last executing test programs: 4.389188294s ago: executing program 2 (id=949): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000002840)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r0}, 0x18) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="70000000100003042abd70009da1d2b900000004", @ANYRES32=0x0, @ANYBLOB="0000000000000000500012800b0001006272696467650000400002800800050000000000050029000100000006002700040000000c00220006000000000000000c0021"], 0x70}}, 0x0) 4.122873155s ago: executing program 2 (id=950): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x21081e, &(0x7f00000007c0)={[{@nouid32}, {@nogrpid}, {@bh}]}, 0x1, 0x51d, &(0x7f0000001480)="$eJzs3c9vHFcdAPDvTLK2k7h1WnoABG1oCwFFWceb1qp6gHJCCFVC9AhSauyNZXnXa3nXpTaRcM9ckajECY78AZx74s4FwY1LOSDxwwLVSBwGzezY2di79uaHvZb385FG89688X7fizPvzbxd7wtgbN2IiJ2ImIiI9yNipjyelFu8093y8z7bfbC4t/tgMYkse++fSVGeH4uen8ldK19zKiJ+8J2IHydH47a3tlcXGo36Rpmf7TTXZ9tb27dXmgvL9eX6Wq02Pzd/5627b9YeozVTx5a+0pwoU1/+9A873/hpXq3p8khvO56lbtMrB3FylyPie6cRbAQule2ZGHVFeCJpRLwYEa8W1/9MXCp+mwDARZZlM5HN9OYBgIsuLebAkrRazgVMR5pWq905vJfiatpotTu37rc215a6c2XXo5LeX2nU75RzhdejkuT5uSL9MF87lL8bES9ExC8mrxT56mKrsTTKGx8AGGPXDo3//5nsjv8AwAV3/MdmAICLyPgPAOPH+A8A48f4DwDjpzv+X3ncH8uy7GenUR0A4Ax4/geA8WP8B4Cx8v133823bK/8/uulD7Y2V1sf3F6qt1erzc3F6mJrY7263GotF9/Z0zzp9Rqt1vrcG7H54fVvrrc7s+2t7XvN1uZa517xvd736pXirJ0zaBkAMMgLr3zy5yQfkd++UmzRs5ZDZaQ1A05bOuoKACNzadQVAEbGal8wvh4+4z/2hwBMD8AF0WeJ3kdM9fsDoSzLstOrEnDKbn7B/D+Mq575f58ChjFz0vx/sTawNwnhQjL/D+Mry5Jh1/yPYU8EAM63Y+b4r5/lfQgwOgPe/3+x3P+2fHPgR0uHz/j4NGsFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA59v++r/Vcpnf6UjTajXiuWIBoEpyf6VRvxMRz0fEnyYrk3l+bsR1BgCeVvq3pFz/6+bM69OPFL187SA5ERE/+dV7v/xwodPZ+GPERPKvyf3jnY/L47UTg02dRgsAgOPtj9PFvudB/rPdB4v721nW5+/f7t4V5HH3didi7yD+5bhc7KeiEhFX/52U+a6kZ+7iaex8FBGf79f+JKaLOZDuLcvh+Hns5840fvpI/LRcoDkt/y0+9wzqAuPmk7z/eaff9ZfGjWLf//qfKnqop1f2f/lLLe4VfeDD+Pv936UB/d+NYWO88fvvdlNXjpZ9FPHFyxH7sfd6+p/9+MmA+K8PGf8vX3r51UFl2a8jbkb/+L2xZjvN9dn21vbtlebCcn25vlarzc/N33nr7pu12WKOenbwaPCPt289P6gsb//VAfGnTmj/V4ds/2/+9/4Pv3JM/K+/1i9+Gi8dEz8fE782ZPyFq78b+Nydx1862v5kmN//rSHjf/rX7SPLhgMAo9Pe2l5daDTqGxIS5z+R/5c9B9Xom/jWWcWaiP5FP3+te00fKsqyJ4o1qMd4FrNuwHlwcNFHxH9HXRkAAAAAAAAAAAAAAKCvs/iLpVG3EQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIvr/wEAAP//Rb3T2A==") r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r1 = fspick(r0, &(0x7f0000000000)='.\x00', 0x0) r2 = dup(r1) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x11, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES8=r0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) process_vm_writev(r4, &(0x7f0000000180)=[{&(0x7f0000000240)=""/133, 0xfffffffffffffcc2}], 0x1, &(0x7f0000000940), 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="199d64d10221e1774393bd612c6aefe79323a4b4bdc33d96c3d065321d20e2ed6708f8d59e45"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000740), 0x1, r5}, 0x38) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='kfree\x00', r6, 0x0, 0x2}, 0x18) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r7, 0x0, 0x4}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000200)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) inotify_init1(0x800) r8 = mq_open(&(0x7f0000001600)='eth0\x00#~\x02\x00\x00\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfd\x05\x00\x00\x00\x00\x00\x80\x00\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94uu_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18A\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x05\x00\x00\x000\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xce\x00\x00\x00\xe8\vq+\xbb\xc7\xaf\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) mq_timedsend(r8, 0x0, 0x0, 0x6, 0x0) mq_timedreceive(r8, &(0x7f000001d600)=""/102389, 0x18ff5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r9, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f0000000a40)=ANY=[], 0x0) 3.486007489s ago: executing program 2 (id=953): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r1, @ANYBLOB="0500060001000000050007d60500000005000300df00000008000200", @ANYRES64=r0], 0x68}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r2, 0x0, &(0x7f0000001700)=""/53}, 0x20) r3 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r4, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(r4, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{r5}], 0x1, 0x0, &(0x7f0000000080)={[0x8001a0efffffff]}, 0x8) dup2(r4, r5) tkill(r3, 0x13) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0xffffffffffffffff) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r6, 0x0) syz_emit_ethernet(0x5a, &(0x7f0000000480)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x24, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@synack={0x1e, 0x10, 0xc, 0x2, 0x4, 0x7, 0x23}]}}}}}}}}, 0x0) 1.847770899s ago: executing program 4 (id=993): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r0, 0x0, 0x4}, 0x18) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x20d00, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) acct(&(0x7f0000000040)='./file0\x00') 1.633338451s ago: executing program 4 (id=994): bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x39) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000cc0)='kmem_cache_free\x00', r0}, 0x18) syz_open_dev$loop(0x0, 0x81, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./file1\x00', 0x810, &(0x7f0000000140)=ANY=[@ANYRES8=0x0, @ANYRES32], 0x1, 0x256, &(0x7f0000000bc0)="$eJzs2s9rHGUYB/Bn0takqclG/EUL4ose1MvQ5OyhQVoQA4o2QhWkUzPRJeNuyCyBFaE56dWjR8/i0YMgSI9ecvEv6MFbLjn2II6ku9ZtE0sx224pn89lH3jmu/sM8zI8h91789svNtbrfL3oxVSWxdSF2IlbWSzEVPxjJ9547cpvL31w5aN3lldWLr6f0qXly4tLKaX5l3/9+KsfX7nRO/PhT/O/TMfuwid7+0t/7L6we3bvr8uft+vUrlOn20tFutbt9oprVZnW2vVGntJ7VVnUZWp36nLrrv561d3c7KeiszY3u7lV1nUqOv20UfZTr5t6W/1UfFa0OynP8zQ3GxzH6g+3mib2m1NXo2ma09/HmRsxdzNakT2TsmcvZM9fzV7cyc5+Nz3pQXlIHuj57zdNa9KD8lCMvNRnIqpvtle3Vwefg/7yerSjijLORyv+jINjMjSoL729cvF8um0hvq6uD/PXt1dPDPIxzC9GKxaOzi8O8unu/HTMjv7+UrTiuaPzS0fmZ+L1V0fyebTi90+jG1WsxUH2Tv7niEhvvbtyT/7c7esAAJ40ebrj0P5286Cf/1d/kL/ffjgTESP74T371ck4d3LSd0/d/3KjqKpySzG+4uDwPwZjTKg4dZz46eG5vM81Tx9uTcV4hn/qeN8zP6Yxxlec+P/xCb+YeCT+feiHe9kkBgIAAAAAAAAAAOCBPIo/IU76HgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgMfb3wEAAP//R7zIZg==") openat(0xffffffffffffff9c, 0x0, 0x105142, 0x2c) r2 = creat(&(0x7f0000000380)='./file1\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x1000f4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x4) fallocate(r3, 0x1, 0x13, 0xfffe) socket$nl_audit(0x10, 0x3, 0x9) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000580)='kmem_cache_free\x00', r5}, 0x18) syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./file2\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x6, 0x36e, &(0x7f00000007c0)="$eJzs3U1oM0UYwPEnaZImeXmbHERRkA6+CHpZ2uhZDNKCELC0jdgKwrbdaMialGyoRsS2J4+Kd0+Ch9KbBQ8F7VnoxZteRPDWi6BgBXVlv5LNV9PGpMH2/4OSycw8uzPZSXk27WYv3vj03UrJ0kp6Q6JJJRERkUuRrEQlEPEfo245IfLJd622A3n+wW8/PL22UUx6FWo5v/5CTik1N//Nex+m/G6ns3Kefevi19wv54+fP3nxz/o7ZUuVLVWtNZSutmo/NfQt01A7ZauiKbViGrplqHLVMupe+1f+dsza7m5T6dWdh+ndumFZSq82VcVoqkZNNepNpb+tl6tK0zT1MC0Ypni0uqrnRwzeHvNgMCH1el6fEZFUT0vxaCoDAgAAU9Wd/0edlH5Y/h/Syv83Za5QWFpVTud2/n/8zFnjwesnc37+f5rol/+/+KO3rY783zmdaOf/Ne/8oDQ8//9cbpD/92ZE98vI+X92AoPBaOYTPVWRjmdO/p/237+uwzePF9wC+T8AAAAAAAAAAAAAAAAAAAAAAP8Hl7adsW07EzwGP+1LCPznuJMGHf9ZEUk6R9/m+N9laxubknQv3HOOsfnxXnGv6D36Hc5ExBTjb7ubszaCK4+UIyvfmvt+/P5eccZtyZek7MTLomQk666nULxtL79aWFpUHj++dZlSOhyfk4w8Fo7/2l2dTnyuM97ff0KeexSK1yQj329LTUzZcSPb+/9oUalXXit0xafcfiLy860fFAAAAAAAxkxTLX3P3zVtULv3LSP5kvsxkSELkpG/+p/fL/Q9P49lnopNe/YAAAAAANwPVvODii5Ro+4WTLNfISUDm8ZQiHXUxEWkb+dEV038qi3PhGZ43fEkxLuDyX+d1xfBq3qTqOAfKZyBt5r8O6rIaOMJ5u/WRGLP/u43/XnTeUUOxF0AB+GmqFwjPNY9+HmnQvXt/Gjgdg79ibRqgo+NEgNeZ1np3U70ipUQ76mxI6MtgCc++/KP8b1BXjrxV8D7wzsfmoa9L9c5KF0FZxe9TfGJ/+IBAAAAcOvaSX9Q83K4OXwjkfDNcvjLPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYzSRr/TrKgze++xtThUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYun8DAAD//7ct9c4=") r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x105142, 0x2c) mmap$IORING_OFF_SQ_RING(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x100000b, 0x2013, r6, 0x0) r7 = syz_open_procfs(0x0, 0x0) pread64(r7, 0x0, 0x0, 0xb6) setsockopt$inet_mreqn(r1, 0x0, 0x24, 0x0, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1801000001ffffeb00000000eb658e0d850000007b000000"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r8}, 0x18) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2060, 0x0) 1.265605943s ago: executing program 0 (id=995): r0 = bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x18) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vxcan0\x00'}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r0}, 0x4) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x2008002, &(0x7f0000000340), 0x1, 0x564, &(0x7f0000000c00)="$eJzs3c9vHFcdAPDvjH82SesEeoAKSIBCQFF2400bVb20XECoqoSoOCAOqbE3lsluNmTXpTaRcP8GkEDiBH8CByQOSD1xgBNHJA6AKAekAhEoRuph0MyO7Y29Jou93iXez0eazI83M9/3djPz3r5dzwtgYl2KiK2ImI2INyNiodyelFO82p3y/R4+uL+8/eD+chJZ9sbfkyI93xY9x+TOluecj4ivfinim8nBuO2NzdtLjUb9Xrle7TTvVtsbm1fXmkur9dX6nVrtxuKNay9df7E2tLJebP7s/S+uvfa1X/7i4+/9duvz382zda5M6y3HMHWLPrMbJzcdEa+dRLAxmCrns2POB0eTRsSHIuJTxfW/EFPF/04A4DTLsoXIFnrXAYDTLi36wJK0EhFpWjYCKt0+vGfjTNpotTtXbrXW76x0+8rOx0x6a61Rv3Zh7vffLnaeSfL1xSKtSC/Wa/vWr0fEhYj4wdxTxXpludVYGU+TBwAm3tne+j8i/jWXppXKQIf2+VYPAHhizI87AwDAyKn/AWDyqP8BYPIMUP+XX/ZvnXheAIDR8PkfACaP+h8AJo/6HwAmyldefz2fsu3y+dcrb22s3269dXWl3r5daa4vV5Zb9+5WVlut1eKZPc3Hna/Rat1dfCHW36526u1Otb2xebPZWr/TuVk81/tmfWYkpQIA/psLF9/9XRIRWy8/VUzRM5aDuhpOt3SIewFPlqnjHKyBAE80o33B5BqoCi8aCb8+8bwA49H3Yd7zfRcf9aP/IYjfGcH/lcsfHbz/3xjPcLrs69n/IBtXRoCRO1r//ytDzwcwekfu///jcPMBjF6WJfvH/J/dTQIATqVj/IQv+96wGiHAWD1uMO+hfP8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp8y5iPhWJGmlGAs8zf9NK5WIpyPifMwkt9Ya9WsR8UxcjIiZuXx9cdyZBgCOKf1rUo7/dXnh+XP7U2eTf88V84j4zo/f+OHbS53OvcV8+z92t8/tDB9W2zvuGOMKAgCD+/MgOxX1d62c93yQf/jg/vLOdIJ5POD9L+wOPrq8/eB+MXVTpiPLsixivmhLnPlnEtPlMfMR8VxETA0h/tY7EfGRfuVPir6R8+XIp73xo4z99Ejjp4/ET4u07jx/+T48hLzApHk3v/+82u/6S+NSMe9//c8Xd6jjK+5/8xE7977tnvjTZaSpPvHza/7SoDFe+NWXD2zMFrpp70Q8N90vfrIbPzkk/vMDxv/Dxz7x/VcOSct+EnE5+sfvjVXtNO9W2xubV9eaS6v11fqdWu3G4o1rL11/sVYt+qirOz3VB/3t5SvPHJa3vPxnDonffefP7iv/7O6xnxmw/D/94M1vfHJvdW5//M99uv/7/2wRsf/rn9eJnx0w/tKZnx86fHcef+WQ8j/u/b8yYPz3/rK5MuCuAMAItDc2by81GvV7x1rIP4UO4zwHFvIsDrbzTnPxeEH/FMXC3suSRBJHPuFM/6S8MTbQ4Sf1qp74wvRuW3G4Z/56fsYRFycdeimOshDny4WHowo6vnsSMBp7F31E/GbcuQEAAAAAAAAAAAAAAPoZxd8wjbuMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnF7/CQAA///bV8Ru") mknod(&(0x7f0000000200)='./bus\x00', 0x8000, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) 1.265198603s ago: executing program 1 (id=996): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800"], 0x48) r1 = memfd_create(&(0x7f0000000100)='\vem\xda\x99R@m\xfc\xfe\x9b#*\xff', 0x0) write(r1, &(0x7f0000000040)="0600", 0x2) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4044050}, 0x10000000) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r1, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYRESHEX=r0], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r3}, 0x18) r4 = semget$private(0x0, 0x20000000102, 0x0) semop(r4, &(0x7f0000000240)=[{0x3, 0x0, 0x1800}], 0x1) 976.757244ms ago: executing program 3 (id=998): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000600)=ANY=[], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000480)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r0, 0x0, 0x7}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffffc}, 0x18) add_key(&(0x7f00000001c0)='ceph\x00', 0x0, &(0x7f0000000840)='\x00\x00\x00\x00\x00\x00\x00\x00\x00*\x00\x00', 0xc, 0xffffffffffffffff) 936.219165ms ago: executing program 3 (id=999): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000010"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r1}, 0x10) getpgrp(0x0) 871.944275ms ago: executing program 3 (id=1000): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, 0x0}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r1, 0x0, 0xffff}, 0x18) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r3, 0x0) syz_emit_ethernet(0x5a, &(0x7f0000000480)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x24, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@synack={0x1e, 0x10, 0xc, 0x2, 0x4, 0x7, 0x23}]}}}}}}}}, 0x0) 871.344705ms ago: executing program 3 (id=1001): gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000086"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000000000000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x4008032, 0xffffffffffffffff, 0xd06d000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_open_dev$vcsa(&(0x7f0000000000), 0x7, 0x10001) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x503, 0x0, 0xfffffbfc, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x4000) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) 736.010706ms ago: executing program 0 (id=1002): r0 = socket(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000380)={0x1b, 0x0, 0x0, 0x2, 0x0, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x50) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x7a, 0x7a, 0x6, [@datasec={0x3, 0x8, 0x0, 0xf, 0x2, [{0x1, 0x8001, 0x3}, {0x3, 0x1, 0x4}, {0x3, 0x6, 0xfffffffb}, {0x2, 0x9}, {0x4, 0x2, 0xd}, {0x4, 0x8, 0x1}, {0x1, 0x5, 0x5}, {0x1, 0xc00000, 0x9}], "32ed"}, @fwd={0xd}]}, {0x0, [0x5f, 0x61, 0x30, 0x30]}}, &(0x7f0000000640)=""/238, 0x9a, 0xee, 0x1, 0x101}, 0x28) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000800)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x14, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x42, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x12, 0x11, &(0x7f0000000ac0)=ANY=[@ANYBLOB="c5874cd9142070775a3f477513c88772ce1a0a2d9beb89ba4fb207718baa22ab98a9834cb4f2c5210f1e421aaee018c259473c12e7a157e89dc6b5042f96e67cfec9e851f7958f5a802caea295968bd0808b2ee7af9bf5da9b5979f6e92f16bf2ca6", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000186900000d0000000000000001000000bf91000000000000b7020000020000008500000085000000b7000000000000009500000000000000"], &(0x7f00000002c0)='syzkaller\x00', 0x61aa212a, 0xa9, &(0x7f00000004c0)=""/169, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x31, r2, 0x8, &(0x7f0000000780)={0x4, 0x3}, 0x8, 0x10, &(0x7f00000007c0)={0x5, 0xb, 0x2000, 0x7}, 0x10, 0xffffffffffffffff, r3, 0x2, &(0x7f0000000840)=[r4], &(0x7f0000000880)=[{0x1, 0x2, 0x8, 0x4}, {0x4, 0x5, 0x3, 0x4}], 0x10, 0x40}, 0x94) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r6, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a803f0003"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d00)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180100000100a7d9000000000020b200850000007b00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000006"], 0x48) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800e00010069703665727370616e0000002000028006000200300000001400060000000000000000000000ffff7f00000108000a00", @ANYRESOCT], 0x5c}}, 0x0) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000001c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r10}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r3, &(0x7f0000000480)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000bc0)={0x88, r8, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x854}, 0x80) socket$nl_route(0x10, 0x3, 0x0) 633.961876ms ago: executing program 1 (id=1003): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000780)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x20, 0x7ffc1ffb}]}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='kmem_cache_free\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) rename(0x0, &(0x7f0000000140)='./bus/file0\x00') 616.762657ms ago: executing program 1 (id=1004): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r2, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f0000000a40)=ANY=[], 0x0) 560.819527ms ago: executing program 1 (id=1005): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) r2 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0x17, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x1) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[], 0x48}}, 0x0) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000005c0)='fd', 0x0, 0xffffffffffffffff) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="a80000001200080029bd7000fbdbdf25010300084e234e22010000000a000000750000000700000006000000080200000004000168ebfffff58a9f75ad3ea5c419a2f650772c24c300", @ANYRES32, @ANYBLOB="09000000f9ffffff0c000000ba0c0000580001003160cf8228b3c21869bc1e293e2b782c69836972b1b37c99054afadcd76ced199a654b84fb3eb69e2df6abc426d824caadc7441aeb057c485f95ea61816acf247da86bd365ecfc49004e6db5040001000000000000000000"], 0xa8}, 0x1, 0x0, 0x0, 0x80}, 0x40000) r5 = fsmount(r2, 0x0, 0x2) openat(r5, &(0x7f00000002c0)='./bus\x00', 0x289c2, 0x1) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xf, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000001000000181100", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000800008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00', r6}, 0x10) rseq(&(0x7f0000000300), 0x20, 0x0, 0x0) sigaltstack(0x0, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, &(0x7f0000000100), 0xff, 0x4a1, &(0x7f00000004c0)="$eJzs3MtvVFUYAPDvTh+8aUVEQdAqGomPlhZUFi7UaOJCExNd4LK2BZGBGloTIY0WY3BpSNwblyb+Be7cGHVhTNxq4tKQEG1MKK5q7gum02mZlpYpnd8vmc45c1/nu+eemXPv6b0BtK2+9E8SsT0ifo+Injw7f4a+/G12Zmrk+szUSBJzc2/9nWTzXZuZGilnLZfbVmQOVSIqnyXxYrJwuxPnL5werlbHzhX5gckzHwxMnL/wzKkzwyfHTo6dHTp27OiRweefG3p2VeJM47q27+Px/Xtfe+fyGyPHL7/707dpsfYcyKfXxnFL1xsE1EBfutf+mcvUT3t8GWW/G+yoSSedLSwIy9IREWl1dWXtvyc64mbl9cSrn7a0cMCaSn+bNi0+eXoO2MCSaHUJgNYof+jT89/ydYe6HuvC1Zciuov07MzUyOyN+DujUnzetYbb74uI49P/fZW+YrnXIQAAViDr2zzdqP9XiT3Zez7WsbMYQ+mNiHsiYldE3BsRuyPivohs3vujOx7IF57raXL7fXX5hf2fypWGZV4laf/vhZq+32xN/MVbb0eR25HF35WcOFUdO1zsk0PRtSnNDy6xje9f+e2LxabV9v/SV7r9si9YFOBKZ90FutHhyeHV2glXL0bs62wUf3JjJCA9AvZGxL7lrXpnmTj15Df7F5vp1vEvYRXGmea+jngir//pqIu/lCw9PjmwOapjhwfKo2Khn3+99GaR7K6fdlvxr4K0/rfOP/6LKReL955/k3y8tiuq1bFzE8vfxqU/Pl/0nGalx3938nY2Zv3Le/lnHw1PTp4bjOhOXs/y5Y7OPh+6uWyZL+dP4z90sHH731Usk8b/YESkB/GBiHgoIh4uyv5IRDwaEQeXiP/Hlx97f4n4k0iipfU/2vD7L4nYnCV6k9rx+hUkOk7/8N1iI+bN1f/RmM6+a3PZ998tNFvA29+DAAAAsP5VImJ7JJX+PN23PSqV/v78f/h3x9ZKdXxi8qkT4x+eHc3vEeiNrkp5paun5nroYDJdrDHPDxXXisvpR4rrxl92bMny/SPj1dEWxw7tbtv89h9l+0/91dHq0gFrzv1a0L7q23+lReUA7rxmfv+dC8DG1KD9b2lFOYA7z/k/tK9G7f+Turz+P2xMC9v/nw0eWQdsRPr/0L60f2hf2j+0pWbv4i+fp7DihwDMS5Q3C6x8PZubvsN//SX61mTNZQ2tZeG3xM1PorJqa55eB5WyzhNpi1nJ4rGz+WdhzE80eFgNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAXej/AAAA//+q8eIl") writev(r0, &(0x7f00000025c0)=[{&(0x7f0000000240)='4', 0x1}], 0x1) 407.360468ms ago: executing program 0 (id=1006): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000007c0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r0}, 0x10) getpgrp(0x0) 407.125788ms ago: executing program 2 (id=1007): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff0000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x76bf}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000005a40)=ANY=[@ANYBLOB="b400000010000904000000000000000000002200", @ANYRES32=0x0, @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200367da1650e000000280003800c00010001800000002000000c000100a1000000c84200000c0001000800000008000000340004800c00010006000000ff0300000c00010004000000080000000c00010004000000020000000c000100050000000300000008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRESOCT], 0xb4}}, 0x0) 406.419068ms ago: executing program 3 (id=1008): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000800)=@generic={&(0x7f00000006c0)='./file1\x00'}, 0x18) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES8=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007240000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) clock_settime(0x0, &(0x7f0000000240)={0x77359400}) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000180)='sys_enter\x00', r3}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0xc, &(0x7f0000000880)=ANY=[], &(0x7f0000000840)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='kfree\x00', r5}, 0x18) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000f7850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r8}, 0x10) connect$netlink(r7, &(0x7f0000000280)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x0, &(0x7f0000000380), 0x1, 0x2cb, &(0x7f00000003c0)="$eJzs3T1rm0cAB/Cr7NpFxS9ToV16tEu7PLjuF6goNpgKWlwrJBkCj/HjREiRjB5BJJPBe5bs+QYmY7ZAyBcw5ENk8xI8eYqCLcdvccgQ5Aej3w/E/eGP4I7jxC3i9m8/fdjYzJPNtBtKf8UwGUIoHYYwH0phIgx9czKWjvNUOG8n/F5+8+zJ/3fu/lOpVpdWY1yurP25GGOc/fnVo8fPf3nd/f7Wi9mX02Fv/t7+u8W3ez/s/bj/fu1BPY/1PLba3ZjG9Xa7m643s7hRzxtJjP81szTPYr2VZ50L/WazvbXVj2lrY6a81cnyPKatfmxk/dhtx26nH9P7ab0VkySJM+XAl9R2V1fTStGzYLQ6nUp6dIanP2lqu4VMCAAolPv/OHP/HwdH9/+pk/N7kfs/AAAAAAAAAAAAAADcBIeDwdxgMJj7OF7+FD0/Rsv+jzf7P97s/3g798fd70I42OnVerXhOOyXV6pLC/HY/Nm3Dnq92sRp/8ewjxf7b0P5pF+8sp8Kv/067I+6v/+tXuqnw8bolw8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAx5J46sr3/ZPkc/0wLa9UlxaufN9/Mvw0eW3LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICvkve3G2mzmXUEQRBOQ9G/TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHD9zh79LnomAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFCnvbzfSZjPrjDAUvUYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvoQwAAAP//jsgAew==") sendmsg$nl_route(r7, &(0x7f0000000300)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000021000f0000f901000000000002"], 0x1c}}, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$packet(0x11, 0xa, 0x300) socket$packet(0x11, 0xa, 0x300) socket$packet(0x11, 0xa, 0x300) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00'}, 0x18) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x1c, r9, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4008084}, 0x0) syz_io_uring_setup(0x10d4, &(0x7f0000000000)={0x0, 0x7f36, 0x0, 0x7fff, 0x34f}, &(0x7f00000000c0), &(0x7f0000000080)) 323.047968ms ago: executing program 4 (id=1009): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0xff, 0x7ffc1ffd}]}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=@newtfilter={0x70, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xa, 0x7}, {}, {0xc, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x40, 0x2, [@TCA_CGROUP_EMATCHES={0x3c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x2c, 0x1, 0x0, 0x0, {{0xe34, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0xa}, @TCA_EM_IPT_MATCH_DATA={0x4}]}}]}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x880}, 0x40010) 269.190509ms ago: executing program 0 (id=1010): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000600)=ANY=[], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000480)=ANY=[@ANYBLOB], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r0, 0x0, 0x7}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffffc}, 0x18) add_key(&(0x7f00000001c0)='ceph\x00', 0x0, &(0x7f0000000840)='\x00\x00\x00\x00\x00\x00\x00\x00\x00*\x00\x00', 0xc, 0xffffffffffffffff) 268.615329ms ago: executing program 0 (id=1011): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000010"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r1}, 0x10) getpgrp(0x0) 262.271579ms ago: executing program 2 (id=1012): prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') prctl$PR_SET_NAME(0xf, &(0x7f0000000040)='$}&\xab$-\\@^\x00') bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000080)={0xfffffffd, 0x0}, 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r3], 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r4}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000640)=ANY=[@ANYBLOB="14000000100001000c000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x2000c080}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000020000380100000800c00018006000100d10300000c000080080003400000000214000000110001"], 0xb0}}, 0x40) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r2) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="02000000040000000400000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xc, 0x4, 0x4, 0x7, 0x0, r7, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x80}, 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x9, 0xc, &(0x7f0000000680)=ANY=[@ANYRESOCT=r1], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000000)='timer_start\x00', r8}, 0x18) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000080) sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000000000100000000000000000850000007d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f00000003c0)='kmem_cache_free\x00', r9}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) io_setup(0x8f0, &(0x7f0000002400)=0x0) io_submit(r11, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2000000000, 0x4, 0x0, 0x1, 0x0, r10, &(0x7f0000000040)="0200ffff0000", 0x6, 0x0, 0x0, 0x2}]) 220.256549ms ago: executing program 0 (id=1013): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800"], 0x48) r1 = memfd_create(&(0x7f0000000100)='\vem\xda\x99R@m\xfc\xfe\x9b#*\xff', 0x0) write(r1, &(0x7f0000000040)="0600", 0x2) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4044050}, 0x10000000) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r1, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYRESHEX=r0], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r3}, 0x18) r4 = semget$private(0x0, 0x20000000102, 0x0) semop(r4, &(0x7f0000000240)=[{0x3, 0x0, 0x1800}], 0x1) 219.693569ms ago: executing program 4 (id=1014): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000780)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x20, 0x7ffc1ffb}]}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='kmem_cache_free\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) rename(0x0, 0x0) 190.320839ms ago: executing program 1 (id=1015): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec85"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r0, 0x0, 0x4}, 0x18) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x20d00, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) acct(&(0x7f0000000040)='./file0\x00') 168.052149ms ago: executing program 4 (id=1016): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) io_setup(0x8f0, &(0x7f0000002400)=0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) io_submit(r1, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2000000000, 0x4, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)="0200ffff0000", 0x6, 0x0, 0x0, 0x2}]) 127.742909ms ago: executing program 1 (id=1017): r0 = socket(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000380)={0x1b, 0x0, 0x0, 0x2, 0x0, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x50) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x7a, 0x7a, 0x6, [@datasec={0x3, 0x8, 0x0, 0xf, 0x2, [{0x1, 0x8001, 0x3}, {0x3, 0x1, 0x4}, {0x3, 0x6, 0xfffffffb}, {0x2, 0x9}, {0x4, 0x2, 0xd}, {0x4, 0x8, 0x1}, {0x1, 0x5, 0x5}, {0x1, 0xc00000, 0x9}], "32ed"}, @fwd={0xd}]}, {0x0, [0x5f, 0x61, 0x30, 0x30]}}, &(0x7f0000000640)=""/238, 0x9a, 0xee, 0x1, 0x101}, 0x28) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000800)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x14, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x42, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x12, 0x11, &(0x7f0000000ac0)=ANY=[@ANYBLOB="c5874cd9142070775a3f477513c88772ce1a0a2d9beb89ba4fb207718baa22ab98a9834cb4f2c5210f1e421aaee018c259473c12e7a157e89dc6b5042f96e67cfec9e851f7958f5a802caea295968bd0808b2ee7af9bf5da9b5979f6e92f16bf2ca6", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000186900000d0000000000000001000000bf91000000000000b7020000020000008500000085000000b7000000000000009500000000000000"], &(0x7f00000002c0)='syzkaller\x00', 0x61aa212a, 0xa9, &(0x7f00000004c0)=""/169, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x31, r2, 0x8, &(0x7f0000000780)={0x4, 0x3}, 0x8, 0x10, &(0x7f00000007c0)={0x5, 0xb, 0x2000, 0x7}, 0x10, 0xffffffffffffffff, r3, 0x2, &(0x7f0000000840)=[r4], &(0x7f0000000880)=[{0x1, 0x2, 0x8, 0x4}, {0x4, 0x5, 0x3, 0x4}], 0x10, 0x40}, 0x94) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r6, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a803f0003"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d00)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180100000100a7d9000000000020b200850000007b00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000006"], 0x48) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800e00010069703665727370616e0000002000028006000200300000001400060000000000000000000000ffff7f00000108000a00", @ANYRESOCT], 0x5c}}, 0x0) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000001c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r10}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r3, &(0x7f0000000480)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000bc0)={0x88, r8, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x854}, 0x80) socket$nl_route(0x10, 0x3, 0x0) 107.656429ms ago: executing program 2 (id=1018): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r1, @ANYBLOB="0500060001000000050007d60500000005000300df00000008000200", @ANYRES64=r0], 0x68}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r2, 0x0, &(0x7f0000001700)=""/53}, 0x20) r3 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r4, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(r4, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{r5}], 0x1, 0x0, &(0x7f0000000080)={[0x8001a0efffffff]}, 0x8) dup2(r4, r5) tkill(r3, 0x13) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0xffffffffffffffff) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r6, 0x0) syz_emit_ethernet(0x5a, &(0x7f0000000480)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x24, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@synack={0x1e, 0x10, 0xc, 0x2, 0x4, 0x7, 0x23}]}}}}}}}}, 0x0) 46.60468ms ago: executing program 3 (id=1019): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x6, 0x19, &(0x7f0000000d40)=ANY=[@ANYBLOB="180000000100000000000000ed05000095000000000000007c04f8ff100000009854f6fffcffffff18120000", @ANYRES32, @ANYBLOB, @ANYRES32=0x1, @ANYBLOB="0000000100000000e9d7e138087107000000c0530000858200eaa400e1ff840000001000233757f8777e1493980d0000765b5175293f670129eeda08d47078be5bb22f78bdaaf4c0b8f7a56d1409afc74e7327cb0fa797007d639bafd52de7549c0d09bbc071d5ddc157c02f68cdf6514eaa003f5fdc4f19a38fce137298d88064b7e4466c05c6d2c833b26547"], &(0x7f0000000580)='syzkaller\x00', 0x8, 0xb0, &(0x7f00000005c0)=""/176, 0x41100, 0x1, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000680)={0x3, 0x3}, 0x8, 0x10, &(0x7f00000006c0)={0x5, 0x0, 0x3, 0xfffffffd}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000700)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff], &(0x7f0000000740)=[{0x2, 0x5, 0xa, 0x1}, {0x3, 0x3, 0x8}, {0x4, 0x3, 0x1, 0x2}, {0x5, 0x1, 0x0, 0x1}, {0xfffffffe, 0x4, 0x6, 0xa}, {0x4, 0x4, 0xe, 0x4}], 0x10, 0x9}, 0x94) r3 = signalfd(0xffffffffffffffff, &(0x7f0000000880)={[0x5b2b]}, 0x8) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000980)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000900), &(0x7f0000000940)='%pS \x00'}, 0x20) sendmsg$inet(r1, &(0x7f0000000d00)={&(0x7f0000000b80)={0x2, 0x4e23, @broadcast}, 0x10, &(0x7f0000000c80)=[{&(0x7f0000000f40)="954816962e49aed59cc68855b80be7f02935fd49192cc7b0eeed35ad21b9eda9538c91cd7d0e8705457f6d937f2ead31a359d359d8f4621fe6da3d636652affad87a63522322f4a0e249c7b81c29949c909212570bf60f2deb6fd6ebb90f8e2512acd9a88e472fa853c81b3556bde8cb509781802364a184b3745f88cffa905ec198ee03099466c62d40ac04a976bda4014abb64f5e2d76b2e4d11fc3a10d24ad03405939a59a5f3e80f3ca7", 0xac}], 0x1, &(0x7f0000000cc0)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x8}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x3cc}}], 0x30}, 0x800) r6 = signalfd4(0xffffffffffffffff, &(0x7f00000009c0), 0x8, 0x180000) bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x7, 0xb, &(0x7f0000000e80)=ANY=[@ANYBLOB="18650000000000000000000002000000185100000800000000000000000000008520000003000000061681000200000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7030000000000008500000087070000b7000000000000004ac22f2c8ff65c35fef876c1e0889c4831dd7b13645ca126b91ac586d7eebaacaaec972fa8e611601d8e1219823196f15f9d1ef8a760"], &(0x7f0000000140)='GPL\x00', 0xed40, 0xe5, &(0x7f0000000380)=""/229, 0x41100, 0x72, '\x00', 0x0, @fallback=0x19, r1, 0x8, &(0x7f00000002c0)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000000300)={0x0, 0xe, 0xfffffffe, 0x5}, 0x10, 0xffffffffffffffff, r2, 0x7, &(0x7f0000000a00)=[r3, r5, r4, r5, r6], &(0x7f0000000a40)=[{0x4, 0x5, 0x7, 0x2}, {0x2, 0x2, 0x5}, {0x0, 0x5, 0x4}, {0x3, 0x2, 0x4, 0x2}, {0x2, 0x2, 0x8, 0x6}, {0x4, 0x3, 0x3, 0x3}, {0x1, 0x2, 0x7, 0x3}], 0x10, 0x8}, 0x94) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) dup(r7) open_tree(0xffffffffffffff9c, &(0x7f0000001700)='./file0\x00', 0x89901) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r8 = getpid() sched_setscheduler(r8, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYRESOCT=0x0], 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x44004) mount(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x2014800, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x8, 0x3, 0x590, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x4c0, 0xffffffff, 0xffffffff, 0x4c0, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x81, 0x0, 0x24, 0x0, 'syz1\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x298, 0x300, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x1, 0x1, 0x0, 'syz1\x00'}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5f0) 0s ago: executing program 4 (id=1020): bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x39) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000cc0)='kmem_cache_free\x00', r0}, 0x18) syz_open_dev$loop(0x0, 0x81, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./file1\x00', 0x810, &(0x7f0000000140)=ANY=[@ANYRES8=0x0, @ANYRES32], 0x1, 0x256, &(0x7f0000000bc0)="$eJzs2s9rHGUYB/Bn0takqclG/EUL4ose1MvQ5OyhQVoQA4o2QhWkUzPRJeNuyCyBFaE56dWjR8/i0YMgSI9ecvEv6MFbLjn2II6ku9ZtE0sx224pn89lH3jmu/sM8zI8h91789svNtbrfL3oxVSWxdSF2IlbWSzEVPxjJ9547cpvL31w5aN3lldWLr6f0qXly4tLKaX5l3/9+KsfX7nRO/PhT/O/TMfuwid7+0t/7L6we3bvr8uft+vUrlOn20tFutbt9oprVZnW2vVGntJ7VVnUZWp36nLrrv561d3c7KeiszY3u7lV1nUqOv20UfZTr5t6W/1UfFa0OynP8zQ3GxzH6g+3mib2m1NXo2ma09/HmRsxdzNakT2TsmcvZM9fzV7cyc5+Nz3pQXlIHuj57zdNa9KD8lCMvNRnIqpvtle3Vwefg/7yerSjijLORyv+jINjMjSoL729cvF8um0hvq6uD/PXt1dPDPIxzC9GKxaOzi8O8unu/HTMjv7+UrTiuaPzS0fmZ+L1V0fyebTi90+jG1WsxUH2Tv7niEhvvbtyT/7c7esAAJ40ebrj0P5286Cf/1d/kL/ffjgTESP74T371ck4d3LSd0/d/3KjqKpySzG+4uDwPwZjTKg4dZz46eG5vM81Tx9uTcV4hn/qeN8zP6Yxxlec+P/xCb+YeCT+feiHe9kkBgIAAAAAAAAAAOCBPIo/IU76HgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgMfb3wEAAP//R7zIZg==") openat(0xffffffffffffff9c, 0x0, 0x105142, 0x2c) r2 = creat(&(0x7f0000000380)='./file1\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x1000f4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x4) fallocate(r3, 0x1, 0x13, 0xfffe) socket$nl_audit(0x10, 0x3, 0x9) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000580)='kmem_cache_free\x00', r5}, 0x18) syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./file2\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x6, 0x36e, &(0x7f00000007c0)="$eJzs3U1oM0UYwPEnaZImeXmbHERRkA6+CHpZ2uhZDNKCELC0jdgKwrbdaMialGyoRsS2J4+Kd0+Ch9KbBQ8F7VnoxZteRPDWi6BgBXVlv5LNV9PGpMH2/4OSycw8uzPZSXk27WYv3vj03UrJ0kp6Q6JJJRERkUuRrEQlEPEfo245IfLJd622A3n+wW8/PL22UUx6FWo5v/5CTik1N//Nex+m/G6ns3Kefevi19wv54+fP3nxz/o7ZUuVLVWtNZSutmo/NfQt01A7ZauiKbViGrplqHLVMupe+1f+dsza7m5T6dWdh+ndumFZSq82VcVoqkZNNepNpb+tl6tK0zT1MC0Ypni0uqrnRwzeHvNgMCH1el6fEZFUT0vxaCoDAgAAU9Wd/0edlH5Y/h/Syv83Za5QWFpVTud2/n/8zFnjwesnc37+f5rol/+/+KO3rY783zmdaOf/Ne/8oDQ8//9cbpD/92ZE98vI+X92AoPBaOYTPVWRjmdO/p/237+uwzePF9wC+T8AAAAAAAAAAAAAAAAAAAAAAP8Hl7adsW07EzwGP+1LCPznuJMGHf9ZEUk6R9/m+N9laxubknQv3HOOsfnxXnGv6D36Hc5ExBTjb7ubszaCK4+UIyvfmvt+/P5eccZtyZek7MTLomQk666nULxtL79aWFpUHj++dZlSOhyfk4w8Fo7/2l2dTnyuM97ff0KeexSK1yQj329LTUzZcSPb+/9oUalXXit0xafcfiLy860fFAAAAAAAxkxTLX3P3zVtULv3LSP5kvsxkSELkpG/+p/fL/Q9P49lnopNe/YAAAAAANwPVvODii5Ro+4WTLNfISUDm8ZQiHXUxEWkb+dEV038qi3PhGZ43fEkxLuDyX+d1xfBq3qTqOAfKZyBt5r8O6rIaOMJ5u/WRGLP/u43/XnTeUUOxF0AB+GmqFwjPNY9+HmnQvXt/Gjgdg79ibRqgo+NEgNeZ1np3U70ipUQ76mxI6MtgCc++/KP8b1BXjrxV8D7wzsfmoa9L9c5KF0FZxe9TfGJ/+IBAAAAcOvaSX9Q83K4OXwjkfDNcvjLPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYzSRr/TrKgze++xtThUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYun8DAAD//7ct9c4=") r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x105142, 0x2c) mmap$IORING_OFF_SQ_RING(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x100000b, 0x2013, r6, 0x0) r7 = syz_open_procfs(0x0, 0x0) pread64(r7, 0x0, 0x0, 0xb6) setsockopt$inet_mreqn(r1, 0x0, 0x24, 0x0, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1801000001ffffeb00000000eb658e0d850000007b000000"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r8}, 0x18) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2060, 0x0) kernel console output (not intermixed with test programs): de [ 52.709906][ T3318] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 52.719986][ T4334] ip6gretap0: left promiscuous mode [ 52.832624][ T4356] netlink: 8 bytes leftover after parsing attributes in process `syz.0.205'. [ 52.871375][ T4356] ip6gretap0: entered promiscuous mode [ 52.916055][ T4356] ip6gretap0: left promiscuous mode [ 52.947306][ T4358] loop1: detected capacity change from 0 to 512 [ 53.099190][ T4365] lo speed is unknown, defaulting to 1000 [ 53.207613][ T4365] netlink: 12 bytes leftover after parsing attributes in process `syz.4.204'. [ 53.388590][ T4358] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e842c11c, mo2=0002] [ 53.417046][ T4358] System zones: 0-2, 18-18, 34-34 [ 53.422410][ T4372] loop0: detected capacity change from 0 to 2048 [ 53.423337][ T4374] loop2: detected capacity change from 0 to 512 [ 53.441518][ T4358] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.206: bg 0: block 248: padding at end of block bitmap is not set [ 53.456212][ T4374] EXT4-fs: Ignoring removed bh option [ 53.478173][ T4370] syzkaller0: entered allmulticast mode [ 53.484068][ T4370] syzkaller0: entered promiscuous mode [ 53.497403][ T4370] syzkaller0 (unregistering): left allmulticast mode [ 53.504385][ T4370] syzkaller0 (unregistering): left promiscuous mode [ 53.520945][ T4358] __quota_error: 362 callbacks suppressed [ 53.520963][ T4358] Quota error (device loop1): write_blk: dquota write failed [ 53.534253][ T4358] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 53.547266][ T4374] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 53.564027][ T4372] rdma_rxe: rxe_newlink: failed to add bond0 [ 53.570791][ T4374] ext4 filesystem being mounted at /35/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 53.581944][ T4358] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.206: Failed to acquire dquot type 1 [ 53.595555][ T4374] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000. [ 53.606219][ T4358] EXT4-fs (loop1): 1 truncate cleaned up [ 53.616639][ T29] audit: type=1326 audit(1762031918.784:1290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4373 comm="syz.2.210" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 53.640011][ T29] audit: type=1326 audit(1762031918.784:1291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4373 comm="syz.2.210" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 53.663489][ T29] audit: type=1326 audit(1762031918.784:1292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4373 comm="syz.2.210" exe="/root/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 53.668359][ T4358] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 53.686858][ T29] audit: type=1326 audit(1762031918.784:1293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4373 comm="syz.2.210" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 53.699433][ T4358] ext4 filesystem being mounted at /44/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 53.722618][ T29] audit: type=1326 audit(1762031918.784:1294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4373 comm="syz.2.210" exe="/root/syz-executor" sig=0 arch=c000003e syscall=240 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 53.756296][ T29] audit: type=1326 audit(1762031918.784:1295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4373 comm="syz.2.210" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 53.757543][ T4358] syz.1.206 (4358) used greatest stack depth: 9200 bytes left [ 53.779707][ T29] audit: type=1326 audit(1762031918.784:1296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4373 comm="syz.2.210" exe="/root/syz-executor" sig=0 arch=c000003e syscall=242 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 53.810560][ T29] audit: type=1326 audit(1762031918.784:1297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4373 comm="syz.2.210" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 53.901121][ T3318] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.936506][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.963103][ T4390] loop0: detected capacity change from 0 to 512 [ 54.025410][ T4402] netlink: 8 bytes leftover after parsing attributes in process `syz.2.219'. [ 54.045757][ T4402] ip6gretap0: entered promiscuous mode [ 54.055923][ T4402] ip6gretap0: left promiscuous mode [ 54.138241][ T4390] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 54.266822][ T4409] lo speed is unknown, defaulting to 1000 [ 54.457337][ T4390] ext4 filesystem being mounted at /38/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 54.565609][ T4415] netlink: 8 bytes leftover after parsing attributes in process `syz.2.223'. [ 54.585156][ T4390] EXT4-fs error (device loop0): ext4_do_update_inode:5632: inode #2: comm syz.0.217: corrupted inode contents [ 54.625277][ T4390] EXT4-fs error (device loop0): ext4_dirty_inode:6517: inode #2: comm syz.0.217: mark_inode_dirty error [ 54.637129][ T4419] loop4: detected capacity change from 0 to 512 [ 54.639171][ T4415] ip6gretap0: entered promiscuous mode [ 54.660130][ T4415] ip6gretap0: left promiscuous mode [ 54.668609][ T4390] EXT4-fs error (device loop0): ext4_do_update_inode:5632: inode #2: comm syz.0.217: corrupted inode contents [ 54.686223][ T4390] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #2: comm syz.0.217: mark_inode_dirty error [ 54.701926][ T4419] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 54.714732][ T4419] ext4 filesystem being mounted at /54/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 54.747663][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 54.759851][ T4425] loop3: detected capacity change from 0 to 512 [ 54.779078][ T4427] netlink: 8 bytes leftover after parsing attributes in process `syz.2.226'. [ 54.790032][ T3323] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 54.794271][ T4427] ip6gretap0: entered promiscuous mode [ 54.806866][ T4427] ip6gretap0: left promiscuous mode [ 54.833922][ T4429] loop0: detected capacity change from 0 to 512 [ 54.840942][ T4429] EXT4-fs: Ignoring removed bh option [ 54.911151][ T4429] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 54.913732][ T4425] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 54.939027][ T4429] ext4 filesystem being mounted at /39/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 54.970338][ T4429] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000. [ 54.979594][ T4425] ext4 filesystem being mounted at /44/loop7 supports timestamps until 2038-01-19 (0x7fffffff) [ 54.998146][ T4431] loop4: detected capacity change from 0 to 2048 [ 55.069855][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.135904][ T4445] lo speed is unknown, defaulting to 1000 [ 55.201798][ T4417] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #2: comm syz.3.224: corrupted inode contents [ 55.224886][ T4446] syzkaller0: entered allmulticast mode [ 55.232794][ T4417] EXT4-fs error (device loop3): ext4_dirty_inode:6517: inode #2: comm syz.3.224: mark_inode_dirty error [ 55.250853][ T4446] syzkaller0: entered promiscuous mode [ 55.269748][ T4446] syzkaller0 (unregistering): left allmulticast mode [ 55.276489][ T4446] syzkaller0 (unregistering): left promiscuous mode [ 55.287456][ T4417] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #2: comm syz.3.224: corrupted inode contents [ 55.307102][ T4417] EXT4-fs error (device loop3): __ext4_ext_dirty:206: inode #2: comm syz.3.224: mark_inode_dirty error [ 55.330436][ T4447] rdma_rxe: rxe_newlink: failed to add bond0 [ 55.407511][ T4451] netlink: 8 bytes leftover after parsing attributes in process `syz.2.233'. [ 55.419155][ T4451] ip6gretap0: entered promiscuous mode [ 55.426397][ T4451] ip6gretap0: left promiscuous mode [ 55.451258][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.551812][ T4467] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 55.588745][ T4467] x_tables: duplicate underflow at hook 2 [ 55.606544][ T4471] loop4: detected capacity change from 0 to 512 [ 55.614658][ T4471] EXT4-fs: Ignoring removed bh option [ 55.633017][ T4471] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 55.648817][ T4471] ext4 filesystem being mounted at /58/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 55.661170][ T4471] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000. [ 55.691830][ T3323] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.905352][ T4491] loop1: detected capacity change from 0 to 2048 [ 55.911398][ T4495] netlink: 8 bytes leftover after parsing attributes in process `syz.4.251'. [ 55.924065][ T4495] ip6gretap0: entered promiscuous mode [ 55.931713][ T4495] ip6gretap0: left promiscuous mode [ 55.998022][ T4484] syzkaller0: entered allmulticast mode [ 56.006511][ T4484] syzkaller0: entered promiscuous mode [ 56.013349][ T4484] syzkaller0 (unregistering): left allmulticast mode [ 56.020151][ T4484] syzkaller0 (unregistering): left promiscuous mode [ 56.065571][ T4491] rdma_rxe: rxe_newlink: failed to add bond0 [ 56.219154][ T4506] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 56.360575][ T4519] lo speed is unknown, defaulting to 1000 [ 56.575301][ T4506] netlink: 12 bytes leftover after parsing attributes in process `syz.3.256'. [ 56.706507][ T4506] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 56.728041][ T4526] syzkaller1: entered promiscuous mode [ 56.733771][ T4526] syzkaller1: entered allmulticast mode [ 56.740848][ T4528] netlink: 4 bytes leftover after parsing attributes in process `syz.0.264'. [ 56.981013][ T4533] netlink: 8 bytes leftover after parsing attributes in process `syz.1.267'. [ 57.078854][ T4533] ip6gretap0: entered promiscuous mode [ 57.079271][ T4545] loop4: detected capacity change from 0 to 128 [ 57.097948][ T4538] loop2: detected capacity change from 0 to 2048 [ 57.111764][ T4545] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 57.127884][ T4545] ext4 filesystem being mounted at /64/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 57.161422][ T4533] ip6gretap0: left promiscuous mode [ 57.199094][ T4547] FAULT_INJECTION: forcing a failure. [ 57.199094][ T4547] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 57.212372][ T4547] CPU: 1 UID: 0 PID: 4547 Comm: syz.0.272 Not tainted syzkaller #0 PREEMPT(voluntary) [ 57.212452][ T4547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 57.212464][ T4547] Call Trace: [ 57.212469][ T4547] [ 57.212477][ T4547] __dump_stack+0x1d/0x30 [ 57.212504][ T4547] dump_stack_lvl+0xe8/0x140 [ 57.212546][ T4547] dump_stack+0x15/0x1b [ 57.212563][ T4547] should_fail_ex+0x265/0x280 [ 57.212584][ T4547] should_fail+0xb/0x20 [ 57.212605][ T4547] should_fail_usercopy+0x1a/0x20 [ 57.212647][ T4547] _copy_from_iter+0xd2/0xe80 [ 57.212748][ T4547] ? mntput_no_expire+0x6f/0x440 [ 57.212771][ T4547] ? mntput+0x4b/0x80 [ 57.212788][ T4547] tun_get_user+0x14d/0x26e0 [ 57.212823][ T4547] ? path_openat+0x1bf8/0x2170 [ 57.212851][ T4547] ? _parse_integer_limit+0x170/0x190 [ 57.213040][ T4547] ? ref_tracker_alloc+0x1f2/0x2f0 [ 57.213077][ T4547] ? selinux_file_permission+0x1e4/0x320 [ 57.213112][ T4547] tun_chr_write_iter+0x15e/0x210 [ 57.213150][ T4547] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 57.213251][ T4547] vfs_write+0x52a/0x960 [ 57.213336][ T4547] ksys_write+0xda/0x1a0 [ 57.213362][ T4547] __x64_sys_write+0x40/0x50 [ 57.213387][ T4547] x64_sys_call+0x2802/0x3000 [ 57.213459][ T4547] do_syscall_64+0xd2/0x200 [ 57.213477][ T4547] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 57.213559][ T4547] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 57.213678][ T4547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.213763][ T4547] RIP: 0033:0x7f860e55efc9 [ 57.213782][ T4547] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 57.213801][ T4547] RSP: 002b:00007f860cfc7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 57.213819][ T4547] RAX: ffffffffffffffda RBX: 00007f860e7b5fa0 RCX: 00007f860e55efc9 [ 57.213844][ T4547] RDX: 000000000000004e RSI: 00002000000002c0 RDI: 0000000000000006 [ 57.213860][ T4547] RBP: 00007f860cfc7090 R08: 0000000000000000 R09: 0000000000000000 [ 57.213876][ T4547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 57.213891][ T4547] R13: 00007f860e7b6038 R14: 00007f860e7b5fa0 R15: 00007ffcbc67ed88 [ 57.213915][ T4547] [ 57.486745][ T4538] syzkaller0: entered allmulticast mode [ 57.498825][ T4538] syzkaller0: entered promiscuous mode [ 57.516851][ T4538] syzkaller0 (unregistering): left allmulticast mode [ 57.523685][ T4538] syzkaller0 (unregistering): left promiscuous mode [ 57.551430][ T4566] netlink: 4 bytes leftover after parsing attributes in process `syz.0.276'. [ 57.568699][ T4562] syz2: rxe_newlink: already configured on bond0 [ 57.705606][ T4575] syzkaller1: entered promiscuous mode [ 57.711197][ T4575] syzkaller1: entered allmulticast mode [ 57.924424][ T4596] lo speed is unknown, defaulting to 1000 [ 58.580063][ T4629] lo speed is unknown, defaulting to 1000 [ 58.929953][ T4635] geneve2: entered promiscuous mode [ 58.935274][ T4635] geneve2: entered allmulticast mode [ 59.166705][ T4655] netlink: 4 bytes leftover after parsing attributes in process `syz.1.289'. [ 59.288820][ T4660] lo speed is unknown, defaulting to 1000 [ 59.626306][ T29] kauditd_printk_skb: 352 callbacks suppressed [ 59.626371][ T29] audit: type=1400 audit(1762031924.794:1650): avc: denied { map_create } for pid=4665 comm="syz.2.291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 59.672339][ T4666] syzkaller1: entered promiscuous mode [ 59.677892][ T4666] syzkaller1: entered allmulticast mode [ 59.685025][ T29] audit: type=1400 audit(1762031924.824:1651): avc: denied { map_read map_write } for pid=4665 comm="syz.2.291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 59.704846][ T29] audit: type=1400 audit(1762031924.824:1652): avc: denied { prog_load } for pid=4665 comm="syz.2.291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 59.723933][ T29] audit: type=1400 audit(1762031924.824:1653): avc: denied { bpf } for pid=4665 comm="syz.2.291" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 59.744387][ T29] audit: type=1400 audit(1762031924.824:1654): avc: denied { perfmon } for pid=4665 comm="syz.2.291" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 59.765205][ T29] audit: type=1400 audit(1762031924.824:1655): avc: denied { prog_run } for pid=4665 comm="syz.2.291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 59.784254][ T29] audit: type=1400 audit(1762031924.834:1656): avc: denied { read write } for pid=3318 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 59.788355][ T4672] netlink: 8 bytes leftover after parsing attributes in process `syz.3.293'. [ 59.808490][ T29] audit: type=1400 audit(1762031924.834:1657): avc: denied { open } for pid=3318 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 59.841398][ T29] audit: type=1400 audit(1762031924.834:1658): avc: denied { ioctl } for pid=3318 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 59.866991][ T29] audit: type=1400 audit(1762031924.844:1659): avc: denied { create } for pid=4665 comm="syz.2.291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 59.889049][ T4672] ip6gretap0: entered promiscuous mode [ 59.946435][ T4672] ip6gretap0: left promiscuous mode [ 60.251891][ T4722] lo speed is unknown, defaulting to 1000 [ 60.365530][ T3323] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 60.703281][ T4731] vlan2: entered allmulticast mode [ 60.812546][ T4734] lo speed is unknown, defaulting to 1000 [ 61.200278][ T4758] netlink: 8 bytes leftover after parsing attributes in process `syz.2.305'. [ 61.238181][ T4758] netlink: 312 bytes leftover after parsing attributes in process `syz.2.305'. [ 61.247215][ T4758] netlink: 8 bytes leftover after parsing attributes in process `syz.2.305'. [ 61.316353][ T4770] loop1: detected capacity change from 0 to 512 [ 61.339028][ T4771] vlan2: entered allmulticast mode [ 61.388699][ T4773] syzkaller1: entered promiscuous mode [ 61.394287][ T4773] syzkaller1: entered allmulticast mode [ 61.452266][ T4770] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 61.488668][ T4770] ext4 filesystem being mounted at /65/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 61.497779][ T4777] loop0: detected capacity change from 0 to 8192 [ 61.503323][ T4770] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #2: comm syz.1.304: corrupted inode contents [ 61.517374][ T4770] EXT4-fs error (device loop1): ext4_dirty_inode:6517: inode #2: comm syz.1.304: mark_inode_dirty error [ 61.529350][ T4770] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #2: comm syz.1.304: corrupted inode contents [ 61.541817][ T4770] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.304: mark_inode_dirty error [ 61.809337][ T4801] loop0: detected capacity change from 0 to 128 [ 61.817736][ T4799] loop3: detected capacity change from 0 to 8192 [ 61.886014][ T4794] lo speed is unknown, defaulting to 1000 [ 62.033708][ T4804] lo speed is unknown, defaulting to 1000 [ 62.259893][ T3318] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 62.294112][ T4801] bio_check_eod: 11255 callbacks suppressed [ 62.294213][ T4801] syz.0.316: attempt to access beyond end of device [ 62.294213][ T4801] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 62.313404][ T4801] buffer_io_error: 11255 callbacks suppressed [ 62.313420][ T4801] Buffer I/O error on dev loop0, logical block 2078, async page read [ 62.327719][ T4810] loop1: detected capacity change from 0 to 128 [ 62.335175][ T4801] syz.0.316: attempt to access beyond end of device [ 62.335175][ T4801] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 62.348426][ T4801] Buffer I/O error on dev loop0, logical block 2078, async page read [ 62.356843][ T4801] syz.0.316: attempt to access beyond end of device [ 62.356843][ T4801] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 62.370173][ T4801] Buffer I/O error on dev loop0, logical block 2078, async page read [ 62.387607][ T4801] syz.0.316: attempt to access beyond end of device [ 62.387607][ T4801] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 62.400919][ T4801] Buffer I/O error on dev loop0, logical block 2078, async page read [ 62.409387][ T4801] syz.0.316: attempt to access beyond end of device [ 62.409387][ T4801] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 62.422621][ T4801] Buffer I/O error on dev loop0, logical block 2078, async page read [ 62.430878][ T4801] syz.0.316: attempt to access beyond end of device [ 62.430878][ T4801] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 62.444096][ T4801] Buffer I/O error on dev loop0, logical block 2078, async page read [ 62.452314][ T4801] syz.0.316: attempt to access beyond end of device [ 62.452314][ T4801] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 62.465550][ T4801] Buffer I/O error on dev loop0, logical block 2078, async page read [ 62.473865][ T4801] syz.0.316: attempt to access beyond end of device [ 62.473865][ T4801] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 62.487060][ T4801] Buffer I/O error on dev loop0, logical block 2078, async page read [ 62.490506][ T4810] syz.1.318: attempt to access beyond end of device [ 62.490506][ T4810] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 62.508405][ T4810] Buffer I/O error on dev loop1, logical block 2078, async page read [ 62.552344][ T4810] syz.1.318: attempt to access beyond end of device [ 62.552344][ T4810] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 62.565698][ T4810] Buffer I/O error on dev loop1, logical block 2078, async page read [ 62.652444][ T4814] capability: warning: `syz.3.319' uses deprecated v2 capabilities in a way that may be insecure [ 63.011274][ T4827] lo speed is unknown, defaulting to 1000 [ 63.147878][ T4832] loop3: detected capacity change from 0 to 512 [ 63.179509][ T4832] EXT4-fs: Ignoring removed bh option [ 63.205790][ T4832] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 63.248671][ T4832] ext4 filesystem being mounted at /71/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 63.301053][ T4832] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000. [ 63.354165][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 63.396278][ T4843] netlink: 8 bytes leftover after parsing attributes in process `syz.1.328'. [ 63.428186][ T4841] loop3: detected capacity change from 0 to 8192 [ 63.471912][ T4843] ip6gretap0: entered promiscuous mode [ 63.493537][ T4843] ip6gretap0: left promiscuous mode [ 63.660902][ T4861] loop1: detected capacity change from 0 to 512 [ 63.699537][ T4861] EXT4-fs: Ignoring removed bh option [ 63.943515][ T4866] lo speed is unknown, defaulting to 1000 [ 64.084379][ T4861] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 64.232913][ T4861] ext4 filesystem being mounted at /72/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 64.254246][ T4861] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000. [ 64.319256][ T3318] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 64.524443][ T4884] loop1: detected capacity change from 0 to 512 [ 64.557926][ T4884] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 64.599836][ T4884] ext4 filesystem being mounted at /74/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 64.652339][ T29] kauditd_printk_skb: 105 callbacks suppressed [ 64.652353][ T29] audit: type=1400 audit(1762031929.824:1765): avc: denied { create } for pid=4882 comm="syz.1.341" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 64.656382][ T4884] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #2: comm syz.1.341: corrupted inode contents [ 64.658600][ T29] audit: type=1400 audit(1762031929.824:1766): avc: denied { execute } for pid=4888 comm="syz.2.343" path=2F6D656D66643A0B656DDA9952406DFCFE9B232AFF202864656C6574656429 dev="tmpfs" ino=1084 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 64.747583][ T4884] EXT4-fs error (device loop1): ext4_dirty_inode:6517: inode #2: comm syz.1.341: mark_inode_dirty error [ 64.791540][ T4884] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #2: comm syz.1.341: corrupted inode contents [ 64.832362][ T4896] loop3: detected capacity change from 0 to 8192 [ 64.841187][ T4884] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.341: mark_inode_dirty error [ 64.919135][ T3318] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 64.934493][ T29] audit: type=1326 audit(1762031930.104:1767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4898 comm="syz.0.346" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 64.969027][ T4901] netlink: 8 bytes leftover after parsing attributes in process `syz.3.348'. [ 64.980982][ T4901] ip6gretap0: entered promiscuous mode [ 64.991891][ T4901] ip6gretap0: left promiscuous mode [ 64.999652][ T29] audit: type=1326 audit(1762031930.164:1768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4898 comm="syz.0.346" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 65.023082][ T29] audit: type=1326 audit(1762031930.164:1769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4898 comm="syz.0.346" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 65.046504][ T29] audit: type=1326 audit(1762031930.164:1770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4898 comm="syz.0.346" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 65.156377][ T4911] netlink: 8 bytes leftover after parsing attributes in process `syz.3.352'. [ 65.284926][ T4911] ip6gretap0: entered promiscuous mode [ 65.292206][ T4911] ip6gretap0: left promiscuous mode [ 65.463611][ T4926] lo speed is unknown, defaulting to 1000 [ 66.301458][ T4924] netlink: 8 bytes leftover after parsing attributes in process `syz.4.355'. [ 66.335036][ T4929] lo speed is unknown, defaulting to 1000 [ 67.372294][ T4943] netlink: 60 bytes leftover after parsing attributes in process `syz.2.360'. [ 67.381432][ T29] audit: type=1400 audit(1762031932.534:1771): avc: denied { append } for pid=4938 comm="syz.4.359" name="001" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 67.407672][ T4940] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 67.425638][ T4942] loop3: detected capacity change from 0 to 512 [ 67.425806][ T4936] loop1: detected capacity change from 0 to 8192 [ 67.440502][ T4942] EXT4-fs: Ignoring removed bh option [ 67.460119][ T29] audit: type=1400 audit(1762031932.624:1772): avc: denied { prog_load } for pid=4944 comm="syz.0.362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 67.479158][ T29] audit: type=1400 audit(1762031932.624:1773): avc: denied { bpf } for pid=4944 comm="syz.0.362" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 67.501440][ T29] audit: type=1400 audit(1762031932.624:1774): avc: denied { perfmon } for pid=4944 comm="syz.0.362" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 67.547914][ T4953] syzkaller1: entered promiscuous mode [ 67.553778][ T4953] syzkaller1: entered allmulticast mode [ 67.570180][ T4942] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 67.612847][ T4942] ext4 filesystem being mounted at /81/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 67.683400][ T4942] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000. [ 67.692758][ T4965] netlink: 8 bytes leftover after parsing attributes in process `syz.4.369'. [ 67.708726][ T4965] ip6gretap0: entered promiscuous mode [ 67.717607][ T4964] netlink: 12 bytes leftover after parsing attributes in process `syz.1.367'. [ 67.726675][ T4965] ip6gretap0: left promiscuous mode [ 67.744415][ T4969] loop0: detected capacity change from 0 to 512 [ 67.752815][ T4969] EXT4-fs: Ignoring removed bh option [ 67.756668][ T4964] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 67.776858][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 67.791028][ T4969] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 67.804754][ T4969] ext4 filesystem being mounted at /66/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 67.830758][ T4969] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000. [ 67.855141][ T4978] loop4: detected capacity change from 0 to 512 [ 67.877121][ T4978] EXT4-fs: Ignoring removed bh option [ 67.892923][ T4983] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 67.907962][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 67.945198][ T4978] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 67.961943][ T4978] ext4 filesystem being mounted at /79/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 68.062171][ T4978] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000. [ 68.086671][ T4992] vlan2: entered allmulticast mode [ 68.092951][ T3323] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 68.238782][ T4999] netlink: 12 bytes leftover after parsing attributes in process `syz.3.380'. [ 68.251942][ T4999] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 68.303439][ T5001] loop4: detected capacity change from 0 to 512 [ 68.322051][ T5001] EXT4-fs: Ignoring removed bh option [ 68.344572][ T5001] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 68.503292][ T5009] netlink: 8 bytes leftover after parsing attributes in process `syz.2.384'. [ 68.537993][ T5009] ip6gretap0: entered promiscuous mode [ 68.567436][ T5009] ip6gretap0: left promiscuous mode [ 68.574411][ T5001] ext4 filesystem being mounted at /81/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 68.696285][ T5001] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000. [ 68.852830][ T5015] loop2: detected capacity change from 0 to 8192 [ 68.992107][ T5030] loop3: detected capacity change from 0 to 512 [ 68.996735][ T5029] netlink: 12 bytes leftover after parsing attributes in process `syz.2.390'. [ 68.999936][ T5030] EXT4-fs: Ignoring removed bh option [ 69.022011][ T5030] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 69.037442][ T5030] ext4 filesystem being mounted at /89/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 69.040980][ T5029] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 69.057874][ T5030] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000. [ 69.100616][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 69.148129][ T3323] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 69.155854][ T5038] loop3: detected capacity change from 0 to 512 [ 69.182646][ T5034] loop2: detected capacity change from 0 to 2048 [ 69.193001][ T5038] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 69.205906][ T5038] ext4 filesystem being mounted at /90/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 69.223585][ T5040] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 69.232726][ T5034] syzkaller0: entered allmulticast mode [ 69.251258][ T5038] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #2: comm syz.3.392: corrupted inode contents [ 69.263731][ T5038] EXT4-fs error (device loop3): ext4_dirty_inode:6517: inode #2: comm syz.3.392: mark_inode_dirty error [ 69.275198][ T5034] syzkaller0: entered promiscuous mode [ 69.275330][ T5038] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #2: comm syz.3.392: corrupted inode contents [ 69.293075][ T5038] EXT4-fs error (device loop3): __ext4_ext_dirty:206: inode #2: comm syz.3.392: mark_inode_dirty error [ 69.293976][ T5034] syzkaller0 (unregistering): left allmulticast mode [ 69.310981][ T5034] syzkaller0 (unregistering): left promiscuous mode [ 69.318004][ T5044] loop4: detected capacity change from 0 to 2048 [ 69.334420][ T5046] syz2: rxe_newlink: already configured on bond0 [ 69.342067][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 69.382208][ T5050] loop3: detected capacity change from 0 to 128 [ 69.457195][ T5056] loop0: detected capacity change from 0 to 128 [ 69.498093][ T5061] netlink: 8 bytes leftover after parsing attributes in process `syz.2.401'. [ 69.499645][ T5050] bio_check_eod: 5083 callbacks suppressed [ 69.499664][ T5050] syz.3.397: attempt to access beyond end of device [ 69.499664][ T5050] loop3: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 69.509525][ T5061] ip6gretap0: entered promiscuous mode [ 69.512887][ T5050] buffer_io_error: 5083 callbacks suppressed [ 69.512905][ T5050] Buffer I/O error on dev loop3, logical block 2078, async page read [ 69.547690][ T5061] ip6gretap0: left promiscuous mode [ 69.554693][ T5050] syz.3.397: attempt to access beyond end of device [ 69.554693][ T5050] loop3: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 69.567948][ T5050] Buffer I/O error on dev loop3, logical block 2078, async page read [ 69.573011][ T5065] loop4: detected capacity change from 0 to 512 [ 69.584610][ T5050] syz.3.397: attempt to access beyond end of device [ 69.584610][ T5050] loop3: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 69.585661][ T5065] EXT4-fs: Ignoring removed bh option [ 69.597832][ T5050] Buffer I/O error on dev loop3, logical block 2078, async page read [ 69.616477][ T5066] syz.0.399: attempt to access beyond end of device [ 69.616477][ T5066] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 69.629861][ T5066] Buffer I/O error on dev loop0, logical block 2078, async page read [ 69.638444][ T5066] syz.0.399: attempt to access beyond end of device [ 69.638444][ T5066] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 69.648744][ T5050] syz.3.397: attempt to access beyond end of device [ 69.648744][ T5050] loop3: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 69.651728][ T5066] Buffer I/O error on dev loop0, logical block 2078, async page read [ 69.664835][ T5050] Buffer I/O error on dev loop3, logical block 2078, async page read [ 69.675806][ T5066] syz.0.399: attempt to access beyond end of device [ 69.675806][ T5066] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 69.694215][ T5066] Buffer I/O error on dev loop0, logical block 2078, async page read [ 69.702869][ T5050] syz.3.397: attempt to access beyond end of device [ 69.702869][ T5050] loop3: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 69.716144][ T5050] Buffer I/O error on dev loop3, logical block 2078, async page read [ 69.716662][ T29] kauditd_printk_skb: 180 callbacks suppressed [ 69.716676][ T29] audit: type=1400 audit(1762031934.874:1955): avc: denied { name_bind } for pid=5060 comm="syz.2.401" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 69.724815][ T5050] syz.3.397: attempt to access beyond end of device [ 69.724815][ T5050] loop3: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 69.730494][ T29] audit: type=1400 audit(1762031934.874:1956): avc: denied { node_bind } for pid=5060 comm="syz.2.401" saddr=fe80::aa src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 69.752061][ T5050] Buffer I/O error on dev loop3, logical block 2078, async page read [ 69.780182][ T5066] syz.0.399: attempt to access beyond end of device [ 69.780182][ T5066] loop0: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 69.793954][ T5050] Buffer I/O error on dev loop3, logical block 2078, async page read [ 69.950649][ T29] audit: type=1400 audit(1762031935.094:1957): avc: denied { create } for pid=5074 comm="syz.1.405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 70.195681][ T29] audit: type=1326 audit(1762031935.364:1958): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5077 comm="syz.2.406" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 70.219183][ T29] audit: type=1326 audit(1762031935.364:1959): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5077 comm="syz.2.406" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 70.270143][ T29] audit: type=1326 audit(1762031935.424:1960): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5077 comm="syz.2.406" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 70.270827][ T5065] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 70.293571][ T29] audit: type=1326 audit(1762031935.424:1961): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5077 comm="syz.2.406" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 70.329363][ T29] audit: type=1326 audit(1762031935.424:1962): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5077 comm="syz.2.406" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 70.352779][ T29] audit: type=1326 audit(1762031935.424:1963): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5077 comm="syz.2.406" exe="/root/syz-executor" sig=0 arch=c000003e syscall=152 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 70.376158][ T29] audit: type=1326 audit(1762031935.424:1964): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5077 comm="syz.2.406" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 70.388572][ T5065] ext4 filesystem being mounted at /85/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 70.446034][ T5082] loop2: detected capacity change from 0 to 512 [ 70.465262][ T5065] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000. [ 70.474875][ T5082] EXT4-fs: Ignoring removed bh option [ 70.517089][ T3323] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 70.531667][ T5087] loop3: detected capacity change from 0 to 2048 [ 70.539077][ T5082] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 70.555775][ T5095] netlink: 12 bytes leftover after parsing attributes in process `syz.0.413'. [ 70.568437][ T5095] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 70.573002][ T5082] ext4 filesystem being mounted at /73/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 70.618940][ T5082] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000. [ 70.724518][ T5110] loop3: detected capacity change from 0 to 512 [ 70.754563][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 70.788067][ T5110] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 70.819521][ T5117] netlink: 8 bytes leftover after parsing attributes in process `syz.2.419'. [ 70.830612][ T5110] ext4 filesystem being mounted at /94/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 70.871678][ T5110] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #2: comm syz.3.418: corrupted inode contents [ 70.891138][ T5117] ip6gretap0: entered promiscuous mode [ 71.002297][ T5110] EXT4-fs error (device loop3): ext4_dirty_inode:6517: inode #2: comm syz.3.418: mark_inode_dirty error [ 71.028589][ T5110] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #2: comm syz.3.418: corrupted inode contents [ 71.046648][ T5117] ip6gretap0: left promiscuous mode [ 71.073679][ T5110] EXT4-fs error (device loop3): __ext4_ext_dirty:206: inode #2: comm syz.3.418: mark_inode_dirty error [ 71.160447][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 71.193776][ T5125] loop3: detected capacity change from 0 to 512 [ 71.204172][ T5125] EXT4-fs: Ignoring removed bh option [ 71.226584][ T5128] FAULT_INJECTION: forcing a failure. [ 71.226584][ T5128] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 71.239748][ T5128] CPU: 0 UID: 0 PID: 5128 Comm: syz.2.422 Not tainted syzkaller #0 PREEMPT(voluntary) [ 71.239826][ T5128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 71.239838][ T5128] Call Trace: [ 71.239845][ T5128] [ 71.239851][ T5128] __dump_stack+0x1d/0x30 [ 71.239880][ T5128] dump_stack_lvl+0xe8/0x140 [ 71.239943][ T5128] dump_stack+0x15/0x1b [ 71.240029][ T5128] should_fail_ex+0x265/0x280 [ 71.240053][ T5128] should_fail+0xb/0x20 [ 71.240096][ T5128] should_fail_usercopy+0x1a/0x20 [ 71.240178][ T5128] _copy_from_user+0x1c/0xb0 [ 71.240202][ T5128] ___sys_sendmsg+0xc1/0x1d0 [ 71.240235][ T5128] __x64_sys_sendmsg+0xd4/0x160 [ 71.240296][ T5128] x64_sys_call+0x191e/0x3000 [ 71.240325][ T5128] do_syscall_64+0xd2/0x200 [ 71.240347][ T5128] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 71.240376][ T5128] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 71.240415][ T5128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.240509][ T5128] RIP: 0033:0x7f47a25aefc9 [ 71.240527][ T5128] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 71.240548][ T5128] RSP: 002b:00007f47a1017038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 71.240565][ T5128] RAX: ffffffffffffffda RBX: 00007f47a2805fa0 RCX: 00007f47a25aefc9 [ 71.240580][ T5128] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000005 [ 71.240594][ T5128] RBP: 00007f47a1017090 R08: 0000000000000000 R09: 0000000000000000 [ 71.240609][ T5128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 71.240624][ T5128] R13: 00007f47a2806038 R14: 00007f47a2805fa0 R15: 00007ffd60bee1c8 [ 71.240642][ T5128] [ 71.473738][ T5125] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 71.530231][ T5125] ext4 filesystem being mounted at /95/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 71.565503][ T5125] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000. [ 71.640934][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 71.663624][ T5144] loop4: detected capacity change from 0 to 2048 [ 71.694927][ T5149] netlink: 8 bytes leftover after parsing attributes in process `syz.1.432'. [ 71.725645][ T5149] ip6gretap0: entered promiscuous mode [ 71.751604][ T5147] loop2: detected capacity change from 0 to 2048 [ 71.758973][ T5149] ip6gretap0: left promiscuous mode [ 71.766709][ T5151] lo speed is unknown, defaulting to 1000 [ 71.772952][ T5151] lo speed is unknown, defaulting to 1000 [ 71.809877][ T5151] lo speed is unknown, defaulting to 1000 [ 71.818791][ T5151] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 71.839121][ T5151] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 71.873026][ T5142] syzkaller0: entered allmulticast mode [ 71.878928][ T5142] syzkaller0: entered promiscuous mode [ 71.886716][ T5142] syzkaller0 (unregistering): left allmulticast mode [ 71.893553][ T5142] syzkaller0 (unregistering): left promiscuous mode [ 71.936411][ T5147] syz2: rxe_newlink: already configured on bond0 [ 71.973252][ T5151] lo speed is unknown, defaulting to 1000 [ 71.979513][ T5151] lo speed is unknown, defaulting to 1000 [ 71.988180][ T5151] lo speed is unknown, defaulting to 1000 [ 72.008392][ T5151] lo speed is unknown, defaulting to 1000 [ 72.030001][ T5151] lo speed is unknown, defaulting to 1000 [ 72.046315][ T5151] lo speed is unknown, defaulting to 1000 [ 72.057473][ T5175] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 72.126116][ T5179] loop2: detected capacity change from 0 to 512 [ 72.133279][ T5179] EXT4-fs: Ignoring removed bh option [ 72.147909][ T5170] lo speed is unknown, defaulting to 1000 [ 72.161444][ T5179] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 72.161577][ T5179] ext4 filesystem being mounted at /78/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 72.163238][ T5179] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000. [ 72.182405][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.261205][ T5187] netlink: 8 bytes leftover after parsing attributes in process `syz.3.441'. [ 72.333555][ T5187] netlink: 8 bytes leftover after parsing attributes in process `syz.3.441'. [ 72.576492][ T5212] loop3: detected capacity change from 0 to 128 [ 72.594526][ T5213] loop2: detected capacity change from 0 to 512 [ 72.605821][ T5207] loop0: detected capacity change from 0 to 512 [ 72.617780][ T5207] EXT4-fs error (device loop0): ext4_orphan_get:1392: inode #15: comm syz.0.450: inode has both inline data and extents flags [ 72.631356][ T5213] EXT4-fs: Ignoring removed bh option [ 72.637006][ T5207] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.450: couldn't read orphan inode 15 (err -117) [ 72.649957][ T5207] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 72.677911][ T5213] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 72.700843][ T5213] ext4 filesystem being mounted at /81/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 72.818327][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.827812][ T5213] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000. [ 73.045767][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.143510][ T5242] netlink: 8 bytes leftover after parsing attributes in process `syz.0.462'. [ 73.181406][ T5242] ip6gretap0: entered promiscuous mode [ 73.199398][ T5242] ip6gretap0: left promiscuous mode [ 73.348353][ T5244] lo speed is unknown, defaulting to 1000 [ 73.383138][ T5244] lo speed is unknown, defaulting to 1000 [ 73.501238][ T5256] netlink: 8 bytes leftover after parsing attributes in process `syz.0.468'. [ 73.522537][ T5256] ip6gretap0: entered promiscuous mode [ 73.563106][ T5256] ip6gretap0: left promiscuous mode [ 73.592336][ T5261] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 73.612101][ T5263] loop2: detected capacity change from 0 to 512 [ 73.650917][ T5263] EXT4-fs: Ignoring removed bh option [ 73.716254][ T5263] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 73.775596][ T5263] ext4 filesystem being mounted at /84/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 73.816910][ T5263] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000. [ 73.825078][ T5277] loop4: detected capacity change from 0 to 8192 [ 73.842729][ T5281] loop0: detected capacity change from 0 to 512 [ 73.846839][ T5279] loop3: detected capacity change from 0 to 128 [ 73.859067][ T5281] EXT4-fs: Ignoring removed bh option [ 73.859976][ T5279] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 73.897789][ T5279] ext4 filesystem being mounted at /110/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 73.898672][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 74.004514][ T5281] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 74.040297][ T5281] ext4 filesystem being mounted at /88/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 74.073348][ T5281] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000. [ 74.088310][ T5291] netlink: 12 bytes leftover after parsing attributes in process `syz.4.479'. [ 74.125340][ T5291] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 74.147014][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 74.183059][ T5304] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 74.281134][ T5320] loop2: detected capacity change from 0 to 512 [ 74.291742][ T5324] loop0: detected capacity change from 0 to 512 [ 74.305195][ T5324] EXT4-fs: Ignoring removed bh option [ 74.323850][ T5320] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 74.332135][ T5324] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 74.341542][ T5320] ext4 filesystem being mounted at /87/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 74.360896][ T5324] ext4 filesystem being mounted at /90/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 74.360929][ T5334] loop4: detected capacity change from 0 to 128 [ 74.380032][ T5336] loop1: detected capacity change from 0 to 128 [ 74.404014][ T5334] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 74.417517][ T5336] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 74.431242][ T5320] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #2: comm syz.2.486: corrupted inode contents [ 74.443056][ T5336] ext4 filesystem being mounted at /98/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 74.443133][ T5320] EXT4-fs error (device loop2): ext4_dirty_inode:6517: inode #2: comm syz.2.486: mark_inode_dirty error [ 74.474923][ T5334] ext4 filesystem being mounted at /100/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 74.486757][ T5320] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #2: comm syz.2.486: corrupted inode contents [ 74.543073][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 74.587093][ T5320] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #2: comm syz.2.486: mark_inode_dirty error [ 74.650518][ T5364] netlink: 8 bytes leftover after parsing attributes in process `syz.0.492'. [ 74.671364][ T5364] ip6gretap0: entered promiscuous mode [ 74.678092][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 74.689681][ T5364] ip6gretap0: left promiscuous mode [ 74.745134][ T29] kauditd_printk_skb: 478 callbacks suppressed [ 74.745152][ T29] audit: type=1400 audit(1762031939.914:2443): avc: denied { create } for pid=5378 comm="syz.2.494" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 74.783643][ T29] audit: type=1400 audit(1762031939.914:2444): avc: denied { create } for pid=5378 comm="syz.2.494" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 74.921662][ T29] audit: type=1400 audit(1762031940.084:2445): avc: denied { read write } for pid=3325 comm="syz-executor" name="loop0" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 74.945966][ T29] audit: type=1400 audit(1762031940.084:2446): avc: denied { open } for pid=3325 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 74.970174][ T29] audit: type=1400 audit(1762031940.084:2447): avc: denied { ioctl } for pid=3325 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=100 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 75.009727][ T29] audit: type=1326 audit(1762031940.094:2448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5393 comm="syz.0.496" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 75.033133][ T29] audit: type=1326 audit(1762031940.094:2449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5393 comm="syz.0.496" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 75.056549][ T29] audit: type=1326 audit(1762031940.094:2450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5393 comm="syz.0.496" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 75.079919][ T29] audit: type=1400 audit(1762031940.094:2451): avc: denied { prog_load } for pid=5393 comm="syz.0.496" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 75.090217][ T5397] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 75.098984][ T29] audit: type=1400 audit(1762031940.094:2452): avc: denied { bpf } for pid=5393 comm="syz.0.496" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 75.180911][ T5406] loop2: detected capacity change from 0 to 512 [ 75.190836][ T5406] EXT4-fs: Ignoring removed bh option [ 75.221866][ T5406] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 75.245140][ T5406] ext4 filesystem being mounted at /91/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 75.263420][ T5417] loop0: detected capacity change from 0 to 2048 [ 75.275522][ T5406] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000. [ 75.299379][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 75.327598][ T5417] syzkaller0: entered allmulticast mode [ 75.333725][ T5417] syzkaller0: entered promiscuous mode [ 75.341361][ T5417] syzkaller0 (unregistering): left allmulticast mode [ 75.348179][ T5417] syzkaller0 (unregistering): left promiscuous mode [ 75.391545][ T5435] rdma_rxe: rxe_newlink: failed to add bond0 [ 75.516614][ T5452] netlink: 8 bytes leftover after parsing attributes in process `syz.0.504'. [ 75.535886][ T5452] ip6gretap0: entered promiscuous mode [ 75.549790][ T5452] ip6gretap0: left promiscuous mode [ 75.674474][ T5471] loop0: detected capacity change from 0 to 512 [ 75.699416][ T5471] EXT4-fs: Ignoring removed bh option [ 75.714259][ T5471] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 75.730453][ T5471] ext4 filesystem being mounted at /99/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 75.757160][ T5471] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000. [ 75.789240][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 76.228333][ T5505] loop0: detected capacity change from 0 to 2048 [ 76.348248][ T5519] netlink: 12 bytes leftover after parsing attributes in process `syz.2.518'. [ 76.361868][ T5519] bridge3: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 76.371984][ T5515] lo speed is unknown, defaulting to 1000 [ 76.423248][ T5515] lo speed is unknown, defaulting to 1000 [ 76.462531][ T3323] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 76.475399][ T3318] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 76.478873][ T3314] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 76.500512][ T5522] loop2: detected capacity change from 0 to 512 [ 76.509757][ T5522] EXT4-fs error (device loop2): ext4_orphan_get:1392: inode #15: comm syz.2.519: inode has both inline data and extents flags [ 76.537537][ T5522] EXT4-fs error (device loop2): ext4_orphan_get:1397: comm syz.2.519: couldn't read orphan inode 15 (err -117) [ 76.590051][ T5522] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 76.639846][ T5537] netlink: 8 bytes leftover after parsing attributes in process `syz.3.524'. [ 76.670686][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 76.687340][ T5537] ip6gretap0: entered promiscuous mode [ 76.717871][ T5544] loop2: detected capacity change from 0 to 512 [ 76.724423][ T5537] ip6gretap0: left promiscuous mode [ 76.746236][ T5544] EXT4-fs: Ignoring removed bh option [ 76.780290][ T5551] netlink: 8 bytes leftover after parsing attributes in process `syz.4.529'. [ 76.803917][ T5551] ip6gretap0: entered promiscuous mode [ 76.822041][ T5551] ip6gretap0: left promiscuous mode [ 76.833895][ T5544] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 76.848275][ T5544] ext4 filesystem being mounted at /100/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 76.869946][ T5544] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000. [ 76.907162][ T5560] loop3: detected capacity change from 0 to 128 [ 76.924291][ T5564] netlink: 8 bytes leftover after parsing attributes in process `syz.4.533'. [ 76.947178][ T5564] ip6gretap0: entered promiscuous mode [ 76.969478][ T5560] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 76.970900][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 76.981965][ T5560] ext4 filesystem being mounted at /115/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 77.022321][ T5564] ip6gretap0: left promiscuous mode [ 77.072388][ T5573] netlink: 12 bytes leftover after parsing attributes in process `syz.2.536'. [ 77.085334][ T5573] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 77.159326][ T5578] loop2: detected capacity change from 0 to 512 [ 77.208846][ T5578] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 77.240505][ T5578] ext4 filesystem being mounted at /102/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 77.258016][ T5578] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #2: comm syz.2.539: corrupted inode contents [ 77.272259][ T5578] EXT4-fs error (device loop2): ext4_dirty_inode:6517: inode #2: comm syz.2.539: mark_inode_dirty error [ 77.284613][ T5578] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #2: comm syz.2.539: corrupted inode contents [ 77.296722][ T5578] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #2: comm syz.2.539: mark_inode_dirty error [ 77.350428][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.373820][ T5594] loop2: detected capacity change from 0 to 128 [ 77.387795][ T5594] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 77.408486][ T5594] ext4 filesystem being mounted at /103/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 77.473111][ T5600] loop4: detected capacity change from 0 to 128 [ 77.577029][ T5611] loop0: detected capacity change from 0 to 128 [ 77.591978][ T5611] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 77.619900][ T5600] bio_check_eod: 22647 callbacks suppressed [ 77.619920][ T5600] syz.4.542: attempt to access beyond end of device [ 77.619920][ T5600] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 77.625498][ T5611] ext4 filesystem being mounted at /113/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 77.625974][ T5600] buffer_io_error: 22647 callbacks suppressed [ 77.625992][ T5600] Buffer I/O error on dev loop4, logical block 2078, async page read [ 77.685854][ T5600] syz.4.542: attempt to access beyond end of device [ 77.685854][ T5600] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 77.699203][ T5600] Buffer I/O error on dev loop4, logical block 2078, async page read [ 77.709379][ T5600] syz.4.542: attempt to access beyond end of device [ 77.709379][ T5600] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 77.722682][ T5600] Buffer I/O error on dev loop4, logical block 2078, async page read [ 77.742699][ T5600] syz.4.542: attempt to access beyond end of device [ 77.742699][ T5600] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 77.755947][ T5600] Buffer I/O error on dev loop4, logical block 2078, async page read [ 77.775351][ T5600] syz.4.542: attempt to access beyond end of device [ 77.775351][ T5600] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 77.788573][ T5600] Buffer I/O error on dev loop4, logical block 2078, async page read [ 77.797286][ T5600] syz.4.542: attempt to access beyond end of device [ 77.797286][ T5600] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 77.810625][ T5600] Buffer I/O error on dev loop4, logical block 2078, async page read [ 77.818987][ T5600] syz.4.542: attempt to access beyond end of device [ 77.818987][ T5600] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 77.832283][ T5600] Buffer I/O error on dev loop4, logical block 2078, async page read [ 77.842468][ T5600] syz.4.542: attempt to access beyond end of device [ 77.842468][ T5600] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 77.855716][ T5600] Buffer I/O error on dev loop4, logical block 2078, async page read [ 77.864296][ T5600] syz.4.542: attempt to access beyond end of device [ 77.864296][ T5600] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 77.877519][ T5600] Buffer I/O error on dev loop4, logical block 2078, async page read [ 77.886241][ T5600] syz.4.542: attempt to access beyond end of device [ 77.886241][ T5600] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 77.899657][ T5600] Buffer I/O error on dev loop4, logical block 2078, async page read [ 78.364119][ T5680] netlink: 8 bytes leftover after parsing attributes in process `syz.4.544'. [ 78.397031][ T5680] ip6gretap0: entered promiscuous mode [ 78.418484][ T5680] ip6gretap0: left promiscuous mode [ 78.531044][ T5701] loop4: detected capacity change from 0 to 512 [ 78.552399][ T5701] EXT4-fs: Ignoring removed bh option [ 78.571864][ T5701] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 78.587865][ T5701] ext4 filesystem being mounted at /108/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 78.628925][ T3323] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.724931][ T5719] loop4: detected capacity change from 0 to 2048 [ 78.776912][ T5719] syzkaller0: entered allmulticast mode [ 78.792738][ T5719] syzkaller0: entered promiscuous mode [ 78.801385][ T5719] syzkaller0 (unregistering): left allmulticast mode [ 78.808223][ T5719] syzkaller0 (unregistering): left promiscuous mode [ 78.851844][ T5734] rdma_rxe: rxe_newlink: failed to add bond0 [ 78.943979][ T5741] loop4: detected capacity change from 0 to 512 [ 78.950952][ T5741] EXT4-fs: Ignoring removed bh option [ 78.975001][ T5741] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 78.987877][ T5741] ext4 filesystem being mounted at /110/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 79.001917][ T5741] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000. [ 79.026430][ T3323] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 79.457166][ T3327] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 79.788094][ T3314] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 79.797698][ T3325] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 79.818445][ T5770] netlink: 8 bytes leftover after parsing attributes in process `syz.3.558'. [ 79.837102][ T5770] ip6gretap0: entered promiscuous mode [ 79.870515][ T5770] ip6gretap0: left promiscuous mode [ 79.888000][ T29] kauditd_printk_skb: 320 callbacks suppressed [ 79.888105][ T29] audit: type=1400 audit(1762031945.054:2773): avc: denied { read write } for pid=3325 comm="syz-executor" name="loop0" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 79.918597][ T29] audit: type=1400 audit(1762031945.054:2774): avc: denied { open } for pid=3325 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 79.963333][ T29] audit: type=1400 audit(1762031945.114:2775): avc: denied { ioctl } for pid=3325 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=100 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 79.989048][ T29] audit: type=1400 audit(1762031945.124:2776): avc: denied { map_create } for pid=5774 comm="syz.0.560" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 80.008233][ T29] audit: type=1400 audit(1762031945.124:2777): avc: denied { perfmon } for pid=5774 comm="syz.0.560" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 80.029192][ T29] audit: type=1400 audit(1762031945.124:2778): avc: denied { map_read map_write } for pid=5774 comm="syz.0.560" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 80.049048][ T29] audit: type=1400 audit(1762031945.124:2779): avc: denied { prog_load } for pid=5774 comm="syz.0.560" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 80.068058][ T29] audit: type=1400 audit(1762031945.124:2780): avc: denied { bpf } for pid=5774 comm="syz.0.560" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 80.092443][ T5777] loop0: detected capacity change from 0 to 512 [ 80.113665][ T5777] EXT4-fs: Ignoring removed bh option [ 80.119122][ T29] audit: type=1400 audit(1762031945.284:2781): avc: denied { mounton } for pid=5776 comm="syz.0.561" path="/116/bus" dev="tmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 80.171469][ T29] audit: type=1400 audit(1762031945.324:2782): avc: denied { read } for pid=5778 comm="syz.4.562" dev="nsfs" ino=4026532531 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 80.279511][ T5777] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 80.292412][ T5785] loop3: detected capacity change from 0 to 8192 [ 80.292982][ T5777] ext4 filesystem being mounted at /116/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 80.446644][ T5789] lo speed is unknown, defaulting to 1000 [ 80.500353][ T5789] lo speed is unknown, defaulting to 1000 [ 80.611475][ T5777] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000. [ 80.794653][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 80.885614][ T5799] loop2: detected capacity change from 0 to 512 [ 80.911966][ T5799] EXT4-fs error (device loop2): ext4_orphan_get:1392: inode #15: comm syz.2.568: inode has both inline data and extents flags [ 80.955026][ T5814] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 80.968067][ T5799] EXT4-fs error (device loop2): ext4_orphan_get:1397: comm syz.2.568: couldn't read orphan inode 15 (err -117) [ 81.069682][ T5799] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 81.169418][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 81.238252][ T5830] loop0: detected capacity change from 0 to 512 [ 81.249000][ T5830] EXT4-fs: Ignoring removed bh option [ 81.269104][ T5830] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 81.299071][ T5830] ext4 filesystem being mounted at /122/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 81.353954][ T5830] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000. [ 81.392325][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 81.450234][ T5842] netlink: 8 bytes leftover after parsing attributes in process `syz.0.584'. [ 81.465863][ T5842] ip6gretap0: entered promiscuous mode [ 81.473212][ T5842] ip6gretap0: left promiscuous mode [ 81.613406][ T5846] lo speed is unknown, defaulting to 1000 [ 81.671326][ T5846] lo speed is unknown, defaulting to 1000 [ 81.987209][ T5858] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 82.033465][ T5864] vlan2: entered allmulticast mode [ 82.049391][ T5869] netlink: 12 bytes leftover after parsing attributes in process `syz.1.594'. [ 82.067600][ T5869] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 82.369564][ T5888] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 82.474460][ T5895] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 82.861896][ T5918] loop1: detected capacity change from 0 to 2048 [ 82.933222][ T5929] netlink: 8 bytes leftover after parsing attributes in process `syz.3.617'. [ 82.971552][ T5929] ip6gretap0: entered promiscuous mode [ 82.997493][ T5929] ip6gretap0: left promiscuous mode [ 83.195357][ T5957] loop0: detected capacity change from 0 to 512 [ 83.202909][ T5957] EXT4-fs: Ignoring removed bh option [ 83.303877][ T5957] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 83.347289][ T5957] ext4 filesystem being mounted at /135/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 83.372413][ T5957] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000. [ 83.417402][ T5978] netlink: 8 bytes leftover after parsing attributes in process `syz.3.634'. [ 83.442846][ T5981] loop1: detected capacity change from 0 to 2048 [ 83.462622][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 83.463734][ T5978] ip6gretap0: entered promiscuous mode [ 83.483983][ T5978] ip6gretap0: left promiscuous mode [ 83.500539][ T5961] lo speed is unknown, defaulting to 1000 [ 83.542449][ T5990] loop2: detected capacity change from 0 to 128 [ 83.547569][ T5961] lo speed is unknown, defaulting to 1000 [ 83.594268][ T5990] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 83.640821][ T5990] ext4 filesystem being mounted at /118/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 83.834059][ T6024] netlink: 8 bytes leftover after parsing attributes in process `syz.3.649'. [ 83.894215][ T6024] ip6gretap0: entered promiscuous mode [ 83.922289][ T6027] loop4: detected capacity change from 0 to 2048 [ 83.936548][ T6024] ip6gretap0: left promiscuous mode [ 83.976859][ T6033] loop0: detected capacity change from 0 to 512 [ 83.987997][ T6033] EXT4-fs error (device loop0): ext4_orphan_get:1392: inode #15: comm syz.0.652: inode has both inline data and extents flags [ 84.031307][ T6033] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.652: couldn't read orphan inode 15 (err -117) [ 84.044910][ T6033] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 84.071855][ T6032] lo speed is unknown, defaulting to 1000 [ 84.106515][ T6032] lo speed is unknown, defaulting to 1000 [ 84.213237][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.275210][ T6054] loop3: detected capacity change from 0 to 2048 [ 84.311215][ T6070] loop4: detected capacity change from 0 to 512 [ 84.347476][ T6054] syzkaller0: entered allmulticast mode [ 84.357905][ T6054] syzkaller0: entered promiscuous mode [ 84.382622][ T6054] syzkaller0 (unregistering): left allmulticast mode [ 84.389371][ T6054] syzkaller0 (unregistering): left promiscuous mode [ 84.431188][ T6085] rdma_rxe: rxe_newlink: failed to add bond0 [ 84.467135][ T6090] loop4: detected capacity change from 0 to 128 [ 84.550555][ T6090] bio_check_eod: 7059 callbacks suppressed [ 84.550570][ T6090] syz.4.663: attempt to access beyond end of device [ 84.550570][ T6090] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 84.569615][ T6090] buffer_io_error: 7059 callbacks suppressed [ 84.569630][ T6090] Buffer I/O error on dev loop4, logical block 2078, async page read [ 84.587027][ T6090] syz.4.663: attempt to access beyond end of device [ 84.587027][ T6090] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 84.600255][ T6090] Buffer I/O error on dev loop4, logical block 2078, async page read [ 84.608622][ T6090] syz.4.663: attempt to access beyond end of device [ 84.608622][ T6090] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 84.621809][ T6090] Buffer I/O error on dev loop4, logical block 2078, async page read [ 84.631255][ T6090] syz.4.663: attempt to access beyond end of device [ 84.631255][ T6090] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 84.644471][ T6090] Buffer I/O error on dev loop4, logical block 2078, async page read [ 84.652951][ T6090] syz.4.663: attempt to access beyond end of device [ 84.652951][ T6090] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 84.666124][ T6090] Buffer I/O error on dev loop4, logical block 2078, async page read [ 84.674606][ T6090] syz.4.663: attempt to access beyond end of device [ 84.674606][ T6090] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 84.687817][ T6090] Buffer I/O error on dev loop4, logical block 2078, async page read [ 84.697093][ T6090] syz.4.663: attempt to access beyond end of device [ 84.697093][ T6090] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 84.710287][ T6090] Buffer I/O error on dev loop4, logical block 2078, async page read [ 84.721965][ T6111] loop1: detected capacity change from 0 to 2048 [ 84.728591][ T6090] syz.4.663: attempt to access beyond end of device [ 84.728591][ T6090] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 84.741797][ T6090] Buffer I/O error on dev loop4, logical block 2078, async page read [ 84.751132][ T6090] syz.4.663: attempt to access beyond end of device [ 84.751132][ T6090] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 84.764343][ T6090] Buffer I/O error on dev loop4, logical block 2078, async page read [ 84.773812][ T6090] syz.4.663: attempt to access beyond end of device [ 84.773812][ T6090] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 84.787091][ T6090] Buffer I/O error on dev loop4, logical block 2078, async page read [ 84.897472][ T6116] lo speed is unknown, defaulting to 1000 [ 84.909534][ T29] kauditd_printk_skb: 940 callbacks suppressed [ 84.909551][ T29] audit: type=1400 audit(1762031950.064:3723): avc: denied { create } for pid=6125 comm="syz.1.668" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 84.936593][ T29] audit: type=1400 audit(1762031950.084:3724): avc: denied { open } for pid=6125 comm="syz.1.668" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 84.936621][ T6116] lo speed is unknown, defaulting to 1000 [ 84.955736][ T29] audit: type=1400 audit(1762031950.084:3725): avc: denied { kernel } for pid=6125 comm="syz.1.668" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 84.980821][ T29] audit: type=1400 audit(1762031950.084:3726): avc: denied { create } for pid=6125 comm="syz.1.668" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 85.000700][ T29] audit: type=1400 audit(1762031950.084:3727): avc: denied { read write } for pid=6125 comm="syz.1.668" name="file0" dev="tmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 85.023567][ T29] audit: type=1400 audit(1762031950.084:3728): avc: denied { open } for pid=6125 comm="syz.1.668" path="/137/file0" dev="tmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 85.099206][ T29] audit: type=1400 audit(1762031950.244:3729): avc: denied { unlink } for pid=3318 comm="syz-executor" name="file0" dev="tmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 85.121903][ T29] audit: type=1326 audit(1762031950.244:3730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6130 comm="syz.1.669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51ccaaefc9 code=0x7ffc0000 [ 85.145382][ T29] audit: type=1326 audit(1762031950.244:3731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6130 comm="syz.1.669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51ccaaefc9 code=0x7ffc0000 [ 85.168722][ T29] audit: type=1326 audit(1762031950.244:3732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6130 comm="syz.1.669" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f51ccaaefc9 code=0x7ffc0000 [ 85.213304][ T6140] netlink: 12 bytes leftover after parsing attributes in process `syz.0.670'. [ 85.228722][ T6140] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 85.295759][ T6148] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 85.420608][ T6169] loop1: detected capacity change from 0 to 512 [ 85.456082][ T6164] vlan2: entered allmulticast mode [ 85.495256][ T6169] ext4 filesystem being mounted at /143/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 85.531480][ T6169] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #2: comm syz.1.679: corrupted inode contents [ 85.546726][ T6169] EXT4-fs error (device loop1): ext4_dirty_inode:6517: inode #2: comm syz.1.679: mark_inode_dirty error [ 85.568853][ T6185] loop0: detected capacity change from 0 to 512 [ 85.594396][ T6169] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #2: comm syz.1.679: corrupted inode contents [ 85.613922][ T6169] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.679: mark_inode_dirty error [ 85.661418][ T6185] ext4 filesystem being mounted at /147/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 85.687960][ T6195] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 85.706031][ T6185] EXT4-fs error (device loop0): ext4_do_update_inode:5632: inode #2: comm syz.0.683: corrupted inode contents [ 85.756162][ T6200] loop4: detected capacity change from 0 to 512 [ 85.760537][ T6185] EXT4-fs error (device loop0): ext4_dirty_inode:6517: inode #2: comm syz.0.683: mark_inode_dirty error [ 85.781773][ T6185] EXT4-fs error (device loop0): ext4_do_update_inode:5632: inode #2: comm syz.0.683: corrupted inode contents [ 85.801347][ T6185] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #2: comm syz.0.683: mark_inode_dirty error [ 85.842223][ T6200] ext4 filesystem being mounted at /138/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 85.892613][ T6200] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #2: comm syz.4.687: corrupted inode contents [ 85.908603][ T6220] netlink: 12 bytes leftover after parsing attributes in process `syz.1.690'. [ 85.929477][ T6200] EXT4-fs error (device loop4): ext4_dirty_inode:6517: inode #2: comm syz.4.687: mark_inode_dirty error [ 85.941431][ T6200] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #2: comm syz.4.687: corrupted inode contents [ 85.949078][ T6220] bridge3: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 85.953418][ T6200] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #2: comm syz.4.687: mark_inode_dirty error [ 86.077431][ T6235] loop1: detected capacity change from 0 to 512 [ 86.088991][ T6235] EXT4-fs: Ignoring removed bh option [ 86.105900][ T6235] ext4 filesystem being mounted at /147/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 86.172450][ T6235] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000. [ 86.181856][ T6234] lo speed is unknown, defaulting to 1000 [ 86.219133][ T6234] lo speed is unknown, defaulting to 1000 [ 86.229126][ T6246] loop4: detected capacity change from 0 to 2048 [ 86.631044][ T6282] lo speed is unknown, defaulting to 1000 [ 86.688336][ T6282] lo speed is unknown, defaulting to 1000 [ 87.392034][ T6310] loop0: detected capacity change from 0 to 512 [ 87.398715][ T6310] EXT4-fs: Ignoring removed bh option [ 87.526744][ T6310] ext4 filesystem being mounted at /154/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 87.565686][ T6310] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000. [ 87.650934][ T6324] lo speed is unknown, defaulting to 1000 [ 87.686986][ T6324] lo speed is unknown, defaulting to 1000 [ 87.822656][ T6343] vlan2: entered allmulticast mode [ 87.879774][ T6348] netlink: 12 bytes leftover after parsing attributes in process `syz.4.716'. [ 87.897182][ T6348] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 87.907241][ T6336] lo speed is unknown, defaulting to 1000 [ 87.980398][ T6353] loop4: detected capacity change from 0 to 2048 [ 88.004730][ T6336] lo speed is unknown, defaulting to 1000 [ 88.546646][ T6385] netlink: 12 bytes leftover after parsing attributes in process `syz.1.731'. [ 88.578805][ T6385] x_tables: unsorted entry at hook 2 [ 88.593589][ T6386] loop3: detected capacity change from 0 to 2048 [ 88.888019][ T6399] vhci_hcd: default hub control req: 8013 v0000 i0000 l31125 [ 88.928934][ T6413] loop3: detected capacity change from 0 to 512 [ 88.999242][ T6411] lo speed is unknown, defaulting to 1000 [ 89.035592][ T6411] lo speed is unknown, defaulting to 1000 [ 89.087930][ T6413] ext4 filesystem being mounted at /153/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 89.105777][ T6413] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #2: comm syz.3.740: corrupted inode contents [ 89.117648][ T6413] EXT4-fs error (device loop3): ext4_dirty_inode:6517: inode #2: comm syz.3.740: mark_inode_dirty error [ 89.129377][ T6413] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #2: comm syz.3.740: corrupted inode contents [ 89.141268][ T6413] EXT4-fs error (device loop3): __ext4_ext_dirty:206: inode #2: comm syz.3.740: mark_inode_dirty error [ 89.334426][ T6432] syzkaller1: entered promiscuous mode [ 89.339984][ T6432] syzkaller1: entered allmulticast mode [ 89.348660][ T6430] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 89.475031][ T6434] loop4: detected capacity change from 0 to 2048 [ 89.544376][ T6434] syzkaller0: entered allmulticast mode [ 89.560033][ T6434] syzkaller0: entered promiscuous mode [ 89.576633][ T6434] syzkaller0 (unregistering): left allmulticast mode [ 89.583515][ T6434] syzkaller0 (unregistering): left promiscuous mode [ 89.625169][ T6439] rdma_rxe: rxe_newlink: failed to add bond0 [ 89.903946][ T6454] syzkaller1: entered promiscuous mode [ 89.909489][ T6454] syzkaller1: entered allmulticast mode [ 90.027193][ T29] kauditd_printk_skb: 370 callbacks suppressed [ 90.027219][ T29] audit: type=1326 audit(1762031955.194:4103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6464 comm="syz.4.762" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a1f91efc9 code=0x7ffc0000 [ 90.242294][ T29] audit: type=1326 audit(1762031955.234:4104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6464 comm="syz.4.762" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a1f91efc9 code=0x7ffc0000 [ 90.265839][ T29] audit: type=1326 audit(1762031955.244:4105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6464 comm="syz.4.762" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2a1f91efc9 code=0x7ffc0000 [ 90.289276][ T29] audit: type=1326 audit(1762031955.244:4106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6464 comm="syz.4.762" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a1f91efc9 code=0x7ffc0000 [ 90.312623][ T29] audit: type=1326 audit(1762031955.244:4107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6464 comm="syz.4.762" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a1f91efc9 code=0x7ffc0000 [ 90.335963][ T29] audit: type=1326 audit(1762031955.244:4108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6464 comm="syz.4.762" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2a1f91efc9 code=0x7ffc0000 [ 90.359516][ T29] audit: type=1326 audit(1762031955.244:4109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6464 comm="syz.4.762" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a1f91efc9 code=0x7ffc0000 [ 90.383333][ T29] audit: type=1326 audit(1762031955.244:4110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6464 comm="syz.4.762" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a1f91efc9 code=0x7ffc0000 [ 90.406678][ T29] audit: type=1326 audit(1762031955.244:4111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6464 comm="syz.4.762" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7f2a1f91efc9 code=0x7ffc0000 [ 90.430044][ T29] audit: type=1326 audit(1762031955.244:4112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6464 comm="syz.4.762" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a1f91efc9 code=0x7ffc0000 [ 90.563415][ T6480] lo speed is unknown, defaulting to 1000 [ 90.579883][ T6485] loop4: detected capacity change from 0 to 2048 [ 90.605590][ T6480] lo speed is unknown, defaulting to 1000 [ 90.700596][ T6495] syzkaller1: entered promiscuous mode [ 90.706277][ T6495] syzkaller1: entered allmulticast mode [ 90.717293][ T6499] loop0: detected capacity change from 0 to 256 [ 90.723859][ T6490] loop2: detected capacity change from 0 to 512 [ 90.735660][ T6499] ======================================================= [ 90.735660][ T6499] WARNING: The mand mount option has been deprecated and [ 90.735660][ T6499] and is ignored by this kernel. Remove the mand [ 90.735660][ T6499] option from the mount to silence this warning. [ 90.735660][ T6499] ======================================================= [ 90.770580][ T6490] EXT4-fs error (device loop2): ext4_orphan_get:1392: inode #15: comm syz.2.771: inode has both inline data and extents flags [ 90.789782][ T6490] EXT4-fs error (device loop2): ext4_orphan_get:1397: comm syz.2.771: couldn't read orphan inode 15 (err -117) [ 90.825692][ T6499] FAT-fs (loop0): Directory bread(block 64) failed [ 90.833383][ T6499] FAT-fs (loop0): Directory bread(block 65) failed [ 90.840421][ T6499] FAT-fs (loop0): Directory bread(block 66) failed [ 90.847074][ T6499] FAT-fs (loop0): Directory bread(block 67) failed [ 90.853945][ T6499] FAT-fs (loop0): Directory bread(block 68) failed [ 90.860644][ T6499] FAT-fs (loop0): Directory bread(block 69) failed [ 90.867414][ T6499] FAT-fs (loop0): Directory bread(block 70) failed [ 90.905227][ T6499] FAT-fs (loop0): Directory bread(block 71) failed [ 90.913927][ T6507] syzkaller1: entered promiscuous mode [ 90.919471][ T6507] syzkaller1: entered allmulticast mode [ 90.928412][ T6499] FAT-fs (loop0): Directory bread(block 72) failed [ 90.941817][ T6505] loop2: detected capacity change from 0 to 2048 [ 90.942712][ T6499] FAT-fs (loop0): Directory bread(block 73) failed [ 90.981623][ T6511] loop4: detected capacity change from 0 to 128 [ 91.054335][ T6511] bio_check_eod: 7633 callbacks suppressed [ 91.054366][ T6511] syz.4.778: attempt to access beyond end of device [ 91.054366][ T6511] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 91.073398][ T6511] buffer_io_error: 7633 callbacks suppressed [ 91.073416][ T6511] Buffer I/O error on dev loop4, logical block 2078, async page read [ 91.108081][ T6515] netlink: 12 bytes leftover after parsing attributes in process `syz.3.780'. [ 91.126060][ T6511] syz.4.778: attempt to access beyond end of device [ 91.126060][ T6511] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 91.139382][ T6511] Buffer I/O error on dev loop4, logical block 2078, async page read [ 91.150352][ T6511] syz.4.778: attempt to access beyond end of device [ 91.150352][ T6511] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 91.163662][ T6511] Buffer I/O error on dev loop4, logical block 2078, async page read [ 91.178724][ T6515] bridge3: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 91.188876][ T6511] syz.4.778: attempt to access beyond end of device [ 91.188876][ T6511] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 91.202250][ T6511] Buffer I/O error on dev loop4, logical block 2078, async page read [ 91.210763][ T6511] syz.4.778: attempt to access beyond end of device [ 91.210763][ T6511] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 91.218982][ T6524] netlink: 8 bytes leftover after parsing attributes in process `syz.1.782'. [ 91.224038][ T6511] Buffer I/O error on dev loop4, logical block 2078, async page read [ 91.287839][ T6526] loop2: detected capacity change from 0 to 2048 [ 91.295100][ T6524] ip6gretap0: entered promiscuous mode [ 91.297532][ T6511] syz.4.778: attempt to access beyond end of device [ 91.297532][ T6511] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 91.313753][ T6511] Buffer I/O error on dev loop4, logical block 2078, async page read [ 91.322705][ T6524] ip6gretap0: left promiscuous mode [ 91.330044][ T6511] syz.4.778: attempt to access beyond end of device [ 91.330044][ T6511] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 91.343344][ T6511] Buffer I/O error on dev loop4, logical block 2078, async page read [ 91.354058][ T6511] syz.4.778: attempt to access beyond end of device [ 91.354058][ T6511] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 91.367254][ T6511] Buffer I/O error on dev loop4, logical block 2078, async page read [ 91.375809][ T6511] syz.4.778: attempt to access beyond end of device [ 91.375809][ T6511] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 91.389010][ T6511] Buffer I/O error on dev loop4, logical block 2078, async page read [ 91.397616][ T6511] syz.4.778: attempt to access beyond end of device [ 91.397616][ T6511] loop4: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 91.410830][ T6511] Buffer I/O error on dev loop4, logical block 2078, async page read [ 91.469828][ T6538] syzkaller1: entered promiscuous mode [ 91.475393][ T6538] syzkaller1: entered allmulticast mode [ 91.690616][ T6543] lo speed is unknown, defaulting to 1000 [ 91.708562][ T6556] FAULT_INJECTION: forcing a failure. [ 91.708562][ T6556] name failslab, interval 1, probability 0, space 0, times 0 [ 91.721309][ T6556] CPU: 1 UID: 0 PID: 6556 Comm: syz.3.791 Not tainted syzkaller #0 PREEMPT(voluntary) [ 91.721334][ T6556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 91.721348][ T6556] Call Trace: [ 91.721430][ T6556] [ 91.721437][ T6556] __dump_stack+0x1d/0x30 [ 91.721458][ T6556] dump_stack_lvl+0xe8/0x140 [ 91.721476][ T6556] dump_stack+0x15/0x1b [ 91.721493][ T6556] should_fail_ex+0x265/0x280 [ 91.721516][ T6556] ? rtnl_newlink+0x5c/0x12d0 [ 91.721562][ T6556] should_failslab+0x8c/0xb0 [ 91.721658][ T6556] __kmalloc_cache_noprof+0x4c/0x4a0 [ 91.721692][ T6556] rtnl_newlink+0x5c/0x12d0 [ 91.721719][ T6556] ? css_rstat_updated+0xb7/0x240 [ 91.721762][ T6556] ? css_rstat_updated+0xb7/0x240 [ 91.721867][ T6556] ? refill_stock+0x32f/0x390 [ 91.721899][ T6556] ? x86_call_depth_emit_accounting+0x128/0x2e0 [ 91.721938][ T6556] ? __rcu_read_unlock+0x4f/0x70 [ 91.721970][ T6556] ? percpu_array_map_lookup_percpu_elem+0x9c/0xd0 [ 91.722025][ T6556] ? __rcu_read_unlock+0x34/0x70 [ 91.722049][ T6556] ? bpf_trace_run3+0x12c/0x1d0 [ 91.722080][ T6556] ? __kfree_skb+0x109/0x150 [ 91.722196][ T6556] ? __rcu_read_unlock+0x4f/0x70 [ 91.722238][ T6556] ? avc_has_perm_noaudit+0x1b1/0x200 [ 91.722400][ T6556] ? cred_has_capability+0x210/0x280 [ 91.722436][ T6556] ? selinux_capable+0x31/0x40 [ 91.722464][ T6556] ? security_capable+0x83/0x90 [ 91.722506][ T6556] ? ns_capable+0x7d/0xb0 [ 91.722623][ T6556] ? __pfx_rtnl_newlink+0x10/0x10 [ 91.722647][ T6556] rtnetlink_rcv_msg+0x5fe/0x6d0 [ 91.722674][ T6556] netlink_rcv_skb+0x123/0x220 [ 91.722793][ T6556] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 91.722831][ T6556] rtnetlink_rcv+0x1c/0x30 [ 91.722859][ T6556] netlink_unicast+0x5c0/0x690 [ 91.722929][ T6556] netlink_sendmsg+0x58b/0x6b0 [ 91.722956][ T6556] ? __pfx_netlink_sendmsg+0x10/0x10 [ 91.722980][ T6556] __sock_sendmsg+0x145/0x180 [ 91.723013][ T6556] ____sys_sendmsg+0x31e/0x4e0 [ 91.723101][ T6556] ___sys_sendmsg+0x17b/0x1d0 [ 91.723141][ T6556] __x64_sys_sendmsg+0xd4/0x160 [ 91.723173][ T6556] x64_sys_call+0x191e/0x3000 [ 91.723201][ T6556] do_syscall_64+0xd2/0x200 [ 91.723231][ T6556] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 91.723269][ T6556] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 91.723401][ T6556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.723428][ T6556] RIP: 0033:0x7ff87208efc9 [ 91.723447][ T6556] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 91.723468][ T6556] RSP: 002b:00007ff870aef038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 91.723492][ T6556] RAX: ffffffffffffffda RBX: 00007ff8722e5fa0 RCX: 00007ff87208efc9 [ 91.723508][ T6556] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000005 [ 91.723524][ T6556] RBP: 00007ff870aef090 R08: 0000000000000000 R09: 0000000000000000 [ 91.723558][ T6556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 91.723574][ T6556] R13: 00007ff8722e6038 R14: 00007ff8722e5fa0 R15: 00007ffce5393488 [ 91.723595][ T6556] [ 92.101107][ T6565] netlink: 12 bytes leftover after parsing attributes in process `syz.2.795'. [ 92.141484][ T6565] bridge5: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 92.209488][ T6567] loop3: detected capacity change from 0 to 2048 [ 92.251913][ T6543] lo speed is unknown, defaulting to 1000 [ 92.301997][ T6576] syzkaller1: entered promiscuous mode [ 92.307574][ T6576] syzkaller1: entered allmulticast mode [ 92.362043][ T6584] loop3: detected capacity change from 0 to 512 [ 92.736805][ T6593] netlink: 'syz.2.803': attribute type 12 has an invalid length. [ 92.744627][ T6593] netlink: 'syz.2.803': attribute type 29 has an invalid length. [ 92.752421][ T6593] netlink: 148 bytes leftover after parsing attributes in process `syz.2.803'. [ 92.761508][ T6593] netlink: 59 bytes leftover after parsing attributes in process `syz.2.803'. [ 92.868361][ T6595] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 92.911645][ T6595] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 93.120767][ T6597] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 93.198111][ T6607] loop0: detected capacity change from 0 to 2048 [ 93.247477][ T6610] syzkaller1: entered promiscuous mode [ 93.253122][ T6610] syzkaller1: entered allmulticast mode [ 93.295164][ T6607] syzkaller0: entered allmulticast mode [ 93.303197][ T6607] syzkaller0: entered promiscuous mode [ 93.338736][ T6607] syzkaller0 (unregistering): left allmulticast mode [ 93.345526][ T6607] syzkaller0 (unregistering): left promiscuous mode [ 93.373652][ T6615] loop3: detected capacity change from 0 to 2048 [ 93.411092][ T6609] lo speed is unknown, defaulting to 1000 [ 93.419029][ T6614] syzkaller1: entered promiscuous mode [ 93.424599][ T6614] syzkaller1: entered allmulticast mode [ 93.461608][ T6609] lo speed is unknown, defaulting to 1000 [ 93.471716][ T6617] rdma_rxe: rxe_newlink: failed to add bond0 [ 93.652456][ T6633] vlan2: entered allmulticast mode [ 93.768568][ T6645] vlan2: entered allmulticast mode [ 93.793974][ T6634] lo speed is unknown, defaulting to 1000 [ 93.830687][ T6634] lo speed is unknown, defaulting to 1000 [ 93.850026][ T6654] syzkaller1: entered promiscuous mode [ 93.855728][ T6654] syzkaller1: entered allmulticast mode [ 93.909162][ T6657] netlink: 8 bytes leftover after parsing attributes in process `syz.3.826'. [ 93.925281][ T6657] ip6gretap0: entered promiscuous mode [ 93.932494][ T6657] ip6gretap0: left promiscuous mode [ 94.000712][ T6660] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 94.531466][ T6678] vlan2: entered allmulticast mode [ 94.594355][ T6684] loop1: detected capacity change from 0 to 512 [ 94.602063][ T6684] EXT4-fs: Ignoring removed bh option [ 94.647403][ T6684] ext4 filesystem being mounted at /172/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 94.693041][ T6684] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000. [ 94.725946][ T6676] lo speed is unknown, defaulting to 1000 [ 94.793199][ T6676] lo speed is unknown, defaulting to 1000 [ 94.928087][ T6715] netlink: 12 bytes leftover after parsing attributes in process `syz.2.847'. [ 94.959594][ T6715] bridge6: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 94.969664][ T6705] lo speed is unknown, defaulting to 1000 [ 95.010664][ T6705] lo speed is unknown, defaulting to 1000 [ 95.028278][ T6719] vlan2: entered allmulticast mode [ 95.108371][ T29] kauditd_printk_skb: 326 callbacks suppressed [ 95.108388][ T29] audit: type=1326 audit(2000000002.740:4439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.0.850" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 95.138194][ T29] audit: type=1326 audit(2000000002.740:4440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.0.850" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 95.161574][ T29] audit: type=1326 audit(2000000002.760:4441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.0.850" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 95.185058][ T29] audit: type=1326 audit(2000000002.760:4442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.0.850" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 95.208415][ T29] audit: type=1326 audit(2000000002.760:4443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.0.850" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 95.231889][ T29] audit: type=1326 audit(2000000002.760:4444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.0.850" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 95.255269][ T29] audit: type=1326 audit(2000000002.760:4445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.0.850" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 95.278633][ T29] audit: type=1326 audit(2000000002.760:4446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.0.850" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 95.301964][ T29] audit: type=1326 audit(2000000002.760:4447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.0.850" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 95.325357][ T29] audit: type=1326 audit(2000000002.760:4448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6722 comm="syz.0.850" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f860e55efc9 code=0x7ffc0000 [ 95.432836][ T6728] netlink: 8 bytes leftover after parsing attributes in process `syz.4.852'. [ 95.453225][ T6728] ip6gretap0: entered promiscuous mode [ 95.461647][ T6728] ip6gretap0: left promiscuous mode [ 95.949430][ T6763] loop3: detected capacity change from 0 to 128 [ 95.956149][ T6762] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 95.998161][ T6763] ext4 filesystem being mounted at /183/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 96.030027][ T6751] lo speed is unknown, defaulting to 1000 [ 96.146076][ T6751] lo speed is unknown, defaulting to 1000 [ 96.365257][ T6808] syzkaller1: entered promiscuous mode [ 96.370873][ T6808] syzkaller1: entered allmulticast mode [ 96.641332][ T6850] syzkaller1: entered promiscuous mode [ 96.646856][ T6850] syzkaller1: entered allmulticast mode [ 96.719146][ T6862] netlink: 8 bytes leftover after parsing attributes in process `syz.2.878'. [ 96.731606][ T6862] ip6gretap0: entered promiscuous mode [ 96.738960][ T6862] ip6gretap0: left promiscuous mode [ 97.564957][ T6982] loop4: detected capacity change from 0 to 512 [ 97.577413][ T6982] EXT4-fs: Ignoring removed bh option [ 97.604407][ T6984] syzkaller1: entered promiscuous mode [ 97.609916][ T6984] syzkaller1: entered allmulticast mode [ 97.619013][ T6982] ext4 filesystem being mounted at /181/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 97.631709][ T6982] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000. [ 97.949489][ T7004] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 98.128554][ T7016] loop0: detected capacity change from 0 to 512 [ 98.144080][ T7016] EXT4-fs: Ignoring removed bh option [ 98.172200][ T7016] ext4 filesystem being mounted at /195/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 98.239654][ T7020] loop1: detected capacity change from 0 to 512 [ 98.256664][ T7016] EXT4-fs (loop0): re-mounted 00000000-0000-0000-0000-000000000000. [ 98.290679][ T7020] EXT4-fs error (device loop1): ext4_orphan_get:1392: inode #15: comm syz.1.912: inode has both inline data and extents flags [ 98.308043][ T7020] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.912: couldn't read orphan inode 15 (err -117) [ 98.346261][ T7024] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 98.366272][ T7024] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 98.456082][ T7029] vlan2: entered allmulticast mode [ 98.593188][ T7036] loop0: detected capacity change from 0 to 2048 [ 98.798835][ T7053] loop4: detected capacity change from 0 to 512 [ 98.820682][ T7053] EXT4-fs: Ignoring removed bh option [ 98.824161][ T7044] lo speed is unknown, defaulting to 1000 [ 98.858070][ T7053] ext4 filesystem being mounted at /186/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 98.884019][ T7044] lo speed is unknown, defaulting to 1000 [ 98.918330][ T7053] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000. [ 98.928990][ T7055] loop3: detected capacity change from 0 to 512 [ 98.952256][ T7055] EXT4-fs error (device loop3): ext4_orphan_get:1392: inode #15: comm syz.3.924: inode has both inline data and extents flags [ 98.966930][ T7055] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.924: couldn't read orphan inode 15 (err -117) [ 98.982376][ T7064] netlink: 8 bytes leftover after parsing attributes in process `syz.0.927'. [ 99.012301][ T7064] ip6gretap0: entered promiscuous mode [ 99.027497][ T7066] loop4: detected capacity change from 0 to 512 [ 99.029849][ T7064] ip6gretap0: left promiscuous mode [ 99.040041][ T3314] EXT4-fs unmount: 30 callbacks suppressed [ 99.045957][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 99.083803][ T7071] loop3: detected capacity change from 0 to 512 [ 99.115322][ T7071] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 99.128451][ T7071] ext4 filesystem being mounted at /190/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 99.141565][ T7071] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #2: comm syz.3.929: corrupted inode contents [ 99.167103][ T7071] EXT4-fs error (device loop3): ext4_dirty_inode:6517: inode #2: comm syz.3.929: mark_inode_dirty error [ 99.178725][ T7071] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #2: comm syz.3.929: corrupted inode contents [ 99.190877][ T7071] EXT4-fs error (device loop3): __ext4_ext_dirty:206: inode #2: comm syz.3.929: mark_inode_dirty error [ 99.222408][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 99.257231][ T7079] syzkaller1: entered promiscuous mode [ 99.262833][ T7079] syzkaller1: entered allmulticast mode [ 99.376541][ T7084] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 99.476240][ T7091] loop3: detected capacity change from 0 to 512 [ 99.496464][ T7091] EXT4-fs: Ignoring removed bh option [ 99.508638][ T7093] netlink: 12 bytes leftover after parsing attributes in process `syz.1.937'. [ 99.530144][ T7093] bridge5: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 99.552712][ T7091] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 99.585518][ T7091] ext4 filesystem being mounted at /194/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 99.606351][ T7091] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000. [ 99.630404][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 99.660783][ T7099] loop1: detected capacity change from 0 to 512 [ 99.672078][ T7099] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 99.684849][ T7099] ext4 filesystem being mounted at /190/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 99.696641][ T7099] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #2: comm syz.1.940: corrupted inode contents [ 99.708662][ T7099] EXT4-fs error (device loop1): ext4_dirty_inode:6517: inode #2: comm syz.1.940: mark_inode_dirty error [ 99.720256][ T7099] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #2: comm syz.1.940: corrupted inode contents [ 99.732114][ T7099] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.940: mark_inode_dirty error [ 99.745956][ T7103] netlink: 12 bytes leftover after parsing attributes in process `syz.3.939'. [ 99.757336][ T3318] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 99.769753][ T7103] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 99.981186][ T7123] loop1: detected capacity change from 0 to 128 [ 100.009107][ T7125] netlink: 12 bytes leftover after parsing attributes in process `syz.2.949'. [ 100.022661][ T7125] bridge7: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 100.060235][ T7126] FAULT_INJECTION: forcing a failure. [ 100.060235][ T7126] name failslab, interval 1, probability 0, space 0, times 0 [ 100.073013][ T7126] CPU: 1 UID: 0 PID: 7126 Comm: syz.3.946 Not tainted syzkaller #0 PREEMPT(voluntary) [ 100.073046][ T7126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 100.073061][ T7126] Call Trace: [ 100.073070][ T7126] [ 100.073079][ T7126] __dump_stack+0x1d/0x30 [ 100.073102][ T7126] dump_stack_lvl+0xe8/0x140 [ 100.073158][ T7126] dump_stack+0x15/0x1b [ 100.073178][ T7126] should_fail_ex+0x265/0x280 [ 100.073254][ T7126] should_failslab+0x8c/0xb0 [ 100.073296][ T7126] kmem_cache_alloc_noprof+0x50/0x480 [ 100.073325][ T7126] ? create_new_namespaces+0x3c/0x3d0 [ 100.073348][ T7126] create_new_namespaces+0x3c/0x3d0 [ 100.073393][ T7126] unshare_nsproxy_namespaces+0xe8/0x120 [ 100.073462][ T7126] ksys_unshare+0x3d0/0x6d0 [ 100.073497][ T7126] __x64_sys_unshare+0x1f/0x30 [ 100.073557][ T7126] x64_sys_call+0x2915/0x3000 [ 100.073580][ T7126] do_syscall_64+0xd2/0x200 [ 100.073667][ T7126] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 100.073748][ T7126] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 100.073780][ T7126] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.073874][ T7126] RIP: 0033:0x7ff87208efc9 [ 100.073888][ T7126] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 100.073919][ T7126] RSP: 002b:00007ff870aad038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 100.074011][ T7126] RAX: ffffffffffffffda RBX: 00007ff8722e6180 RCX: 00007ff87208efc9 [ 100.074026][ T7126] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c040000 [ 100.074041][ T7126] RBP: 00007ff870aad090 R08: 0000000000000000 R09: 0000000000000000 [ 100.074056][ T7126] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 100.074070][ T7126] R13: 00007ff8722e6218 R14: 00007ff8722e6180 R15: 00007ffce5393488 [ 100.074091][ T7126] [ 100.275906][ T7130] loop2: detected capacity change from 0 to 512 [ 100.283760][ T7130] EXT4-fs: Ignoring removed bh option [ 100.324092][ T7130] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 100.337030][ T7130] ext4 filesystem being mounted at /163/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 100.349971][ T7133] bio_check_eod: 6588 callbacks suppressed [ 100.349990][ T7133] syz.1.948: attempt to access beyond end of device [ 100.349990][ T7133] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 100.356476][ T29] kauditd_printk_skb: 815 callbacks suppressed [ 100.356494][ T29] audit: type=1400 audit(2000000001.050:5264): avc: denied { create } for pid=7117 comm="syz.3.946" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 100.369093][ T7133] buffer_io_error: 6588 callbacks suppressed [ 100.369109][ T7133] Buffer I/O error on dev loop1, logical block 2078, async page read [ 100.375267][ T29] audit: type=1400 audit(2000000001.050:5265): avc: denied { getopt } for pid=7117 comm="syz.3.946" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 100.397645][ T7133] syz.1.948: attempt to access beyond end of device [ 100.397645][ T7133] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 100.441113][ T7133] Buffer I/O error on dev loop1, logical block 2078, async page read [ 100.449707][ T7133] syz.1.948: attempt to access beyond end of device [ 100.449707][ T7133] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 100.462879][ T7133] Buffer I/O error on dev loop1, logical block 2078, async page read [ 100.481685][ T7133] syz.1.948: attempt to access beyond end of device [ 100.481685][ T7133] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 100.494939][ T7133] Buffer I/O error on dev loop1, logical block 2078, async page read [ 100.500223][ T29] audit: type=1326 audit(2000000001.450:5266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7129 comm="syz.2.950" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 100.526514][ T29] audit: type=1326 audit(2000000001.460:5267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7129 comm="syz.2.950" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 100.537522][ T7133] syz.1.948: attempt to access beyond end of device [ 100.537522][ T7133] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 100.550163][ T29] audit: type=1326 audit(2000000001.460:5268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7129 comm="syz.2.950" exe="/root/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 100.563110][ T7133] Buffer I/O error on dev loop1, logical block 2078, async page read [ 100.564217][ T7130] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000. [ 100.586597][ T29] audit: type=1326 audit(2000000001.460:5269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7129 comm="syz.2.950" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 100.595131][ T7133] syz.1.948: attempt to access beyond end of device [ 100.595131][ T7133] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 100.602882][ T29] audit: type=1326 audit(2000000001.460:5270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7129 comm="syz.2.950" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 100.626165][ T7133] Buffer I/O error on dev loop1, logical block 2078, async page read [ 100.639274][ T29] audit: type=1326 audit(2000000001.460:5271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7129 comm="syz.2.950" exe="/root/syz-executor" sig=0 arch=c000003e syscall=240 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 100.639307][ T29] audit: type=1326 audit(2000000001.460:5272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7129 comm="syz.2.950" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 100.706696][ T7139] lo speed is unknown, defaulting to 1000 [ 100.717429][ T29] audit: type=1326 audit(2000000001.460:5273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7129 comm="syz.2.950" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47a25aefc9 code=0x7ffc0000 [ 100.755655][ T7139] lo speed is unknown, defaulting to 1000 [ 100.780328][ T7133] syz.1.948: attempt to access beyond end of device [ 100.780328][ T7133] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 100.793532][ T7133] Buffer I/O error on dev loop1, logical block 2078, async page read [ 100.804779][ T7133] syz.1.948: attempt to access beyond end of device [ 100.804779][ T7133] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 100.818004][ T7133] Buffer I/O error on dev loop1, logical block 2078, async page read [ 100.840794][ T7133] syz.1.948: attempt to access beyond end of device [ 100.840794][ T7133] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 100.854180][ T7133] Buffer I/O error on dev loop1, logical block 2078, async page read [ 100.865130][ T7133] syz.1.948: attempt to access beyond end of device [ 100.865130][ T7133] loop1: rw=0, sector=2078, nr_sectors = 1 limit=128 [ 100.878321][ T7133] Buffer I/O error on dev loop1, logical block 2078, async page read [ 100.893093][ T7142] loop4: detected capacity change from 0 to 512 [ 100.903474][ T3327] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 100.934732][ T7142] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 100.954507][ T7146] netlink: 8 bytes leftover after parsing attributes in process `syz.2.953'. [ 100.965926][ T7146] ip6gretap0: entered promiscuous mode [ 100.973171][ T7142] ext4 filesystem being mounted at /191/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 100.976824][ T7146] ip6gretap0: left promiscuous mode [ 100.985450][ T7142] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #2: comm syz.4.952: corrupted inode contents [ 101.002598][ T7142] EXT4-fs error (device loop4): ext4_dirty_inode:6517: inode #2: comm syz.4.952: mark_inode_dirty error [ 101.016216][ T7142] EXT4-fs error (device loop4): ext4_do_update_inode:5632: inode #2: comm syz.4.952: corrupted inode contents [ 101.030221][ T7142] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #2: comm syz.4.952: mark_inode_dirty error [ 101.060457][ T3323] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 101.248632][ T7157] loop4: detected capacity change from 0 to 2048 [ 101.557704][ T7173] syzkaller1: entered promiscuous mode [ 101.563344][ T7173] syzkaller1: entered allmulticast mode [ 101.577411][ T7175] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 101.718256][ T7180] vlan2: entered allmulticast mode [ 101.875183][ T7193] netlink: 'syz.4.970': attribute type 12 has an invalid length. [ 101.883057][ T7193] netlink: 'syz.4.970': attribute type 29 has an invalid length. [ 101.890869][ T7193] netlink: 148 bytes leftover after parsing attributes in process `syz.4.970'. [ 101.899825][ T7193] netlink: 59 bytes leftover after parsing attributes in process `syz.4.970'. [ 101.933169][ T7195] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 101.965814][ T7193] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 101.973954][ T7193] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 102.090336][ T7207] netlink: 12 bytes leftover after parsing attributes in process `syz.0.976'. [ 102.152707][ T7217] loop1: detected capacity change from 0 to 512 [ 102.159687][ T7217] EXT4-fs: Ignoring removed bh option [ 102.182050][ T7217] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 102.220235][ T7226] loop4: detected capacity change from 0 to 512 [ 102.220482][ T7217] ext4 filesystem being mounted at /203/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 102.263853][ T7217] EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000. [ 102.299311][ T3318] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 102.354837][ T7230] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 102.366480][ T7230] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 102.555403][ T7241] FAULT_INJECTION: forcing a failure. [ 102.555403][ T7241] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 102.568651][ T7241] CPU: 1 UID: 0 PID: 7241 Comm: syz.1.990 Not tainted syzkaller #0 PREEMPT(voluntary) [ 102.568685][ T7241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 102.568744][ T7241] Call Trace: [ 102.568752][ T7241] [ 102.568761][ T7241] __dump_stack+0x1d/0x30 [ 102.568788][ T7241] dump_stack_lvl+0xe8/0x140 [ 102.568822][ T7241] dump_stack+0x15/0x1b [ 102.568843][ T7241] should_fail_ex+0x265/0x280 [ 102.568868][ T7241] should_fail+0xb/0x20 [ 102.568911][ T7241] should_fail_usercopy+0x1a/0x20 [ 102.568936][ T7241] _copy_from_user+0x1c/0xb0 [ 102.568966][ T7241] perf_copy_attr+0x145/0x610 [ 102.568997][ T7241] __se_sys_perf_event_open+0x67/0x11c0 [ 102.569073][ T7241] ? vfs_write+0x7e8/0x960 [ 102.569105][ T7241] ? __rcu_read_unlock+0x4f/0x70 [ 102.569140][ T7241] __x64_sys_perf_event_open+0x67/0x80 [ 102.569170][ T7241] x64_sys_call+0x7bd/0x3000 [ 102.569197][ T7241] do_syscall_64+0xd2/0x200 [ 102.569301][ T7241] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 102.569332][ T7241] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 102.569402][ T7241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.569507][ T7241] RIP: 0033:0x7f51ccaaefc9 [ 102.569525][ T7241] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 102.569546][ T7241] RSP: 002b:00007f51cb517038 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 102.569569][ T7241] RAX: ffffffffffffffda RBX: 00007f51ccd05fa0 RCX: 00007f51ccaaefc9 [ 102.569584][ T7241] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 102.569598][ T7241] RBP: 00007f51cb517090 R08: 0000000000000000 R09: 0000000000000000 [ 102.569610][ T7241] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 102.569701][ T7241] R13: 00007f51ccd06038 R14: 00007f51ccd05fa0 R15: 00007ffebfacb778 [ 102.569724][ T7241] [ 102.870862][ T7249] lo speed is unknown, defaulting to 1000 [ 102.927789][ T7249] lo speed is unknown, defaulting to 1000 [ 103.100442][ T7252] loop0: detected capacity change from 0 to 512 [ 103.209474][ T7252] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 103.227406][ T7258] loop4: detected capacity change from 0 to 128 [ 103.305272][ T7252] ext4 filesystem being mounted at /212/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 103.378158][ T7252] EXT4-fs error (device loop0): ext4_do_update_inode:5632: inode #2: comm syz.0.995: corrupted inode contents [ 103.440414][ T7252] EXT4-fs error (device loop0): ext4_dirty_inode:6517: inode #2: comm syz.0.995: mark_inode_dirty error [ 103.571233][ T7252] EXT4-fs error (device loop0): ext4_do_update_inode:5632: inode #2: comm syz.0.995: corrupted inode contents [ 103.602459][ T7252] EXT4-fs error (device loop0): __ext4_ext_dirty:206: inode #2: comm syz.0.995: mark_inode_dirty error [ 103.653304][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 103.865047][ T7288] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 103.873672][ T7288] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 103.907272][ T7286] loop1: detected capacity change from 0 to 512 [ 103.917673][ T7286] EXT4-fs error (device loop1): ext4_orphan_get:1392: inode #15: comm syz.1.1005: inode has both inline data and extents flags [ 103.939784][ T7286] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.1005: couldn't read orphan inode 15 (err -117) [ 103.998712][ T7293] loop3: detected capacity change from 0 to 512 [ 104.008257][ T7294] vlan2: entered allmulticast mode [ 104.019195][ T7286] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 104.109936][ T7299] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 104.201364][ T3318] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 104.287777][ T7317] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1018'. [ 104.297787][ T7314] netlink: 'syz.1.1017': attribute type 12 has an invalid length. [ 104.305674][ T7314] netlink: 'syz.1.1017': attribute type 29 has an invalid length. [ 104.313667][ T7314] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1017'. [ 104.322727][ T7314] netlink: 59 bytes leftover after parsing attributes in process `syz.1.1017'. [ 104.334319][ T7317] ip6gretap0: entered promiscuous mode [ 104.375013][ T7317] ip6gretap0: left promiscuous mode [ 104.400947][ T7321] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 104.408893][ T7321] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 104.424753][ T7323] loop4: detected capacity change from 0 to 128 [ 104.438718][ T3307] ================================================================== [ 104.446864][ T3307] BUG: KCSAN: data-race in __dentry_kill / fast_dput [ 104.453573][ T3307] [ 104.455928][ T3307] write to 0xffff88811ac51cd0 of 8 bytes by task 3005 on cpu 1: [ 104.463570][ T3307] __dentry_kill+0x142/0x4b0 [ 104.468184][ T3307] dput+0x5e/0xd0 [ 104.471833][ T3307] step_into+0x58c/0x7f0 [ 104.476097][ T3307] walk_component+0x162/0x220 [ 104.480800][ T3307] path_lookupat+0xfe/0x2a0 [ 104.485339][ T3307] filename_lookup+0x2d7/0x340 [ 104.490147][ T3307] do_readlinkat+0x7d/0x320 [ 104.494685][ T3307] __x64_sys_readlink+0x47/0x60 [ 104.499571][ T3307] x64_sys_call+0x28de/0x3000 [ 104.504264][ T3307] do_syscall_64+0xd2/0x200 [ 104.508784][ T3307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.514722][ T3307] [ 104.517074][ T3307] read to 0xffff88811ac51cd0 of 8 bytes by task 3307 on cpu 0: [ 104.524652][ T3307] fast_dput+0x5f/0x2c0 [ 104.528858][ T3307] dput+0x24/0xd0 [ 104.532520][ T3307] do_unlinkat+0x259/0x480 [ 104.536951][ T3307] __x64_sys_unlink+0x2e/0x40 [ 104.541665][ T3307] x64_sys_call+0x2dcf/0x3000 [ 104.546376][ T3307] do_syscall_64+0xd2/0x200 [ 104.550908][ T3307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.556826][ T3307] [ 104.559158][ T3307] value changed: 0xffff888237682700 -> 0x0000000000000000 [ 104.566268][ T3307] [ 104.568597][ T3307] Reported by Kernel Concurrency Sanitizer on: [ 104.574753][ T3307] CPU: 0 UID: 0 PID: 3307 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) [ 104.584052][ T3307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 104.594122][ T3307] ==================================================================