last executing test programs: 1.438700797s ago: executing program 3 (id=749): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) creat(&(0x7f0000000380)='./file0\x00', 0x1c) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r2}, 0x38) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000002400)={0x18, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000001e40)='kmem_cache_free\x00', r3, 0x0, 0x2}, 0x18) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) 1.303056969s ago: executing program 3 (id=751): connect$pppoe(0xffffffffffffffff, 0x0, 0x0) getegid() r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x80000000}, 0x18) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001380)=ANY=[], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000280)='kfree\x00', r2}, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r3, 0x0, 0x4, 0x0, 0x0) 1.25645538s ago: executing program 3 (id=753): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) futex(0x0, 0xd, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000)=0x2000000, 0x300) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xae, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_open_dev$loop(0x0, 0x100000000, 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) 1.169313192s ago: executing program 1 (id=758): bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0x6, 0x8, 0x8, 0x40, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48) close(r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10003, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae2acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a3053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456391cffdef93e29f10f4a11f0cfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d984ecb91e6683a5f522d536e2f3c43b89823659d1945258fc668950e5aacfffffffffffffff7f7a266c90e64efc8d8f730867202a9ee94e6a00"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r3, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r1, &(0x7f0000000000), &(0x7f0000001a00)=""/122}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000140)={r0, &(0x7f0000000140), &(0x7f00000002c0)=""/4095}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f0000001800)={{r0}, &(0x7f0000001780)=0x4, 0x0}, 0x20) 1.168737742s ago: executing program 1 (id=759): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r1}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x33fe0}], 0x1}, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110e22fff7) ioctl$TUNGETVNETLE(r2, 0x40047451, &(0x7f0000000280)) 1.154957562s ago: executing program 3 (id=761): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ppoll(0x0, 0x0, &(0x7f0000000040), &(0x7f0000000100)={[0x4]}, 0x8) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r2, 0x0) vmsplice(r1, &(0x7f00000019c0)=[{&(0x7f0000001a00)="ce", 0x1}], 0x1, 0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r3, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.141399642s ago: executing program 4 (id=762): bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000980)='mm_page_free\x00', r0}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="034886dd0900320003003000000060000000000c110081e949b93897bc3b0000000000007d01ff020000000000000000000000000001"], 0xfdef) 1.125001192s ago: executing program 3 (id=763): unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x88}}, 0x0) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060"], 0xfdef) 1.052078483s ago: executing program 1 (id=764): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x23, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002ec0)={0x28, r3, 0x10ada85e65c25359, 0xfffffffd, 0x25dfdbfd, {{0x6b}, {@val={0x8}, @val={0xc, 0x99, {0x2, 0x72}}}}}, 0x28}}, 0x0) 1.043451813s ago: executing program 4 (id=765): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r2, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x8, 0x4000, 0x4000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) 992.731824ms ago: executing program 1 (id=766): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x37, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x4c58, 0x10000, 0x0, 0x1, 0x8, 0x20002, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001100)={0x11, 0xb, &(0x7f0000001280)=ANY=[@ANYBLOB="1800000000b800000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000040)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f00000002c0)='kmem_cache_free\x00', r0}, 0x18) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x80, 0x2, 0x8b6}, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r1, 0x0, &(0x7f0000000040)='./file0\x00', 0x64, 0x183000, 0x23456}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) io_uring_enter(r1, 0x47f6, 0x0, 0x2, 0x0, 0x0) 802.887737ms ago: executing program 2 (id=768): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000027"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454da, &(0x7f00000001c0)={'bond_slave_0\x00'}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'dvmrp1\x00', 0x1}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454da, &(0x7f0000000140)={'bond0\x00'}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'nicvf0\x00', 0x1432}) 697.073919ms ago: executing program 2 (id=769): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='workqueue_queue_work\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='workqueue_queue_work\x00', r2}, 0x18) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x1d, &(0x7f00000001c0), 0x4) 616.03091ms ago: executing program 2 (id=770): timer_create(0x0, 0x0, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000000002000000000000000000018190000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000024"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000500)='hrtimer_start\x00', r0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000208e052500000000040000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000400000085000000060000008500000050000000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000500)='hrtimer_start\x00', r1}, 0x10) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) 559.760851ms ago: executing program 2 (id=771): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x18) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, 0x0, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73f72cc9f0ba1f848350000005e120602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x4000850) 483.894562ms ago: executing program 0 (id=772): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r1, 0x0, 0xffffffffffffffff}, 0x18) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=@newlink={0x3c, 0x10, 0x437, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r4, 0x5120b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r4}]}}}]}, 0x3c}}, 0x4000010) sendmmsg$inet(r2, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @empty, @multicast1}}}], 0x20}}], 0x1, 0x0) 391.108284ms ago: executing program 0 (id=773): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x80) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='devpts\x00', 0x0, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$tmpfs(0x0, &(0x7f0000000400)='./file0/../file0\x00', &(0x7f00000001c0), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r0}, &(0x7f0000000380), &(0x7f00000003c0)=r1}, 0x20) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) 390.310934ms ago: executing program 2 (id=774): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x0, 0x4}}, 0x10) listen(r0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000840)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x18) r3 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r3, &(0x7f0000002300)={&(0x7f0000000040)=@id={0x1e, 0x3, 0x0, {0x4e22, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x44}, 0x4) sendmsg$tipc(r3, &(0x7f00000002c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x2, 0x0, {0x41}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x480c0}, 0x0) accept4(r0, 0x0, 0x0, 0x400000000000000) 389.426634ms ago: executing program 1 (id=775): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x37, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xd}, 0x4c58, 0x10000, 0x0, 0x1, 0x8, 0x20002, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) bind$can_raw(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000380)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000580)=0x1, r2, 0x0, 0x2, 0x4}}, 0x20) 388.234614ms ago: executing program 3 (id=776): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb850000004300000095"], 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kmem_cache_free\x00', r0}, 0x10) syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f00000002c0)='./bus\x00', 0x404, &(0x7f00000005c0)={[{@discard}, {@bh}, {@nomblk_io_submit}]}, 0x1, 0x5d8, &(0x7f0000000c00)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x3ffff) sendfile(r2, r1, 0x0, 0x7ffff000) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) 358.407214ms ago: executing program 0 (id=778): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = inotify_init() r1 = creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x18) r4 = inotify_add_watch(r0, &(0x7f00000004c0)='./file0\x00', 0x8c7) write$binfmt_elf32(r1, &(0x7f0000000040)=ANY=[@ANYRES64=r4], 0x69) close(r1) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 357.959864ms ago: executing program 2 (id=779): bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0xd, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000008002b000000000000000018040000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x18, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r0}, 0x10) r1 = gettid() timer_create(0x0, &(0x7f00000003c0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000380)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r4, 0x0, r3, 0x0, 0x3, 0x0) fcntl$setpipe(r2, 0x4, 0xfffffffffffff000) 303.384916ms ago: executing program 1 (id=780): write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0xffffff6a) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0xd9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r1}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_io_uring_setup(0xe46, &(0x7f0000000380)={0x0, 0x5f39, 0x0, 0x4001, 0x2b7}, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.current\x00', 0x275a, 0x0) r2 = perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) close(r2) 302.550956ms ago: executing program 0 (id=781): mknodat$null(0xffffffffffffff9c, 0x0, 0xb0a54e68b1cd2fdb, 0x103) r0 = socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000980)={'team_slave_1\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001380)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000818110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x45, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r3, 0x0, 0x6}, 0x18) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@newtfilter={0x124, 0x2c, 0xd2b, 0x70bd2b, 0x35dfdbfb, {0x0, 0x0, 0x0, r1, {0xf}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_u32={{0x8}, {0xf8, 0x2, [@TCA_U32_SEL={0xf4, 0x5, {0x10, 0x9, 0xe, 0x10da, 0xa760, 0x0, 0x10, 0xfc, [{0x2, 0xd033, 0x10000, 0x8000}, {0x7, 0x7fff, 0x0, 0x40}, {0x40, 0x80000001, 0xfffffffe, 0xffffffff}, {0x5, 0x9, 0x2}, {0x8, 0x80000000, 0x1e0a}, {0xffffffff, 0x9, 0x800, 0x100}, {0x7, 0xe22, 0x9, 0x5cf4}, {0x10001, 0x7, 0xc841, 0x2}, {0x3ff, 0xb, 0x3, 0xa6d}, {0x40, 0x40, 0x3, 0x5}, {0x2, 0x8, 0x6, 0x201}, {0x1, 0x800, 0xc2e0, 0x5}, {0x94b0, 0x81, 0x80000001, 0xfffffffc}, {0xc, 0x2, 0xfffffffb}]}}]}}]}, 0x124}, 0x1, 0x0, 0x0, 0x8000}, 0x24040084) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) 275.044326ms ago: executing program 0 (id=782): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x2, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd29, 0x2, {0x0, 0x0, 0x0, r6, {0xffff, 0xf}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x1, 0x2}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x810) 181.918747ms ago: executing program 0 (id=783): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000080)=0x654a, 0x4) bind$inet(r2, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$sock_int(r2, 0x1, 0xc, &(0x7f0000000000)=0x1, 0x4) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) 181.282357ms ago: executing program 4 (id=784): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000001a00000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000100000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}}, 0x24}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x29a83a768e447add) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd2d, 0x20000000, {0x0, 0x0, 0x0, r3, {0x5, 0x2}, {}, {0x5, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x0, 0x1}}, @TCA_FLOWER_FLAGS={0x8, 0x16, 0x2}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) 89.865348ms ago: executing program 4 (id=785): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01000000010000000500080001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r0}, 0x0, 0x0}, 0x20) r1 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r2, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) write$selinux_user(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='system_u:object_r:auth_cache_t root'], 0x27) 42.67446ms ago: executing program 4 (id=786): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, &(0x7f0000001700)=""/53}, 0x20) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0xfffffffffffffdd0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x2c, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) close_range(r3, 0xffffffffffffffff, 0x0) 0s ago: executing program 4 (id=787): syz_usb_connect(0x0, 0x49, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0xa4, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x4000810) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002180)=@ipv4_newaddr={0x34, 0x14, 0x503, 0x800000, 0x25dfdbff, {0x2, 0x18, 0x50, 0xff, r4}, [@IFA_LOCAL={0x8, 0x2, @loopback}, @IFA_LABEL={0x14, 0x3, 'dvmrp1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0xc090}, 0x48006) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.35' (ED25519) to the list of known hosts. [ 21.956953][ T29] audit: type=1400 audit(1749843059.269:62): avc: denied { mounton } for pid=3266 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.957570][ T3266] cgroup: Unknown subsys name 'net' [ 21.979683][ T29] audit: type=1400 audit(1749843059.269:63): avc: denied { mount } for pid=3266 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.007136][ T29] audit: type=1400 audit(1749843059.299:64): avc: denied { unmount } for pid=3266 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.142367][ T3266] cgroup: Unknown subsys name 'cpuset' [ 22.148450][ T3266] cgroup: Unknown subsys name 'rlimit' [ 22.316944][ T29] audit: type=1400 audit(1749843059.629:65): avc: denied { setattr } for pid=3266 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.340305][ T29] audit: type=1400 audit(1749843059.629:66): avc: denied { create } for pid=3266 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.360820][ T29] audit: type=1400 audit(1749843059.629:67): avc: denied { write } for pid=3266 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.381222][ T29] audit: type=1400 audit(1749843059.629:68): avc: denied { read } for pid=3266 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.401506][ T29] audit: type=1400 audit(1749843059.639:69): avc: denied { mounton } for pid=3266 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.408963][ T3299] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.426338][ T29] audit: type=1400 audit(1749843059.639:70): avc: denied { mount } for pid=3266 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.458181][ T29] audit: type=1400 audit(1749843059.749:71): avc: denied { relabelto } for pid=3299 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 22.541415][ T3266] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.682688][ T3310] chnl_net:caif_netlink_parms(): no params data found [ 23.729539][ T3306] chnl_net:caif_netlink_parms(): no params data found [ 23.782820][ T3313] chnl_net:caif_netlink_parms(): no params data found [ 23.807263][ T3308] chnl_net:caif_netlink_parms(): no params data found [ 23.821148][ T3310] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.828308][ T3310] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.835606][ T3310] bridge_slave_0: entered allmulticast mode [ 23.842026][ T3310] bridge_slave_0: entered promiscuous mode [ 23.850850][ T3310] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.857956][ T3310] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.865219][ T3310] bridge_slave_1: entered allmulticast mode [ 23.871486][ T3310] bridge_slave_1: entered promiscuous mode [ 23.909804][ T3305] chnl_net:caif_netlink_parms(): no params data found [ 23.919536][ T3310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 23.941161][ T3310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 23.956846][ T3306] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.964052][ T3306] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.971611][ T3306] bridge_slave_0: entered allmulticast mode [ 23.978038][ T3306] bridge_slave_0: entered promiscuous mode [ 23.986998][ T3306] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.994098][ T3306] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.001210][ T3306] bridge_slave_1: entered allmulticast mode [ 24.007660][ T3306] bridge_slave_1: entered promiscuous mode [ 24.019380][ T3313] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.026449][ T3313] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.033698][ T3313] bridge_slave_0: entered allmulticast mode [ 24.040110][ T3313] bridge_slave_0: entered promiscuous mode [ 24.064295][ T3313] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.071624][ T3313] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.078812][ T3313] bridge_slave_1: entered allmulticast mode [ 24.085314][ T3313] bridge_slave_1: entered promiscuous mode [ 24.098785][ T3310] team0: Port device team_slave_0 added [ 24.105323][ T3310] team0: Port device team_slave_1 added [ 24.126440][ T3306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 24.139271][ T3308] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.146781][ T3308] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.154029][ T3308] bridge_slave_0: entered allmulticast mode [ 24.160341][ T3308] bridge_slave_0: entered promiscuous mode [ 24.167914][ T3313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 24.180560][ T3313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 24.190619][ T3306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 24.208382][ T3308] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.215492][ T3308] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.222792][ T3308] bridge_slave_1: entered allmulticast mode [ 24.229041][ T3308] bridge_slave_1: entered promiscuous mode [ 24.248631][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.255707][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.281694][ T3310] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.305598][ T3306] team0: Port device team_slave_0 added [ 24.312428][ T3313] team0: Port device team_slave_0 added [ 24.318241][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.325229][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.351231][ T3310] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.366164][ T3305] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.373425][ T3305] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.380635][ T3305] bridge_slave_0: entered allmulticast mode [ 24.387096][ T3305] bridge_slave_0: entered promiscuous mode [ 24.393939][ T3305] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.401009][ T3305] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.408195][ T3305] bridge_slave_1: entered allmulticast mode [ 24.414582][ T3305] bridge_slave_1: entered promiscuous mode [ 24.421536][ T3306] team0: Port device team_slave_1 added [ 24.428059][ T3313] team0: Port device team_slave_1 added [ 24.442142][ T3308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 24.470652][ T3308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 24.480036][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.487043][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.513108][ T3313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.524705][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.531784][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.557785][ T3313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.569389][ T3305] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 24.597922][ T3305] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 24.607765][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.614744][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.640707][ T3306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.657890][ T3310] hsr_slave_0: entered promiscuous mode [ 24.663877][ T3310] hsr_slave_1: entered promiscuous mode [ 24.673927][ T3306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.680922][ T3306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.706941][ T3306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.720968][ T3308] team0: Port device team_slave_0 added [ 24.728378][ T3308] team0: Port device team_slave_1 added [ 24.763646][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.770605][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.796554][ T3308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.808029][ T3305] team0: Port device team_slave_0 added [ 24.820165][ T3313] hsr_slave_0: entered promiscuous mode [ 24.826319][ T3313] hsr_slave_1: entered promiscuous mode [ 24.832124][ T3313] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 24.839659][ T3313] Cannot create hsr debugfs directory [ 24.849674][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.856780][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.882745][ T3308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 24.893940][ T3305] team0: Port device team_slave_1 added [ 24.908561][ T3306] hsr_slave_0: entered promiscuous mode [ 24.914616][ T3306] hsr_slave_1: entered promiscuous mode [ 24.920423][ T3306] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 24.928031][ T3306] Cannot create hsr debugfs directory [ 24.963327][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.970285][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.996321][ T3305] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 25.007473][ T3305] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 25.014462][ T3305] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 25.040534][ T3305] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 25.060027][ T3308] hsr_slave_0: entered promiscuous mode [ 25.065938][ T3308] hsr_slave_1: entered promiscuous mode [ 25.071788][ T3308] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 25.079355][ T3308] Cannot create hsr debugfs directory [ 25.121504][ T3305] hsr_slave_0: entered promiscuous mode [ 25.127549][ T3305] hsr_slave_1: entered promiscuous mode [ 25.133570][ T3305] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 25.141131][ T3305] Cannot create hsr debugfs directory [ 25.287505][ T3313] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 25.298181][ T3313] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 25.310065][ T3313] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 25.320040][ T3313] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 25.340122][ T3310] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 25.351666][ T3310] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 25.364615][ T3310] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 25.375562][ T3310] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 25.394785][ T3306] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 25.405422][ T3306] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 25.413885][ T3306] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 25.428403][ T3306] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 25.450176][ T3308] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 25.458981][ T3308] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 25.468001][ T3308] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 25.476784][ T3308] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 25.536276][ T3305] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 25.545283][ T3305] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 25.555003][ T3305] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 25.564735][ T3305] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 25.576441][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.605481][ T3313] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.618408][ T3310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.631185][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.638274][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.648154][ T3306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.664333][ T3306] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.673778][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.680849][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.700468][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.707632][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.716023][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.723066][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.732449][ T3308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.740917][ T3310] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.760850][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.767956][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.785991][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.793062][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.804498][ T3308] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.816625][ T3305] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.825865][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.832949][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.845328][ T3306] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 25.883798][ T3310] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 25.894355][ T3310] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 25.914748][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.921975][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.935091][ T3305] 8021q: adding VLAN 0 to HW filter on device team0 [ 25.950865][ T3308] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 25.961282][ T3308] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 25.995167][ T2124] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.002377][ T2124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.013051][ T2124] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.020186][ T2124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.034699][ T3306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.047459][ T3310] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.065618][ T3313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.103136][ T3308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.225912][ T3305] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.251146][ T3310] veth0_vlan: entered promiscuous mode [ 26.263997][ T3308] veth0_vlan: entered promiscuous mode [ 26.285697][ T3306] veth0_vlan: entered promiscuous mode [ 26.293385][ T3310] veth1_vlan: entered promiscuous mode [ 26.307993][ T3308] veth1_vlan: entered promiscuous mode [ 26.322176][ T3313] veth0_vlan: entered promiscuous mode [ 26.329782][ T3313] veth1_vlan: entered promiscuous mode [ 26.338585][ T3306] veth1_vlan: entered promiscuous mode [ 26.362977][ T3313] veth0_macvtap: entered promiscuous mode [ 26.381236][ T3313] veth1_macvtap: entered promiscuous mode [ 26.389341][ T3308] veth0_macvtap: entered promiscuous mode [ 26.401353][ T3310] veth0_macvtap: entered promiscuous mode [ 26.410609][ T3306] veth0_macvtap: entered promiscuous mode [ 26.420758][ T3308] veth1_macvtap: entered promiscuous mode [ 26.428240][ T3310] veth1_macvtap: entered promiscuous mode [ 26.437824][ T3306] veth1_macvtap: entered promiscuous mode [ 26.448629][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.461226][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.473168][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.494078][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.505200][ T3306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.514695][ T3310] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.523563][ T3310] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.532513][ T3310] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.541224][ T3310] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.557767][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.567538][ T3306] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.576433][ T3306] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.585178][ T3306] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.594103][ T3306] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.608993][ T3313] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.617846][ T3313] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.626702][ T3313] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.635472][ T3313] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.661936][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.675973][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.687745][ T3305] veth0_vlan: entered promiscuous mode [ 26.715422][ T3308] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.724267][ T3308] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.733077][ T3308] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.741840][ T3308] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.756210][ T3305] veth1_vlan: entered promiscuous mode [ 26.762846][ T3310] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.776738][ T3305] veth0_macvtap: entered promiscuous mode [ 26.797404][ T3305] veth1_macvtap: entered promiscuous mode [ 26.821599][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.859737][ T3305] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.873341][ T3482] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.878504][ T3305] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.893852][ T3305] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.902618][ T3305] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.911417][ T3305] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.924971][ T3482] loop0: detected capacity change from 0 to 256 [ 26.948528][ T3482] FAT-fs (loop0): bogus number of FAT sectors [ 26.954697][ T3482] FAT-fs (loop0): Can't find a valid FAT filesystem [ 26.980511][ T29] kauditd_printk_skb: 34 callbacks suppressed [ 26.980529][ T29] audit: type=1400 audit(1749843064.289:106): avc: denied { create } for pid=3490 comm="syz.2.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.011651][ T3486] veth1_macvtap: left promiscuous mode [ 27.020113][ T3486] macsec0: entered promiscuous mode [ 27.057147][ T29] audit: type=1400 audit(1749843064.289:107): avc: denied { bind } for pid=3490 comm="syz.2.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.077617][ T29] audit: type=1400 audit(1749843064.299:108): avc: denied { write } for pid=3490 comm="syz.2.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.098014][ T29] audit: type=1400 audit(1749843064.349:109): avc: denied { setopt } for pid=3481 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.175427][ T29] audit: type=1400 audit(1749843064.479:110): avc: denied { map } for pid=3499 comm="syz.1.9" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=3785 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 27.199364][ T29] audit: type=1400 audit(1749843064.479:111): avc: denied { read write } for pid=3499 comm="syz.1.9" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=3785 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 27.235771][ T29] audit: type=1326 audit(1749843064.539:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3499 comm="syz.1.9" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6b20d0e929 code=0x0 [ 27.259510][ T29] audit: type=1400 audit(1749843064.549:113): avc: denied { create } for pid=3501 comm="syz.2.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.285413][ T3502] loop2: detected capacity change from 0 to 128 [ 27.293519][ T3502] EXT4-fs: Ignoring removed oldalloc option [ 27.308490][ T29] audit: type=1400 audit(1749843064.619:114): avc: denied { create } for pid=3504 comm="syz.3.12" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 27.344400][ T3502] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 27.357024][ T29] audit: type=1400 audit(1749843064.649:115): avc: denied { create } for pid=3504 comm="syz.3.12" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 27.382483][ T3502] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 27.427294][ T3507] infiniband syz!: set active [ 27.432232][ T3507] infiniband syz!: added team_slave_0 [ 27.455234][ T3507] RDS/IB: syz!: added [ 27.459275][ T3507] smc: adding ib device syz! with port count 1 [ 27.472041][ T3507] smc: ib device syz! port 1 has pnetid [ 27.511749][ C0] hrtimer: interrupt took 38841 ns [ 27.571553][ T3502] syz.2.11 (3502) used greatest stack depth: 10872 bytes left [ 27.589112][ T3517] loop4: detected capacity change from 0 to 2048 [ 27.627970][ T3308] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 27.649588][ T3517] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 27.701887][ T3525] loop2: detected capacity change from 0 to 512 [ 27.709592][ T3525] EXT4-fs: Ignoring removed bh option [ 27.717769][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 27.739133][ T3525] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 27.752595][ T3525] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 27.761638][ T3525] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 27.817447][ T3535] loop4: detected capacity change from 0 to 512 [ 27.824893][ T3525] EXT4-fs (loop2): warning: mounting unchecked fs, running e2fsck is recommended [ 27.834964][ T3535] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 27.844177][ T3535] EXT4-fs (loop4): invalid journal inode [ 27.891478][ T3525] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01c, mo2=0006] [ 27.903376][ T3525] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 27.950845][ T3543] netlink: 'syz.0.26': attribute type 1 has an invalid length. [ 27.960316][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 27.965549][ T3542] netlink: 24 bytes leftover after parsing attributes in process `syz.4.25'. [ 27.981798][ T3543] netlink: 4 bytes leftover after parsing attributes in process `syz.0.26'. [ 27.988033][ T3507] syz.3.12 (3507) used greatest stack depth: 10512 bytes left [ 27.997079][ T3542] sch_tbf: burst 88 is lower than device ip6gre0 mtu (1448) ! [ 28.039809][ T3549] netlink: 96 bytes leftover after parsing attributes in process `syz.1.29'. [ 28.108697][ T3555] netlink: 4 bytes leftover after parsing attributes in process `syz.4.31'. [ 28.118113][ T3555] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 28.125628][ T3555] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 28.140492][ T3555] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 28.148282][ T3555] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 28.242299][ T3559] loop2: detected capacity change from 0 to 4096 [ 28.249615][ T3559] EXT4-fs (loop2): couldn't mount as ext2 due to feature incompatibilities [ 28.330185][ T3563] usb usb8: usbfs: process 3563 (syz.2.36) did not claim interface 0 before use [ 28.340888][ T3570] loop3: detected capacity change from 0 to 2048 [ 28.350653][ T3570] EXT4-fs: Ignoring removed bh option [ 28.377100][ T3570] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 28.400617][ T3570] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 28.416860][ T3570] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 28.429187][ T3570] EXT4-fs (loop3): This should not happen!! Data will be lost [ 28.429187][ T3570] [ 28.439186][ T3570] EXT4-fs (loop3): Total free blocks count 0 [ 28.445274][ T3570] EXT4-fs (loop3): Free/Dirty block details [ 28.451481][ T3570] EXT4-fs (loop3): free_blocks=2415919104 [ 28.457483][ T3570] EXT4-fs (loop3): dirty_blocks=16 [ 28.458480][ T3579] netlink: 'syz.3.39': attribute type 10 has an invalid length. [ 28.462653][ T3570] EXT4-fs (loop3): Block reservation details [ 28.462670][ T3570] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 28.482339][ T3579] netlink: 152 bytes leftover after parsing attributes in process `syz.3.39'. [ 28.493783][ T3576] netlink: 'syz.2.41': attribute type 11 has an invalid length. [ 28.502666][ T3570] syz.3.39 (3570) used greatest stack depth: 9880 bytes left [ 28.523864][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 28.682855][ T3593] loop2: detected capacity change from 0 to 128 [ 28.700856][ T3592] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 28.708803][ T3592] FAT-fs (loop2): Filesystem has been set read-only [ 28.717853][ T3592] syz.2.48: attempt to access beyond end of device [ 28.717853][ T3592] loop2: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 28.731684][ T3592] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 28.739732][ T3592] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000100) [ 28.749323][ T3593] syz.2.48: attempt to access beyond end of device [ 28.749323][ T3593] loop2: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 28.762825][ T3593] syz.2.48: attempt to access beyond end of device [ 28.762825][ T3593] loop2: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 28.776729][ T3593] syz.2.48: attempt to access beyond end of device [ 28.776729][ T3593] loop2: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 28.805269][ T3593] syz.2.48: attempt to access beyond end of device [ 28.805269][ T3593] loop2: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 28.824851][ T3596] loop1: detected capacity change from 0 to 512 [ 28.847175][ T3596] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 28.885210][ T3596] EXT4-fs error (device loop1): ext4_orphan_get:1419: comm syz.1.49: bad orphan inode 15 [ 28.896378][ T3596] ext4_test_bit(bit=14, block=18) = 1 [ 28.901993][ T3596] is_bad_inode(inode)=0 [ 28.906385][ T3596] NEXT_ORPHAN(inode)=1023 [ 28.910733][ T3596] max_ino=32 [ 28.913997][ T3596] i_nlink=0 [ 28.917827][ T3596] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0009-000000000000 r/w without journal. Quota mode: none. [ 28.941904][ T3596] ext2 filesystem being mounted at /8/éq‰Y’3aK supports timestamps until 2038-01-19 (0x7fffffff) [ 28.969312][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0009-000000000000. [ 29.176169][ T3616] Driver unsupported XDP return value 0 on prog (id 50) dev N/A, expect packet loss! [ 29.196991][ T3618] xt_CT: You must specify a L4 protocol and not use inversions on it [ 29.289388][ T3624] sd 0:0:1:0: device reset [ 29.307384][ T3628] loop1: detected capacity change from 0 to 512 [ 29.328858][ T3628] EXT4-fs: Ignoring removed nobh option [ 29.366571][ T3628] EXT4-fs (loop1): mounted filesystem 00800000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 29.428349][ T3628] ext4 filesystem being mounted at /14/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 29.441559][ T3639] netlink: 100 bytes leftover after parsing attributes in process `syz.0.68'. [ 29.455755][ T3645] loop2: detected capacity change from 0 to 128 [ 29.474421][ T3645] EXT4-fs: Ignoring removed nobh option [ 29.503112][ T3628] EXT4-fs error (device loop1): ext4_generic_delete_entry:2668: inode #2: block 3: comm syz.1.63: bad entry in directory: rec_len is too small for name_len - offset=24, inode=11, rec_len=20, size=4096 fake=0 [ 29.543258][ T3645] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 29.556358][ T3628] EXT4-fs error (device loop1) in ext4_delete_entry:2739: Corrupt filesystem [ 29.566900][ T3645] ext4 filesystem being mounted at /16/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 29.578852][ T3628] EXT4-fs warning (device loop1): ext4_rename_delete:3726: inode #2: comm syz.1.63: Deleting old file: nlink 4, error=-117 [ 29.615089][ T3306] EXT4-fs (loop1): unmounting filesystem 00800000-0000-0000-0000-000000000000. [ 29.776579][ T3678] process 'syz.0.83' launched './file1' with NULL argv: empty string added [ 29.798080][ T3308] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 30.036756][ T3698] syzkaller1: entered promiscuous mode [ 30.042516][ T3698] syzkaller1: entered allmulticast mode [ 30.158253][ T3704] netlink: 4 bytes leftover after parsing attributes in process `syz.0.95'. [ 30.203072][ T3704] netlink: 12 bytes leftover after parsing attributes in process `syz.0.95'. [ 30.437954][ T3729] netlink: 'syz.2.106': attribute type 10 has an invalid length. [ 30.445821][ T3729] netlink: 40 bytes leftover after parsing attributes in process `syz.2.106'. [ 30.480799][ T3729] team0: Port device geneve1 added [ 30.653867][ T3752] loop2: detected capacity change from 0 to 512 [ 30.660586][ T3752] EXT4-fs: Ignoring removed nomblk_io_submit option [ 30.772242][ T3752] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 30.813552][ T3752] ext4 filesystem being mounted at /24/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 30.921370][ T3764] xt_cluster: node mask cannot exceed total number of nodes [ 31.030723][ T3770] loop3: detected capacity change from 0 to 128 [ 31.049990][ T3772] netlink: 8 bytes leftover after parsing attributes in process `syz.0.123'. [ 31.082967][ T3772] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 31.305838][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.474812][ T3801] netlink: 'syz.1.136': attribute type 2 has an invalid length. [ 31.482651][ T3801] netlink: 'syz.1.136': attribute type 1 has an invalid length. [ 31.503655][ T3799] pim6reg1: entered promiscuous mode [ 31.509087][ T3799] pim6reg1: entered allmulticast mode [ 31.586560][ T3810] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 31.615731][ T3813] netlink: 'syz.0.138': attribute type 16 has an invalid length. [ 31.623529][ T3813] netlink: 'syz.0.138': attribute type 17 has an invalid length. [ 31.655838][ T3813] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 31.701028][ T3810] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 31.764611][ T3810] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 31.815677][ T3810] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 31.907477][ T3810] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.938948][ T3810] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.952326][ T3810] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.977760][ T3810] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.988020][ T3841] netlink: 'syz.0.152': attribute type 27 has an invalid length. [ 32.008818][ T29] kauditd_printk_skb: 327 callbacks suppressed [ 32.008836][ T29] audit: type=1326 audit(1749843069.319:443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3838 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4e990e929 code=0x7ffc0000 [ 32.048979][ T29] audit: type=1326 audit(1749843069.319:444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3838 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4e990e929 code=0x7ffc0000 [ 32.072483][ T29] audit: type=1326 audit(1749843069.319:445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3838 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=25 compat=0 ip=0x7fa4e990e929 code=0x7ffc0000 [ 32.112453][ T3841] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.119717][ T3841] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.131692][ T29] audit: type=1326 audit(1749843069.379:446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3838 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4e990e929 code=0x7ffc0000 [ 32.155440][ T29] audit: type=1326 audit(1749843069.379:447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3838 comm="syz.2.153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4e990e929 code=0x7ffc0000 [ 32.214631][ T3841] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 32.225089][ T3841] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 32.238675][ T3854] netlink: 'syz.4.157': attribute type 7 has an invalid length. [ 32.261643][ T29] audit: type=1400 audit(1749843069.569:448): avc: denied { mounton } for pid=3855 comm="syz.2.158" path="/30/file0" dev="tmpfs" ino=182 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 32.289047][ T3841] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.298158][ T3841] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.307591][ T3841] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.316562][ T3841] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 32.329306][ T3841] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 32.329786][ T29] audit: type=1400 audit(1749843069.639:449): avc: denied { create } for pid=3858 comm="syz.3.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 32.356375][ T29] audit: type=1400 audit(1749843069.649:450): avc: denied { execmem } for pid=3858 comm="syz.3.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 32.411438][ T29] audit: type=1400 audit(1749843069.719:451): avc: denied { sqpoll } for pid=3861 comm="syz.2.160" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 32.436835][ T3844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.463944][ T3844] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.481002][ T3844] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 32.532482][ T3867] random: crng reseeded on system resumption [ 32.541851][ T29] audit: type=1400 audit(1749843069.839:452): avc: denied { append } for pid=3866 comm="syz.2.162" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 32.645011][ T3872] syz.2.165 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 32.668350][ T3879] ======================================================= [ 32.668350][ T3879] WARNING: The mand mount option has been deprecated and [ 32.668350][ T3879] and is ignored by this kernel. Remove the mand [ 32.668350][ T3879] option from the mount to silence this warning. [ 32.668350][ T3879] ======================================================= [ 32.739967][ T3884] team0: Port device geneve1 added [ 32.793638][ T3894] loop4: detected capacity change from 0 to 2048 [ 32.800383][ T3894] EXT4-fs: Ignoring removed mblk_io_submit option [ 32.823692][ T3894] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.840236][ T3894] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.176: bg 0: block 234: padding at end of block bitmap is not set [ 32.860391][ T3894] EXT4-fs (loop4): Remounting filesystem read-only [ 32.904239][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.937668][ T3910] loop1: detected capacity change from 0 to 1024 [ 32.955741][ T3910] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 32.985771][ T3910] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 49 with max blocks 4 with error 28 [ 32.998275][ T3910] EXT4-fs (loop1): This should not happen!! Data will be lost [ 32.998275][ T3910] [ 33.008069][ T3910] EXT4-fs (loop1): Total free blocks count 0 [ 33.014100][ T3910] EXT4-fs (loop1): Free/Dirty block details [ 33.020017][ T3910] EXT4-fs (loop1): free_blocks=0 [ 33.025007][ T3910] EXT4-fs (loop1): dirty_blocks=0 [ 33.030055][ T3910] EXT4-fs (loop1): Block reservation details [ 33.036110][ T3910] EXT4-fs (loop1): i_reserved_data_blocks=0 [ 33.071958][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.110568][ T3927] __nla_validate_parse: 4 callbacks suppressed [ 33.110587][ T3927] netlink: 4 bytes leftover after parsing attributes in process `syz.4.188'. [ 33.136698][ T3927] netlink: 12 bytes leftover after parsing attributes in process `syz.4.188'. [ 33.165027][ T3930] vhci_hcd: invalid port number 236 [ 33.170303][ T3930] vhci_hcd: invalid port number 236 [ 33.233268][ T3941] syz.1.194 uses obsolete (PF_INET,SOCK_PACKET) [ 33.315113][ T3918] loop3: detected capacity change from 0 to 512 [ 33.322300][ T3918] EXT4-fs: inline encryption not supported [ 33.328635][ T3918] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 33.486451][ T3957] loop4: detected capacity change from 0 to 512 [ 33.493550][ T3957] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 33.505377][ T3957] EXT4-fs error (device loop4): ext4_get_branch:178: inode #11: block 4294967295: comm syz.4.201: invalid block [ 33.519195][ T3957] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.201: invalid indirect mapped block 4294967295 (level 1) [ 33.534064][ T3957] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.201: invalid indirect mapped block 4294967295 (level 1) [ 33.549245][ T3957] EXT4-fs (loop4): 2 truncates cleaned up [ 33.566886][ T3957] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 33.602994][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.761234][ T3983] 9pnet: p9_errstr2errno: server reported unknown error [ 35.092532][ T4059] loop3: detected capacity change from 0 to 512 [ 35.104877][ T4059] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.133378][ T4059] ext4 filesystem being mounted at /49/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 35.178759][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.250568][ T4074] loop3: detected capacity change from 0 to 128 [ 35.267696][ T4074] syz.3.252: attempt to access beyond end of device [ 35.267696][ T4074] loop3: rw=34817, sector=97, nr_sectors = 32 limit=128 [ 35.378746][ T4077] loop3: detected capacity change from 0 to 512 [ 35.393375][ T4077] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.406453][ T4077] ext4 filesystem being mounted at /54/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 35.448142][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.677508][ T4083] xt_cluster: node mask cannot exceed total number of nodes [ 35.885848][ T4094] pim6reg1: entered promiscuous mode [ 35.891427][ T4094] pim6reg1: entered allmulticast mode [ 35.958477][ T4095] loop3: detected capacity change from 0 to 1024 [ 35.987667][ T4095] EXT4-fs: Ignoring removed nobh option [ 35.993346][ T4095] EXT4-fs: Ignoring removed nobh option [ 36.011792][ T4099] 9pnet: p9_errstr2errno: server reported unknown error [ 36.024644][ T4095] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (62631!=20869) [ 36.060794][ T4095] EXT4-fs error (device loop3): ext4_get_journal_inode:5796: comm syz.3.256: inode #4294967295: comm syz.3.256: iget: illegal inode # [ 36.107462][ T4095] EXT4-fs (loop3): no journal found [ 36.113530][ T4095] EXT4-fs (loop3): can't get journal size [ 36.144999][ T4102] netlink: 112 bytes leftover after parsing attributes in process `syz.0.262'. [ 36.174677][ T4095] EXT4-fs (loop3): failed to initialize system zone (-22) [ 36.197277][ T4095] EXT4-fs (loop3): mount failed [ 36.210216][ T4109] netlink: 12 bytes leftover after parsing attributes in process `syz.2.265'. [ 36.255617][ T4113] loop2: detected capacity change from 0 to 512 [ 36.270985][ T4113] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 36.290407][ T4113] EXT4-fs error (device loop2): ext4_get_branch:178: inode #11: block 4294967295: comm syz.2.266: invalid block [ 36.380179][ T4113] EXT4-fs error (device loop2): ext4_free_branches:1023: inode #11: comm syz.2.266: invalid indirect mapped block 4294967295 (level 1) [ 36.456959][ T4113] EXT4-fs error (device loop2): ext4_free_branches:1023: inode #11: comm syz.2.266: invalid indirect mapped block 4294967295 (level 1) [ 36.512110][ T4113] EXT4-fs (loop2): 2 truncates cleaned up [ 36.523561][ T4113] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 36.561768][ T4129] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.582067][ T4133] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4133 comm=syz.4.275 [ 36.628442][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.637552][ T4133] netlink: 8 bytes leftover after parsing attributes in process `syz.4.275'. [ 36.646618][ T4133] netlink: 28 bytes leftover after parsing attributes in process `syz.4.275'. [ 36.663732][ T4129] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.693363][ T4139] tipc: Started in network mode [ 36.698296][ T4139] tipc: Node identity ac14140f, cluster identity 4711 [ 36.714915][ T4139] tipc: New replicast peer: 0.0.255.255 [ 36.720551][ T4139] tipc: Enabled bearer , priority 10 [ 36.730452][ T4129] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.792775][ T4133] vlan2: entered allmulticast mode [ 36.797986][ T4133] hsr0: entered allmulticast mode [ 36.803105][ T4133] hsr_slave_0: entered allmulticast mode [ 36.808760][ T4133] hsr_slave_1: entered allmulticast mode [ 36.840860][ T4089] syz.3.256 (4089) used greatest stack depth: 8216 bytes left [ 36.852578][ T4129] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.924299][ T4129] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.953102][ T4129] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.980913][ T4129] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.018856][ T4129] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.167886][ T4085] syz.3.256 (4085) used greatest stack depth: 7000 bytes left [ 37.207702][ T29] kauditd_printk_skb: 169 callbacks suppressed [ 37.207721][ T29] audit: type=1400 audit(1749843074.519:622): avc: denied { read } for pid=4159 comm="syz.0.286" name="mISDNtimer" dev="devtmpfs" ino=249 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 37.274121][ T29] audit: type=1400 audit(1749843074.519:623): avc: denied { open } for pid=4159 comm="syz.0.286" path="/dev/mISDNtimer" dev="devtmpfs" ino=249 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 37.298051][ T29] audit: type=1400 audit(1749843074.559:624): avc: denied { ioctl } for pid=4159 comm="syz.0.286" path="/dev/mISDNtimer" dev="devtmpfs" ino=249 ioctlcmd=0x4940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 37.356663][ T4163] netlink: 3 bytes leftover after parsing attributes in process `syz.0.287'. [ 37.405296][ T4165] loop3: detected capacity change from 0 to 512 [ 37.416591][ T4163] batadv1: entered promiscuous mode [ 37.422089][ T4163] batadv1: entered allmulticast mode [ 37.447719][ T4165] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 37.469574][ T4165] EXT4-fs error (device loop3): ext4_get_branch:178: inode #11: block 4294967295: comm syz.3.288: invalid block [ 37.495486][ T4165] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.288: invalid indirect mapped block 4294967295 (level 1) [ 37.523029][ T4165] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.288: invalid indirect mapped block 4294967295 (level 1) [ 37.553925][ T4163] Zero length message leads to an empty skb [ 37.560175][ T4165] EXT4-fs (loop3): 2 truncates cleaned up [ 37.573763][ T4165] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 37.607437][ T29] audit: type=1326 audit(1749843074.919:625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4164 comm="syz.3.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 37.630709][ T29] audit: type=1326 audit(1749843074.919:626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4164 comm="syz.3.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 37.691829][ T4169] wg2: entered promiscuous mode [ 37.696970][ T4169] wg2: entered allmulticast mode [ 37.704398][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 37.761780][ T29] audit: type=1326 audit(1749843074.989:627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4164 comm="syz.3.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 37.785857][ T29] audit: type=1326 audit(1749843074.989:628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4164 comm="syz.3.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 37.809376][ T29] audit: type=1326 audit(1749843074.989:629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4164 comm="syz.3.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 37.833606][ T29] audit: type=1326 audit(1749843074.989:630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4164 comm="syz.3.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 37.860784][ T29] audit: type=1326 audit(1749843074.989:631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4164 comm="syz.3.288" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 37.891902][ T10] tipc: Node number set to 2886997007 [ 37.999422][ T4191] loop3: detected capacity change from 0 to 1024 [ 38.047716][ T4191] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 38.048045][ T4187] netlink: 87 bytes leftover after parsing attributes in process `syz.4.296'. [ 38.098681][ T4191] EXT4-fs error (device loop3): mb_free_blocks:1948: group 0, inode 18: block 305:freeing already freed block (bit 19); block bitmap corrupt. [ 38.132414][ T4198] netlink: 24 bytes leftover after parsing attributes in process `syz.0.294'. [ 38.191367][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.312875][ T4205] bridge_slave_0: left allmulticast mode [ 38.318616][ T4205] bridge_slave_0: left promiscuous mode [ 38.324494][ T4205] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.350979][ T4205] bridge_slave_1: left allmulticast mode [ 38.356755][ T4205] bridge_slave_1: left promiscuous mode [ 38.363122][ T4205] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.373928][ T4211] loop2: detected capacity change from 0 to 512 [ 38.374490][ T4205] bond0: (slave bond_slave_0): Releasing backup interface [ 38.388457][ T4205] bond0: (slave bond_slave_1): Releasing backup interface [ 38.399147][ T4205] team0: Port device team_slave_0 removed [ 38.406258][ T4205] team0: Port device team_slave_1 removed [ 38.413524][ T4205] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 38.421131][ T4205] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 38.434749][ T4211] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 38.458583][ T4211] ext4 filesystem being mounted at /50/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 38.555113][ T4218] loop4: detected capacity change from 0 to 512 [ 38.576150][ T4218] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 38.590729][ T4218] EXT4-fs warning (device loop4): dx_probe:837: inode #2: comm syz.4.306: Unimplemented hash flags: 0x0001 [ 38.602824][ T4218] EXT4-fs warning (device loop4): dx_probe:934: inode #2: comm syz.4.306: Corrupt directory, running e2fsck is recommended [ 38.618846][ T4218] EXT4-fs error (device loop4): ext4_readdir:264: inode #2: block 3: comm syz.4.306: path /54/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=4294967295, rec_len=7, size=1024 fake=0 [ 38.645104][ T23] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 38.652609][ T23] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 38.660046][ T23] hid-generic 0003:0004:0000.0001: unknown main item tag 0x0 [ 38.691304][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.701927][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 38.711323][ T23] hid-generic 0003:0004:0000.0001: hidraw0: USB HID v0.00 Device [syz0] on syz1 [ 38.747430][ T4232] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=123 sclass=netlink_route_socket pid=4232 comm=syz.4.310 [ 38.836973][ T4241] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 38.836973][ T4241] The task syz.4.313 (4241) triggered the difference, watch for misbehavior. [ 38.922950][ T4247] loop2: detected capacity change from 0 to 512 [ 38.943951][ T4247] EXT4-fs error (device loop2): ext4_iget_extra_inode:5035: inode #15: comm syz.2.316: corrupted in-inode xattr: invalid ea_ino [ 38.967703][ T4247] EXT4-fs error (device loop2): ext4_orphan_get:1398: comm syz.2.316: couldn't read orphan inode 15 (err -117) [ 38.988958][ T4241] loop4: detected capacity change from 0 to 256 [ 38.996473][ T4247] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 39.009676][ T4241] vfat: Unknown parameter 'shortname' [ 39.058978][ T4255] mmap: syz.3.317 (4255) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 39.111313][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.136899][ T4260] loop1: detected capacity change from 0 to 1024 [ 39.149653][ T4260] EXT4-fs: Ignoring removed nomblk_io_submit option [ 39.156894][ T4260] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 39.160159][ T4262] loop2: detected capacity change from 0 to 512 [ 39.168714][ T4260] JBD2: no valid journal superblock found [ 39.179145][ T4260] EXT4-fs (loop1): Could not load journal inode [ 39.187741][ T4262] EXT4-fs: Ignoring removed nobh option [ 39.207504][ T4262] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #3: comm syz.2.320: corrupted inode contents [ 39.239648][ T4262] EXT4-fs error (device loop2): ext4_dirty_inode:6459: inode #3: comm syz.2.320: mark_inode_dirty error [ 39.259831][ T4262] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #3: comm syz.2.320: corrupted inode contents [ 39.292762][ T4262] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #3: comm syz.2.320: mark_inode_dirty error [ 39.323761][ T4269] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.338599][ T4262] EXT4-fs error (device loop2): ext4_acquire_dquot:6933: comm syz.2.320: Failed to acquire dquot type 0 [ 39.358556][ T4262] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #16: comm syz.2.320: corrupted inode contents [ 39.376174][ T4262] EXT4-fs error (device loop2): ext4_dirty_inode:6459: inode #16: comm syz.2.320: mark_inode_dirty error [ 39.389922][ T4269] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.407562][ T4262] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #16: comm syz.2.320: corrupted inode contents [ 39.423629][ T4262] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #16: comm syz.2.320: mark_inode_dirty error [ 39.435161][ T4262] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #16: comm syz.2.320: corrupted inode contents [ 39.447449][ T4262] EXT4-fs error (device loop2) in ext4_orphan_del:305: Corrupt filesystem [ 39.456384][ T4262] EXT4-fs error (device loop2): ext4_do_update_inode:5568: inode #16: comm syz.2.320: corrupted inode contents [ 39.474053][ T4269] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.493420][ T4262] EXT4-fs error (device loop2): ext4_truncate:4597: inode #16: comm syz.2.320: mark_inode_dirty error [ 39.506140][ T4262] EXT4-fs error (device loop2) in ext4_process_orphan:347: Corrupt filesystem [ 39.515832][ T4262] EXT4-fs (loop2): 1 truncate cleaned up [ 39.521976][ T4262] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.534771][ T4262] ext4 filesystem being mounted at /53/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.557861][ T4269] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.586205][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.604700][ T4276] validate_nla: 1 callbacks suppressed [ 39.604716][ T4276] netlink: 'syz.2.326': attribute type 27 has an invalid length. [ 39.655853][ T4276] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.663353][ T4276] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.704790][ T4276] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.714954][ T4276] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.724440][ T4287] netlink: 24 bytes leftover after parsing attributes in process `syz.1.325'. [ 39.735337][ T4288] netlink: zone id is out of range [ 39.740500][ T4288] netlink: zone id is out of range [ 39.745766][ T4288] netlink: zone id is out of range [ 39.750950][ T4288] netlink: zone id is out of range [ 39.756105][ T4288] netlink: zone id is out of range [ 39.761238][ T4288] netlink: zone id is out of range [ 39.770248][ T4288] netlink: zone id is out of range [ 39.775660][ T4288] netlink: zone id is out of range [ 39.780789][ T4288] netlink: zone id is out of range [ 39.785914][ T4288] netlink: zone id is out of range [ 39.800525][ T4276] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.809757][ T4276] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.818692][ T4276] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.827742][ T4276] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.862731][ T4281] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.870913][ T4281] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.914933][ T4269] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.927437][ T4269] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.952931][ T4269] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.980677][ T4269] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.014026][ T4301] loop1: detected capacity change from 0 to 512 [ 40.033065][ T4303] xt_connbytes: Forcing CT accounting to be enabled [ 40.047558][ T4303] Cannot find set identified by id 0 to match [ 40.065140][ T4301] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.081587][ T4308] netlink: 'syz.3.337': attribute type 10 has an invalid length. [ 40.090554][ T4301] ext4 filesystem being mounted at /68/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 40.110247][ T4308] team0: Port device dummy0 added [ 40.129946][ T4308] netlink: 'syz.3.337': attribute type 10 has an invalid length. [ 40.138635][ T4308] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 40.152835][ T4308] team0: Failed to send options change via netlink (err -105) [ 40.162187][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.169326][ T4308] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 40.180956][ T4308] team0: Port device dummy0 removed [ 40.189349][ T4308] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 40.280522][ T4317] loop3: detected capacity change from 0 to 8192 [ 40.331368][ T4323] netlink: 'syz.3.342': attribute type 27 has an invalid length. [ 40.371433][ T4323] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.378863][ T4323] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.490839][ T4323] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 40.504464][ T4323] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 40.535356][ T4323] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.544011][ T4323] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.552610][ T4323] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.561027][ T4323] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.637220][ T4330] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.674714][ T4330] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.020702][ T4372] loop4: detected capacity change from 0 to 512 [ 41.036636][ T4372] EXT4-fs: Ignoring removed nobh option [ 41.073745][ T4372] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #3: comm syz.4.351: corrupted inode contents [ 41.087009][ T4372] EXT4-fs error (device loop4): ext4_dirty_inode:6459: inode #3: comm syz.4.351: mark_inode_dirty error [ 41.098819][ T4372] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #3: comm syz.4.351: corrupted inode contents [ 41.112054][ T4372] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #3: comm syz.4.351: mark_inode_dirty error [ 41.132273][ T4372] EXT4-fs error (device loop4): ext4_acquire_dquot:6933: comm syz.4.351: Failed to acquire dquot type 0 [ 41.152661][ T4372] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #16: comm syz.4.351: corrupted inode contents [ 41.176535][ T4372] EXT4-fs error (device loop4): ext4_dirty_inode:6459: inode #16: comm syz.4.351: mark_inode_dirty error [ 41.198153][ T4372] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #16: comm syz.4.351: corrupted inode contents [ 41.211451][ T4380] wg2: left promiscuous mode [ 41.211477][ T4372] EXT4-fs error (device loop4): __ext4_ext_dirty:206: inode #16: comm syz.4.351: mark_inode_dirty error [ 41.216172][ T4380] wg2: left allmulticast mode [ 41.233615][ T4372] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #16: comm syz.4.351: corrupted inode contents [ 41.247432][ T4372] EXT4-fs error (device loop4) in ext4_orphan_del:305: Corrupt filesystem [ 41.261029][ T4380] wg2: entered promiscuous mode [ 41.266093][ T4380] wg2: entered allmulticast mode [ 41.269456][ T4372] EXT4-fs error (device loop4): ext4_do_update_inode:5568: inode #16: comm syz.4.351: corrupted inode contents [ 41.284413][ T4372] EXT4-fs error (device loop4): ext4_truncate:4597: inode #16: comm syz.4.351: mark_inode_dirty error [ 41.296310][ T4382] sit0: entered allmulticast mode [ 41.296373][ T4372] EXT4-fs error (device loop4) in ext4_process_orphan:347: Corrupt filesystem [ 41.297067][ T4382] sit0: entered promiscuous mode [ 41.302303][ T4372] EXT4-fs (loop4): 1 truncate cleaned up [ 41.322766][ T4372] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 41.336300][ T4372] ext4 filesystem being mounted at /62/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 41.355007][ T4384] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.387061][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.404275][ T4384] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.406485][ T4388] 9pnet: p9_errstr2errno: server reported unknown error [ 41.423471][ T4390] netlink: 'syz.4.359': attribute type 27 has an invalid length. [ 41.456211][ T4390] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.463420][ T4390] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.518950][ T4390] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.528046][ T4390] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.536468][ T4390] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.544929][ T4390] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.559015][ T4390] vlan2: left allmulticast mode [ 41.563978][ T4390] hsr0: left allmulticast mode [ 41.568791][ T4390] hsr_slave_0: left allmulticast mode [ 41.574386][ T4390] hsr_slave_1: left allmulticast mode [ 41.622702][ T4394] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.630966][ T4394] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.645290][ T4384] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.680126][ T4402] loop2: detected capacity change from 0 to 1024 [ 41.697429][ T4402] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.700356][ T4408] loop3: detected capacity change from 0 to 512 [ 41.717636][ T4384] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.728864][ T4408] EXT4-fs: Ignoring removed nomblk_io_submit option [ 41.733926][ T4405] syz_tun: entered promiscuous mode [ 41.740522][ T4402] EXT4-fs error (device loop2): mb_free_blocks:1948: group 0, inode 18: block 305:freeing already freed block (bit 19); block bitmap corrupt. [ 41.756316][ T4405] vlan3: entered promiscuous mode [ 41.764089][ T4408] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 41.780019][ T4408] ext4 filesystem being mounted at /74/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 41.791669][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.799963][ T4384] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.812883][ T4384] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.832772][ T4384] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.858098][ T4384] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.868892][ T4412] netlink: 20 bytes leftover after parsing attributes in process `syz.2.367'. [ 41.877902][ T4412] netlink: 204 bytes leftover after parsing attributes in process `syz.2.367'. [ 41.952603][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.952632][ T4420] loop1: detected capacity change from 0 to 512 [ 41.969087][ T4420] EXT4-fs: Ignoring removed nobh option [ 41.981270][ T4423] netlink: 3 bytes leftover after parsing attributes in process `syz.4.374'. [ 41.994867][ T4420] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #3: comm syz.1.370: corrupted inode contents [ 41.997725][ T4423] batadv0: entered promiscuous mode [ 42.011880][ T4423] batadv0: entered allmulticast mode [ 42.019450][ T4427] 9pnet: p9_errstr2errno: server reported unknown error [ 42.028010][ T4420] EXT4-fs error (device loop1): ext4_dirty_inode:6459: inode #3: comm syz.1.370: mark_inode_dirty error [ 42.046862][ T4420] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #3: comm syz.1.370: corrupted inode contents [ 42.059014][ T4420] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #3: comm syz.1.370: mark_inode_dirty error [ 42.077748][ T4420] EXT4-fs error (device loop1): ext4_acquire_dquot:6933: comm syz.1.370: Failed to acquire dquot type 0 [ 42.089700][ T4420] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #16: comm syz.1.370: corrupted inode contents [ 42.103827][ T4420] EXT4-fs error (device loop1): ext4_dirty_inode:6459: inode #16: comm syz.1.370: mark_inode_dirty error [ 42.115762][ T4420] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #16: comm syz.1.370: corrupted inode contents [ 42.130203][ T4420] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #16: comm syz.1.370: mark_inode_dirty error [ 42.148078][ T4420] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #16: comm syz.1.370: corrupted inode contents [ 42.173117][ T4420] EXT4-fs error (device loop1) in ext4_orphan_del:305: Corrupt filesystem [ 42.182424][ T4420] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #16: comm syz.1.370: corrupted inode contents [ 42.195006][ T4420] EXT4-fs error (device loop1): ext4_truncate:4597: inode #16: comm syz.1.370: mark_inode_dirty error [ 42.206658][ T4420] EXT4-fs error (device loop1) in ext4_process_orphan:347: Corrupt filesystem [ 42.217126][ T4420] EXT4-fs (loop1): 1 truncate cleaned up [ 42.223636][ T4420] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.236800][ T4420] ext4 filesystem being mounted at /72/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.269263][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.309684][ T4442] netlink: 'syz.1.377': attribute type 27 has an invalid length. [ 42.329752][ T4443] loop3: detected capacity change from 0 to 512 [ 42.345151][ T4443] EXT4-fs: Ignoring removed nomblk_io_submit option [ 42.354725][ T4443] EXT4-fs: Ignoring removed nomblk_io_submit option [ 42.361925][ T4443] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 42.385837][ T4443] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 42.412080][ T4442] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.419413][ T4442] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.442963][ T4443] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 42.475530][ T4443] EXT4-fs (loop3): 1 truncate cleaned up [ 42.497419][ T4443] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.555951][ T4442] wg2: left promiscuous mode [ 42.560627][ T4442] wg2: left allmulticast mode [ 42.578082][ T29] kauditd_printk_skb: 105 callbacks suppressed [ 42.578096][ T29] audit: type=1400 audit(1749843079.889:731): avc: denied { remount } for pid=4441 comm="syz.3.380" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 42.628743][ T4442] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 42.636474][ T4443] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 42.649285][ T4442] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 42.688207][ T4442] macsec0: left promiscuous mode [ 42.703905][ T4442] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.712388][ T4442] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.720788][ T4442] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.729373][ T4442] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.782216][ T4445] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.790227][ T4445] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.803114][ T4448] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 42.823220][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.860314][ T4453] netlink: 'syz.0.385': attribute type 29 has an invalid length. [ 42.882938][ T4456] netlink: 24 bytes leftover after parsing attributes in process `syz.3.383'. [ 42.892583][ T4453] netlink: 'syz.0.385': attribute type 29 has an invalid length. [ 42.921851][ T4453] netlink: 'syz.0.385': attribute type 29 has an invalid length. [ 42.961956][ T4453] netlink: 'syz.0.385': attribute type 29 has an invalid length. [ 43.046642][ T29] audit: type=1400 audit(1749843080.359:732): avc: denied { mounton } for pid=4463 comm="syz.1.389" path="/proc/175/ns" dev="proc" ino=8405 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 43.129346][ T29] audit: type=1326 audit(1749843080.359:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4463 comm="syz.1.389" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b20d0e929 code=0x7ffc0000 [ 43.152791][ T29] audit: type=1326 audit(1749843080.359:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4463 comm="syz.1.389" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b20d0e929 code=0x7ffc0000 [ 43.176243][ T29] audit: type=1326 audit(1749843080.369:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4463 comm="syz.1.389" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6b20d0e929 code=0x7ffc0000 [ 43.199590][ T29] audit: type=1326 audit(1749843080.369:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4463 comm="syz.1.389" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b20d0e929 code=0x7ffc0000 [ 43.222849][ T29] audit: type=1326 audit(1749843080.369:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4463 comm="syz.1.389" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b20d0e929 code=0x7ffc0000 [ 43.246108][ T29] audit: type=1326 audit(1749843080.369:738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4463 comm="syz.1.389" exe="/root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f6b20d0e929 code=0x7ffc0000 [ 43.269401][ T29] audit: type=1326 audit(1749843080.379:739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4465 comm="syz.1.389" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f6b20d411e5 code=0x7ffc0000 [ 43.292742][ T29] audit: type=1326 audit(1749843080.379:740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4463 comm="syz.1.389" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b20d0e929 code=0x7ffc0000 [ 43.466932][ T4481] netlink: 332 bytes leftover after parsing attributes in process `syz.2.396'. [ 43.472093][ T4485] team0: Port device dummy0 added [ 43.487444][ T4481] netlink: 108 bytes leftover after parsing attributes in process `syz.2.396'. [ 43.499422][ T4481] netlink: 32 bytes leftover after parsing attributes in process `syz.2.396'. [ 43.517907][ T4485] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 43.561445][ T4485] team0: Failed to send options change via netlink (err -105) [ 43.575270][ T4485] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 43.597134][ T4485] team0: Port device dummy0 removed [ 43.614346][ T4485] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 43.647704][ T4487] sit0: entered allmulticast mode [ 43.682207][ T4487] sit0: entered promiscuous mode [ 44.805000][ T4533] 9pnet: p9_errstr2errno: server reported unknown error [ 44.946564][ T4540] loop4: detected capacity change from 0 to 1024 [ 44.975223][ T4540] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.990528][ T4540] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:4113: comm syz.4.420: Allocating blocks 385-513 which overlap fs metadata [ 45.024504][ T4540] EXT4-fs (loop4): pa ffff888106a235b0: logic 16, phys. 129, len 24 [ 45.033133][ T4540] EXT4-fs error (device loop4): ext4_mb_release_inode_pa:5364: group 0, free 0, pa_free 8 [ 45.071107][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.096247][ T4545] bridge_slave_0: left allmulticast mode [ 45.101986][ T4545] bridge_slave_0: left promiscuous mode [ 45.107733][ T4545] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.116220][ T4545] bridge_slave_1: left allmulticast mode [ 45.122576][ T4545] bridge_slave_1: left promiscuous mode [ 45.128410][ T4545] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.137298][ T4545] bond0: (slave bond_slave_0): Releasing backup interface [ 45.145151][ T4545] bond0: (slave bond_slave_1): Releasing backup interface [ 45.153387][ T4545] team0: Port device team_slave_0 removed [ 45.159567][ T4545] team0: Port device team_slave_1 removed [ 45.165549][ T4545] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 45.173255][ T4545] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 45.181246][ T4545] team0: Port device geneve1 removed [ 45.232209][ T4551] ALSA: seq fatal error: cannot create timer (-22) [ 45.299837][ T4563] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 45.490587][ T4572] loop2: detected capacity change from 0 to 2048 [ 45.552252][ T4572] loop2: p1 < > p4 [ 45.556668][ T4572] loop2: p4 size 8388608 extends beyond EOD, truncated [ 45.952243][ T4589] loop4: detected capacity change from 0 to 512 [ 45.959707][ T4589] EXT4-fs error (device loop4): ext4_iget_extra_inode:5035: inode #15: comm syz.4.439: corrupted in-inode xattr: invalid ea_ino [ 45.973361][ T4589] EXT4-fs error (device loop4): ext4_orphan_get:1398: comm syz.4.439: couldn't read orphan inode 15 (err -117) [ 45.985753][ T4589] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 46.023710][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.137535][ T4606] netlink: 12 bytes leftover after parsing attributes in process `syz.1.447'. [ 46.481455][ T4625] netlink: 24 bytes leftover after parsing attributes in process `syz.0.454'. [ 46.621913][ T4630] netlink: 404 bytes leftover after parsing attributes in process `syz.0.456'. [ 46.649003][ T4632] bridge: RTM_NEWNEIGH with invalid ether address [ 47.362791][ T4666] netlink: 3 bytes leftover after parsing attributes in process `syz.1.472'. [ 47.384938][ T4666] batadv1: entered promiscuous mode [ 47.390181][ T4666] batadv1: entered allmulticast mode [ 47.683028][ T4683] loop4: detected capacity change from 0 to 512 [ 47.716254][ T4683] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.741926][ T4683] ext4 filesystem being mounted at /87/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 47.833884][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.873071][ T4692] loop2: detected capacity change from 0 to 512 [ 47.915626][ T4692] EXT4-fs (loop2): 1 orphan inode deleted [ 47.932025][ T59] __quota_error: 62 callbacks suppressed [ 47.932041][ T59] Quota error (device loop2): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 47.938082][ T4692] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.947488][ T59] EXT4-fs error (device loop2): ext4_release_dquot:6969: comm kworker/u8:4: Failed to release dquot type 1 [ 47.994283][ T4692] ext4 filesystem being mounted at /89/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 48.051526][ T29] audit: type=1400 audit(1749843085.359:803): avc: denied { create } for pid=4697 comm="syz.1.484" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 48.092280][ T29] audit: type=1400 audit(1749843085.389:804): avc: denied { ioctl } for pid=4697 comm="syz.1.484" path="socket:[9115]" dev="sockfs" ino=9115 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 48.219024][ T29] audit: type=1400 audit(1749843085.529:805): avc: denied { name_bind } for pid=4703 comm="syz.0.488" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 48.282263][ T29] audit: type=1326 audit(1749843085.589:806): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4708 comm="syz.4.490" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 48.305669][ T29] audit: type=1326 audit(1749843085.589:807): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4708 comm="syz.4.490" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 48.329281][ T29] audit: type=1326 audit(1749843085.599:808): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4708 comm="syz.4.490" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 48.352622][ T29] audit: type=1326 audit(1749843085.599:809): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4708 comm="syz.4.490" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 48.375926][ T29] audit: type=1326 audit(1749843085.599:810): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4708 comm="syz.4.490" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 48.399364][ T29] audit: type=1326 audit(1749843085.599:811): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4708 comm="syz.4.490" exe="/root/syz-executor" sig=0 arch=c000003e syscall=201 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 48.574672][ T4724] netlink: 24 bytes leftover after parsing attributes in process `syz.1.496'. [ 48.626215][ T4728] ip6gre1: entered allmulticast mode [ 48.693543][ T4735] netlink: 8 bytes leftover after parsing attributes in process `syz.0.502'. [ 48.768565][ T4738] netlink: 332 bytes leftover after parsing attributes in process `syz.4.503'. [ 48.792965][ T4738] validate_nla: 3 callbacks suppressed [ 48.793005][ T4738] netlink: 'syz.4.503': attribute type 9 has an invalid length. [ 48.808675][ T4738] netlink: 108 bytes leftover after parsing attributes in process `syz.4.503'. [ 48.819839][ T4738] netlink: 32 bytes leftover after parsing attributes in process `syz.4.503'. [ 48.913243][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.087875][ T4750] loop1: detected capacity change from 0 to 2048 [ 49.131409][ T4750] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 49.153553][ T4750] Invalid ELF header magic: != ELF [ 49.208891][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.354531][ T4771] netlink: 'syz.2.514': attribute type 10 has an invalid length. [ 49.392445][ T4771] team0: Port device dummy0 added [ 49.407154][ T4776] netlink: 'syz.2.514': attribute type 10 has an invalid length. [ 49.425633][ T4776] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 49.457204][ T4776] team0: Failed to send options change via netlink (err -105) [ 49.481174][ T4776] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 49.500243][ T4776] team0: Port device dummy0 removed [ 49.515181][ T4776] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 49.602787][ T4783] loop1: detected capacity change from 0 to 512 [ 49.638082][ T4783] EXT4-fs (loop1): 1 orphan inode deleted [ 49.651922][ T2124] EXT4-fs error (device loop1): ext4_release_dquot:6969: comm kworker/u8:6: Failed to release dquot type 1 [ 49.673942][ T4783] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.705835][ T4783] ext4 filesystem being mounted at /102/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 49.753841][ T4783] netlink: 332 bytes leftover after parsing attributes in process `syz.1.519'. [ 49.801944][ T4783] netlink: 'syz.1.519': attribute type 9 has an invalid length. [ 49.809660][ T4783] netlink: 108 bytes leftover after parsing attributes in process `syz.1.519'. [ 49.818658][ T4783] netlink: 32 bytes leftover after parsing attributes in process `syz.1.519'. [ 49.865067][ T4792] loop3: detected capacity change from 0 to 512 [ 49.893536][ T4792] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 49.943597][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 49.972829][ T4794] netlink: 'syz.2.523': attribute type 10 has an invalid length. [ 49.980679][ T4794] netlink: 40 bytes leftover after parsing attributes in process `syz.2.523'. [ 50.015349][ T4792] EXT4-fs (loop3): 1 truncate cleaned up [ 50.035813][ T4792] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 50.059032][ T4798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.071854][ T4794] dummy0: entered promiscuous mode [ 50.095245][ T4794] bond0: (slave dummy0): Releasing backup interface [ 50.111846][ T4798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.124148][ T4792] EXT4-fs error (device loop3): ext4_read_inline_dir:1502: inode #12: block 7: comm syz.3.522: path /92/bus/file0: bad entry in directory: rec_len is smaller than minimal - offset=40, inode=2085390, rec_len=0, size=80 fake=0 [ 50.150532][ T4794] bridge0: port 3(dummy0) entered blocking state [ 50.156986][ T4794] bridge0: port 3(dummy0) entered disabled state [ 50.184838][ T4794] dummy0: entered allmulticast mode [ 50.212091][ T3313] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.259300][ T4802] loop6: detected capacity change from 0 to 7 [ 50.359766][ T4807] loop2: detected capacity change from 0 to 1024 [ 50.359910][ T4809] netlink: 'syz.4.529': attribute type 1 has an invalid length. [ 50.373962][ T4809] netlink: 'syz.4.529': attribute type 2 has an invalid length. [ 50.390337][ T4809] netlink: 4 bytes leftover after parsing attributes in process `syz.4.529'. [ 50.402097][ T4807] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 50.422738][ T4807] ext4 filesystem being mounted at /100/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 50.433558][ T4815] ip6gre1: entered allmulticast mode [ 50.452676][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.502471][ T4821] netlink: 'syz.0.534': attribute type 9 has an invalid length. [ 50.540230][ T4825] loop2: detected capacity change from 0 to 128 [ 50.548080][ T4825] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x614101ff (sector = 1) [ 50.614295][ T4825] syz.2.536: attempt to access beyond end of device [ 50.614295][ T4825] loop2: rw=0, sector=97, nr_sectors = 944 limit=128 [ 50.738045][ T12] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x614101ff (sector = 1) [ 50.859969][ T4842] netlink: 'syz.1.544': attribute type 10 has an invalid length. [ 50.892815][ T4842] team0: Port device dummy0 added [ 50.905512][ T4842] netlink: 'syz.1.544': attribute type 10 has an invalid length. [ 50.922244][ T4842] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 50.943362][ T4842] team0: Failed to send options change via netlink (err -105) [ 50.950912][ T4842] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 50.971649][ T4842] team0: Port device dummy0 removed [ 50.979161][ T4842] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 51.078879][ T4847] loop1: detected capacity change from 0 to 1024 [ 51.109744][ T4847] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 51.111248][ T4850] vhci_hcd: default hub control req: 2317 v0040 i0002 l0 [ 51.132287][ T4847] ext4 filesystem being mounted at /107/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 51.180515][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.430384][ T4866] loop1: detected capacity change from 0 to 1024 [ 51.454592][ T4866] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 51.470903][ T4866] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4113: comm syz.1.553: Allocating blocks 385-513 which overlap fs metadata [ 51.499875][ T4866] EXT4-fs (loop1): pa ffff888106a23620: logic 16, phys. 129, len 24 [ 51.508726][ T4866] EXT4-fs error (device loop1): ext4_mb_release_inode_pa:5364: group 0, free 0, pa_free 8 [ 51.544128][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.607678][ T4873] loop1: detected capacity change from 0 to 512 [ 51.656097][ T4873] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 51.699016][ T4873] ext4 filesystem being mounted at /112/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 51.831118][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.043756][ T4882] team0: Port device dummy0 added [ 52.049798][ T4889] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 52.062301][ T4889] team0: Failed to send options change via netlink (err -105) [ 52.073903][ T4889] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 52.092806][ T4889] team0: Port device dummy0 removed [ 52.106183][ T4889] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 52.199369][ T4905] loop2: detected capacity change from 0 to 1024 [ 52.227452][ T4909] loop4: detected capacity change from 0 to 1024 [ 52.239874][ T4905] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.280838][ T4905] EXT4-fs error (device loop2): ext4_mb_mark_diskspace_used:4113: comm syz.2.567: Allocating blocks 385-513 which overlap fs metadata [ 52.308349][ T4909] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.313067][ T4905] EXT4-fs (loop2): pa ffff888106a23620: logic 16, phys. 129, len 24 [ 52.323947][ T4909] ext4 filesystem being mounted at /104/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 52.328467][ T4905] EXT4-fs error (device loop2): ext4_mb_release_inode_pa:5364: group 0, free 0, pa_free 8 [ 52.416759][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.476655][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.514376][ T4916] pim6reg1: entered promiscuous mode [ 52.519900][ T4916] pim6reg1: entered allmulticast mode [ 52.529355][ T4920] gretap0: refused to change device tx_queue_len [ 52.536028][ T4920] net_ratelimit: 8 callbacks suppressed [ 52.536098][ T4920] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 52.602166][ T4924] loop2: detected capacity change from 0 to 2048 [ 52.639849][ T4924] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.652192][ T4928] loop1: detected capacity change from 0 to 512 [ 52.669957][ T4928] EXT4-fs (loop1): mounted filesystem 00800000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 52.720837][ T3306] EXT4-fs (loop1): unmounting filesystem 00800000-0000-0000-0000-000000000000. [ 52.732149][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.757924][ T4936] loop4: detected capacity change from 0 to 512 [ 52.775672][ T4936] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 52.790205][ T4940] loop1: detected capacity change from 0 to 2048 [ 52.798500][ T4936] EXT4-fs (loop4): 1 truncate cleaned up [ 52.809019][ T4936] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.854137][ T4936] EXT4-fs error (device loop4): ext4_read_inline_dir:1502: inode #12: block 7: comm syz.4.577: path /107/bus/file0: bad entry in directory: rec_len is smaller than minimal - offset=40, inode=2085390, rec_len=0, size=80 fake=0 [ 52.892561][ T4946] dummy0: entered promiscuous mode [ 52.900209][ T4946] bond0: (slave dummy0): Releasing backup interface [ 52.924890][ T4946] bridge0: port 1(dummy0) entered blocking state [ 52.931401][ T4946] bridge0: port 1(dummy0) entered disabled state [ 52.948943][ T4946] dummy0: entered allmulticast mode [ 52.959277][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.003661][ T4955] loop1: detected capacity change from 0 to 128 [ 53.021200][ T4955] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x614101ff (sector = 1) [ 53.133567][ T4955] syz.1.587: attempt to access beyond end of device [ 53.133567][ T4955] loop1: rw=0, sector=97, nr_sectors = 944 limit=128 [ 53.290596][ T4965] loop4: detected capacity change from 0 to 2048 [ 53.300347][ T2124] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x614101ff (sector = 1) [ 53.345938][ T4971] 8021q: adding VLAN 0 to HW filter on device bond1 [ 53.361996][ T4965] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 53.397898][ T4971] bond1: (slave gretap1): making interface the new active one [ 53.406456][ T4971] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 53.467789][ T4971] vlan2: entered allmulticast mode [ 53.473028][ T4971] bond1: entered allmulticast mode [ 53.478180][ T4971] gretap1: entered allmulticast mode [ 53.494690][ T3305] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.516817][ T4971] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 53.671820][ T29] kauditd_printk_skb: 50 callbacks suppressed [ 53.671838][ T29] audit: type=1400 audit(1749843090.979:861): avc: denied { execute_no_trans } for pid=4991 comm="syz.0.612" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=46 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 53.809692][ T5003] validate_nla: 5 callbacks suppressed [ 53.809712][ T5003] netlink: 'syz.1.607': attribute type 6 has an invalid length. [ 53.823866][ T5003] __nla_validate_parse: 6 callbacks suppressed [ 53.823882][ T5003] netlink: 4 bytes leftover after parsing attributes in process `syz.1.607'. [ 53.879863][ T5010] netlink: 4 bytes leftover after parsing attributes in process `syz.1.607'. [ 53.953157][ T5011] loop2: detected capacity change from 0 to 1024 [ 53.960764][ T5011] EXT4-fs: Ignoring removed nobh option [ 53.966407][ T5011] EXT4-fs: Ignoring removed nobh option [ 54.005703][ T5011] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (62631!=20869) [ 54.016179][ T5011] EXT4-fs error (device loop2): ext4_get_journal_inode:5796: comm syz.2.606: inode #4294967295: comm syz.2.606: iget: illegal inode # [ 54.069406][ T5011] EXT4-fs (loop2): no journal found [ 54.074712][ T5011] EXT4-fs (loop2): can't get journal size [ 54.108483][ T5011] EXT4-fs (loop2): failed to initialize system zone (-22) [ 54.126450][ T5011] EXT4-fs (loop2): mount failed [ 54.181488][ T29] audit: type=1326 audit(1749843091.489:862): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5015 comm="syz.4.610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 54.204907][ T29] audit: type=1326 audit(1749843091.489:863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5015 comm="syz.4.610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 54.282415][ T29] audit: type=1326 audit(1749843091.549:864): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5015 comm="syz.4.610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 54.305982][ T29] audit: type=1326 audit(1749843091.559:865): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5015 comm="syz.4.610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 54.329348][ T29] audit: type=1326 audit(1749843091.559:866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5015 comm="syz.4.610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 54.352636][ T29] audit: type=1326 audit(1749843091.559:867): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5015 comm="syz.4.610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 54.376053][ T29] audit: type=1326 audit(1749843091.559:868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5015 comm="syz.4.610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 54.399301][ T29] audit: type=1326 audit(1749843091.559:869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5015 comm="syz.4.610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 54.422541][ T29] audit: type=1326 audit(1749843091.559:870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5015 comm="syz.4.610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7feaa677e929 code=0x7ffc0000 [ 55.023114][ T5047] netlink: 8 bytes leftover after parsing attributes in process `syz.1.624'. [ 55.667190][ T5074] syz_tun: entered allmulticast mode [ 55.692409][ T5072] syz_tun: left allmulticast mode [ 55.697976][ T5076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.717062][ T5076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.753270][ T5079] 9pnet: p9_errstr2errno: server reported unknown error 1844674407 [ 56.026383][ T5088] loop1: detected capacity change from 0 to 1024 [ 56.036566][ T5090] netlink: 'syz.2.639': attribute type 6 has an invalid length. [ 56.052680][ T5088] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.107206][ T5090] netlink: 4 bytes leftover after parsing attributes in process `syz.2.639'. [ 56.155902][ T5090] netlink: 4 bytes leftover after parsing attributes in process `syz.2.639'. [ 56.311040][ T5100] netlink: 'syz.3.643': attribute type 1 has an invalid length. [ 56.337567][ T5102] netlink: 8 bytes leftover after parsing attributes in process `syz.2.642'. [ 56.374194][ T5100] 8021q: adding VLAN 0 to HW filter on device bond1 [ 56.395453][ T5104] bond1: (slave gretap1): making interface the new active one [ 56.445292][ T5104] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 56.469038][ T5100] vlan2: entered allmulticast mode [ 56.474284][ T5100] bond1: entered allmulticast mode [ 56.479466][ T5100] gretap1: entered allmulticast mode [ 56.487739][ T5100] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 57.091578][ T3306] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.965681][ T5168] netlink: 8 bytes leftover after parsing attributes in process `syz.4.673'. [ 58.008753][ T5173] loop2: detected capacity change from 0 to 512 [ 58.086432][ T5173] EXT4-fs (loop2): 1 orphan inode deleted [ 58.103079][ T12] EXT4-fs error (device loop2): ext4_release_dquot:6969: comm kworker/u8:0: Failed to release dquot type 1 [ 58.132690][ T5173] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 58.191944][ T5173] ext4 filesystem being mounted at /129/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 58.379934][ T5189] loop1: detected capacity change from 0 to 128 [ 58.404123][ T5189] netlink: 'syz.1.680': attribute type 6 has an invalid length. [ 59.022341][ T5226] netlink: 24 bytes leftover after parsing attributes in process `syz.4.686'. [ 59.036963][ T29] kauditd_printk_skb: 26 callbacks suppressed [ 59.036980][ T29] audit: type=1400 audit(1749843096.349:896): avc: denied { create } for pid=5228 comm="syz.0.687" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 59.072843][ T29] audit: type=1400 audit(1749843096.379:897): avc: denied { write } for pid=5228 comm="syz.0.687" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 59.294626][ T29] audit: type=1326 audit(1749843096.609:898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5264 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 59.328339][ T5262] syzkaller0: entered promiscuous mode [ 59.333937][ T5262] syzkaller0: entered allmulticast mode [ 59.355268][ T29] audit: type=1326 audit(1749843096.609:899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5264 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 59.378663][ T29] audit: type=1326 audit(1749843096.609:900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5264 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 59.402120][ T29] audit: type=1326 audit(1749843096.609:901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5264 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 59.425436][ T29] audit: type=1326 audit(1749843096.609:902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5264 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 59.448790][ T29] audit: type=1326 audit(1749843096.609:903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5264 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 59.472174][ T29] audit: type=1326 audit(1749843096.609:904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5264 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=97 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 59.495641][ T29] audit: type=1326 audit(1749843096.609:905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5264 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e630ee929 code=0x7ffc0000 [ 59.930811][ T5309] loop1: detected capacity change from 0 to 1024 [ 59.958471][ T5306] ip6gre1: left allmulticast mode [ 59.976828][ T5309] EXT4-fs: Ignoring removed nobh option [ 59.982564][ T5309] EXT4-fs: Ignoring removed nobh option [ 60.036980][ T5309] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (62631!=20869) [ 60.085546][ T5309] EXT4-fs error (device loop1): ext4_get_journal_inode:5796: comm syz.1.708: inode #4294967295: comm syz.1.708: iget: illegal inode # [ 60.142169][ T5309] EXT4-fs (loop1): no journal found [ 60.147438][ T5309] EXT4-fs (loop1): can't get journal size [ 60.202130][ T5319] netlink: 32 bytes leftover after parsing attributes in process `syz.0.720'. [ 60.216876][ T5309] EXT4-fs (loop1): failed to initialize system zone (-22) [ 60.272613][ T5309] EXT4-fs (loop1): mount failed [ 60.470927][ T5339] syzkaller0: entered promiscuous mode [ 60.476669][ T5339] syzkaller0: entered allmulticast mode [ 60.586707][ T5346] loop3: detected capacity change from 0 to 512 [ 60.614318][ T5346] ext4 filesystem being mounted at /124/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 60.765796][ T5358] sit0: left promiscuous mode [ 60.770554][ T5358] sit0: left allmulticast mode [ 60.784721][ T5359] loop3: detected capacity change from 0 to 1024 [ 60.791526][ T5359] EXT4-fs: Ignoring removed oldalloc option [ 60.797645][ T5359] EXT4-fs: Ignoring removed orlov option [ 60.802760][ T5358] ip6gre1: left allmulticast mode [ 60.805241][ T5359] EXT4-fs (loop3): stripe (1570) is not aligned with cluster size (16), stripe is disabled [ 60.865942][ T5359] EXT4-fs error (device loop3): mb_free_blocks:1948: group 0, inode 18: block 433:freeing already freed block (bit 27); block bitmap corrupt. [ 60.900007][ T5359] EXT4-fs (loop3): Remounting filesystem read-only [ 60.985399][ T5292] syz.1.708 (5292) used greatest stack depth: 6064 bytes left [ 61.051619][ T5373] loop1: detected capacity change from 0 to 164 [ 61.059598][ T5373] iso9660: Unexpected value for 'nojoliet' [ 61.200237][ T5391] loop2: detected capacity change from 0 to 256 [ 61.262143][ T5394] loop4: detected capacity change from 0 to 128 [ 61.278091][ T5394] syz.4.748: attempt to access beyond end of device [ 61.278091][ T5394] loop4: rw=2049, sector=145, nr_sectors = 8 limit=128 [ 61.293623][ T5394] syz.4.748: attempt to access beyond end of device [ 61.293623][ T5394] loop4: rw=2049, sector=161, nr_sectors = 8 limit=128 [ 61.309451][ T5394] syz.4.748: attempt to access beyond end of device [ 61.309451][ T5394] loop4: rw=2049, sector=177, nr_sectors = 24 limit=128 [ 61.324640][ T5394] syz.4.748: attempt to access beyond end of device [ 61.324640][ T5394] loop4: rw=2049, sector=209, nr_sectors = 8 limit=128 [ 61.338299][ T5394] syz.4.748: attempt to access beyond end of device [ 61.338299][ T5394] loop4: rw=2049, sector=225, nr_sectors = 8 limit=128 [ 61.352851][ T5394] syz.4.748: attempt to access beyond end of device [ 61.352851][ T5394] loop4: rw=2049, sector=241, nr_sectors = 8 limit=128 [ 61.383297][ T5399] syz.4.748: attempt to access beyond end of device [ 61.383297][ T5399] loop4: rw=2049, sector=305, nr_sectors = 80 limit=128 [ 61.397790][ T5399] syz.4.748: attempt to access beyond end of device [ 61.397790][ T5399] loop4: rw=2049, sector=393, nr_sectors = 8 limit=128 [ 61.408493][ T5394] syz.4.748: attempt to access beyond end of device [ 61.408493][ T5394] loop4: rw=2049, sector=257, nr_sectors = 8 limit=128 [ 61.411810][ T5399] syz.4.748: attempt to access beyond end of device [ 61.411810][ T5399] loop4: rw=2049, sector=409, nr_sectors = 8 limit=128 [ 61.517508][ T50] Buffer I/O error on dev loop4, logical block 305, lost async page write [ 62.167624][ T5450] netlink: 'syz.2.771': attribute type 10 has an invalid length. [ 62.186553][ T5450] veth0_vlan: entered allmulticast mode [ 62.202558][ T5450] veth0_vlan: left promiscuous mode [ 62.209434][ T5450] veth0_vlan: entered promiscuous mode [ 62.224334][ T5450] team0: Device veth0_vlan failed to register rx_handler [ 62.258062][ T5452] ip6gre2: entered allmulticast mode [ 62.367950][ T5459] loop3: detected capacity change from 0 to 1024 [ 62.376474][ T5459] EXT4-fs: Ignoring removed bh option [ 62.381974][ T5459] EXT4-fs: Ignoring removed nomblk_io_submit option [ 62.610721][ T5482] SELinux: syz.4.785 (5482) wrote to /sys/fs/selinux/user! This will not be supported in the future; please update your userspace. [ 63.177433][ T5475] ================================================================== [ 63.185578][ T5475] BUG: KCSAN: data-race in file_write_and_wait_range / xas_set_mark [ 63.193637][ T5475] [ 63.195984][ T5475] write to 0xffff88811a0d53ec of 4 bytes by task 5459 on cpu 0: [ 63.203644][ T5475] xas_set_mark+0x12b/0x140 [ 63.208177][ T5475] __folio_start_writeback+0x1dd/0x440 [ 63.213676][ T5475] ext4_bio_write_folio+0x5ad/0x9f0 [ 63.218985][ T5475] mpage_submit_folio+0xe4/0x170 [ 63.223964][ T5475] mpage_process_page_bufs+0x39b/0x4a0 [ 63.229452][ T5475] mpage_prepare_extent_to_map+0x741/0xaa0 [ 63.235288][ T5475] ext4_do_writepages+0x6ea/0x21c0 [ 63.240426][ T5475] ext4_writepages+0x176/0x300 [ 63.245229][ T5475] do_writepages+0x1c3/0x310 [ 63.249851][ T5475] file_write_and_wait_range+0x156/0x2c0 [ 63.255522][ T5475] generic_buffers_fsync_noflush+0x45/0x120 [ 63.261458][ T5475] ext4_sync_file+0x1ab/0x690 [ 63.266172][ T5475] vfs_fsync_range+0x10d/0x130 [ 63.270960][ T5475] ext4_buffered_write_iter+0x34f/0x3c0 [ 63.276534][ T5475] ext4_file_write_iter+0x383/0xf00 [ 63.281765][ T5475] iter_file_splice_write+0x5f2/0x970 [ 63.287186][ T5475] direct_splice_actor+0x153/0x2a0 [ 63.292331][ T5475] splice_direct_to_actor+0x30f/0x680 [ 63.297753][ T5475] do_splice_direct+0xda/0x150 [ 63.302563][ T5475] do_sendfile+0x380/0x650 [ 63.307025][ T5475] __x64_sys_sendfile64+0x105/0x150 [ 63.312249][ T5475] x64_sys_call+0xb39/0x2fb0 [ 63.316860][ T5475] do_syscall_64+0xd2/0x200 [ 63.321393][ T5475] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.327314][ T5475] [ 63.329661][ T5475] read to 0xffff88811a0d53ec of 4 bytes by task 5475 on cpu 1: [ 63.337225][ T5475] file_write_and_wait_range+0x10e/0x2c0 [ 63.342899][ T5475] generic_buffers_fsync_noflush+0x45/0x120 [ 63.348833][ T5475] ext4_sync_file+0x1ab/0x690 [ 63.353549][ T5475] vfs_fsync_range+0x10d/0x130 [ 63.358349][ T5475] ext4_buffered_write_iter+0x34f/0x3c0 [ 63.363931][ T5475] ext4_file_write_iter+0x383/0xf00 [ 63.369167][ T5475] iter_file_splice_write+0x5f2/0x970 [ 63.374589][ T5475] direct_splice_actor+0x153/0x2a0 [ 63.379746][ T5475] splice_direct_to_actor+0x30f/0x680 [ 63.385142][ T5475] do_splice_direct+0xda/0x150 [ 63.390015][ T5475] do_sendfile+0x380/0x650 [ 63.394447][ T5475] __x64_sys_sendfile64+0x105/0x150 [ 63.399656][ T5475] x64_sys_call+0xb39/0x2fb0 [ 63.404270][ T5475] do_syscall_64+0xd2/0x200 [ 63.408783][ T5475] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.414688][ T5475] [ 63.417015][ T5475] value changed: 0x0a000021 -> 0x04000021 [ 63.423601][ T5475] [ 63.425926][ T5475] Reported by Kernel Concurrency Sanitizer on: [ 63.432088][ T5475] CPU: 1 UID: 0 PID: 5475 Comm: syz.3.776 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(voluntary) [ 63.444422][ T5475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 63.454572][ T5475] ==================================================================