avc: denied { create } for pid=7676 comm="syz.0.1328" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 128.226707][ T28] audit: type=1400 audit(1787643535.598:5881): avc: denied { read write } for pid=7676 comm="syz.0.1328" name="virtual_nci" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 128.261831][ T28] audit: type=1400 audit(1787643535.598:5882): avc: denied { open } for pid=7676 comm="syz.0.1328" path="/dev/virtual_nci" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 128.301209][ T7664] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 128.329324][ T3302] EXT4-fs unmount: 17 callbacks suppressed [ 128.329346][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 128.360022][ T7678] set_capacity_and_notify: 3 callbacks suppressed [ 128.360042][ T7678] loop0: detected capacity change from 0 to 512 [ 128.395128][ T28] audit: type=1400 audit(1787643535.598:5883): avc: denied { write } for pid=7676 comm="syz.0.1328" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 128.479672][ T28] audit: type=1400 audit(1787643535.598:5884): avc: denied { read } for pid=7676 comm="syz.0.1328" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 128.514732][ T7678] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 128.581052][ T7678] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #16: comm syz.0.1328: invalid indirect mapped block 4294967295 (level 0) [ 128.610427][ T28] audit: type=1400 audit(1787643535.598:5885): avc: denied { create } for pid=7676 comm="syz.0.1328" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 128.667614][ T7684] loop2: detected capacity change from 0 to 1024 [ 128.676025][ T7678] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 128.696014][ T7678] EXT4-fs (loop0): Remounting filesystem read-only [ 128.709295][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 128.709323][ C1] EXT4-fs (loop0): initial error at time 1787643536: ext4_free_branches:1023: inode 16 [ 128.709350][ C1] EXT4-fs (loop0): last error at time 1787643536: ext4_free_branches:1023: inode 16 [ 128.768358][ T28] audit: type=1400 audit(1787643535.598:5886): avc: denied { write } for pid=7676 comm="syz.0.1328" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 128.829669][ T7684] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 128.847743][ T28] audit: type=1400 audit(1787643535.708:5887): avc: denied { read } for pid=7676 comm="syz.0.1328" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 128.878379][ T7684] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 128.968176][ T7684] JBD2: no valid journal superblock found [ 128.979646][ T7678] EXT4-fs (loop0): 1 orphan inode deleted [ 129.000382][ T7684] EXT4-fs (loop2): Could not load journal inode [ 129.011370][ T7678] EXT4-fs (loop0): 1 truncate cleaned up [ 129.019755][ T7678] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 129.178128][ T7699] loop4: detected capacity change from 0 to 512 [ 129.245178][ T7699] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 129.331441][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 129.351620][ T7696] gretap0 speed is unknown, defaulting to 1000 [ 129.390188][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 129.428168][ T7707] FAULT_INJECTION: forcing a failure. [ 129.428168][ T7707] name failslab, interval 1, probability 0, space 0, times 0 [ 129.444162][ T7707] CPU: 1 UID: 0 PID: 7707 Comm: syz.4.1338 Not tainted syzkaller #0 PREEMPT(lazy) [ 129.444263][ T7707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 129.444278][ T7707] Call Trace: [ 129.444303][ T7707] [ 129.444313][ T7707] __dump_stack+0x1d/0x30 [ 129.444344][ T7707] dump_stack_lvl+0x95/0xd0 [ 129.444366][ T7707] dump_stack+0x15/0x1b [ 129.444384][ T7707] should_fail_ex+0x262/0x280 [ 129.444561][ T7707] ? security_file_alloc+0x32/0xf0 [ 129.444643][ T7707] should_failslab+0x8c/0xb0 [ 129.444668][ T7707] kmem_cache_alloc_noprof+0x7c/0x3f0 [ 129.444728][ T7707] ? security_file_alloc+0x32/0xf0 [ 129.444754][ T7707] security_file_alloc+0x32/0xf0 [ 129.444786][ T7707] init_file+0x5b/0x1b0 [ 129.444902][ T7707] alloc_empty_file+0x85/0x1e0 [ 129.444936][ T7707] path_openat+0x50/0x10d0 [ 129.444965][ T7707] ? kstrtouint+0x76/0xc0 [ 129.445026][ T7707] do_file_open+0x16c/0x290 [ 129.445070][ T7707] do_sys_openat2+0xa0/0x130 [ 129.445094][ T7707] __x64_sys_openat+0xf2/0x120 [ 129.445117][ T7707] x64_sys_call+0x1f72/0x2550 [ 129.445140][ T7707] do_syscall_64+0x112/0x360 [ 129.445221][ T7707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.445250][ T7707] RIP: 0033:0x7f7f4954e90e [ 129.445267][ T7707] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 129.445296][ T7707] RSP: 002b:00007f7f47fe6f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 129.445334][ T7707] RAX: ffffffffffffffda RBX: 00007f7f47fe76c0 RCX: 00007f7f4954e90e [ 129.445350][ T7707] RDX: 0000000000000000 RSI: 00007f7f4962475f RDI: ffffffffffffff9c [ 129.445388][ T7707] RBP: 00007f7f47fe7090 R08: 0000000000000000 R09: 0000000000000000 [ 129.445404][ T7707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 129.445415][ T7707] R13: 00007f7f49816038 R14: 00007f7f49815fa0 R15: 00007ffc375c0668 [ 129.445434][ T7707] [ 129.720070][ T3300] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 129.765665][ T7705] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=43559 sclass=netlink_xfrm_socket pid=7705 comm=syz.0.1337 [ 129.834574][ T7717] gretap0 speed is unknown, defaulting to 1000 [ 129.878552][ T7719] loop2: detected capacity change from 0 to 512 [ 129.937808][ T7719] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 129.941095][ T7724] netlink: 'syz.1.1344': attribute type 21 has an invalid length. [ 129.961411][ T7724] __nla_validate_parse: 1 callbacks suppressed [ 129.961430][ T7724] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1344'. [ 129.970565][ T7719] ext4 filesystem being mounted at /283/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 129.971469][ T7719] binfmt_misc: register: failed to install interpreter ./file2 [ 130.016857][ T7724] netlink: 'syz.1.1344': attribute type 5 has an invalid length. [ 130.028693][ T7724] netlink: 'syz.1.1344': attribute type 6 has an invalid length. [ 130.037732][ T7724] netlink: 3 bytes leftover after parsing attributes in process `syz.1.1344'. [ 130.068471][ T7724] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1344'. [ 130.115030][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 130.198735][ T7732] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1346'. [ 130.343564][ T7740] loop3: detected capacity change from 0 to 512 [ 130.359079][ T7740] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 130.377961][ T7740] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #16: comm syz.3.1347: invalid indirect mapped block 4294967295 (level 0) [ 130.394622][ T7745] bond5: Unable to set peer notification delay as MII monitoring is disabled [ 130.395288][ T7740] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 130.404841][ T7740] EXT4-fs (loop3): Remounting filesystem read-only [ 130.405679][ T7745] bond5 (unregistering): Released all slaves [ 130.417347][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 130.417366][ C1] EXT4-fs (loop3): initial error at time 1787643537: ext4_free_branches:1023: inode 16 [ 130.417396][ C1] EXT4-fs (loop3): last error at time 1787643537: ext4_free_branches:1023: inode 16 [ 130.418182][ T7740] EXT4-fs (loop3): 1 orphan inode deleted [ 130.418200][ T7740] EXT4-fs (loop3): 1 truncate cleaned up [ 130.418792][ T7740] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 130.801687][ T7761] loop0: detected capacity change from 0 to 32768 [ 130.841074][ T7768] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1358'. [ 130.845555][ T7770] FAULT_INJECTION: forcing a failure. [ 130.845555][ T7770] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 130.878853][ T7770] CPU: 0 UID: 0 PID: 7770 Comm: syz.4.1359 Not tainted syzkaller #0 PREEMPT(lazy) [ 130.878885][ T7770] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 130.878900][ T7770] Call Trace: [ 130.878906][ T7770] [ 130.878917][ T7770] __dump_stack+0x1d/0x30 [ 130.879025][ T7770] dump_stack_lvl+0x95/0xd0 [ 130.879054][ T7770] dump_stack+0x15/0x1b [ 130.879075][ T7770] should_fail_ex+0x262/0x280 [ 130.879107][ T7770] should_fail+0xb/0x20 [ 130.879134][ T7770] should_fail_usercopy+0x1a/0x20 [ 130.879165][ T7770] _copy_from_iter+0xcc/0xe70 [ 130.879233][ T7770] ? __alloc_skb+0x516/0x6f0 [ 130.879342][ T7770] ? __alloc_skb+0x209/0x6f0 [ 130.879367][ T7770] netlink_sendmsg+0x4a4/0x6f0 [ 130.879394][ T7770] ? __pfx_netlink_sendmsg+0x10/0x10 [ 130.879452][ T7770] ____sys_sendmsg+0x532/0x580 [ 130.879546][ T7770] ___sys_sendmsg+0x195/0x1e0 [ 130.879583][ T7770] __x64_sys_sendmsg+0xd4/0x160 [ 130.879608][ T7770] x64_sys_call+0x22ab/0x2550 [ 130.879665][ T7770] do_syscall_64+0x112/0x360 [ 130.879762][ T7770] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.879784][ T7770] RIP: 0033:0x7f7f4958e0d9 [ 130.879799][ T7770] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.879817][ T7770] RSP: 002b:00007f7f47fe7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 130.879896][ T7770] RAX: ffffffffffffffda RBX: 00007f7f49815fa0 RCX: 00007f7f4958e0d9 [ 130.879959][ T7770] RDX: 0000000024000080 RSI: 0000200000000100 RDI: 0000000000000003 [ 130.879972][ T7770] RBP: 00007f7f47fe7090 R08: 0000000000000000 R09: 0000000000000000 [ 130.879986][ T7770] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 130.879998][ T7770] R13: 00007f7f49816038 R14: 00007f7f49815fa0 R15: 00007ffc375c0668 [ 130.880038][ T7770] [ 131.205237][ T7761] loop0: p1 p3 < > [ 131.327599][ T7780] gretap0 speed is unknown, defaulting to 1000 [ 131.905490][ T3289] udevd[3289]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 131.906666][ T6652] udevd[6652]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 131.935392][ T7782] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=43559 sclass=netlink_xfrm_socket pid=7782 comm=syz.0.1363 [ 131.955690][ T3300] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 132.008885][ T7793] ip_tables: iptables: counters copy to user failed while replacing table [ 132.027625][ T7793] No such timeout policy "syz1" [ 132.033815][ T7793] netlink: 27 bytes leftover after parsing attributes in process `syz.1.1368'. [ 132.046748][ T7793] netlink: 'syz.1.1368': attribute type 1 has an invalid length. [ 132.055780][ T7793] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1368'. [ 132.084315][ T7802] loop4: detected capacity change from 0 to 512 [ 132.100642][ T7802] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 132.133665][ T7802] EXT4-fs (loop4): 1 truncate cleaned up [ 132.141336][ T7802] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 132.279479][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 132.380754][ T7821] loop1: detected capacity change from 0 to 512 [ 132.404042][ T7821] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 132.434965][ T7821] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #16: comm syz.1.1377: invalid indirect mapped block 4294967295 (level 0) [ 132.456560][ T7821] loop1: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 132.459578][ T7821] EXT4-fs (loop1): Remounting filesystem read-only [ 132.484849][ T7821] EXT4-fs (loop1): 1 orphan inode deleted [ 132.495428][ T7821] EXT4-fs (loop1): 1 truncate cleaned up [ 132.502834][ T7821] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 132.519364][ T7828] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 132.555229][ T7824] loop3: detected capacity change from 0 to 32768 [ 132.587840][ T7824] loop3: p1 p3 < > [ 132.665947][ T3861] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 132.715074][ T7836] loop3: detected capacity change from 0 to 128 [ 132.741984][ T7836] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 132.747555][ T7832] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 132.758074][ T7836] ext4 filesystem being mounted at /239/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 132.878005][ T7842] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1384'. [ 132.926165][ T7837] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 132.955360][ T3300] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 132.968464][ T7837] ext4 filesystem being mounted at /286/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 133.075770][ T7849] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 133.094013][ T3861] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 133.106837][ T7849] EXT4-fs (loop2): 1 truncate cleaned up [ 133.143275][ T28] kauditd_printk_skb: 222 callbacks suppressed [ 133.143289][ T28] audit: type=1400 audit(1787643540.578:6110): avc: denied { connect } for pid=7852 comm="syz.3.1387" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 133.185247][ T7849] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 133.202064][ T28] audit: type=1400 audit(1787643540.638:6111): avc: denied { write } for pid=7852 comm="syz.3.1387" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 133.251508][ T28] audit: type=1400 audit(1787643540.698:6112): avc: denied { write } for pid=7848 comm="syz.2.1386" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 133.278990][ T28] audit: type=1400 audit(1787643540.698:6113): avc: denied { create } for pid=7848 comm="syz.2.1386" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 133.376767][ T28] audit: type=1400 audit(1787643540.808:6114): avc: denied { name_bind } for pid=7862 comm="syz.1.1390" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 133.402759][ T7863] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=43559 sclass=netlink_xfrm_socket pid=7863 comm=syz.1.1390 [ 133.404934][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 133.435479][ T28] audit: type=1400 audit(1787643540.808:6115): avc: denied { node_bind } for pid=7862 comm="syz.1.1390" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 133.466079][ T28] audit: type=1400 audit(1787643540.808:6116): avc: denied { create } for pid=7862 comm="syz.1.1390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 133.539449][ T7859] set_capacity_and_notify: 2 callbacks suppressed [ 133.539464][ T7859] loop0: detected capacity change from 0 to 512 [ 133.558183][ T28] audit: type=1400 audit(1787643540.808:6117): avc: denied { write } for pid=7862 comm="syz.1.1390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 133.607660][ T7875] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 133.622735][ T7859] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 133.672261][ T7859] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #16: comm syz.0.1391: invalid indirect mapped block 4294967295 (level 0) [ 133.699479][ T7859] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 133.699827][ T7859] EXT4-fs (loop0): Remounting filesystem read-only [ 133.720925][ T7859] EXT4-fs (loop0): 1 orphan inode deleted [ 133.729871][ T7859] EXT4-fs (loop0): 1 truncate cleaned up [ 133.737005][ T7874] loop3: detected capacity change from 0 to 32768 [ 133.737335][ T7859] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 133.783886][ T28] audit: type=1400 audit(1787643541.208:6118): avc: denied { read } for pid=7880 comm="syz.4.1395" name="sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 133.839674][ T28] audit: type=1400 audit(1787643541.208:6119): avc: denied { open } for pid=7880 comm="syz.4.1395" path="/dev/sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 133.889290][ T7874] loop3: p1 p3 < > [ 133.892867][ T7884] loop4: detected capacity change from 0 to 512 [ 133.903111][ T7884] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 133.931857][ T7884] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #17: comm syz.4.1396: corrupted in-inode xattr: e_name out of bounds [ 133.955900][ T7884] loop4: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 133.961797][ T7884] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.1396: couldn't read orphan inode 17 (err -117) [ 134.004342][ T7887] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1397'. [ 134.016442][ T7884] loop4: lost filesystem error report for type 5 error -117 [ 134.017033][ T7884] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 134.135437][ T6650] udevd[6650]: inotify_add_watch(7, /dev/loop3p3, 10) failed: No such file or directory [ 134.135697][ T3289] udevd[3289]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 134.168284][ T7892] configfs-gadget.g1 gadget.0: HOST MAC d6:1d:93:bd:7b:1e [ 134.168307][ T7892] configfs-gadget.g1 gadget.0: MAC 1e:22:df:18:dd:ba [ 134.197878][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.260480][ T7902] loop3: detected capacity change from 0 to 1164 [ 134.275268][ T7902] ISOFS: primary root directory is empty. Disabling Rock Ridge and switching to Joliet. [ 134.306745][ T7893] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1399'. [ 134.346208][ T7902] bridge_slave_0: left allmulticast mode [ 134.352280][ T7902] bridge_slave_0: left promiscuous mode [ 134.361529][ T7902] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.382884][ T7902] bridge_slave_1: left allmulticast mode [ 134.390757][ T7902] bridge_slave_1: left promiscuous mode [ 134.397704][ T7902] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.405221][ T7916] netlink: 'syz.3.1402': attribute type 10 has an invalid length. [ 134.439895][ T7902] bond0: (slave bond_slave_1): Releasing backup interface [ 134.455479][ T7902] team0: Port device team_slave_0 removed [ 134.468058][ T7902] team0: Port device team_slave_1 removed [ 134.480825][ T7902] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 134.680344][ T7916] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 135.231462][ T7944] gretap0 speed is unknown, defaulting to 1000 [ 135.298126][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 135.348807][ T7947] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 135.373293][ T7953] __nla_validate_parse: 3 callbacks suppressed [ 135.373306][ T7953] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1409'. [ 135.520174][ T7969] loop4: detected capacity change from 0 to 512 [ 135.550962][ T7969] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 135.569810][ T7969] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #16: comm syz.4.1411: invalid indirect mapped block 4294967295 (level 0) [ 135.585676][ T7969] loop4: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 135.585936][ T7969] EXT4-fs (loop4): Remounting filesystem read-only [ 135.597600][ T7951] loop1: detected capacity change from 0 to 32768 [ 135.609889][ T7969] EXT4-fs (loop4): 1 orphan inode deleted [ 135.614421][ T7972] FAULT_INJECTION: forcing a failure. [ 135.614421][ T7972] name failslab, interval 1, probability 0, space 0, times 0 [ 135.617367][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 135.631263][ T7972] CPU: 0 UID: 0 PID: 7972 Comm: syz.2.1413 Not tainted syzkaller #0 PREEMPT(lazy) [ 135.631290][ T7972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 135.631303][ T7972] Call Trace: [ 135.631311][ T7972] [ 135.631319][ T7972] __dump_stack+0x1d/0x30 [ 135.631345][ T7972] dump_stack_lvl+0x95/0xd0 [ 135.631441][ T7972] dump_stack+0x15/0x1b [ 135.631531][ T7972] should_fail_ex+0x262/0x280 [ 135.631565][ T7972] ? security_inode_alloc+0x37/0x100 [ 135.631592][ T7972] should_failslab+0x8c/0xb0 [ 135.631620][ T7972] kmem_cache_alloc_noprof+0x7c/0x3f0 [ 135.631724][ T7972] ? security_inode_alloc+0x37/0x100 [ 135.631835][ T7972] security_inode_alloc+0x37/0x100 [ 135.631857][ T7972] inode_init_always_gfp+0x495/0x4e0 [ 135.631889][ T7972] ? __pfx_proc_alloc_inode+0x10/0x10 [ 135.631909][ T7972] alloc_inode+0x58/0x170 [ 135.632064][ T7972] new_inode+0x1d/0xe0 [ 135.632082][ T7972] proc_pid_make_inode+0x24/0x200 [ 135.632171][ T7972] ? __pfx_proc_fd_instantiate+0x10/0x10 [ 135.632200][ T7972] proc_fd_instantiate+0x36/0x190 [ 135.632268][ T7972] ? __pfx_proc_fd_instantiate+0x10/0x10 [ 135.632382][ T7972] proc_lookupfd_common+0xd2/0x190 [ 135.632456][ T7972] proc_lookupfd+0x24/0x30 [ 135.632480][ T7972] __lookup_slow+0x155/0x200 [ 135.632504][ T7972] lookup_slow+0x3c/0x60 [ 135.632534][ T7972] path_lookupat+0x2b2/0x4c0 [ 135.632557][ T7972] do_o_path+0x47/0x140 [ 135.632583][ T7972] path_openat+0xd9c/0x10d0 [ 135.632612][ T7972] do_file_open+0x16c/0x290 [ 135.632685][ T7972] do_sys_openat2+0xa0/0x130 [ 135.632772][ T7972] __x64_sys_openat+0xf2/0x120 [ 135.632795][ T7972] x64_sys_call+0x1f72/0x2550 [ 135.632822][ T7972] do_syscall_64+0x112/0x360 [ 135.632847][ T7972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.632880][ T7972] RIP: 0033:0x7f57d59be90e [ 135.632905][ T7972] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 135.632926][ T7972] RSP: 002b:00007f57d4456b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 135.632949][ T7972] RAX: ffffffffffffffda RBX: 00007f57d44576c0 RCX: 00007f57d59be90e [ 135.633023][ T7972] RDX: 0000000000210000 RSI: 00007f57d4456c00 RDI: ffffffffffffff9c [ 135.633051][ T7972] RBP: 00007f57d4456c00 R08: 0000000000000000 R09: 0000000000000000 [ 135.633065][ T7972] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 135.633079][ T7972] R13: 00007f57d5c86038 R14: 00007f57d5c85fa0 R15: 00007ffefd3beab8 [ 135.633100][ T7972] [ 135.906725][ T7989] loop2: detected capacity change from 0 to 512 [ 135.912674][ C1] EXT4-fs (loop4): initial error at time 1787643542: ext4_free_branches:1023: inode 16 [ 135.933669][ C1] EXT4-fs (loop4): last error at time 1787643542: ext4_free_branches:1023: inode 16 [ 135.944174][ T7989] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 135.948098][ T7969] EXT4-fs (loop4): 1 truncate cleaned up [ 135.964474][ T7969] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 135.967494][ T7989] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #17: comm syz.2.1420: corrupted in-inode xattr: e_name out of bounds [ 136.013973][ T7989] loop2: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 136.014272][ T7951] loop1: p1 p3 < > [ 136.032576][ T7989] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.1420: couldn't read orphan inode 17 (err -117) [ 136.045258][ T7989] loop2: lost filesystem error report for type 5 error -117 [ 136.071330][ T7989] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 136.109047][ T7992] IPv6: Can't replace route, no match found [ 136.127475][ T7994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.151661][ T7994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.161870][ T7994] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 136.170332][ T7994] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 136.178809][ T7994] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 136.182322][ T6650] udevd[6650]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 136.187892][ T7994] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 136.189810][ T3289] udevd[3289]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 136.351045][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 136.361912][ T7998] loop0: detected capacity change from 0 to 256 [ 136.389359][ T8000] ip_tables: iptables: counters copy to user failed while replacing table [ 136.405055][ T8000] No such timeout policy "syz1" [ 136.411750][ T8000] netlink: 'syz.4.1424': attribute type 1 has an invalid length. [ 136.421203][ T8000] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1424'. [ 136.460599][ T8001] netlink: 'syz.0.1423': attribute type 10 has an invalid length. [ 136.471949][ T8001] syz_tun: entered promiscuous mode [ 136.481704][ T8001] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 136.891452][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 137.048531][ T8015] loop0: detected capacity change from 0 to 512 [ 137.057116][ T8015] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 137.103219][ T8015] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #17: comm syz.0.1429: corrupted in-inode xattr: e_name out of bounds [ 137.117907][ T8015] loop0: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 137.122797][ T8015] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.1429: couldn't read orphan inode 17 (err -117) [ 137.146522][ T8015] loop0: lost filesystem error report for type 5 error -117 [ 137.147198][ T8015] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 137.191262][ T8017] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(13) [ 137.200117][ T8017] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 137.210078][ T8017] vhci_hcd vhci_hcd.0: Device attached [ 137.221993][ T8018] vhci_hcd: cannot find the pending unlink 4096 [ 137.330857][ C0] vcan0: j1939_tp_rxtimer: 0xffff888129e26800: rx timeout, send abort [ 137.426968][ T23] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 137.542354][ T23] usb 5-1: new full-speed USB device number 2 using vhci_hcd [ 137.771557][ T8029] loop4: detected capacity change from 0 to 32768 [ 137.795546][ T8029] loop4: p1 p3 < > [ 137.896626][ C0] vcan0: j1939_tp_rxtimer: 0xffff888129e26800: abort rx timeout. Force session deactivation [ 137.926705][ T8018] vhci_hcd: connection reset by peer [ 137.965111][ T182] vhci_hcd vhci_hcd.2: stop threads [ 137.979903][ T182] vhci_hcd vhci_hcd.2: release socket [ 138.000083][ T182] vhci_hcd vhci_hcd.2: disconnect device [ 138.094265][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 138.149249][ T8032] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 138.187550][ T28] kauditd_printk_skb: 127 callbacks suppressed [ 138.187566][ T28] audit: type=1400 audit(1787643545.638:6247): avc: denied { write } for pid=8046 comm="syz.0.1437" name="ip_mr_cache" dev="proc" ino=4026532874 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 138.243732][ T8032] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #16: comm syz.1.1434: invalid indirect mapped block 4294967295 (level 0) [ 138.275013][ T8032] loop1: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 138.275213][ T8032] EXT4-fs (loop1): Remounting filesystem read-only [ 138.295223][ T8014] Set syz0 is full, maxelem 65536 reached [ 138.302707][ T8047] pim6reg0: tun_chr_ioctl cmd 1074025672 [ 138.313004][ T8047] pim6reg0: ignored: set checksum disabled [ 138.313026][ T8032] EXT4-fs (loop1): 1 orphan inode deleted [ 138.323201][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 138.323387][ C1] EXT4-fs (loop1): initial error at time 1787643545: ext4_free_branches:1023: inode 16 [ 138.323426][ C1] EXT4-fs (loop1): last error at time 1787643545: ext4_free_branches:1023: inode 16 [ 138.323977][ T28] audit: type=1400 audit(1787643545.778:6248): avc: denied { write } for pid=8046 comm="syz.0.1437" name="001" dev="devtmpfs" ino=171 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 138.332423][ T8032] EXT4-fs (loop1): 1 truncate cleaned up [ 138.413912][ T8032] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 138.504624][ T3861] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 138.527405][ T8057] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1441'. [ 138.582499][ T8058] cgroup: fork rejected by pids controller in /syz1 [ 138.589529][ T28] audit: type=1400 audit(1787643546.018:6249): avc: denied { create } for pid=8053 comm="syz.4.1441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 138.654961][ T8063] set_capacity_and_notify: 1 callbacks suppressed [ 138.654980][ T8063] loop0: detected capacity change from 0 to 512 [ 138.669899][ T28] audit: type=1400 audit(1787643546.018:6250): avc: denied { setopt } for pid=8053 comm="syz.4.1441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 138.716844][ T8063] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 138.727587][ T8065] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1446'. [ 138.739139][ T28] audit: type=1400 audit(1787643546.018:6251): avc: denied { bind } for pid=8053 comm="syz.4.1441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 138.763368][ T28] audit: type=1400 audit(1787643546.038:6252): avc: denied { read } for pid=8053 comm="syz.4.1441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 138.763634][ T8068] loop3: detected capacity change from 0 to 512 [ 138.788830][ T28] audit: type=1400 audit(1787643546.088:6253): avc: denied { write } for pid=8053 comm="syz.4.1441" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 138.788901][ T28] audit: type=1400 audit(1787643546.088:6254): avc: denied { name_bind } for pid=8053 comm="syz.4.1441" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 138.846527][ T8068] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 138.862090][ T28] audit: type=1400 audit(1787643546.278:6255): avc: denied { write } for pid=8091 comm="syz.4.1449" name="c.1" dev="configfs" ino=5264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.910658][ T8063] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #17: comm syz.0.1445: corrupted in-inode xattr: e_name out of bounds [ 138.927930][ T28] audit: type=1400 audit(1787643546.278:6256): avc: denied { write } for pid=8091 comm="syz.4.1449" name="c.1" dev="configfs" ino=5264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 138.966171][ T8063] loop0: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 138.967194][ T8063] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.1445: couldn't read orphan inode 17 (err -117) [ 138.981239][ T8068] EXT4-fs (loop3): 1 truncate cleaned up [ 138.993969][ T8063] loop0: lost filesystem error report for type 5 error -117 [ 139.001647][ T8068] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 139.001897][ T8063] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 139.178542][ T8221] netlink: 46 bytes leftover after parsing attributes in process `syz.4.1451'. [ 139.214010][ T3300] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 139.265542][ T8230] ip_tables: iptables: counters copy to user failed while replacing table [ 139.296114][ T8230] No such timeout policy "syz1" [ 139.305087][ T8230] netlink: 'syz.2.1454': attribute type 1 has an invalid length. [ 139.316079][ T8230] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1454'. [ 139.374223][ T8238] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1456'. [ 139.453040][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 139.525978][ T8247] loop3: detected capacity change from 0 to 512 [ 139.545818][ T8247] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 139.586200][ T8247] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #16: comm syz.3.1453: invalid indirect mapped block 4294967295 (level 0) [ 139.607414][ T8247] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 139.611642][ T8247] EXT4-fs (loop3): Remounting filesystem read-only [ 139.639445][ T8254] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 139.642653][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 139.642684][ C0] EXT4-fs (loop3): initial error at time 1787643547: ext4_free_branches:1023: inode 16 [ 139.642714][ C0] EXT4-fs (loop3): last error at time 1787643547: ext4_free_branches:1023: inode 16 [ 139.699118][ T8247] EXT4-fs (loop3): 1 orphan inode deleted [ 139.705858][ T8247] EXT4-fs (loop3): 1 truncate cleaned up [ 139.717062][ T8247] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 139.717736][ T8257] loop4: detected capacity change from 0 to 512 [ 139.786022][ T8257] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.1463: corrupted in-inode xattr: e_value out of bounds [ 139.808914][ T8257] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 139.809096][ T8257] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.1463: couldn't read orphan inode 15 (err -117) [ 139.838821][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 139.838852][ C1] EXT4-fs (loop4): initial error at time 1787643547: ext4_iget_extra_inode:5210: inode 15 [ 139.838908][ C1] EXT4-fs (loop4): last error at time 1787643547: ext4_iget_extra_inode:5210: inode 15 [ 139.880510][ T8257] loop4: lost filesystem error report for type 5 error -117 [ 139.882699][ T8257] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 139.961654][ T8260] gretap0 speed is unknown, defaulting to 1000 [ 140.039049][ T8274] loop0: detected capacity change from 0 to 1024 [ 140.053613][ T8274] EXT4-fs: Ignoring removed orlov option [ 140.061092][ T8274] EXT4-fs: inline encryption not supported [ 140.090603][ T8274] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 140.133247][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 140.138007][ T8260] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.155040][ T8260] bridge0: port 1(bridge_slave_0) entered disabled state [ 140.155055][ T8274] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (52238!=20869) [ 140.167976][ T8260] bridge_slave_0: entered allmulticast mode [ 140.178484][ T8274] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 140.180614][ T8274] EXT4-fs (loop0): invalid journal inode [ 140.187275][ T8260] bridge_slave_0: entered promiscuous mode [ 140.198758][ T8274] EXT4-fs (loop0): can't get journal size [ 140.216925][ T8260] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.237313][ T8260] bridge0: port 2(bridge_slave_1) entered disabled state [ 140.247720][ T8260] bridge_slave_1: entered allmulticast mode [ 140.258378][ T8260] bridge_slave_1: entered promiscuous mode [ 140.275419][ T7787] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.277106][ T8274] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 140.314985][ T3300] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 140.320862][ T8274] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1467'. [ 140.367444][ T8260] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 140.395858][ T8260] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 140.408501][ T313] IPVS: starting estimator thread 0... [ 140.418540][ T8260] team0: Port device team_slave_0 added [ 140.425779][ T8260] team0: Port device team_slave_1 added [ 140.451509][ T8260] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 140.480126][ T8260] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 140.514106][ T8260] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 140.531132][ T8260] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 140.539892][ T8260] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 140.588429][ T8260] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 140.589762][ T8288] IPVS: using max 2160 ests per chain, 108000 per kthread [ 140.682728][ T7787] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.740923][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 140.815515][ T8299] loop4: detected capacity change from 0 to 1024 [ 140.826992][ T8260] hsr_slave_0: entered promiscuous mode [ 140.853541][ T8260] hsr_slave_1: entered promiscuous mode [ 140.872176][ T8260] debugfs: 'hsr0' already exists in 'hsr' [ 140.892000][ T8260] Cannot create hsr debugfs directory [ 140.928820][ T8299] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 140.955659][ T8304] loop0: detected capacity change from 0 to 512 [ 141.055823][ T8304] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 141.075814][ T8297] SELinux: Context system_u:object_r:fsadm_exec_t:s0 is not valid (left unmapped). [ 141.167818][ T8297] loop4: detected capacity change from 0 to 4096 [ 141.193721][ T8304] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #17: comm syz.0.1474: corrupted in-inode xattr: e_name out of bounds [ 141.212890][ T8304] loop0: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 141.213090][ T8304] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.1474: couldn't read orphan inode 17 (err -117) [ 141.225840][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 141.225884][ C1] EXT4-fs (loop0): initial error at time 1787643548: ext4_iget_extra_inode:5210: inode 17 [ 141.225912][ C1] EXT4-fs (loop0): last error at time 1787643548: ext4_iget_extra_inode:5210: inode 17 [ 141.279234][ T8304] loop0: lost filesystem error report for type 5 error -117 [ 141.283640][ T8297] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 141.312327][ T8304] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 141.330292][ T7787] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.366440][ T8297] EXT4-fs error (device loop4): ext4_do_update_inode:5801: inode #15: comm syz.4.1471: corrupted inode contents [ 141.396852][ T8297] EXT4-fs error (device loop4): ext4_dirty_inode:6731: inode #15: comm syz.4.1471: mark_inode_dirty error [ 141.413856][ T7787] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.430201][ T8297] EXT4-fs error (device loop4): ext4_do_update_inode:5801: inode #15: comm syz.4.1471: corrupted inode contents [ 141.446216][ T8297] EXT4-fs error (device loop4): __ext4_ext_dirty:207: inode #15: comm syz.4.1471: mark_inode_dirty error [ 141.458905][ T8297] EXT4-fs error (device loop4): ext4_do_update_inode:5801: inode #15: comm syz.4.1471: corrupted inode contents [ 141.509996][ T7787] bridge_slave_1: left allmulticast mode [ 141.520071][ T7787] bridge_slave_1: left promiscuous mode [ 141.530583][ T8297] EXT4-fs error (device loop4): __ext4_ext_dirty:207: inode #15: comm syz.4.1471: mark_inode_dirty error [ 141.547935][ T7787] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.561151][ T7787] bridge_slave_0: left allmulticast mode [ 141.569828][ T7787] bridge_slave_0: left promiscuous mode [ 141.581255][ T8297] EXT4-fs error (device loop4): ext4_do_update_inode:5801: inode #15: comm syz.4.1471: corrupted inode contents [ 141.605091][ T7787] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.643922][ T8297] EXT4-fs error (device loop4): ext4_truncate:4721: inode #15: comm syz.4.1471: mark_inode_dirty error [ 141.683008][ T8297] EXT4-fs error (device loop4) in ext4_setattr:6247: Corrupt filesystem [ 141.712981][ T8299] EXT4-fs error (device loop4): ext4_do_update_inode:5801: inode #15: comm syz.4.1471: corrupted inode contents [ 141.745995][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 141.796999][ T8316] FAULT_INJECTION: forcing a failure. [ 141.796999][ T8316] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 141.813001][ T8316] CPU: 1 UID: 0 PID: 8316 Comm: syz.0.1476 Not tainted syzkaller #0 PREEMPT(lazy) [ 141.813098][ T8316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 141.813109][ T8316] Call Trace: [ 141.813116][ T8316] [ 141.813125][ T8316] __dump_stack+0x1d/0x30 [ 141.813151][ T8316] dump_stack_lvl+0x95/0xd0 [ 141.813171][ T8316] dump_stack+0x15/0x1b [ 141.813244][ T8316] should_fail_ex+0x262/0x280 [ 141.813276][ T8316] should_fail+0xb/0x20 [ 141.813303][ T8316] should_fail_usercopy+0x1a/0x20 [ 141.813372][ T8316] strncpy_from_user+0x27/0x250 [ 141.813404][ T8316] do_getname+0x59/0x1c0 [ 141.813440][ T8316] __se_sys_mkdirat+0x21/0xf0 [ 141.813559][ T8316] __x64_sys_mkdirat+0x43/0x50 [ 141.813589][ T8316] x64_sys_call+0x368/0x2550 [ 141.813677][ T8316] do_syscall_64+0x112/0x360 [ 141.813703][ T8316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.813772][ T8316] RIP: 0033:0x7fb07495e0d9 [ 141.813816][ T8316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.813837][ T8316] RSP: 002b:00007fb0733b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 141.813860][ T8316] RAX: ffffffffffffffda RBX: 00007fb074be5fa0 RCX: 00007fb07495e0d9 [ 141.813875][ T8316] RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c [ 141.813891][ T8316] RBP: 00007fb0733b7090 R08: 0000000000000000 R09: 0000000000000000 [ 141.813906][ T8316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 141.813976][ T8316] R13: 00007fb074be6038 R14: 00007fb074be5fa0 R15: 00007ffc1042da28 [ 141.814006][ T8316] [ 142.092915][ T8321] loop3: detected capacity change from 0 to 512 [ 142.127707][ T7787] bond2 (unregistering): (slave bridge1): Releasing backup interface [ 142.148505][ T7787] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 142.177744][ T8321] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 142.191938][ T7787] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 142.204655][ T8321] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e042e018, mo2=0002] [ 142.217494][ T8321] System zones: 0-1, 15-15, 18-18, 34-34 [ 142.227754][ T8321] EXT4-fs (loop3): orphan cleanup on readonly fs [ 142.240865][ T8321] EXT4-fs warning (device loop3): ext4_enable_quotas:7304: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 142.261003][ T8321] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 142.274083][ T8321] EXT4-fs error (device loop3): ext4_orphan_get:1429: comm syz.3.1479: bad orphan inode 16 [ 142.285576][ T8321] loop3: lost filesystem error report for type 5 error -117 [ 142.285792][ T8321] ext4_test_bit(bit=15, block=18) = 1 [ 142.299390][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 142.299425][ C1] EXT4-fs (loop3): initial error at time 1787643549: ext4_orphan_get:1429 [ 142.299445][ C1] EXT4-fs (loop3): last error at time 1787643549: ext4_orphan_get:1429 [ 142.339398][ T8321] is_bad_inode(inode)=0 [ 142.340376][ T7787] bond0 (unregistering): Released all slaves [ 142.347614][ T8321] NEXT_ORPHAN(inode)=0 [ 142.359024][ T7787] bond1 (unregistering): Released all slaves [ 142.361258][ T8321] max_ino=32 [ 142.361344][ T8321] i_nlink=2 [ 142.372823][ T7787] bond2 (unregistering): Released all slaves [ 142.377940][ T8321] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 142.390694][ T7787] bond3 (unregistering): Released all slaves [ 142.444988][ T8321] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1479'. [ 142.451406][ T7787] bond4 (unregistering): Released all slaves [ 142.476574][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 142.510700][ T3403] gretap0 speed is unknown, defaulting to 1000 [ 142.522998][ T3403] infiniband syz1: ib_query_port failed (-19) [ 142.566520][ T3300] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 142.594700][ T23] usb 5-1: enqueue for inactive port 0 [ 142.602621][ T23] usb 5-1: enqueue for inactive port 0 [ 142.670452][ T7787] hsr_slave_0: left promiscuous mode [ 142.686545][ T8347] loop2: detected capacity change from 0 to 1024 [ 142.704812][ T23] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 142.771884][ T7787] hsr_slave_1: left promiscuous mode [ 142.787052][ T8347] EXT4-fs (loop2): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 142.832722][ T7787] veth1_macvtap: left promiscuous mode [ 142.840220][ T7787] veth0_macvtap: left promiscuous mode [ 142.847334][ T7787] veth1_vlan: left promiscuous mode [ 142.848664][ T8347] ext4 filesystem being mounted at /316/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 142.854627][ T7787] veth0_vlan: left promiscuous mode [ 142.912753][ T8359] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 142.950365][ T8359] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #16: comm syz.4.1480: invalid indirect mapped block 4294967295 (level 0) [ 142.954771][ T8347] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1482'. [ 142.995035][ T8359] loop4: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 143.001407][ T8359] EXT4-fs (loop4): Remounting filesystem read-only [ 143.011735][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 143.011754][ C1] EXT4-fs (loop4): initial error at time 1787643550: ext4_free_branches:1023: inode 16 [ 143.011800][ C1] EXT4-fs (loop4): last error at time 1787643550: ext4_free_branches:1023: inode 16 [ 143.034187][ T8347] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1482'. [ 143.082533][ T8359] EXT4-fs (loop4): 1 orphan inode deleted [ 143.089258][ T8359] EXT4-fs (loop4): 1 truncate cleaned up [ 143.098325][ T8359] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 143.174875][ T7787] team0 (unregistering): Port device team_slave_1 removed [ 143.191591][ T7787] team0 (unregistering): Port device team_slave_0 removed [ 143.274827][ T3018] 8021q: adding VLAN 0 to HW filter on device eth1 [ 143.378808][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 143.439142][ T8374] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 143.485464][ T8374] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #17: comm syz.2.1486: corrupted in-inode xattr: e_name out of bounds [ 143.505764][ T8374] loop2: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 143.508917][ T8364] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 143.538394][ T8364] ext4 filesystem being mounted at /260/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 143.554111][ T8374] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.1486: couldn't read orphan inode 17 (err -117) [ 143.558829][ T28] kauditd_printk_skb: 43 callbacks suppressed [ 143.558848][ T28] audit: type=1400 audit(1787643550.988:6299): avc: denied { write } for pid=8367 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 143.570295][ T8374] loop2: lost filesystem error report for type 5 error -117 [ 143.571043][ T8374] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 143.617251][ T28] audit: type=1400 audit(1787643551.048:6300): avc: denied { write } for pid=8383 comm="rm" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 143.720268][ T3018] 8021q: adding VLAN 0 to HW filter on device eth2 [ 143.746137][ T30] EXT4-fs error (device loop3): ext4_map_blocks:832: inode #15: comm kworker/u8:1: lblock 0 mapped to illegal pblock 0 (length 1) [ 143.772157][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 143.776691][ T28] audit: type=1400 audit(1787643551.048:6301): avc: denied { write } for pid=8363 comm="syz.3.1485" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 143.788894][ T30] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 143.875567][ T30] EXT4-fs (loop3): This should not happen!! Data will be lost [ 143.875567][ T30] [ 143.900637][ T28] audit: type=1400 audit(1787643551.048:6302): avc: denied { read } for pid=8363 comm="syz.3.1485" name="file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 143.934205][ T28] audit: type=1400 audit(1787643551.048:6303): avc: denied { map } for pid=8363 comm="syz.3.1485" path="/260/file1/file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 143.937715][ T3300] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 143.992217][ T28] audit: type=1400 audit(1787643551.048:6304): avc: denied { write } for pid=8373 comm="syz.2.1486" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 144.049287][ T8404] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.051882][ T28] audit: type=1400 audit(1787643551.488:6305): avc: denied { write } for pid=8388 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 144.059587][ T8404] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.123427][ T8408] set_capacity_and_notify: 4 callbacks suppressed [ 144.123448][ T8408] loop4: detected capacity change from 0 to 1024 [ 144.156752][ T28] audit: type=1400 audit(1787643551.578:6306): avc: denied { write } for pid=8407 comm="rm" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 144.200844][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 144.285694][ T8408] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 144.359518][ T8425] loop2: detected capacity change from 0 to 512 [ 144.377830][ T28] audit: type=1400 audit(1787643551.798:6307): avc: denied { write } for pid=8396 comm="syz.4.1490" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 144.394006][ T8430] ip_tables: iptables: counters copy to user failed while replacing table [ 144.419008][ T8397] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1490'. [ 144.467095][ T8397] ext4: Unknown parameter 'TIPCv2' [ 144.470205][ T28] audit: type=1400 audit(1787643551.918:6308): avc: denied { remount } for pid=8396 comm="syz.4.1490" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 144.505681][ T8430] No such timeout policy "syz1" [ 144.513624][ T8430] netlink: 'syz.0.1495': attribute type 1 has an invalid length. [ 144.522172][ T8430] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1495'. [ 144.931898][ T8260] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 144.942171][ T8260] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 144.955719][ T8260] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 144.967738][ T8260] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 144.978142][ T8260] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 144.990625][ T8260] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 145.007541][ T8260] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 145.027391][ T8260] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 145.140753][ T313] Bluetooth: hci0: Frame reassembly failed (-84) [ 145.180654][ T8260] 8021q: adding VLAN 0 to HW filter on device bond0 [ 145.216807][ T8260] 8021q: adding VLAN 0 to HW filter on device team0 [ 145.231662][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 145.242920][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 145.263812][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 145.281223][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 145.294213][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 145.294555][ T8487] loop0: detected capacity change from 0 to 512 [ 145.323066][ T8260] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 145.337797][ T8260] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 145.400576][ T8487] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 145.446110][ T8487] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #16: comm syz.0.1498: invalid indirect mapped block 4294967295 (level 0) [ 145.469003][ T8487] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 145.478919][ T8487] EXT4-fs (loop0): Remounting filesystem read-only [ 145.507622][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 145.517953][ C0] EXT4-fs (loop0): initial error at time 1787643552: ext4_free_branches:1023: inode 16 [ 145.533223][ C0] EXT4-fs (loop0): last error at time 1787643552: ext4_free_branches:1023: inode 16 [ 145.537271][ T8487] EXT4-fs (loop0): 1 orphan inode deleted [ 145.558030][ T8487] EXT4-fs (loop0): 1 truncate cleaned up [ 145.567805][ T8487] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 145.650921][ T8506] netlink: 'syz.2.1504': attribute type 1 has an invalid length. [ 145.653591][ T8500] loop4: detected capacity change from 0 to 1024 [ 145.698179][ T8260] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 145.808062][ T8260] veth0_vlan: entered promiscuous mode [ 145.818587][ T8260] veth1_vlan: entered promiscuous mode [ 145.851049][ T8260] veth0_macvtap: entered promiscuous mode [ 145.866401][ T8260] veth1_macvtap: entered promiscuous mode [ 145.882630][ T8260] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 145.907305][ T8519] ip_tables: iptables: counters copy to user failed while replacing table [ 145.919974][ T8260] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 145.959431][ T7787] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.968926][ T8500] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 145.970077][ T7787] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.021692][ T8519] No such timeout policy "syz1" [ 146.041531][ T8519] netlink: 'syz.2.1506': attribute type 1 has an invalid length. [ 146.056713][ T8519] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1506'. [ 146.069450][ T7787] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.082120][ T7787] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.187985][ T8524] loop2: detected capacity change from 0 to 1024 [ 146.197983][ T8524] EXT4-fs: Ignoring removed bh option [ 146.207470][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 146.256479][ T8524] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 146.326208][ T3295] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 146.471115][ T8538] netlink: 46 bytes leftover after parsing attributes in process `syz.1.1513'. [ 146.503359][ T8548] ip_tables: iptables: counters copy to user failed while replacing table [ 146.538390][ T8548] No such timeout policy "syz1" [ 146.544938][ T8548] netlink: 'syz.0.1517': attribute type 1 has an invalid length. [ 146.557797][ T8548] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1517'. [ 146.647975][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 146.699077][ T8559] loop4: detected capacity change from 0 to 512 [ 146.722981][ T8558] loop0: detected capacity change from 0 to 512 [ 146.763368][ T8558] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 146.779223][ T8559] EXT4-fs error (device loop4): __ext4_fill_super:5621: inode #2: comm syz.4.1522: iget: checksum invalid [ 146.811340][ T8559] loop4: lost file I/O error report for ino 2 type 5 pos 0x0 len 0x0 error -74 [ 146.812270][ T8561] loop1: detected capacity change from 0 to 512 [ 146.832256][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 146.832287][ C1] EXT4-fs (loop4): initial error at time 1787643554: __ext4_fill_super:5621: inode 2 [ 146.832312][ C1] EXT4-fs (loop4): last error at time 1787643554: __ext4_fill_super:5621: inode 2 [ 146.837688][ T8559] EXT4-fs (loop4): get root inode failed [ 146.846017][ T8558] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #17: comm syz.0.1521: corrupted in-inode xattr: e_name out of bounds [ 146.854082][ T8559] EXT4-fs (loop4): mount failed [ 146.877634][ T8561] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 146.885021][ T8558] loop0: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 146.915877][ T8561] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #16: comm syz.1.1519: invalid indirect mapped block 4294967295 (level 0) [ 146.923411][ T8558] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.1521: couldn't read orphan inode 17 (err -117) [ 146.934587][ T8561] loop1: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 146.952174][ T8561] EXT4-fs (loop1): Remounting filesystem read-only [ 146.966971][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 146.977494][ T8561] EXT4-fs (loop1): 1 orphan inode deleted [ 146.985572][ C1] EXT4-fs (loop0): initial error at time 1787643554: ext4_iget_extra_inode:5210: inode 17 [ 146.985609][ C1] EXT4-fs (loop0): last error at time 1787643554: ext4_iget_extra_inode:5210: inode 17 [ 146.997589][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 146.997611][ C0] EXT4-fs (loop1): initial error at time 1787643554: ext4_free_branches:1023: inode 16 [ 146.997636][ C0] EXT4-fs (loop1): last error at time 1787643554: ext4_free_branches:1023: inode 16 [ 147.004814][ T8558] loop0: lost filesystem error report for type 5 error -117 [ 147.054836][ T8561] EXT4-fs (loop1): 1 truncate cleaned up [ 147.187768][ T3625] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 147.228030][ T8577] ip_tables: iptables: counters copy to user failed while replacing table [ 147.244338][ T8577] No such timeout policy "syz1" [ 147.262439][ T8577] netlink: 'syz.4.1528': attribute type 1 has an invalid length. [ 147.272408][ T8577] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1528'. [ 147.287003][ T8582] netlink: 46 bytes leftover after parsing attributes in process `syz.3.1529'. [ 147.364605][ T8589] loop0: detected capacity change from 0 to 1024 [ 147.391595][ T8589] loop0: detected capacity change from 0 to 512 [ 147.514927][ T182] IPVS: starting estimator thread 0... [ 147.654993][ T8596] IPVS: using max 2400 ests per chain, 120000 per kthread [ 147.665964][ T8609] ip_tables: iptables: counters copy to user failed while replacing table [ 147.679370][ T8608] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 147.710665][ T8608] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #17: comm syz.4.1540: corrupted in-inode xattr: e_name out of bounds [ 147.738791][ T8608] loop4: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 147.740146][ T8608] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.1540: couldn't read orphan inode 17 (err -117) [ 147.752037][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 147.752063][ C1] EXT4-fs (loop4): initial error at time 1787643555: ext4_iget_extra_inode:5210: inode 17 [ 147.752099][ C1] EXT4-fs (loop4): last error at time 1787643555: ext4_iget_extra_inode:5210: inode 17 [ 147.789133][ T8609] No such timeout policy "syz1" [ 147.817344][ T8608] loop4: lost filesystem error report for type 5 error -117 [ 147.841216][ T8609] netlink: 'syz.0.1542': attribute type 1 has an invalid length. [ 147.864520][ T8609] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1542'. [ 148.003495][ T8633] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 148.046818][ T8633] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #16: comm syz.3.1546: invalid indirect mapped block 4294967295 (level 0) [ 148.086432][ T8633] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 148.086869][ T8633] EXT4-fs (loop3): Remounting filesystem read-only [ 148.098606][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 148.098691][ C0] EXT4-fs (loop3): initial error at time 1787643555: ext4_free_branches:1023: inode 16 [ 148.098759][ C0] EXT4-fs (loop3): last error at time 1787643555: ext4_free_branches:1023: inode 16 [ 148.142978][ T8633] EXT4-fs (loop3): 1 orphan inode deleted [ 148.149978][ T8633] EXT4-fs (loop3): 1 truncate cleaned up [ 148.275701][ T8654] EXT4-fs: Ignoring removed bh option [ 148.300956][ T8656] ip_tables: iptables: counters copy to user failed while replacing table [ 148.345071][ T8643] syzkaller0: entered promiscuous mode [ 148.352293][ T8643] syzkaller0: entered allmulticast mode [ 148.376481][ T8656] No such timeout policy "syz1" [ 148.389681][ T8656] netlink: 'syz.1.1558': attribute type 1 has an invalid length. [ 148.399421][ T8656] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1558'. [ 148.466513][ T8662] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 148.482439][ T8662] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #17: comm syz.4.1560: corrupted in-inode xattr: e_name out of bounds [ 148.484056][ T8645] syz.0.1554: attempt to access beyond end of device [ 148.484056][ T8645] loop0: rw=2049, sector=138, nr_sectors = 112 limit=128 [ 148.538658][ T8662] loop4: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 148.538943][ T8662] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.1560: couldn't read orphan inode 17 (err -117) [ 148.550303][ C0] EXT4-fs (loop4): error count since last fsck: 1 [ 148.550321][ C0] EXT4-fs (loop4): initial error at time 1787643555: ext4_iget_extra_inode:5210: inode 17 [ 148.550355][ C0] EXT4-fs (loop4): last error at time 1787643555: ext4_iget_extra_inode:5210: inode 17 [ 148.593869][ T8662] loop4: lost filesystem error report for type 5 error -117 [ 148.597826][ T28] kauditd_printk_skb: 281 callbacks suppressed [ 148.597841][ T28] audit: type=1400 audit(1787643556.048:6590): avc: denied { write } for pid=8661 comm="syz.4.1560" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 148.836702][ T8680] FAULT_INJECTION: forcing a failure. [ 148.836702][ T8680] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 148.889387][ T8680] CPU: 1 UID: 60929 PID: 8680 Comm: syz.2.1566 Not tainted syzkaller #0 PREEMPT(lazy) [ 148.889424][ T8680] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 148.889438][ T8680] Call Trace: [ 148.889446][ T8680] [ 148.889501][ T8680] __dump_stack+0x1d/0x30 [ 148.889596][ T8680] dump_stack_lvl+0x95/0xd0 [ 148.889616][ T8680] dump_stack+0x15/0x1b [ 148.889635][ T8680] should_fail_ex+0x262/0x280 [ 148.889709][ T8680] should_fail+0xb/0x20 [ 148.889740][ T8680] should_fail_usercopy+0x1a/0x20 [ 148.889776][ T8680] _copy_from_user+0x1c/0xb0 [ 148.889801][ T8680] kstrtouint_from_user+0x69/0xf0 [ 148.889886][ T8680] ? 0xffffffff81000000 [ 148.889901][ T8680] ? avc_policy_seqno+0x15/0x30 [ 148.889922][ T8680] proc_fail_nth_write+0x50/0x160 [ 148.890027][ T8680] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 148.890086][ T8680] vfs_write+0x254/0x9a0 [ 148.890110][ T8680] ? __fget_files+0x184/0x1c0 [ 148.890144][ T8680] ? mutex_lock+0x57/0x90 [ 148.890239][ T8680] ksys_write+0xdc/0x1a0 [ 148.890268][ T8680] __x64_sys_write+0x40/0x50 [ 148.890292][ T8680] x64_sys_call+0x154e/0x2550 [ 148.890315][ T8680] do_syscall_64+0x112/0x360 [ 148.890396][ T8680] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.890416][ T8680] RIP: 0033:0x7f57d59be90e [ 148.890431][ T8680] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 148.890473][ T8680] RSP: 002b:00007f57d4456fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 148.890495][ T8680] RAX: ffffffffffffffda RBX: 00007f57d44576c0 RCX: 00007f57d59be90e [ 148.890566][ T8680] RDX: 0000000000000001 RSI: 00007f57d44570a0 RDI: 0000000000000003 [ 148.890615][ T8680] RBP: 00007f57d4457090 R08: 0000000000000000 R09: 0000000000000000 [ 148.890628][ T8680] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 148.890640][ T8680] R13: 00007f57d5c86038 R14: 00007f57d5c85fa0 R15: 00007ffefd3beab8 [ 148.890662][ T8680] [ 149.147203][ T28] audit: type=1400 audit(1787643556.598:6591): avc: denied { ioctl } for pid=8671 comm="syz.4.1563" path="socket:[24389]" dev="sockfs" ino=24389 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 149.193926][ T8688] ip_tables: iptables: counters copy to user failed while replacing table [ 149.223481][ T28] audit: type=1326 audit(1787643556.668:6592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8691 comm="syz.4.1571" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 149.293839][ T28] audit: type=1326 audit(1787643556.668:6593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8691 comm="syz.4.1571" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 149.339969][ T28] audit: type=1326 audit(1787643556.668:6594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8691 comm="syz.4.1571" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 149.377855][ T8701] set_capacity_and_notify: 5 callbacks suppressed [ 149.377875][ T8701] loop1: detected capacity change from 0 to 512 [ 149.403260][ T28] audit: type=1326 audit(1787643556.668:6595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8691 comm="syz.4.1571" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 149.433462][ T8701] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 149.440539][ T8704] netlink: 'syz.2.1570': attribute type 1 has an invalid length. [ 149.452814][ T28] audit: type=1326 audit(1787643556.678:6596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8691 comm="syz.4.1571" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=245 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 149.492354][ T8688] No such timeout policy "syz1" [ 149.512899][ T8701] EXT4-fs error (device loop1): ext4_iget_extra_inode:5210: inode #17: comm syz.1.1573: corrupted in-inode xattr: e_name out of bounds [ 149.518972][ T8690] loop0: detected capacity change from 0 to 512 [ 149.533178][ T8693] audit: audit_backlog=65 > audit_backlog_limit=64 [ 149.536939][ T8704] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1570'. [ 149.549485][ T28] audit: type=1326 audit(1787643556.678:6597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8691 comm="syz.4.1571" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4958e0d9 code=0x7ffc0000 [ 149.581573][ T8701] loop1: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 149.581869][ T8693] audit: audit_lost=3 audit_rate_limit=0 audit_backlog_limit=64 [ 149.591303][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 149.591327][ C0] EXT4-fs (loop1): initial error at time 1787643557: ext4_iget_extra_inode:5210: inode 17 [ 149.591360][ C0] EXT4-fs (loop1): last error at time 1787643557: ext4_iget_extra_inode:5210: inode 17 [ 149.601838][ T8690] EXT4-fs (loop0): blocks per group (4) and clusters per group (32768) inconsistent [ 149.609304][ T8701] EXT4-fs error (device loop1): ext4_orphan_get:1408: comm syz.1.1573: couldn't read orphan inode 17 (err -117) [ 149.659849][ T8701] loop1: lost filesystem error report for type 5 error -117 [ 149.683804][ T8711] loop3: detected capacity change from 0 to 512 [ 149.732585][ T8711] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 149.760206][ T8711] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #16: comm syz.3.1574: invalid indirect mapped block 4294967295 (level 0) [ 149.769190][ T8690] process 'syz.0.1569' launched '/dev/fd/5' with NULL argv: empty string added [ 149.783266][ T8711] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 149.794363][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 149.819534][ C1] EXT4-fs (loop3): initial error at time 1787643557: ext4_free_branches:1023: inode 16 [ 149.831479][ C1] EXT4-fs (loop3): last error at time 1787643557: ext4_free_branches:1023: inode 16 [ 149.847184][ T8711] EXT4-fs (loop3): Remounting filesystem read-only [ 149.857345][ T8711] EXT4-fs (loop3): 1 orphan inode deleted [ 149.865362][ T8711] EXT4-fs (loop3): 1 truncate cleaned up [ 150.138472][ T8736] netlink: 'syz.3.1580': attribute type 58 has an invalid length. [ 150.206854][ T8737] bond4 (unregistering): Released all slaves [ 150.257098][ T8748] loop3: detected capacity change from 0 to 512 [ 150.287118][ T8748] EXT4-fs error (device loop3): ext4_iget_extra_inode:5210: inode #15: comm syz.3.1585: corrupted in-inode xattr: e_value out of bounds [ 150.376461][ T8748] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 150.376759][ T8748] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.1585: couldn't read orphan inode 15 (err -117) [ 150.388319][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 150.388344][ C0] EXT4-fs (loop3): initial error at time 1787643557: ext4_iget_extra_inode:5210: inode 15 [ 150.388379][ C0] EXT4-fs (loop3): last error at time 1787643557: ext4_iget_extra_inode:5210: inode 15 [ 150.493291][ T8748] loop3: lost filesystem error report for type 5 error -117 [ 150.495174][ T8760] netlink: 46 bytes leftover after parsing attributes in process `syz.2.1589'. [ 150.727532][ T8778] FAULT_INJECTION: forcing a failure. [ 150.727532][ T8778] name failslab, interval 1, probability 0, space 0, times 0 [ 150.789155][ T8779] loop2: detected capacity change from 0 to 764 [ 150.807621][ T8778] CPU: 1 UID: 0 PID: 8778 Comm: syz.3.1595 Not tainted syzkaller #0 PREEMPT(lazy) [ 150.807700][ T8778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 150.807715][ T8778] Call Trace: [ 150.807723][ T8778] [ 150.807732][ T8778] __dump_stack+0x1d/0x30 [ 150.807771][ T8778] dump_stack_lvl+0x95/0xd0 [ 150.807793][ T8778] dump_stack+0x15/0x1b [ 150.807816][ T8778] should_fail_ex+0x262/0x280 [ 150.807868][ T8778] should_failslab+0x8c/0xb0 [ 150.807894][ T8778] __kvmalloc_node_noprof+0x168/0x5c0 [ 150.808148][ T8778] ? alloc_netdev_mqs+0xa7/0xa90 [ 150.808172][ T8778] ? alloc_netdev_mqs+0xa7/0xa90 [ 150.808299][ T8778] ? __pfx_ipvlan_link_setup+0x10/0x10 [ 150.808388][ T8778] alloc_netdev_mqs+0xa7/0xa90 [ 150.808464][ T8778] rtnl_create_link+0x239/0x720 [ 150.808566][ T8778] rtnl_newlink_create+0x17a/0x4a0 [ 150.808584][ T8778] ? security_capable+0x7b/0x90 [ 150.808620][ T8778] ? netlink_ns_capable+0x86/0xa0 [ 150.808717][ T8778] rtnl_newlink+0x1255/0x1510 [ 150.809143][ T8778] ? try_charge_memcg+0x208/0xa10 [ 150.809164][ T8778] ? __memcg_slab_free_hook+0x154/0x340 [ 150.809183][ T8778] ? __rcu_read_unlock+0x4e/0x70 [ 150.809220][ T8778] ? avc_has_perm_noaudit+0xa3/0x120 [ 150.809285][ T8778] ? cred_has_capability+0x224/0x2a0 [ 150.809322][ T8778] ? selinux_capable+0x31/0x40 [ 150.809378][ T8778] ? security_capable+0x7b/0x90 [ 150.809407][ T8778] ? ns_capable+0x80/0xb0 [ 150.809426][ T8778] ? __pfx_rtnl_newlink+0x10/0x10 [ 150.809492][ T8778] rtnetlink_rcv_msg+0x64b/0x720 [ 150.809593][ T8778] netlink_rcv_skb+0x11e/0x220 [ 150.809690][ T8778] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 150.809727][ T8778] rtnetlink_rcv+0x1c/0x30 [ 150.809865][ T8778] netlink_unicast+0x5a9/0x680 [ 150.809899][ T8778] netlink_sendmsg+0x5be/0x6f0 [ 150.809956][ T8778] ? __pfx_netlink_sendmsg+0x10/0x10 [ 150.809975][ T8778] ____sys_sendmsg+0x532/0x580 [ 150.810060][ T8778] ___sys_sendmsg+0x195/0x1e0 [ 150.810095][ T8778] __x64_sys_sendmsg+0xd4/0x160 [ 150.810123][ T8778] x64_sys_call+0x22ab/0x2550 [ 150.810215][ T8778] do_syscall_64+0x112/0x360 [ 150.810237][ T8778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.810258][ T8778] RIP: 0033:0x7f725108e0d9 [ 150.810275][ T8778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.810330][ T8778] RSP: 002b:00007f724fae7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 150.810569][ T8778] RAX: ffffffffffffffda RBX: 00007f7251315fa0 RCX: 00007f725108e0d9 [ 150.810586][ T8778] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 150.810599][ T8778] RBP: 00007f724fae7090 R08: 0000000000000000 R09: 0000000000000000 [ 150.810611][ T8778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 150.810668][ T8778] R13: 00007f7251316038 R14: 00007f7251315fa0 R15: 00007ffdc0e5d0a8 [ 150.810745][ T8778] [ 150.914629][ T8766] loop4: detected capacity change from 0 to 32768 [ 150.917732][ T8779] iso9660: Unknown parameter 'ch' [ 151.061452][ T8768] loop1: detected capacity change from 0 to 32768 [ 151.358273][ T8768] loop1: p1 p3 < > [ 151.380437][ T8766] loop4: p1 p3 < > [ 151.497205][ T8797] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1600'. [ 151.589834][ T6652] udevd[6652]: inotify_add_watch(7, /dev/loop4p3, 10) failed: No such file or directory [ 151.592054][ T6650] udevd[6650]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 151.638224][ T8806] tmpfs: Bad value for 'mpol' [ 151.729225][ T8799] syzkaller0: entered promiscuous mode [ 151.735109][ T8799] syzkaller0: entered allmulticast mode [ 151.746341][ T3289] udevd[3289]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 151.748188][ T6650] udevd[6650]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 151.982498][ T8813] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 151.995778][ T8815] ip_tables: iptables: counters copy to user failed while replacing table [ 152.065132][ T8815] netlink: 'syz.3.1606': attribute type 1 has an invalid length. [ 152.082345][ T8815] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1606'. [ 152.127459][ T8822] netlink: 'syz.0.1609': attribute type 1 has an invalid length. [ 152.172990][ T8822] 8021q: adding VLAN 0 to HW filter on device bond2 [ 152.214688][ T8830] bond2: Unable to set down delay as MII monitoring is disabled [ 152.225677][ T8830] bond2 (unregistering): Released all slaves [ 152.375746][ T8832] loop3: detected capacity change from 0 to 32768 [ 152.395656][ T8832] loop3: p1 p3 < > [ 152.470104][ T8842] loop1: detected capacity change from 0 to 1024 [ 152.480487][ T8842] EXT4-fs: Ignoring removed bh option [ 152.570004][ T8852] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1618'. [ 152.675621][ T8860] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 152.677704][ T3289] udevd[3289]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 152.697325][ T6650] udevd[6650]: inotify_add_watch(7, /dev/loop3p3, 10) failed: No such file or directory [ 152.858733][ T8866] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=8866 comm=syz.3.1622 [ 152.980813][ T8870] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1623'. [ 153.086873][ T8870] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1623'. [ 153.155026][ T8870] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1623'. [ 153.262554][ T8874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.290095][ T8874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.291057][ T8876] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1624'. [ 153.402703][ T8882] loop4: detected capacity change from 0 to 512 [ 153.427875][ T8882] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 153.454765][ T8882] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e042e018, mo2=0002] [ 153.457657][ T8888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.466022][ T8882] System zones: 0-1, 15-15, 18-18, 34-34 [ 153.482637][ T8882] EXT4-fs (loop4): orphan cleanup on readonly fs [ 153.496954][ T8882] EXT4-fs warning (device loop4): ext4_enable_quotas:7304: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 153.502018][ T8888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.514005][ T8882] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 153.529603][ T8882] EXT4-fs error (device loop4): ext4_orphan_get:1429: comm syz.4.1629: bad orphan inode 16 [ 153.543035][ T8882] loop4: lost filesystem error report for type 5 error -117 [ 153.544257][ T8882] ext4_test_bit(bit=15, block=18) = 1 [ 153.553736][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 153.553805][ C1] EXT4-fs (loop4): initial error at time 1787643560: ext4_orphan_get:1429 [ 153.553828][ C1] EXT4-fs (loop4): last error at time 1787643560: ext4_orphan_get:1429 [ 153.592212][ T8882] is_bad_inode(inode)=0 [ 153.597698][ T8882] NEXT_ORPHAN(inode)=0 [ 153.604790][ T8882] max_ino=32 [ 153.608325][ T8882] i_nlink=2 [ 153.634053][ T8888] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 153.642032][ T8888] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 153.659525][ T8888] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 153.682025][ T8897] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 153.706123][ T8888] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 153.968576][ T8907] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1634'. [ 154.241500][ T8909] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1636'. [ 154.455632][ T8914] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1638'. [ 154.475794][ T8918] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1639'. [ 154.506291][ T8918] loop4: detected capacity change from 0 to 512 [ 154.523993][ T8918] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 154.534543][ T8918] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 154.563929][ T8925] loop0: detected capacity change from 0 to 512 [ 154.578824][ T8925] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 154.588708][ T8918] EXT4-fs (loop4): warning: checktime reached, running e2fsck is recommended [ 154.591841][ T8925] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #17: comm syz.0.1643: corrupted in-inode xattr: e_name out of bounds [ 154.614309][ T8918] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002] [ 154.621358][ T8925] loop0: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 154.629216][ T8918] System zones: [ 154.629635][ T8925] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.1643: couldn't read orphan inode 17 (err -117) [ 154.640900][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 154.640920][ C0] EXT4-fs (loop0): initial error at time 1787643562: ext4_iget_extra_inode:5210: inode 17 [ 154.645818][ T8925] loop0: lost filesystem error report for type 5 error -117 [ 154.659251][ C0] EXT4-fs (loop0): last error at time 1787643562: ext4_iget_extra_inode:5210: inode 17 [ 154.660702][ T8918] 0-2 [ 154.689762][ T8929] loop2: detected capacity change from 0 to 1024 [ 154.717190][ T8918] , 18-18, 34-34 [ 154.722439][ T8918] EXT4-fs error (device loop4): ext4_orphan_get:1429: comm syz.4.1639: bad orphan inode 15 [ 154.736682][ T28] kauditd_printk_skb: 284 callbacks suppressed [ 154.736697][ T28] audit: type=1400 audit(1787643562.188:6880): avc: denied { write } for pid=8924 comm="syz.0.1643" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 154.747812][ T8929] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a042c029, mo2=0002] [ 154.772378][ T8918] loop4: lost filesystem error report for type 5 error -117 [ 154.785885][ T8918] ext4_test_bit(bit=14, block=18) = 1 [ 154.797084][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 154.797102][ C1] EXT4-fs (loop4): initial error at time 1787643562: ext4_orphan_get:1429 [ 154.797123][ C1] EXT4-fs (loop4): last error at time 1787643562: ext4_orphan_get:1429 [ 154.797575][ T8929] System zones: 0-1, 3-12 [ 154.835803][ T8933] loop1: detected capacity change from 0 to 512 [ 154.837385][ T8918] is_bad_inode(inode)=0 [ 154.848938][ T8918] NEXT_ORPHAN(inode)=2264924160 [ 154.854571][ T8918] max_ino=32 [ 154.858756][ T8918] i_nlink=0 [ 154.863289][ T8929] EXT4-fs error (device loop2): ext4_validate_block_bitmap:445: comm syz.2.1640: bg 0: block 216: padding at end of block bitmap is not set [ 154.884274][ T8918] EXT4-fs error (device loop4): ext4_xattr_delete_inode:2933: inode #15: comm syz.4.1639: corrupted xattr block 19: bad e_name length [ 154.901166][ T8933] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 154.913449][ T8929] EXT4-fs (loop2): Remounting filesystem read-only [ 154.935059][ T8918] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 154.935514][ T8929] EXT4-fs warning (device loop2): ext4_xattr_inode_lookup_create:1613: inode #11: comm syz.2.1640: cleanup dec ref error -28 [ 154.955606][ T8918] EXT4-fs warning (device loop4): ext4_evict_inode:288: xattr delete (err -117) [ 154.984443][ T8933] EXT4-fs error (device loop1): ext4_iget_extra_inode:5210: inode #17: comm syz.1.1644: corrupted in-inode xattr: e_name out of bounds [ 155.002802][ T28] audit: type=1400 audit(1787643562.448:6881): avc: denied { bind } for pid=8935 comm="syz.3.1646" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 155.037614][ T8933] loop1: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 155.037792][ T28] audit: type=1400 audit(1787643562.448:6882): avc: denied { setopt } for pid=8935 comm="syz.3.1646" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 155.039593][ T8933] EXT4-fs error (device loop1): ext4_orphan_get:1408: comm syz.1.1644: couldn't read orphan inode 17 (err -117) [ 155.048324][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 155.048345][ C0] EXT4-fs (loop1): initial error at time 1787643562: ext4_iget_extra_inode:5210: inode 17 [ 155.112937][ C0] EXT4-fs (loop1): last error at time 1787643562: ext4_iget_extra_inode:5210: inode 17 [ 155.113154][ T8939] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 155.126334][ T8933] loop1: lost filesystem error report for type 5 error -117 [ 155.128881][ T28] audit: type=1400 audit(1787643562.548:6883): avc: denied { write } for pid=8915 comm="syz.2.1640" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 155.179968][ T8937] loop3: detected capacity change from 0 to 8192 [ 155.191826][ T28] audit: type=1400 audit(1787643562.638:6884): avc: denied { write } for pid=8932 comm="syz.1.1644" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 155.431733][ T8953] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1651'. [ 155.549746][ T8942] ================================================================== [ 155.560149][ T8942] BUG: KCSAN: data-race in __writeback_single_inode / xas_set_mark [ 155.570085][ T8942] [ 155.574018][ T8942] write to 0xffff888107a890ac of 4 bytes by task 8937 on cpu 0: [ 155.585409][ T8942] xas_set_mark+0x12b/0x140 [ 155.591180][ T8942] __folio_start_writeback+0x16b/0x370 [ 155.597793][ T8942] __mpage_writepages+0xd92/0x1370 [ 155.604961][ T8942] fat_writepages+0x26/0x30 [ 155.610108][ T8942] do_writepages+0x1b9/0x300 [ 155.615712][ T8942] file_write_and_wait_range+0x178/0x2f0 [ 155.624919][ T8942] simple_fsync_noflush+0x42/0x120 [ 155.631588][ T8942] fat_file_fsync+0x7e/0x100 [ 155.637560][ T8942] vfs_fsync_range+0xc5/0xe0 [ 155.643471][ T8942] generic_file_write_iter+0x1a3/0x1f0 [ 155.652429][ T8942] iter_file_splice_write+0x6a0/0xa60 [ 155.661644][ T8942] direct_splice_actor+0x158/0x280 [ 155.667850][ T8942] splice_direct_to_actor+0x2f9/0x680 [ 155.674145][ T8942] do_splice_direct+0x119/0x1a0 [ 155.681026][ T8942] do_sendfile+0x37d/0x640 [ 155.687072][ T8942] __x64_sys_sendfile64+0x105/0x150 [ 155.694168][ T8942] x64_sys_call+0x1015/0x2550 [ 155.701250][ T8942] do_syscall_64+0x112/0x360 [ 155.706681][ T8942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.715434][ T8942] [ 155.719319][ T8942] read to 0xffff888107a890ac of 4 bytes by task 8942 on cpu 1: [ 155.727433][ T8942] __writeback_single_inode+0x208/0x790 [ 155.734312][ T8942] writeback_single_inode+0x16d/0x410 [ 155.742702][ T8942] sync_inode_metadata+0x6e/0xa0 [ 155.749576][ T8942] simple_fsync_noflush+0xdb/0x120 [ 155.756401][ T8942] fat_file_fsync+0x7e/0x100 [ 155.763269][ T8942] vfs_fsync_range+0xc5/0xe0 [ 155.768696][ T8942] generic_file_write_iter+0x1a3/0x1f0 [ 155.778093][ T8942] iter_file_splice_write+0x6a0/0xa60 [ 155.787361][ T8942] direct_splice_actor+0x158/0x280 [ 155.795385][ T8942] splice_direct_to_actor+0x2f9/0x680 [ 155.802703][ T8942] do_splice_direct+0x119/0x1a0 [ 155.808660][ T8942] do_sendfile+0x37d/0x640 [ 155.820169][ T8942] __x64_sys_sendfile64+0x105/0x150 [ 155.828217][ T8942] x64_sys_call+0x1015/0x2550 [ 155.833594][ T8942] do_syscall_64+0x112/0x360 [ 155.839827][ T8942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.847560][ T8942] [ 155.850461][ T8942] value changed: 0x05000021 -> 0x02000021 [ 155.858050][ T8942] [ 155.860459][ T8942] Reported by Kernel Concurrency Sanitizer on: [ 155.867664][ T8942] CPU: 1 UID: 0 PID: 8942 Comm: syz.3.1646 Not tainted syzkaller #0 PREEMPT(lazy) [ 155.878930][ T8942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 155.892577][ T8942] ================================================================== [ 155.951775][ T8962] loop1: detected capacity change from 0 to 512 [ 155.997995][ T8962] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 156.013969][ T8962] EXT4-fs error (device loop1): ext4_iget_extra_inode:5210: inode #17: comm syz.1.1655: corrupted in-inode xattr: e_name out of bounds [ 156.033863][ T8962] loop1: lost file I/O error report for ino 17 type 5 pos 0x0 len 0x0 error -117 [ 156.034108][ T8962] EXT4-fs error (device loop1): ext4_orphan_get:1408: comm syz.1.1655: couldn't read orphan inode 17 (err -117) [ 156.049357][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 156.049385][ C1] EXT4-fs (loop1): initial error at time 1787643563: ext4_iget_extra_inode:5210: inode 17 [ 156.049411][ C1] EXT4-fs (loop1): last error at time 1787643563: ext4_iget_extra_inode:5210: inode 17