last executing test programs: 8.213701407s ago: executing program 1 (id=9): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000080)=0x2cb6) write$cgroup_devices(r0, &(0x7f00000000c0)=ANY=[@ANYRES8=r0, @ANYBLOB='#'], 0xffdd) 8.06799029s ago: executing program 1 (id=13): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000180)={0xcf43, 0x4cb, 0x2, 0x9dff, 0xe, "3d52e3ff00"}) write$binfmt_aout(r1, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x40, 0x3, 0x100005, 0x19, "b0bf2ebb48c8040018bfef400000000500"}) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r1, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000000)=0xff) dup3(r1, r0, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000080)=0x1a) 7.224298453s ago: executing program 1 (id=26): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0) read(r0, 0x0, 0x0) 7.164423024s ago: executing program 1 (id=28): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210008, &(0x7f0000000000)={[{@nodelalloc}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@bh}, {@nodiscard}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x2e508d, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f00000001c0), &(0x7f0000000040)='./bus\x00', 0x322020, &(0x7f0000000280)=ANY=[], 0x1, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x48042, 0x18c) truncate(&(0x7f0000000940)='./file1\x00', 0x2fffffd) 5.995560213s ago: executing program 1 (id=35): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0x0, &(0x7f0000000a00), 0x5, 0x785, &(0x7f0000006580)="$eJzs3M9rXNUeAPDvvc00/ZH3Jg/e4r1NFVpooXSSNJt2ZdyIm0Kh4LaGZBJCbjIlM6lJLDR1Jwi12agIonuXboVS/wB3UlBwL4jWuKhuRmYymbbpzHTSZDo2fj5wM+ecOed+z/feycm9kDsB/GO9WvuRRAxFxOWIyDfa04g4XC8diVjf6rf54MZUbUuiWr3yS1IbFpvVfHNfSeP1eNSHxP8i4l4u4ux7T8ctr67NT2ZZcalRH6ksXBspr66dm1uYnC3OFhfHxi+OXhgfvzA6vm+5nnrr4tE7376xsfHdV5XbJwbOJTFRzzsaue1boMdsHZNcTOxoX+xFsD5Kuugz8ALmAQBAZ7Xr/EONa7Nc5ONQp6s0F3AAAADwUqoOVrv1R9c9AQAAgL+ZJPo9AwAAAKC3tv8PYPvZ3l49B9vOz69HxHCr+AP1Z4gjjkQuIo5tJk88fpBsDYM9Wb8VEXcnWnz+unmiubPRR8Wj+7NH9tvd2voz0Wr9SZvrT7RYfwa2vzthj9qvf4/iH2qz/l3uMsbXn/0/1zb+rfLK+ydaxU+a8ZM28d/uMv7tjQ/utHuv+kXE6ZZ/f5InYnX4foiRmbms1a9Wc7r3/jxzv33+Eceeip8k9ahJ5/yvdZn/u5u/za93iH/mZOfzvxV/8Ilxtc/Eh415pBFxp/Faq2/siHFy4ftvno6crG/Hn25z/Fuf/zeb+X/eZf4/fjm40mVXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqEsjYiiStNAsp2mhEHE8Iv4bx9KsVK6cnSktL07X3osYjlw6M5cVRyMiv1VPavWxevlR/fyO+nhE/OeHo1tB57JiYaqUTfc7eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJqOR8RQJGkhItKI+D2fpoVCv2cFAAAA7Lvhfk8AAAAA6Dn3/wAAAHDwPe/9f7LP8wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOtMuXLtW26uaDG1O1+vT11eX50vVz08XyfGFheaowVVq6VpgtlWazYmGqtPCs/aURMXYxlldGKuuNpoXS8mLl6tzC5GzxajHX84wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4HkP1LUkLEZHWy2laKET8KyKGI5fMzGXF0Yj4d0Tcz+cGa/Wxfk8aAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAfVdeXZufzLLi0stdqB6sdLouRBKx9/1E9GaGnzTOSqc+yXqvou+ikDYmupf9ROxm1M1nHJZeFB7uovMrfVqPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/Lq2vxklhWXyv2eCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP2V/pRERG07nT81tPPdw8nDfP01It759MpHK5OVytJYrf3XZnvl40b7+ccG3nyROQAAAMCB99puOm/fp2/fxwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHSrvLo2P5llxaUeFuJWv7MEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACex18BAAD//7OittA=") chdir(&(0x7f0000000040)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x100, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c081}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000200)=@filter={'filter\x00', 0xc, 0x4, 0x2b8, 0xffffffff, 0x220, 0x130, 0x0, 0x98, 0xffffffff, 0x220, 0x220, 0x220, 0x98, 0x4, 0x0, {[{{@ip={@local, @loopback, 0xff, 0xffffff00, 'dummy0\x00', 'veth1_macvtap\x00', {}, {}, 0x8, 0x2, 0x46}, 0x0, 0x70, 0x98}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@icmp={{0x28}, {0x11}}, @common=@addrtype={{0x20}, {0x150, 0x22, 0x0, 0x1}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x318) 4.3515912s ago: executing program 1 (id=54): socket$nl_route(0x10, 0x3, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) wait4(0x0, 0x0, 0x20000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r4, 0x1, 0x70bd2e, 0x0, {{}, {}, {0x14, 0x19, {0x80, 0x1, 0x4, 0x2}}}}, 0x30}}, 0x8000) 4.316564881s ago: executing program 32 (id=54): socket$nl_route(0x10, 0x3, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) wait4(0x0, 0x0, 0x20000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r4, 0x1, 0x70bd2e, 0x0, {{}, {}, {0x14, 0x19, {0x80, 0x1, 0x4, 0x2}}}}, 0x30}}, 0x8000) 1.85832169s ago: executing program 5 (id=98): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001700)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab000e271f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1ff032aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f757036303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e0800000092e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9be7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa5200002fe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb0972d39e4b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e501ddddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981179186e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b605908000000f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c332c34812382e57c0e0d83f3f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217b6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2a434b9048ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b4783d66661a92f174f2b88cd544b2a8e1b05ea7cf51578169fff7765f9978883b4b5983b42a35a05dabfc325ec2a2ec2f9b0882fdcf5d6f72272d2ff0d8eea60f5494ba42b4d40f144f0ab680a6f40f9094d3afb58a1efd6109894b8605c6b3b3f020c222f6446195b2274f634fbb737948a1f36ea729467e132385e9da614e4625175f4443b97a675934db90010e4b884200c3546c4d86d712c3939e11be3343f693846f509ad4c445ade5cd6d126d5694462ac5d3b527c3bd51c0a715a28d65fe94b255d02cdc1fab99b5b9c352f1b284115e4046285a824d22b6f0afbed8d6096a72fef72ebd6aae78b02fa1993e8fe2020ae93aae2bcfffa40b98549f1fb9fcefa74329909a207336d07f6f59da423ac5fa47852055d5ce6d2c56bdbbcdbf3458ba478c669f39d5272e65c90908ea2cb86d38f8ebf80a8cb85d8399b42403c94b8662af5cf1411526f177b4d476169a5d5a8c37d0d8893a77d0bd47b8a0bba60b3e26094209c889585f997ff556bcd2cc223f9c0c44de9d0fe1b5a8a815f652e79747d3e1f413fa0575d51f652d22883e143065c5ad74bdc864754ba3dad5a8fc8fc2c807d1a51dfb29884adee415c13f2ce14d307bd6165ec6ba68a766adfcbe444ea72d586bb47dd98a225467aab538a77667d19bae2e51727ba6d190e6d7"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x2e0, 0xe40, 0x2b0, &(0x7f0000000100)="b9ff0b078059268cb89e14f086dd2de0ffff206000000001000aac14140ce000000149e832f0", 0x0, 0x28e, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.663891824s ago: executing program 5 (id=100): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000000000)={@remote, @local}, 0x8) 1.663701554s ago: executing program 5 (id=101): syz_emit_ethernet(0x14, &(0x7f0000000200)={@broadcast, @local, @void, {@llc={0x4, {@llc={0xd4, 0xf0, '\r', "b0b825"}}}}}, 0x0) 1.663306354s ago: executing program 2 (id=102): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100001000000000000000000000000000a00000e0998cee3b28c17c0762054e3f6e4ad7b2800020073797a3100797a31000000004c000440"], 0x5c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a310000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a310000000094000000050a01020000000000000000010020000c00024000000000000000010900010073797a310000f8ff5b0004"], 0x130}}, 0x0) 1.617847824s ago: executing program 5 (id=104): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000040)=0xed43, 0x4) 1.617742444s ago: executing program 2 (id=105): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002ec0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e01f3440cee51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cad32b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337602d3e5a815232f5e16c1b30c3a6abc85018e5ff2c91018afc9ffc2cc788bee1b47683db012469398685211dfbbae3e2ed0a50e7393bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d300006aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7af22e30d46a9d26d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977fb536a9caab37d9ac4cfc1c7b400000000000007ffc826b956ba859ac8e3c177b91bd7d5e41ff83ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d000069a16203a967c1bbe09315c29877a308bcc87dc3addb08142bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8240000e3428d2129369ee1b85af9ffffff0d0df414b315f651c8412392191fa83ee830548f11be359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92000000000f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb74d4ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905de328c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a978ee56c83a3466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342e0eaf6f330e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea95ec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf81700cd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be3827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f969369de47422604e2fc5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293b6c833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b612272d40f522d8c98c879aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbe71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd46dbd61627a2e0a74b5e6aefb7eee403502734137ff47a57f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a125e3af1130d66a7b66837ae7e7123dde7404a067ad0a6a2d6bec9411b61cad4121be3c72ff3a04713042253d438e7becf8120de3895b8ce974958bde39cb8da3427a2e9e2de936431e67fed5ab5684db07de39083d8948cc4c8a2608100000000000000000000aecb8b0b7941088f971ce17427eec32a012295cc0cdd32955176b6ad5a4bb953e58ccfa9428f452cfb5a48a9fda26db3985c8be3c2f99827da074825b01c4a3a71fb59d5798100000000000000c76b05a45d2dd8c20d971e2f3e4369168f5cb83d6ff3a18733fec726034fbfa95624135bee374414b2c8c61f52357a520efd6a10aff244bc8a62ed367981fb4d5d77f7bc093958ff46527499957da4934cd4b370cf76f72dd05fa80cdfb68c836fd81be7a58532e041a87f9222f157610a4bcdc05b2a55308c8e7568b90f7a338557e816a16972aea79dff5becefa6f9c5ce6c58fb38da9e7532dc53cfdc2e789b76f7d32aca1bfea2aa62621b78dded30fc07171866bf3d552900000000a32dda61eeda1750e157c2d569b9d08f583c0ee28daec2e8bb85f3c8e91c4448096ee953def18dc73e55cb30f9cd069d8780b00eaba382f0c3ae391c30a5f1b0f36dd0c2193b791995d2890327a10d7abac76d1202f72e97f0105184d7aaaab8d3e29c9a8d263f076b55cf53c5bb9c0662a3d19a6722d7f83ae4331d3256f90af0857788b380ccc3b266c418e66d1d756d5df6423dd0cea67bc235d3776d22270fc19301ead09f156893e9"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0xfd6d}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe2c, 0x60000000, &(0x7f0000000100)="b9ff03316844268cb89e14f0080047e0ffff00124000632f77fbac14fe16e000030a07080403fe80000020006558845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0x24, 0x60000000}, 0x2c) 1.617343224s ago: executing program 3 (id=106): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x90, 0x0, &(0x7f0000002100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x58, 0x0, &(0x7f0000002040)={@flat=@binder={0x73622a85, 0x100, 0x2}, @fd, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x3b}}, 0x0}}], 0x0, 0x0, 0x0}) 1.617291935s ago: executing program 2 (id=107): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000a00)={0x14, 0x1, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4010) 1.602356704s ago: executing program 2 (id=108): setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@filter={'filter\x00', 0xc, 0x4, 0x2b8, 0xffffffff, 0x220, 0x130, 0x0, 0x98, 0xffffffff, 0x220, 0x220, 0x220, 0x98, 0x4, 0x0, {[{{@ip={@local, @loopback, 0xff, 0xffffff00, 'dummy0\x00', 'veth1_macvtap\x00', {}, {}, 0x8, 0x2, 0x46}, 0x0, 0x70, 0x98}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@icmp={{0x28}, {0x11}}, @common=@addrtype={{0x20}, {0x150, 0x22, 0x0, 0x1}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x318) 1.601937835s ago: executing program 3 (id=110): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x800, &(0x7f0000000300)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noauto_da_alloc}, {@dioread_nolock}, {@test_dummy_encryption}, {@block_validity}, {@nodelalloc}, {@minixdf}, {@auto_da_alloc}]}, 0x1, 0xba6, &(0x7f0000000c00)="$eJzs3M1rXFUUAPDzXj7bRicVEeumEZEWxGlaSbFFsJWKGxeCboWGdFJCph8kkZo0i4n+A6KuBTeCWpQu7LobBbdutG4tLoQisVEQ0cibjyQ2M0naTvJq8vvBzbt3zpvcc/KYeffCTALYsQayH2nEvog4nUQU6o+nEdFd7fVGVGrnLczPjvwxPzuSxOLi678mkUTE7fnZkcbvSurHPfVBb0R891ISj7y7et7J6Znx4XK5NFEfH5o6d/HQ5PTMs2Pnhs+WzpbOHz76/NCRoaODx4baVuufP5249vuTr/xc+euzv6/89sEnSZyIvnpsZR3tMhADS3+TlTojYrjdk+Wko17PyjqTznWelG5yUgAAtJSuWMM9FoXoiOXFWyG+/j7X5AAAAIC2WOyIWAQAAAC2ucT+HwAAALa5xucAbs/PjjRavp9I2Fq3TkZEf63+hXqrRTqjUj32RldE7L6dxMqvtSa1p923gYi4+eOxL7MWm/Q95LVU5iLi8WbXP6nW31/9Fvfq+tOIGGzD/AN3jP9P9Z9ow/x51w/AznT9ZO1Gtvr+ly6tf6LJ/a+zyb3rXuR9/2us/xZWrf+W6+9osf57bYNzXP70o0utYln9L1x7+YtGy+bPjvdV1F24NRfxRGez+pOl+pMW9Z/e4ByFfy6VWsXyrn/x44gD0bz+hmTt/090aHSsXBqs/Ww6x9y3Q5+3mj/v+rPrv7tF/etd/4sbnOPNU6eutoqtX3/6S3fyRrXXXX/k7eGpqYnDEd3Jq6sfP7J2Lo1zGr8jq//gU2u//pvVn70nVOp/h2wvMFc/ZuN37pjzxSuXv1qr/mzvl+f1P3OP1/+9Dc7x9DfvH2wVW7n/zVo2/82kthcGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIY0IvoiSYtL/TQtFiP2RMSjsTstX5icemb0wlvnz2SxiP7oSkfHyqXBiCjUxkk2PlztL4+P3DF+LiL2RsSHhV3VcXHkQvlM3sUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwZE9E9EWSFiMijYiFQpoWi3lnBQAAALRdf94JAAAAAJvO/h8AAAC2P/t/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANtne/ddvJBFROb6r2jLd9VhXrpkBmy3NOwEgNx15JwDkpjPvBIDc3OUe33IBtqFknXhvy0hP23MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4MF1YN/1G0lEVI7vqrZMdz3W1fQZ+7cwO2AzpXknAOSmY61g59blAWw9L3HYuZrv8YGdJFkn3rt8TuW/kZ5NywkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB09ftSVpMSLSaj9Ni8WIhyKiP7qS0bFyaTAiHo6IHwpdPdm4J++kAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaLvJ6Znx4XK5NKGjo5NvJ3kw0qh18n5nAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD5PTM+PD5XJpYjLvTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC8TU7PjA+Xy6WJDXSu3s3JKzp51wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQH7+DQAA//+LYA3r") r0 = inotify_init1(0x80800) inotify_add_watch(r0, &(0x7f0000000040)='./file0\x00', 0x528) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x1a42028, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x14a0, &(0x7f0000000200)=ANY=[], 0x1, 0x0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x0, 0x0, 0x0) 1.540434186s ago: executing program 2 (id=111): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x33, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) prctl$PR_MPX_DISABLE_MANAGEMENT(0x2c) keyctl$invalidate(0x15, 0x0) r4 = socket(0x28, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f00000002c0)={'veth1_macvtap\x00', &(0x7f0000000080)=@ethtool_sfeatures={0x15}}) 1.383443658s ago: executing program 0 (id=113): socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x803, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r1, @ANYRESHEX=r2], 0x15) 1.30039507s ago: executing program 4 (id=114): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x44, r1, 0xb97534d5fe9704cf, 0x70bd2b, 0x25dfdbfe, {{0x12}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0xfffffff8, 0xfffffff5}}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x421}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x5}]}, 0x44}}, 0x810) 1.30023793s ago: executing program 3 (id=115): unshare(0x64000600) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0xbf2e, 0x9, 0x5, 0x5}}) 1.29999795s ago: executing program 4 (id=116): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000002780)=@raw={'raw\x00', 0x3c1, 0x3, 0x12e8, 0x1120, 0x178, 0xc, 0x1120, 0x178, 0x1218, 0x258, 0x258, 0x1218, 0x258, 0x3, 0x0, {[{{@uncond, 0x0, 0x1100, 0x1120, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00'}}, @common=@unspec=@addrtype1={{0x28}}]}, @unspec=@NOTRACK={0x20}}, {{@ipv6={@private1, @mcast1, [], [], 'wg2\x00', 'hsr0\x00', {}, {0xff}}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1348) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) listen(r0, 0x2005) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x24040014, &(0x7f0000000000)={0xa, 0x4e22, 0x40, @empty}, 0x1c) sendmmsg$inet(r2, &(0x7f0000002a00)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000028c0)="f2990e196a679b77", 0x8}, {0x0}], 0x2}}], 0x1, 0x48045) pipe2(0x0, 0x800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x6, 0x4, 0x1010, 0x89}, 0x50) r6 = socket(0x2, 0x2, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f00000458c0)={0x1f, 0x2}, 0x6) write$bt_hci(r7, &(0x7f0000000080)=ANY=[@ANYBLOB="01"], 0x7) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r6, 0x8983, &(0x7f0000000000)={0x1, 'vlan1\x00', {}, 0x5832}) close_range(r0, 0xffffffffffffffff, 0x0) 1.251195901s ago: executing program 3 (id=117): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="380000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="c3040500000000001800128008000100736900000c0002"], 0xfffffffffffffe47}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="ec0000003b00070127bd700000008000017c00000400fc800c00"], 0xec}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 1.223391921s ago: executing program 0 (id=118): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502"], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) sendmsg$can_raw(0xffffffffffffffff, 0x0, 0x4000040) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) 1.192233871s ago: executing program 3 (id=119): syz_mount_image$ext4(&(0x7f00000008c0)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x0, &(0x7f0000000a40)={[{@noblock_validity}, {@grpquota}, {@grpid}, {@nombcache}]}, 0x1, 0x5a3, &(0x7f00000002c0)="$eJzs3T1sG3UbAPDnznHTj7xv+krvK72gDhUgFamqk/QDClO7IipV6oDEApHjRlWcuIodaKJIpHuF6IAAdSkbDIwgBgbEwsjKwseMVNEIpKYDGDk+p2nqFCfEMcS/n3TJ/3939vP8fX7OvtOdHEDfOtr4k0Y8EREXk4jhdcsGIlt4tLneyvJi8f7yYjGJev3Sz0kkEXFvebHYWj/J/h+KiKWI+H9EfJWPOJ6uPeW+VqM6vzA1Xi6XZrP+SG366kh1fuHElenxydJkaebU8y+cOXv6zNjJsfXp3q+v7+W3NtYb3998+8Y3L92++fEnR5aK744ncS6GsmXrx7GTmq9JPs5tmH+6G8F6KOl1AmxLLqvzRin9L4Yjl1V9O/X1O4fBXUkP6KL6YER9zbom0AcSRQ99qvU9oHH825p28/vHnfPNA5BG3JXlxeJb0Yo/0Dw3EftXj00O/pI8dGTSON48vJuJsictXY+I0YGBR9//Sfb+277RnUiQrvryfHNDPbr907X9T7TZ/wy1zp3+Ra3930q2/1tpEz+3yf7vYocxfnv1xw82jX99MJ5sGz9Zi5+0iZ9GxOsdxr/1yudnN1tW/zDiWLSP35I8/vzwyOUr5dJo82/bGF8cO/Li5uOPOLhJ/OY52/2riawf/74sp7TD8X/29adPLT0m/rNPP377t3v9D0TEOx3G/8+9j17ebNmd68ndxreArW7/JPJxu8P4z507+l3WdNYQAAAAAAAAAAB2ULp6LVuSFtbaaVooNO/h/W8cTMuVau345crczETzmrfDkU9bV1oNN/tJoz+WXY/b6p/c0D+VywLmDqz2C8VKeaLHYwcAAAAAAAAAAAAAAAAAAIC/i0Mb7v//Nbd6///Gn6sG9qrNf/Ib2OvUP/Svh+s/6VkewO7z+Q99q67+oX+pf+hf6h/6l/qH/tW2/g/sfh7A7vP5D/1L/QMAAAAAAAAAAAAAAAAAAAAAAAAAQFdcvHChMdXvLy8WG/2Jgfm5qcobJyZK1anC9FyxUKzMXi1MViqT5VKhWJn+s+dLKpWrozEzd22kVqrWRqrzC69NV+ZmWr8pWsp3fUQAAAAAAAAAAAAAAAAAAADwzzO0OiVpISLf7KdpoRDxr4g4nERy+Uq5NBoR/46Ib3P5wUZ/rNdJAwAAAAAAAAAAAAAAAAAAwB5TnV+YGi+XS7PdawxkoTp71A+1ruYzsJWVI2JpZ9NoPOOWH5XPXsDubqY+aeQ6fB/2faOHOyUAAAAAAAAAAAAAAAAAAOhTD2767fQRv3c3IQAAAAAAAAAAAAAAAAAAAOhL6U9JRDSmY8PPDG1cui9Zya3+j4g3b11679p4rTY71ph/d21+7f1s/sle5A90qlWnaUQ06hgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4oDq/MDVeLpdmt9kY7GCdXo8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDv+CAAA//9bQM66") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101041, 0xf0) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42042, 0x1cb) fallocate(r1, 0x10, 0x820, 0x8000) 1.192041411s ago: executing program 0 (id=120): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x1, 0x0, 0x0, 0x0}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) 1.191999391s ago: executing program 0 (id=121): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) 1.191730031s ago: executing program 0 (id=122): syz_emit_ethernet(0x122, &(0x7f00000013c0)=ANY=[@ANYBLOB], 0x0) r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000280)='./control\x00', 0x210000, &(0x7f0000000940)={[{@nodelalloc}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@bh}, {@min_batch_time={'min_batch_time', 0x3d, 0x8}}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x5}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) tkill(0x0, 0x13) tkill(0x0, 0x12) waitid(0x1, 0x0, 0x0, 0x4, &(0x7f00000003c0)) setrlimit(0xd, &(0x7f0000000040)={0x4, 0x6e6c}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)="97"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001a40)="a1"}) prlimit64(0x0, 0x1, &(0x7f0000000040), 0x0) r6 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$read(0x2, r6, &(0x7f00000000c0)=""/4096, 0x1000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709000100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x2000c020) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000001a0f2e2150b959a1f20000000000000500000a34000000060a8bae00000000000000000a0000010900010073796e08cf10c0f20fb30fa5289bb2bbbd7a310000000008000940000000020900020073797a320000000014000000114e57306e135d86353a650d51e66199025c17e4464542c7f239a623f37be86890a76e14e1233a847672b3d0e46850b2df05d7568840ad8719e801cccee3f7199577f118fe1fac64d28d446dda867e547eb18fe5a523b8"], 0x5c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40040) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') epoll_create1(0x80000) 344.390955ms ago: executing program 2 (id=123): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getresgid(&(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chroot(&(0x7f0000000a40)='./file0\x00') mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) getdents64(0xffffffffffffffff, &(0x7f0000002600)=""/4113, 0x1011) 344.200755ms ago: executing program 3 (id=124): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x0) 344.084875ms ago: executing program 5 (id=125): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18020000000100000000000000000000850000004100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x64, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffd4, 0x0, 0x0, 0x10, 0x2}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={r1, r2, 0x25, 0x2, @val=@netkit}, 0x1c) syz_emit_ethernet(0x8c, &(0x7f00000010c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x19}, @void, {@ipv6={0x86dd, @dccp_packet={0x7, 0x6, "3422cc", 0x56, 0x21, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @local, {[], {{0x4e21, 0x4e22, 0x4, 0x1, 0x3, 0x0, 0x0, 0x9, 0x2, "ecde00", 0xff, "165848"}, "3a29143c1290afb10fe4068b266b4ee8b286aecad48cbb76ec1b79079f85939ecbfacc8828ae027b7a184a6c6150b09b68d5d6e1e631bd815d0d8dacc43d4695bf7a5563856c"}}}}}}, 0x0) 264.361497ms ago: executing program 4 (id=126): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) madvise(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x64) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x8, 0x0, 0x0, 0x101, 0x42, 0x4a, 0x42, 0x4}) 136.399799ms ago: executing program 0 (id=127): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a, 0x3}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0x4c, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x0, 0x1000000, 0x0, 0x1, 0xafc, &(0x7f00000005c0)="c6"}) 402.45µs ago: executing program 4 (id=128): r0 = socket$inet(0x2, 0x4000000000000001, 0x6) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x8, 0x4) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) write(r0, &(0x7f00000000c0)="ec", 0x1) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000002c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/106, 0x6a, 0x1, &(0x7f0000000280)=""/7, 0x7}, &(0x7f0000000540)=0x40) 217.31µs ago: executing program 5 (id=129): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newtfilter={0x84, 0x2c, 0xd2f, 0x30bd2c, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x3, 0x10}, {}, {0x4, 0xd}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0xab, 0x1, 0x3, 0x6}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) 142.06µs ago: executing program 4 (id=130): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x7}, '\x00', "5171bb672965593497418688ac68cb126474cd3660dab9e2086e246728d7a040", '\x00\x00=*', "1202000000040030"}, 0x58) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) 0s ago: executing program 4 (id=131): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x2}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd21, 0xfbffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x400) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0xfff2, 0x4}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x92, 0x1, 0x7, 0x3}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x81, 0x2}}]}, 0x8c}}, 0x4800) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.70' (ED25519) to the list of known hosts. [ 17.624497][ T30] audit: type=1400 audit(1782392065.516:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 17.625568][ T277] cgroup: Unknown subsys name 'net' [ 17.647131][ T30] audit: type=1400 audit(1782392065.516:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 17.674402][ T30] audit: type=1400 audit(1782392065.546:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 17.674589][ T277] cgroup: Unknown subsys name 'devices' [ 17.790665][ T277] cgroup: Unknown subsys name 'hugetlb' [ 17.796373][ T277] cgroup: Unknown subsys name 'rlimit' [ 17.932327][ T30] audit: type=1400 audit(1782392065.826:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 17.955513][ T30] audit: type=1400 audit(1782392065.826:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 17.959022][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 17.980653][ T30] audit: type=1400 audit(1782392065.826:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 18.011857][ T30] audit: type=1400 audit(1782392065.876:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.036940][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 18.037509][ T30] audit: type=1400 audit(1782392065.876:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.071449][ T30] audit: type=1400 audit(1782392065.926:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.096982][ T30] audit: type=1400 audit(1782392065.926:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.641861][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.648912][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.656339][ T286] device bridge_slave_0 entered promiscuous mode [ 18.663105][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.670239][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.677478][ T285] device bridge_slave_0 entered promiscuous mode [ 18.684322][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.691396][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 18.698770][ T285] device bridge_slave_1 entered promiscuous mode [ 18.709588][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.716617][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 18.724029][ T286] device bridge_slave_1 entered promiscuous mode [ 18.748423][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.755504][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.762857][ T287] device bridge_slave_0 entered promiscuous mode [ 18.772348][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.779442][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 18.786777][ T287] device bridge_slave_1 entered promiscuous mode [ 18.830758][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.837800][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.845236][ T288] device bridge_slave_0 entered promiscuous mode [ 18.860961][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.868006][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 18.875438][ T288] device bridge_slave_1 entered promiscuous mode [ 18.910092][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.917134][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.924526][ T289] device bridge_slave_0 entered promiscuous mode [ 18.950005][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.957140][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 18.964511][ T289] device bridge_slave_1 entered promiscuous mode [ 19.055314][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.062387][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.069695][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.076706][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.097092][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.104148][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.111411][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.118424][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.135144][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.142198][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.149465][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.156480][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.186073][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.193134][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.200419][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.207427][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.215813][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.223553][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.230902][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.238367][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.245686][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.252848][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.260106][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.267261][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.274480][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.301390][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.309597][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.317780][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.324806][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.332870][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.341035][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.348039][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.355397][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.363536][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.370565][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.402624][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.411006][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.419234][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.426260][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.433802][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.442296][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.449365][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.456703][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.464938][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.471951][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.479335][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.487227][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.495170][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.503124][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.512616][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.531466][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 19.538918][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.557738][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.565593][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.573689][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.582001][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.589024][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.596557][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.604708][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.611725][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.619012][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.627159][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.634185][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.641616][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.649843][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.656846][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.664265][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 19.685449][ T287] device veth0_vlan entered promiscuous mode [ 19.692583][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 19.700744][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.708934][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 19.717378][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 19.725889][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 19.733987][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.742011][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 19.750357][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 19.758577][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 19.767006][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 19.775349][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 19.783317][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 19.791281][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 19.799264][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 19.807134][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 19.814696][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 19.822170][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 19.829824][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 19.843182][ T289] device veth0_vlan entered promiscuous mode [ 19.850730][ T288] device veth0_vlan entered promiscuous mode [ 19.860806][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 19.868885][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.877023][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 19.885248][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.893805][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 19.901754][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 19.909649][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 19.917034][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 19.929847][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 19.938040][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 19.950055][ T289] device veth1_macvtap entered promiscuous mode [ 19.961187][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 19.968785][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 19.976886][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 19.985206][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 19.993509][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.002293][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.010595][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.019896][ T287] device veth1_macvtap entered promiscuous mode [ 20.028103][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.036028][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.044317][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.053908][ T288] device veth1_macvtap entered promiscuous mode [ 20.065905][ T286] device veth0_vlan entered promiscuous mode [ 20.076475][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.084240][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.092571][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.101019][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.109491][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.117723][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.126020][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.134351][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.142260][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.150238][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.158380][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.166778][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.174229][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.191584][ T285] device veth0_vlan entered promiscuous mode [ 20.198221][ T289] request_module fs-gadgetfs succeeded, but still no fs? [ 20.201047][ T286] device veth1_macvtap entered promiscuous mode [ 20.217959][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.227307][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.235459][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.243773][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.251923][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.259556][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.267682][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.276241][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.284569][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.292891][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.300304][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.333231][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.345860][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.364323][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.372645][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.381231][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.389915][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.402859][ T314] loop1: detected capacity change from 0 to 512 [ 20.410298][ T285] device veth1_macvtap entered promiscuous mode [ 20.465402][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.512570][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.520946][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.531186][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.539600][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.608517][ T326] process 'syz.3.4' launched './file2' with NULL argv: empty string added [ 20.621431][ T325] binder: 324:325 ioctl c0306201 200000000000 returned -14 [ 20.684243][ T314] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 20.694582][ T314] EXT4-fs (loop1): 1 truncate cleaned up [ 20.700624][ T314] EXT4-fs (loop1): mounted filesystem without journal. Opts: jqfmt=vfsold,usrjquota="errors=continue,noload,data_err=ignore,usrjquota="errors=continue,noinit_itable,noblock_validity,,errors=continue. Quota mode: writeback. [ 20.727945][ T314] EXT4-fs (loop1): re-mounted. Opts: (null). Quota mode: writeback. [ 20.737913][ T314] EXT4-fs (loop1): re-mounted. Opts: (null). Quota mode: writeback. [ 20.786640][ T336] netlink: 324 bytes leftover after parsing attributes in process `syz.0.11'. [ 21.315214][ T360] netlink: 12 bytes leftover after parsing attributes in process `syz.3.19'. [ 21.326160][ T360] 8021q: VLANs not supported on sit0 [ 21.398938][ T362] netlink: 96 bytes leftover after parsing attributes in process `syz.3.20'. [ 21.671132][ T374] loop0: detected capacity change from 0 to 2048 [ 21.696004][ T374] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 21.707262][ T374] ext4 filesystem being mounted at /6/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 21.729786][ T374] overlayfs: failed to set xattr on upper [ 21.735527][ T374] overlayfs: ...falling back to index=off,metacopy=off. [ 21.771269][ T379] loop1: detected capacity change from 0 to 1024 [ 21.797160][ T379] EXT4-fs (loop1): Ignoring removed bh option [ 21.810188][ T379] EXT4-fs (loop1): mounted filesystem without journal. Opts: nodelalloc,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000005,bh,nodiscard,. Quota mode: none. [ 22.176144][ T379] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #12: block 7: comm syz.1.28: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 22.393991][ T379] EXT4-fs (loop1): Remounting filesystem read-only [ 22.457358][ T379] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2807: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 22.934309][ T30] kauditd_printk_skb: 90 callbacks suppressed [ 22.934322][ T30] audit: type=1400 audit(1782392070.826:164): avc: denied { read write } for pid=396 comm="syz.0.33" name="uinput" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 22.935441][ T388] syz.1.28 (388) used greatest stack depth: 20352 bytes left [ 22.942969][ T30] audit: type=1400 audit(1782392070.836:165): avc: denied { open } for pid=396 comm="syz.0.33" path="/dev/uinput" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 22.975610][ T287] EXT4-fs error (device loop1): ext4_read_inline_dir:1632: inode #12: block 7: comm syz-executor: path /5/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 22.999751][ T399] loop2: detected capacity change from 0 to 7 [ 23.056592][ T30] audit: type=1400 audit(1782392070.836:166): avc: denied { ioctl } for pid=396 comm="syz.0.33" path="/dev/uinput" dev="devtmpfs" ino=258 ioctlcmd=0x5564 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 23.089428][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 23.100998][ T401] loop3: detected capacity change from 0 to 256 [ 23.101532][ T287] EXT4-fs error (device loop1): ext4_read_inline_dir:1632: inode #12: block 7: comm syz-executor: path /5/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 23.129960][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 23.136711][ T287] EXT4-fs error (device loop1): empty_inline_dir:1887: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 23.156990][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 23.163723][ T287] EXT4-fs warning (device loop1): empty_inline_dir:1894: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 23.164232][ T401] ======================================================= [ 23.164232][ T401] WARNING: The mand mount option has been deprecated and [ 23.164232][ T401] and is ignored by this kernel. Remove the mand [ 23.164232][ T401] option from the mount to silence this warning. [ 23.164232][ T401] ======================================================= [ 23.185300][ T287] EXT4-fs error (device loop1): ext4_read_inline_dir:1632: inode #12: block 7: comm syz-executor: path /5/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 23.239431][ T405] input: syz0 as /devices/virtual/input/input4 [ 23.247396][ T30] audit: type=1400 audit(1782392071.136:167): avc: denied { read } for pid=86 comm="acpid" name="event3" dev="devtmpfs" ino=570 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.250656][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 23.283375][ T30] audit: type=1400 audit(1782392071.166:168): avc: denied { open } for pid=86 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=570 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.307469][ T30] audit: type=1400 audit(1782392071.166:169): avc: denied { ioctl } for pid=86 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=570 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.333132][ T287] EXT4-fs error (device loop1): ext4_read_inline_dir:1632: inode #12: block 7: comm syz-executor: path /5/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 23.509222][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 23.515334][ T401] FAT-fs (loop3): Directory bread(block 64) failed [ 23.523923][ T287] EXT4-fs error (device loop1): empty_inline_dir:1887: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 23.530618][ T401] FAT-fs (loop3): Directory bread(block 65) failed [ 23.551702][ T401] FAT-fs (loop3): Directory bread(block 66) failed [ 23.554553][ T415] netlink: 36 bytes leftover after parsing attributes in process `syz.2.40'. [ 23.567934][ T401] FAT-fs (loop3): Directory bread(block 67) failed [ 23.636996][ T401] FAT-fs (loop3): Directory bread(block 68) failed [ 23.661728][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 23.674778][ T287] EXT4-fs warning (device loop1): empty_inline_dir:1894: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 23.690313][ T401] FAT-fs (loop3): Directory bread(block 69) failed [ 23.695438][ T287] EXT4-fs error (device loop1): ext4_read_inline_dir:1632: inode #12: block 7: comm syz-executor: path /5/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 23.727345][ T401] FAT-fs (loop3): Directory bread(block 70) failed [ 23.729356][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 23.740653][ T401] FAT-fs (loop3): Directory bread(block 71) failed [ 23.747356][ T401] FAT-fs (loop3): Directory bread(block 72) failed [ 23.754124][ T401] FAT-fs (loop3): Directory bread(block 73) failed [ 23.754475][ T422] loop2: detected capacity change from 0 to 4096 [ 23.789200][ T287] EXT4-fs error (device loop1): ext4_read_inline_dir:1632: inode #12: block 7: comm syz-executor: path /5/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 23.841255][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 23.857995][ T287] EXT4-fs error (device loop1): empty_inline_dir:1887: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 23.881318][ T422] EXT4-fs (loop2): dax option not supported [ 23.901383][ T401] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 23.919473][ T30] audit: type=1400 audit(1782392071.816:170): avc: denied { mount } for pid=400 comm="syz.3.36" name="/" dev="loop3" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 24.001605][ T287] EXT4-fs (loop1): Remounting filesystem read-only [ 24.008145][ T287] EXT4-fs warning (device loop1): empty_inline_dir:1894: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 24.023673][ T30] audit: type=1400 audit(1782392071.916:171): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 24.046501][ T287] EXT4-fs warning (device loop1): empty_inline_dir:1894: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 24.061536][ T287] EXT4-fs warning (device loop1): empty_inline_dir:1894: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 24.197586][ T30] audit: type=1400 audit(1782392072.086:172): avc: denied { read } for pid=427 comm="syz.3.43" dev="nsfs" ino=4026532377 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 24.213161][ T426] loop0: detected capacity change from 0 to 1024 [ 24.225049][ T287] EXT4-fs warning (device loop1): empty_inline_dir:1894: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 24.239258][ T30] audit: type=1400 audit(1782392072.116:173): avc: denied { open } for pid=427 comm="syz.3.43" path="net:[4026532377]" dev="nsfs" ino=4026532377 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 24.276303][ T426] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.291669][ T433] loop3: detected capacity change from 0 to 512 [ 24.299898][ T287] EXT4-fs warning (device loop1): empty_inline_dir:1894: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 24.307213][ T435] loop2: detected capacity change from 0 to 512 [ 24.314658][ T287] EXT4-fs warning (device loop1): empty_inline_dir:1894: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 24.337185][ T433] EXT4-fs (loop3): Test dummy encryption mode enabled [ 24.348422][ T433] EXT4-fs (loop3): dax option not supported [ 24.354668][ T287] EXT4-fs warning (device loop1): empty_inline_dir:1894: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 24.374152][ T435] EXT4-fs error (device loop2): ext4_orphan_get:1406: inode #15: comm syz.2.47: inode has both inline data and extents flags [ 24.387872][ T435] EXT4-fs error (device loop2): ext4_orphan_get:1411: comm syz.2.47: couldn't read orphan inode 15 (err -117) [ 24.400698][ T435] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.528172][ T442] loop2: detected capacity change from 0 to 256 [ 24.607786][ T452] netlink: 36 bytes leftover after parsing attributes in process `syz.4.53'. [ 24.746351][ T459] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.753631][ T459] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.766779][ T459] device bridge_slave_0 entered promiscuous mode [ 24.776175][ T459] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.783382][ T459] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.784642][ T458] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouid32,nodioread_nolock,noquota,delalloc,journal_dev=0x0000000000000009,inlinecrypt,,errors=continue. Quota mode: none. [ 24.791021][ T459] device bridge_slave_1 entered promiscuous mode [ 24.808449][ T458] ext4 filesystem being mounted at /15/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 24.837686][ T458] EXT4-fs error (device loop4): ext4_map_blocks:742: inode #15: block 3: comm syz.4.57: lblock 3 mapped to illegal pblock 3 (length 3) [ 24.851912][ T458] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 24.865278][ T458] EXT4-fs (loop4): This should not happen!! Data will be lost [ 24.865278][ T458] [ 24.879164][ T469] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 24.902681][ T458] netlink: 12 bytes leftover after parsing attributes in process `syz.4.57'. [ 24.929188][ T10] EXT4-fs error (device loop4): ext4_map_blocks:742: inode #15: block 8: comm kworker/u4:1: lblock 8 mapped to illegal pblock 8 (length 8) [ 24.955478][ T10] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 8 with error 117 [ 24.971660][ T10] EXT4-fs (loop4): This should not happen!! Data will be lost [ 24.971660][ T10] [ 24.975168][ T459] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.988337][ T459] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.995609][ T459] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.002625][ T459] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.021349][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.028849][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.036153][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.040071][ T308] loop2: p1 p3 < > [ 25.053444][ T45] device bridge_slave_1 left promiscuous mode [ 25.060762][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.061754][ T473] loop2: p1 p3 < > [ 25.071955][ T45] device bridge_slave_0 left promiscuous mode [ 25.078112][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.091762][ T45] device veth1_macvtap left promiscuous mode [ 25.097884][ T45] device veth0_vlan left promiscuous mode [ 25.179291][ T315] udevd[315]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 25.190122][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.199184][ T308] udevd[308]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 25.206187][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.213804][ T308] udevd[308]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 25.215869][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.227313][ T417] udevd[417]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 25.233613][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.251644][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.253360][ T478] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 25.258691][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.269985][ T478] ext4 filesystem being mounted at /10/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 25.277670][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.313962][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.347222][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.355661][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.363943][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.372017][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.385564][ T488] netlink: 36 bytes leftover after parsing attributes in process `syz.0.66'. [ 25.396829][ T459] device veth0_vlan entered promiscuous mode [ 25.409796][ T492] device syzkaller0 entered promiscuous mode [ 25.429895][ T496] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.437067][ T496] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.486568][ T459] device veth1_macvtap entered promiscuous mode [ 25.505377][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.514028][ T503] overlayfs: failed to get inode (-116) [ 25.519398][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.519902][ T503] overlayfs: failed to get inode (-116) [ 25.533883][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.554350][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.570753][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.606138][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.619012][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.702378][ T520] binder: BINDER_SET_CONTEXT_MGR already set [ 25.708387][ T520] binder: 516:520 ioctl 4018620d 200000004a80 returned -16 [ 26.066415][ T527] netlink: 36 bytes leftover after parsing attributes in process `syz.3.80'. [ 26.233429][ T535] set_capacity_and_notify: 3 callbacks suppressed [ 26.233467][ T535] loop5: detected capacity change from 0 to 256 [ 26.334794][ T535] FAT-fs (loop5): Directory bread(block 64) failed [ 26.421446][ T535] FAT-fs (loop5): Directory bread(block 65) failed [ 26.431781][ T535] FAT-fs (loop5): Directory bread(block 66) failed [ 26.441355][ T535] FAT-fs (loop5): Directory bread(block 67) failed [ 26.579162][ T535] FAT-fs (loop5): Directory bread(block 68) failed [ 26.579191][ T535] FAT-fs (loop5): Directory bread(block 69) failed [ 26.579229][ T535] FAT-fs (loop5): Directory bread(block 70) failed [ 26.579246][ T535] FAT-fs (loop5): Directory bread(block 71) failed [ 26.579276][ T535] FAT-fs (loop5): Directory bread(block 72) failed [ 26.579293][ T535] FAT-fs (loop5): Directory bread(block 73) failed [ 26.768072][ T547] loop5: detected capacity change from 0 to 256 [ 26.796691][ T548] loop4: detected capacity change from 0 to 256 [ 26.924241][ T553] hub 7-0:1.0: USB hub found [ 26.926600][ T555] loop5: detected capacity change from 0 to 128 [ 26.936385][ T556] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 26.946202][ T553] hub 7-0:1.0: 1 port detected [ 26.972588][ T555] EXT4-fs (loop5): mounted filesystem without journal. Opts: data_err=ignore,,errors=continue. Quota mode: none. [ 27.000157][ T560] loop3: detected capacity change from 0 to 4096 [ 27.016923][ T555] ext4 filesystem being mounted at /5/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 27.051483][ T566] loop2: detected capacity change from 0 to 1024 [ 27.075158][ T568] netlink: 24 bytes leftover after parsing attributes in process `syz.0.97'. [ 27.084809][ T560] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 27.094797][ T568] netlink: 24 bytes leftover after parsing attributes in process `syz.0.97'. [ 27.104315][ T560] EXT4-fs (loop3): Test dummy encryption mode enabled [ 27.112680][ T560] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c1a8, mo2=0003] [ 27.120994][ T560] System zones: 0-5 [ 27.125738][ T560] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,jqfmt=vfsv0,inlinecrypt,errors=remount-ro,test_dummy_encryption=v1,norecovery,delalloc,nogrpid,minixdf,. Quota mode: writeback. [ 27.152328][ T566] EXT4-fs (loop2): dax option not supported [ 27.174774][ T560] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 27.230897][ T579] loop0: detected capacity change from 0 to 128 [ 27.257533][ T579] EXT4-fs (loop0): mounted filesystem without journal. Opts: data_err=ignore,,errors=continue. Quota mode: none. [ 27.271517][ T579] ext4 filesystem being mounted at /18/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 27.332535][ T589] binder: 588:589 ioctl c0306201 200000000000 returned -14 [ 27.392041][ T602] device syzkaller0 entered promiscuous mode [ 27.411153][ T600] loop3: detected capacity change from 0 to 4096 [ 27.480456][ T607] loop0: detected capacity change from 0 to 8192 [ 27.580100][ T600] EXT4-fs (loop3): Test dummy encryption mode enabled [ 27.588727][ T600] EXT4-fs (loop3): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,dioread_nolock,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 27.616397][ T600] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 27.729457][ T614] 9pnet: p9_errstr2errno: server reported unknown error 0x0000000 [ 27.795178][ T631] loop3: detected capacity change from 0 to 1024 [ 27.810816][ T633] EXT4-fs (loop0): Ignoring removed bh option [ 27.817203][ T633] EXT4-fs (loop0): Ignoring removed bh option [ 27.844615][ T631] EXT4-fs (loop3): mounted filesystem without journal. Opts: noblock_validity,grpquota,grpid,nombcache,,errors=continue. Quota mode: writeback. [ 27.859757][ T631] ext4 filesystem being mounted at /21/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 27.868690][ T633] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodelalloc,dioread_lock,barrier=0x0000000000000004,nolazytime,bh,min_batch_time=0x0000000000000008,errors=remount-ro,stripe=0x0000000000000005,bh,init_itable,. Quota mode: none. [ 27.873502][ T631] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm syz.3.119: bg 0: block 112: padding at end of block bitmap is not set [ 27.917781][ T631] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 52 with error 28 [ 28.040047][ T631] EXT4-fs (loop3): This should not happen!! Data will be lost [ 28.040047][ T631] [ 28.052262][ T631] EXT4-fs (loop3): Total free blocks count 0 [ 28.058624][ T631] EXT4-fs (loop3): Free/Dirty block details [ 28.064836][ T631] EXT4-fs (loop3): free_blocks=0 [ 28.070283][ T631] EXT4-fs (loop3): dirty_blocks=64 [ 28.075629][ T631] EXT4-fs (loop3): Block reservation details [ 28.081735][ T631] EXT4-fs (loop3): i_reserved_data_blocks=4 [ 28.759134][ T30] kauditd_printk_skb: 52 callbacks suppressed [ 28.759269][ T30] audit: type=1400 audit(1782392076.616:226): avc: denied { mount } for pid=643 comm="syz.2.123" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 28.914817][ T30] audit: type=1400 audit(1782392076.616:227): avc: denied { mounton } for pid=643 comm="syz.2.123" path="/27/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 28.975651][ T659] ================================================================== [ 28.983738][ T659] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3200 [ 28.991897][ T659] Read of size 8 at addr ffff88811de4f1c0 by task syz.5.129/659 [ 28.999553][ T659] [ 29.001872][ T659] CPU: 0 PID: 659 Comm: syz.5.129 Not tainted syzkaller #0 [ 29.009057][ T659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 29.019115][ T659] Call Trace: [ 29.022383][ T659] [ 29.025298][ T659] __dump_stack+0x21/0x30 [ 29.029616][ T659] dump_stack_lvl+0x110/0x170 [ 29.034281][ T659] ? show_regs_print_info+0x20/0x20 [ 29.039461][ T659] ? load_image+0x3f0/0x3f0 [ 29.043946][ T659] print_address_description+0x7f/0x2c0 [ 29.049476][ T659] ? tc_setup_flow_action+0x88e/0x3200 [ 29.054928][ T659] kasan_report+0x10f/0x150 [ 29.059413][ T659] ? tc_setup_flow_action+0x88e/0x3200 [ 29.064851][ T659] __asan_report_load8_noabort+0x14/0x20 [ 29.070505][ T659] tc_setup_flow_action+0x88e/0x3200 [ 29.075824][ T659] mall_replace_hw_filter+0x2db/0x8d0 [ 29.081181][ T659] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 29.087228][ T659] ? mall_set_parms+0x520/0x520 [ 29.092056][ T659] ? tcf_exts_destroy+0xb0/0xb0 [ 29.096887][ T659] ? pcpu_alloc+0x1118/0x16f0 [ 29.101546][ T659] ? mall_set_parms+0x1e4/0x520 [ 29.106379][ T659] mall_change+0x544/0x760 [ 29.110776][ T659] ? __kasan_check_write+0x14/0x20 [ 29.115963][ T659] ? mall_get+0xa0/0xa0 [ 29.120101][ T659] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 29.125981][ T659] ? mall_get+0xa0/0xa0 [ 29.130120][ T659] tc_new_tfilter+0x13df/0x1990 [ 29.134955][ T659] ? tcf_gate_entry_destructor+0x20/0x20 [ 29.140568][ T659] ? security_capable+0x87/0xb0 [ 29.145414][ T659] ? ns_capable+0x8c/0xf0 [ 29.149729][ T659] ? netlink_net_capable+0x125/0x160 [ 29.155004][ T659] ? tcf_gate_entry_destructor+0x20/0x20 [ 29.160642][ T659] rtnetlink_rcv_msg+0x83c/0xcb0 [ 29.165560][ T659] ? rtnetlink_bind+0x80/0x80 [ 29.170336][ T659] ? avc_has_perm_noaudit+0x390/0x490 [ 29.175701][ T659] ? memcpy+0x56/0x70 [ 29.179673][ T659] ? avc_has_perm_noaudit+0x30a/0x490 [ 29.185029][ T659] ? arch_stack_walk+0xee/0x140 [ 29.189866][ T659] ? avc_denied+0x1b0/0x1b0 [ 29.194371][ T659] ? stack_trace_save+0xa6/0xf0 [ 29.199201][ T659] ? avc_has_perm+0x163/0x250 [ 29.203859][ T659] ? avc_has_perm_noaudit+0x490/0x490 [ 29.209212][ T659] ? x64_sys_call+0x4b/0x9a0 [ 29.213790][ T659] ? selinux_nlmsg_lookup+0x39d/0x440 [ 29.219144][ T659] netlink_rcv_skb+0x1e9/0x430 [ 29.223911][ T659] ? rtnetlink_bind+0x80/0x80 [ 29.228576][ T659] ? netlink_ack+0xb10/0xb10 [ 29.233145][ T659] ? _copy_from_iter+0x4a4/0x10a0 [ 29.238170][ T659] ? __netlink_lookup+0x387/0x3b0 [ 29.243174][ T659] rtnetlink_rcv+0x1c/0x20 [ 29.247585][ T659] netlink_unicast+0x86c/0xa30 [ 29.252342][ T659] netlink_sendmsg+0x879/0xb80 [ 29.257089][ T659] ? netlink_getsockopt+0x530/0x530 [ 29.262272][ T659] ? security_socket_sendmsg+0x82/0xa0 [ 29.267740][ T659] ? netlink_getsockopt+0x530/0x530 [ 29.272917][ T659] ____sys_sendmsg+0x5be/0x8f0 [ 29.277668][ T659] ? __sys_sendmsg_sock+0x40/0x40 [ 29.282689][ T659] ? import_iovec+0x7c/0xb0 [ 29.287183][ T659] ___sys_sendmsg+0x236/0x2e0 [ 29.291842][ T659] ? __sys_sendmsg+0x280/0x280 [ 29.296582][ T659] ? sock_show_fdinfo+0xa0/0xa0 [ 29.301411][ T659] ? __fdget+0x1a1/0x230 [ 29.305630][ T659] __x64_sys_sendmsg+0x201/0x2d0 [ 29.310544][ T659] ? ___sys_sendmsg+0x2e0/0x2e0 [ 29.315373][ T659] ? __kasan_check_write+0x14/0x20 [ 29.320463][ T659] ? switch_fpu_return+0x15d/0x2c0 [ 29.325559][ T659] x64_sys_call+0x4b/0x9a0 [ 29.329966][ T659] do_syscall_64+0x4c/0xa0 [ 29.334390][ T659] ? clear_bhb_loop+0x50/0xa0 [ 29.339153][ T659] ? clear_bhb_loop+0x50/0xa0 [ 29.343811][ T659] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.350638][ T659] RIP: 0033:0x7f3d80815e59 [ 29.355043][ T659] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.374649][ T659] RSP: 002b:00007f3d7f270028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 29.383043][ T659] RAX: ffffffffffffffda RBX: 00007f3d80a8efa0 RCX: 00007f3d80815e59 [ 29.391005][ T659] RDX: 0000000020000000 RSI: 0000200000000580 RDI: 0000000000000004 [ 29.398971][ T659] RBP: 00007f3d808abe6f R08: 0000000000000000 R09: 0000000000000000 [ 29.406921][ T659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.414872][ T659] R13: 00007f3d80a8f038 R14: 00007f3d80a8efa0 R15: 00007ffc43cef128 [ 29.422830][ T659] [ 29.425835][ T659] [ 29.428151][ T659] Allocated by task 659: [ 29.432374][ T659] __kasan_kmalloc+0xd4/0x100 [ 29.437041][ T659] __kmalloc+0x13d/0x2c0 [ 29.441262][ T659] tcf_idr_create+0x5f/0x790 [ 29.445830][ T659] tcf_idr_create_from_flags+0x61/0x70 [ 29.451265][ T659] tcf_gact_init+0x342/0x570 [ 29.455833][ T659] tcf_action_init_1+0x3fd/0x6b0 [ 29.460769][ T659] tcf_action_init+0x233/0x7a0 [ 29.465510][ T659] tcf_exts_validate+0x24a/0x580 [ 29.470432][ T659] mall_set_parms+0x48/0x520 [ 29.475010][ T659] mall_change+0x478/0x760 [ 29.479404][ T659] tc_new_tfilter+0x13df/0x1990 [ 29.484232][ T659] rtnetlink_rcv_msg+0x83c/0xcb0 [ 29.489149][ T659] netlink_rcv_skb+0x1e9/0x430 [ 29.493890][ T659] rtnetlink_rcv+0x1c/0x20 [ 29.498281][ T659] netlink_unicast+0x86c/0xa30 [ 29.503106][ T659] netlink_sendmsg+0x879/0xb80 [ 29.507847][ T659] ____sys_sendmsg+0x5be/0x8f0 [ 29.512587][ T659] ___sys_sendmsg+0x236/0x2e0 [ 29.517245][ T659] __x64_sys_sendmsg+0x201/0x2d0 [ 29.522157][ T659] x64_sys_call+0x4b/0x9a0 [ 29.526550][ T659] do_syscall_64+0x4c/0xa0 [ 29.530942][ T659] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.536808][ T659] [ 29.539110][ T659] The buggy address belongs to the object at ffff88811de4f100 [ 29.539110][ T659] which belongs to the cache kmalloc-192 of size 192 [ 29.553135][ T659] The buggy address is located 0 bytes to the right of [ 29.553135][ T659] 192-byte region [ffff88811de4f100, ffff88811de4f1c0) [ 29.566736][ T659] The buggy address belongs to the page: [ 29.572348][ T659] page:ffffea00047793c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11de4f [ 29.582570][ T659] flags: 0x4000000000000200(slab|zone=1) [ 29.588185][ T659] raw: 4000000000000200 ffffea0004735ac0 0000000400000004 ffff888100042c00 [ 29.596746][ T659] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 29.605299][ T659] page dumped because: kasan: bad access detected [ 29.611704][ T659] page_owner tracks the page as allocated [ 29.617542][ T659] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 246, ts 15667898481, free_ts 15667837344 [ 29.633514][ T659] post_alloc_hook+0x192/0x1b0 [ 29.638272][ T659] prep_new_page+0x1c/0x110 [ 29.642754][ T659] get_page_from_freelist+0x2c3a/0x2cd0 [ 29.648277][ T659] __alloc_pages+0x1a2/0x460 [ 29.652843][ T659] new_slab+0xa0/0x4d0 [ 29.656887][ T659] ___slab_alloc+0x3ac/0x840 [ 29.661471][ T659] __slab_alloc+0x49/0x90 [ 29.665779][ T659] kmem_cache_alloc_trace+0x146/0x270 [ 29.671129][ T659] alloc_pipe_info+0xe6/0x4a0 [ 29.675791][ T659] create_pipe_files+0x8d/0x6c0 [ 29.680620][ T659] __do_pipe_flags+0x4f/0x200 [ 29.685274][ T659] do_pipe2+0xa7/0x190 [ 29.689317][ T659] __x64_sys_pipe2+0x5a/0x70 [ 29.693888][ T659] x64_sys_call+0x354/0x9a0 [ 29.698366][ T659] do_syscall_64+0x4c/0xa0 [ 29.702763][ T659] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.708727][ T659] page last free stack trace: [ 29.713460][ T659] free_unref_page_prepare+0x5fa/0x600 [ 29.718899][ T659] free_unref_page+0xae/0x540 [ 29.723647][ T659] __free_pages+0x6c/0x100 [ 29.728057][ T659] free_pipe_info+0x21e/0x2b0 [ 29.732710][ T659] pipe_release+0x238/0x320 [ 29.737188][ T659] __fput+0x22b/0x900 [ 29.741150][ T659] ____fput+0x15/0x20 [ 29.745110][ T659] task_work_run+0x127/0x190 [ 29.749677][ T659] exit_to_user_mode_loop+0xd0/0xe0 [ 29.754856][ T659] exit_to_user_mode_prepare+0x87/0xd0 [ 29.760375][ T659] syscall_exit_to_user_mode+0x1a/0x30 [ 29.765809][ T659] do_syscall_64+0x58/0xa0 [ 29.770202][ T659] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.776072][ T659] [ 29.778375][ T659] Memory state around the buggy address: [ 29.783976][ T659] ffff88811de4f080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 29.792013][ T659] ffff88811de4f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.800051][ T659] >ffff88811de4f180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 29.808084][ T659] ^ [ 29.814208][ T659] ffff88811de4f200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.822243][ T659] ffff88811de4f280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 29.830276][ T659] ================================================================== [ 29.838309][ T659] Disabling lock debugging due to kernel taint [ 29.858912][ T30] audit: type=1400 audit(1782392077.746:228): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 29.888206][ T30] audit: type=1400 audit(1782392077.746:229): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 29.912209][ T30] audit: type=1400 audit(1782392077.746:230): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 29.933665][ T30] audit: type=1400 audit(1782392077.746:231): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 29.954940][ T30] audit: type=1400 audit(1782392077.746:232): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 29.975569][ T30] audit: type=1400 audit(1782392077.746:233): avc: denied { append open } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 29.999206][ T30] audit: type=1400 audit(1782392077.746:234): avc: denied { getattr } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 30.028548][ T30] audit: type=1400 audit(1782392077.746:235): avc: denied { write } for pid=663 comm="syz.0.127" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1