last executing test programs: 1.670278259s ago: executing program 0 (id=1): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1000, 0x103) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80800, 0x0) r3 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x5]}, 0x8) mount$9p_fd(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000240), 0x10, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) poll(&(0x7f0000000140)=[{r2, 0x20b6}], 0x1, 0x76) r4 = creat(&(0x7f00000002c0)='./file1\x00', 0x1) writev(r4, &(0x7f0000000400), 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='kfree\x00', r1, 0x0, 0x2}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="18010000030000000000000000030000850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x80003, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1002}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0}, 0x18) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x3000046, &(0x7f0000000bc0)={[{@dioread_nolock}, {@data_err_abort}, {@inlinecrypt}, {@noauto_da_alloc}, {@data_err_ignore}, {@nojournal_checksum}, {@errors_remount}, {@grpquota}, {@noblock_validity}, {@user_xattr}, {@nombcache}, {@errors_remount}]}, 0x11, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x40) pwritev2(r5, 0x0, 0x0, 0x5405, 0x0, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r5, 0xc020662a, &(0x7f0000000380)={0x3fffffffbfb, 0x5, 0x5, 0x7f}) syz_emit_ethernet(0x3b6, &(0x7f0000000000)=ANY=[], 0x0) r6 = socket(0x2, 0x5, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, 0x0) getsockopt$inet_sctp_SCTP_STATUS(r6, 0x84, 0xe, &(0x7f0000000140)={r8, 0x8, 0x9, 0xffff, 0x8fb, 0x80, 0x5, 0x735d, {r8, @in={{0x2, 0x4e22, @broadcast}}, 0x1, 0x7, 0x1, 0x9, 0x4ee}}, &(0x7f0000000200)=0xb0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000340)={r8, 0xb8, &(0x7f0000000680)=[@in6={0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, '\x00', 0x43}, 0xfffffffd}, @in6={0xa, 0x4e21, 0x8, @local, 0x6}, @in6={0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x9}, @in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x4c4b, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7}, @in6={0xa, 0x4e21, 0x400, @private2={0xfc, 0x2, '\x00', 0x1}, 0x2d6}, @in6={0xa, 0x4e22, 0x3445, @loopback, 0xa16e}]}, &(0x7f00000003c0)=0x10) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r11) getsockname$packet(r11, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000900)=@delchain={0x4c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r12, {0xf}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0x20, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x1, 0x9}}, @TCA_FW_INDEV={0x14, 0x3, 'xfrm0\x00'}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) sendmsg$nl_route_sched(r9, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000980)=@delqdisc={0x158, 0x25, 0x200, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, {0xfff2, 0x10}, {0xb, 0xb}, {0x2, 0x6}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_QUANTUM={0x8, 0x3, 0xffffffff}, @TCA_FQ_INITIAL_QUANTUM={0x8, 0x4, 0xe8d8}]}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x80000001}, @qdisc_kind_options=@q_ingress={0xc}, @TCA_RATE={0x6, 0x5, {0x2, 0x8}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x7}, @TCA_STAB={0x74, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xb, 0xec, 0x2, 0x0, 0x1, 0x81, 0x8, 0x4}}, {0xc, 0x2, [0x1000, 0x49, 0x8, 0x5]}}, {{0x1c, 0x1, {0x0, 0x4, 0x5, 0x5, 0x1, 0x0, 0x6, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x4, 0x5, 0x9, 0x9, 0x0, 0x80000000, 0xfffffffb, 0x2}}, {0x8, 0x2, [0x2815, 0x800]}}]}, @TCA_STAB={0x80, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xfe, 0xf, 0x1, 0x7fffffff, 0x0, 0x2, 0x4, 0x6}}, {0x10, 0x2, [0x100, 0x5, 0x3, 0x7, 0x9c, 0x1c]}}, {{0x1c, 0x1, {0x8, 0x3, 0xc1, 0x5, 0x2, 0xd88, 0x318f13ce, 0x3}}, {0xa, 0x2, [0x8000, 0x9, 0xa]}}, {{0x1c, 0x1, {0x3, 0x4, 0x4, 0xff, 0x2, 0x8, 0x101, 0x4}}, {0xc, 0x2, [0x8, 0x3041, 0x3, 0x4]}}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x81}, 0x4000) 1.571363093s ago: executing program 3 (id=4): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1000, 0x103) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80800, 0x0) r3 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x5]}, 0x8) mount$9p_fd(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000240), 0x10, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) poll(&(0x7f0000000140)=[{r2, 0x20b6}], 0x1, 0x76) r4 = creat(&(0x7f00000002c0)='./file1\x00', 0x1) writev(r4, &(0x7f0000000400), 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='kfree\x00', r1, 0x0, 0x2}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="18010000030000000000000000030000850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x80003, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1002}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0}, 0x18) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x3000046, &(0x7f0000000bc0)={[{@dioread_nolock}, {@data_err_abort}, {@inlinecrypt}, {@noauto_da_alloc}, {@data_err_ignore}, {@nojournal_checksum}, {@errors_remount}, {@grpquota}, {@noblock_validity}, {@user_xattr}, {@nombcache}, {@errors_remount}]}, 0x11, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x40) pwritev2(r5, 0x0, 0x0, 0x5405, 0x0, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r5, 0xc020662a, &(0x7f0000000380)={0x3fffffffbfb, 0x5, 0x5, 0x7f}) syz_emit_ethernet(0x3b6, &(0x7f0000000000)=ANY=[], 0x0) r6 = socket(0x2, 0x5, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r6, 0x84, 0xe, &(0x7f0000000140)={r8, 0x8, 0x9, 0xffff, 0x8fb, 0x80, 0x5, 0x735d, {r8, @in={{0x2, 0x4e22, @broadcast}}, 0x1, 0x7, 0x1, 0x9, 0x4ee}}, &(0x7f0000000200)=0xb0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000340)={r8, 0x9c, &(0x7f0000000680)=[@in6={0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, '\x00', 0x43}, 0xfffffffd}, @in6={0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x9}, @in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x4c4b, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7}, @in6={0xa, 0x4e21, 0x400, @private2={0xfc, 0x2, '\x00', 0x1}, 0x2d6}, @in6={0xa, 0x4e22, 0x3445, @loopback, 0xa16e}]}, &(0x7f00000003c0)=0x10) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r11) getsockname$packet(r11, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000900)=@delchain={0x4c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r12, {0xf}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0x20, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x1, 0x9}}, @TCA_FW_INDEV={0x14, 0x3, 'xfrm0\x00'}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) sendmsg$nl_route_sched(r9, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000980)=@delqdisc={0x158, 0x25, 0x200, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, {0xfff2, 0x10}, {0xb, 0xb}, {0x2, 0x6}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_QUANTUM={0x8, 0x3, 0xffffffff}, @TCA_FQ_INITIAL_QUANTUM={0x8, 0x4, 0xe8d8}]}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x80000001}, @qdisc_kind_options=@q_ingress={0xc}, @TCA_RATE={0x6, 0x5, {0x2, 0x8}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x7}, @TCA_STAB={0x74, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xb, 0xec, 0x2, 0x0, 0x1, 0x81, 0x8, 0x4}}, {0xc, 0x2, [0x1000, 0x49, 0x8, 0x5]}}, {{0x1c, 0x1, {0x0, 0x4, 0x5, 0x5, 0x1, 0x0, 0x6, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x4, 0x5, 0x9, 0x9, 0x0, 0x80000000, 0xfffffffb, 0x2}}, {0x8, 0x2, [0x2815, 0x800]}}]}, @TCA_STAB={0x80, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xfe, 0xf, 0x1, 0x7fffffff, 0x0, 0x2, 0x4, 0x6}}, {0x10, 0x2, [0x100, 0x5, 0x3, 0x7, 0x9c, 0x1c]}}, {{0x1c, 0x1, {0x8, 0x3, 0xc1, 0x5, 0x2, 0xd88, 0x318f13ce, 0x3}}, {0xa, 0x2, [0x8000, 0x9, 0xa]}}, {{0x1c, 0x1, {0x3, 0x4, 0x4, 0xff, 0x2, 0x8, 0x101, 0x4}}, {0xc, 0x2, [0x8, 0x3041, 0x3, 0x4]}}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x81}, 0x4000) 1.234450778s ago: executing program 2 (id=3): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000c300)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x38, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}], {0x14}}, 0x60}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000020b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r2}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000280)=@IORING_OP_TIMEOUT={0xb, 0x2, 0x0, 0x0, 0x0, &(0x7f0000001400)={0x0, 0x3938700}, 0x1, 0x40}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000100)='cdg', 0x3) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000c80)='kmem_cache_free\x00'}, 0x10) sendmsg$inet(r6, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000042c0)="86", 0xff0f}], 0x1}, 0x0) recvmsg(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000380)=""/219, 0xdb}], 0x1}, 0x40000041) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e1e, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) close_range(r3, 0xffffffffffffffff, 0xff0f000000000000) 1.118932912s ago: executing program 2 (id=6): syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace5ffb2e9fc603dd282100000002ff02000000000000000000000000000104004e200023b0"], 0x0) 1.106966463s ago: executing program 4 (id=5): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000002304e80000000000"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f00000001c0)='netlink_extack\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newnexthop={0x20, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_OIF={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) 1.061431645s ago: executing program 1 (id=2): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_KEY={0x8}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x17}]}}}]}]}], {0x14}}, 0xd8}, 0x1, 0x0, 0x0, 0x50}, 0x4000040) 1.058982515s ago: executing program 4 (id=7): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0xfffffffffffffffd, 0x32d83) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000700)=ANY=[@ANYRESHEX=r0], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x3, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) unshare(0x64000600) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001700)=ANY=[@ANYBLOB="160000000000000061b1000002"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000007d000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, 0x0, &(0x7f0000000040)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000200)={r2, 0x0, &(0x7f0000001740)=""/4085}, 0x20) getpgrp(0x0) socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0xaa, &(0x7f0000000740)={@local, @remote, @val={@val={0x88a8, 0x4, 0x0, 0x4}, {0x8100, 0x5, 0x1}}, {@ipv4={0x800, @igmp={{0x11, 0x4, 0x0, 0x4, 0x94, 0x66, 0x80, 0x7, 0x2, 0x0, @private=0xa010102, @local, {[@lsrr={0x83, 0xb, 0xd8, [@local, @rand_addr=0x64010100]}, @timestamp_prespec={0x44, 0x24, 0x50, 0x3, 0xe, [{@loopback, 0xfffffff5}, {@local, 0x8}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x3ff}, {@broadcast, 0x1}]}]}}, {0x11, 0x1, 0x0, @empty, "844c81938280b7bac7994db7cc46ec7245bdd5fb394303ab20005e0000000017ce89d8894a6877168fb68e59dddfe4f9acd261d66f166bea0aceadc385ce437e0446a70335547e18"}}}}}, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x3, 0xa0203, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_config_ext={0x8, 0x7}, 0x0, 0x10000, 0x0, 0x3, 0x8, 0x20009, 0xb, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x43, 0x1, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x182, 0x6}, 0x6025, 0x4005, 0xb, 0x0, 0x1, 0x1, 0xb, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r3, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000200000000000000000808"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x140, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x0) syz_usbip_server_init(0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) 1.054202745s ago: executing program 2 (id=8): r0 = syz_open_pts(0xffffffffffffffff, 0x44600) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x10000, &(0x7f0000000380)={[{@noauto_da_alloc}]}, 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="be403665362dd3b6e435052aee", @ANYRESDEC=r1, @ANYRES64=r1], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16=r3, @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000f00)=ANY=[@ANYRESOCT=r4, @ANYRES8=r5, @ANYRESOCT=r5, @ANYRES64=r1, @ANYRES64=r3, @ANYRES64=r3, @ANYBLOB="1522824eea5b55bdee01c038c6dc42f44f611cf7f4a659a8cfecb668920454f76bf83dd7cb4784f7cd995905ee8a471fbde8b52e6348350be6c06d20a15892abcf6483fef195b9bf44ced013aa0125b885926f97bea66a03ce1ad8c20d51db6027b670662dd3a6e9d81c505a6438399ca50d215c5978d768790c48a660b4a6f40714c9e89e33d9c39a1ff993c42d09ad9579322800d6c9aa6af75755182c87e04a44c3c81167984985f22d559f94fcd0f54527dac021cab3fecc587a3ef20dbafa1d58885453f7ccfa6bc7d075771ae4922bdf33a69ea00d9e770aebf03fe85cd2aac7b2a176ce34382e932fb3cdad8cc287d631fb03bb66efa9", @ANYRESHEX=r1, @ANYRESOCT=r0, @ANYRES8=r2], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x20, 0x8, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000802000000000000000018100000a68e9bd51ec0f6f5e49253d3ab6c15bada493e81bb64a6363614cc8f000b064c5a7c32a2b8e859635b100dd237a6dbc9c13c8f88a53bd4d4a05046ced9c02550d136b9c0bb99", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x94) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000a40)={r6, &(0x7f0000000a00)="229a15555ae67f331ef28aea43747f57bca34d28"}, 0x20) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)="d8000000200081044e81f782db44b90402000000e8fe55a11800150006001c0000000e120900100000000401a80016000a0011400600000003080000004dcf5c0468c1d67f6f94007134cf6ee08088568ab35d6e7016bb234841ef52b49816277ce06bbace806069438e6fb599e0ced72a6ba86cf917cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b10d414f00004d9db22fe7c9f8775730d16a4683f1aea4edbb57a5025ccca9e00360db70100000040fad95667e006d8df969b3ef35ce34d4a13821f4fbb9ad809d561cdce81ed0bffece0b42a9e", 0xd8}], 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000dc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x4016, &(0x7f00000006c0)={[{@dioread_nolock}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x2}}, {@noauto_da_alloc}, {@lazytime}, {@noquota}, {@quota}]}, 0x1, 0x43c, &(0x7f0000000280)="$eJzs28tvG0UYAPBv7SR9k1CVR9MCgYKIeCRNWkoPXEAgcQAJCQ7lGJK0CnUb1ASJVhEEhMoRVeKOOCLxF3CCCwJOSFzhjipVKJcWTkZr7ya2Y7tJ6tSh/v2kbWd2x5n5vDv2zI43gJ41kv6TROyPiD8iYrCarS8wUv3v1srS9D8rS9NJlMtv/51Uyt1cWZrOi+av25dn+iIKnydxpEm9C5evnJ8qlWYvZfnxxQsfjC9cvvL83IWpc7PnZi9Onj598sTEi6cmX+hInGlcN4c/nj96+PV3r705febae798l+TxN8TRISPtDj5VLne4uu46UJNO+rrYEDalWO2m0V/p/4NRjLWTNxivfdbVxgHbqlwulx9sfXi5DNzDkuh2C4DuyL/o0/lvvt2loceOcOPl6gQojftWtlWP9EUhK9PfML/tpJGIOLP879fpFttzHwIAoM4P6fjnuWbjv0LU3he6L1tDGYqI+yPiYESciohDEfFARKXsQxHx8Cbrb1wkWT/+KVzfUmAblI7/XsrWturHf/noL4aKWe5AJf7+5OxcafZ49p6MRv+uND/Rpo4fX/39y1bHasd/6ZbWn48Fs3Zc79tV/5qZqcWpO4m51o1PI4b7msWfrK4EJBFxOCKGt1jH3DPfHm117Pbxt9GBdabyNxFPV8//cjTEn0var0+O747S7PHx/KpY79ffrr7Vqv47ir8D0vO/t+n1vxr/UFK7Xruw+Tqu/vlFyznNVq//geSdun0fTS0uXpqIGEjeqDa6dv9kQ7nJtfJp/KPHsvgH6vv/wVh7J45ERHoRPxIRj0bEY1nbH4+IJyLiWJv4f37lyfe3Fv/uNn+1M9L4ZzZ1/tcSA9G4p3mieP6n7+sqHdpo/JGd/5OV1Gi2ZyOffxtp19auZgAAAPj/KUTE/kgKY6vpQmFsrPob/kOxt1CaX1h89uz8hxdnqs8IDEV/Ib/TNVhzP3Qim9bn+cmG/InsvvFXxT2V/Nj0fGmm28FDj9vXov+n/ip2u3XAtvO8FvQu/R96l/4PvUv/h55U+ZVfk/6/pwttAbqg2ff/J11oB3D3NfR/y37QQ8z/oXfp/9C79H/oSQt74vYPyUtIrEtEYUc04x5MxI5oRrc/mQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADrjvwAAAP//qSDljg==") r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x4c02, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x0, 0xc3, 0x0, r8}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r9 = syz_init_net_socket$x25(0x9, 0x5, 0x0) recvmmsg(r9, 0x0, 0x0, 0x2, 0x0) socket$inet6(0xa, 0x4, 0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r4}, &(0x7f0000000000), &(0x7f0000000100)=r5}, 0x20) ioctl$SIOCSIFHWADDR(r3, 0x8923, &(0x7f0000000000)={'vlan1\x00', @broadcast}) 980.267948ms ago: executing program 1 (id=9): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) ftruncate(r0, 0x5) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a9a4850000000400000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_KEY={0x8}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x17}]}}}]}]}], {0x14}}, 0xd8}, 0x1, 0x0, 0x0, 0x50}, 0x4000040) 815.849035ms ago: executing program 2 (id=10): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1000, 0x103) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80800, 0x0) r3 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x5]}, 0x8) mount$9p_fd(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000240), 0x10, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) poll(&(0x7f0000000140)=[{r2, 0x20b6}], 0x1, 0x76) r4 = creat(&(0x7f00000002c0)='./file1\x00', 0x1) writev(r4, &(0x7f0000000400)=[{&(0x7f0000000640)="0b1c", 0x2}], 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='kfree\x00', r1, 0x0, 0x2}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="18010000030000000000000000030000850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x80003, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1002}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0}, 0x18) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x3000046, &(0x7f0000000bc0)={[{@dioread_nolock}, {@data_err_abort}, {@inlinecrypt}, {@noauto_da_alloc}, {@data_err_ignore}, {@nojournal_checksum}, {@errors_remount}, {@grpquota}, {@noblock_validity}, {@user_xattr}, {@nombcache}, {@errors_remount}]}, 0x11, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x40) pwritev2(r5, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5405, 0x0, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r5, 0xc020662a, &(0x7f0000000380)={0x3fffffffbfb, 0x5, 0x5, 0x7f}) syz_emit_ethernet(0x3b6, &(0x7f0000000000)=ANY=[], 0x0) r6 = socket(0x2, 0x5, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r6, 0x84, 0xe, 0x0, &(0x7f0000000200)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000340)={r8, 0xb8, &(0x7f0000000680)=[@in6={0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, '\x00', 0x43}, 0xfffffffd}, @in6={0xa, 0x4e21, 0x8, @local, 0x6}, @in6={0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x9}, @in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x4c4b, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7}, @in6={0xa, 0x4e21, 0x400, @private2={0xfc, 0x2, '\x00', 0x1}, 0x2d6}, @in6={0xa, 0x4e22, 0x3445, @loopback, 0xa16e}]}, &(0x7f00000003c0)=0x10) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r11) getsockname$packet(r11, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000900)=@delchain={0x4c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r12, {0xf}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0x20, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x1, 0x9}}, @TCA_FW_INDEV={0x14, 0x3, 'xfrm0\x00'}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) sendmsg$nl_route_sched(r9, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000980)=@delqdisc={0x158, 0x25, 0x200, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, {0xfff2, 0x10}, {0xb, 0xb}, {0x2, 0x6}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_QUANTUM={0x8, 0x3, 0xffffffff}, @TCA_FQ_INITIAL_QUANTUM={0x8, 0x4, 0xe8d8}]}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x80000001}, @qdisc_kind_options=@q_ingress={0xc}, @TCA_RATE={0x6, 0x5, {0x2, 0x8}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x7}, @TCA_STAB={0x74, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xb, 0xec, 0x2, 0x0, 0x1, 0x81, 0x8, 0x4}}, {0xc, 0x2, [0x1000, 0x49, 0x8, 0x5]}}, {{0x1c, 0x1, {0x0, 0x4, 0x5, 0x5, 0x1, 0x0, 0x6, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x4, 0x5, 0x9, 0x9, 0x0, 0x80000000, 0xfffffffb, 0x2}}, {0x8, 0x2, [0x2815, 0x800]}}]}, @TCA_STAB={0x80, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xfe, 0xf, 0x1, 0x7fffffff, 0x0, 0x2, 0x4, 0x6}}, {0x10, 0x2, [0x100, 0x5, 0x3, 0x7, 0x9c, 0x1c]}}, {{0x1c, 0x1, {0x8, 0x3, 0xc1, 0x5, 0x2, 0xd88, 0x318f13ce, 0x3}}, {0xa, 0x2, [0x8000, 0x9, 0xa]}}, {{0x1c, 0x1, {0x3, 0x4, 0x4, 0xff, 0x2, 0x8, 0x101, 0x4}}, {0xc, 0x2, [0x8, 0x3041, 0x3, 0x4]}}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x81}, 0x4000) 772.574077ms ago: executing program 1 (id=11): r0 = socket$inet(0x2, 0x2, 0xffff) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2100, 0x700, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x60, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0xfe, 0x0}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000000)={'tunl0\x00', r1, 0x20, 0x10, 0x1001000, 0x6, {{0x5, 0x4, 0x2, 0x6, 0x14, 0x67, 0x0, 0xf9, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback}}}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/vlan/vlan0\x00') r2 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f0000000080)=@add_del={0x2, 0x0}) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, {@in=@dev={0xac, 0x14, 0x14, 0x20}, 0x4d3, 0x32}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x9}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}]}, 0x138}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0xe0880, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB="1801000000000000000000004b84ffec85"], 0x0, 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @broadcast}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x40f00}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 641.179123ms ago: executing program 0 (id=12): syz_mount_image$vfat(&(0x7f0000000880), &(0x7f0000003200)='./file2\x00', 0x4204, &(0x7f0000003240)=ANY=[], 0x3, 0x335, &(0x7f0000000a40)="$eJzs3M9rG0cUwPEnWZYlGVs6lJYWiof20l4WW+25VBQbSgU1tlVqFwxre9UKbSWjFS4qpbZPvZbccwrkYHz0zZD4H/Alt+SSS266BHKICSEb9pf107asyJFjfz8QdjQzTzujGYW3i1f1X///s5i3tLxelXBMSUhE5EQkJWEJhPxj2C1HpdmOfD3+4vHni8srP2Wy2dkFpeYyS9+klVKTUw/++ifudzsck+PUav15+tnxx8ef1t8s/VGwVMFSpXJV6Wqt/LSqr5mG2ihYRU2pedPQLUMVSpZR8drLXnveLG9u1pRe2phIbFYMy1J6qaaKRk1Vy6paqSn9d71QUpqmqYmE4ALOgi7omT6j1wc8GlyRSiWjj4hIvKMltzeUAQEAgKFqz//DTkrfV/4vk27+73Ru5P/7XxxVx385mDx0Ylfrh9Fu+f+3T7z3asn/YyLST/5/Vy6R/3dmRLdLbm+h//wf18NUtKMq1PLKyf8T/vfXtfvb/rRbIP8HAAAAAAAAAAAAAAAAAAAAAOBDcGLbSdu2k8Ex+Nd4hMB/jRvprPUfE5GYs/o263+TLS6vSMx9cM9ZY/O/rdxWzjv6HY5ExBRDpiUpr9394HPKwZNHypGSh+a2G//KOY64LZm8FNz4GUlKqj3etud+zM7OKI8ff/qYUqI5Pi1J+ah7fLo13hn/9lYuKl992RSvSVIerUtZTNlw93Uj/t8ZpX74OdsWH/dOAgAAAADADaApFfIvn1Ot17/e9bumKdW93fuVkUzevU10xv0B7/p6uuv1eST5WWTYswcAAAAA4Hawan8XddM0KucU4nJxn/4Lkd46R9tqRs/rPNI0w17HE3VvZIi867zu9fipthSCP6RoaYr5lf2NJ5j/wNZrp7kmLD1ERdoHP+VUqEuefdefyGlNcNsoesbnLPOd7xM+ZyeMDmw/f3Ln/svBfUG+Owh2wMWdd/s9V6x917mF0av+fwcAAADA+9dI+oOa75ubQ0MZFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAt8yV/KRfW2HYcwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACui7cBAAD//5Oa+gc=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000080)=0x10001) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) wait4(0xffffffffffffffff, 0x0, 0x20000000, 0x0) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x1006, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xa, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x1, 0x0, 0x5d, r5}, 0xc) sendmsg$nl_xfrm(r3, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000003c0)=0x0) sched_setaffinity(r7, 0x8, &(0x7f0000000400)=0x7) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000700)={&(0x7f00000006c0)='kmem_cache_free\x00', r8}, 0x10) uname(&(0x7f00000002c0)=""/76) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r9}, 0x10) add_key(&(0x7f00000001c0)='ceph\x00', 0x0, &(0x7f0000000840)='\x00\x00\x00\x00\x00\x00', 0x6, 0xffffffffffffffff) 610.644374ms ago: executing program 3 (id=13): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b1000000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe0}, 0x94) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={r2, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r3, 0x0, 0x10007ffffffff}, 0x18) r4 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="2400000016000d190a762d7f08", 0xd}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff", 0x17}], 0x2}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r5, 0x0) connect$unix(r1, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r5, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f000001a240)="1d", 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(r7, &(0x7f0000004080)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r6], 0x18}}], 0x1, 0x0) r8 = socket$netlink(0x10, 0x3, 0x4) writev(r8, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f004e2100a2bc5603ca00000f7f89004e00200000000101ff00c00e0300", 0x35}], 0x1) unshare(0x6a040000) openat$tun(0xffffffffffffff9c, 0x0, 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0xfffffffffffffeeb) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone(0x62008000, 0x0, 0x0, 0x0, 0x0, 0x0) 398.810523ms ago: executing program 1 (id=14): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0xfffffffffffffffd, 0x32d83) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000700)=ANY=[@ANYRESHEX=r0], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x3, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) unshare(0x64000600) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001700)=ANY=[@ANYBLOB="160000000000000061b1000002"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000007d000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, 0x0, &(0x7f0000000040)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000200)={r2, 0x0, &(0x7f0000001740)=""/4085}, 0x20) getpgrp(0x0) socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0xaa, &(0x7f0000000740)={@local, @remote, @val={@val={0x88a8, 0x4, 0x0, 0x4}, {0x8100, 0x5, 0x1}}, {@ipv4={0x800, @igmp={{0x11, 0x4, 0x0, 0x4, 0x94, 0x66, 0x80, 0x7, 0x2, 0x0, @private=0xa010102, @local, {[@lsrr={0x83, 0xb, 0xd8, [@local, @rand_addr=0x64010100]}, @timestamp_prespec={0x44, 0x24, 0x50, 0x3, 0xe, [{@loopback, 0xfffffff5}, {@local, 0x8}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x3ff}, {@broadcast, 0x1}]}]}}, {0x11, 0x1, 0x0, @empty, "844c81938280b7bac7994db7cc46ec7245bdd5fb394303ab20005e0000000017ce89d8894a6877168fb68e59dddfe4f9acd261d66f166bea0aceadc385ce437e0446a70335547e18"}}}}}, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x3, 0xa0203, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_config_ext={0x8, 0x7}, 0x0, 0x10000, 0x0, 0x3, 0x8, 0x20009, 0xb, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x43, 0x1, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x182, 0x6}, 0x6025, 0x4005, 0xb, 0x0, 0x1, 0x1, 0xb, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r3, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x140, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x50) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x0) syz_usbip_server_init(0x1) fcntl$dupfd(r0, 0x0, r0) 321.653536ms ago: executing program 0 (id=15): r0 = syz_open_pts(0xffffffffffffffff, 0x44600) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x10000, &(0x7f0000000380)={[{@noauto_da_alloc}]}, 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="be403665362dd3b6e435052aee", @ANYRESDEC=r1, @ANYRES64=r1], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16=r3, @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000f00)=ANY=[@ANYRESOCT=r4, @ANYRES8=r5, @ANYRESOCT=r5, @ANYRES64=r1, @ANYRES64=r3, @ANYRES64=r3, @ANYBLOB="1522824eea5b55bdee01c038c6dc42f44f611cf7f4a659a8cfecb668920454f76bf83dd7cb4784f7cd995905ee8a471fbde8b52e6348350be6c06d20a15892abcf6483fef195b9bf44ced013aa0125b885926f97bea66a03ce1ad8c20d51db6027b670662dd3a6e9d81c505a6438399ca50d215c5978d768790c48a660b4a6f40714c9e89e33d9c39a1ff993c42d09ad9579322800d6c9aa6af75755182c87e04a44c3c81167984985f22d559f94fcd0f54527dac021cab3fecc587a3ef20dbafa1d58885453f7ccfa6bc7d075771ae4922bdf33a69ea00d9e770aebf03fe85cd2aac7b2a176ce34382e932fb3cdad8cc287d631fb03bb66efa9", @ANYRESHEX=r1, @ANYRESOCT=r0, @ANYRES8=r2], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x20, 0x8, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000802000000000000000018100000a68e9bd51ec0f6f5e49253d3ab6c15bada493e81bb64a6363614cc8f000b064c5a7c32a2b8e859635b100dd237a6dbc9c13c8f88a53bd4d4a05046ced9c02550d136b9c0bb99", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x94) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000a40)={r6, &(0x7f0000000a00)="229a15555ae67f331ef28aea43747f57bca34d28"}, 0x20) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)="d8000000200081044e81f782db44b90402000000e8fe55a11800150006001c0000000e120900100000000401a80016000a0011400600000003080000004dcf5c0468c1d67f6f94007134cf6ee08088568ab35d6e7016bb234841ef52b49816277ce06bbace806069438e6fb599e0ced72a6ba86cf917cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b10d414f00004d9db22fe7c9f8775730d16a4683f1aea4edbb57a5025ccca9e00360db70100000040fad95667e006d8df969b3ef35ce34d4a13821f4fbb9ad809d561cdce81ed0bffece0b42a9e", 0xd8}], 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000dc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x4016, &(0x7f00000006c0)={[{@dioread_nolock}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x2}}, {@noauto_da_alloc}, {@lazytime}, {@noquota}, {@quota}]}, 0x1, 0x43c, &(0x7f0000000280)="$eJzs28tvG0UYAPBv7SR9k1CVR9MCgYKIeCRNWkoPXEAgcQAJCQ7lGJK0CnUb1ASJVhEEhMoRVeKOOCLxF3CCCwJOSFzhjipVKJcWTkZr7ya2Y7tJ6tSh/v2kbWd2x5n5vDv2zI43gJ41kv6TROyPiD8iYrCarS8wUv3v1srS9D8rS9NJlMtv/51Uyt1cWZrOi+av25dn+iIKnydxpEm9C5evnJ8qlWYvZfnxxQsfjC9cvvL83IWpc7PnZi9Onj598sTEi6cmX+hInGlcN4c/nj96+PV3r705febae798l+TxN8TRISPtDj5VLne4uu46UJNO+rrYEDalWO2m0V/p/4NRjLWTNxivfdbVxgHbqlwulx9sfXi5DNzDkuh2C4DuyL/o0/lvvt2loceOcOPl6gQojftWtlWP9EUhK9PfML/tpJGIOLP879fpFttzHwIAoM4P6fjnuWbjv0LU3he6L1tDGYqI+yPiYESciohDEfFARKXsQxHx8Cbrb1wkWT/+KVzfUmAblI7/XsrWturHf/noL4aKWe5AJf7+5OxcafZ49p6MRv+uND/Rpo4fX/39y1bHasd/6ZbWn48Fs3Zc79tV/5qZqcWpO4m51o1PI4b7msWfrK4EJBFxOCKGt1jH3DPfHm117Pbxt9GBdabyNxFPV8//cjTEn0var0+O747S7PHx/KpY79ffrr7Vqv47ir8D0vO/t+n1vxr/UFK7Xruw+Tqu/vlFyznNVq//geSdun0fTS0uXpqIGEjeqDa6dv9kQ7nJtfJp/KPHsvgH6vv/wVh7J45ERHoRPxIRj0bEY1nbH4+IJyLiWJv4f37lyfe3Fv/uNn+1M9L4ZzZ1/tcSA9G4p3mieP6n7+sqHdpo/JGd/5OV1Gi2ZyOffxtp19auZgAAAPj/KUTE/kgKY6vpQmFsrPob/kOxt1CaX1h89uz8hxdnqs8IDEV/Ib/TNVhzP3Qim9bn+cmG/InsvvFXxT2V/Nj0fGmm28FDj9vXov+n/ip2u3XAtvO8FvQu/R96l/4PvUv/h55U+ZVfk/6/pwttAbqg2ff/J11oB3D3NfR/y37QQ8z/oXfp/9C79H/oSQt74vYPyUtIrEtEYUc04x5MxI5oRrc/mQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADrjvwAAAP//qSDljg==") r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x4c02, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x0, 0xc3, 0x0, r8}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) r9 = syz_init_net_socket$x25(0x9, 0x5, 0x0) recvmmsg(r9, 0x0, 0x0, 0x2, 0x0) socket$inet6(0xa, 0x4, 0x1) ioctl$SIOCSIFHWADDR(r3, 0x8923, &(0x7f0000000000)={'vlan1\x00', @broadcast}) 244.49758ms ago: executing program 4 (id=16): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) ftruncate(r0, 0x5) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a9a4850000000400000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_KEY={0x8}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x17}]}}}]}]}], {0x14}}, 0xd8}, 0x1, 0x0, 0x0, 0x50}, 0x4000040) 154.776904ms ago: executing program 0 (id=17): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000580)=0x2, 0x4) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace5ffb2e9fc603dd282100000002ff02000000000000000000000000000104004e200023b0"], 0x0) 84.659117ms ago: executing program 0 (id=18): syz_open_dev$sg(&(0x7f00000060c0), 0xfffffffffffffffd, 0x32d83) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) unshare(0x64000600) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001700)=ANY=[@ANYBLOB="160000000000000061b1000002"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000007d000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1}, 0x0, &(0x7f0000000040)}, 0x20) socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x32, &(0x7f0000000740)={@local, @remote, @val={@val={0x88a8, 0x4, 0x0, 0x4}, {0x8100, 0x5, 0x1}}, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x1c, 0x66, 0x80, 0x7, 0x2, 0x0, @private=0xa010102, @local}, {0x11, 0x1, 0x0, @empty}}}}}, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x3, 0xa0203, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_config_ext={0x8, 0x7}, 0x0, 0x10000, 0x0, 0x3, 0x8, 0x20009, 0xb, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) pread64(0xffffffffffffffff, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x140, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000"], 0x50) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) syz_usbip_server_init(0x1) 16.845329ms ago: executing program 4 (id=19): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e00000004000000080000000f"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file1/file4/file5\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file1/file4/file5\x00', 0xffffffffffffff9c, 0x0, 0x0) 0s ago: executing program 4 (id=20): syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace5ffb2e9fc603dd282100000002ff02000000000000000000000000000104004e200023b0"], 0x0) kernel console output (not intermixed with test programs): =process permissive=1 [ 18.761239][ T29] audit: type=1400 audit(1764144429.671:61): avc: denied { siginh } for pid=3192 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.149' (ED25519) to the list of known hosts. [ 25.931374][ T29] audit: type=1400 audit(1764144436.851:62): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.954276][ T29] audit: type=1400 audit(1764144436.871:63): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.954898][ T3304] cgroup: Unknown subsys name 'net' [ 25.981841][ T29] audit: type=1400 audit(1764144436.911:64): avc: denied { unmount } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.099234][ T3304] cgroup: Unknown subsys name 'cpuset' [ 26.105266][ T3304] cgroup: Unknown subsys name 'rlimit' [ 26.274082][ T29] audit: type=1400 audit(1764144437.191:65): avc: denied { setattr } for pid=3304 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.297414][ T29] audit: type=1400 audit(1764144437.191:66): avc: denied { create } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.317896][ T29] audit: type=1400 audit(1764144437.191:67): avc: denied { write } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.338251][ T29] audit: type=1400 audit(1764144437.191:68): avc: denied { read } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.347745][ T3306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.358515][ T29] audit: type=1400 audit(1764144437.221:69): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.391792][ T29] audit: type=1400 audit(1764144437.221:70): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.414996][ T29] audit: type=1400 audit(1764144437.291:71): avc: denied { relabelto } for pid=3306 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.462558][ T3304] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.531693][ T3321] chnl_net:caif_netlink_parms(): no params data found [ 28.575253][ T3316] chnl_net:caif_netlink_parms(): no params data found [ 28.588596][ T3314] chnl_net:caif_netlink_parms(): no params data found [ 28.600155][ T3313] chnl_net:caif_netlink_parms(): no params data found [ 28.693913][ T3316] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.700991][ T3316] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.708143][ T3316] bridge_slave_0: entered allmulticast mode [ 28.714481][ T3316] bridge_slave_0: entered promiscuous mode [ 28.735476][ T3316] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.742563][ T3316] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.749728][ T3316] bridge_slave_1: entered allmulticast mode [ 28.756040][ T3316] bridge_slave_1: entered promiscuous mode [ 28.766648][ T3314] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.773716][ T3314] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.780786][ T3314] bridge_slave_0: entered allmulticast mode [ 28.787063][ T3314] bridge_slave_0: entered promiscuous mode [ 28.793410][ T3315] chnl_net:caif_netlink_parms(): no params data found [ 28.801687][ T3321] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.808713][ T3321] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.815781][ T3321] bridge_slave_0: entered allmulticast mode [ 28.822042][ T3321] bridge_slave_0: entered promiscuous mode [ 28.836716][ T3314] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.843852][ T3314] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.851012][ T3314] bridge_slave_1: entered allmulticast mode [ 28.857383][ T3314] bridge_slave_1: entered promiscuous mode [ 28.865838][ T3321] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.872887][ T3321] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.879971][ T3321] bridge_slave_1: entered allmulticast mode [ 28.886404][ T3321] bridge_slave_1: entered promiscuous mode [ 28.892500][ T3313] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.899612][ T3313] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.906654][ T3313] bridge_slave_0: entered allmulticast mode [ 28.913076][ T3313] bridge_slave_0: entered promiscuous mode [ 28.920433][ T3316] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.942994][ T3313] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.950147][ T3313] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.957205][ T3313] bridge_slave_1: entered allmulticast mode [ 28.963527][ T3313] bridge_slave_1: entered promiscuous mode [ 28.970433][ T3316] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.998263][ T3321] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.018619][ T3314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.028672][ T3314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.038685][ T3321] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.052365][ T3313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.075368][ T3316] team0: Port device team_slave_0 added [ 29.081777][ T3313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.091691][ T3316] team0: Port device team_slave_1 added [ 29.104096][ T3321] team0: Port device team_slave_0 added [ 29.127085][ T3314] team0: Port device team_slave_0 added [ 29.133286][ T3321] team0: Port device team_slave_1 added [ 29.149177][ T3313] team0: Port device team_slave_0 added [ 29.159187][ T3314] team0: Port device team_slave_1 added [ 29.170206][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.177134][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.203083][ T3316] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.214176][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.221154][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.247038][ T3316] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.258278][ T3313] team0: Port device team_slave_1 added [ 29.264017][ T3315] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.271163][ T3315] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.278297][ T3315] bridge_slave_0: entered allmulticast mode [ 29.284580][ T3315] bridge_slave_0: entered promiscuous mode [ 29.295700][ T3321] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.302680][ T3321] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.328576][ T3321] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.341801][ T3321] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.348796][ T3321] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.374738][ T3321] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.394629][ T3315] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.401693][ T3315] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.408802][ T3315] bridge_slave_1: entered allmulticast mode [ 29.415149][ T3315] bridge_slave_1: entered promiscuous mode [ 29.426584][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.433598][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.459489][ T3314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.472697][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.479668][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.505613][ T3314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.516548][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.523509][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.549440][ T3313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.571551][ T3315] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.593493][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.600441][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.626378][ T3313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.646882][ T3315] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.676644][ T3321] hsr_slave_0: entered promiscuous mode [ 29.682724][ T3321] hsr_slave_1: entered promiscuous mode [ 29.696539][ T3316] hsr_slave_0: entered promiscuous mode [ 29.702604][ T3316] hsr_slave_1: entered promiscuous mode [ 29.708358][ T3316] debugfs: 'hsr0' already exists in 'hsr' [ 29.714089][ T3316] Cannot create hsr debugfs directory [ 29.721159][ T3314] hsr_slave_0: entered promiscuous mode [ 29.726966][ T3314] hsr_slave_1: entered promiscuous mode [ 29.732768][ T3314] debugfs: 'hsr0' already exists in 'hsr' [ 29.738479][ T3314] Cannot create hsr debugfs directory [ 29.759769][ T3313] hsr_slave_0: entered promiscuous mode [ 29.765850][ T3313] hsr_slave_1: entered promiscuous mode [ 29.771712][ T3313] debugfs: 'hsr0' already exists in 'hsr' [ 29.777407][ T3313] Cannot create hsr debugfs directory [ 29.788641][ T3315] team0: Port device team_slave_0 added [ 29.795328][ T3315] team0: Port device team_slave_1 added [ 29.834729][ T3315] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.841725][ T3315] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.867675][ T3315] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.893327][ T3315] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.900271][ T3315] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.926137][ T3315] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.004010][ T3315] hsr_slave_0: entered promiscuous mode [ 30.009810][ T3315] hsr_slave_1: entered promiscuous mode [ 30.015586][ T3315] debugfs: 'hsr0' already exists in 'hsr' [ 30.021314][ T3315] Cannot create hsr debugfs directory [ 30.108984][ T3321] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.121705][ T3321] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.130029][ T3321] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.140128][ T3321] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.164155][ T3313] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 30.176159][ T3313] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 30.192096][ T3313] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 30.202634][ T3313] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 30.229862][ T3314] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.239397][ T3314] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.252247][ T3321] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.262783][ T3314] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.273336][ T3314] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.298921][ T3321] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.309272][ T3316] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 30.331461][ T3316] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 30.345481][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.353742][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.360792][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.369532][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.376593][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.391995][ T3316] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 30.401049][ T3316] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 30.410980][ T3315] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.421009][ T3315] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.434225][ T3315] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.445321][ T3315] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.473603][ T3313] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.492678][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.500379][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.519676][ T3314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.547656][ T3313] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.558078][ T3313] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.570068][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.577082][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.595941][ T3321] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.613872][ T3315] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.630489][ T3314] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.639809][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.646915][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.666608][ T1869] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.673668][ T1869] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.686281][ T3313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.704409][ T3315] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.715967][ T3314] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.726320][ T3314] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.740522][ T3316] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.765976][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.773048][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.783739][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.790851][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.801904][ T3316] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.839777][ T3321] veth0_vlan: entered promiscuous mode [ 30.852295][ T1869] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.859424][ T1869] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.868282][ T1869] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.875352][ T1869] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.885912][ T3321] veth1_vlan: entered promiscuous mode [ 30.895691][ T3314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.936162][ T3321] veth0_macvtap: entered promiscuous mode [ 30.959859][ T3313] veth0_vlan: entered promiscuous mode [ 30.977007][ T3321] veth1_macvtap: entered promiscuous mode [ 30.992066][ T3321] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.001111][ T3313] veth1_vlan: entered promiscuous mode [ 31.017368][ T3321] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.032678][ T3313] veth0_macvtap: entered promiscuous mode [ 31.043292][ T31] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.055337][ T3315] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.066752][ T31] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.079295][ T3313] veth1_macvtap: entered promiscuous mode [ 31.089966][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 31.089979][ T29] audit: type=1400 audit(1764144442.011:81): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/root/syzkaller.V9Gkd3/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 31.094585][ T31] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.096140][ T29] audit: type=1400 audit(1764144442.011:82): avc: denied { mount } for pid=3321 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 31.121491][ T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.128919][ T29] audit: type=1400 audit(1764144442.011:83): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/root/syzkaller.V9Gkd3/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 31.163532][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.184560][ T29] audit: type=1400 audit(1764144442.011:84): avc: denied { mount } for pid=3321 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 31.194349][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.213552][ T29] audit: type=1400 audit(1764144442.011:85): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/root/syzkaller.V9Gkd3/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 31.234247][ T3316] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.247252][ T29] audit: type=1400 audit(1764144442.011:86): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/root/syzkaller.V9Gkd3/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 31.258055][ T3314] veth0_vlan: entered promiscuous mode [ 31.281270][ T29] audit: type=1400 audit(1764144442.011:87): avc: denied { unmount } for pid=3321 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 31.300304][ T29] audit: type=1400 audit(1764144442.081:88): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 31.328952][ T29] audit: type=1400 audit(1764144442.081:89): avc: denied { mount } for pid=3321 comm="syz-executor" name="/" dev="gadgetfs" ino=4834 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 31.353561][ T3321] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.357178][ T365] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.383760][ T29] audit: type=1400 audit(1764144442.301:90): avc: denied { read write } for pid=3321 comm="syz-executor" name="loop0" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 31.412768][ T3314] veth1_vlan: entered promiscuous mode [ 31.435748][ T52] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.449797][ T3314] veth0_macvtap: entered promiscuous mode [ 31.459340][ T3314] veth1_macvtap: entered promiscuous mode [ 31.469925][ T52] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.478890][ T365] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.491282][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.514905][ T3315] veth0_vlan: entered promiscuous mode [ 31.532626][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.542541][ T3315] veth1_vlan: entered promiscuous mode [ 31.559784][ T41] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.568574][ T41] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.579998][ T41] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.593407][ T41] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.611179][ T3315] veth0_macvtap: entered promiscuous mode [ 31.618101][ T3315] veth1_macvtap: entered promiscuous mode [ 31.625194][ T3316] veth0_vlan: entered promiscuous mode [ 31.633451][ T3316] veth1_vlan: entered promiscuous mode [ 31.645838][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.657975][ T3488] loop3: detected capacity change from 0 to 1024 [ 31.663722][ T3316] veth0_macvtap: entered promiscuous mode [ 31.666356][ T3488] ======================================================= [ 31.666356][ T3488] WARNING: The mand mount option has been deprecated and [ 31.666356][ T3488] and is ignored by this kernel. Remove the mand [ 31.666356][ T3488] option from the mount to silence this warning. [ 31.666356][ T3488] ======================================================= [ 31.676926][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.719455][ T3316] veth1_macvtap: entered promiscuous mode [ 31.725674][ T3489] loop0: detected capacity change from 0 to 1024 [ 31.729452][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.746663][ T3489] EXT4-fs: inline encryption not supported [ 31.751392][ T3488] EXT4-fs: inline encryption not supported [ 31.762567][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.774378][ T52] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.785277][ T52] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.785845][ T3488] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.796534][ T52] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.817035][ T365] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.839266][ T365] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.851309][ T3488] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.856191][ T3489] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 31.887166][ T365] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.891310][ T3489] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.908165][ T365] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.946873][ T365] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.011853][ T3488] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=3488 comm=syz.3.4 [ 32.026980][ T3509] loop2: detected capacity change from 0 to 512 [ 32.034191][ T3489] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=3489 comm=syz.0.1 [ 32.061094][ T3509] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.078854][ T3509] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 32.095557][ T3509] netlink: 'syz.2.8': attribute type 16 has an invalid length. [ 32.100161][ T3505] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(12) [ 32.103266][ T3509] netlink: 156 bytes leftover after parsing attributes in process `syz.2.8'. [ 32.109689][ T3505] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 32.109799][ T3505] vhci_hcd vhci_hcd.0: Device attached [ 32.212522][ T3509] ÿÿÿÿÿÿ: renamed from vlan1 (while UP) [ 32.235441][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.368822][ T2967] usb 9-1: new low-speed USB device number 2 using vhci_hcd [ 32.381511][ T3542] loop2: detected capacity change from 0 to 1024 [ 32.390705][ T3542] EXT4-fs: inline encryption not supported [ 32.415638][ T3542] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.447602][ T3542] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.454817][ T3548] loop0: detected capacity change from 0 to 128 [ 32.491561][ T3548] FAT-fs (loop0): Invalid FSINFO signature: 0x41615200, 0x61417272 (sector = 1) [ 32.561602][ T3542] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=3542 comm=syz.2.10 [ 32.584970][ T3548] bridge0: entered promiscuous mode [ 32.590963][ T3548] macsec1: entered promiscuous mode [ 32.597036][ T3548] bridge0: port 3(macsec1) entered blocking state [ 32.603512][ T3548] bridge0: port 3(macsec1) entered disabled state [ 32.612092][ T3548] macsec1: entered allmulticast mode [ 32.617393][ T3548] bridge0: entered allmulticast mode [ 32.623975][ T3548] macsec1: left allmulticast mode [ 32.629025][ T3548] bridge0: left allmulticast mode [ 32.636066][ T3548] bridge0: left promiscuous mode [ 32.691337][ T3514] vhci_hcd: connection reset by peer [ 32.697352][ T52] vhci_hcd: stop threads [ 32.701665][ T52] vhci_hcd: release socket [ 32.706091][ T52] vhci_hcd: disconnect device [ 32.736799][ T3556] loop0: detected capacity change from 0 to 512 [ 32.756188][ T3556] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.769447][ T3556] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 32.782145][ T3556] netlink: 'syz.0.15': attribute type 16 has an invalid length. [ 32.789842][ T3556] netlink: 156 bytes leftover after parsing attributes in process `syz.0.15'. [ 32.853314][ T3554] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(11) [ 32.859932][ T3554] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 32.867593][ T3554] vhci_hcd vhci_hcd.0: Device attached [ 32.875757][ T3556] ÿÿÿÿÿÿ: renamed from vlan1 (while UP) [ 32.895566][ T3321] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.926698][ T3569] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 33.004061][ T3571] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(9) [ 33.010582][ T3571] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 33.018073][ T3571] vhci_hcd vhci_hcd.0: Device attached [ 33.055502][ T3004] ================================================================== [ 33.063596][ T3004] BUG: KCSAN: data-race in d_delete / step_into [ 33.069829][ T3004] [ 33.072132][ T3004] read-write to 0xffff8881004930c0 of 4 bytes by task 3300 on cpu 1: [ 33.080177][ T3004] d_delete+0x15a/0x180 [ 33.084316][ T3004] d_delete_notify+0x32/0x100 [ 33.088979][ T3004] vfs_unlink+0x30b/0x420 [ 33.093295][ T3004] do_unlinkat+0x24e/0x480 [ 33.097696][ T3004] __x64_sys_unlink+0x2e/0x40 [ 33.102361][ T3004] x64_sys_call+0x2dcf/0x3000 [ 33.107027][ T3004] do_syscall_64+0xd2/0x200 [ 33.111515][ T3004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 33.117400][ T3004] [ 33.119703][ T3004] read to 0xffff8881004930c0 of 4 bytes by task 3004 on cpu 0: [ 33.127228][ T3004] step_into+0xe3/0x7f0 [ 33.131373][ T3004] walk_component+0x162/0x220 [ 33.136044][ T3004] path_lookupat+0xfe/0x2a0 [ 33.140538][ T3004] filename_lookup+0x147/0x340 [ 33.145293][ T3004] do_readlinkat+0x7d/0x320 [ 33.149782][ T3004] __x64_sys_readlink+0x47/0x60 [ 33.154619][ T3004] x64_sys_call+0x28de/0x3000 [ 33.159281][ T3004] do_syscall_64+0xd2/0x200 [ 33.163767][ T3004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 33.169642][ T3004] [ 33.171946][ T3004] value changed: 0x00300180 -> 0x00004080 [ 33.177638][ T3004] [ 33.179939][ T3004] Reported by Kernel Concurrency Sanitizer on: [ 33.186079][ T3004] CPU: 0 UID: 0 PID: 3004 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) [ 33.195352][ T3004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 33.205389][ T3004] ================================================================== [ 33.214534][ T3551] usb 3-1: new low-speed USB device number 2 using vhci_hcd [ 33.338796][ T3461] usb 1-1: new low-speed USB device number 2 using vhci_hcd [ 33.523879][ T3563] vhci_hcd: connection reset by peer [ 33.529504][ T2072] vhci_hcd: stop threads [ 33.533737][ T2072] vhci_hcd: release socket [ 33.538208][ T2072] vhci_hcd: disconnect device [ 33.635583][ T3573] vhci_hcd: connection reset by peer [ 33.642088][ T52] vhci_hcd: stop threads [ 33.646357][ T52] vhci_hcd: release socket [ 33.650821][ T52] vhci_hcd: disconnect device [ 37.388834][ T2967] usb 9-1: enqueue for inactive port 0 [ 37.394346][ T2967] usb 9-1: enqueue for inactive port 0 [ 37.468775][ T2967] vhci_hcd: vhci_device speed not set [ 38.268762][ T3551] usb 3-1: enqueue for inactive port 0 [ 38.274233][ T3551] usb 3-1: enqueue for inactive port 0 [ 38.348941][ T3551] vhci_hcd: vhci_device speed not set [ 38.358789][ T3461] usb 1-1: enqueue for inactive port 0 [ 38.364283][ T3461] usb 1-1: enqueue for inactive port 0 [ 38.438835][ T3461] vhci_hcd: vhci_device speed not set