last executing test programs: 36.204582127s ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000001c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000440)='\x00', 0x89901) mount$bind(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x3c5093, 0x0) 36.170132178s ago: executing program 4 (id=7): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./bus\x00', 0x0, &(0x7f0000000240), 0x21, 0x4a6, &(0x7f0000000a40)="$eJzs3cFPG9kZAPBvBgiEkEDaHNqqbdI0bVpFscFJUJRTemlVRZGqRj31kFBwEMLGCJs00BzI/1CpkXpq/4QeKvVQKae97233tpfsYaXsbrSrsNIevJqxIYRgYDcES/j3k55m3jzj7z2sec98gF8APetcRKxFxLGIuBcRo+3rSbvEzVbJHvfyxaPp9RePppNoNu98luTt2bXY8jWZE+3nHIqIP/4u4i/Jm3HrK6vzU5VKealdLzaqi8X6yurluerUbHm2vFAqTU5Mjl+/cq10YGM9W/3P89/O3frT///3k2fvr/36b1m3RtptW8dxkFpDH9iMk+mPiFvvIlgX9LXHc6zbHeE7SSPiexFxPr//R6MvfzUBgKOs2RyN5ujWOgBw1KV5DixJC+1cwEikaaHQyuGdieG0Uqs3Lt2vLS/MtHJlYzGQ3p+rlMfbucKxGEiy+kR+/qpe2la/EhGnI+Lvg8fzemG6Vpnp5hsfAOhhJ7at/18OttZ/AOCIG+p2BwCAQ2f9B4DeY/0HgN5j/QeA3mP9B4DeY/0HgN5j/QeAnvKH27ez0lxvf/71zIOV5fnag8sz5fp8obo8XZiuLS0WZmu12fwze6p7PV+lVlucuBrLD4uNcr1RrK+s3q3Wlhcad/PP9b5bHjiUUQEAuzl99umHSUSs3Tiel9iyl4O1Go62tNsdALqmr9sdALrGbl/Qu/yMD+ywRe9rOv6J0JOD7wtwOC7+UP4fepX8P/Qu+X/oXfL/0LuazcSe/wDQY+T4Ab//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG9vJC9JWmjvBT4SaVooRJyMiLEYSO7PVcrjEXEqIj4YHBjM6hPd7jQA8JbST5L2/l8XRy+MbG89lnw1mB8j4q//vPOPh1ONxtJEdv3zzeuNJ+3rpW70HwDYy8Y6vbGOb3j54tH0RjnM/jz/TWtz0Szueru0WvqjPz8OxUBEDH+RtOst2fuVvgOIv/Y4In6w0/iTPDcy1t75dHv8LPbJQ42fvhY/zdtax+x78f0D6Av0mqfZ/HNzp/svjXP5cef7fyifod7exvy3/sb8l27Of30d5r9z+41x9b3fd2x7HPGj/p3iJ5vxkw7xL+wz/kc//un5Tm3Nf0VcjJ3jb41VbFQXi/WV1ctz1anZ8mx5oVSanJgcv37lWqmY56iLG5nqN31649Kp3cY/3CH+0B7j/8U+x//vr+/9+We7xP/Vz3d+/c/sEj9bE3+5z/hTw//tuH13Fn+mw/j3ev0v7TP+s49XZ/b5UADgENRXVuenKpXykhMnTpxsnnR7ZgLetVc3fbd7AgAAAAAAAAAAAAAAdHIY/07U7TECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwdH0TAAD//yyP2UE=") syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f00000011c0)='./file2\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) timer_create(0x7, &(0x7f0000001200)={0x0, 0x30, 0x1, @thr={0x0, 0x0}}, 0x0) clock_gettime(0xfffffffffffffffc, &(0x7f0000000280)) sync_file_range(r0, 0x3, 0x1000, 0x7) 36.016879812s ago: executing program 4 (id=10): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0xc010) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x2800, 0x24) read$FUSE(r1, &(0x7f0000002000)={0x2020}, 0x2020) read$FUSE(r1, &(0x7f000000a580)={0x2020}, 0xee6) 36.016758012s ago: executing program 32 (id=10): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0xc010) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x2800, 0x24) read$FUSE(r1, &(0x7f0000002000)={0x2020}, 0x2020) read$FUSE(r1, &(0x7f000000a580)={0x2020}, 0xee6) 35.450235376s ago: executing program 2 (id=24): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000070000000200000007"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000010018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000b98cad95850000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$inet(r3, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x8000) 35.403843937s ago: executing program 2 (id=27): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x14e24, 0x1000, @empty}, 0x1c) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @rand_addr, 0x7fffffd}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="c21118557768d1f18bc03d9ba22c25b2a41f702bb044d2b3f67dad46", 0x1c}], 0x1}}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000002c0)="7764bafa1d96aa2a2f3eac8c50dd10efca127343620013752723b006ea1d57f05c833ee31e4d63e8a8", 0x29}], 0x1}}], 0x2, 0xc8040) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) splice(r1, 0x0, r0, 0x0, 0x7ffff000, 0x6) 35.006505156s ago: executing program 2 (id=34): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0xfff8, @multicast1}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000340)=0x1) dup3(r1, r0, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000008c0)) 34.962185948s ago: executing program 2 (id=36): syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000000c0), 0x1, 0x2c7, &(0x7f00000003c0)="$eJzs3c9r02AYwPFn/bF2HVt7GAMF8UEveglb/QuKbCAWlLmO6UHIXKqlsR1NrVTE7eZ1f8fw6ElBBc+77CZexUsRBC87iJU1ydZ2lW26LnP9fmDkzfu+T/Imb1aeBJo2FtcfF/OOkTerEoqrhETWZFsktVPyDHnLUKs8LO3W5Oroj08X7ty9dzOTzc7Mqc5m5q+lVXX84runz19d+lAdXXg9/jYmm6n7je/pL5uTm+cav+b9rZdFTF0ql6vmkm3pcsEpGqq3bct0LC2UHKtS1bb2vF1eWamrWVoeS6xULMdRs1QfFquu1bJWK3U1H5qFkhqGoWMJGTThI0fkNubmzExfBoMgjPSqrFQyZrhnY27jJAYFAABOl8bieriYd3bXTyr/f1RwtOBoqdyR3+/P/0NyYP6vRT//Fxno/P/oyP/PpI/RjtWd/D/h/f92Iv8HAAAAAAAAAAAAAAAAAAAAAOB/sN1sJpvNZtJf+n8xEYmLiL8e9DjRH8z/YGv74l5cxH5Zy9Vy7tJtz+SlILZYMhUV+dm6HjxuefZGdmZKWyblvb3qxa/WcmGJ+fG+VO/4aTde2+NXJSqJ9v2nJSkTvePTPeJruWG5crkZ8/ZsiSFJ2XogZbFluXVd78W/mFa9fivbFT/S6gcAAAAAwFlg6K5U9/17q91Q/7UhXe1u5d7zAUke8Hyg6/46IucjwR03AAAAAACDxKk/K5q2bVXOakEiIl6N//sHx7Ll4E9d/LCdIyLi1bwJeMxREelqGlpzZ2V/59D+zocuhP9tlr+JSEfNRODTfRyFr0/cc71b8/nPnRfGAvtQAgAAANAXftI/dOTI3FZfBgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAA67MvD/P5/8+6xtt2FgzlKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4HT4HQAA//+2WBFv") syz_mount_image$fuse(0x0, &(0x7f0000000700)='./bus\x00', 0x20008, 0x0, 0xff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) mount$incfs(&(0x7f0000000740)='.\x00', &(0x7f0000000780)='./bus\x00', &(0x7f00000007c0), 0x1004002, 0x0) chdir(&(0x7f0000000800)='./bus\x00') syz_mount_image$vfat(&(0x7f0000000840), &(0x7f0000000880)='./bus/file0\x00', 0xa12448, 0x0, 0x1, 0x0, &(0x7f00000008c0)) rename(&(0x7f0000000900)='./bus/file0\x00', &(0x7f0000000940)='./file0\x00') 34.85178614s ago: executing program 2 (id=43): mkdir(&(0x7f0000000240)='./file0\x00', 0x1ff) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000001bc0)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18, 0xb, 0x0, {0x1}}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x30, 0x5, 0x0, {0x0, 0x1, 0xfffffffffffffffe}}, 0x30) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000140), 0x4, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) 34.560457617s ago: executing program 2 (id=47): r0 = socket$inet6(0xa, 0x2, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000200)={@dev={0xfe, 0x80, '\x00', 0xb}, r1}, 0x14) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @rand_addr, 0x7fffffd}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000080)=[{&(0x7f0000000100)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100050c100000000000224e0000", 0x58}], 0x1) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x3004017, &(0x7f0000000c40)={[{@nodiscard}, {@journal_ioprio}]}, 0x46, 0x4e5, &(0x7f0000000c80)="$eJzs3UFvG1kdAPD/TOJu2s2usyyH3ZVYVtuitILaSUPbiENbJASnSkC5h5A4URQnjhKnbaIKpeIDICEESJw49YLEB0BC/QgIqRLcEVQgBC0cOABGHtshTezGBSdTkt9Pms5782by/z9LfvZ4XmcCOLU+iohbETEUEZciotFoNJrb0/Yy06zstPZ7/uzBXHNJotG48+ckkva2zt9K2us3W4fESER8/SsR30q6Rd5enq1WK+vtWrm+slbe2Nq+vLQyu1hZrKxOTU1em74+fXV6ov/OpL2bxiLixpee/uC7j7584xefu/fbmT9e/HYzrdF2+95+DFKr64XstegYjoj1owiWk+GshwAA/D94NyI+EREfZ9//izGUfZs7k3daAAAAwAA1bo7GP5LWdb9+fBz97wsAAAC8HtJsDmySltrTZ0cjTUul1hzeT8a5tFrbqH92oba5Ot9qH4tCurBUrUxERLFVT5r1yfYc2079yr76VES8ExHfL57N6qW5WnU+7x8/AAAA4JR4c9/5/9+KrfP/Ry/+h8613BIEAAAABmMs7wQAAACAI+f8HwAAAE4+5/8AAABwon319u3m0ug8/3r+7tbmcu3u5fnKxnJpZXOuNFdbXyst1mqL2T37Vg77e9Vabe3zsbp5v1yvbNTLG1vbMyu1zdX6zNILj8AGAAAAjtE7n378myQidr5wNlua3s87KeBYpK+y8++PLg/g+A3lnQCQm+G8EwByU8g7ASB3ySHtb/dq+OXgcwEAAI7G+PsHr/8X804KOBavdP0fADgRXP+H06tgBiCcem8fMg70vHnHgev/N3vs2Gj8F2kBAAADNJotSVpqXwscjTQtlSLeyh4LUEgWlqqVifb8318XC28065PZkcmhc4YBAAAAAAAAAAAAAAAAAAAAAAAAgJZGI4kGAAAAcKJFpH9Isrv5R4wXL4zu/33gTPL3YraOiHs/vvPD+7P1+vpkc/tfdrfXf9TefiWPXzAAAADglHja/5P4OufpnfN4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABik588ezHWW44z7py9GxFi3+MMxkq1HohAR5/6axPCe45KIGBpA/J2HEfFet/hJM60Ya2fRLf7ZY4+f7B6XDiA2nHaPm+PPrW7vvzQ+ytbd3//D7eV/1Xv8S3fHv6Ee489bfcb44MnPyj3jP4z4YLj7+NOJn2TRDsY/32f8b35je3tP9Y29bY2fRIx3/fxJXohVrq+slTe2ti8vrcwuVhYrq1NTk9emr09fnZ4oLyxVK+1/u8b/3qd+/q+X9f9cj/hju/3v/vpf6LP//3xy/9m7rWKhW/yL57t//r7XI37a/uz7TLvcbB/vlHda5b0+/OmvPnxZ/+d79H/kkP5f7LP/l772nd/1uSsAcAw2traXZ6vVyrqCQg6FM/FapKFwoJD3yAQAAAzaf770550JAAAAAAAAAAAAAAAAAAAAnF69bwM2uFsD7o+5k09XAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABe6t8BAAD//yqw1EM=") 34.534582838s ago: executing program 33 (id=47): r0 = socket$inet6(0xa, 0x2, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000200)={@dev={0xfe, 0x80, '\x00', 0xb}, r1}, 0x14) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @rand_addr, 0x7fffffd}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000080)=[{&(0x7f0000000100)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100050c100000000000224e0000", 0x58}], 0x1) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x3004017, &(0x7f0000000c40)={[{@nodiscard}, {@journal_ioprio}]}, 0x46, 0x4e5, &(0x7f0000000c80)="$eJzs3UFvG1kdAPD/TOJu2s2usyyH3ZVYVtuitILaSUPbiENbJASnSkC5h5A4URQnjhKnbaIKpeIDICEESJw49YLEB0BC/QgIqRLcEVQgBC0cOABGHtshTezGBSdTkt9Pms5782by/z9LfvZ4XmcCOLU+iohbETEUEZciotFoNJrb0/Yy06zstPZ7/uzBXHNJotG48+ckkva2zt9K2us3W4fESER8/SsR30q6Rd5enq1WK+vtWrm+slbe2Nq+vLQyu1hZrKxOTU1em74+fXV6ov/OpL2bxiLixpee/uC7j7584xefu/fbmT9e/HYzrdF2+95+DFKr64XstegYjoj1owiWk+GshwAA/D94NyI+EREfZ9//izGUfZs7k3daAAAAwAA1bo7GP5LWdb9+fBz97wsAAAC8HtJsDmySltrTZ0cjTUul1hzeT8a5tFrbqH92oba5Ot9qH4tCurBUrUxERLFVT5r1yfYc2079yr76VES8ExHfL57N6qW5WnU+7x8/AAAA4JR4c9/5/9+KrfP/Ry/+h8613BIEAAAABmMs7wQAAACAI+f8HwAAAE4+5/8AAABwon319u3m0ug8/3r+7tbmcu3u5fnKxnJpZXOuNFdbXyst1mqL2T37Vg77e9Vabe3zsbp5v1yvbNTLG1vbMyu1zdX6zNILj8AGAAAAjtE7n378myQidr5wNlua3s87KeBYpK+y8++PLg/g+A3lnQCQm+G8EwByU8g7ASB3ySHtb/dq+OXgcwEAAI7G+PsHr/8X804KOBavdP0fADgRXP+H06tgBiCcem8fMg70vHnHgev/N3vs2Gj8F2kBAAADNJotSVpqXwscjTQtlSLeyh4LUEgWlqqVifb8318XC28065PZkcmhc4YBAAAAAAAAAAAAAAAAAAAAAAAAgJZGI4kGAAAAcKJFpH9Isrv5R4wXL4zu/33gTPL3YraOiHs/vvPD+7P1+vpkc/tfdrfXf9TefiWPXzAAAADglHja/5P4OufpnfN4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABik588ezHWW44z7py9GxFi3+MMxkq1HohAR5/6axPCe45KIGBpA/J2HEfFet/hJM60Ya2fRLf7ZY4+f7B6XDiA2nHaPm+PPrW7vvzQ+ytbd3//D7eV/1Xv8S3fHv6Ee489bfcb44MnPyj3jP4z4YLj7+NOJn2TRDsY/32f8b35je3tP9Y29bY2fRIx3/fxJXohVrq+slTe2ti8vrcwuVhYrq1NTk9emr09fnZ4oLyxVK+1/u8b/3qd+/q+X9f9cj/hju/3v/vpf6LP//3xy/9m7rWKhW/yL57t//r7XI37a/uz7TLvcbB/vlHda5b0+/OmvPnxZ/+d79H/kkP5f7LP/l772nd/1uSsAcAw2traXZ6vVyrqCQg6FM/FapKFwoJD3yAQAAAzaf770550JAAAAAAAAAAAAAAAAAAAAnF69bwM2uFsD7o+5k09XAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABe6t8BAAD//yqw1EM=") 9.452124183s ago: executing program 1 (id=776): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="60010000100033062cbd8700000000007f000001000000000000000000000000000000000000050000fffd000000003a00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd320000007f0000010000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000020100000000000002000000800000000000000048000200656362286369706865725f6e756c6c2900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200017000100000000000000000000000000000000000000200000000000000008"], 0x160}, 0x1, 0x0, 0x0, 0x20040}, 0x80) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000380)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x4e20, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xffff, 0xfffffffffffffffd, 0x2}, {0x1, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x2}}, 0xe8) write(r1, 0x0, 0x0) 9.412479514s ago: executing program 1 (id=778): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c}}]}, 0x78}}, 0x0) 9.340131735s ago: executing program 1 (id=783): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x4}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f00000001c0)={0x8000042}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x80042, 0x1}, 0x10) sendmsg$tipc(r0, &(0x7f0000000100)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40850}, 0x4000084) 9.309819147s ago: executing program 1 (id=785): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, 0x0) pivot_root(&(0x7f0000000600)='./file0\x00', &(0x7f0000000300)='./file0/../file0\x00') umount2(&(0x7f0000000000)='./file0/../file0\x00', 0x9) 9.248811648s ago: executing program 1 (id=786): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0a00000004000000080000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000040), &(0x7f00000002c0)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) 9.241906498s ago: executing program 1 (id=788): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000001000390400000000fcffffff00000000", @ANYRES32=r2, @ANYBLOB="01980000000100001800128008000100677265000c00028008000700ac"], 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000180)={'wg2\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x439, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r2, 0x8048bf23f46c217b, 0x22900}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r3}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x804}, 0x4000880) 9.187961059s ago: executing program 34 (id=788): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000001000390400000000fcffffff00000000", @ANYRES32=r2, @ANYBLOB="01980000000100001800128008000100677265000c00028008000700ac"], 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000180)={'wg2\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x439, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r2, 0x8048bf23f46c217b, 0x22900}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r3}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x804}, 0x4000880) 2.244823537s ago: executing program 0 (id=992): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000040), 0x4) 1.462659005s ago: executing program 7 (id=1010): sendmsg$key(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x37, 0x0, 0x9}]}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1.328197279s ago: executing program 7 (id=1013): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) timer_gettime(r1, 0x0) timerfd_settime(0xffffffffffffffff, 0x1, 0x0, 0x0) 1.309910969s ago: executing program 0 (id=992): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000040), 0x4) 1.29556248s ago: executing program 5 (id=1015): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_pwait(r0, &(0x7f00000000c0)=[{}, {}], 0x2, 0xfe, 0x0, 0x0) 1.294566929s ago: executing program 7 (id=1016): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001840), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001880)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f00000018c0)=[@textreal={0x8, &(0x7f0000000200)="670f09f4daca0fc735d8060000f30f09670fe803baa100ed2ef30fc7b68d000f30", 0x21}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000002640)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.28516018s ago: executing program 0 (id=1017): mkdirat(0xffffffffffffff9c, &(0x7f0000000980)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000300)='./bus\x00', &(0x7f0000000340), 0x8, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r0 = open(&(0x7f0000000400)='.\x00', 0x8000, 0x112) openat$incfs(r0, &(0x7f00000004c0)='.pending_reads\x00', 0x40, 0x52) getdents(r0, 0x0, 0x0) 1.253518021s ago: executing program 0 (id=1020): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) syz_clone(0x8200, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = creat(&(0x7f00000035c0)='./bus\x00', 0x119) write$cgroup_int(r0, &(0x7f0000003600), 0xfffffdd8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) 1.231882551s ago: executing program 6 (id=1021): unshare(0x64000600) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000001800dd8d26bd7000fcdbdf2502141000fd00000600220020"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000015c0)={'lo\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001640)={&(0x7f0000001680)=ANY=[@ANYBLOB="340000001a00010028bd70000000000002202003ff0100070002000008000300", @ANYRES32=r3, @ANYBLOB="08000100ac141433080002000a"], 0x34}}, 0xea5bc50b6199d77e) 1.069087815s ago: executing program 6 (id=1022): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000004340)={0x0, 0x0, 0x0}, 0x0) syz_mount_image$exfat(&(0x7f00000043c0), &(0x7f0000004400)='./file0\x00', 0x2000084c, &(0x7f0000004440)=ANY=[@ANYBLOB='iocharset=ascii,discard,dmask=00000000000000000000007,uid=', @ANYRESHEX=r1, @ANYBLOB=',dmask=00000000000000000000152,fmask=00000000000000000000006,gid=', @ANYRESHEX=r2, @ANYBLOB=',\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESHEX, @ANYBLOB="2c646973636172642c00fb278330ab3b4884d36adf6908d11f57832035e96a1513231140da182ca77aeedc492bbc501d94f854a7e26909bde6e698d72a15ec808a86c25d"], 0x81, 0x14f3, &(0x7f0000004540)="$eJzs3AuYjlW7OPB1r7UexjTpbZLDsO51P7xpaJkkySGnHJIkCUlOCUmTJAmJcZY0JCHHSXIYkuQwjUnjfD7knDT5pEmSkJBk/S/V3r5v9327vf/f9//b1577d13rsm7Pc9/vWnPPNe963uua+bbXmHot69duRkTinwK//ZMihIgRQowQQlwnhAiEEBXjK8Zfvl5AQco/9yLsX6t5+tVeAbuauP95G/c/b+P+523c/7yN+5+3cf/zNu5/3sb9Zywv2zGv2PU88u7gz//zMn7//18kt9zULzeVu7H3fyOF+5+3cf/zNu5/3sb9z9u4/3kb9/9/v1r/yTXuf97G/WcsL7vanz/zuLrjan//McYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhjLG877K7QQ4t/m/zDh5z+7gTHGGGOMMcYYY//T+PxXewWMMcYYY4wxxhj7fw+EFEpoEYh8Ir+IEQVErLhGxIlrRUFxnYiI60W8uEEUEjeKwqKIKCqKiQRRXJQQRqCwgkQoSopSIipuEqXFzSJRlBFlxS3CiXIiSdwqyovbRAVxu6go7hCVxJ2isqgiqopq4i5RXdQQNUUtUVvcLeqIuqKeqC/uEQ3EvaKhuE80EveLxuIB0UQ8KJqKh0Qz0Vy0EA+LluIR0Uo8KlqLNqKtaCfa/1/lvyj6iZdEfzFApIiBYpAYLIaIoWKYGC5GiJfFSPGKGCVeFalitBgjXhNjxetinHhDjBcTxETxppgkJospYqqYJqaLNPGWmCHeFjPFO2KWmC3miLkiXcwT88W7YoF4TywU74tF4gOxWCwRS8UykSE+FJliucgSH4kV4mORLVaKVWK1WCPWinVivdggNopNYrPYIraKbWK72CE+ETvFLrFb7BF7xT6xX3wqDojPxEHxucgRX/w388/9h/zeIECABAkaNOSDfBADMRALsRAHcVAQCkIEIhAP8VAICkFhKAxFoSgkQAKUgBKAgEBAUBJKQhSiUBpKQyIkQlkoCw4cJEESlIfboAJUgIpQESpBJagMVaAKVINqUB2qQ02oCbWhNtSBOlAP6sE9cA/cCw2hITSCRtAYGkMTaAJNoSk0g2bQAlpAS2gJraAVtIbW0BbaQntoDx2gA3SEjtAZOkMX6AJdoSskQzJ0g27QHbpDD+gBPaEn9IJe0Bv6QB94EV6El+AlGAB15EAYBINgCAyBYTAchsPLMBJegVfgVUiF0TAGXoPX4HUYB2dhPEyAiTARqsvJMAWmAsnpkAZpMANmwEyYCbNgNsyGuZAO82A+zIcF8B68B+/DIvgAPoAlsASWQQZkQCYshyzIghVwDrJhJayC1bAG1sIaWA8bYD1sgs2wCbbCVtgO2+ET+AR2wS7YA3tgH+yDT+FT+Aw+g1TIgRw4BIfgMByGI3AEciEXjsJROAbH4DgchxNwAk7CKTgNp+AMnIGzcA7Ow3m4ABfgIjyf8HWLfWU2pgp5mZZa5pP5ZIyMkbEyVsbJOFlQFpQRGZHxMl4WkoVkYVlYFpVFZYJMkCVkCYkSJclQlpQlZVRGZWlZWibKRFlWlpVOOpkkk2R5WV5WkBVkRXmHrCTvlJVlFdnJVZPVZHXZ2dWUtWRtWVvWkXVlPVlf1pcNZAPZUDaUjWQj2Vg2lk3kg7KpHAjDoLm83JmWcjS0kmOgtWwj28p28nV4THaQ46Cj7CQ7yyfkBBgPXWUHlyyflt3kFOgun5VT4TnZU06HXvIF2Vv2kX3li7Kf7Oj6ywFyFgyUg+RcGCKHymFyuFwAdeXljtWTr8pUOVqOka/JZfC6HCffkOPlBDlRviknyclyipwqp8npMk2+JWfIt+VM+Y6cJWfLOXKuTJfz5Hz5rlwg35ML5ftykfxALpZL5FK5TGbID2WmXC6z5EdyhfxYZsuVcpVcLdfItXKdXC83yI1yk9wst8itcpvcLnfIT+ROuUvulnvkXrlP7pefygPyM3lQfi5z5BfykPyLPCy/lEfkVzJXfi2Pym/kMfmtPC6/kyfk9/KkPCVPyx/kGfmjPCvPyfPyJ3lB/iwvyl/kJemlUKCkUkqrQOVT+VWMKqBi1TUqTl2rCqrrVERdr+LVDaqQulEVVkVUUVVMJajiqoQyCpVVpEJVUpVSUXWTKq1uVomqjCqrblFOlVNJ6lZVXt2mKqjbVUV1h6qk7lSVVRVVVVVTd6nqqoaqqWqp2upuVUfVVfVUfXWPaqDuVQ3VfaqRul81Vg+oJupB1VQ9pJqp5qqFeli1VI+oVupR1Vq1UW1VO9VePaY6qMdVR9VJdVZPqC7qSdVVPaWS1dOqm3pGdVfPqh7qOdVTPa96qRdUb9VH9VW/qEvKq/5qgEpRA9UgNVgNUUPVMDVcjVAvq5HqFTVKvapS1Wg1Rr2mxqrX1Tj1hhqvJqiJ6k01SU1WU9RUNU1NV2nqLTVDva1mqnfULDVbzVFzVbqap4b9XmnhfyH/7b+TP+rXV9+udqhP1E61S+1We9RetU/tV/vVAXVAHVQHVY7KUYfUIXVYHVZH1BGVq3LVUXVUHVPH1HF1XJ1QJ9RJdUr9pH5QZ9SP6qw6p86pn9QFdUFd/P1rIDRoqZXWOtD5dH4dowvoWH2NjtPX6oL6Oh3R1+t4fYMupG/UhXURXVQX0wm6uC6hjUZtNelQl9SldFTfpEvrm3WiLqPL6lu00+V0kr71n87/s/W11+11B91Bd9QddWfdWXfRXXRX3VUn62TdTXfT3XV33UP30D11T91L99K9dW/dV/fV/XQ/3V/31yk6RQ/Sg/UQPVQP08P1CP2yHqlH6lF6lE7VqXqMHqPH6rF6nB6nx+vxeqKeqCfpSXqKnqKn6Wk6TafpGXqGnqln6ll6lp6j5+h0na7n6/l6gV6gF+qFepFepBfrxXqpXqozdIbO1Jk6S2fpFXqFztYr9Uq9Wq/Wa/VavV6v1xv1Rr1Zb9Zb9VadrXfoHXqn3ql36916r96r9+v9+oA+oA/qgzpH5+hD+pA+rA/rI/qIztW5+qg+qo/pY/q4Pq5P6BP6pD6pT+vT+ow+o8/qs/q8Pq8v6Av6or6oL+lLl499gQxkoAMd5AvyBTFBTBAbxAZxQVxQMCgYRIJIEB/EB4WCG4PCQZGgaFAsSAiKByUCE2BgAwrCoGRQKogGNwWlg5uDxKBMUDa4JXBBuSApuDUoH9wWVAhuDyoGdwSVgjuDykGVoGpQLbgrqB7UCGoGtYLawd1BnaBuUC+oH9wTNAjuDRoG9wWNgvuDxsEDQZPgwaBp8FDQLGgetAgeDloGjwStgkeD1kGboG3QLmj/L63v/dkij7v+ZoBJMQPNIDPYDDFDzTAz3IwwL5uR5hUzyrxqUs1oM8a8Zsaa180484YZbyaYieZNM8lMNlPMVDPNTDdp5i0zw7xtZpp3zCwz28wxc026mVfj90O3WWjeN4vMB2axWWKWmmUmw3xoMs1yk2U+MivMxybbrDSrzGqzxqw168x6s8FsNJvMZrPFbDXbzHazw3xidppdZrfZY/aafWa/+dQcMJ+Zg+Zzk2O+MIfMX8xh86U5Yr4yueZrc9R8Y46Zb81x8505Yb43J80pc9r8YM6YH81Zc86cNz+ZC+Znc9H8Yi4Zf/lwf/ntHTVqzIf5MAZjMBZjMQ7jsCAWxAhGMB7jsRAWwsJYGItiUUzABCyBJfAyQsKSWBKjGMXSWBoTMRHLYll06DAJk7A8lscKWAErYkWshJWwMlbGqlgV78K7sAbWwFpYC+/Gu7Eu1sX6WB8bYANsiA2xETbCxtgYm2ATbIpNsRk2wxbYAltiS2yFrbA1tsa22BbbY3vsgB2wI3bEztgZu2AX7IpdMRmTsRt2w+7YHXtgD+yJPbEX9sLe2Bv7Yl/sh/2wP/bHFEzBQTgIh+AQHIbDcASOwJE4EkfhKEzFVByDY3AsjsVxOA7H4wSciG/iJJyMU3AqTsPpmIZpOANn4EycibNwFs7BOZiO6Tgf5+MCXIALcSEuwkW4GBfjUlyKGZiBmZiJWZiFK3AFZmM2rsJVuAbX4DpchxtwA27CTbgFt+A23IY7cAfuxJ24G3fjXtyL+3E/HsADeBAPYg7m4CE8hIfxMB7BI5iLuXgUj+IxPIbH8TiewBN4Ek/iaTyNZ/AMnsWzeB7P4wX8GS/iL3gJPcZYKWLtNTbOXmsL2utsjC1g/zouaovZBFvclrDGFrZF/iZGa22iLWPL2luss+Vskr31D3FlW8VWtdXsXba6rWFr/iFuYO+1De19tpG939a39/xN3Ng+YJvYR2xT+6htZtvYFradbWkfsa3so7a1bWPb2na2i33SdrVP2WT7tO1mn/lDnGmX2w12o91kN9sD9jN73v5kj9lv7QX7s+1vB9gR9mU70r5iR9lXbaod/Yd4on3TTrKT7RQ71U6z0/8Qz7FzbbqdZ+fbd+0C+94f4gz7oV1ks+xiu8Qutct+jS+vKct+ZFfYj222XWlX2dV2jV1r19n1/77W1Xar3Wa32/32U7vT7rK77R671+77Nb68j4P2c5tjv7BH7Tf2sP3SHrHHba79+tf48v6O2+/sCfu9PWlP2dP2B3vG/mjP2nO/7v/y3n+wv9hL1ltBQJIUaQooH+WnGCpAsXQNxdG1VJCuowhdT/F0AxWiG6kwFaGiVIwSqDiVIENIlohCKkmlKEo3UWm6mRKpDJWlW8hROUqiW6k83UYV6HaqSHdQJbqTKlMVqkrV6C6qTjWoJtWi2nQ31aG6VI/q0z3UgO6lhnQfNaL7qTE9QE3oQWpKD1Ezak4t6GFqSY9QK3qUWlMbakvtqD09Rh3ocepInagzPUFd6EnqSk9RMj1N3egZ6k7PUg96jnrS89SLXqDe1If60ovUj16i/jSAUmggDaLBNISG0jAaTiPoZRpJr9AoepVSaTSNoddoLL1O4+gNGk8TaCK9SZNoMk2hqTSNplMavUUz6G2aSe/QLJpNc2gupdM8mk/v0gJ6jxbS+7SIPqDFtISW0jLKoA8pk5ZTFn1EK+hjyqaVtIpW0xpaS+toPW2gjbSJNtMW2krbaDvtoE9oJ+2i3bSH9tI+2k+f0gH6jA7S55RDX9Ah+gsdpi/pCH1FufQ1HaVv6Bh9S8fpOzpB39NJOkWn6Qc6Qz/SWTpH5+knukA/00X6hS6RJxFCKEMV6jAI84X5w5iwQBgbXhPGhdeGBcPrwkh4fRgf3hAWCm8MC4dFwqJhsTAhLB6WCE2IoQ0pDMOSYakwGt4Ulg5vDhPDMmHZ8JbQheXCpPDWsHx4W1ghvD2sGN4RVgrvDCuHVcJH7q8W3hVWD2uENcNaYe3w7rBOWDesF9YP7wkbhPeGDcP7wkbh/WGF8IGwSfhg2DR8KGwWNg9bhA+HLcNHwlbho2HrsE3YNmwXtg8fCzuEj4cdw05h5/CJsEv4ZNg1fCpMDp8Ou4XP/On1lHBgOCgcHA4Ovb9PLY0ui2ZEP4xmRpdHs6IfRVdEP45mR1dGV0VXR9dE10bXRddHN0Q3RjdFN0e3RLdGt0W3R72vn184cNIpp13g8rn8LsYVcLHuGhfnrnUF3XUu4q538e4GV8jd6Aq7Iq6oK+YSXHFXwhmHzjpyoSvpSrmou8mVdje7RDe4+W8HiHIuybVz7V1718E97jq6Tq6ze8I94Z50T7qn3FPuadfNPeO6u2ddD/ec6+med8+7F1xv18f1dS+6fu4l198NcCkuxQ1yg9wQN8QNc8PcCDfCjXQj3Sg3yqW6VDfGjXFj3Vg3zo1z4914N9FNdJPcJDfFTXHT3DSX5tLcDDfDzXQz3Sw3y81xc1y6S3fz3Xy3wC1wC91CtyhxkVvsFrulbqnLcBku02W6LJflVrgVLttlu1VulVvj1rh1bp3b4Da4TW6T2+K2uG1um9vhdridbqfb7Xa7vW6v2+/2uwPugDvoDrocl+MOuUPusDvsjrivXK772h1137hj7lt33H3nTrjv3Ul3yp12P7gz7kd31p1z591P7oL72V10v7hLzru0yFuRGZG3IzMj70RmRWZH5kTmRtIj8yLzI+9GFkTeiyyMvB9ZFPkgsjiyJLI0siySEfkwkhlZHsmKfBRZEfk4kh1ZGVkVWR1ZE1kb8b74ztCX9KV81N/kS/ubfaIv48v6W7zz5XySv9WX97f5Cv52X9Hf4Sv5O31lX8VX9Y/61r6Nb+vb+fb+Md/BP+47+k6+s3/Cd/FP+q7+KZ/sn/bd/DO+u3/W9/DP+Z7+ed/Lv+B7+z6+r3/R9/Mv+f5+gE/xA/0gP9gP8UP9MD/cj/Av+5H+FT/Kv+pT/Wg/xr/mx/rX/Tj/hh/vJ/iJ/k0/yU/2U/xUP81P92n+LT/Dv+1n+nf8LD/bz/Fzfbqf5+f7d/0C/55f6N/3i/wHfrFf4pf6ZT7Df+gz/XKf5T/yK/zHPtuv9Kv8ar/Gr/Xr/Hq/wW/0m/xmv8Vv9dv8dr/Df+J3+l1+t9/j9/p9fr//1B/wn/mD/nOf47/wh/xf/GH/pT/iv/K5/mt/1H/jj/lv/XH/nT/hv/cn/Sl/2v/gz/gf/Vl/zp/3P/kL/md/0f/iL/GvpDHGGGOM/ZeoP7k+8O/8n/x9XDZICHHtrmK5/7HmlsK/zYfKhC4RIcTTA3o1/7dRp05KSsrv92YrEZRaIoSIXMnPJ67EK0Vn8aRIFp1E+b+7vqGyzwX6k/rRO4SI/aucGHElvlL/tn9Q/7EnJmZWCs/H/yf1lwiRWOpKTgFxJb5Sv8I/qF+kw5+sv8CXaUJ0/KucOHElvlI/STwunhHJf3MnY4wxxhhjjDH2m6Gyao8/e36+/HyeoK/k5BdX4j97PmeMMcYYY4wxxtjV91yfvk89lpzcqQdPeMITnvz75Gr/ZGKMMcYYY4z9q1059F/tlTDGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY3nX/48/J3a198gYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4xdbf8nAAD//yx2QLk=") gettid() getsockopt$sock_buf(r0, 0x1, 0x37, 0x0, &(0x7f0000000000)) 1.028587306s ago: executing program 6 (id=1023): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000580)=[@text32={0x20, &(0x7f00000005c0)="0f8666f2a665f0ff0f0fc73666ba21003e0f01c5c4c1ed665a0aa00f06ea009000002c00c4c1b81516", 0x29}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.003686987s ago: executing program 6 (id=1025): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'veth0_to_hsr\x00', 0x0}) sendto$packet(r1, &(0x7f00000000c0)='\t', 0x1, 0x100400c1, &(0x7f0000000140)={0x11, 0x8100, r2, 0x1, 0x87, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}}, 0x14) recvmmsg(r0, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) 964.247857ms ago: executing program 6 (id=1027): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@gettclass={0x24, 0x2a, 0x2, 0x70bd27, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0x7, 0xffff}, {0x8, 0xffe0}, {0xfff7, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2004c010}, 0x84e4e2600b8bc9a4) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x3, 0xc, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x584}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 808.828121ms ago: executing program 3 (id=1031): sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$uac3(0x2, 0x97, &(0x7f00000002c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0x1235, 0x4661, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x85, 0x3, 0x1, 0x9, 0x10, 0x1, {0x8, 0xb, 0x2, 0x2, 0x1, 0x24, 0x30, 0xaf}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xd, 0xa, 0x74}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0xa, 0x381f, 0x1, 0x4, 0x2d, 0xe, 0x7355, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x3, 0x55, 0x8, {0xa, 0x25, 0x25, 0xffff7fff, 0x56, 0x200}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x7, 0x3, 0x0, {0xa, 0x25, 0x25, 0xfffffffe, 0x23, 0xa34}}}}}}}}]}}, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[], 0x0}, 0x0) ioctl$EVIOCRMFF(r0, 0x4004550f, 0x0) 320.443053ms ago: executing program 6 (id=1032): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='./file0\x00', 0x280440e, &(0x7f0000000180)={[{@usrjquota}, {@test_dummy_encryption_v1}, {@inlinecrypt}, {@delalloc}, {@noinit_itable}, {@norecovery}, {@minixdf}, {@nodioread_nolock}, {@errors_remount}, {@jqfmt_vfsv0}, {@usrquota}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x8}}]}, 0x1, 0xbdb, &(0x7f0000001000)="$eJzs3M1rHOcZAPBnRqsP23JXLqXUvVilFBtK17KLTG0KtYtLLz0U2mvBQl4ZofUHkoorWdBV8g+EJP9ALjkkJsGH+OxLArnmkjjXmBwCJihWAiEkCrMfkiztSpa1q1Hk3w9ezfsxM+/zaKSdeWF3A3hhDWc/0ojjEXEliSg2+tOI6KvVBiKq9f2WlxbGv1laGE9iZeVfXyaRRMSTpYXx5rmSxvZIozEQER/9NYmfv7x53pm5+amxSqU83Wifnr1+6/TM3PwfJq+PXStfK984c+5Po2dHz42cH+1Yrt9+dvH+17/5++fV7976/u5Xr72ZxMUYbIytz6OR9a4Nx/Dq72S9QkSMdeD8+0FPI5/1eSaFbQ5KuxwUAABtpeue4X4ZxeiJtYe3Yrz/ca7BAQAAAB2x0hOxAgAAABxwifU/AAAAHHDN9wE8WVoYb5Z835Gwtx5fioihev7LjVIfKUS1th2I3og4/CSJ9R9rTeqH7dpwRDz69Py7WYkWn0PutupiRPyq1fVPavkPNT4JvTH/NCJGOjD/8Ib2Tyn/ix2YP+/8AXgxPbhUv5Ftvv+lq88/0eL+V2hx73oeed//ms9/y5ue/9by72nz/PfPZ5zjTiFutxvL8v/z/b+90yzZ/Nl2V0ntwOPFiF8XWuWfrOaftMn/yjbnTqJ+iuIPt8vt9sk7/5U3Ik5G6/ybkq2/n+j0xGSlPFL/2XKOxQ9H3243f975Z9f/cJv8t7j+A1nfrafO1P5Lff5z+fK9TZ2N3bfPP/2iL/l3rdbX6Pnf2Ozs9JmIvuQfm/vPbp1vc5/mObL8T/126///Vn//2WtCtfG3kaWy2Nhm7Zc2zPmXu3feaxdPc/2X5/W/uvPrX+t75Rnn+N0Hr57a2Nf8fq3169+sZPM/SuprYQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoSiNiMJK0FBFJrZ6mpVLEkYj4RRxOKzdnZn8/cfO/N65mYxFD0ZtOTFbKIxFRrLeTrH2mVl9rn93Q/mNEHIuI14uHau3S+M3K1byTBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYNWRiBiMJC1FRBoRy8U0LZXyjgoAAADouKG8AwAAAAC6zvofAAAADj7rfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrs2IkHD5OIqF44VCuZvsZYb66RAd2W5h0AkJuevAMAclPIOwAgNztc43tcgAMo2WZ8oGVv9urR35V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANifTh5/8DCJiOqFQ7WS6WuM9bY84sQeRgd0U5p3AEBuerYaLOxdHMDee+5/8aOdjQPYe63X+MCLJNlmfGBtn+rTI/1diwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/WewVpK0FBFprZ6mpVLE0YgYit5kYrJSHomIn0XEJ8Xe/qzdn3fQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdNzM3PzUWKVSnn6eSrK7w1VU2lX+vz/C2NtKUqsM5B1GvZL3KxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHmYmZufGqtUytMzeUcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5G1mbn5qrFIpTz9D5d5Odl5XyTtHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADy82MAAAD//1sCDDY=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) fdatasync(r0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 306.058623ms ago: executing program 7 (id=1033): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xe, &(0x7f00000002c0)=0x80000000, 0x4) 276.560604ms ago: executing program 7 (id=1034): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x86}}]}, 0x0, 0x3, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000008"], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 230.449155ms ago: executing program 0 (id=1035): unshare(0x60000600) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="03031b003000320006006300000000442fff00000000000000000000ffffac141419ff020000000000000000000000000001042022eb"], 0x76) 153.141027ms ago: executing program 5 (id=1036): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) recvmsg$unix(r1, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001e80)={0xffffffffffffffff}) close_range(r0, 0xffffffffffffffff, 0x2) dup3(r1, r3, 0x80000) 152.939647ms ago: executing program 5 (id=1037): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000) 145.261137ms ago: executing program 5 (id=1038): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'bridge_slave_1\x00', 0x0}) sendto$packet(r2, &(0x7f00000002c0)="05030500d3fc030000004788800509101128", 0x18, 0x4, &(0x7f0000000140)={0x11, 0x88a8, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) 132.646038ms ago: executing program 3 (id=1039): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x67b}]}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000240)={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) sendmmsg$inet(r1, &(0x7f0000002a00)=[{{&(0x7f0000000380)={0x2, 0x6e20, @multicast1}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000f80)="1bc7a7fab25c4d096d13ab609699ccfad50f833b12f72e7d9a802d8457394031e7227a4d2e5133ed69e3195918c45d8b0ef7819b03d71ace368b2fd8c3db9191abc22ee97998989d915efcc43b63e353a9d8e8dfe21a31a73a4d908795b98c62b655664130a6af358e15446e3b497e599e062848ec62e3b3ead00bd921780434f1561243737f27a2bf98d708c1bf4fd2c2e3f83c597a12ba4be2bb9439d7a518eac95b7b8776383bfefeed41d09154ce0983f0450acd463a6e3f8285a144a20dec45b607a1720ceb95883a14ea680f7f00d86053bec5d49bc08e692bd70c22929662532126387ee04f16807e453b2f00806a935e6ffa988d859a1ec87e621e51e12aac1a4fab0f7c2044f81fbd5e40f87f5518e707217f0e74b0c2378f385be89cb50a9b153b13ef46da14a89ba5de849aa0f55cf97a8202d9be92ea302fbebfbdf9fa1ae3c40a4229801264b7799ef332e2a0eaf7dc88797dfd6c", 0x15b}, {&(0x7f0000000180)="6242870f0e6b4396205a2c501f10b0601e64a04104bf0ef28ebfda215394bae4413f4292888a899117ec83cfbb17c52caa27a3b4f2621e6941138caa786f3f6d7ebf1863150a9b64556d76d8250364fa8445b75536a74b3dec286c7b5dba4cb16a12e4a1a7c9", 0x66}, {&(0x7f0000000580)="7d1455a2eefbb9a13c80e6527d489144bf9bdcfdf9108b8fbd754043e281e3c4af285fd285f0ccc9655dfb2c2330aba5e7f71f81f05b23afb867db3b29e2d37b802dfc57772a67d57e70daa13148536e5cfe1eec171afbbf0a99f64a3b0658fe289beff381c455f37c2b1c71e0e98f34a344141f9996f71a6c32cd9e930f86b9aa8d31e566b300"/146, 0x92}, {&(0x7f0000000c80)="3e6069e04318de6ead0334bb1e66cb4e88bc998b266287091cf880dc0fb0e8b3bbdf8d45987e6302f1ac521b8e43d5135865c441efb1377fa4b4c9946f8ba2f5999ff4070213fdf5716b9c7992cc570d15691cbe123cb43ed522a35874f4503d56d44c71c7ab62adc0801af924a0df53cd52aaf4eca9516d8c5cccf8a4b62b04a539314e33cc2b14107eaaa7460a6c35395f2a6253b517b685f448709ea52c3fe7c64200417272b56fe5307c4b1f0fedde01c106750b5c9c3b917ffa26b537bc6c42c9512e50ff7437643d08d62bf21e8473b8dbd812b8bacdaa11a11f62bc43b1bee91e35ca0278699d919bf538a575fb2ee011a1a5b8f0b180df3152b26f8f82d13689f0b203ced9ef4216b647c86e0e9f22994aaee828202747578c9c26291ea298c8506e39320443182d0b8ba7e237766bba240246bbf4d3c8fad7c22b17a01b91f44e23292181488868d94bf559563b286d", 0x154}, {&(0x7f0000001100)="ac6aed94fbb8c7fecccf1fbe0f823f4711e4d4e5831b1172b79994156deeb8f47a21f6bd119ffeb486267bd8dbaa3b868deca95efc3fea013ea88ddd3222ff7cc0a3448434dca51f5bc1972720dc071c5c5e2358a62bb3d9ccb581431764476f92bc0dd581a715f7ff8cef23b35dceb96809ab4bfbc85cd9eed4820e2a821913e94ed62ce3b44103e31a82b7c14ea5dae6b42906b14cc21e24fcb7b255b5fd8b3d9eda621defc3f398cc545fb03d6549353921bb4a52b3230008f967ddc1ad8635d58667b82a58ec030a57d199f14b1714330e476a95d3aa897b4161302835", 0xdf}], 0x5}}, {{0x0, 0x0, &(0x7f0000002640)=[{&(0x7f0000000500)="a9c15c0d8f3c7fddf7bb74d5ce88196b07a41cec8a5bb223eb1739052a69fbd66fcf8b7ea8d61cbb5b3494163520d9aca6119c080992b34c8e4cf4005d6c104d0a643cb1a7b3dfde988196459c082c696460ae024b91defd82ad6d90e75aaf91e139212139e620afe0fc96e948b44a", 0x6f}, {&(0x7f0000000680)="4ce18e40d84c2fa9a40c01604c5ae7cbb474a3a63fb030eaf4ae5752d34a5d5a13a1b677", 0x24}, {&(0x7f0000001640)="a70c7b8c1ed97d26028ff99736c6e819572600ca3f80529af9b65189ba693289bb83459f9a872cdb4440b0250c91e58d8bdd03030cda42c96252661a8dddc39fa50858f0c12f443a6ad240e652872203244515ddea8eb7cf43ca7371d52575f93be142853af9ba9b0ed5e4acc754ed2bf0fd32799408600d92aa43c0debea4a9f680d0f57c17e2204e33baa544d8c7049cd4a6c12a01bfc2bbc7abb30ed2f8577c0d476f573a03c3c58833e52e95867645ed0a6508d49bf1d59579f2f54eb0f79b55cf44e3d58d504545a2c503853c919c99fd49731083d12aabaa6e28a42df16240efc508b2521ea87c0b09c2b4dbf87276e70bf1dece82fc52302888830439c96d5cd85ad1805fc2c1f874240b444704aca5f23b8dc3f606a181658c707c5c26352ce782272f9e752e513546bf1a7607c6025643f5dcde60e469e3905ffbaf55f3e2895068977dc25cc99b6a43c33593e0516714ef88f1954ee11e064e28e326af91bcdeb5082c2d6a31fe6ac89f618523c1b3023fe499d4416cd1528d099d19c96ca4e60898eb8434d371aa8ca7e84f054e5d85e7dfb61914d07051f57e260e3a85c2ccb16efd3c04dcafd737a982c9c77edfa0135fbd336f4a90f3bdd106533ca97f3ad75cb45ddd3a95de7fa9631b876c094a0d3f8926b5142e43ac5c594cf8cd9160a8305d7ed1bd46763137e13df18ce3c5651e636cb2e047ba6a67bbd60bf87e518ee7fbec60b2de2ad415e2374c1bc968412b30f0a4fa1a955df165f7e5a83bdb83420d5729d3ce471ab054a856dfd1f483887cf85dfa05aae9665a2637b1f7049b48af29be3f7d8446d6cc433fe63254cf7a318c5c8f406f99026b420e6d704092158b818ee518e5ee68800a2679d03d304f01e37ff3eb679c525ae4cbc25b3b2f1b29da84667963381b957b1dcd797f29d2fb3eeb4f614f6d2b4df0a8f6108dc9214a8959fa23f873f8a26c231770518481b2c8b075b2d44c31e5640b4db9d95bae6e92171b11e4e0e8c10486b63d879be4ef5ea09d19538229a0e3ec7ce9202c2e8ebde15b59060bb0f82df2b9f792206bec252985cb196e89b3ee8460e41ec829e4eca0970fdc41e0ada9e1700153ec7fbc906552a72ddbccb0380691fe9ff59271759369fe9fd2ef8efef42e1b", 0x334}], 0x3}}], 0x3, 0x2000c044) writev(r1, &(0x7f0000000840)=[{&(0x7f00000003c0)="3c55bdbe09ef4cc8feed4cee04e4427a3cc07b85bbde763a3fc4c507d5a5bbdaae79b87071c5284ab18d9de2f460edaa54e285e2d3d928d4f2e0d968b215b7ca023ef7b9bec9f21f43284ec2cd10f86da7efb9cae07bd9e7ce73e205ba787ca8399310a37792c37e81b2d28ce4c6e731e4ea63c2b8b56808b382732b08aad0b7a849a40163e464003276b6b7ad79373161d2160a7f43b10ba268cba048f0effcf0a540a40c30354d5fad88276d3de36266fcda755e419f0243d792a6d575a3373993a540fc0669ec8e0ff50985d551f0917fa48b91c522a64de9440fe00171861596d8718400"/239, 0xef}, {&(0x7f0000000880)="28a270979ee81eec231609fc7f7e5711d528742cc4b4cac8e82c6ea9bf3ba682e5216a75f139844435f1de9894afaa6fff52a9f411d145c67c7ddd85cfc8f3e1443ba4bcec229ad587d2a6c3b18db8ddde4f65a9d21651aa68b6dcd5a59ed55d3f559c2a0e1b4e5867037e431bd219f083d315363b17558cfccbae322e4185111f5c0dfd2203af0c5f46132cd81041cee09f8d1f39166821fd08a68fccab9d0dfcbcdd83d05b6e7f417700ffc1d0c78ca94f19114206799084de7bfe9b94183829", 0xc1}, {&(0x7f0000000980)="25442da81e03a6e68722fac7ab904f360ab736f11a27a7aabb5b8d1f721f76f1763259d8bf78f64fca8212ce76d6ed701c3c6b641892168c0185dc110c3b72eb14631b4f25869b861a4317bbb0dcc6b7180e314f0da94b602d6c0b2a4967727aca73427d428c71ff3fa9ad4de5364db3beab6acc1f2aaf3079e004e94701a02ecb3d143a8d4570de5f77b52fa454f80917c9f81f276ed6888ec2efb5536c69034b9e1e1e6805b514a469f778c8e1c0aef9f558a415260d6d90e3d1073c71d8f979b553150782878da869804ad72632b3b8fdb128c5cf1d65b95ce5c4f5e21eef9867ffb16b466ddc6758833786c862c3efd028522754ae65b6f50b8339ddd215ec97f136b61b36306b5506e5d4c4ddc7992eb81666064bd6af744f4aebdd9932637919fe398d95f3bea11d3a53d159e666e9cbbe7bd092", 0x137}, {&(0x7f00000007c0)="22c1cf6cc393ee0de46a4ba7dfdc7fb8a19e7de7646ff33a9b5eac77fa36c9f1e114f0da6b1c2a09b0ad694a4fbef7d782638b1a2e2cd453a7f7113403ca8e186b0c5d896445b73ebe39a91c22d1786263a43220d6", 0x55}], 0x4) 75.838649ms ago: executing program 3 (id=1040): r0 = fsopen(&(0x7f0000000200)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101400, 0x108) getdents64(r2, &(0x7f0000000f80)=""/4096, 0x1000) 65.736949ms ago: executing program 7 (id=1041): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) fcntl$lock(r1, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x73f0, 0x9}) fcntl$lock(r1, 0x7, &(0x7f0000000140)={0x1, 0x1, 0x73f8, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 49.97968ms ago: executing program 5 (id=1042): r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file1\x00') sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)={0x14, 0x56, 0x1, 0x70bd25, 0x0, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x200440c4}, 0x0) r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) write$binfmt_script(r1, &(0x7f0000000080)={'#! ', './file1', [{}]}, 0x2) write$binfmt_misc(r1, &(0x7f0000000040)='\t', 0x27) close(r1) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) 48.84579ms ago: executing program 3 (id=1043): r0 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r1, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r3}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 38.53159ms ago: executing program 3 (id=1044): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x9, 0x4, 0x4, 0x100, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0}, 0x50) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x9, &(0x7f0000000280)=@framed={{}, [@generic={0x7a, 0xa, 0x0, 0xfffffff8}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000)=r3, 0x4) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 33.88852ms ago: executing program 5 (id=1045): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x9, 0xa) write$cgroup_pid(r2, &(0x7f0000000000), 0xffffff98) 15.171051ms ago: executing program 3 (id=1046): r0 = syz_usb_connect$hid(0x2, 0x7c, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x56a, 0x16, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x20, "", [{{0x9, 0x4, 0x0, 0xd, 0x2, 0x3, 0x0, 0x5, 0x0, {0x9, 0x21, 0x1001, 0x6, 0x1, {0x22, 0x6}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x7d, 0x5, 0xa}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000880)={0x24, 0x0, 0x0, &(0x7f0000000800)={0x0, 0x22, 0x6, {[@local=@item_4={0x3, 0x2, 0x8, "07579985"}, @global=@item_012={0x0, 0x1, 0x5}]}}, 0x0}, 0x0) syz_mount_image$ext4(&(0x7f00000005c0)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000000)={[{@test_dummy_encryption_v1}, {@acl}, {@oldalloc}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x8}}]}, 0x1, 0x5b9, &(0x7f0000000680)="$eJzs3W2IHHcdB/Df7N6mebiaNLZqa2xOQ20gdPdyuYREfGGJD7UmtaL4IhTCkdvuhezdnrkN9LaCLb4pCiL4RgShYl9YEQ3kTaXU9kWLbxSU+kClxoAKIhStFERQV2YfrmszaYr3MHjz+cDc/ec/c/v/7y3fndmd/8wEUFgT6Y8kYjwiLkXEzv7sf68w0f/VOXRxLp2S6HY//Zekt97soYtzw1WHf7cj/TEWsTUidh9PYl/l6naXljvnZprN+vnBfK09v1hbWu7cdXZ+plFv1BcOH50+NnVk+uj02j3XyZ9uv+WPd9x35Ynn//7Pb/76yPfT/o4Plo0+j7UyEROD/0klbhqpH0si7l3rxnJS7r/UccdIXTKWY4d4y7rd3d9LX7+3R8S+Xv53Rjn6L95LTz/wt53xy3vy7iOwfrpD2Ytf7QKbVqm3D5yUqhHRL5dK1Wp/H/7m2F5qtpbaBx5sXViY7e8r74pK6cGzzfrk4LPCrqgk6fzBXvn1+ak3zB+K6O0DP1be1puvnmk1Zzf6zQ7oGY+4fOlzZ7bseEP+/1Tu5x/YvNL8/+KFp55Ny6+V8+4NsJHS/H/3tflPhPxD4cg/FJf8Q3HJPxSX/ENxyT8Ul/xDcck/FJf8Q3HJPxTXMP/3nzwZ95882e0Mzn9faDXOnptbPDY1WZ2/cKZ6pnV+sdpotRq9M3bmr/+4zVZr8eBUXHio1q4vtWtLy53T860LC+3TvfP6T9czLgUA5ODUla333rT3uZeSiHjkA9t6U2rLYLmswubW7SaR9znIQD589Ificqk2KC6f8YHkOsu3XmtBc+37AmyMUt4dAHJz562O/0FR+f4fisv3/1Bc9vEB3/9D8fj+H4pr/Br3/7px5N5dkxHxtoj4Sblyw/BeX8D/r/GIy5e//dnayn24FRQUFFYKeb9DAevt9dDn3RMgL7OHLs4Np41q85nGRrUEZHnl7v4goDT3ncHUXzK2cmygsk7jhF5+LGIifvjbx/fPldMpBu9D69AUkOGRRyPiXVnb/6R3bGDXYL3d/dXi5oi4JSLeERHvXGXbX/9Umv8X6qN18g8b563m/9aIuD0ibouId0fEnoh4zyrb/vmlNP+/2jZaJ/9QDJ9/Pu8eAHn5+FN59wDIyyljDKCwvvNw3j0A8vL0D/LuAZCXr7yYdw+g2J67OyIms47/lXrH+4cqg+sC3jC4FsC2iNgeETsG5xDeODhHcOfIMcPrOf3JiIm4/UejdY7/wcYZjv/rXDX+r7Qy/q8cEXtX0cYzHxz/clb9zJ40/088PBz/l05p+8OxgMD6euXRiNsy85+sjPlNIs1pxHv/xzYmvnDlyaz6F+9LH7fyM/mHfHS/FfH+yM7/UFqqtecXa0vLnbt69/Fu1BcOH50+NnVk+uh0rXeJkNrwQiEZTvz11QNZ9S9Ppfn/xmH5h3yk2//t18j/6P7/+1bRxvGvfelUVv3479P873n2zfNf+vOW5DO9+eF9CR6aabfPH4zYkpy4un5qFR2FTW6YkWGG0vzv35f9+X/34G/S7f/xiPhwur8QEf+KiH9HxEci4qMR8bGIuOdN2vzqnY0rWfW/ezLN/+PnbP8hH2n+Z6+z/U9//2MVbRzY/+MvZtV/aG+a/+pv/nDigbF0kn8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAtbe03Dk302zWz69jIe/nCAAAAAAAAEXxnwAAAP//xOQ08g==") syz_mount_image$vfat(&(0x7f0000006d80), &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x800053, 0x0, 0x1, 0x0, &(0x7f0000001180)) symlink(&(0x7f00000005c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', &(0x7f00000002c0)='.\x02\x00') rename(&(0x7f0000000080)='.\x02\x00', &(0x7f0000000100)='.\x02/file0\x00') 0s ago: executing program 0 (id=1047): munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) fcntl$setstatus(r0, 0x4, 0x2000) read$FUSE(r0, &(0x7f0000002d40)={0x2020}, 0x2020) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.249' (ED25519) to the list of known hosts. [ 18.747237][ T24] audit: type=1400 audit(1791979040.050:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.748203][ T271] cgroup: Unknown subsys name 'net' [ 18.770006][ T24] audit: type=1400 audit(1791979040.050:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.797387][ T24] audit: type=1400 audit(1791979040.090:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.797596][ T271] cgroup: Unknown subsys name 'devices' [ 18.912854][ T271] cgroup: Unknown subsys name 'hugetlb' [ 18.918541][ T271] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 19.025464][ T24] audit: type=1400 audit(1791979040.330:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.037884][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.048796][ T24] audit: type=1400 audit(1791979040.330:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.082159][ T24] audit: type=1400 audit(1791979040.330:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.082183][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.105307][ T24] audit: type=1400 audit(1791979040.370:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.139322][ T24] audit: type=1400 audit(1791979040.370:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.165615][ T24] audit: type=1400 audit(1791979040.380:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.191268][ T24] audit: type=1400 audit(1791979040.380:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.635734][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.642847][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.650252][ T279] device bridge_slave_0 entered promiscuous mode [ 19.658027][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.665097][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.672558][ T279] device bridge_slave_1 entered promiscuous mode [ 19.750288][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.757479][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.764975][ T280] device bridge_slave_0 entered promiscuous mode [ 19.771900][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.778927][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.786332][ T280] device bridge_slave_1 entered promiscuous mode [ 19.805999][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.813078][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.820551][ T283] device bridge_slave_0 entered promiscuous mode [ 19.829652][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.836724][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.844227][ T283] device bridge_slave_1 entered promiscuous mode [ 19.924656][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.931739][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.939015][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.946055][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.972223][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.979279][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.986916][ T281] device bridge_slave_0 entered promiscuous mode [ 19.994015][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.001052][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.008476][ T281] device bridge_slave_1 entered promiscuous mode [ 20.041888][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.048941][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.056214][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.063249][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.074589][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.081755][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.089156][ T282] device bridge_slave_0 entered promiscuous mode [ 20.105585][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.112671][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.120063][ T282] device bridge_slave_1 entered promiscuous mode [ 20.159537][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.166619][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.173898][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.180922][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.194856][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.202128][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.209382][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.216918][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.224115][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.231975][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.239646][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.247138][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.261880][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.269517][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.277744][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.284804][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.292478][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.300668][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.307800][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.315156][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.323451][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.330546][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.337938][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.346122][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.353272][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.407206][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.415810][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.423829][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.432112][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.439120][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.446925][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.455093][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.462218][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.469533][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.477678][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.502549][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.521700][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.529391][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.537659][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.545993][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.554212][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.561330][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.568759][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.576940][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.583978][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.597305][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 20.618282][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.627393][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.635953][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 20.644531][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.652604][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 20.660635][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.668707][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.677114][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.685395][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.693684][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.702836][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.710690][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.725361][ T281] device veth0_vlan entered promiscuous mode [ 20.740041][ T280] device veth0_vlan entered promiscuous mode [ 20.747980][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.755612][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.763712][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.772503][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.780724][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.788713][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.796784][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.804738][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.812805][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.820192][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.827715][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.835247][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.849571][ T281] device veth1_macvtap entered promiscuous mode [ 20.856854][ T279] device veth0_vlan entered promiscuous mode [ 20.864936][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.873338][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.881806][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.902234][ T283] device veth0_vlan entered promiscuous mode [ 20.909754][ T280] device veth1_macvtap entered promiscuous mode [ 20.918810][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.926430][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.933968][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.942834][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.951446][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 20.959661][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.968072][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.975125][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.982748][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.990894][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.999274][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 21.007632][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.015818][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.022883][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.030302][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.038397][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.046384][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.054610][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.063074][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.070671][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.078795][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.086258][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.104469][ T281] request_module fs-gadgetfs succeeded, but still no fs? [ 21.109907][ T283] device veth1_macvtap entered promiscuous mode [ 21.119385][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.128639][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.136705][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.144829][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.153077][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.161602][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.169831][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.178203][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.186572][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.201559][ T281] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.215247][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.224301][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.233211][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.242112][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.250735][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.259645][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.270444][ T279] device veth1_macvtap entered promiscuous mode [ 21.283909][ T282] device veth0_vlan entered promiscuous mode [ 21.291709][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.299434][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.308543][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.328980][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.338588][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.346586][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.355598][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.364445][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.373587][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.393431][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.403424][ T282] device veth1_macvtap entered promiscuous mode [ 21.414709][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.423422][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.445912][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.467405][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.488390][ T315] using random self ethernet address [ 21.495720][ T315] using random host ethernet address [ 21.502150][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.520318][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.532488][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.540807][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.550604][ T324] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 21.605051][ T324] APIC base relocation is unsupported by KVM [ 21.710869][ T320] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.740687][ T320] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.760313][ T320] device bridge_slave_0 entered promiscuous mode [ 21.788389][ T320] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.799450][ T320] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.811598][ T320] device bridge_slave_1 entered promiscuous mode [ 21.892361][ T354] ====================================================== [ 21.892361][ T354] WARNING: the mand mount option is being deprecated and [ 21.892361][ T354] will be removed in v5.15! [ 21.892361][ T354] ====================================================== [ 21.964199][ T320] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.971388][ T320] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.978763][ T320] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.985830][ T320] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.993968][ T354] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 22.108742][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.117050][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.147753][ T366] FAULT_INJECTION: forcing a failure. [ 22.147753][ T366] name failslab, interval 1, probability 0, space 0, times 1 [ 22.160646][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.183304][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.197855][ T366] CPU: 0 PID: 366 Comm: syz.3.26 Not tainted syzkaller #0 [ 22.205017][ T366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 22.215093][ T366] Call Trace: [ 22.218412][ T366] __dump_stack+0x21/0x24 [ 22.222773][ T366] dump_stack_lvl+0x1a7/0x208 [ 22.227485][ T366] ? thaw_kernel_threads+0x220/0x220 [ 22.232790][ T366] ? show_regs_print_info+0x18/0x18 [ 22.238012][ T366] ? do_futex+0xfe9/0x1270 [ 22.242449][ T366] ? avc_denied+0x1b0/0x1b0 [ 22.246971][ T366] dump_stack+0x15/0x1c [ 22.251152][ T366] should_fail+0x3ab/0x500 [ 22.255597][ T366] ? __se_sys_fsconfig+0x553/0x7e0 [ 22.258842][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.260833][ T366] __should_failslab+0xa4/0xe0 [ 22.260853][ T366] should_failslab+0x9/0x20 [ 22.268005][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.272744][ T366] __kmalloc_track_caller+0x5f/0x310 [ 22.272754][ T366] ? __kasan_check_write+0x14/0x20 [ 22.272773][ T366] memdup_user_nul+0x26/0xf0 [ 22.299547][ T366] __se_sys_fsconfig+0x553/0x7e0 [ 22.304490][ T366] ? __x64_sys_fsconfig+0xd0/0xd0 [ 22.309521][ T366] ? switch_fpu_return+0x19c/0x330 [ 22.314619][ T366] ? fpu__clear_all+0x20/0x20 [ 22.319280][ T366] __x64_sys_fsconfig+0xbf/0xd0 [ 22.324155][ T366] do_syscall_64+0x31/0x40 [ 22.328579][ T366] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.334480][ T366] RIP: 0033:0x7fa5cb86c559 [ 22.338894][ T366] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 22.358492][ T366] RSP: 002b:00007fa5ca2c5028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 22.367009][ T366] RAX: ffffffffffffffda RBX: 00007fa5cbaf3fa0 RCX: 00007fa5cb86c559 [ 22.375013][ T366] RDX: 00002000000003c0 RSI: 0000000000000002 RDI: 0000000000000003 [ 22.382975][ T366] RBP: 00007fa5cb9038b0 R08: 0000000000000001 R09: 0000000000000000 [ 22.390934][ T366] R10: 0000200000000500 R11: 0000000000000246 R12: 0000000000000000 [ 22.398890][ T366] R13: 00007fa5cbaf4038 R14: 00007fa5cbaf3fa0 R15: 00007ffcb9bcf348 [ 22.442613][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.457453][ T375] capability: warning: `syz.0.31' uses 32-bit capabilities (legacy support in use) [ 22.461388][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.473882][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.520550][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.538638][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.566707][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.597934][ T385] incfs: ino conflict with backing FS 1 [ 22.608306][ T320] device veth0_vlan entered promiscuous mode [ 22.626230][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.637507][ T49] device bridge_slave_1 left promiscuous mode [ 22.643161][ T282] FAT-fs (loop2): error, invalid access to FAT (entry 0xffff0000) [ 22.651841][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.652605][ T399] erofs: (device loop0): mounted with root inode @ nid 36. [ 22.663064][ T282] FAT-fs (loop2): Filesystem has been set read-only [ 22.680234][ T49] device bridge_slave_0 left promiscuous mode [ 22.687341][ T399] erofs: (device loop0): z_erofs_readahead: readahead error at page 5 @ nid 89 [ 22.697405][ T282] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 22.705571][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.713074][ T399] erofs: (device loop0): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 22.722729][ T282] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 22.731752][ T49] device veth1_macvtap left promiscuous mode [ 22.738331][ T399] attempt to access beyond end of device [ 22.738331][ T399] loop0: rw=524288, want=34359738368, limit=16 [ 22.750656][ T49] device veth0_vlan left promiscuous mode [ 22.770647][ T399] attempt to access beyond end of device [ 22.770647][ T399] loop0: rw=524288, want=24, limit=16 [ 22.793789][ T399] attempt to access beyond end of device [ 22.793789][ T399] loop0: rw=0, want=34359738368, limit=16 [ 22.865480][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.873492][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.897903][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.907138][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.917244][ T320] device veth1_macvtap entered promiscuous mode [ 22.940358][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.949634][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.958615][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.968603][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.977346][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.064520][ T426] netlink: 'syz.0.53': attribute type 12 has an invalid length. [ 23.072744][ T426] netlink: 'syz.0.53': attribute type 29 has an invalid length. [ 23.080444][ T426] netlink: 148 bytes leftover after parsing attributes in process `syz.0.53'. [ 23.090078][ T426] netlink: 'syz.0.53': attribute type 1 has an invalid length. [ 23.098064][ T426] netlink: 'syz.0.53': attribute type 2 has an invalid length. [ 23.105733][ T426] netlink: 11 bytes leftover after parsing attributes in process `syz.0.53'. [ 23.115045][ T426] Zero length message leads to an empty skb [ 23.137433][ T418] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.145340][ T418] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.155367][ T418] device bridge_slave_0 entered promiscuous mode [ 23.171823][ T418] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.178883][ T418] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.187323][ T418] device bridge_slave_1 entered promiscuous mode [ 23.246211][ T418] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.253350][ T418] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.260631][ T418] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.267717][ T418] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.292166][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.300201][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.308685][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.324958][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.333626][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.340694][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.348584][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.357090][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.364176][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.379625][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.388557][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.408511][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.422049][ T418] device veth0_vlan entered promiscuous mode [ 23.428432][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.442896][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.452734][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.469823][ T418] device veth1_macvtap entered promiscuous mode [ 23.483060][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.512368][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.527883][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.736150][ T478] Illegal XDP return value 4294967294, expect packet loss! [ 23.756118][ T24] kauditd_printk_skb: 5051 callbacks suppressed [ 23.756131][ T24] audit: type=1326 audit(1791979045.060:5125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=439 comm="syz.5.58" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7febed5192d7 code=0x7ffc0000 [ 23.788054][ T24] audit: type=1326 audit(1791979045.060:5126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=439 comm="syz.5.58" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7febed4c08d9 code=0x7ffc0000 [ 23.813533][ T24] audit: type=1326 audit(1791979045.060:5127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=439 comm="syz.5.58" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7febed5192d7 code=0x7ffc0000 [ 23.840714][ T492] xt_hashlimit: size too large, truncated to 1048576 [ 23.866379][ T495] netlink: 27 bytes leftover after parsing attributes in process `syz.3.82'. [ 23.868506][ T24] audit: type=1326 audit(1791979045.060:5128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=439 comm="syz.5.58" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7febed4c08d9 code=0x7ffc0000 [ 23.923222][ T24] audit: type=1326 audit(1791979045.060:5129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=439 comm="syz.5.58" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7febed5192d7 code=0x7ffc0000 [ 23.971524][ T24] audit: type=1326 audit(1791979045.060:5130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=439 comm="syz.5.58" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7febed4c08d9 code=0x7ffc0000 [ 24.022910][ T24] audit: type=1326 audit(1791979045.060:5131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=439 comm="syz.5.58" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7febed5192d7 code=0x7ffc0000 [ 24.023033][ T49] device bridge_slave_1 left promiscuous mode [ 24.047744][ T24] audit: type=1326 audit(1791979045.060:5132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=439 comm="syz.5.58" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7febed4c08d9 code=0x7ffc0000 [ 24.108495][ T24] audit: type=1326 audit(1791979045.060:5133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=439 comm="syz.5.58" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7febed5192d7 code=0x7ffc0000 [ 24.108516][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.144807][ T24] audit: type=1326 audit(1791979045.060:5134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=439 comm="syz.5.58" exe="/root/ci2-android-5-10/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7febed4c08d9 code=0x7ffc0000 [ 24.183098][ T49] device bridge_slave_0 left promiscuous mode [ 24.193556][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.204656][ T49] device veth1_macvtap left promiscuous mode [ 24.210919][ T49] device veth0_vlan left promiscuous mode [ 24.456753][ T535] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=16574 sclass=netlink_route_socket pid=535 comm=syz.6.98 [ 24.475147][ T535] kernel profiling enabled (shift: 4) [ 25.283357][ T619] netlink: 8 bytes leftover after parsing attributes in process `syz.3.120'. [ 25.388361][ T623] overlayfs: failed to clone upperpath [ 25.490898][ T627] xt_hashlimit: size too large, truncated to 1048576 [ 25.803630][ T646] EXT4-fs (loop5): Unrecognized mount option "subj_role=.+" or missing value [ 25.824665][ T661] xt_hashlimit: size too large, truncated to 1048576 [ 26.178111][ T670] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 26.202993][ T670] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 26.212355][ T670] F2FS-fs (loop1): invalid crc value [ 26.219603][ T670] F2FS-fs (loop1): Found nat_bits in checkpoint [ 26.256704][ T670] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 26.264145][ T670] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 26.604484][ T699] netlink: 4 bytes leftover after parsing attributes in process `syz.5.150'. [ 27.317406][ T735] netlink: 28 bytes leftover after parsing attributes in process `syz.1.164'. [ 27.327691][ T735] ip_tables: iptables: counters copy to user failed while replacing table [ 27.519739][ T743] netlink: 140 bytes leftover after parsing attributes in process `syz.1.167'. [ 27.534280][ T743] netlink: 20 bytes leftover after parsing attributes in process `syz.1.167'. [ 27.739856][ T760] netlink: 'syz.1.174': attribute type 3 has an invalid length. [ 27.747818][ T760] netlink: 'syz.1.174': attribute type 3 has an invalid length. [ 27.781022][ T764] netlink: 56 bytes leftover after parsing attributes in process `syz.1.176'. [ 27.802101][ T764] device ip6gre2 entered promiscuous mode [ 28.449973][ T789] fuse: Bad value for 'fd' [ 28.460539][ T791] EXT4-fs warning (device sda1): verify_group_input:147: Cannot add at group 5 (only 8 groups) [ 28.758803][ T785] F2FS-fs (loop5): Found nat_bits in checkpoint [ 28.795113][ T780] Leaked POSIX lock on dev=0x0:0x27 ino=0xac fl_owner=ffff888100bfc340 fl_flags=0x81 fl_type=0x1 fl_pid=779 [ 28.811322][ T785] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 28.812708][ T418] Leaked locks on dev=0x0:0x27 ino=0xac: [ 28.825133][ T418] POSIX: fl_owner=ffff888100bfc340 fl_flags=0x81 fl_type=0x1 fl_pid=779 [ 28.831219][ T15] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 28.884633][ T785] F2FS-fs (loop5): lookup inode (7) has corrupted xattr [ 28.891714][ T24] kauditd_printk_skb: 125 callbacks suppressed [ 28.891726][ T24] audit: type=1400 audit(1791979050.190:5260): avc: denied { checkpoint_restore } for pid=809 comm="syz.0.194" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 28.932526][ T24] audit: type=1400 audit(1791979050.230:5261): avc: denied { write } for pid=784 comm="syz.5.185" name="file1" dev="loop5" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 29.094338][ T825] tipc: Started in network mode [ 29.099279][ T825] tipc: Own node identity ac1414aa, cluster identity 4711 [ 29.106565][ T825] tipc: New replicast peer: 172.20.20.187 [ 29.113090][ T825] tipc: Enabled bearer , priority 10 [ 29.120643][ T825] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=39 sclass=netlink_xfrm_socket pid=825 comm=syz.5.196 [ 29.151234][ T15] usb 2-1: not running at top speed; connect to a high speed hub [ 29.192860][ T24] audit: type=1400 audit(1791979050.500:5262): avc: denied { name_bind } for pid=834 comm="syz.6.204" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 29.219932][ T24] audit: type=1400 audit(1791979050.530:5263): avc: denied { create } for pid=837 comm="syz.6.205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 29.239496][ T15] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 29.239530][ T15] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 29.239541][ T15] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.248823][ T840] netlink: 'syz.6.206': attribute type 4 has an invalid length. [ 29.249964][ T24] audit: type=1400 audit(1791979050.530:5264): avc: denied { write } for pid=837 comm="syz.6.205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 29.271932][ T15] uvcvideo: Found UVC 1.00 device (046d:0825) [ 29.302414][ T842] netlink: 'syz.6.206': attribute type 4 has an invalid length. [ 29.330888][ T24] audit: type=1400 audit(1791979050.630:5265): avc: denied { write } for pid=846 comm="syz.3.208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 29.347884][ T15] uvcvideo: No streaming interface found for terminal 2. [ 29.357513][ T851] xt_hashlimit: size too large, truncated to 1048576 [ 29.383693][ T852] process 'syz.5.207' launched './file0' with NULL argv: empty string added [ 29.401594][ T24] audit: type=1400 audit(1791979050.710:5266): avc: denied { transition } for pid=843 comm="syz.5.207" path="/36/file0" dev="tmpfs" ino=213 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 29.439739][ T24] audit: type=1400 audit(1791979050.730:5267): avc: denied { entrypoint } for pid=843 comm="syz.5.207" path="/36/file0" dev="tmpfs" ino=213 scontext=system_u:object_r:hugetlbfs_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 29.463511][ T24] audit: type=1400 audit(1791979050.730:5268): avc: denied { share } for pid=843 comm="syz.5.207" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 29.488374][ T20] usb 2-1: USB disconnect, device number 2 [ 29.495917][ T24] audit: type=1400 audit(1791979050.730:5269): avc: denied { noatsecure } for pid=843 comm="syz.5.207" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=process permissive=1 [ 29.730755][ T863] syz.3.215 uses obsolete (PF_INET,SOCK_PACKET) [ 30.029818][ T894] overlayfs: failed to get inode (-116) [ 30.045777][ T894] overlayfs: failed to get inode (-116) [ 30.215185][ T907] kvm [905]: vcpu2, guest rIP: 0x9135 disabled perfctr wrmsr: 0xc1 data 0xfffffc00 [ 30.231391][ T327] tipc: 32-bit node address hash set to aa1414ac [ 30.238049][ T907] kvm [905]: vcpu2, guest rIP: 0x9135 disabled perfctr wrmsr: 0xc2 data 0xfffffc00 [ 30.261637][ T907] kvm [905]: vcpu2, guest rIP: 0x9135 ignored wrmsr: 0x11e data 0xfffffc00 [ 30.284096][ T907] kvm [905]: vcpu2, guest rIP: 0x9135 disabled perfctr wrmsr: 0x186 data 0xfffffc00 [ 30.296117][ T890] F2FS-fs (loop0): Invalid Fs Meta Ino: node(0) meta(2) root(0) [ 30.313360][ T890] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 30.321925][ T907] kvm [905]: vcpu2, guest rIP: 0x9135 disabled perfctr wrmsr: 0x187 data 0xfffffc00 [ 30.322453][ T890] F2FS-fs (loop0): invalid crc value [ 30.342158][ T890] F2FS-fs (loop0): Found nat_bits in checkpoint [ 30.403381][ T890] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 30.411187][ T890] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 30.578179][ T943] ip_tables: iptables: counters copy to user failed while replacing table [ 30.671685][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 30.680151][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 30.683010][ T890] attempt to access beyond end of device [ 30.683010][ T890] loop0: rw=2049, want=45104, limit=40427 [ 30.698558][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 30.721648][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 30.730739][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 30.744765][ T281] attempt to access beyond end of device [ 30.744765][ T281] loop0: rw=2049, want=45112, limit=40427 [ 30.756741][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 30.780844][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 30.807244][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 30.886465][ T960] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x8f9fe1ed, utbl_chksum : 0xe619d30d) [ 31.112178][ T974] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 31.137540][ T974] EXT4-fs error (device loop1): ext4_mb_generate_buddy:824: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters [ 31.203007][ T974] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 31.249750][ T974] EXT4-fs (loop1): This should not happen!! Data will be lost [ 31.249750][ T974] [ 31.264472][ T974] EXT4-fs (loop1): Total free blocks count 0 [ 31.278010][ T974] EXT4-fs (loop1): Free/Dirty block details [ 31.287640][ T974] EXT4-fs (loop1): free_blocks=4096 [ 31.300667][ T974] EXT4-fs (loop1): dirty_blocks=64 [ 31.312644][ T974] EXT4-fs (loop1): Block reservation details [ 31.324642][ T974] EXT4-fs (loop1): i_reserved_data_blocks=4 [ 31.357002][ T49] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 31.389888][ T49] EXT4-fs (loop1): This should not happen!! Data will be lost [ 31.389888][ T49] [ 31.554521][ T1021] ip_tables: iptables: counters copy to user failed while replacing table [ 32.054403][ T1064] printk: syz.1.292 (1064): Attempt to access syslog with CAP_SYS_ADMIN but no CAP_SYSLOG (deprecated). [ 32.371181][ T53] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 32.501402][ T1076] overlayfs: failed to clone upperpath [ 32.543584][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 32.555488][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.572711][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 32.583020][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.586186][ T1088] overlayfs: failed to clone upperpath [ 32.591621][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.607441][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.622252][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.630518][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.670327][ T1102] capability: warning: `syz.6.308' uses deprecated v2 capabilities in a way that may be insecure [ 32.699188][ T1102] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=1102 comm=syz.6.308 [ 32.731453][ T53] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 32.742001][ T53] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.753421][ T53] usb 2-1: config 0 descriptor?? [ 32.898214][ T1119] xt_hashlimit: size too large, truncated to 1048576 [ 33.142856][ T1123] raw_sendmsg: syz.6.316 forgot to set AF_INET. Fix it! [ 33.203773][ T1134] netlink: 140 bytes leftover after parsing attributes in process `syz.3.321'. [ 33.234815][ T1136] fuse: Bad value for 'fd' [ 33.622747][ T1152] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 33.688067][ T1157] exFAT-fs (loop0): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 33.828584][ T1189] syz.0.341 (1189): attempted to duplicate a private mapping with mremap. This is not supported. [ 33.938939][ T24] kauditd_printk_skb: 39 callbacks suppressed [ 33.938951][ T24] audit: type=1400 audit(1791979055.240:5309): avc: denied { search } for pid=1203 comm="syz.5.345" name="/" dev="configfs" ino=1153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 34.011191][ T24] audit: type=1400 audit(1791979055.250:5310): avc: denied { read } for pid=1203 comm="syz.5.345" name="/" dev="configfs" ino=1153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 34.028622][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 34.039171][ T24] audit: type=1400 audit(1791979055.250:5311): avc: denied { open } for pid=1203 comm="syz.5.345" path="/" dev="configfs" ino=1153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 34.063370][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 34.078147][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 34.086744][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 34.099074][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 34.112040][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 34.120910][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 34.129672][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 34.139492][ T1214] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 34.483004][ T24] audit: type=1400 audit(1791979055.790:5312): avc: denied { bind } for pid=1239 comm="syz.0.361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.512341][ T24] audit: type=1400 audit(1791979055.810:5313): avc: denied { setopt } for pid=1239 comm="syz.0.361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.535540][ T24] audit: type=1400 audit(1791979055.810:5314): avc: denied { ioctl } for pid=1239 comm="syz.0.361" path="socket:[18869]" dev="sockfs" ino=18869 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.656740][ T1255] ip_tables: iptables: counters copy to user failed while replacing table [ 34.666126][ T1249] netlink: 92 bytes leftover after parsing attributes in process `syz.5.364'. [ 34.725615][ T1259] fuse: Unknown parameter '//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// [ 34.726666][ T1260] netlink: 12 bytes leftover after parsing attributes in process `syz.0.369'. [ 35.113918][ T20] usb 2-1: USB disconnect, device number 3 [ 35.198820][ T1280] xt_hashlimit: size too large, truncated to 1048576 [ 35.510738][ T24] audit: type=1400 audit(1791979056.810:5315): avc: denied { mount } for pid=1301 comm="syz.6.390" name="/" dev="ramfs" ino=18258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 35.571958][ T24] audit: type=1400 audit(1791979056.880:5316): avc: denied { mounton } for pid=1301 comm="syz.6.390" path="/" dev="ramfs" ino=18258 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 35.671683][ T1314] xt_SECMARK: invalid mode: 2 [ 36.038654][ T1365] xt_hashlimit: size too large, truncated to 1048576 [ 36.114120][ T1366] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 36.139344][ T1368] netlink: 4 bytes leftover after parsing attributes in process `syz.5.417'. [ 36.175205][ T1371] netlink: 4 bytes leftover after parsing attributes in process `syz.6.418'. [ 36.475716][ T1384] netlink: 4 bytes leftover after parsing attributes in process `syz.0.422'. [ 36.940344][ T1414] syz.5.436[1414] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 36.940424][ T1414] syz.5.436[1414] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 37.034725][ T1421] netlink: 4 bytes leftover after parsing attributes in process `syz.0.437'. [ 37.082350][ T1425] netlink: 24 bytes leftover after parsing attributes in process `syz.3.440'. [ 37.109376][ T24] audit: type=1400 audit(1791979058.410:5317): avc: denied { create } for pid=1429 comm="syz.5.442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 37.132296][ T1434] 9pnet: p9_errstr2errno: server reported unknown error n$[ [ 37.132296][ T1434] Q&|x6 [ 37.144971][ T24] audit: type=1400 audit(1791979058.410:5318): avc: denied { getopt } for pid=1429 comm="syz.5.442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 37.212081][ T1443] netlink: 'syz.3.449': attribute type 3 has an invalid length. [ 37.219818][ T1443] netlink: 'syz.3.449': attribute type 3 has an invalid length. [ 37.249647][ T1440] exFAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 37.261670][ T1449] 9pnet: p9_errstr2errno: server reported unknown error n$[ [ 37.261670][ T1449] Q&|x6 [ 37.261670][ T1449] N [ 37.265389][ T1440] exFAT-fs (loop0): Medium has reported failures. Some data may be lost. [ 37.285024][ T1440] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 37.683333][ T1465] syz.0.465 (1465): drop_caches: 2 [ 37.689751][ T1469] netlink: 4 bytes leftover after parsing attributes in process `syz.1.455'. [ 37.721748][ T1470] erofs: (device loop0): mounted with root inode @ nid 36. [ 37.780766][ T1465] attempt to access beyond end of device [ 37.780766][ T1465] loop0: rw=0, want=15300821032, limit=16 [ 37.847265][ T1465] erofs: (device loop0): z_erofs_readpage: failed to read, err [-117] [ 37.857987][ T1474] xt_hashlimit: size too large, truncated to 1048576 [ 38.018118][ T1465] syz.0.465 (1465): drop_caches: 2 [ 38.147093][ T1467] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 38.162334][ T1467] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 38.172869][ T1467] F2FS-fs (loop5): invalid crc value [ 38.191904][ T1467] F2FS-fs (loop5): Found nat_bits in checkpoint [ 38.244432][ T1467] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 38.263161][ T1467] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 38.389506][ T1498] xt_hashlimit: size too large, truncated to 1048576 [ 38.922114][ T1508] F2FS-fs (loop1): invalid crc value [ 38.935818][ T1508] F2FS-fs (loop1): Found nat_bits in checkpoint [ 38.979597][ T1508] F2FS-fs (loop1): Start checkpoint disabled! [ 38.986232][ T1508] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 39.047233][ T24] kauditd_printk_skb: 1 callbacks suppressed [ 39.047244][ T24] audit: type=1400 audit(1791979060.350:5320): avc: denied { load_policy } for pid=1529 comm="syz.5.480" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 39.047376][ T1530] SELinux: failed to load policy [ 39.381201][ T20] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 39.545259][ T1540] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 39.761257][ T20] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 39.771202][ T20] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 39.780990][ T20] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 39.792584][ T20] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 39.802603][ T20] usb 6-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 39.811850][ T20] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.831242][ T1536] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 39.839251][ T1536] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 39.851603][ T20] pl2303 6-1:1.0: pl2303 converter detected [ 39.928128][ T1570] netlink: 176 bytes leftover after parsing attributes in process `syz.0.498'. [ 39.973027][ T20] usb 6-1: pl2303 converter now attached to ttyUSB0 [ 40.059642][ T24] audit: type=1400 audit(1791979061.360:5321): avc: denied { append } for pid=1535 comm="syz.5.484" name="ttyUSB0" dev="devtmpfs" ino=547 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.071227][ T1536] pl2303 6-1:1.0: pl2303_vendor_write - failed to write [0007]: -32 [ 40.101340][ T1536] pl2303 ttyUSB0: pl2303_get_line_request - failed: -32 [ 40.121241][ T1536] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 40.141217][ T1536] pl2303 6-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 40.149263][ T1536] pl2303 ttyUSB0: failed to submit interrupt urb: -90 [ 40.171206][ T1576] pl2303 6-1:1.0: pl2303_vendor_write - failed to write [0007]: -32 [ 40.194416][ T1576] pl2303 ttyUSB0: pl2303_get_line_request - failed: -32 [ 40.221311][ T1576] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 40.241323][ T1576] pl2303 6-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 40.249954][ T1576] pl2303 ttyUSB0: failed to submit interrupt urb: -90 [ 40.270911][ T1581] device ip6gre0 entered promiscuous mode [ 40.277561][ T433] usb 6-1: USB disconnect, device number 2 [ 40.287357][ T433] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 40.297448][ T1581] netlink: 4 bytes leftover after parsing attributes in process `syz.6.502'. [ 40.306887][ T433] pl2303 6-1:1.0: device disconnected [ 40.359647][ T1580] device ip6gre0 left promiscuous mode [ 40.527920][ T24] audit: type=1400 audit(1791979061.830:5322): avc: denied { connect } for pid=1598 comm="syz.3.511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.659711][ T1609] FAULT_INJECTION: forcing a failure. [ 40.659711][ T1609] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 40.690162][ T24] audit: type=1400 audit(1791979061.990:5323): avc: denied { setopt } for pid=1582 comm="syz.6.503" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 40.693323][ T1609] CPU: 1 PID: 1609 Comm: syz.1.516 Not tainted syzkaller #0 [ 40.711020][ T1612] overlayfs: failed to clone lowerpath [ 40.716765][ T1609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.716771][ T1609] Call Trace: [ 40.716791][ T1609] __dump_stack+0x21/0x24 [ 40.716800][ T1609] dump_stack_lvl+0x1a7/0x208 [ 40.716822][ T1609] ? thaw_kernel_threads+0x220/0x220 [ 40.749998][ T1609] ? show_regs_print_info+0x18/0x18 [ 40.755216][ T1609] dump_stack+0x15/0x1c [ 40.759494][ T1609] should_fail+0x3ab/0x500 [ 40.763937][ T1609] should_fail_usercopy+0x1a/0x20 [ 40.769063][ T1609] _copy_to_iter+0x1dc/0xa20 [ 40.773664][ T1609] get_random_bytes_user+0x1cd/0x3b0 [ 40.778957][ T1609] ? signal_pending+0xa0/0xa0 [ 40.784086][ T1609] ? __kasan_check_write+0x14/0x20 [ 40.789204][ T1609] ? mutex_lock+0x92/0xf0 [ 40.793534][ T1609] ? import_single_range+0xda/0x1c0 [ 40.798727][ T1609] __x64_sys_getrandom+0x1d2/0x2c0 [ 40.803834][ T1609] ? __kasan_check_write+0x14/0x20 [ 40.809023][ T1609] ? add_disk_randomness+0xd0/0xd0 [ 40.814128][ T1609] ? __kasan_check_read+0x11/0x20 [ 40.819161][ T1609] ? exit_to_user_mode_prepare+0x9a/0xa0 [ 40.824806][ T1609] do_syscall_64+0x31/0x40 [ 40.829223][ T1609] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 40.835109][ T1609] RIP: 0033:0x7f27239a8559 [ 40.839519][ T1609] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.859115][ T1609] RSP: 002b:00007f2722401028 EFLAGS: 00000246 ORIG_RAX: 000000000000013e [ 40.867530][ T1609] RAX: ffffffffffffffda RBX: 00007f2723c2ffa0 RCX: 00007f27239a8559 [ 40.875493][ T1609] RDX: 0000000000000000 RSI: 00000000ffffff9a RDI: 0000200000000240 [ 40.883457][ T1609] RBP: 00007f2723a3f8b0 R08: 0000000000000000 R09: 0000000000000000 [ 40.891506][ T1609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.899467][ T1609] R13: 00007f2723c30038 R14: 00007f2723c2ffa0 R15: 00007ffe74004598 [ 40.974670][ T1624] netlink: 28 bytes leftover after parsing attributes in process `syz.5.522'. [ 40.995239][ T24] audit: type=1400 audit(1791979062.300:5324): avc: denied { read write } for pid=1626 comm="syz.1.524" name="uinput" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 41.051893][ T24] audit: type=1400 audit(1791979062.300:5325): avc: denied { open } for pid=1626 comm="syz.1.524" path="/dev/uinput" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 41.149709][ T1640] EXT4-fs (loop1): Ignoring removed mblk_io_submit option [ 41.155421][ T1653] xt_hashlimit: size too large, truncated to 1048576 [ 41.194982][ T1640] EXT4-fs (loop1): mounted filesystem without journal. Opts: mblk_io_submit,usrjquota=,,errors=continue [ 41.217267][ T1640] ext4 filesystem being mounted at /86/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 41.248397][ T24] audit: type=1400 audit(1791979062.550:5326): avc: denied { mount } for pid=1664 comm="syz.5.540" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 41.272165][ T24] audit: type=1400 audit(1791979062.550:5327): avc: denied { search } for pid=1664 comm="syz.5.540" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 41.294128][ T24] audit: type=1400 audit(1791979062.550:5328): avc: denied { write } for pid=1664 comm="syz.5.540" name="dynamic_events" dev="tracefs" ino=12713 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 41.317417][ T24] audit: type=1400 audit(1791979062.550:5329): avc: denied { open } for pid=1664 comm="syz.5.540" path="/105/tracefs/dynamic_events" dev="tracefs" ino=12713 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 41.548848][ T1698] ip_tables: iptables: counters copy to user failed while replacing table [ 41.557831][ T1691] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 41.582387][ T1691] EXT4-fs (loop1): mounted filesystem without journal. Opts: discard,journal_dev=0x0000000000000002,grpquota,stripe=0x0000000000000003,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue [ 41.687076][ T1713] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 41.700240][ T1713] EXT4-fs (loop0): 1 truncate cleaned up [ 41.714489][ T1713] EXT4-fs (loop0): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000001,usrjquota=,noload,data_err=ignore,usrjquota=,,errors=continue [ 41.745763][ T1730] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 41.758576][ T1730] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 41.871540][ T1755] smpboot: CPU 1 is now offline [ 41.882940][ T1755] x86: Booting SMP configuration: [ 41.887999][ T1755] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 41.894835][ T0] kvm-clock: cpu 1, msr 6e7a041, secondary cpu clock [ 41.896144][ T17] kvm-guest: stealtime: cpu 1, msr 1f7127040 [ 41.957477][ T1757] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 42.041674][ T1757] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5971: Corrupt filesystem [ 42.069542][ T1757] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5971: Corrupt filesystem [ 42.089994][ T1757] EXT4-fs error (device loop1): ext4_evict_inode:285: inode #18: comm syz.1.579: mark_inode_dirty error [ 42.101598][ T1757] EXT4-fs warning (device loop1): ext4_evict_inode:288: couldn't mark inode dirty (err -117) [ 42.229624][ T1780] netlink: 12 bytes leftover after parsing attributes in process `syz.1.587'. [ 42.274744][ T1782] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61712 sclass=netlink_route_socket pid=1782 comm=syz.1.588 [ 42.741882][ T1813] netlink: 'syz.3.601': attribute type 4 has an invalid length. [ 42.774627][ T1813] netlink: 'syz.3.601': attribute type 4 has an invalid length. [ 43.255093][ T1827] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 43.282555][ T1827] EXT4-fs (loop0): mounted filesystem without journal. Opts: discard,journal_dev=0x0000000000000002,grpquota,stripe=0x0000000000000003,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue [ 43.573278][ T1852] xt_hashlimit: size too large, truncated to 1048576 [ 43.705493][ T1857] syz.3.620[1857] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 43.705601][ T1857] syz.3.620[1857] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 43.850541][ T1872] ip_tables: iptables: counters copy to user failed while replacing table [ 43.889650][ T1874] smpboot: CPU 1 is now offline [ 43.900446][ T1874] x86: Booting SMP configuration: [ 43.905925][ T1874] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 43.912396][ T0] kvm-clock: cpu 1, msr 6e7a041, secondary cpu clock [ 43.913542][ T17] kvm-guest: stealtime: cpu 1, msr 1f7127040 [ 44.039896][ T1859] F2FS-fs (loop0): invalid crc value [ 44.070417][ T1859] F2FS-fs (loop0): Found nat_bits in checkpoint [ 44.131050][ T1859] F2FS-fs (loop0): Start checkpoint disabled! [ 44.150372][ T1859] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6 [ 44.215344][ T24] kauditd_printk_skb: 8 callbacks suppressed [ 44.215356][ T24] audit: type=1400 audit(1791979065.520:5338): avc: denied { wake_alarm } for pid=1887 comm="syz.6.633" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 44.268777][ T24] audit: type=1400 audit(1791979065.570:5339): avc: denied { watch watch_reads } for pid=1858 comm="syz.0.621" path="/113/file0" dev="loop0" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 44.366226][ T1884] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 44.384497][ T1884] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 44.399227][ T9] attempt to access beyond end of device [ 44.399227][ T9] loop0: rw=2049, want=40976, limit=40427 [ 44.411742][ T1884] F2FS-fs (loop5): invalid crc value [ 44.438826][ T1884] F2FS-fs (loop5): Found nat_bits in checkpoint [ 44.489108][ T1884] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 44.501196][ T1884] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 44.670186][ T320] attempt to access beyond end of device [ 44.670186][ T320] loop5: rw=2049, want=40968, limit=40427 [ 44.705506][ T1911] netlink: 184 bytes leftover after parsing attributes in process `syz.3.641'. [ 44.841108][ T24] audit: type=1400 audit(1791979066.140:5340): avc: denied { read } for pid=1927 comm="syz.5.638" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 44.945445][ T1931] overlayfs: failed to clone upperpath [ 44.962607][ T1933] netlink: 1363 bytes leftover after parsing attributes in process `syz.3.649'. [ 44.984212][ T1935] fuse: Bad value for 'fd' [ 45.116492][ T1954] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.124349][ T1954] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.166996][ T1954] netlink: 'syz.3.658': attribute type 16 has an invalid length. [ 45.174889][ T1954] netlink: 'syz.3.658': attribute type 17 has an invalid length. [ 45.190936][ T1954] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.198049][ T1954] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.206498][ T1954] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.213572][ T1954] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.236858][ T1954] IPv6: ADDRCONF(NETDEV_CHANGE): syztnl1: link becomes ready [ 45.254425][ T1954] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0.257: link becomes ready [ 45.271773][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 45.280069][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 45.300308][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 45.317446][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 45.335840][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 45.344351][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 45.353480][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 45.362533][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 45.384485][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 45.392651][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 45.554271][ T1972] fuse: root generation should be zero [ 45.687814][ T24] audit: type=1400 audit(1791979067.990:5341): avc: denied { append } for pid=2008 comm="syz.1.683" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 45.864008][ T2042] xt_hashlimit: size too large, truncated to 1048576 [ 46.056669][ T24] audit: type=1400 audit(1791979068.360:5342): avc: denied { accept } for pid=2074 comm="syz.1.711" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 46.086969][ T24] audit: type=1400 audit(1791979068.380:5343): avc: denied { nlmsg_write } for pid=2074 comm="syz.1.711" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 46.115880][ T24] audit: type=1400 audit(1791979068.410:5344): avc: denied { ioctl } for pid=2076 comm="syz.1.712" path="/124/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x6725 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 46.211060][ T2085] ip_tables: iptables: counters copy to user failed while replacing table [ 46.315053][ T24] audit: type=1400 audit(1791979068.620:5345): avc: denied { nlmsg_read } for pid=2102 comm="syz.1.724" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 46.335709][ T2105] netlink: 48 bytes leftover after parsing attributes in process `syz.1.724'. [ 46.355286][ T24] audit: type=1400 audit(1791979068.660:5346): avc: denied { append } for pid=2106 comm="syz.5.726" name="cgroup.controllers" dev="overlay" ino=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 46.379053][ T24] audit: type=1400 audit(1791979068.660:5347): avc: denied { setattr } for pid=2106 comm="syz.5.726" name="#776" dev="tmpfs" ino=776 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 46.684227][ T2123] F2FS-fs (loop5): Corrupted extension count (64 + 1 > 64) [ 46.691767][ T2123] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 47.203557][ T2171] input: syz0 as /devices/virtual/input/input4 [ 47.407167][ T2177] xt_hashlimit: size too large, truncated to 1048576 [ 47.827010][ T2200] mmap: syz.0.764 (2200): VmData 29073408 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 48.112529][ T2237] netlink: 12 bytes leftover after parsing attributes in process `syz.1.778'. [ 48.444905][ T2259] EXT4-fs (loop5): Test dummy encryption mode enabled [ 48.461187][ T2259] EXT4-fs (loop5): Ignoring removed orlov option [ 48.475211][ T2259] EXT4-fs (loop5): Quota format mount options ignored when QUOTA feature is enabled [ 48.508089][ T2265] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.515672][ T2259] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=284ec1a8, mo2=0003] [ 48.525338][ T2265] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.528041][ T2259] System zones: 0-5 [ 48.540488][ T2265] device bridge_slave_0 entered promiscuous mode [ 48.546115][ T2259] EXT4-fs (loop5): mounted filesystem without journal. Opts: debug,test_dummy_encryption=v1,inlinecrypt,delalloc,noinit_itable,norecovery,minixdf,orlov,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000008, [ 48.554054][ T2265] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.576320][ T2265] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.585226][ T2265] device bridge_slave_1 entered promiscuous mode [ 48.606138][ T2259] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 48.695203][ T2265] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.702306][ T2265] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.709586][ T2265] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.716658][ T2265] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.783826][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.791914][ T396] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.802045][ T396] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.825801][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.841389][ T396] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.848571][ T396] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.872247][ T9] device bridge_slave_1 left promiscuous mode [ 48.878424][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.901622][ T9] device bridge_slave_0 left promiscuous mode [ 48.907813][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.932502][ T9] device veth1_macvtap left promiscuous mode [ 48.938556][ T9] device veth0_vlan left promiscuous mode [ 49.155541][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.163732][ T396] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.170745][ T396] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.182522][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.193400][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.206047][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.216976][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.225211][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 49.232742][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 49.241248][ T2265] device veth0_vlan entered promiscuous mode [ 49.251064][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.260326][ T2265] device veth1_macvtap entered promiscuous mode [ 49.269449][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.278062][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.288075][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 49.296438][ T396] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.310734][ T24] kauditd_printk_skb: 28 callbacks suppressed [ 49.310746][ T24] audit: type=1400 audit(1791979071.610:5376): avc: denied { mount } for pid=2265 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 49.339744][ T24] audit: type=1400 audit(1791979071.610:5377): avc: denied { mounton } for pid=2265 comm="syz-executor" path="/root/syzkaller.z0kE4t/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 49.514527][ T2294] netlink: 60 bytes leftover after parsing attributes in process `syz.0.795'. [ 49.538266][ T2294] netlink: 60 bytes leftover after parsing attributes in process `syz.0.795'. [ 49.602710][ T2293] EXT4-fs (loop5): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 49.632137][ T2277] overlayfs: failed to clone upperpath [ 49.638927][ T2293] EXT4-fs (loop5): mounted filesystem without journal. Opts: dioread_nolock,resuid=0x0000000000000000,barrier=0x0000000000000009,,errors=continue [ 49.653981][ T2293] ext4 filesystem being mounted at /159/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 49.669990][ T24] audit: type=1400 audit(1791979071.970:5378): avc: denied { create } for pid=2292 comm="syz.5.798" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 49.706379][ T24] audit: type=1400 audit(1791979072.000:5379): avc: denied { ioctl } for pid=2292 comm="syz.5.798" path="/159/file1/file1" dev="loop5" ino=15 ioctlcmd=0x660f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 49.875684][ T2318] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 49.889389][ T2318] ext4 filesystem being mounted at /163/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 49.905236][ T24] audit: type=1400 audit(1791979072.210:5380): avc: denied { write open } for pid=2317 comm="syz.5.812" path="/163/file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop5" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 49.951473][ T24] audit: type=1400 audit(1791979072.210:5381): avc: denied { create } for pid=2317 comm="syz.5.812" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 49.993723][ T24] audit: type=1400 audit(1791979072.220:5382): avc: denied { create } for pid=2317 comm="syz.5.812" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=chr_file permissive=1 [ 50.241069][ T24] audit: type=1400 audit(1791979328.542:5383): avc: denied { getopt } for pid=2341 comm="syz.6.821" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 50.308509][ T24] audit: type=1400 audit(1791979328.612:5384): avc: denied { execute_no_trans } for pid=2345 comm="syz.5.823" path="/166/file0" dev="tmpfs" ino=898 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 50.387232][ T2359] ip_tables: iptables: counters copy to user failed while replacing table [ 50.416509][ T24] audit: type=1400 audit(1791979328.722:5385): avc: denied { read } for pid=2358 comm="syz.7.830" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 50.515208][ T2361] EXT4-fs error (device loop0): ext4_xattr_inode_iget:401: inode #2: comm syz.0.829: missing EA_INODE flag [ 50.533412][ T2361] EXT4-fs error (device loop0): ext4_xattr_inode_iget:406: comm syz.0.829: error while reading EA inode 2 err=-117 [ 50.546040][ T2361] EXT4-fs (loop0): 1 orphan inode deleted [ 50.551960][ T2361] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 50.556865][ T2367] erofs: (device loop7): mounted with root inode @ nid 36. [ 50.605459][ T2367] attempt to access beyond end of device [ 50.605459][ T2367] loop7: rw=0, want=34359738368, limit=16 [ 50.784817][ T2380] ip_tables: iptables: counters copy to user failed while replacing table [ 50.818379][ T2386] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.828853][ T2386] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.835974][ T2386] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.858453][ T2378] FAT-fs (loop7): error, fat_get_cluster: invalid cluster chain (i_pos 196) [ 50.894279][ T2378] FAT-fs (loop7): Filesystem has been set read-only [ 51.003485][ T2398] xt_hashlimit: size too large, truncated to 1048576 [ 51.321543][ T2396] F2FS-fs (loop7): Invalid SB checksum offset: 0 [ 51.331221][ T2396] F2FS-fs (loop7): Can't find valid F2FS filesystem in 2th superblock [ 51.347847][ T2396] F2FS-fs (loop7): invalid crc value [ 51.355880][ T2396] F2FS-fs (loop7): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 51.384868][ T2396] F2FS-fs (loop7): Try to recover 2th superblock, ret: 0 [ 51.392006][ T2396] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5 [ 51.455308][ T2427] mmap: syz.0.854 (2427) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 51.487469][ T2432] xt_hashlimit: size too large, truncated to 1048576 [ 51.837372][ T2441] ip_tables: iptables: counters copy to user failed while replacing table [ 52.021410][ T2457] erofs: Unknown parameter '' [ 52.795268][ T2493] xt_hashlimit: size too large, truncated to 1048576 [ 52.970423][ T2504] EXT4-fs (loop5): mounted filesystem without journal. Opts: usrquota,nodelalloc,,errors=continue [ 52.981875][ T2504] ext4 filesystem being mounted at /178/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 53.109261][ T2519] bridge0: port 3(syz_tun) entered blocking state [ 53.117106][ T2519] bridge0: port 3(syz_tun) entered disabled state [ 53.126382][ T2519] device syz_tun entered promiscuous mode [ 53.137843][ T2519] bridge0: port 3(syz_tun) entered blocking state [ 53.144342][ T2519] bridge0: port 3(syz_tun) entered forwarding state [ 53.163039][ T2519] device bridge0 entered promiscuous mode [ 53.175181][ T2519] device macsec1 entered promiscuous mode [ 53.182058][ T2527] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 53.244754][ T2535] netlink: 7 bytes leftover after parsing attributes in process `syz.6.901'. [ 53.286005][ T2543] netlink: 'syz.6.905': attribute type 4 has an invalid length. [ 53.301006][ T2522] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 53.323477][ T2522] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 53.345680][ T2522] F2FS-fs (loop5): invalid crc value [ 53.366100][ T2522] F2FS-fs (loop5): Found nat_bits in checkpoint [ 53.406793][ T2522] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 53.415094][ T2522] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 53.662787][ T2582] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 53.683435][ T2599] netlink: 28 bytes leftover after parsing attributes in process `syz.6.929'. [ 53.725234][ T2582] EXT4-fs (loop0): mounted filesystem without journal. Opts: barrier=0x0000000000000081,minixdf,discard,delalloc,dioread_nolock,noquota,,errors=continue [ 53.771013][ T2582] ext4 filesystem being mounted at /149/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 53.958461][ T2624] overlayfs: failed to clone upperpath [ 53.982740][ T2628] overlayfs: failed to clone upperpath [ 53.986242][ T2601] overlayfs: failed to clone upperpath [ 54.082954][ T2642] netlink: 28 bytes leftover after parsing attributes in process `syz.3.946'. [ 54.101657][ T2644] overlayfs: './file0' not a directory [ 54.356336][ T24] kauditd_printk_skb: 21 callbacks suppressed [ 54.356346][ T24] audit: type=1400 audit(1791979332.662:5407): avc: denied { write } for pid=2649 comm="syz.0.950" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 54.681107][ T24] audit: type=1400 audit(1791979332.982:5408): avc: denied { map } for pid=2688 comm="syz.3.967" path="socket:[23766]" dev="sockfs" ino=23766 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 54.733459][ T2680] EXT4-fs (loop7): mounted filesystem without journal. Opts: ,errors=continue [ 54.779504][ T2691] EXT4-fs (loop0): Ignoring removed oldalloc option [ 54.803947][ T24] audit: type=1400 audit(1791979333.112:5409): avc: denied { append } for pid=2679 comm="syz.7.962" path="/28/file1/file0/blkio.bfq.io_wait_time_recursive" dev="overlay" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 54.808074][ T2691] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 54.864186][ T2691] EXT4-fs (loop0): mounted filesystem without journal. Opts: abort,acl,oldalloc,jqfmt=vfsv0,,errors=continue [ 55.019450][ T2721] netlink: 28 bytes leftover after parsing attributes in process `syz.3.977'. [ 55.116003][ T24] audit: type=1400 audit(1791979333.422:5410): avc: denied { remount } for pid=2746 comm="syz.0.989" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 55.286128][ T2753] netlink: 28 bytes leftover after parsing attributes in process `syz.7.991'. [ 55.381964][ T2762] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.389211][ T2762] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.396930][ T2762] device bridge_slave_0 entered promiscuous mode [ 55.409472][ T2762] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.417284][ T2762] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.424971][ T2762] device bridge_slave_1 entered promiscuous mode [ 55.438002][ T2765] EXT4-fs (loop7): mounted filesystem without journal. Opts: ,errors=continue [ 55.452466][ T2765] ext4 filesystem being mounted at /40/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 55.497175][ T2762] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.504293][ T2762] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.504775][ T24] audit: type=1400 audit(1791979333.822:5411): avc: denied { map } for pid=2764 comm="syz.7.996" path="/40/file0/blkio.bfq.empty_time" dev="loop7" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 55.511600][ T2762] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.542487][ T2762] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.567542][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.601896][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.609285][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.638125][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 55.671659][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.678732][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.717502][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 55.739608][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.746740][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.765990][ T2788] tipc: Started in network mode [ 55.777252][ T2788] tipc: Own node identity fe80000000000000000000000000001, cluster identity 4711 [ 55.787163][ T2788] tipc: Enabled bearer , priority 10 [ 55.812535][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 55.841773][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 55.893649][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 55.927027][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 55.939727][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 55.956294][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 55.961189][ T24] audit: type=1400 audit(1791979334.262:5412): avc: denied { create } for pid=2799 comm="syz.7.1009" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 55.970841][ T2762] device veth0_vlan entered promiscuous mode [ 55.992798][ T2800] SELinux: failed to load policy [ 56.016334][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 56.026961][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 56.036026][ T24] audit: type=1400 audit(1791979334.262:5413): avc: denied { bind } for pid=2799 comm="syz.7.1009" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 56.056992][ T24] audit: type=1400 audit(1791979334.262:5414): avc: denied { load_policy } for pid=2799 comm="syz.7.1009" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 56.080634][ T2762] device veth1_macvtap entered promiscuous mode [ 56.101271][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 56.109464][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 56.118744][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 56.143019][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 56.157969][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 56.186047][ T2809] overlayfs: failed to clone lowerpath [ 56.373865][ T2829] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1021'. [ 56.507463][ T2840] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 56.556439][ T2845] xt_hashlimit: size too large, truncated to 1048576 [ 56.901542][ T428] tipc: 32-bit node address hash set to 100080fe [ 57.311011][ T24] audit: type=1400 audit(1791979335.612:5415): avc: denied { ioctl } for pid=2867 comm="syz.5.1037" path="socket:[24701]" dev="sockfs" ino=24701 ioctlcmd=0x7452 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 57.369943][ T24] audit: type=1400 audit(1791979335.652:5416): avc: denied { setattr } for pid=2867 comm="syz.5.1037" path="socket:[24701]" dev="sockfs" ino=24701 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 57.510377][ T9] ================================================================== [ 57.518596][ T9] BUG: KASAN: use-after-free in l2tp_tunnel_del_work+0xcd/0x3d0 [ 57.521516][ T2869] ------------[ cut here ]------------ [ 57.526238][ T9] Read of size 8 at addr ffff888124492480 by task kworker/u4:1/9 [ 57.526251][ T9] [ 57.541758][ T9] CPU: 0 PID: 9 Comm: kworker/u4:1 Not tainted syzkaller #0 [ 57.549046][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 57.555129][ T2869] WARNING: CPU: 1 PID: 2869 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 57.559110][ T9] Workqueue: l2tp l2tp_tunnel_del_work [ 57.559126][ T9] Call Trace: [ 57.577939][ T9] __dump_stack+0x21/0x24 [ 57.582364][ T9] dump_stack_lvl+0x1a7/0x208 [ 57.587079][ T9] ? show_regs_print_info+0x18/0x18 [ 57.592295][ T9] ? thaw_kernel_threads+0x220/0x220 [ 57.597688][ T9] print_address_description+0x7f/0x2c0 [ 57.603240][ T9] ? l2tp_tunnel_del_work+0xcd/0x3d0 [ 57.606306][ T2869] Modules linked in: [ 57.608535][ T9] kasan_report+0x100/0x140 [ 57.608552][ T9] ? __switch_to_asm+0x3a/0x60 [ 57.612992][ T2869] [ 57.616938][ T9] ? l2tp_tunnel_del_work+0xcd/0x3d0 [ 57.616951][ T9] __asan_report_load8_noabort+0x14/0x20 [ 57.616966][ T9] l2tp_tunnel_del_work+0xcd/0x3d0 [ 57.637748][ T2869] CPU: 1 PID: 2869 Comm: syz.5.1037 Not tainted syzkaller #0 [ 57.640099][ T9] process_one_work+0x6fd/0xbc0 [ 57.640117][ T9] worker_thread+0xa8e/0x13c0 [ 57.657005][ T9] kthread+0x324/0x3b0 [ 57.661084][ T9] ? worker_clr_flags+0x190/0x190 [ 57.666132][ T9] ? kthread_blkcg+0xd0/0xd0 [ 57.670737][ T9] ret_from_fork+0x1f/0x30 [ 57.672138][ T2869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 57.675156][ T9] [ 57.675164][ T9] Allocated by task 2868: [ 57.675185][ T9] __kasan_kmalloc+0xd4/0x100 [ 57.696601][ T9] __kmalloc+0x19f/0x330 [ 57.701026][ T9] l2tp_session_create+0x39/0xb60 [ 57.706065][ T9] pppol2tp_connect+0xbf5/0x1640 [ 57.711021][ T9] __sys_connect+0x3ce/0x450 [ 57.715625][ T9] __x64_sys_connect+0x7a/0x90 [ 57.718752][ T2869] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 57.720415][ T9] do_syscall_64+0x31/0x40 [ 57.720425][ T9] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 57.720436][ T9] [ 57.739388][ T9] Freed by task 2868: [ 57.743385][ T9] kasan_set_track+0x4a/0x70 [ 57.746978][ T2869] Code: 5d c3 e8 dc 25 35 fd be 02 00 00 00 eb 0a e8 d0 25 35 fd be 01 00 00 00 4c 89 f7 e8 73 95 0e fe e9 0f ff ff ff e8 b9 25 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 25 35 fd 4c 89 f7 be 03 [ 57.748033][ T9] kasan_set_free_info+0x23/0x40 [ 57.748042][ T9] ____kasan_slab_free+0x125/0x160 [ 57.748060][ T9] __kasan_slab_free+0x11/0x20 [ 57.774111][ T2869] RSP: 0018:ffffc90000c37c40 EFLAGS: 00010293 [ 57.777796][ T9] slab_free_freelist_hook+0xc5/0x190 [ 57.777805][ T9] kfree+0xc0/0x270 [ 57.777829][ T9] l2tp_session_put+0xb2/0x1a0 [ 57.784805][ T2869] [ 57.788671][ T9] pppol2tp_ioctl+0x748/0x960 [ 57.788697][ T9] pppox_ioctl+0x1e1/0x440 [ 57.794465][ T2869] RAX: ffffffff842f9107 RBX: ffff88810fab5000 RCX: ffff888110705000 [ 57.797862][ T9] sock_do_ioctl+0xda/0x380 [ 57.797871][ T9] sock_ioctl+0x472/0x740 [ 57.797886][ T9] __se_sys_ioctl+0x121/0x1a0 [ 57.802984][ T2869] RDX: 0000000000000000 RSI: 000000000f99ff00 RDI: 000000000c04eb7d [ 57.804957][ T9] __x64_sys_ioctl+0x7b/0x90 [ 57.804968][ T9] do_syscall_64+0x31/0x40 [ 57.804978][ T9] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 57.804987][ T9] [ 57.809806][ T2869] RBP: ffffc90000c37c60 R08: ffff88810fab5083 R09: 1ffff11021f56a10 [ 57.814058][ T9] The buggy address belongs to the object at ffff888124492400 [ 57.814058][ T9] which belongs to the cache kmalloc-512 of size 512 [ 57.814067][ T9] The buggy address is located 128 bytes inside of [ 57.814067][ T9] 512-byte region [ffff888124492400, ffff888124492600) [ 57.814071][ T9] The buggy address belongs to the page: [ 57.814086][ T9] page:ffffea0004912400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x124490 [ 57.814095][ T9] head:ffffea0004912400 order:2 compound_mapcount:0 compound_pincount:0 [ 57.814102][ T9] flags: 0x4000000000010200(slab|head) [ 57.814118][ T9] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 57.822966][ T2869] R10: dffffc0000000000 R11: ffffed1021f56a11 R12: dffffc0000000000 [ 57.826584][ T9] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 57.826589][ T9] page dumped because: kasan: bad access detected [ 57.826599][ T9] page_owner tracks the page as allocated [ 57.830954][ T2869] R13: dffffc0000000000 R14: 000000000f99ff00 R15: ffff888124492400 [ 57.835588][ T9] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 320, ts 22940100483, free_ts 22937830856 [ 57.835603][ T9] prep_new_page+0x176/0x190 [ 57.835612][ T9] get_page_from_freelist+0x225f/0x23f0 [ 57.835621][ T9] __alloc_pages_nodemask+0x29a/0x640 [ 57.835629][ T9] new_slab+0x84/0x3f0 [ 57.835645][ T9] ___slab_alloc+0x2f8/0x4c0 [ 57.845900][ T2869] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 57.848326][ T9] __slab_alloc+0x63/0xa0 [ 57.848336][ T9] __kmalloc+0x1f9/0x330 [ 57.848354][ T9] qdisc_alloc+0x79/0x720 [ 57.858666][ T2869] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.858740][ T9] qdisc_create_dflt+0x6b/0x390 [ 57.858755][ T9] dev_activate+0x292/0x11c0 [ 57.861449][ T2869] CR2: 00007fc9a4aa8c40 CR3: 000000010ec9a000 CR4: 00000000003506a0 [ 57.869045][ T9] __dev_open+0x3e9/0x500 [ 57.869055][ T9] __dev_change_flags+0x1e4/0x6a0 [ 57.869065][ T9] dev_change_flags+0x80/0x1a0 [ 57.869073][ T9] do_setlink+0xb19/0x29a0 [ 57.869083][ T9] rtnl_newlink+0x13e6/0x1830 [ 57.869098][ T9] rtnetlink_rcv_msg+0x9e9/0xca0 [ 57.883735][ T2869] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.896481][ T9] page last free stack trace: [ 57.896496][ T9] free_unref_page_prepare+0x2b7/0x2d0 [ 57.896507][ T9] __free_pages+0x146/0x390 [ 57.896517][ T9] __vunmap+0x801/0x980 [ 57.896526][ T9] vfree+0x61/0x90 [ 57.896536][ T9] kcov_close+0x2b/0x50 [ 57.896545][ T9] __fput+0x2dc/0x730 [ 57.896553][ T9] ____fput+0x15/0x20 [ 57.896563][ T9] task_work_run+0x127/0x190 [ 57.896572][ T9] do_exit+0xa7c/0x24e0 [ 57.896581][ T9] do_group_exit+0x149/0x310 [ 57.896590][ T9] __x64_sys_exit_group+0x3f/0x40 [ 57.896599][ T9] do_syscall_64+0x31/0x40 [ 57.896609][ T9] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 57.896612][ T9] [ 57.896616][ T9] Memory state around the buggy address: [ 57.896626][ T9] ffff888124492380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.896635][ T9] ffff888124492400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.896643][ T9] >ffff888124492480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.896647][ T9] ^ [ 57.896660][ T9] ffff888124492500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.903518][ T2869] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.912502][ T9] ffff888124492580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.912506][ T9] ================================================================== [ 57.912511][ T9] Disabling lock debugging due to kernel taint [ 57.958188][ T9] ------------[ cut here ]------------ [ 58.039511][ T2869] Call Trace: [ 58.137433][ T9] refcount_t: underflow; use-after-free. [ 58.139527][ T2869] pppol2tp_release+0x150/0x2b0 [ 58.152138][ T9] WARNING: CPU: 0 PID: 9 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 58.153497][ T2869] sock_close+0xb8/0x200 [ 58.166389][ T9] Modules linked in: [ 58.182055][ T2869] ? sock_mmap+0xa0/0xa0 [ 58.188457][ T9] [ 58.203283][ T2869] __fput+0x2dc/0x730 [ 58.208000][ T9] CPU: 0 PID: 9 Comm: kworker/u4:1 Tainted: G B syzkaller #0 [ 58.224118][ T2869] ____fput+0x15/0x20 [ 58.265757][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 58.267456][ T2869] task_work_run+0x127/0x190 [ 58.278136][ T9] Workqueue: l2tp l2tp_tunnel_del_work [ 58.279982][ T2869] do_exit+0xa7c/0x24e0 [ 58.285984][ T9] [ 58.295066][ T2869] ? __kasan_check_write+0x14/0x20 [ 58.302641][ T9] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 58.328088][ T2869] ? switch_fpu_return+0x19c/0x330 [ 58.341187][ T9] Code: 04 01 48 c7 c7 c0 55 40 85 e8 6c 96 3b 02 0f 0b eb c3 e8 43 8f 26 ff c6 05 22 75 82 04 01 48 c7 c7 20 56 40 85 e8 50 96 3b 02 <0f> 0b eb a7 e8 27 8f 26 ff c6 05 03 75 82 04 01 48 c7 c7 40 55 40 [ 58.342831][ T2869] ? put_task_struct+0x90/0x90 [ 58.362822][ T9] RSP: 0018:ffffc90000097c58 EFLAGS: 00010246 [ 58.371168][ T2869] ? fpu__clear_all+0x20/0x20 [ 58.376415][ T9] RAX: 1fceb7015a356d00 RBX: 0000000000000003 RCX: ffff88810024a800 [ 58.383474][ T2869] ? __kasan_check_read+0x11/0x20 [ 58.386335][ T9] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 58.399301][ T9] RBP: ffffc90000097c68 R08: ffff8881f7052fff R09: 1ffff1103ee0a5ff [ 58.401266][ T2869] __x64_sys_exit+0x40/0x40 [ 58.407671][ T9] R10: dffffc0000000000 R11: ffffed103ee0a600 R12: ffff888124492820 [ 58.411861][ T2869] do_syscall_64+0x31/0x40 [ 58.420116][ T9] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 58.424577][ T2869] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 58.432549][ T9] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 58.438473][ T2869] RIP: 0033:0x7febed51f559 [ 58.447511][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 58.451834][ T2869] Code: Unable to access opcode bytes at RIP 0x7febed51f52f. [ 58.458489][ T9] CR2: 0000001b32120ff8 CR3: 000000011de55000 CR4: 00000000003506b0 [ 58.466973][ T2869] RSP: 002b:00007febebf77ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 58.482371][ T9] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 58.490357][ T2869] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007febed51f559 [ 58.490364][ T2869] RDX: 00007febebf789c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 58.490378][ T2869] RBP: 00007febed5b68b0 R08: 0000000000000000 R09: 0000000000000058 [ 58.498789][ T9] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 58.522612][ T2869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 58.522619][ T2869] R13: 00007febed7a7038 R14: 00007febed7a6fa0 R15: 00007ffd8d401918 [ 58.522629][ T2869] ---[ end trace 5418dc77516a63b6 ]--- [ 58.544249][ T9] Call Trace: [ 58.547555][ T9] l2tp_session_put+0xcb/0x1a0 [ 58.552385][ T9] l2tp_session_delete+0x3a9/0x4a0 [ 58.557509][ T9] l2tp_tunnel_del_work+0x180/0x3d0 [ 58.562749][ T9] process_one_work+0x6fd/0xbc0 [ 58.567600][ T9] worker_thread+0xa8e/0x13c0 [ 58.572295][ T9] kthread+0x324/0x3b0 [ 58.576372][ T9] ? worker_clr_flags+0x190/0x190 [ 58.581719][ T9] ? kthread_blkcg+0xd0/0xd0 [ 58.586300][ T9] ret_from_fork+0x1f/0x30 [ 58.590698][ T9] ---[ end trace 5418dc77516a63b7 ]---