last executing test programs: 5m55.730602094s ago: executing program 3 (id=3416): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000000c0)='kfree\x00', r0, 0x0, 0xfffffffffffffffd}, 0x18) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) 5m55.690217537s ago: executing program 3 (id=3418): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b70400000000000085000000"], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32], 0x0}, 0x94) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000340)='sched_kthread_stop_ret\x00'}, 0x10) syz_emit_ethernet(0x56, &(0x7f0000000280)={@local, @local, @void, {@canfd={0xd, {{0x3, 0x1, 0x1}, 0x22, 0x2, 0x0, 0x0, "c65c08799a3ef730c91a9d5c5d92ef612afde301fc7407be1815b7ae0567bb42d407f0d07e7863e817b2ff341ccb59800dfc8fb7ce207fc61ed8c96114529d9c"}}}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40050}, 0x4000080) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) 5m55.579389896s ago: executing program 3 (id=3420): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000580)='svcrdma_send_err\x00', 0xffffffffffffffff, 0x0, 0x861}, 0x18) r1 = getpid() process_vm_readv(r1, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@fallback=r0, 0x0, 0x1, 0x401, &(0x7f0000000100)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000140), &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000de0000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000001900010000000000000000001c140000fe0000010000"], 0x24}}, 0x4000000) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x101343) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f00000000c0)={0x0, 0x0, {0x0, 0x1, 0x0, 0x0, 0x3}, 0x3}) 5m55.289376399s ago: executing program 3 (id=3424): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000d7c900000900000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32, @ANYRESDEC, @ANYBLOB="00000000000001000000000000000000000016009d112d00f24a36d326f87e470d4961a3f62e6d89e8633c7a0a2e1dd90000000000000000"], 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000b40)=ANY=[@ANYBLOB="7cd6cf003933b78f8acaeff1855b7f17784340f8326a55d82c659f6941ecc06ba7a08075afc120f81d515b216528283eb3bcec8b7bd61d5a8e7669897fe243d92e8f291fbed8837d654ab1981b832ca7886dae3cdcd3f8979faed6e3cc33b3b73baaaea88d961c80889641abcdd7f223747c14627ea3d9d3857b3919fec41d414fa94cbaba6d7bf930a29d8df97788c76357410712d99061e65b98abf8b095b531bc87a67a1cd66d8c5418675136f8083e725b5fd613e9cfe0f9cd7735218d131ca39698864dcab883d7e7ab65fcf3954d26f0fa763798a5240d3b43cc097e90a9fc704ec343621ad2ff354dcb336a2875047f000000", @ANYRES16=r2, @ANYRESHEX, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7c}}, 0x4008000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYRES32=r2, @ANYRESDEC=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000650000000800000095"], &(0x7f0000000040)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000a40)={&(0x7f0000000980)='sys_enter\x00', r7}, 0x10) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000240)='./file2\x00', 0x2000410, &(0x7f0000000080), 0x81, 0x7a5, &(0x7f0000000f80)="$eJzs3c9rXNUeAPDvnfxq0r6XPHjwXl0FBA2UTkyNrYKLigsRLBR0bRsm01AzyZTMpDQh0BYR3AgqLgTddO2PunPrj63+Fy6kpWparLiQkTuZSSbNTJq0mZlgPh+4uefcc2/O+c65P87MvcwEcGCNpn8yEUcj4v0kYri2PImIvmqqN+L02nr3V1dy6ZREpfL6r0l1nXurK7lo2CZ1uJb5f0R8907EsczWektLy7NThUJ+oZYfL89dGi8tLR+/ODc1k5/Jz5+cmJw8ceq5Uyf3Ltbff1w+cvuDV57+8vSfb//v5nvfJ3E6jtTKGuPYK6MxWntN+tKXcJOX97qyLku63QAeSXpo9qwd5XE0hqOnmmphsJMtAwDa5WpEVACAAyZx/QeAA6b+OcC91ZVcferuJxKddeeliDi0Fn/9/uZaSW/tnt2h6n3QoXvJpjsjSUSM7EH9oxHx6ddvfp5O0ab7kADNXLseEedHRree/5Mtzyzs1jPbFVYGqrPRBxY7/0HnfJOOf55vNv7LrI9/osn4Z6DJsfsoHn78Z27tQTUtpeO/FxuebbvfEH/NSE8t96/qmK8vuXCxkE/Pbf+OiLHoG0jzE9VVmz8FNXb3r7ut6m8c//324VufpfWn8401Mrd6BzZvMz1VnnrcuOvuXI94ordZ/Ml6/yctxr9nd1jHqy+8+0mrsjT+NN76tDX+9qrciHiqaf9v9GWy7fOJ49XdYby+UzTx1U8fD7Wqf6P/B6rztP76e4FOSPt/aPv4R5LG5zVLu6/jhxvD37Yqa9z/m8fffP/vT96opvtry65MlcsLExH9yWtbl5/Y2Laer6+fxj/2ZPPjv9X+n6k9G3t+Pbe93tu/fFH7V03jr7rWKv72SuOf3lX/b5Oo1LZ5oOjm/dmeVvXvrP8nq6mx2pKdnP8e0tLH2JsBAAAAAAAAAAAAAAAAAAAAAAAAYPcyEXEkkkx2PZ3JZLNrv+H93xjKFIql8rELxcX56aj+VvZI9GXqX3U53PB9qBO178Ov5088kH82Iv4TER8NDFbz2VyxMN3t4AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg5vDm3/+/ms6y2bWynwe63ToAoG0OdbsBAEDHuf4DwMGzu+v/YNvaAQB0zq7f/1eS9jQEAOiYHV//z7e3HQBA57j/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQJudPXMmnSp/rK7k0vz05aXF2eLl49P50mx2bjGXzRUXLmVnisWZQj6bK861/EfX1maFYvHSZMwvXhkv50vl8dLS8rm54uJ8+dzFuamZ/Ll8X8ciAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICdKy0tz04VCvkFiW0Tg/ujGfsm0Rv7ohn/+ER/12pvPEsMdu8EBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDP/R0AAP//aHclQg==") r9 = creat(&(0x7f0000000900)='./bus\x00', 0xd931d3864d39ddd8) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000480), 0x4) r10 = memfd_secret(0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x4, 0x16, &(0x7f00000008c0)=ANY=[@ANYRESHEX, @ANYRESOCT=r7, @ANYRESHEX=r5], &(0x7f0000000940)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000000c0)={0x6}, 0x8) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r11, r10, 0x2e, 0x4608, @void}, 0x10) r12 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000740)='/proc/consoles\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x10, 0x16, &(0x7f0000001740)=ANY=[@ANYBLOB="1800000007000000000000000800000018110000", @ANYRES32=r9, @ANYRESOCT=r11, @ANYRES32=r8, @ANYBLOB="0000000000000000b703000000000000850000000c0000e3b6000000000000001236eb00f0ffffff09370100d4b12b463778aea3107462c4617afcf1853591000000000000b7020000020000008500000085000000b70000000000000095000000000000007e883d6eb965c2460f36f1d68c7605896ced9ca779a366e09f5a1630a38091657717a70dce375cc81eec42656ef281b18c315e9e4228794227c533d23eb607f74cb6c65d22775d9acf8bf4b8113769e934e4394b7260df3191209bc3047416ac58f336df65dd2c1f018d6052dba9abdc42ee5432ee3effb213ba7007000b85d297981feeef187d1823c69f9c51b33023e1c2963ba2cd25996b7c76e561d8528fa9dd83591f314bb024ade8bde5d02fda007fcf1483b1aa353002c21b4ddcf54951fc928c2f01ad4b453eb8fd5b87f5faca19d604ea75c7e37ccd9dfa93a245d2db8935e651d563a044ce000000"], &(0x7f0000000440)='GPL\x00', 0x8, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f00000006c0)={0x6, 0x1}, 0x8, 0x10, &(0x7f0000000700)={0x1, 0x4, 0x77a3, 0xbb}, 0x10, 0x0, r9, 0x2, &(0x7f0000000780)=[r12, r6], &(0x7f00000007c0)=[{0x1, 0x1, 0x10}, {0x3, 0x2, 0x7, 0xb}], 0x10, 0x272}, 0x94) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x58) mount(&(0x7f0000000d00)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) open(&(0x7f0000000340)='./bus\x00', 0x8000, 0x10) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r9, 0xc018937e, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './bus\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(r13, 0xc0189376, &(0x7f0000000280)={{0x1, 0x1, 0x18, r7, {0x8}}, './bus\x00'}) r14 = syz_io_uring_setup(0xbc3, &(0x7f0000000c80)={0x0, 0x1064, 0x20000, 0x200004, 0x1af}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r15, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r14, 0x47fb, 0x0, 0x0, 0x0, 0x0) r16 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="18010000bc0000000000000000030000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x6, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='kfree\x00', r16, 0x0, 0x3}, 0x18) creat(0x0, 0x44) 5m54.411723809s ago: executing program 3 (id=3435): socket$packet(0x11, 0xa, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="219a53f271a76d2608004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000640)={{r1}, &(0x7f0000000540), &(0x7f0000000600)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaaa20c87982a7c63278b038aaaaaaaabb080045000030000000201e7d55ef6dedfc0290780000001ce00003000306907800fa000945f4fff600650510000000000000"], 0x0) 5m53.239612523s ago: executing program 3 (id=3462): r0 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ipvlan0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c000000100003052cbd7000fedbdf2500000020", @ANYRES32=0x0, @ANYBLOB="0000000000080400240012800b0001006d61637365630000140002800500060000000000050007000000000008000500", @ANYRES32=r1], 0x4c}}, 0x0) 5m53.239491363s ago: executing program 32 (id=3462): r0 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ipvlan0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c000000100003052cbd7000fedbdf2500000020", @ANYRES32=0x0, @ANYBLOB="0000000000080400240012800b0001006d61637365630000140002800500060000000000050007000000000008000500", @ANYRES32=r1], 0x4c}}, 0x0) 48.75792575s ago: executing program 2 (id=8292): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24000000031401002dbd7000000000000900020073797a3000000000080041"], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) dup(0xffffffffffffffff) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000007000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='kfree\x00', r3, 0x0, 0xffffffffffffffff}, 0x18) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000240)='4', 0x1}], 0x1) 48.699182514s ago: executing program 2 (id=8294): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000000e00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r0, 0x0, 0xff}, 0x18) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) (async) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) (async) r1 = syz_clone(0x80841d80, &(0x7f0000000100)="8459e4252ac9b43635a1a367ebc94e9dd187", 0x12, &(0x7f0000000140), &(0x7f0000000240), &(0x7f00000002c0)="b407e899a036482eda36e27b7d67af079396a25f77a1105cd9fd33d290e711423e82a18ac1dc7da93c0f08e0d47c09afd91760c2e1fb89febed113c3c4165986b9b547187404ba4d636da1db07297a01d3393517d542aad638cc8de2490768a7272cbcc01ec2f239b109f6a255908aa9eddf06318fb58667a64a04197f8ddb8f840803e0ceb7a54dce35d79307d76d86ca733b0d9553b98a90a766e46a423ef46596443ffd2f10ac039f779db72b669d8bbfe2f870182c887cc179a084e77501dfa7b9d7a405da7dc4a52925b160448b6415bc23a5f1ade07227b8fe7e64f929c7") r2 = perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x80, 0x0, 0x0, 0x9}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) (async) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) (async) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) (async) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'ovf\x00', 0x11, 0xff, 0xf}, 0x2c) (async) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x30046, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async) close(r2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x22020400) (async) r5 = syz_io_uring_setup(0x83f, &(0x7f00000000c0)={0x0, 0xa9ee, 0x0, 0x3, 0x8002ae}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x109880}) (async) io_uring_enter(r5, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r9}, 0x10) (async) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) (async) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x7, 0x6, 0x101, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048004}, 0x0) 48.462032234s ago: executing program 2 (id=8298): socket$nl_netfilter(0x10, 0x3, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x25, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x80000001, 0x4}, 0x100b28, 0x3, 0x0, 0x1, 0x8, 0x20005, 0x101, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = io_uring_setup(0x54a0, &(0x7f00000002c0)={0x0, 0x0, 0x1, 0x3, 0x276}) r1 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r1, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r1, 0x4) recvmmsg(r1, &(0x7f00000050c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}}], 0x1, 0x40000100, 0x0) close_range(r0, r1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x48084) 47.528530748s ago: executing program 2 (id=8315): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6(0xa, 0x805, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)) r1 = syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x0, &(0x7f0000000600), 0x1, 0x563, &(0x7f0000000640)="$eJzs3c9vFFUcAPDvm/7gR9EWYlQ8aBNjIFFaWsAQ4wHuhOCPmxdXWgiy/Ait0aIHSPBiYrx4MPHkQfwvlOjVkzcPXjwZEmIMRxPXzHamLHS3tGXXqcznk0w7b95uvm9289038/bNbAC1NZn/ySL2RsTlFDHeUTccReXk8uPu/vXJ6XxJ0Wq99WeKVGwrH5+K/2PFk7dHxC8/ptgztDruwtLV841mc/5KUZ5evHB5emHp6oFzFxpn58/OX5x9dfbokcNHjs4c7Nu+nrjx/ofjn51859uv/04z3/12MsWx2FXUde5Hv0zG5Mpr0il/XY/2O1hFhor96XyL03CFDWJDyvdvJCKeifEYintv3nh8+kaljQMGqpUiWkBNJfkPNVUeB5Tn9oM4Dwa2pjvHlwcAVuf/8PLYYGxvjw3svJuic1gnRUQ/RubyGD//dPJGvsSAxuGA7q5dj4hnu+V/aufmRHsUP8//7L78zyLiVPE/3/7mJuNPPlCW//DfeZT8f7cj/9/bZHz5DwAAAAAAAP1z63hEvNLt+79sZf5PdJn/MxYRx/oQ/+Hf/2W3+xAG6OLO8YjXu87/zcqHTAwVpSfa8wFG0plzzfmDEfFkROyPkW15eWaNGAc+3/NVr7rO+X/5kscv5wIW7bg9vO3+58w1FhuPss/AsjvXI57rOv83rfT/qUv/n38eXF5njD0v3TzVq+7h+Q8MSuubiH1d+/97d65Ia9+fY7p9PDBdHhWs9vzHX3zfK778h+rk/f/OtfN/InXer2dh4zEOLQ23etVt9vh/NL3dvuXMaLHto8bi4pWZiNF0YvX22Y23GR5HZT6U+ZLn//4X1x7/63b8vyMirq0z5tP/jP3eq07/D9XJ839uQ/3/xldmb0780Cv++vr/w+0+fX+xxfgfrG29CVp1OwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/yiLiF2RsqmV9SybmooYi4inYmfWvLSw+PKZSx9cnMvr2r//n5W/9Du+XE7l7/9PdJRnHygfiojdEfHl0I52eer0peZc1TsPAAAAAAAAAAAAAAAAAAAAW8RYj+v/c38MVd06YOCGq24AUBn5D/Ul/6G+5D/Ul/yH+pL/UF/yH+pL/kN9yX+oL/kPAAAAAACPld0v3Po1RcS113a0l9xoUTdSacuAQcuqbgBQGbf4gfoy9Qfqyzk+kB5Sv33TzwQAAAAAAAAAAAAA+mXfXtf/Q125/h/qy/X/UF+u/4f6co4PuP4fAAAAAAAAAAAAALa+haWr5xvN5vwVK1asWFlZqfqTCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKP0bAAD//zn7JB8=") r2 = open(&(0x7f0000000180)='./bus\x00', 0x14937e, 0x111) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x6b2, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8, 0x10000000000]}) write$binfmt_script(r2, &(0x7f00000004c0)={'#! ', './bus'}, 0x9) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000002c0)=ANY=[@ANYRES8=r0, @ANYRES8=r1, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r4}, &(0x7f00000008c0), &(0x7f0000000880)=r5}, 0x20) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x9c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x6c, 0x2, {{}, [@TCA_NETEM_LOSS={0x30, 0x2, 0x0, 0x1, [@NETEM_LOSS_GE={0x18}, @NETEM_LOSS_GI={0x18}]}, @TCA_NETEM_RATE={0x4, 0xd}, @TCA_NETEM_CORRUPT={0xc, 0x2}]}}}]}, 0x9c}}, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x25, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x0, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) 46.906015508s ago: executing program 2 (id=8323): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24000000031401002dbd7000000000000900020073797a"], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r2, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r2, 0x0, 0x0) write$ppp(r2, &(0x7f0000000480)="ac4a", 0x2) 46.337962614s ago: executing program 2 (id=8331): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24000000031401002dbd7000000000000900020073797a"], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r2, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r2, 0x0, 0x0) write$ppp(r2, &(0x7f0000000480)="ac4a", 0x2) 46.337583874s ago: executing program 33 (id=8331): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24000000031401002dbd7000000000000900020073797a"], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r2, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r2, 0x0, 0x0) write$ppp(r2, &(0x7f0000000480)="ac4a", 0x2) 4.497024819s ago: executing program 0 (id=8619): bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x10, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000028c0)=[{{&(0x7f00000006c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000000b00)=[{&(0x7f0000000880)=""/211, 0xd3}, {&(0x7f0000001200)=""/4096, 0x1000}, {&(0x7f0000000c40)=""/27, 0x1b}, {&(0x7f0000000980)=""/116, 0x74}, {&(0x7f0000000a00)=""/232, 0xe8}], 0x5, &(0x7f0000000b80)=""/106, 0x6a}, 0x3}, {{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f00000003c0)=""/49, 0x31}, {&(0x7f0000000440)=""/9, 0x9}, {&(0x7f0000000740)=""/51, 0x33}, {&(0x7f0000000c00)=""/51, 0x33}, {&(0x7f0000000c40)}, {&(0x7f0000000c80)=""/237, 0xed}, {&(0x7f0000002200)=""/178, 0xb2}, {&(0x7f00000025c0)=""/120, 0x78}, {&(0x7f0000002340)=""/98, 0x62}], 0x9, &(0x7f0000002480)=""/62, 0x3e}, 0x2d69cb67}, {{0x0, 0x0, &(0x7f0000002500)=[{&(0x7f00000024c0)=""/14, 0xe}], 0x1}, 0x7}, {{&(0x7f0000002540)=@tipc=@id, 0x80, &(0x7f00000026c0), 0x0, &(0x7f0000002700)=""/141, 0x8d}, 0x80000001}, {{&(0x7f00000027c0)=@l2tp6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f0000002880)=[{&(0x7f0000002840)=""/24, 0x18}], 0x1}, 0x8}], 0x5, 0x2, 0x0) 1.914093756s ago: executing program 6 (id=8625): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r1 = socket(0x1, 0x803, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0700000004000000080200002100000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000053211f56819e41420000000000"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000001850000001b000000b70000000000070095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kfree\x00', r3}, 0x18) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="8fedcb7910009875f37538e486dd6317ce8102033300fe08000e40000200875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084503, &(0x7f0000000540)=""/209) r4 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_FREE_STREAMS(r4, 0x8008551d, &(0x7f0000000180)={0x8c30, 0x1, [{0xb}]}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)) socket(0x10, 0x3, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001c80)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x80001, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x7ea}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0xfffff800, 0x40, 0x1, 0x3, 0x80000001}, 0x2}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4008044}, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$packet(0x11, 0x2, 0x300) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x26, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x8, 0x6}, 0x0, 0x6, 0x0, 0x1, 0xa, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x7fffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000380)=[{0x200000000006, 0x1, 0x7, 0x7ffc1ffb}]}) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x18, 0x3, &(0x7f00000001c0)=ANY=[@ANYRESOCT=r1], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r6, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) statfs(0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001880)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000004000008000500", @ANYRES32=r9], 0x50}}, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r10}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) 1.511082218s ago: executing program 6 (id=8627): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000c00008e3af2db1a4635f6c0", @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x29}, './file0\x00'}) 1.483484871s ago: executing program 1 (id=8628): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @lirc_mode2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r1, 0x0, 0x2}, 0x18) r2 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x480c4}, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000400)=@newtfilter={0x88, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xfffa}, {}, {0x5, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff8, 0xfff, 0x0, 0x5, 0xb}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x88}}, 0x24000000) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.450928343s ago: executing program 0 (id=8629): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x14, r1, 0x1, 0x0, 0x25dfdbfd, {0x54}}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x8000) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01", @ANYRES16=r0, @ANYRESOCT=r0], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYRES16=r2, @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x593, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r3, 0x0, 0x3}, 0x18) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r5}, 0x10) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) close(r6) accept(r4, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000f0f000000000700000a20000000000a01030000000000000000010000000900010073797a310000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000050900010073797a3100"], 0xc4}}, 0x0) 1.426138735s ago: executing program 1 (id=8630): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1094a}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) ioctl$TIOCGPTPEER(r1, 0x5441, 0x3) 1.36604518s ago: executing program 0 (id=8632): r0 = socket$l2tp(0x2, 0x2, 0x73) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @broadcast}, 0x10) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000080)=0x14, 0x80800) getsockname$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000100)=0x14) newfstatat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) quotactl_fd$Q_QUOTAON(r1, 0xffffffff80000201, r4, &(0x7f0000000200)='./file0\x00') setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x0, 0x0, [0xd4e8, 0x1000, 0x2, 0x80, 0xfffffffffffffeff, 0x8], 0x6, &(0x7f0000000240)=[{}, {}, {}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}]}, 0xd8) r5 = openat2(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x200981, 0x17}, 0x18) r6 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_SIOCINQ(r6, 0x541b, &(0x7f0000000440)) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r5, 0x111, 0x3, 0x0, 0x4) r7 = socket$inet6_sctp(0xa, 0x4, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r5, 0x84, 0x70, &(0x7f0000000480)={0x0, @in6={{0xa, 0x4e21, 0x3, @local, 0x2}}, [0x6, 0x80000000, 0x2, 0x80000000, 0x100000000, 0x0, 0x3, 0x3cdfdf2f, 0x4, 0x2, 0x9, 0x40, 0x80000001, 0x6, 0x401]}, &(0x7f0000000580)=0x100) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f00000005c0)={0x0, 0x5, 0xd, 0x1, r8}, &(0x7f0000000600)=0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), r5) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000740)={'syztnl0\x00', &(0x7f00000006c0)={'syztnl0\x00', r3, 0x29, 0x1, 0x2, 0x4, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast1, 0x8, 0x7, 0x1, 0xfffffffc}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a40)={r5, 0xe0, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000800)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x3a, &(0x7f0000000840)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000880), &(0x7f00000008c0), 0x8, 0x8, 0x8, 0x8, &(0x7f0000000900)}}, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r5, &(0x7f0000000c40)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000a80)={0x14c, r10, 0x800, 0x70bd2b, 0x25dfdbff, {}, [@HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @HEADER={0x78, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6tnl0\x00'}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x14}, 0x20000100) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000c80), &(0x7f0000000cc0)=0x4) lstat(&(0x7f0000000d80)='./file0\x00', &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$tmpfs(0x0, &(0x7f0000000d00)='./file0\x00', &(0x7f0000000d40), 0x3000000, &(0x7f0000000e40)={[{@grpquota}], [{@fowner_gt={'fowner>', r4}}, {@fowner_eq={'fowner', 0x3d, r13}}]}) sendmsg$nl_route(r5, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)=@bridge_getneigh={0x48, 0x1e, 0x1, 0x70bd26, 0x25dfdbff, {0x7, 0x0, 0x0, r2, 0x2240, 0x180}, [@IFLA_TARGET_NETNSID={0x8, 0x2e, 0x2}, @IFLA_LINK_NETNSID={0x8, 0x25, 0x4}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_CARRIER={0x5, 0x21, 0x6}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x1) r14 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001000), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r14, 0x84, 0x16, &(0x7f0000001040)={0x7, [0x8, 0xa, 0x65, 0x0, 0xff, 0x5, 0x6]}, &(0x7f0000001080)=0x12) ioctl$PIO_FONTRESET(r14, 0x4b6d, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f00000010c0), &(0x7f0000001140)=0x68) write$P9_RREADLINK(r14, &(0x7f0000001180)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f00000011c0)={r9, 0x292f, 0x4}, &(0x7f0000001200)=0x8) sendmsg$nl_route_sched_retired(r14, &(0x7f00000014c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001480)={&(0x7f0000001280)=@newqdisc={0x1dc, 0x24, 0x200, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0xd, 0x5}, {0x4, 0xffff}, {0xffff, 0x9}}, [@q_dsmark={{0xb}, {0x24, 0x2, [@TCA_DSMARK_INDICES={0x6}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x1d}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x5163}]}}, @q_dsmark={{0xb}, {0x28, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0x10}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0xc}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x1c5}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x49c4}]}}, @q_dsmark={{0xb}, {0x14, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0xe64f}, @TCA_DSMARK_INDICES={0x6}]}}, @q_dsmark={{0xb}, {0x44, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x9}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0xa}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x1}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0xd1d}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x4}, @TCA_DSMARK_INDICES={0x6}]}}, @q_dsmark={{0xb}, {0x34, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0x30}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x2}, @TCA_DSMARK_INDICES={0x6, 0x1, 0xc}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x28}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x1}]}}, @q_dsmark={{0xb}, {0x2c, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0xb}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x401}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x5}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x7}]}}, @q_dsmark={{0xb}, {0x4c, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x4}, @TCA_DSMARK_INDICES={0x6}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x24}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x2}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0xa}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x10}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x1e}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x4}]}}, @q_dsmark={{0xb}, {0x8, 0x2, [@TCA_DSMARK_SET_TC_INDEX={0x4}]}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4000000}, 0x400c010) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r5, &(0x7f0000001800)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000017c0)={&(0x7f0000001580)={0x240, 0x0, 0x400, 0x70bd28, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x1}, {0xc, 0x8f, 0x70}, {0xc, 0x90, 0x7ff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x1}, {0xc, 0x8f, 0x6}, {0xc, 0x90, 0xf}}, {@pci={{0x8}, {0x11}}, {0x8}, {0xc, 0x8f, 0x10001}, {0xc, 0x90, 0x9}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x1}, {0xc, 0x8f, 0x7}, {0xc, 0x90, 0x2}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x1}, {0xc, 0x90, 0x9}}, {@pci={{0x8}, {0x11}}, {0x8}, {0xc, 0x8f, 0x4244}, {0xc, 0x90, 0x7}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x2}, {0xc, 0x90, 0x2}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x1}, {0xc, 0x8f, 0x4}, {0xc, 0x90, 0x7}}, {@pci={{0x8}, {0x11}}, {0x8}, {0xc, 0x8f, 0x2}, {0xc, 0x90, 0x40}}]}, 0x240}, 0x1, 0x0, 0x0, 0x400c0d5}, 0x20000004) 1.36492075s ago: executing program 6 (id=8633): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x64, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44c094, 0x2, @perf_config_ext={0x9, 0x6}, 0x8, 0x0, 0x800000, 0x6, 0xfffffffffffffffe, 0x2, 0x9, 0x0, 0x0, 0x0, 0xbc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0xc, &(0x7f00000006c0)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x40e00, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xffffffffffffffff, 0x9, 0x0) syz_usb_disconnect(0xffffffffffffffff) utimensat(0xffffffffffffff9c, &(0x7f0000002240)='.\x00', 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000001bc0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRESHEX=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r2, 0x0, 0x400007}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000080000000000000000000180100003020702500000000002020207b1af8ff00000000bfa1000000000000070100003affffffb702000008000000b7030000000000a3850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000880)=ANY=[@ANYBLOB="58000004100039042abd7000eafff7ff000051e4", @ANYRES32=0x0, @ANYBLOB="03000000c31006003800128008000100736974002c00028006000e000010000008000300ac1414bb08000200ac14142d08000c00ee0000000800140001000100"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x4008040) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000940)="46aac5dead586ff73709a62c48785d2d172103b967ae1abc02cef2e3956a83f53aeae1a892e33bafd37730e3a2", 0x2d}, {&(0x7f0000000ac0)="62ce8d319f61858ce27516db475f5168456fbe4d39719e3947b742413024b48eca98759c7d411c7e2395c8f3841328a77f3dd21850f82796312ce786907ff16dc963af7223f231653a18cd3605d3587a8f605ab249ae0dbe37372a7e44882f805fd8d1a28fbe6e28393053be9de48c4c0987d2666df734ed87e7cf43c057795025ab798b019cb9b6cb897435bd7c00b2fed4ee3047e8b4eae7a55120ccff993284b9096df33d1a57c943640d1b06c3406fd499a26e185b8125c144a91a657525837bda2a34983ce909978e33d90c9b6e04b14a92af8dc8bc0c3cf4ebbb5e8616ea8d6ccf0cd1e02dbd2b032951cd019c1ec71ae486580b1a14628fa5a816dd50a40d072d69b1532af014bb4cb73058630a8c10c0d710d9478c6ed9407034acbeda335ae85fe82f68eb3105640c99cdb3f3404555e913f7f6adc07021a52f4d727bca8f9f7dd73381ef33081ec778aed2ecfc7e6976561664f1657146fa640e7162ab664e0d78c12b4790ae7dddaefd5a0d0ab16be1fde14daef5c7f44b89ebd72a3bff3bd7eeb7adb2ee2181f59aa97f13351f9afe783eb4a2664648fa18fbbb7de51b161e51669374b9cdae62c10c5fa5109462e830dd6f773371d0acccc5a49c7cbccb774dea04335d753adbba3383299eb49f70b7aae8192e238530f71fdbb91f6f502c80fc2a2fe2645ecccb5c4dcbafb3321c79d24d5b3f52f4a1930ddf27e7b78a72aee6f46490c39af236662cdf0e1e996c765d74f6f667a1ebce100f618bcad5a0bf1a3f10633934eca661f268a0110740cedf6771915d4edd6ac6e5d5f6faac0304cffac49fa3068b2924885c5d732182b98607f81f16aafc9d6710a1792d1ecbfce2f9da0740b9a64ccd53e021f89fbfacb109e38ad2dfa2923dc8f383a72eadfe7b04e276e84c0774316b14fc535033ff84e8da9a74b100e60773e3c3a7438d30dd78cd6f9c4b1b53928b1cd89765c52b0f9eca9e38113791416b3877b32421575816a0caf20eb53918ce2c6ee32ac2ab3b71ec02a03691540a582ea229b53c296e76718e63e00131a91eafa850b738e06ae4d08003305d66fee007d51ca77036d19b91c04d6efa64d37cb4c08a25a3ce300bb6a83ade00685ce9a8ba385231a85f660b842a41ad873c15c1ac1d7963697c277c054ef49273bc4b80d5701ed920fb9d9375baaf1bde06e5acf0db81050e1ee45c53444b1d6979c996648bdcd2d6e3761cb46ccddb5500729db23a042fa4446f67b348b1ed520aa7863a095787ef159d3ae9efde787046310938d89141a4f428c453988e7b55e7ad35a39cd1276780741ce2b83c29afb9f46f622c1e99a394cedd3fb697b02ac4f4368326a4dd8657572f791c16c034eb4f76e9e2952102a4060c68bf3d98a01043092ca9ba187a59ee600d8395d13bd41d8e4d3d282e7ade10dcb8d75df9fded2703cbbf6f099f74de9e9d2f65f16ac6a4f19c3705d74da649cf0291fa3ac0096ff9718c01738dd363692ce2159833eb85875d59a80adc9079942f0a5a38cd62f63531fc4afa5f94ab0ae0631bc0efc187fa33078c98ab6d57dde5695c4229be2dcd637a4e2feb03837420ed3782839659d7b4fef7532f4bda6d8356589cec6562fd6887dbc449e454d2a0e834574f457348984249266756862e9737cc483f551b2804e4dc95119eb8c8685a23b7a0de440ba9c51f8bae6f7994328db5d990bf5b6e9d80f71b7c9c6ed61ef85ce37d7da4152f23e6518f903be10158bea8fefddfd21e188f939c06877df5b4c7b2ca0b253f5d7cddba9d633388d5be847cd9aeb8e03691ca580cf3ac807904f3b08b8909ff9b31849a193e3e7dd6af66f732d6ff1ba5c0585c2f644614c1104634538e35dedc9b4facaeffbf650a62746aa28c1928b01395d279520208f7100b8ce2ec129f85e8352b6444642c0e11c082bfd0c95c17da78c36a46ff172b5464c115a672ee57891e1c5ff7b92caffeee9fde6c3e130f072fa0b296575f97c504dfd901260f1be1eb454171615921957ba7139bc548b9b71b692105e9fce94653ab4f24020b0485e9eab4f5fb0c0cb3778c316974a8978597f56f258b2e0000680ada025d0ea9a1af9c5feb04221ed0e5aeed2504df1f87abd6662cca24d1e0d12eee2f0617abaf593488c5cbda1584301d997741c9db2fa4453b117f164011e83336cd1e1a0d542a6eecdbd1eb3611b41d7580c08d26400e0bf2706db799ec709be3814ce9fe3ae25a003571aed3ffa9e6459698618897b4c9059c5fcde99f34af3fc01a6766d84110b1892fbadf5509097909f0dd5ef4f2d59f43e2025b73022b4964c165931cb2c569b31601a8268f24ca859fe37a58fdabf0c260e50fc496218a64f39c6db8110c302b2a8669f2fed242d036570b66dc4ad9ec7c41bc3d566a689b96f950464fc6d779e3cf6546897c697df1668652b4d5ed37691bf94336fa238a4029a68ed9c74049920f84599d546f3c00c5958466f980b4bea50a522734f4616e9c2168ad132cec5b625b9e2910830a580afc87446ad3408d3334383cd1fbdd83ea8efabb52b4b4a6b1a3f5ea78f3923cbc9b0570a60b5bb1efe392f4329a1a96efb00d919e9b2d526e1057956f98c2546a018ece7f6187b366639ab273f16ad6f5de6651512c3925348b6d1c0d5ef7a151f831314e035d0aa9bed206959283098b0ee38f0b13dec0b8b1c26b350148806626ec78e12aafc7d712ee5ae2b2ff637b7fc904acabaf286a48832f39aea38da4af028a8b5e33332296757ee0be546fbc404191408f3d198a537dc0163a31f7add4c809b90dd6900f24ca079f23dc6b48efa46f14cda7631819e8e21566619e5030d62f8b5d97a82ad488387755954b1ca780caa76be10ddf3b85f93bcfb9a927533dd2cf1816e944a9af49783485155c8fe672f860ce4c99e7acc56d3a70861a7026f02b7740e2a6b20c00c47b50a0e55e4ba1cf91107dcfc0c841e2589ffab5775be3f7ca6652234ee185839f9fda001a5bc356442c62c8ea93b74beb3334b12582ab8c63ab50654574a053db7d12afa6229f1d29d44840ba73ef7b1653102fcb1dee827b809559a5225d4eb74e317ea1094779179b5e9ad7bbd59f794b61ec1233920a480a7c110a7c336ffac90bf47df1133b158ded1277a07ef8e9ae32ceb132163084714075fe56a8097afc978bc9868d726d23d83935b3eed124c2c0e5a1ed505fd72d8c73ddb00a6d795afe0b0842e35fb7881e121cd35b7b478ced578283cba394e823ca1d91f062d665b3f96da303a948fce64f8b322cb2f625eb9cae44bc6030c9ea46dd1da6e8f77b9a2ca949ee31740a4f67ff50606f017c16366ac44421834fb58822e7fd3543c73b1b1e246e0fe425c8aec177f1098df7a9d7885ec69797d16097012664b3286e1dc2ace0d560410a5df45b30ec94e51739adb416c9ab78dac42bd2afa68996ac43c13c5cbb8ab0ceefa6b03a91f5110bb8330d6f88a800ca01c135892ec60a4f413f526485be446e3f087f278992669c1a0325ae3f16981f37ace57e35117cf23941b1403d2a0e442af1376a8baa52fa62bd784267b82234fbea288f96a1d1883e3fafa599fb0fff98d5f60de9b81107ffad0d93cd4192ebaab5879bb319d0b7482e9913c45ae1ae737648dda82a93ce1387c1765d1180d90b0a1992d14f8e626edb401e58890794e2032fc0320d4a96cccb03d8d54cc91d3424f038c7b6054d98beb6346cb003912ff00e1c23cdefedee8f59f0f48726cd6a715d0af0258fa35339bdfa562666e36b4743c7949f24af888de99d0b4da024b010015bf568e585fd98f855e65abbf6aa85f41491ff289062ba1c1f5485f002f13e8736be3094eb0cd28ed1c5ccd56292ec55edd419fa3e0166c2fef1e96a95d4847c1f7a6410784bc026c5cc69ebe15ff11fd4fa4b648c22055ea0c3b9aba49ed01494b842f8837903c6bfbb7f5381cfd2a5fd2e0fec3274517341b0e2058b11a3512a7ce3811cfb7c9f20cee2cf80fe225506939dc80385f960b04448cc212472ccf1e622272b5adc0d4fe9ca34581240bd0864f5114f480fc8907d2fb79407c0b3392dac6849a1d40de6388cd4e73050f74bb40f43f2a51b4282d80099265c4c82fe7efa32a2e65c335c9a3c830c1df5a389bde64b7b3f027e795b87f0502a4964eaaf8c1bbfdb31d7d7ce8057f08bb06061cbf7e4fbbb675c3d776aaa707ecc6df249d5c664ac80de8b2f38abb8b1b3b5793f4c283ec2943154685c9e35fa9412baa1fd871701ae47975e32f3c7892fb569b35f7c4a2600d6ef704444b00c32a0c65e90f8a74e5f621a2a73879b4b4f0ba68ac94eb1b686734f68bc495443055cd4c4385f2d72c6b5f800f550459490cadabde3809b20202bdf376701062ce3a08b170f900244373a9eda538df6135bdc589b391d89e8d21f75070cff30423acf53a9357e4f8ef7b5628c8c2f4f69fece9df13fb467f6ae68db28cb777f9cb7ecab6584c78b203e2f07ddb9af0c9da42a2a2912c94529a8d3906e1a158e17368875d84c49ba568020d603631bd353590a97f7fa22e78adf0aac23979e8b157ce92818d0457dba729cc8ed7bfbda618ce890bf38c2b4f40571d212560616290ebea69ecef07b78808e887ace40097d3d5ba75ac5ac10a5ea4b53e4ff56a4d78a8baad299e579e21e55bc4a2b3bee35014632c587205a626a7fb6a01a7579d9d285cad71fb55a844557381b3d1fdc4198f231eebe77619434c4a6e26a8a24c911b0443fcd5ccb5b46e5f749234861f84cb79ad67c9cb207a3d8fd5786f82bc727f0949a93bc968daf91dbf45a8dcf03e837fe639668f2a101396644921840f3bb284a81725bafe496cf36bef74b75a2f1bd80482d884d8481ee734faadad37e6996114d503d232237f8bd5ba27227cfd43eec6bea9b91ca1f119e06baf72293079238445f43c3bc98c64238f87ecedc0cc79e375bc3ea98fdf574c986a15826e48b678af2daa91127620b0f9662230bcd987b8dea49307ef6faea0f6b1e6a53e2270b33758488427cc219d33bf0e25537ec57a2b694a0e03e5ccd26f59cbabaa2f38f088becccdb40f6aeef4bd3262c8f4bc516ff5d78eeb599c094ba7319705453932f76d5780fdbcb23d8d53214547f7a64a4bb1882cb3236563c8dd455939913152bcf24eb1269bd0270df21437ad2ce7b5ee944731d01fffa973eafd1d45fbdfb37c2c4dab956fa395b94d7acd0bd96e62d010d7bd00f76079ec0fe7859427cd590d82fcc84bf20c9c7dda1ee2f5bc1314a6bda26f642ac00c95bd2b5629f28e821e93a2a887f819d2a3509612061a48477f8c73a722473ef0db0781a85c8b72c23ffe7e429c804d22d79933efc500eb47954370452e4b8d02525257a5a944271c7d6a5a0b09ecdfd4d2a3e72c45d7a1f05555c0f684c28e5b072c7055e3f600528e7344f127d074a4822cffe47a333b2c8cb40e0d24c130905f561fd35ea35ea94077bd5f87d3d148ed5c3f157cbfbad59dc867a625a2faf222f79099ee0294dfd8934faa121ee8182777b0a57d9cbd89d4b2a865591205d1de658fa15ff9ca59a1344c8b875391a37b71af169c790abb9ae23590e7dfddca4e5b9a1be8002d5b48acc69c2b606bf2be721f6c510dd53512d8b376f5cbc7750bf08681520f05cc5060167d6871da15b572bd59e999d8b7f8adbdb2bc1e6c6304275fd1c49ac25f6d2a7abd1425b32e659261a0c43480059ab4c6b66183c547c084c12a892625c04b7775a3b4ba11473984df44e9980ad5b63676fc0", 0xf55}, {&(0x7f0000001ac0)="b7444cd2795795be7f491818a72f8e61de2f41a31125dd9861ecd1cd4c08f1d1d1ea7af6e2d20abea4a37551083457239f68196dcace66c2d5de37f9ccf3684d7fad4017d37ed62e22de65c8f6247402eb1212cf418b37cb04922a1539fdef15771f3136ac4a69d464891805c74c400fa8f00d858a61c5b3a4f78c337e5236ced4abd08b45bd5ac0218f263234daa1d6b2d6f90d2039e4a791cc0c989bf90c424cff3cb58fd826082376189da12c5f2c577102823ae39b4e46097a1f69d582b5df0b28ff355b95d54e4364953226fb415a07ef", 0xd3}, {&(0x7f0000001c80)="2fda27044e78bb4749f9f2e5d17f5d8918d9d88977d02b86e203311ef67b6d69c4acc7dedd6d9ce84b6b6f464daf937781a297968df0ef42606708c1a66d331edb0cb646848a3d1b1e9c11574ac76cc952009748d1fa9550da1e4b64297747f1868412dca7c736c0057d48c4e274010d3f2e997a7ee89799f1b577bd1f04744d9ddc837fedcd151f0a2475b218700ea19160b338e13d9241473737471d78d9e0fd319fa469ea52db5545050aed4370bf4b59b1bb66c4a3989c2756406ab49ca809898d638ac4052be098ee4a86e130c6c6ae", 0xd2}], 0x4}, 0x24008851) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a11800150006001400000000120800030043000040", 0x30}], 0x1}, 0xc001) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0xfe33) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000003c0)=0x11) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='kfree\x00', r4, 0x0, 0xffffffffffffffff}, 0x18) r5 = perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x40082406, &(0x7f00000001c0)='cpu&00\t&&') dup(0xffffffffffffffff) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000740)='./file0\x00', 0x759, &(0x7f0000000780)={[{@noload}, {@max_batch_time={'max_batch_time', 0x3d, 0x7}}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x40}}, {@errors_remount}, {@nouser_xattr, 0x0}, {@data_journal}, {@journal_dev={'journal_dev', 0x3d, 0xf}}, {@i_version}, {@nobarrier}, {@debug}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xb6a}}, {@data_err_ignore}], [], 0x2c}, 0x2, 0x4f9, &(0x7f0000000200)="$eJzs3ElvHFUeAPB/te04zjL2ZNYsM+mZzAgLRBw764FDgkDKBQkJhMLR2E4U4iQoNlISWcRBKEgcQPkELDckPgEnuCBAHEBcibgipAj5ksABFarqatN2ub2l7cbx7yd151XVq37v31Uv/ZZuB7BpVbOnJGJHRHwXEb21zbkZqrV/7s9Mjfw8MzWSRJo+91OS57s3MzVSz1o/b3ux0V+JqLyRxN5ysd0T165fGB4fH7tS7BiYrBSpi8Pnxs6NXRo6ceLI4Z7jx4aOtiTOrE739rx2ed/u0y/efmbkzO2Xvvgoq29aHG+Mo6Yvf96y7BI6SnuqUZ37Xjb4//KrviHsbEgnndlzpX2VYdmyuza7XF15+++Njnyrpjeefr2tlQPWVJqmaXdp7+xn2XTaKElqJ6TpzRR4CCTR7hoA7VH/oL83k41Up0bK4+CH291TkY+AsrjvF4/akc58BFvtq42Nutao/L9GxJnpX97NHrHgPAQAQGt9cipiW9HvqD9qRyrx94Z8fyrWhvoi4s8RsSsi/lL0X/4Wkef9R0T8s+GcHctYBajO2y73f77pKRKN3dWWyfp/TxRrW3P7f7M17+sotnbm8XclZ8+Pjx0q3pP+6OrOtgfLLz07rfbpU9++06z8akP/L3tk5df7gkU9fuycN0E3Ojw5/KBx1929mb+xN8rxJ9GZ1FMRuyNizypeP3vPzj/64b5mx+fEn8VZiv/t5i/euYoKzZO+H/FI7fpPx7z4o1j/S/L1yYuvDExcu/74+cb1ycHjx4aODmyN8bFDA/W7ouzLr289WyRLw4hFrn+9aazpQlp2/bcteP/Prlz2ZanZ9dqJlZdx686bTcc0q73/tyTP5+n6+uzV4cnJK4MRW5Lp8v6h38+9OtwzJ38Wf/+Bhdv/rohf3yvO2xsR2U38r4j4d0TsL+r+n4j4b0QcWCT+z5/838vNhpBLx7+2svhHV3T9myVOfhWx8KGOC599XCr4rWop/q5odv2P5Kn+Ys/o8OTWpeJarKaNiQd+AwEAAGAD2J/P0yaVg8VE046oVA4ejNg+O4MyMfnY2cuvXhqtzef2RVelPtPV2zAfOljMDWfb2VlDDdvZ8cP5vHGapmlPtp2N38d3tjd02PS2N2n/mR/KP2kBHjYrWkdr9os2YEOa3/7vLPvM1n8hA1hfLfgeDbBBaf+weS27/a/Vr+CAtlmo/d+IuN+GqgDrbKH2/0Jpz8l1qQuwvoz/YfNaffv3ZQDY6Hz+w6a0rB/JryKx6/QieZLOtSm0eaISi/8VgL6I+p56n2bxF/y+EtGaGna0NNKeOde0smCerdGKsqKyZJ7OFfwhhvVNVP4Y1agluiNiibt39ma7UU9cX+uK5Y3gg/b+7wQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDgfgsAAP//RUTTKw==") 1.349453201s ago: executing program 1 (id=8634): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x64, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44c094, 0x2, @perf_config_ext={0x9, 0x6}, 0x8, 0x0, 0x800000, 0x6, 0xfffffffffffffffe, 0x2, 0x9, 0x0, 0x0, 0x0, 0xbc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0xc, &(0x7f00000006c0)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x40e00, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xffffffffffffffff, 0x9, &(0x7f0000006680)) syz_usb_disconnect(0xffffffffffffffff) utimensat(0xffffffffffffff9c, &(0x7f0000002240)='.\x00', 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000001bc0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRESHEX=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r2, 0x0, 0x400007}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000080000000000000000000180100003020702500000000002020207b1af8ff00000000bfa1000000000000070100003affffffb702000008000000b7030000000000a3850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000880)=ANY=[@ANYBLOB="58000004100039042abd7000eafff7ff000051e4", @ANYRES32=0x0, @ANYBLOB="03000000c31006003800128008000100736974002c00028006000e000010000008000300ac1414bb08000200ac14142d08000c00ee0000000800140001000100"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x4008040) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000940)="46aac5dead586ff73709a62c48785d2d172103b967ae1abc02cef2e3956a83f53aeae1a892e33bafd37730e3a2", 0x2d}, {&(0x7f0000000ac0)="62ce8d319f61858ce27516db475f5168456fbe4d39719e3947b742413024b48eca98759c7d411c7e2395c8f3841328a77f3dd21850f82796312ce786907ff16dc963af7223f231653a18cd3605d3587a8f605ab249ae0dbe37372a7e44882f805fd8d1a28fbe6e28393053be9de48c4c0987d2666df734ed87e7cf43c057795025ab798b019cb9b6cb897435bd7c00b2fed4ee3047e8b4eae7a55120ccff993284b9096df33d1a57c943640d1b06c3406fd499a26e185b8125c144a91a657525837bda2a34983ce909978e33d90c9b6e04b14a92af8dc8bc0c3cf4ebbb5e8616ea8d6ccf0cd1e02dbd2b032951cd019c1ec71ae486580b1a14628fa5a816dd50a40d072d69b1532af014bb4cb73058630a8c10c0d710d9478c6ed9407034acbeda335ae85fe82f68eb3105640c99cdb3f3404555e913f7f6adc07021a52f4d727bca8f9f7dd73381ef33081ec778aed2ecfc7e6976561664f1657146fa640e7162ab664e0d78c12b4790ae7dddaefd5a0d0ab16be1fde14daef5c7f44b89ebd72a3bff3bd7eeb7adb2ee2181f59aa97f13351f9afe783eb4a2664648fa18fbbb7de51b161e51669374b9cdae62c10c5fa5109462e830dd6f773371d0acccc5a49c7cbccb774dea04335d753adbba3383299eb49f70b7aae8192e238530f71fdbb91f6f502c80fc2a2fe2645ecccb5c4dcbafb3321c79d24d5b3f52f4a1930ddf27e7b78a72aee6f46490c39af236662cdf0e1e996c765d74f6f667a1ebce100f618bcad5a0bf1a3f10633934eca661f268a0110740cedf6771915d4edd6ac6e5d5f6faac0304cffac49fa3068b2924885c5d732182b98607f81f16aafc9d6710a1792d1ecbfce2f9da0740b9a64ccd53e021f89fbfacb109e38ad2dfa2923dc8f383a72eadfe7b04e276e84c0774316b14fc535033ff84e8da9a74b100e60773e3c3a7438d30dd78cd6f9c4b1b53928b1cd89765c52b0f9eca9e38113791416b3877b32421575816a0caf20eb53918ce2c6ee32ac2ab3b71ec02a03691540a582ea229b53c296e76718e63e00131a91eafa850b738e06ae4d08003305d66fee007d51ca77036d19b91c04d6efa64d37cb4c08a25a3ce300bb6a83ade00685ce9a8ba385231a85f660b842a41ad873c15c1ac1d7963697c277c054ef49273bc4b80d5701ed920fb9d9375baaf1bde06e5acf0db81050e1ee45c53444b1d6979c996648bdcd2d6e3761cb46ccddb5500729db23a042fa4446f67b348b1ed520aa7863a095787ef159d3ae9efde787046310938d89141a4f428c453988e7b55e7ad35a39cd1276780741ce2b83c29afb9f46f622c1e99a394cedd3fb697b02ac4f4368326a4dd8657572f791c16c034eb4f76e9e2952102a4060c68bf3d98a01043092ca9ba187a59ee600d8395d13bd41d8e4d3d282e7ade10dcb8d75df9fded2703cbbf6f099f74de9e9d2f65f16ac6a4f19c3705d74da649cf0291fa3ac0096ff9718c01738dd363692ce2159833eb85875d59a80adc9079942f0a5a38cd62f63531fc4afa5f94ab0ae0631bc0efc187fa33078c98ab6d57dde5695c4229be2dcd637a4e2feb03837420ed3782839659d7b4fef7532f4bda6d8356589cec6562fd6887dbc449e454d2a0e834574f457348984249266756862e9737cc483f551b2804e4dc95119eb8c8685a23b7a0de440ba9c51f8bae6f7994328db5d990bf5b6e9d80f71b7c9c6ed61ef85ce37d7da4152f23e6518f903be10158bea8fefddfd21e188f939c06877df5b4c7b2ca0b253f5d7cddba9d633388d5be847cd9aeb8e03691ca580cf3ac807904f3b08b8909ff9b31849a193e3e7dd6af66f732d6ff1ba5c0585c2f644614c1104634538e35dedc9b4facaeffbf650a62746aa28c1928b01395d279520208f7100b8ce2ec129f85e8352b6444642c0e11c082bfd0c95c17da78c36a46ff172b5464c115a672ee57891e1c5ff7b92caffeee9fde6c3e130f072fa0b296575f97c504dfd901260f1be1eb454171615921957ba7139bc548b9b71b692105e9fce94653ab4f24020b0485e9eab4f5fb0c0cb3778c316974a8978597f56f258b2e0000680ada025d0ea9a1af9c5feb04221ed0e5aeed2504df1f87abd6662cca24d1e0d12eee2f0617abaf593488c5cbda1584301d997741c9db2fa4453b117f164011e83336cd1e1a0d542a6eecdbd1eb3611b41d7580c08d26400e0bf2706db799ec709be3814ce9fe3ae25a003571aed3ffa9e6459698618897b4c9059c5fcde99f34af3fc01a6766d84110b1892fbadf5509097909f0dd5ef4f2d59f43e2025b73022b4964c165931cb2c569b31601a8268f24ca859fe37a58fdabf0c260e50fc496218a64f39c6db8110c302b2a8669f2fed242d036570b66dc4ad9ec7c41bc3d566a689b96f950464fc6d779e3cf6546897c697df1668652b4d5ed37691bf94336fa238a4029a68ed9c74049920f84599d546f3c00c5958466f980b4bea50a522734f4616e9c2168ad132cec5b625b9e2910830a580afc87446ad3408d3334383cd1fbdd83ea8efabb52b4b4a6b1a3f5ea78f3923cbc9b0570a60b5bb1efe392f4329a1a96efb00d919e9b2d526e1057956f98c2546a018ece7f6187b366639ab273f16ad6f5de6651512c3925348b6d1c0d5ef7a151f831314e035d0aa9bed206959283098b0ee38f0b13dec0b8b1c26b350148806626ec78e12aafc7d712ee5ae2b2ff637b7fc904acabaf286a48832f39aea38da4af028a8b5e33332296757ee0be546fbc404191408f3d198a537dc0163a31f7add4c809b90dd6900f24ca079f23dc6b48efa46f14cda7631819e8e21566619e5030d62f8b5d97a82ad488387755954b1ca780caa76be10ddf3b85f93bcfb9a927533dd2cf1816e944a9af49783485155c8fe672f860ce4c99e7acc56d3a70861a7026f02b7740e2a6b20c00c47b50a0e55e4ba1cf91107dcfc0c841e2589ffab5775be3f7ca6652234ee185839f9fda001a5bc356442c62c8ea93b74beb3334b12582ab8c63ab50654574a053db7d12afa6229f1d29d44840ba73ef7b1653102fcb1dee827b809559a5225d4eb74e317ea1094779179b5e9ad7bbd59f794b61ec1233920a480a7c110a7c336ffac90bf47df1133b158ded1277a07ef8e9ae32ceb132163084714075fe56a8097afc978bc9868d726d23d83935b3eed124c2c0e5a1ed505fd72d8c73ddb00a6d795afe0b0842e35fb7881e121cd35b7b478ced578283cba394e823ca1d91f062d665b3f96da303a948fce64f8b322cb2f625eb9cae44bc6030c9ea46dd1da6e8f77b9a2ca949ee31740a4f67ff50606f017c16366ac44421834fb58822e7fd3543c73b1b1e246e0fe425c8aec177f1098df7a9d7885ec69797d16097012664b3286e1dc2ace0d560410a5df45b30ec94e51739adb416c9ab78dac42bd2afa68996ac43c13c5cbb8ab0ceefa6b03a91f5110bb8330d6f88a800ca01c135892ec60a4f413f526485be446e3f087f278992669c1a0325ae3f16981f37ace57e35117cf23941b1403d2a0e442af1376a8baa52fa62bd784267b82234fbea288f96a1d1883e3fafa599fb0fff98d5f60de9b81107ffad0d93cd4192ebaab5879bb319d0b7482e9913c45ae1ae737648dda82a93ce1387c1765d1180d90b0a1992d14f8e626edb401e58890794e2032fc0320d4a96cccb03d8d54cc91d3424f038c7b6054d98beb6346cb003912ff00e1c23cdefedee8f59f0f48726cd6a715d0af0258fa35339bdfa562666e36b4743c7949f24af888de99d0b4da024b010015bf568e585fd98f855e65abbf6aa85f41491ff289062ba1c1f5485f002f13e8736be3094eb0cd28ed1c5ccd56292ec55edd419fa3e0166c2fef1e96a95d4847c1f7a6410784bc026c5cc69ebe15ff11fd4fa4b648c22055ea0c3b9aba49ed01494b842f8837903c6bfbb7f5381cfd2a5fd2e0fec3274517341b0e2058b11a3512a7ce3811cfb7c9f20cee2cf80fe225506939dc80385f960b04448cc212472ccf1e622272b5adc0d4fe9ca34581240bd0864f5114f480fc8907d2fb79407c0b3392dac6849a1d40de6388cd4e73050f74bb40f43f2a51b4282d80099265c4c82fe7efa32a2e65c335c9a3c830c1df5a389bde64b7b3f027e795b87f0502a4964eaaf8c1bbfdb31d7d7ce8057f08bb06061cbf7e4fbbb675c3d776aaa707ecc6df249d5c664ac80de8b2f38abb8b1b3b5793f4c283ec2943154685c9e35fa9412baa1fd871701ae47975e32f3c7892fb569b35f7c4a2600d6ef704444b00c32a0c65e90f8a74e5f621a2a73879b4b4f0ba68ac94eb1b686734f68bc495443055cd4c4385f2d72c6b5f800f550459490cadabde3809b20202bdf376701062ce3a08b170f900244373a9eda538df6135bdc589b391d89e8d21f75070cff30423acf53a9357e4f8ef7b5628c8c2f4f69fece9df13fb467f6ae68db28cb777f9cb7ecab6584c78b203e2f07ddb9af0c9da42a2a2912c94529a8d3906e1a158e17368875d84c49ba568020d603631bd353590a97f7fa22e78adf0aac23979e8b157ce92818d0457dba729cc8ed7bfbda618ce890bf38c2b4f40571d212560616290ebea69ecef07b78808e887ace40097d3d5ba75ac5ac10a5ea4b53e4ff56a4d78a8baad299e579e21e55bc4a2b3bee35014632c587205a626a7fb6a01a7579d9d285cad71fb55a844557381b3d1fdc4198f231eebe77619434c4a6e26a8a24c911b0443fcd5ccb5b46e5f749234861f84cb79ad67c9cb207a3d8fd5786f82bc727f0949a93bc968daf91dbf45a8dcf03e837fe639668f2a101396644921840f3bb284a81725bafe496cf36bef74b75a2f1bd80482d884d8481ee734faadad37e6996114d503d232237f8bd5ba27227cfd43eec6bea9b91ca1f119e06baf72293079238445f43c3bc98c64238f87ecedc0cc79e375bc3ea98fdf574c986a15826e48b678af2daa91127620b0f9662230bcd987b8dea49307ef6faea0f6b1e6a53e2270b33758488427cc219d33bf0e25537ec57a2b694a0e03e5ccd26f59cbabaa2f38f088becccdb40f6aeef4bd3262c8f4bc516ff5d78eeb599c094ba7319705453932f76d5780fdbcb23d8d53214547f7a64a4bb1882cb3236563c8dd455939913152bcf24eb1269bd0270df21437ad2ce7b5ee944731d01fffa973eafd1d45fbdfb37c2c4dab956fa395b94d7acd0bd96e62d010d7bd00f76079ec0fe7859427cd590d82fcc84bf20c9c7dda1ee2f5bc1314a6bda26f642ac00c95bd2b5629f28e821e93a2a887f819d2a3509612061a48477f8c73a722473ef0db0781a85c8b72c23ffe7e429c804d22d79933efc500eb47954370452e4b8d02525257a5a944271c7d6a5a0b09ecdfd4d2a3e72c45d7a1f05555c0f684c28e5b072c7055e3f600528e7344f127d074a4822cffe47a333b2c8cb40e0d24c130905f561fd35ea35ea94077bd5f87d3d148ed5c3f157cbfbad59dc867a625a2faf222f79099ee0294dfd8934faa121ee8182777b0a57d9cbd89d4b2a865591205d1de658fa15ff9ca59a1344c8b875391a37b71af169c790abb9ae23590e7dfddca4e5b9a1be8002d5b48acc69c2b606bf2be721f6c510dd53512d8b376f5cbc7750bf08681520f05cc5060167d6871da15b572bd59e999d8b7f8adbdb2bc1e6c6304275fd1c49ac25f6d2a7abd1425b32e659261a0c43480059ab4c6b66183c547c084c12a892625c04b7775a3b4ba11473984df44e9980ad5b63676fc0", 0xf55}, {&(0x7f0000001ac0)="b7444cd2795795be7f491818a72f8e61de2f41a31125dd9861ecd1cd4c08f1d1d1ea7af6e2d20abea4a37551083457239f68196dcace66c2d5de37f9ccf3684d7fad4017d37ed62e22de65c8f6247402eb1212cf418b37cb04922a1539fdef15771f3136ac4a69d464891805c74c400fa8f00d858a61c5b3a4f78c337e5236ced4abd08b45bd5ac0218f263234daa1d6b2d6f90d2039e4a791cc0c989bf90c424cff3cb58fd826082376189da12c5f2c577102823ae39b4e46097a1f69d582b5df0b28ff355b95d54e4364953226fb415a07ef", 0xd3}, {&(0x7f0000001c80)="2fda27044e78bb4749f9f2e5d17f5d8918d9d88977d02b86e203311ef67b6d69c4acc7dedd6d9ce84b6b6f464daf937781a297968df0ef42606708c1a66d331edb0cb646848a3d1b1e9c11574ac76cc952009748d1fa9550da1e4b64297747f1868412dca7c736c0057d48c4e274010d3f2e997a7ee89799f1b577bd1f04744d9ddc837fedcd151f0a2475b218700ea19160b338e13d9241473737471d78d9e0fd319fa469ea52db5545050aed4370bf4b59b1bb66c4a3989c2756406ab49ca809898d638ac4052be098ee4a86e130c6c6ae", 0xd2}], 0x4}, 0x24008851) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a11800150006001400000000120800030043000040", 0x30}], 0x1}, 0xc001) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0xfe33) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000003c0)=0x11) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='kfree\x00', r4, 0x0, 0xffffffffffffffff}, 0x18) r5 = perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x40082406, &(0x7f00000001c0)='cpu&00\t&&') dup(0xffffffffffffffff) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000740)='./file0\x00', 0x759, &(0x7f0000000780)={[{@noload}, {@max_batch_time={'max_batch_time', 0x3d, 0x7}}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x40}}, {@errors_remount}, {@nouser_xattr, 0x0}, {@data_journal}, {@journal_dev={'journal_dev', 0x3d, 0xf}}, {@i_version}, {@nobarrier}, {@debug}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xb6a}}, {@data_err_ignore}], [], 0x2c}, 0x2, 0x4f9, &(0x7f0000000200)="$eJzs3ElvHFUeAPB/te04zjL2ZNYsM+mZzAgLRBw764FDgkDKBQkJhMLR2E4U4iQoNlISWcRBKEgcQPkELDckPgEnuCBAHEBcibgipAj5ksABFarqatN2ub2l7cbx7yd151XVq37v31Uv/ZZuB7BpVbOnJGJHRHwXEb21zbkZqrV/7s9Mjfw8MzWSRJo+91OS57s3MzVSz1o/b3ux0V+JqLyRxN5ysd0T165fGB4fH7tS7BiYrBSpi8Pnxs6NXRo6ceLI4Z7jx4aOtiTOrE739rx2ed/u0y/efmbkzO2Xvvgoq29aHG+Mo6Yvf96y7BI6SnuqUZ37Xjb4//KrviHsbEgnndlzpX2VYdmyuza7XF15+++Njnyrpjeefr2tlQPWVJqmaXdp7+xn2XTaKElqJ6TpzRR4CCTR7hoA7VH/oL83k41Up0bK4+CH291TkY+AsrjvF4/akc58BFvtq42Nutao/L9GxJnpX97NHrHgPAQAQGt9cipiW9HvqD9qRyrx94Z8fyrWhvoi4s8RsSsi/lL0X/4Wkef9R0T8s+GcHctYBajO2y73f77pKRKN3dWWyfp/TxRrW3P7f7M17+sotnbm8XclZ8+Pjx0q3pP+6OrOtgfLLz07rfbpU9++06z8akP/L3tk5df7gkU9fuycN0E3Ojw5/KBx1929mb+xN8rxJ9GZ1FMRuyNizypeP3vPzj/64b5mx+fEn8VZiv/t5i/euYoKzZO+H/FI7fpPx7z4o1j/S/L1yYuvDExcu/74+cb1ycHjx4aODmyN8bFDA/W7ouzLr289WyRLw4hFrn+9aazpQlp2/bcteP/Prlz2ZanZ9dqJlZdx686bTcc0q73/tyTP5+n6+uzV4cnJK4MRW5Lp8v6h38+9OtwzJ38Wf/+Bhdv/rohf3yvO2xsR2U38r4j4d0TsL+r+n4j4b0QcWCT+z5/838vNhpBLx7+2svhHV3T9myVOfhWx8KGOC599XCr4rWop/q5odv2P5Kn+Ys/o8OTWpeJarKaNiQd+AwEAAGAD2J/P0yaVg8VE046oVA4ejNg+O4MyMfnY2cuvXhqtzef2RVelPtPV2zAfOljMDWfb2VlDDdvZ8cP5vHGapmlPtp2N38d3tjd02PS2N2n/mR/KP2kBHjYrWkdr9os2YEOa3/7vLPvM1n8hA1hfLfgeDbBBaf+weS27/a/Vr+CAtlmo/d+IuN+GqgDrbKH2/0Jpz8l1qQuwvoz/YfNaffv3ZQDY6Hz+w6a0rB/JryKx6/QieZLOtSm0eaISi/8VgL6I+p56n2bxF/y+EtGaGna0NNKeOde0smCerdGKsqKyZJ7OFfwhhvVNVP4Y1agluiNiibt39ma7UU9cX+uK5Y3gg/b+7wQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDgfgsAAP//RUTTKw==") 1.346168072s ago: executing program 4 (id=8635): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x64, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44c094, 0x2, @perf_config_ext={0x9, 0x6}, 0x8, 0x0, 0x800000, 0x6, 0xfffffffffffffffe, 0x2, 0x9, 0x0, 0x0, 0x0, 0xbc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x3, 0x4, &(0x7f0000000900)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x5, 0xfdf, &(0x7f0000001e00)=""/4063, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10000}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0500000004000000990000000b"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0xc, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000015850000001700000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000008850000000700000095"], &(0x7f00000001c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40e00, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) utimensat(0xffffffffffffff9c, &(0x7f0000002240)='.\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000001bc0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000181100", @ANYRESHEX=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000080000000000000000000180100003020702500000000002020207b1af8ff00000000bfa1000000000000070100003affffffb702000008000000b7030000000000a3850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000880)=ANY=[@ANYBLOB="58000004100039042abd7000eafff7ff000051e4", @ANYRES32=0x0, @ANYBLOB="03000000c31006003800128008000100736974002c00028006000e000010000008000300ac1414bb08000200ac14142d08000c00ee000000080014000100"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x4008040) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000940)="46aac5dead586ff73709a62c48785d2d172103b967ae1abc02cef2e3956a83f53aeae1a892e33bafd37730e3a2", 0x2d}, {&(0x7f0000001ac0)="b7444cd2795795be7f491818a72f8e61de2f41a31125dd9861ecd1cd4c08f1d1d1ea7af6e2d20abea4a37551083457239f68196dcace66c2d5de37f9ccf3684d7fad4017d37ed62e22de65c8f6247402eb1212cf418b37cb04922a1539fdef15771f3136ac4a69d464891805c74c400fa8f00d858a61c5b3a4f78c337e5236ced4abd08b45bd5ac0218f263234daa1d6b2d6f90d2039e4a791cc0c989bf90c424cff3cb58fd826082376189da12c5f2c577102823ae39b4e46097a1f69d582b5df0b28ff355b95d54e4364953226fb415a07ef", 0xd3}, {&(0x7f0000001c80)="2fda27044e78bb4749f9f2e5d17f5d8918d9d88977d02b86e203311ef67b6d69c4acc7dedd6d9ce84b6b6f464daf937781a297968df0ef42606708c1a66d331edb0cb646848a3d1b1e9c11574ac76cc952009748d1fa9550da1e4b64297747f1868412dca7c736c0057d48c4e274010d3f2e997a7ee89799f1b577bd1f04744d9ddc837fedcd151f0a2475b218700ea19160b338e13d9241473737471d78d9e0fd319fa469ea52db5545050aed4370bf4b59b1bb66c4a3989c2756406ab49ca809898d638ac4052be098ee4a86e130c6c6ae", 0xd2}], 0x3}, 0x24008851) r4 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0xfe33) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000003c0)=0x11) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000007000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='kfree\x00', r5, 0x0, 0xffffffffffffffff}, 0x18) r6 = perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x40082406, &(0x7f00000001c0)='cpu&00\t&&') 1.23775189s ago: executing program 0 (id=8637): bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000640)=ANY=[@ANYBLOB="1b0000"], 0x50) syz_usb_connect(0x2, 0x64, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x0, 0xf7}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000140)={0x0, 0x0}) socket$key(0xf, 0x3, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x400000, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, &(0x7f0000000740)={0x0}, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_io_uring_setup(0x499, &(0x7f0000000400)={0x0, 0xd146, 0x0, 0x3, 0x288}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x40, 0x0, r2, 0x0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='0'], 0x30}}) io_uring_enter(r3, 0x3516, 0x0, 0x4, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) 1.217742582s ago: executing program 5 (id=8638): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000002000000000000000000001811", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) symlinkat(&(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') 1.191952084s ago: executing program 5 (id=8639): bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x10, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000028c0)=[{{&(0x7f00000006c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000000b00)=[{&(0x7f0000000880)=""/211, 0xd3}, {&(0x7f0000001200)=""/4096, 0x1000}, {&(0x7f0000000c40)=""/27, 0x1b}, {&(0x7f0000000980)=""/116, 0x74}, {&(0x7f0000000a00)=""/232, 0xe8}], 0x5, &(0x7f0000000b80)=""/106, 0x6a}, 0x3}, {{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f00000003c0)=""/49, 0x31}, {&(0x7f0000000440)=""/9, 0x9}, {&(0x7f0000000740)=""/51, 0x33}, {&(0x7f0000000c00)=""/51, 0x33}, {&(0x7f0000000c40)}, {&(0x7f0000000c80)=""/237, 0xed}, {&(0x7f0000002200)=""/178, 0xb2}, {&(0x7f00000025c0)=""/120, 0x78}, {&(0x7f0000002340)=""/98, 0x62}], 0x9, &(0x7f0000002480)=""/62, 0x3e}, 0x2d69cb67}, {{0x0, 0x0, &(0x7f0000002500)=[{&(0x7f00000024c0)=""/14, 0xe}], 0x1}, 0x7}, {{&(0x7f0000002540)=@tipc=@id, 0x80, &(0x7f00000026c0), 0x0, &(0x7f0000002700)=""/141, 0x8d}, 0x80000001}, {{&(0x7f00000027c0)=@l2tp6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f0000002880)=[{&(0x7f0000002840)=""/24, 0x18}], 0x1}, 0x8}], 0x5, 0x2, 0x0) 1.161250536s ago: executing program 4 (id=8640): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4e, '\x00', 0x0, 0x2}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x80) mount(0x0, 0x0, &(0x7f0000000040)='devpts\x00', 0x0, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x29}, './file0\x00'}) 1.130245069s ago: executing program 4 (id=8641): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0b0000000700000001"], 0x48) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x84) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1094a}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000600)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_9p2000}]}}) 1.025685097s ago: executing program 4 (id=8642): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x200602, 0x0) ioctl$TUNSETIFF(r0, 0x400454da, &(0x7f0000000080)={'batadv0\x00'}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'dvmrp1\x00', 0x1}) r1 = getpid() fcntl$lock(r0, 0x25, &(0x7f00000000c0)={0x2, 0x1, 0x0, 0x7fffffff, r1}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYRES16=r2, @ANYRES32=r2], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001600), 0x1, r3}, 0x38) bpf$BPF_GET_PROG_INFO(0x4, &(0x7f0000000140)={r3, 0xe0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8000) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendto(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x404c084, 0x0, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/pm_wakeup_irq', 0x0, 0xb) r6 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x0) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f0000000140)={r5, 0x20000800, {0x2a00, 0x80010000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, "fee8a7bd5547a4b4e00f9683dda1000000010000000000200000000000000000000000000000000000000900", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512f40e7f0000003ee8ffffffffffff00", [0x4, 0x40000000000000]}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kfree\x00', r7}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x10) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4400000010000104fcffffff8000000000000000", @ANYRES32=0x0, @ANYBLOB="0315000000000000140012800b0001006d616373656300000400028008000500", @ANYRES32=r10, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r10], 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 857.987551ms ago: executing program 4 (id=8643): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x221a0a6, &(0x7f0000000280)={[{}, {@dioread_nolock}, {@quota}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="01"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001480)=ANY=[@ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="002998443900000000e700000000006e848d4f1626c5c973f1000000000020000000000000"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000700200018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095000000000000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x18) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf}, {0xe, 0xffe0}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x4, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x40080}, 0x6c10) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000380)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x16}}, {0x0, @broadcast}, 0x2, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1}}, 'vlan0\x00'}) r5 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) recvfrom$unix(r5, &(0x7f0000000040)=""/120, 0x78, 0x0, &(0x7f00000000c0)=@file={0x0, './file1\x00'}, 0x6e) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, r6}, 0x38) socket$key(0xf, 0x3, 0x2) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e000000000000"], 0x48) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x1018e58, &(0x7f0000000380)={[{@nodioread_nolock}, {@minixdf}, {@data_err_ignore}, {@max_batch_time={'max_batch_time', 0x3d, 0x8c9}}, {@nodiscard}, {@inlinecrypt}, {@i_version}]}, 0x6, 0x5fc, &(0x7f0000000600)="$eJzs3c9rHGUfAPDvzCZ5kzavaUXEFsWAhxakaVKLVS+29WAPBQv2IOKhoUlq6PYHTQq2FkzBg4KCiFeRXvwHvEvv3kRQb56FKlJRUOnK7M62m2Q3XdPsTpr5fGCzz/PM7D7PdydP5pmZPDsBlNZ49iON2BVx51QSMdaybDQaC8fz9W7/du109kiiVnv91ySSvKy5fpI/b88zwxHx7dGIRyur6124cvXsdLXW8F7E/sVzF/cvXLm6b/7c9JnZM7Pnpw68cPDQ5ItTB6c2JM7t+fOx4689+fH7bz8/9111XxKH4+TguzOxIo6NMh7jcScPsbV8ICIOZYk2n8vDZguEUGqV/PdxMCIej7Go1HMNYzH/UaGNA3qqVomoASWV6P9QUs1xQPPYvrvj4JM9HpX0z60jjQOg1fEPNM6NxHD92Gjb7aTlyKhxbmPHBtSf1fHPtd2fZ49Ydh7iz7tbZ2AD6ulk6XpEPNEu/qTeth31SLP402XtSCJiMiKG8va98gBtSFrSvTgPs5b1xp9GxOH8OSs/us76x1fk+x0/AOV080i+I1/Kcvf2f9nYozn+iTbjn9E2+671KHr/13n819zfD9fPkacrxmHZmOVE+7ccXFnw04fHPu1Uf+v4L3tk9TfHgv1w63rE7hXxf5AFm49/sviTNts/W+XU4e7qePX7X451WlZ0/LUbEXvaHv/cG5VmqTWuT+6fm6/OTjZ+tq3j62/e+rJT/UXHn23/bR3ib9n+6crXZZ/JxS7r+OrEjXOdlo3eN/7056Gkcbw5lJe8M724eGkqYig5nq/SUn5g7bY012m+Rxb/3mfa9/9lv//Xl7/PSPNPZhcuvnH2dqdl69n+LReT79S6bEMnWfwz99/+q/p/VvZJl3X88eblpzotWyv+kQcJDAAAAAAAAEoorV+DTdKJu+k0nZhozJd9LLal1QsLi8/OXbh8fiZib/3/IQfT5pXusUY+yfJT+f/DNvMHVuSfi4idEfFZZaSenzh9oTpTdPAAAAAAAAAAAAAAAAAAAACwSWzP5/8371P9e6Ux/x8oiV7eYA7Y3PR/KK96/191iyegDOz/obz0fygv/R/KS/+H8tL/obz0fygv/R/KS/8HAAAAgC1p59M3f0wiYumlkfojM5QvMyMItrbBohsAFKZSdAOAwty99G+wD6XT1fj/r/zLAXvfHKAASbvC+uCgtnbnv9n2lQAAAAAAAAAAAABAD+zZ1Xn+v7nBsLWZ9gfl9QDz/311ADzkfPU/lJdjfOB+s/iHOy0w/x8AAAAAAAAAAAAA+ma0/kjSiXwu8Gik6cRExP8jYkcMJnPz1dnJiHgkIn6oDP4vy08V3WgAAAAAAAAAAAAAAAAAAADYYhauXD07Xa3OXmpN/L2qZGsnmndB7UNdL8d/fFUk/f9YRiKi8I3Ss8RAS0kSsZRt+U3RsEsLsTmaUU8U/IcJAAAAAAAAAAAAAAAAAABKqGXucXu7v+hziwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg/+7d/793iaJjBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeTv8GAAD//7V5QCw=") r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000101401002cbd7000fedbdf25080003800100000008004a0001000000080001000000000008004b0013000000"], 0x30}, 0x1, 0x0, 0x0, 0x24044836}, 0xc094) r9 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) quotactl_fd$Q_SETQUOTA(r9, 0xffffffff80000800, 0xee00, &(0x7f0000000140)={0x10004, 0x1, 0x401, 0xf, 0x8, 0xb, 0x28a7, 0x0, 0x6}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000181100", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000057000000"], 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000100)='sched_pi_setprio\x00', 0xffffffffffffffff, 0x0, 0x6}, 0x18) accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000300)=0x14) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021181500001e0a05010000000000000000070000000900020073797a31000000000900010073797a3000000000ec140380300000802c000180250001007bb0c03ce8ed22d039cce454fd98ae614b08a9f3d4ddf1f742d55995afac076948000000b81400800c00054000000000000000000c00054000000000000000000c00044000000000000000000c00044000000000000000000600064019d20000240201802400028008000340000000000800034000000000080003400000000008000180000000003c00028008000340000000000800018000000000080003400000000008000340000000000900020073797a30000000000900020073797a310000000044000280080003400000000008000340000000010900020073797a32000000000800034000000000080003400000000108000340000000020900020073797a30000000003400028008000180000000000900020073797a310000000008000340000000000900020073797a320000000008000340000000000c0002800800034000000000400002800900020073797a310000000008000340000000000900020073797a32000000000900020073797a3200000000080001800000000008000180fffffffcfc000100789be1642f8430c460e8692a8f8c45aaf3118316539052ba181a60f03707ec8179fd143ed6c4db73977b77f68686d2ec94b25435ecec60f6ac23db96833cbf99779e33db32e62fe3a078933d3c1122022952988b9550db169ecb6e39fd8720a05d3eeb5d40a7ab91f9b5565dc2b48c9ac61eefd9d0aab86e58ea1940d2240a851dbeabcf0b6cefba164663ad87cbcdb6aa1468529d1206b1fa3aa39118b45ab882df7fb2c6e9c25a706f99002cc42ee9b894b4bbfe66ce8fa1038566ae3407d5c80e28dc3911476785933d1ef923697a44a9cd4271d539e2ecc14d37a5e2074116425f0766b49a6febf9f1b8405ee9de1363b262f1be2839a40101804c0002800900020073797a300000000008000340000000000900020073797a300000000008000180000000000900020073797a30000000000900020073797a3200000000080003400000000104000280380002800900020073797a300000000008000180000000000900020073797a320000000008000340000000000900020073797a32000000002400028008000180000000000900020073797a32000000000900020073797a3000000000f3000100a6117a78b9e48d6dd9ad86fc2c54547cbee98c24f4b972c82722771febf3e388f9b3907852ee4adbd95ca25deb487ac3d49d3716931979f6bbf2b8cdcc0bc37f27a54709a59c31c01c5544b11cb9c6ca800d7f23c3cc5237458188f26a04c78ad8dfd3b13e958558dc3b7f0f4cfc16c4fd23e11b25bd23b195b64166e0c3a8ab3ebbd2ead4abf745bcf4d4b0610521d7ec52023ed38c7f9fb1cbab6a9d87c96fd783ff63f9483766557291fcc41f17c423550c1e965a66e30631b271db96cccb68bf8c91656e894ef46a296974170da742b0d13d665f0f2e80d3590b3dc637851b6e7b0adc59ab874ce337a258bc430008000340", @ANYRES16], 0x159c}}, 0x0) 619.9691ms ago: executing program 0 (id=8644): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000c00008e3af2db1a4635f6c0", @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x29}, './file0\x00'}) 502.2134ms ago: executing program 0 (id=8645): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40001, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x18) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000200)='kfree\x00', r2, 0x0, 0xfffffffffffffffc}, 0x18) fsetxattr$trusted_overlay_redirect(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0xd7, 0x0) r3 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x40, '\x00', r4, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff}, 0x94) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xe, 0xb}}}, 0x24}}, 0x800) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000"], 0x48) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) ioctl$TCSETAF(r9, 0x5408, &(0x7f00000000c0)={0x4e00, 0x0, 0x730, 0xbdff, 0x10, "feeeff000000001b"}) write$binfmt_aout(r9, &(0x7f0000000100)=ANY=[], 0xff2e) ioctl$TCSETS(r9, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0x0, 0x0, "0062ba7d82000000000000000000f7fffeff00"}) r10 = syz_open_pts(r9, 0x8182) r11 = dup3(r10, r9, 0x0) ioctl$TIOCSTI(r11, 0x5412, &(0x7f0000000000)=0x17) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xe7c) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r11, 0x89f8, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000540)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xc102, 0x1, {{0x13, 0x4, 0x1, 0x33, 0x4c, 0x67, 0x0, 0x1, 0x2f, 0x0, @private=0xa010101, @loopback, {[@generic={0x89, 0x9, "51e748525e0b2c"}, @timestamp_prespec={0x44, 0xc, 0xe1, 0x3, 0x0, [{@multicast2, 0x5be}]}, @ssrr={0x89, 0x23, 0xe4, [@remote, @broadcast, @local, @multicast2, @private=0xa010100, @local, @remote, @local]}]}}}}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x22, 0xc, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x101}, [@printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x9}}, @exit]}, &(0x7f0000000080)='syzkaller\x00', 0x81, 0x6b, &(0x7f0000000440)=""/107, 0x40f00, 0x2c, '\x00', r12, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f00000005c0)={0x0, 0xd, 0x7, 0x68a4}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000680)=[r0, r11, r8, r11, r8, r1, r8], &(0x7f00000006c0)=[{0x0, 0x3, 0xb, 0xa}, {0x5, 0x5, 0x10, 0xd}, {0x4, 0x4, 0x2, 0x4}], 0x10, 0xa}, 0x94) r13 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x1b, r1}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r13, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r14 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r14, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r13}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x4) 440.958464ms ago: executing program 6 (id=8646): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, &(0x7f00000000c0)}) r0 = fsopen(&(0x7f0000000080)='bpf\x00', 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000400000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x18) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x0) symlinkat(&(0x7f0000000000)='.\x00', r2, &(0x7f0000000140)='./file0\x00') readlinkat(r2, &(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)=""/204, 0xcc) 373.47361ms ago: executing program 1 (id=8647): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x1, 'queue1\x00', 0x200000}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3, 0x0, 0x1}, 0x2}) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) write$sndseq(r2, &(0x7f00000006c0)=[{0x7, 0x7, 0x7, 0x3, @tick=0x85, {0x2, 0x3}, {0xd3, 0x5}, @addr={0x7, 0xf}}, {0x3, 0x0, 0x4, 0xdb, @tick=0xe, {0xf, 0x7f}, {0xe8, 0xc}, @result={0x9, 0x10001}}, {0x5, 0x4, 0x7, 0x1, @tick=0x37, {0x6e, 0xff}, {0x0, 0xc}, @connect={{0x1, 0x4}, {0x5, 0xa}}}], 0x54) r3 = syz_clone3(&(0x7f0000000040)={0xa00000, 0x0, 0x0, 0x0, {0x11}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x1a5002, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYRESDEC=r4], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, 0x2}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000001040)=ANY=[@ANYBLOB="1800000002e6e8ffffd8f5ffffffffff00009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r5}, 0x10) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(r6, 0x402c542b, &(0x7f0000000100)={0x0, 0x2, 0x4, 0x3, 0xfc, "92b37108b47180a82c02e37c3b69568d3ccdd1", 0xfffffffc, 0x1}) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = dup(r7) write$UHID_INPUT(r8, &(0x7f0000000000)={0xc, {"a2e3ad21ed0d52f91b5a090987f70e06d038e7ff7fc6e5539b5b43078b089b3b32346d090890e0878f0e1ac6e7049b3371959b719a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074c0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffffe}, 0x18) syz_open_dev$usbmon(0x0, 0x80000000000005, 0xe003) syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f00000009c0)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r9 = perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xc6, 0x0, 0x0, 0x0, 0x0, 0x2000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000001080)=ANY=[@ANYRESOCT=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095", @ANYRES16=r1, @ANYBLOB="563dcec929fd26f2e44c4c7f229baf639708df03a64cd722e8336750fb796b2334a0c0b146a1b39883c3852f29c353c676cb17cb4135644d101a43ecb4c0b026e05e2a4c0fbc21f1d99090c58a0c164ea570be0674e37e04"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r10}, 0x10) ioctl$PERF_EVENT_IOC_SET_FILTER(r9, 0x40082406, &(0x7f0000000000)='cpu~\t\t') socket$nl_generic(0x10, 0x3, 0x10) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000006"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) 269.191458ms ago: executing program 6 (id=8648): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x51}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000240)='kfree\x00', r2}, 0x18) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10, 0x0, 0x0, &(0x7f0000000200)=[@rdma_map={0x30, 0x114, 0x3, {{0x0}, 0x0, 0x28}}], 0x30}, 0x0) (fail_nth: 6) 185.392285ms ago: executing program 1 (id=8649): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000140)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='sys_enter\x00', r0}, 0x10) migrate_pages(0xffffffffffffffff, 0x99, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1}, &(0x7f0000000000), &(0x7f0000000180)}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f00000002c0)={'veth1_virt_wifi\x00', 0x400}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x25) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000040)='sysfs\x00', 0x1, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000000)='kfree\x00', r4, 0x0, 0xfffffffffffffffd}, 0x18) r5 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, @remote, @empty, 0x7800, 0x80, 0xfffffffc, 0xdc67}}) umount2(&(0x7f0000000580)='./file0\x00', 0x3) 184.749585ms ago: executing program 5 (id=8650): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000200000000000000000000181100", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) symlinkat(&(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') 163.497636ms ago: executing program 4 (id=8651): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x14) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000001100)='./file1\x00', 0x0, &(0x7f0000000200)={[{@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x4}}, {@usrjquota}, {@jqfmt_vfsv1}, {@dioread_lock}, {@bh}, {@mblk_io_submit}, {@minixdf}, {@barrier_val}, {@nombcache}, {}]}, 0x45, 0x7b6, &(0x7f0000001140)="$eJzs3c9rG1ceAPDvyPLPZNdeWNjNngwLu4EQeZ31JruwsF72sBQaCLSnHpoYWTGpZStYcoiNaRNKoZdCW3prLzn356X02h+HXtr/oySkrROa0kNxGf2wZVtyrMSWkubzgYne07zRe995ozcvmrEUwBNrPP0nE3EsIl5PIkbrzycR0V9NZSOma+Xura/l0yWJjY1nvkuqZe6ur+WjaZvUkXrmjxHx+SsRJzK76y2vrM7PFIuFpXp+orJweaK8snry0sLMXGGusHh6cmrq1Jl/nDn9UOENN2d++Hr16K03/v/XD6Z/evkPH772RRLTcbS+rjmOgzIe4/V90p/uwm3+d9CV9czHL+6jUNMRkD3MxtChtGP66r1yLEajb6/+Ge5mywCAw/JSRGy009d2DQDwWEtq5///9LodAEC3ND4HuLu+lm8svf1Eortu/zcihobqudr1zVo6W79mN1S9DjpyN9l2ZSSJiLEDqH88It755Pn30iUO6TokQCvXrkfEhbHx3eN/suuehU79rfXTc82Z8R0rjX/QPZ+m859/tpr/ZTbnP9Fi/jPY4r37IO7//s/cPIBq2krnf/9uurftXlP8dWN99dxvqnO+/uTipWIhHdt+GxHHo38wzU/uUcfxOz/fabeuef73/ZsvvJvWnz5ulcjczA5u32Z2pjLzMDE3u3094k/ZVvGn4/9gtf+TNvPfc/X0wH3qeOpfr77dbl0afxpvY9kd/+HauBHxl5b9n2yWSfa8P3GiejhMNA6KFj6ajpF29Y9nt/o/XdL6G/8X6Ia0/0f2jn8sab5fs7zvl968W+yrG6OftSvUfPy3jr/18T+QPFtNN469qzOVytJkxEDy9O7nT21t28g3yqfxH/9z6/d/Y/xrcfw/l77+hX3uiOytb99/8PgPVxr/bEf933Eihu7N97Wrf3/9P7Vtm/2Mf/tt4IPuNwAAAAAAAAAAAAAAAAAAAAAAAADoRCYijkaSyW2mM5lcrvYb3r+PkUyxVK6cuFhaXpyN6m9lj0V/pvFVl6NN34c6Wf8+/Eb+1I783yPidxHx1uBwNZ/Ll4qzvQ4eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOqOtPn9/9Q3gzsK9/WihQDAoRhyYgeAJ02Szfa6CQBAtw11VHr40NoBAHRPZ+d/AODXwPkfAJ489zn/7/wzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOjUubNn02Xjx/W1fJqfvbKyPF+6cnK2UJ7PLSznc/nS0uXcXKk0Vyzk8qWFti90rfZQLJUuT8Xi8tWJSqFcmSivrJ5fKC0vVs5fWpiZK5wv9HctMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADYv/LK6vxMsVhYkuhJYv7LWj88Ku2R6CwR12r996i05+ASMbA1Sgz3ZnACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAz8EgAA//99gB7t") 127.915109ms ago: executing program 6 (id=8652): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000010"], 0x48) r1 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) dup(0xffffffffffffffff) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000006"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000007000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='kfree\x00', r5, 0x0, 0xffffffffffffffff}, 0x18) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x2082) r7 = fcntl$dupfd(r6, 0x0, r6) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffe, 0x6, 0x0, @buffer={0x2, 0x41001, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374c96ee3", 0x0, 0x300, 0x0, 0x0, 0x0}) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000240)='4', 0x1}], 0x1) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r8, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r8, 0x0, 0x0) write$ppp(r8, &(0x7f0000000480)="ac4a", 0x2) 127.193069ms ago: executing program 5 (id=8653): r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000007000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='kfree\x00', r2, 0x0, 0xffffffffffffffff}, 0x18) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000240)='4', 0x1}], 0x1) 75.233144ms ago: executing program 1 (id=8654): socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bf"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000000080)='D', 0x1, 0x4014, 0x0, 0x0) shutdown(r1, 0x1) 67.626325ms ago: executing program 5 (id=8655): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000002000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) linkat(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x1000) 0s ago: executing program 5 (id=8656): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x441, 0x0) write$binfmt_aout(r0, &(0x7f0000000000)=ANY=[], 0xff2e) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)}, 0x14) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) connect$unix(r5, &(0x7f0000000100)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r4, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000001100)='./file1\x00', 0x0, &(0x7f0000000200)={[{@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x4}}, {@usrjquota}, {@jqfmt_vfsv1}, {@dioread_lock}, {@bh}, {@mblk_io_submit}, {@minixdf}, {@barrier_val}, {@nombcache}, {}]}, 0x45, 0x7b6, &(0x7f0000001140)="$eJzs3c9rG1ceAPDvyPLPZNdeWNjNngwLu4EQeZ31JruwsF72sBQaCLSnHpoYWTGpZStYcoiNaRNKoZdCW3prLzn356X02h+HXtr/oySkrROa0kNxGf2wZVtyrMSWkubzgYne07zRe995ozcvmrEUwBNrPP0nE3EsIl5PIkbrzycR0V9NZSOma+Xura/l0yWJjY1nvkuqZe6ur+WjaZvUkXrmjxHx+SsRJzK76y2vrM7PFIuFpXp+orJweaK8snry0sLMXGGusHh6cmrq1Jl/nDn9UOENN2d++Hr16K03/v/XD6Z/evkPH772RRLTcbS+rjmOgzIe4/V90p/uwm3+d9CV9czHL+6jUNMRkD3MxtChtGP66r1yLEajb6/+Ge5mywCAw/JSRGy009d2DQDwWEtq5///9LodAEC3ND4HuLu+lm8svf1Eortu/zcihobqudr1zVo6W79mN1S9DjpyN9l2ZSSJiLEDqH88It755Pn30iUO6TokQCvXrkfEhbHx3eN/suuehU79rfXTc82Z8R0rjX/QPZ+m859/tpr/ZTbnP9Fi/jPY4r37IO7//s/cPIBq2krnf/9uurftXlP8dWN99dxvqnO+/uTipWIhHdt+GxHHo38wzU/uUcfxOz/fabeuef73/ZsvvJvWnz5ulcjczA5u32Z2pjLzMDE3u3094k/ZVvGn4/9gtf+TNvPfc/X0wH3qeOpfr77dbl0afxpvY9kd/+HauBHxl5b9n2yWSfa8P3GiejhMNA6KFj6ajpF29Y9nt/o/XdL6G/8X6Ia0/0f2jn8sab5fs7zvl968W+yrG6OftSvUfPy3jr/18T+QPFtNN469qzOVytJkxEDy9O7nT21t28g3yqfxH/9z6/d/Y/xrcfw/l77+hX3uiOytb99/8PgPVxr/bEf933Eihu7N97Wrf3/9P7Vtm/2Mf/tt4IPuNwAAAAAAAAAAAAAAAAAAAAAAAADoRCYijkaSyW2mM5lcrvYb3r+PkUyxVK6cuFhaXpyN6m9lj0V/pvFVl6NN34c6Wf8+/Eb+1I783yPidxHx1uBwNZ/Ll4qzvQ4eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOqOtPn9/9Q3gzsK9/WihQDAoRhyYgeAJ02Szfa6CQBAtw11VHr40NoBAHRPZ+d/AODXwPkfAJ489zn/7/wzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOjUubNn02Xjx/W1fJqfvbKyPF+6cnK2UJ7PLSznc/nS0uXcXKk0Vyzk8qWFti90rfZQLJUuT8Xi8tWJSqFcmSivrJ5fKC0vVs5fWpiZK5wv9HctMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADYv/LK6vxMsVhYkuhJYv7LWj88Ku2R6CwR12r996i05+ASMbA1Sgz3ZnACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAz8EgAA//99gB7t") r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000070000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r6}, 0x18) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010002000000000000000000000a18010000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000020d40009800800014000000006c80002800c"], 0x140}}, 0x84) kernel console output (not intermixed with test programs): [ 502.960459][T18192] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 503.024052][T25683] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7611'. [ 503.092479][T25684] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 503.398762][T25689] loop2: detected capacity change from 0 to 512 [ 503.415289][T25689] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 503.507350][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 503.618663][T25699] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7615'. [ 504.050434][T25715] loop1: detected capacity change from 0 to 128 [ 504.064056][T25718] netlink: 36 bytes leftover after parsing attributes in process `+}[@'. [ 504.072544][T25718] netlink: 36 bytes leftover after parsing attributes in process `+}[@'. [ 504.081191][T25718] netlink: 36 bytes leftover after parsing attributes in process `+}[@'. [ 504.098462][T25715] tipc: Started in network mode [ 504.103461][T25715] tipc: Node identity ac14140f, cluster identity 4711 [ 504.117496][T25716] loop5: detected capacity change from 0 to 2048 [ 504.125281][T25716] EXT4-fs: Ignoring removed bh option [ 504.126373][T25715] tipc: New replicast peer: 255.255.255.83 [ 504.130784][T25716] EXT4-fs: Ignoring removed mblk_io_submit option [ 504.136776][T25715] tipc: Enabled bearer , priority 10 [ 504.174696][T25716] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 504.220943][T25718] netlink: 36 bytes leftover after parsing attributes in process `+}[@'. [ 504.229556][T25718] netlink: 36 bytes leftover after parsing attributes in process `+}[@'. [ 504.260203][T25734] netlink: 'syz.4.7623': attribute type 21 has an invalid length. [ 504.379394][T25741] loop1: detected capacity change from 0 to 512 [ 504.403115][T25741] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 504.473586][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 504.507490][T25747] netlink: 'syz.1.7628': attribute type 6 has an invalid length. [ 504.531065][T25579] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm ext4lazyinit: bg 0: block 234: padding at end of block bitmap is not set [ 505.949359][ T36] tipc: Node number set to 2886997007 [ 507.176298][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 507.196085][ T29] kauditd_printk_skb: 910 callbacks suppressed [ 507.196103][ T29] audit: type=1400 audit(1755988297.006:56626): avc: denied { read write } for pid=21888 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 507.226814][ T29] audit: type=1400 audit(1755988297.006:56627): avc: denied { open } for pid=21888 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 507.251115][ T29] audit: type=1400 audit(1755988297.006:56628): avc: denied { unmount } for pid=22567 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 507.271051][ T29] audit: type=1400 audit(1755988297.026:56629): avc: denied { ioctl } for pid=21888 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 507.321063][ T29] audit: type=1400 audit(1755988297.136:56630): avc: denied { read write } for pid=24821 comm="syz-executor" name="loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 507.345654][ T29] audit: type=1400 audit(1755988297.136:56631): avc: denied { read write open } for pid=24821 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 507.370938][ T29] audit: type=1400 audit(1755988297.136:56632): avc: denied { ioctl } for pid=24821 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=102 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 507.396829][ T29] audit: type=1400 audit(1755988297.146:56633): avc: denied { create } for pid=25768 comm="syz.1.7636" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 507.416743][ T29] audit: type=1400 audit(1755988297.146:56634): avc: denied { map_create } for pid=25768 comm="syz.1.7636" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 507.436184][ T29] audit: type=1400 audit(1755988297.146:56635): avc: denied { perfmon } for pid=25768 comm="syz.1.7636" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 507.521799][T25777] __nla_validate_parse: 10 callbacks suppressed [ 507.521818][T25777] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7640'. [ 507.537197][T25777] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7640'. [ 507.546381][T25777] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7640'. [ 507.555583][T25777] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7640'. [ 507.564669][T25777] netlink: 'syz.0.7640': attribute type 6 has an invalid length. [ 507.644781][T25791] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7646'. [ 507.668980][T25790] loop5: detected capacity change from 0 to 512 [ 507.690788][T25790] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 507.709841][T25798] netlink: 36 bytes leftover after parsing attributes in process `+}[@'. [ 507.718346][T25798] netlink: 36 bytes leftover after parsing attributes in process `+}[@'. [ 507.742605][T25798] netlink: 36 bytes leftover after parsing attributes in process `+}[@'. [ 507.760409][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 507.771757][T25798] netlink: 36 bytes leftover after parsing attributes in process `+}[@'. [ 507.780314][T25798] netlink: 36 bytes leftover after parsing attributes in process `+}[@'. [ 508.119964][T25804] netlink: 'syz.4.7649': attribute type 21 has an invalid length. [ 508.160768][T25819] can0: slcan on ttyS3. [ 508.298509][T25818] can0 (unregistered): slcan off ttyS3. [ 508.935493][T25843] loop4: detected capacity change from 0 to 8192 [ 509.007477][T25843] loop4: p1 p2[DM] p4 [ 509.018989][T25843] loop4: p1 size 196608 extends beyond EOD, truncated [ 509.041157][T25843] loop4: p2 start 4292936063 is beyond EOD, truncated [ 509.048056][T25843] loop4: p4 size 50331648 extends beyond EOD, truncated [ 509.157201][T25854] can0: slcan on ttyS3. [ 509.234369][T25858] loop2: detected capacity change from 0 to 2048 [ 509.242384][T25858] EXT4-fs: Ignoring removed bh option [ 509.247855][T25858] EXT4-fs: Ignoring removed mblk_io_submit option [ 509.258261][T25858] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 509.296807][T25853] can0 (unregistered): slcan off ttyS3. [ 509.495421][T25872] netlink: 'syz.5.7672': attribute type 6 has an invalid length. [ 510.121467][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 510.862439][T25922] netlink: 'syz.2.7687': attribute type 6 has an invalid length. [ 511.553945][T25952] netlink: 'syz.0.7703': attribute type 6 has an invalid length. [ 511.762386][T25967] loop2: detected capacity change from 0 to 512 [ 511.776412][T25967] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 511.825682][T25967] EXT4-fs error (device loop2): ext4_acquire_dquot:6937: comm syz.2.7710: Failed to acquire dquot type 1 [ 511.840604][T25967] EXT4-fs (loop2): 1 truncate cleaned up [ 511.859954][T25977] can0: slcan on ttyS3. [ 511.873575][ T4113] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.883666][T25967] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 511.950053][ T4113] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.986448][T25973] can0 (unregistered): slcan off ttyS3. [ 512.016965][T25967] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.025548][T25967] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.047780][ T4113] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.116884][T25995] loop5: detected capacity change from 0 to 8192 [ 512.152793][ T4113] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.176994][T25995] loop5: p1 p2[DM] p4 [ 512.182892][T25995] loop5: p1 size 196608 extends beyond EOD, truncated [ 512.194628][T25995] loop5: p2 start 4292936063 is beyond EOD, truncated [ 512.201523][T25995] loop5: p4 size 50331648 extends beyond EOD, truncated [ 512.255992][ T4113] bridge_slave_1: left allmulticast mode [ 512.261730][ T4113] bridge_slave_1: left promiscuous mode [ 512.267419][ T4113] bridge0: port 2(bridge_slave_1) entered disabled state [ 512.284756][ T4113] bridge_slave_0: left allmulticast mode [ 512.290511][ T4113] bridge_slave_0: left promiscuous mode [ 512.296232][ T4113] bridge0: port 1(bridge_slave_0) entered disabled state [ 512.333253][ T29] kauditd_printk_skb: 1129 callbacks suppressed [ 512.333268][ T29] audit: type=1400 audit(1755988302.166:57763): avc: denied { read write } for pid=21888 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 512.384201][ T29] audit: type=1400 audit(1755988302.166:57764): avc: denied { open } for pid=21888 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 512.408576][ T29] audit: type=1400 audit(1755988302.166:57765): avc: denied { ioctl } for pid=21888 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 512.434380][ T29] audit: type=1400 audit(1755988302.196:57766): avc: denied { map_create } for pid=26003 comm="syz.1.7719" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 512.453769][ T29] audit: type=1400 audit(1755988302.206:57767): avc: denied { allowed } for pid=26003 comm="syz.1.7719" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 512.473323][ T29] audit: type=1400 audit(1755988302.206:57768): avc: denied { create } for pid=26003 comm="syz.1.7719" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 512.494747][ T29] audit: type=1400 audit(1755988302.206:57769): avc: denied { map } for pid=26003 comm="syz.1.7719" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=82622 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 512.519201][ T29] audit: type=1400 audit(1755988302.206:57770): avc: denied { read write } for pid=26003 comm="syz.1.7719" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=82622 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 512.544236][ T29] audit: type=1400 audit(1755988302.206:57771): avc: denied { open } for pid=26003 comm="syz.1.7719" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 512.563622][ T29] audit: type=1400 audit(1755988302.206:57772): avc: denied { perfmon } for pid=26003 comm="syz.1.7719" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 512.599658][ T4113] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 512.613970][ T4113] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 512.623691][ T4113] bond0 (unregistering): Released all slaves [ 512.659378][ T4113] tipc: Left network mode [ 512.668522][ T4113] hsr_slave_0: left promiscuous mode [ 512.677497][ T4113] veth1_macvtap: left promiscuous mode [ 512.683038][ T4113] veth0_macvtap: left promiscuous mode [ 512.688784][ T4113] veth1_vlan: left promiscuous mode [ 512.694180][ T4113] veth0_vlan: left promiscuous mode [ 512.738138][ T4113] pimreg (unregistering): left allmulticast mode [ 512.776856][ T4113] team0 (unregistering): Port device team_slave_1 removed [ 512.788538][ T4113] team0 (unregistering): Port device C removed [ 512.842445][T25972] chnl_net:caif_netlink_parms(): no params data found [ 512.914863][T25972] bridge0: port 1(bridge_slave_0) entered blocking state [ 512.922077][T25972] bridge0: port 1(bridge_slave_0) entered disabled state [ 512.945298][T25972] bridge_slave_0: entered allmulticast mode [ 512.952209][T25972] bridge_slave_0: entered promiscuous mode [ 512.961889][T25972] bridge0: port 2(bridge_slave_1) entered blocking state [ 512.969060][T25972] bridge0: port 2(bridge_slave_1) entered disabled state [ 512.981591][T25972] bridge_slave_1: entered allmulticast mode [ 512.988593][T25972] bridge_slave_1: entered promiscuous mode [ 513.003374][T26027] can0: slcan on ttyS3. [ 513.014627][T25972] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 513.025607][T25972] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 513.055544][T25972] team0: Port device team_slave_0 added [ 513.064093][T25972] team0: Port device team_slave_1 added [ 513.083240][T25972] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 513.090452][T25972] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 513.116438][T25972] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 513.128320][T25978] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm ext4lazyinit: bg 0: block 248: padding at end of block bitmap is not set [ 513.172667][T25972] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 513.179683][T25972] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 513.205711][T25972] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 513.216421][T26026] can0 (unregistered): slcan off ttyS3. [ 513.261641][T25972] hsr_slave_0: entered promiscuous mode [ 513.267666][T25972] hsr_slave_1: entered promiscuous mode [ 513.273506][T25972] debugfs: 'hsr0' already exists in 'hsr' [ 513.279261][T25972] Cannot create hsr debugfs directory [ 513.294998][ C1] vcan0: j1939_tp_rxtimer: 0xffff888119ad3c00: rx timeout, send abort [ 513.306083][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888119ad3c00: 0x3f002: (3) A timeout occurred and this is the connection abort to close the session. [ 513.732897][T26049] loop1: detected capacity change from 0 to 2048 [ 513.758028][T25972] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 513.793286][T26049] EXT4-fs: Ignoring removed bh option [ 513.798803][T26049] EXT4-fs: Ignoring removed mblk_io_submit option [ 513.837314][T25972] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 513.862030][T25972] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 513.881475][T26049] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 513.912026][T25972] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 514.008452][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 514.078871][T25972] 8021q: adding VLAN 0 to HW filter on device bond0 [ 514.095137][T25972] 8021q: adding VLAN 0 to HW filter on device team0 [ 514.108408][T11829] bridge0: port 1(bridge_slave_0) entered blocking state [ 514.115502][T11829] bridge0: port 1(bridge_slave_0) entered forwarding state [ 514.142733][T25972] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 514.153204][T25972] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 514.242626][T11829] bridge0: port 2(bridge_slave_1) entered blocking state [ 514.249823][T11829] bridge0: port 2(bridge_slave_1) entered forwarding state [ 514.366560][T26055] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm ext4lazyinit: bg 0: block 234: padding at end of block bitmap is not set [ 514.417069][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 514.494633][T26072] loop5: detected capacity change from 0 to 512 [ 514.509978][T26072] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 514.526449][T25972] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 514.728305][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 514.935965][T25972] veth0_vlan: entered promiscuous mode [ 514.957462][T25972] veth1_vlan: entered promiscuous mode [ 514.998035][T25972] veth0_macvtap: entered promiscuous mode [ 515.009602][T26097] loop2: detected capacity change from 0 to 1764 [ 515.018605][T25972] veth1_macvtap: entered promiscuous mode [ 515.047683][T25972] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 515.076180][T25972] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 515.092588][ T4113] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.119206][ T4113] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.131820][ T4113] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.151315][ T4113] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.197104][T26107] __nla_validate_parse: 26 callbacks suppressed [ 515.197118][T26107] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7740'. [ 515.275146][T26117] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7743'. [ 515.400098][T26122] loop2: detected capacity change from 0 to 2048 [ 515.423739][T26122] EXT4-fs: Ignoring removed bh option [ 515.429264][T26122] EXT4-fs: Ignoring removed mblk_io_submit option [ 515.504653][T26122] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 515.707423][T26142] loop1: detected capacity change from 0 to 512 [ 515.718788][T26142] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 515.785179][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 515.884685][T26157] netlink: 'syz.1.7761': attribute type 21 has an invalid length. [ 515.894700][T26157] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7761'. [ 515.951359][T26160] can0: slcan on ttyS3. [ 516.108834][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 516.126454][T26159] can0 (unregistered): slcan off ttyS3. [ 516.473590][T26199] loop4: detected capacity change from 0 to 8192 [ 516.526456][T26199] loop4: p1 p2[DM] p4 [ 516.530593][T26199] loop4: p1 size 196608 extends beyond EOD, truncated [ 516.539441][T26199] loop4: p2 start 4292936063 is beyond EOD, truncated [ 516.546363][T26199] loop4: p4 size 50331648 extends beyond EOD, truncated [ 517.371193][ T29] kauditd_printk_skb: 1368 callbacks suppressed [ 517.371211][ T29] audit: type=1400 audit(1755988307.206:59141): avc: denied { open } for pid=26221 comm="syz.1.7793" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 517.396995][ T29] audit: type=1400 audit(1755988307.206:59142): avc: denied { perfmon } for pid=26221 comm="syz.1.7793" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 517.418191][ T29] audit: type=1400 audit(1755988307.206:59143): avc: denied { kernel } for pid=26221 comm="syz.1.7793" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 517.490544][ T29] audit: type=1400 audit(1755988307.286:59144): avc: denied { map_create } for pid=26223 comm="syz.4.7792" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 517.510214][ T29] audit: type=1400 audit(1755988307.286:59145): avc: denied { prog_load } for pid=26223 comm="syz.4.7792" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 517.529506][ T29] audit: type=1400 audit(1755988307.286:59146): avc: denied { bpf } for pid=26223 comm="syz.4.7792" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 517.550331][ T29] audit: type=1400 audit(1755988307.286:59147): avc: denied { perfmon } for pid=26223 comm="syz.4.7792" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 517.571400][ T29] audit: type=1400 audit(1755988307.286:59148): avc: denied { create } for pid=26223 comm="syz.4.7792" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 517.591258][ T29] audit: type=1400 audit(1755988307.286:59149): avc: denied { setopt } for pid=26223 comm="syz.4.7792" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 517.610867][ T29] audit: type=1400 audit(1755988307.286:59150): avc: denied { connect } for pid=26223 comm="syz.4.7792" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 517.688281][T26234] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7796'. [ 517.740226][T26236] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7797'. [ 517.749214][T26236] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7797'. [ 517.863822][T26224] netlink: 168 bytes leftover after parsing attributes in process `syz.1.7793'. [ 517.893642][T26224] can0: slcan on ttyS3. [ 517.906784][T26244] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7800'. [ 517.956268][T26224] can0 (unregistered): slcan off ttyS3. [ 517.966784][T26224] can0: slcan on ttyS3. [ 517.979503][T26224] loop1: detected capacity change from 0 to 512 [ 517.996267][T26224] ext4: Unknown parameter 'nouser_xattr' [ 518.116350][T26221] can0 (unregistered): slcan off ttyS3. [ 518.157177][T26250] loop5: detected capacity change from 0 to 1764 [ 518.319720][T26255] loop4: detected capacity change from 0 to 2048 [ 518.333718][T26255] EXT4-fs: Ignoring removed bh option [ 518.339220][T26255] EXT4-fs: Ignoring removed mblk_io_submit option [ 518.369671][T26255] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 518.555054][T26279] @: renamed from vlan0 (while UP) [ 518.677241][T26287] FAULT_INJECTION: forcing a failure. [ 518.677241][T26287] name failslab, interval 1, probability 0, space 0, times 0 [ 518.689918][T26287] CPU: 0 UID: 0 PID: 26287 Comm: syz.2.7816 Not tainted syzkaller #0 PREEMPT(voluntary) [ 518.689946][T26287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 518.689962][T26287] Call Trace: [ 518.690030][T26287] [ 518.690052][T26287] __dump_stack+0x1d/0x30 [ 518.690072][T26287] dump_stack_lvl+0xe8/0x140 [ 518.690095][T26287] dump_stack+0x15/0x1b [ 518.690115][T26287] should_fail_ex+0x265/0x280 [ 518.690176][T26287] should_failslab+0x8c/0xb0 [ 518.690200][T26287] kmem_cache_alloc_node_noprof+0x57/0x320 [ 518.690273][T26287] ? __alloc_skb+0x101/0x320 [ 518.690309][T26287] __alloc_skb+0x101/0x320 [ 518.690341][T26287] ? audit_log_start+0x365/0x6c0 [ 518.690374][T26287] audit_log_start+0x380/0x6c0 [ 518.690483][T26287] audit_seccomp+0x48/0x100 [ 518.690514][T26287] ? __seccomp_filter+0x68c/0x10d0 [ 518.690577][T26287] __seccomp_filter+0x69d/0x10d0 [ 518.690616][T26287] ? bpf_send_signal_common+0x280/0x300 [ 518.690657][T26287] __secure_computing+0x82/0x150 [ 518.690682][T26287] syscall_trace_enter+0xcf/0x1e0 [ 518.690705][T26287] do_syscall_64+0xac/0x200 [ 518.690790][T26287] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 518.690818][T26287] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 518.690864][T26287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.690892][T26287] RIP: 0033:0x7f0c9306ebe9 [ 518.690908][T26287] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 518.690925][T26287] RSP: 002b:00007f0c91ad7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d5 [ 518.690943][T26287] RAX: ffffffffffffffda RBX: 00007f0c93295fa0 RCX: 00007f0c9306ebe9 [ 518.690955][T26287] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 518.690970][T26287] RBP: 00007f0c91ad7090 R08: 0000000000000000 R09: 0000000000000000 [ 518.691057][T26287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 518.691070][T26287] R13: 00007f0c93296038 R14: 00007f0c93295fa0 R15: 00007fff6c492598 [ 518.691094][T26287] [ 518.902576][T26290] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7818'. [ 518.911576][T26290] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7818'. [ 518.963690][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 519.206430][T26322] netlink: 'syz.4.7829': attribute type 21 has an invalid length. [ 519.246686][T26326] loop5: detected capacity change from 0 to 2048 [ 519.254493][T26326] EXT4-fs: Ignoring removed bh option [ 519.259968][T26326] EXT4-fs: Ignoring removed mblk_io_submit option [ 519.288334][T26326] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 519.344353][T26328] can0: slcan on ttyS3. [ 519.358250][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 519.502848][T26342] hsr_slave_1 (unregistering): left promiscuous mode [ 519.513510][T26352] loop2: detected capacity change from 0 to 512 [ 519.523179][T26352] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 519.588749][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 519.606465][T26330] can0 (unregistered): slcan off ttyS3. [ 519.624006][T26330] can0: slcan on ttyS3. [ 519.678082][T26356] loop1: detected capacity change from 0 to 2048 [ 519.685510][T26356] EXT4-fs: Ignoring removed bh option [ 519.690986][T26356] EXT4-fs: Ignoring removed mblk_io_submit option [ 519.697696][T26329] can0 (unregistered): slcan off ttyS3. [ 519.708612][T26356] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 519.713804][T26359] loop2: detected capacity change from 0 to 1024 [ 519.743791][T26359] bridge_slave_0: left allmulticast mode [ 519.749525][T26359] bridge_slave_0: left promiscuous mode [ 519.755235][T26359] bridge0: port 1(bridge_slave_0) entered disabled state [ 519.764323][T26359] bridge_slave_1: left allmulticast mode [ 519.770057][T26359] bridge_slave_1: left promiscuous mode [ 519.775778][T26359] bridge0: port 2(bridge_slave_1) entered disabled state [ 519.788099][T26359] bond0: (slave bond_slave_0): Releasing backup interface [ 519.797781][T26359] bond0: (slave bond_slave_1): Releasing backup interface [ 519.810131][T26359] team0: Port device C removed [ 519.817970][T26359] team0: Port device team_slave_1 removed [ 520.194527][T26382] loop2: detected capacity change from 0 to 8192 [ 520.194547][T26386] loop5: detected capacity change from 0 to 2048 [ 520.218675][T26386] EXT4-fs: Ignoring removed bh option [ 520.224158][T26386] EXT4-fs: Ignoring removed mblk_io_submit option [ 520.236774][T26382] loop2: p1 p2[DM] p4 [ 520.240914][T26382] loop2: p1 size 196608 extends beyond EOD, truncated [ 520.248170][T26382] loop2: p2 start 4292936063 is beyond EOD, truncated [ 520.254961][T26382] loop2: p4 size 50331648 extends beyond EOD, truncated [ 520.267270][T26386] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 520.309182][T26393] __nla_validate_parse: 8 callbacks suppressed [ 520.309198][T26393] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7861'. [ 520.338813][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 520.403445][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 520.414682][T26399] netlink: 'syz.4.7862': attribute type 21 has an invalid length. [ 520.437377][T26399] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7862'. [ 520.543063][T26405] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7866'. [ 520.552126][T26405] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7866'. [ 520.631459][T26417] FAULT_INJECTION: forcing a failure. [ 520.631459][T26417] name failslab, interval 1, probability 0, space 0, times 0 [ 520.644427][T26417] CPU: 1 UID: 0 PID: 26417 Comm: syz.0.7870 Not tainted syzkaller #0 PREEMPT(voluntary) [ 520.644501][T26417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 520.644514][T26417] Call Trace: [ 520.644521][T26417] [ 520.644529][T26417] __dump_stack+0x1d/0x30 [ 520.644551][T26417] dump_stack_lvl+0xe8/0x140 [ 520.644621][T26417] dump_stack+0x15/0x1b [ 520.644638][T26417] should_fail_ex+0x265/0x280 [ 520.644698][T26417] should_failslab+0x8c/0xb0 [ 520.644723][T26417] __kmalloc_noprof+0xa5/0x3e0 [ 520.644772][T26417] ? iovec_from_user+0x84/0x210 [ 520.644804][T26417] iovec_from_user+0x84/0x210 [ 520.644834][T26417] __import_iovec+0xf3/0x540 [ 520.644866][T26417] import_iovec+0x61/0x80 [ 520.644931][T26417] vfs_writev+0xfb/0x8b0 [ 520.644967][T26417] ? mutex_lock+0xd/0x30 [ 520.645004][T26417] do_writev+0xe7/0x210 [ 520.645034][T26417] __x64_sys_writev+0x45/0x50 [ 520.645059][T26417] x64_sys_call+0x1e9a/0x2ff0 [ 520.645081][T26417] do_syscall_64+0xd2/0x200 [ 520.645169][T26417] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 520.645252][T26417] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 520.645279][T26417] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.645301][T26417] RIP: 0033:0x7fb4bbddebe9 [ 520.645316][T26417] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 520.645343][T26417] RSP: 002b:00007fb4ba847038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 520.645370][T26417] RAX: ffffffffffffffda RBX: 00007fb4bc005fa0 RCX: 00007fb4bbddebe9 [ 520.645437][T26417] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000003 [ 520.645451][T26417] RBP: 00007fb4ba847090 R08: 0000000000000000 R09: 0000000000000000 [ 520.645463][T26417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 520.645476][T26417] R13: 00007fb4bc006038 R14: 00007fb4bc005fa0 R15: 00007fffbb399978 [ 520.645495][T26417] [ 520.850132][T26420] can0: slcan on ttyS3. [ 521.126313][T26416] can0 (unregistered): slcan off ttyS3. [ 521.194152][T26431] loop2: detected capacity change from 0 to 2048 [ 521.235175][T26431] EXT4-fs: Ignoring removed bh option [ 521.240668][T26431] EXT4-fs: Ignoring removed mblk_io_submit option [ 521.309134][T26431] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 521.356059][T26446] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7878'. [ 521.366624][T26447] netlink: 'syz.1.7877': attribute type 21 has an invalid length. [ 521.385182][T26447] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7877'. [ 521.592896][T26449] loop1: detected capacity change from 0 to 1764 [ 521.914729][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 521.952392][T26464] netlink: 88 bytes leftover after parsing attributes in process `syz.1.7886'. [ 522.136423][T26475] @: renamed from vlan0 (while UP) [ 522.278011][T26467] netlink: 168 bytes leftover after parsing attributes in process `syz.5.7890'. [ 522.298599][T26467] can0: slcan on ttyS3. [ 522.327334][T26467] loop5: detected capacity change from 0 to 512 [ 522.337615][T26467] ext4: Unknown parameter 'nouser_xattr' [ 522.385508][ T29] kauditd_printk_skb: 1483 callbacks suppressed [ 522.385525][ T29] audit: type=1400 audit(1755988312.216:60632): avc: denied { read write } for pid=26481 comm="syz.1.7895" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 522.416126][ T29] audit: type=1400 audit(1755988312.216:60633): avc: denied { read write open } for pid=26481 comm="syz.1.7895" path="/dev/loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 522.442164][T26492] loop1: detected capacity change from 0 to 8192 [ 522.448992][ T29] audit: type=1400 audit(1755988312.256:60634): avc: denied { create } for pid=26491 comm="syz.2.7899" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 522.469135][ T29] audit: type=1400 audit(1755988312.276:60635): avc: denied { ioctl } for pid=26481 comm="syz.1.7895" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 522.469158][T26466] can0 (unregistered): slcan off ttyS3. [ 522.500736][ T29] audit: type=1400 audit(1755988312.276:60636): avc: denied { prog_load } for pid=26495 comm="syz.4.7900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 522.519994][ T29] audit: type=1400 audit(1755988312.276:60637): avc: denied { bpf } for pid=26495 comm="syz.4.7900" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 522.540747][ T29] audit: type=1400 audit(1755988312.276:60638): avc: denied { perfmon } for pid=26495 comm="syz.4.7900" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 522.561906][ T29] audit: type=1400 audit(1755988312.286:60639): avc: denied { ioctl } for pid=26481 comm="syz.1.7895" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c05 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 522.588204][ T29] audit: type=1400 audit(1755988312.306:60640): avc: denied { prog_run } for pid=26495 comm="syz.4.7900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 522.609560][T26499] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7900'. [ 522.646313][ T29] audit: type=1400 audit(1755988312.426:60641): avc: denied { write } for pid=26491 comm="syz.2.7899" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 522.666943][T26492] loop1: p1 p2[DM] p4 [ 522.671120][T26492] loop1: p1 size 196608 extends beyond EOD, truncated [ 522.696215][T26492] loop1: p2 start 4292936063 is beyond EOD, truncated [ 522.703034][T26492] loop1: p4 size 50331648 extends beyond EOD, truncated [ 522.738004][T26503] netlink: 88 bytes leftover after parsing attributes in process `syz.0.7902'. [ 522.845360][T26506] can0: slcan on ttyS3. [ 522.916612][T26505] can0 (unregistered): slcan off ttyS3. [ 523.004898][T26518] FAULT_INJECTION: forcing a failure. [ 523.004898][T26518] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 523.018236][T26518] CPU: 0 UID: 0 PID: 26518 Comm: syz.5.7908 Not tainted syzkaller #0 PREEMPT(voluntary) [ 523.018291][T26518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 523.018307][T26518] Call Trace: [ 523.018316][T26518] [ 523.018325][T26518] __dump_stack+0x1d/0x30 [ 523.018347][T26518] dump_stack_lvl+0xe8/0x140 [ 523.018369][T26518] dump_stack+0x15/0x1b [ 523.018441][T26518] should_fail_ex+0x265/0x280 [ 523.018533][T26518] should_fail_alloc_page+0xf2/0x100 [ 523.018558][T26518] __alloc_frozen_pages_noprof+0xff/0x360 [ 523.018591][T26518] alloc_pages_mpol+0xb3/0x250 [ 523.018620][T26518] folio_alloc_mpol_noprof+0x39/0x80 [ 523.018694][T26518] shmem_get_folio_gfp+0x3cf/0xd60 [ 523.018742][T26518] shmem_fault+0xf6/0x250 [ 523.018834][T26518] __do_fault+0xb9/0x200 [ 523.018855][T26518] handle_mm_fault+0xd69/0x2c20 [ 523.018875][T26518] ? __rcu_read_unlock+0x4f/0x70 [ 523.018903][T26518] do_user_addr_fault+0x3fe/0x1090 [ 523.018961][T26518] exc_page_fault+0x62/0xa0 [ 523.018982][T26518] asm_exc_page_fault+0x26/0x30 [ 523.019000][T26518] RIP: 0010:filldir+0x1f6/0x420 [ 523.019072][T26518] Code: c1 ff 48 89 ef 4c 89 fe e8 67 a1 c1 ff 4c 39 fd 0f 82 af 01 00 00 4c 39 e5 0f 87 a6 01 00 00 0f 01 cb 0f ae e8 48 8b 44 24 40 <49> 89 47 08 48 8b 44 24 10 48 8b 4c 24 38 48 89 08 48 8b 6c 24 18 [ 523.019088][T26518] RSP: 0018:ffffc900017c3d68 EFLAGS: 00050287 [ 523.019101][T26518] RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff8881023fe300 [ 523.019181][T26518] RDX: 0000000000000000 RSI: 0000200000001fc0 RDI: 0000200000001fd8 [ 523.019192][T26518] RBP: 0000200000001fd8 R08: 0001c900017c3ea7 R09: 0000000000000000 [ 523.019269][T26518] R10: 0000000000000001 R11: ffffffff819658f0 R12: 00007ffffffff000 [ 523.019361][T26518] R13: 0000000000000004 R14: ffffffff864403b3 R15: 0000200000001fc0 [ 523.019374][T26518] ? __pfx_filldir+0x10/0x10 [ 523.019394][T26518] ? filldir+0x1d9/0x420 [ 523.019413][T26518] ? __pfx_filldir+0x10/0x10 [ 523.019429][T26518] proc_sys_readdir+0x142/0x620 [ 523.019473][T26518] iterate_dir+0x114/0x330 [ 523.019487][T26518] ? mutex_lock+0xd/0x30 [ 523.019542][T26518] __se_sys_getdents+0x88/0x1b0 [ 523.019568][T26518] ? __pfx_filldir+0x10/0x10 [ 523.019587][T26518] __x64_sys_getdents+0x43/0x50 [ 523.019615][T26518] x64_sys_call+0xee7/0x2ff0 [ 523.019634][T26518] do_syscall_64+0xd2/0x200 [ 523.019658][T26518] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 523.019679][T26518] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 523.019757][T26518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.019776][T26518] RIP: 0033:0x7fae2dedebe9 [ 523.019789][T26518] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 523.019804][T26518] RSP: 002b:00007fae2c947038 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 523.019820][T26518] RAX: ffffffffffffffda RBX: 00007fae2e105fa0 RCX: 00007fae2dedebe9 [ 523.019831][T26518] RDX: 00000000000000ab RSI: 0000200000001fc0 RDI: 0000000000000004 [ 523.019912][T26518] RBP: 00007fae2c947090 R08: 0000000000000000 R09: 0000000000000000 [ 523.019923][T26518] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 523.019933][T26518] R13: 00007fae2e106038 R14: 00007fae2e105fa0 R15: 00007ffd3a642388 [ 523.019949][T26518] [ 523.923137][T26531] tmpfs: Bad value for 'mpol' [ 524.058053][T26544] wireguard0: entered promiscuous mode [ 524.063629][T26544] wireguard0: entered allmulticast mode [ 524.381023][T26560] loop2: detected capacity change from 0 to 512 [ 524.389611][T26556] loop4: detected capacity change from 0 to 8192 [ 524.418380][T26560] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 524.446269][T26556] loop4: p1 p2[DM] p4 [ 524.450516][T26556] loop4: p1 size 196608 extends beyond EOD, truncated [ 524.504538][T26556] loop4: p2 start 4292936063 is beyond EOD, truncated [ 524.511491][T26556] loop4: p4 size 50331648 extends beyond EOD, truncated [ 524.599281][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 524.615285][T26567] loop5: detected capacity change from 0 to 1764 [ 524.910212][T26584] netlink: 'syz.5.7932': attribute type 21 has an invalid length. [ 525.044602][T26596] loop4: detected capacity change from 0 to 512 [ 525.062638][T26602] netlink: 'syz.5.7937': attribute type 21 has an invalid length. [ 525.073836][T26596] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 525.074385][T26599] 9pnet_fd: Insufficient options for proto=fd [ 525.128135][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 525.137939][T26600] loop2: detected capacity change from 0 to 2048 [ 525.145612][T26600] EXT4-fs: Ignoring removed bh option [ 525.151153][T26600] EXT4-fs: Ignoring removed mblk_io_submit option [ 525.188575][T26600] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 525.490193][T26621] loop9: detected capacity change from 0 to 7 [ 525.496420][T26621] Buffer I/O error on dev loop9, logical block 0, async page read [ 525.504539][T26621] Buffer I/O error on dev loop9, logical block 0, async page read [ 525.512429][T26621] loop9: unable to read partition table [ 525.518341][T26621] loop_reread_partitions: partition scan of loop9 (þ被xüŸÑø éÚ¬§½dG¤´à–ƒÝ¡¯ â·û [ 525.518341][T26621] ) failed (rc=-5) [ 525.550211][T26621] netlink: 'syz.0.7944': attribute type 4 has an invalid length. [ 525.576573][T26618] __nla_validate_parse: 3 callbacks suppressed [ 525.576590][T26618] netlink: 168 bytes leftover after parsing attributes in process `syz.4.7943'. [ 525.593335][T26618] C: renamed from team_slave_0 (while UP) [ 525.608656][T26618] can0: slcan on ttyS3. [ 525.628374][T26618] loop4: detected capacity change from 0 to 512 [ 525.636392][T26618] ext4: Unknown parameter 'nouser_xattr' [ 525.698777][T26617] can0 (unregistered): slcan off ttyS3. [ 525.716843][T26625] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7945'. [ 525.775257][T26629] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7946'. [ 525.881859][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 526.047662][T26642] netlink: 'syz.1.7951': attribute type 21 has an invalid length. [ 526.055689][T26642] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7951'. [ 528.228456][ T29] kauditd_printk_skb: 1354 callbacks suppressed [ 528.228474][ T29] audit: type=1400 audit(1755988316.897:61996): avc: denied { prog_load } for pid=26655 comm="syz.5.7957" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 528.254177][ T29] audit: type=1400 audit(1755988316.897:61997): avc: denied { bpf } for pid=26655 comm="syz.5.7957" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 528.274895][ T29] audit: type=1400 audit(1755988316.897:61998): avc: denied { perfmon } for pid=26655 comm="syz.5.7957" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 528.296077][ T29] audit: type=1400 audit(1755988317.193:61999): avc: denied { map_create } for pid=26655 comm="syz.5.7957" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 528.315476][ T29] audit: type=1400 audit(1755988317.193:62000): avc: denied { map_read map_write } for pid=26655 comm="syz.5.7957" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 528.335505][ T29] audit: type=1400 audit(1755988317.488:62001): avc: denied { allowed } for pid=26655 comm="syz.5.7957" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 528.355188][ T29] audit: type=1400 audit(1755988317.488:62002): avc: denied { create } for pid=26655 comm="syz.5.7957" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 528.376589][ T29] audit: type=1400 audit(1755988317.820:62003): avc: denied { relabelfrom } for pid=26655 comm="syz.5.7957" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 528.396672][ T29] audit: type=1400 audit(1755988317.820:62004): avc: denied { relabelto } for pid=26655 comm="syz.5.7957" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 528.420975][ T29] audit: type=1400 audit(1755988318.005:62005): avc: denied { read write } for pid=25972 comm="syz-executor" name="loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 528.657985][T26676] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7962'. [ 528.698711][T26692] loop2: detected capacity change from 0 to 512 [ 528.718750][T26692] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 528.784706][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 528.892947][T26708] loop5: detected capacity change from 0 to 2048 [ 528.906320][T26708] EXT4-fs: Ignoring removed bh option [ 528.911776][T26708] EXT4-fs: Ignoring removed mblk_io_submit option [ 528.959153][T26708] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 529.084397][T26724] loop1: detected capacity change from 0 to 2048 [ 529.102578][T26724] EXT4-fs: Ignoring removed bh option [ 529.108034][T26724] EXT4-fs: Ignoring removed mblk_io_submit option [ 529.292823][T26730] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7979'. [ 529.658810][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 529.824722][T26746] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7987'. [ 530.000507][T26724] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 530.158136][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 530.597190][T26768] loop4: detected capacity change from 0 to 2048 [ 530.654555][T26768] EXT4-fs: Ignoring removed bh option [ 530.660094][T26768] EXT4-fs: Ignoring removed mblk_io_submit option [ 530.775837][T26768] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 531.024437][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 531.038382][T26776] loop5: detected capacity change from 0 to 8192 [ 531.115219][T26776] loop5: p1 p2[DM] p4 [ 531.120732][T26776] loop5: p1 size 196608 extends beyond EOD, truncated [ 531.171293][T26776] loop5: p2 start 4292936063 is beyond EOD, truncated [ 531.178301][T26776] loop5: p4 size 50331648 extends beyond EOD, truncated [ 531.390602][T26790] loop2: detected capacity change from 0 to 2048 [ 531.410323][T26790] EXT4-fs: Ignoring removed bh option [ 531.415738][T26790] EXT4-fs: Ignoring removed mblk_io_submit option [ 531.436099][T26792] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8004'. [ 531.445029][T26792] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8004'. [ 531.488063][T26790] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 531.943357][T26817] loop1: detected capacity change from 0 to 2048 [ 531.955548][T26817] EXT4-fs: Ignoring removed bh option [ 531.961036][T26817] EXT4-fs: Ignoring removed mblk_io_submit option [ 532.005182][T26817] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 532.035871][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 532.038589][T26827] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8013'. [ 532.077218][T26825] loop4: detected capacity change from 0 to 1764 [ 532.106537][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 532.146901][T26831] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8016'. [ 532.409922][T26852] loop2: detected capacity change from 0 to 8192 [ 532.435109][T26855] loop1: detected capacity change from 0 to 8192 [ 532.438139][T26854] can0: slcan on ttyS3. [ 532.458290][T26852] loop2: p1 p2[DM] p4 [ 532.462521][T26852] loop2: p1 size 196608 extends beyond EOD, truncated [ 532.469951][T26852] loop2: p2 start 4292936063 is beyond EOD, truncated [ 532.476771][T26852] loop2: p4 size 50331648 extends beyond EOD, truncated [ 532.480097][T26855] loop1: p1 p2[DM] p4 [ 532.487926][T26855] loop1: p1 size 196608 extends beyond EOD, truncated [ 532.495453][T26855] loop1: p2 start 4292936063 is beyond EOD, truncated [ 532.502307][T26855] loop1: p4 size 50331648 extends beyond EOD, truncated [ 532.534012][T26853] can0 (unregistered): slcan off ttyS3. [ 532.595186][T26863] @: renamed from vlan0 (while UP) [ 532.662494][T26867] loop5: detected capacity change from 0 to 512 [ 532.673020][T26867] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 532.720869][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 532.757942][T26874] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8032'. [ 533.113846][T26892] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8040'. [ 533.376370][T26900] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8043'. [ 533.385410][T26900] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8043'. [ 533.475936][T26902] loop2: detected capacity change from 0 to 512 [ 533.512141][T26902] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 533.677001][ T29] kauditd_printk_skb: 1745 callbacks suppressed [ 533.677019][ T29] audit: type=1400 audit(1755988322.851:63751): avc: denied { prog_load } for pid=26906 comm="syz.4.8046" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 533.702578][ T29] audit: type=1400 audit(1755988322.851:63752): avc: denied { bpf } for pid=26906 comm="syz.4.8046" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 533.723338][ T29] audit: type=1400 audit(1755988322.851:63753): avc: denied { perfmon } for pid=26906 comm="syz.4.8046" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 533.800119][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 533.888658][ T29] audit: type=1400 audit(1755988322.925:63754): avc: denied { bpf } for pid=26906 comm="syz.4.8046" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 533.909631][ T29] audit: type=1400 audit(1755988322.925:63755): avc: denied { prog_run } for pid=26906 comm="syz.4.8046" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 533.928860][ T29] audit: type=1400 audit(1755988322.925:63756): avc: denied { unmount } for pid=24821 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 533.948778][ T29] audit: type=1400 audit(1755988322.934:63757): avc: denied { prog_load } for pid=26906 comm="syz.4.8046" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 533.968109][ T29] audit: type=1400 audit(1755988322.934:63758): avc: denied { bpf } for pid=26906 comm="syz.4.8046" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 533.988955][ T29] audit: type=1400 audit(1755988322.952:63759): avc: denied { read write } for pid=25972 comm="syz-executor" name="loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 534.013340][ T29] audit: type=1400 audit(1755988322.952:63760): avc: denied { open } for pid=25972 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 534.293888][T26911] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8049'. [ 534.345343][T26916] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8047'. [ 534.841889][T26920] loop4: detected capacity change from 0 to 2048 [ 534.891696][T26924] loop5: detected capacity change from 0 to 8192 [ 534.912868][T26920] EXT4-fs: Ignoring removed bh option [ 534.918324][T26920] EXT4-fs: Ignoring removed mblk_io_submit option [ 535.004475][T26924] loop5: p1 p2[DM] p4 [ 535.011649][T26920] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 535.026724][T26924] loop5: p1 size 196608 extends beyond EOD, truncated [ 535.075906][T26924] loop5: p2 start 4292936063 is beyond EOD, truncated [ 535.082772][T26924] loop5: p4 size 50331648 extends beyond EOD, truncated [ 535.219630][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 535.448990][T26933] loop5: detected capacity change from 0 to 736 [ 535.477015][T26933] rock: directory entry would overflow storage [ 535.483267][T26933] rock: sig=0x3b10, size=4, remaining=3 [ 535.544602][T26933] syz_tun: entered allmulticast mode [ 535.574510][T26933] pimreg: left allmulticast mode [ 535.688680][T26940] @: renamed from vlan0 (while UP) [ 535.700089][T26932] syz_tun: left allmulticast mode [ 536.023522][T26957] loop5: detected capacity change from 0 to 8192 [ 536.087666][T26957] loop5: p1 p2[DM] p4 [ 536.091866][T26957] loop5: p1 size 196608 extends beyond EOD, truncated [ 536.105867][T26957] loop5: p2 start 4292936063 is beyond EOD, truncated [ 536.112696][T26957] loop5: p4 size 50331648 extends beyond EOD, truncated [ 536.267590][T26964] can0: slcan on ttyS3. [ 536.337067][T26962] can0 (unregistered): slcan off ttyS3. [ 536.478806][T26984] loop4: detected capacity change from 0 to 736 [ 536.493976][T26984] rock: directory entry would overflow storage [ 536.500245][T26984] rock: sig=0x3b10, size=4, remaining=3 [ 536.953717][T27023] loop5: detected capacity change from 0 to 2048 [ 536.962447][T27023] EXT4-fs: Ignoring removed bh option [ 536.967967][T27023] EXT4-fs: Ignoring removed mblk_io_submit option [ 536.978238][T27023] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 537.125335][T27036] loop4: detected capacity change from 0 to 512 [ 537.147078][T27036] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 537.217092][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 537.243884][T27053] __nla_validate_parse: 5 callbacks suppressed [ 537.243904][T27053] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8104'. [ 537.313380][T27054] loop1: detected capacity change from 0 to 8192 [ 537.358966][T27056] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8106'. [ 537.368782][T27054] loop1: p1 p2[DM] p4 [ 537.372946][T27054] loop1: p1 size 196608 extends beyond EOD, truncated [ 537.393028][T27054] loop1: p2 start 4292936063 is beyond EOD, truncated [ 537.399903][T27054] loop1: p4 size 50331648 extends beyond EOD, truncated [ 537.705971][T27079] loop2: detected capacity change from 0 to 2048 [ 537.713858][T27079] EXT4-fs: Ignoring removed bh option [ 537.719467][T27079] EXT4-fs: Ignoring removed mblk_io_submit option [ 537.737355][T27079] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 537.787969][T27085] netlink: 60 bytes leftover after parsing attributes in process `syz.4.8116'. [ 537.797757][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 537.915303][T27092] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8119'. [ 538.148178][T27100] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8122'. [ 538.148287][T27094] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8120'. [ 538.157193][T27100] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8122'. [ 538.415642][T27115] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8129'. [ 539.002505][T27125] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8131'. [ 539.099873][ T29] kauditd_printk_skb: 1703 callbacks suppressed [ 539.099890][ T29] audit: type=1400 audit(1755988327.863:65464): avc: denied { map_read map_write } for pid=27128 comm="syz.0.8134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 539.202909][ T29] audit: type=1400 audit(1755988327.927:65465): avc: denied { read write } for pid=22567 comm="syz-executor" name="loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 539.227441][ T29] audit: type=1400 audit(1755988327.927:65466): avc: denied { read write open } for pid=22567 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 539.252852][ T29] audit: type=1400 audit(1755988327.927:65467): avc: denied { ioctl } for pid=22567 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 539.371238][ T29] audit: type=1400 audit(1755988328.038:65468): avc: denied { open } for pid=27132 comm="syz.0.8135" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 539.390700][ T29] audit: type=1400 audit(1755988328.038:65469): avc: denied { perfmon } for pid=27132 comm="syz.0.8135" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 539.412331][ T29] audit: type=1400 audit(1755988328.038:65470): avc: denied { kernel } for pid=27132 comm="syz.0.8135" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 539.432007][ T29] audit: type=1400 audit(1755988328.038:65471): avc: denied { prog_load } for pid=27131 comm="syz.5.8136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 539.451335][ T29] audit: type=1400 audit(1755988328.038:65472): avc: denied { bpf } for pid=27131 comm="syz.5.8136" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 539.472131][ T29] audit: type=1400 audit(1755988328.038:65473): avc: denied { prog_run } for pid=27131 comm="syz.5.8136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 539.512235][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 539.521727][T27133] loop5: detected capacity change from 0 to 512 [ 539.556246][T27133] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 539.577520][T27134] netlink: 168 bytes leftover after parsing attributes in process `syz.0.8135'. [ 539.658091][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 539.733976][T27143] loop2: detected capacity change from 0 to 1764 [ 539.806399][T27151] loop1: detected capacity change from 0 to 2048 [ 539.813982][T27151] EXT4-fs: Ignoring removed bh option [ 539.819522][T27151] EXT4-fs: Ignoring removed mblk_io_submit option [ 539.860821][T27151] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 540.529052][T27198] loop4: detected capacity change from 0 to 2048 [ 540.536600][T27198] EXT4-fs: Ignoring removed bh option [ 540.542094][T27198] EXT4-fs: Ignoring removed mblk_io_submit option [ 540.566490][T27198] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 540.596269][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 540.637833][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 540.762980][T27215] @: renamed from vlan0 (while UP) [ 540.936748][T27209] loop5: detected capacity change from 0 to 512 [ 540.949900][T27209] ext4: Unknown parameter 'nouser_xattr' [ 541.233866][T27237] loop1: detected capacity change from 0 to 2048 [ 541.275603][T27237] EXT4-fs: Ignoring removed bh option [ 541.281230][T27237] EXT4-fs: Ignoring removed mblk_io_submit option [ 541.348388][T27243] can0: slcan on ttyS3. [ 541.371829][T27237] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 541.494252][T27239] can0 (unregistered): slcan off ttyS3. [ 541.998960][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 542.857716][T27308] loop1: detected capacity change from 0 to 512 [ 542.876466][T27308] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 542.980876][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 543.119104][T27328] loop1: detected capacity change from 0 to 2048 [ 543.126755][T27328] EXT4-fs: Ignoring removed bh option [ 543.132343][T27328] EXT4-fs: Ignoring removed mblk_io_submit option [ 543.154125][T27328] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 543.203337][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 543.321681][T27355] loop2: detected capacity change from 0 to 512 [ 543.341546][T27355] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 543.398284][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 543.492139][T27371] loop2: detected capacity change from 0 to 512 [ 543.513750][T27371] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 543.623885][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 543.673421][T27380] loop4: detected capacity change from 0 to 2048 [ 543.683770][T27380] EXT4-fs: Ignoring removed bh option [ 543.689200][T27380] EXT4-fs: Ignoring removed mblk_io_submit option [ 543.730065][T27380] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 543.778333][T27377] __nla_validate_parse: 9 callbacks suppressed [ 543.778348][T27377] netlink: 168 bytes leftover after parsing attributes in process `syz.5.8229'. [ 543.796530][T27377] can0: slcan on ttyS3. [ 543.855736][T27377] can0 (unregistered): slcan off ttyS3. [ 543.874000][T27400] can0: slcan on ttyS3. [ 543.883967][T27377] loop5: detected capacity change from 0 to 512 [ 543.891201][T27377] ext4: Unknown parameter 'nouser_xattr' [ 543.966818][T27389] netlink: 168 bytes leftover after parsing attributes in process `syz.0.8233'. [ 543.980339][T27393] netlink: 168 bytes leftover after parsing attributes in process `syz.2.8236'. [ 544.039979][T27388] can0 (unregistered): slcan off ttyS3. [ 544.058482][T27393] loop2: detected capacity change from 0 to 512 [ 544.067643][T27393] ext4: Unknown parameter 'nouser_xattr' [ 544.405044][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 544.531170][ T29] kauditd_printk_skb: 1787 callbacks suppressed [ 544.531188][ T29] audit: type=1400 audit(1755988332.875:67261): avc: denied { map_create } for pid=27402 comm="syz.5.8239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 544.556894][ T29] audit: type=1400 audit(1755988332.875:67262): avc: denied { bpf } for pid=27402 comm="syz.5.8239" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 544.658080][ T29] audit: type=1400 audit(1755988332.911:67263): avc: denied { map_read map_write } for pid=27402 comm="syz.5.8239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 544.678249][ T29] audit: type=1400 audit(1755988332.921:67264): avc: denied { prog_load } for pid=27402 comm="syz.5.8239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 544.697778][ T29] audit: type=1400 audit(1755988332.921:67265): avc: denied { perfmon } for pid=27402 comm="syz.5.8239" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 544.719072][ T29] audit: type=1400 audit(1755988332.921:67266): avc: denied { prog_run } for pid=27402 comm="syz.5.8239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 544.738271][ T29] audit: type=1400 audit(1755988332.939:67267): avc: denied { read write } for pid=22567 comm="syz-executor" name="loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 544.762728][ T29] audit: type=1400 audit(1755988332.939:67268): avc: denied { open } for pid=22567 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 544.787007][ T29] audit: type=1400 audit(1755988332.939:67269): avc: denied { ioctl } for pid=22567 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 544.812768][ T29] audit: type=1400 audit(1755988332.958:67270): avc: denied { map_create } for pid=27405 comm="syz.0.8240" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 545.152130][T27431] loop2: detected capacity change from 0 to 736 [ 545.174085][T27431] rock: directory entry would overflow storage [ 545.180345][T27431] rock: sig=0x3b10, size=4, remaining=3 [ 545.537067][T27451] loop2: detected capacity change from 0 to 512 [ 545.598382][T27451] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 545.617700][T27453] SELinux: ebitmap: truncated map [ 545.624661][T27451] ext4 filesystem being mounted at /176/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 545.637871][T27453] SELinux: failed to load policy [ 545.684788][T27451] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 545.807641][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 547.559880][T27477] loop4: detected capacity change from 0 to 1764 [ 547.698571][T27483] loop2: detected capacity change from 0 to 736 [ 547.729454][T27485] loop4: detected capacity change from 0 to 736 [ 547.738080][T27483] rock: directory entry would overflow storage [ 547.744254][T27483] rock: sig=0x3b10, size=4, remaining=3 [ 547.760551][T27485] rock: directory entry would overflow storage [ 547.766744][T27485] rock: sig=0x3b10, size=4, remaining=3 [ 548.165727][T27503] loop2: detected capacity change from 0 to 1024 [ 548.203808][T27503] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 548.218255][T27463] SELinux: ebitmap: truncated map [ 548.224908][T27463] SELinux: failed to load policy [ 548.340140][T27513] loop5: detected capacity change from 0 to 736 [ 548.349427][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 548.395465][T27513] rock: directory entry would overflow storage [ 548.401658][T27513] rock: sig=0x3b10, size=4, remaining=3 [ 548.651147][T27543] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 548.663830][T27538] SELinux: ebitmap start bit (7587720) is not a multiple of the map unit size (64) [ 548.675280][T27538] SELinux: failed to load policy [ 548.675821][T27547] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8291'. [ 549.837422][T27595] loop2: detected capacity change from 0 to 1024 [ 549.902463][T27595] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 549.956272][ T29] kauditd_printk_skb: 1112 callbacks suppressed [ 549.956289][ T29] audit: type=1326 audit(1755988337.886:68383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27592 comm="syz.4.8314" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f139986ebe9 code=0x7ffc0000 [ 550.024167][T27600] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8315'. [ 550.053279][T27600] netem: change failed [ 550.075652][ T29] audit: type=1400 audit(1755988337.933:68384): avc: denied { read write } for pid=22567 comm="syz-executor" name="loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 550.100077][ T29] audit: type=1400 audit(1755988337.933:68385): avc: denied { open } for pid=22567 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 550.124397][ T29] audit: type=1400 audit(1755988337.933:68386): avc: denied { ioctl } for pid=22567 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 550.150177][ T29] audit: type=1400 audit(1755988337.933:68387): avc: denied { map_create } for pid=27593 comm="syz.2.8315" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 550.169519][ T29] audit: type=1400 audit(1755988337.933:68388): avc: denied { prog_load } for pid=27593 comm="syz.2.8315" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 550.188807][ T29] audit: type=1400 audit(1755988337.933:68389): avc: denied { bpf } for pid=27593 comm="syz.2.8315" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 550.209594][ T29] audit: type=1400 audit(1755988337.933:68390): avc: denied { perfmon } for pid=27593 comm="syz.2.8315" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 550.230794][ T29] audit: type=1400 audit(1755988337.969:68391): avc: denied { map_create } for pid=27601 comm="syz.5.8317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 550.250161][ T29] audit: type=1400 audit(1755988337.969:68392): avc: denied { perfmon } for pid=27601 comm="syz.5.8317" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 550.291331][T27595] loop2: detected capacity change from 1024 to 3 [ 550.309258][T27595] syz.2.8315: attempt to access beyond end of device [ 550.309258][T27595] loop2: rw=0, sector=6, nr_sectors = 2 limit=3 [ 550.322322][T27595] Buffer I/O error on dev loop2, logical block 3, async page read [ 550.334762][T27595] syz.2.8315: attempt to access beyond end of device [ 550.334762][T27595] loop2: rw=0, sector=6, nr_sectors = 2 limit=3 [ 550.347597][T27595] Buffer I/O error on dev loop2, logical block 3, async page read [ 550.355469][T27595] loop2: unable to read partition table [ 550.367112][T27595] loop_reread_partitions: partition scan of loop2 (ï5ŸA;¹8R÷Ö¤®mÝûÑÎ])Âî^\©) failed (rc=-5) [ 550.396489][T24821] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6334: Out of memory [ 550.418365][T24821] EXT4-fs error (device loop2): ext4_dirty_inode:6538: inode #2: comm syz-executor: mark_inode_dirty error [ 550.434271][T27612] FAULT_INJECTION: forcing a failure. [ 550.434271][T27612] name failslab, interval 1, probability 0, space 0, times 0 [ 550.446959][T27612] CPU: 0 UID: 0 PID: 27612 Comm: syz.0.8322 Not tainted syzkaller #0 PREEMPT(voluntary) [ 550.447034][T27612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 550.447047][T27612] Call Trace: [ 550.447053][T27612] [ 550.447060][T27612] __dump_stack+0x1d/0x30 [ 550.447085][T27612] dump_stack_lvl+0xe8/0x140 [ 550.447108][T27612] dump_stack+0x15/0x1b [ 550.447127][T27612] should_fail_ex+0x265/0x280 [ 550.447191][T27612] should_failslab+0x8c/0xb0 [ 550.447221][T27612] kmem_cache_alloc_noprof+0x50/0x310 [ 550.447249][T27612] ? getname_flags+0x80/0x3b0 [ 550.447353][T27612] getname_flags+0x80/0x3b0 [ 550.447385][T27612] __x64_sys_symlink+0x33/0x60 [ 550.447413][T27612] x64_sys_call+0x23cc/0x2ff0 [ 550.447510][T27612] do_syscall_64+0xd2/0x200 [ 550.447537][T27612] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 550.447561][T27612] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 550.447590][T27612] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.447615][T27612] RIP: 0033:0x7fb4bbddebe9 [ 550.447700][T27612] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 550.447720][T27612] RSP: 002b:00007fb4ba847038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 550.447743][T27612] RAX: ffffffffffffffda RBX: 00007fb4bc005fa0 RCX: 00007fb4bbddebe9 [ 550.447759][T27612] RDX: 0000000000000000 RSI: 00002000000009c0 RDI: 0000200000000280 [ 550.447807][T27612] RBP: 00007fb4ba847090 R08: 0000000000000000 R09: 0000000000000000 [ 550.447819][T27612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 550.447830][T27612] R13: 00007fb4bc006038 R14: 00007fb4bc005fa0 R15: 00007fffbb399978 [ 550.447918][T27612] [ 550.645871][T24821] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 550.739257][T27623] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8327'. [ 550.904329][ T4113] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.015870][ T4113] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.141514][ T4113] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.273036][ T4113] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.631806][T27649] loop4: detected capacity change from 0 to 2048 [ 551.678480][T27649] EXT4-fs: Ignoring removed bh option [ 551.683962][T27649] EXT4-fs: Ignoring removed mblk_io_submit option [ 551.786427][T27649] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 551.875179][ T4113] bond0 (unregistering): Released all slaves [ 551.942263][ T4113] hsr_slave_0: left promiscuous mode [ 551.963132][ T4113] veth1_macvtap: left promiscuous mode [ 551.968693][ T4113] veth0_macvtap: left promiscuous mode [ 551.985533][ T4113] veth1_vlan: left promiscuous mode [ 552.001540][ T4113] veth0_vlan: left promiscuous mode [ 552.113751][T27654] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8336'. [ 552.380586][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 552.652761][T27641] chnl_net:caif_netlink_parms(): no params data found [ 555.082735][T27641] bridge0: port 1(bridge_slave_0) entered blocking state [ 555.089835][T27641] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.138411][T27641] bridge_slave_0: entered allmulticast mode [ 555.275135][T27641] bridge_slave_0: entered promiscuous mode [ 555.294277][T27641] bridge0: port 2(bridge_slave_1) entered blocking state [ 555.301406][T27641] bridge0: port 2(bridge_slave_1) entered disabled state [ 555.789836][ T29] kauditd_printk_skb: 544 callbacks suppressed [ 555.789856][ T29] audit: type=1400 audit(1755988342.880:68937): avc: denied { create } for pid=27692 comm="syz.0.8347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 555.815895][ T29] audit: type=1400 audit(1755988342.880:68938): avc: denied { module_request } for pid=27692 comm="syz.0.8347" kmod="net-pf-2-proto-5-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 555.838924][ T29] audit: type=1400 audit(1755988342.944:68939): avc: denied { create } for pid=27692 comm="syz.0.8347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 555.858844][ T29] audit: type=1400 audit(1755988342.954:68940): avc: denied { sys_admin } for pid=27692 comm="syz.0.8347" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 555.883155][T27641] bridge_slave_1: entered allmulticast mode [ 555.895069][T27641] bridge_slave_1: entered promiscuous mode [ 555.897851][ T29] audit: type=1400 audit(1755988343.341:68941): avc: denied { read write } for pid=22567 comm="syz-executor" name="loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 555.925263][ T29] audit: type=1400 audit(1755988343.341:68942): avc: denied { open } for pid=22567 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 555.949566][ T29] audit: type=1400 audit(1755988343.341:68943): avc: denied { ioctl } for pid=22567 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 555.975364][ T29] audit: type=1400 audit(1755988343.360:68944): avc: denied { open } for pid=27699 comm="syz.5.8348" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 555.994836][ T29] audit: type=1400 audit(1755988343.360:68945): avc: denied { perfmon } for pid=27699 comm="syz.5.8348" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 556.015901][ T29] audit: type=1400 audit(1755988343.360:68946): avc: denied { kernel } for pid=27699 comm="syz.5.8348" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 556.250586][T27641] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 556.278462][T27641] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 556.327104][T27641] team0: Port device team_slave_0 added [ 556.344324][T27641] team0: Port device team_slave_1 added [ 556.358214][T27700] netlink: 168 bytes leftover after parsing attributes in process `syz.5.8348'. [ 556.422451][T27702] loop5: detected capacity change from 0 to 512 [ 556.467154][T27641] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 556.474275][T27641] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 556.500343][T27641] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 556.513559][T27702] ext4: Unknown parameter 'nouser_xattr' [ 556.541346][T27711] loop4: detected capacity change from 0 to 2048 [ 556.551222][T27711] EXT4-fs: Ignoring removed bh option [ 556.556758][T27711] EXT4-fs: Ignoring removed mblk_io_submit option [ 556.626917][T27641] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 556.633994][T27641] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 556.660019][T27641] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 556.679735][T27711] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 556.716978][T27641] hsr_slave_0: entered promiscuous mode [ 556.723133][T27641] hsr_slave_1: entered promiscuous mode [ 556.751828][T27641] debugfs: 'hsr0' already exists in 'hsr' [ 556.757712][T27641] Cannot create hsr debugfs directory [ 556.966385][T27723] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8355'. [ 556.975427][T27723] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8355'. [ 556.984463][T27641] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 557.374225][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 557.494824][T27641] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 557.510303][T27641] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 557.541283][T27641] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 557.741878][T27735] can0: slcan on ttyS3. [ 557.913269][T27641] 8021q: adding VLAN 0 to HW filter on device bond0 [ 557.940815][T27734] can0 (unregistered): slcan off ttyS3. [ 557.991249][T27641] 8021q: adding VLAN 0 to HW filter on device team0 [ 558.039113][ T6762] bridge0: port 1(bridge_slave_0) entered blocking state [ 558.046322][ T6762] bridge0: port 1(bridge_slave_0) entered forwarding state [ 558.127628][ T6762] bridge0: port 2(bridge_slave_1) entered blocking state [ 558.134739][ T6762] bridge0: port 2(bridge_slave_1) entered forwarding state [ 558.256336][T27763] loop5: detected capacity change from 0 to 1024 [ 558.287904][T27763] EXT4-fs: Ignoring removed nomblk_io_submit option [ 558.312746][T27763] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 558.340199][T27763] System zones: 0-1, 3-36 [ 558.346574][T27763] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 558.386467][T27763] capability: warning: `syz.5.8365' uses deprecated v2 capabilities in a way that may be insecure [ 558.427978][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 558.461158][T27641] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 558.607366][T27770] netlink: 168 bytes leftover after parsing attributes in process `syz.0.8367'. [ 558.658524][T27783] loop4: detected capacity change from 0 to 2048 [ 558.667500][T27783] EXT4-fs: Ignoring removed bh option [ 558.672983][T27783] EXT4-fs: Ignoring removed mblk_io_submit option [ 558.734379][T27783] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 558.993844][T27641] veth0_vlan: entered promiscuous mode [ 559.003453][T27641] veth1_vlan: entered promiscuous mode [ 559.025851][T27641] veth0_macvtap: entered promiscuous mode [ 559.034191][T27641] veth1_macvtap: entered promiscuous mode [ 559.050359][T27641] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 559.064787][T27641] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 559.107372][ T6762] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.116874][ T6762] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.164049][ T6762] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.218768][ T6762] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.468907][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 559.498789][T27800] netlink: 168 bytes leftover after parsing attributes in process `syz.1.8371'. [ 559.514544][T27800] can0: slcan on ttyS3. [ 559.576527][T27800] can0 (unregistered): slcan off ttyS3. [ 559.588783][T27801] can0: slcan on ttyS3. [ 559.627155][T27800] loop1: detected capacity change from 0 to 512 [ 559.656936][T27800] ext4: Unknown parameter 'nouser_xattr' [ 559.779692][T27811] loop4: detected capacity change from 0 to 2048 [ 559.794214][T27811] EXT4-fs: Ignoring removed bh option [ 559.799650][T27811] EXT4-fs: Ignoring removed mblk_io_submit option [ 559.806512][T27798] can0 (unregistered): slcan off ttyS3. [ 559.816428][T27817] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8374'. [ 559.838105][T27811] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 560.338835][T27840] loop5: detected capacity change from 0 to 2048 [ 560.346569][T27840] EXT4-fs: Ignoring removed bh option [ 560.351962][T27840] EXT4-fs: Ignoring removed mblk_io_submit option [ 560.369376][T27840] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 560.476399][T27845] geneve2: entered promiscuous mode [ 560.481653][T27845] geneve2: entered allmulticast mode [ 560.498286][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 560.687650][T27851] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8386'. [ 561.004249][T27865] can0: slcan on ttyS3. [ 561.125693][T27864] can0 (unregistered): slcan off ttyS3. [ 561.166359][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 561.248562][ T29] kauditd_printk_skb: 1056 callbacks suppressed [ 561.248580][ T29] audit: type=1400 audit(1755988348.298:70003): avc: denied { read write } for pid=27641 comm="syz-executor" name="loop6" dev="devtmpfs" ino=106 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 561.279287][ T29] audit: type=1400 audit(1755988348.298:70004): avc: denied { open } for pid=27641 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=106 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 561.476094][ T29] audit: type=1400 audit(1755988348.353:70005): avc: denied { ioctl } for pid=27641 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=106 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 561.502097][ T29] audit: type=1400 audit(1755988348.418:70006): avc: denied { read write } for pid=21888 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 561.526487][ T29] audit: type=1400 audit(1755988348.418:70007): avc: denied { open } for pid=21888 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 561.550823][ T29] audit: type=1400 audit(1755988348.418:70008): avc: denied { ioctl } for pid=21888 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 561.576698][ T29] audit: type=1400 audit(1755988348.464:70009): avc: denied { read write } for pid=27641 comm="syz-executor" name="loop6" dev="devtmpfs" ino=106 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 561.601105][ T29] audit: type=1400 audit(1755988348.464:70010): avc: denied { open } for pid=27641 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=106 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 561.625428][ T29] audit: type=1400 audit(1755988348.464:70011): avc: denied { ioctl } for pid=27641 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=106 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 561.651259][ T29] audit: type=1400 audit(1755988348.473:70012): avc: denied { create } for pid=27872 comm="syz.1.8396" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 561.834686][T27881] 9pnet_fd: Insufficient options for proto=fd [ 561.852472][T27875] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8397'. [ 561.925510][T27875] hsr_slave_1 (unregistering): left promiscuous mode [ 563.124931][T27898] loop1: detected capacity change from 0 to 2048 [ 563.143735][T27898] EXT4-fs: Ignoring removed bh option [ 563.149264][T27898] EXT4-fs: Ignoring removed mblk_io_submit option [ 563.186700][T27898] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 563.315029][T27911] can0: slcan on ttyS3. [ 563.390159][T27906] can0 (unregistered): slcan off ttyS3. [ 563.392485][T27912] loop5: detected capacity change from 0 to 2048 [ 563.402662][T27912] EXT4-fs: Ignoring removed bh option [ 563.408084][T27912] EXT4-fs: Ignoring removed mblk_io_submit option [ 563.429791][T27912] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 563.889579][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 565.997013][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 566.076452][T27941] loop4: detected capacity change from 0 to 512 [ 566.087165][T27941] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 566.177374][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 566.339407][T27947] can0: slcan on ttyS3. [ 566.461269][T27944] netlink: 168 bytes leftover after parsing attributes in process `syz.1.8418'. [ 566.528508][T27957] @: renamed from vlan0 (while UP) [ 566.607663][T27944] can0 (unregistered): slcan off ttyS3. [ 566.642935][T27944] can0: slcan on ttyS3. [ 566.674576][ T29] kauditd_printk_skb: 692 callbacks suppressed [ 566.674639][ T29] audit: type=1326 audit(1755988353.310:70660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27963 comm="syz.6.8424" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b36eeebe9 code=0x7ffc0000 [ 566.711474][T27944] loop1: detected capacity change from 0 to 512 [ 566.737143][T27944] ext4: Unknown parameter 'nouser_xattr' [ 566.903358][ T29] audit: type=1326 audit(1755988353.337:70661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27963 comm="syz.6.8424" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f4b36eeebe9 code=0x7ffc0000 [ 566.927003][ T29] audit: type=1400 audit(1755988353.337:70662): avc: denied { allowed } for pid=27963 comm="syz.6.8424" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 566.946508][ T29] audit: type=1400 audit(1755988353.337:70663): avc: denied { create } for pid=27963 comm="syz.6.8424" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 566.967947][ T29] audit: type=1326 audit(1755988353.337:70664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27963 comm="syz.6.8424" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f4b36eeec23 code=0x7ffc0000 [ 566.991457][ T29] audit: type=1400 audit(1755988353.337:70665): avc: denied { map } for pid=27963 comm="syz.6.8424" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=90150 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 567.015877][ T29] audit: type=1400 audit(1755988353.337:70666): avc: denied { read write } for pid=27963 comm="syz.6.8424" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=90150 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 567.040942][ T29] audit: type=1400 audit(1755988353.337:70667): avc: denied { prog_load } for pid=27965 comm="syz.4.8425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 567.060287][ T29] audit: type=1400 audit(1755988353.337:70668): avc: denied { bpf } for pid=27965 comm="syz.4.8425" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 567.081185][ T29] audit: type=1400 audit(1755988353.337:70669): avc: denied { read write } for pid=27943 comm="syz.1.8418" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 568.384555][T27943] can0 (unregistered): slcan off ttyS3. [ 571.388965][T27985] loop5: detected capacity change from 0 to 512 [ 571.422761][T27985] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 571.641292][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 572.461518][ T29] kauditd_printk_skb: 229 callbacks suppressed [ 572.461537][ T29] audit: type=1400 audit(1755988357.952:70899): avc: denied { create } for pid=27993 comm="syz.1.8434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 572.487487][ T29] audit: type=1400 audit(1755988357.952:70900): avc: denied { module_request } for pid=27993 comm="syz.1.8434" kmod="net-pf-2-proto-5-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 572.510540][ T29] audit: type=1400 audit(1755988357.999:70901): avc: denied { create } for pid=27993 comm="syz.1.8434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 572.530522][ T29] audit: type=1400 audit(1755988358.008:70902): avc: denied { sys_admin } for pid=27993 comm="syz.1.8434" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 572.551678][ T29] audit: type=1400 audit(1755988358.312:70903): avc: denied { map_create } for pid=27993 comm="syz.1.8434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 572.571037][ T29] audit: type=1400 audit(1755988358.312:70904): avc: denied { bpf } for pid=27993 comm="syz.1.8434" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 572.591888][ T29] audit: type=1400 audit(1755988358.312:70905): avc: denied { map_read map_write } for pid=27993 comm="syz.1.8434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 572.611907][ T29] audit: type=1400 audit(1755988358.312:70906): avc: denied { prog_load } for pid=27993 comm="syz.1.8434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 572.631155][ T29] audit: type=1400 audit(1755988358.312:70907): avc: denied { bpf } for pid=27993 comm="syz.1.8434" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 572.652058][ T29] audit: type=1400 audit(1755988358.312:70908): avc: denied { perfmon } for pid=27993 comm="syz.1.8434" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 577.887367][ T29] kauditd_printk_skb: 320 callbacks suppressed [ 577.887390][ T29] audit: type=1400 audit(1755988363.666:71229): avc: denied { open } for pid=28070 comm="syz.1.8453" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 577.913136][ T29] audit: type=1400 audit(1755988363.666:71230): avc: denied { perfmon } for pid=28070 comm="syz.1.8453" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 577.934358][ T29] audit: type=1400 audit(1755988363.666:71231): avc: denied { kernel } for pid=28070 comm="syz.1.8453" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 577.990141][T28054] netlink: 168 bytes leftover after parsing attributes in process `syz.6.8447'. [ 578.005973][T28054] C: renamed from team_slave_0 (while UP) [ 578.021151][T28054] can0: slcan on ttyS3. [ 578.052694][ T29] audit: type=1400 audit(1755988363.721:71232): avc: denied { perfmon } for pid=28070 comm="syz.1.8453" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 578.073914][ T29] audit: type=1400 audit(1755988363.721:71233): avc: denied { tracepoint } for pid=28070 comm="syz.1.8453" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 578.093890][ T29] audit: type=1400 audit(1755988363.730:71234): avc: denied { allowed } for pid=28070 comm="syz.1.8453" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 578.113528][ T29] audit: type=1400 audit(1755988363.730:71235): avc: denied { create } for pid=28070 comm="syz.1.8453" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 578.135070][ T29] audit: type=1400 audit(1755988363.730:71236): avc: denied { create } for pid=28070 comm="syz.1.8453" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 578.155103][ T29] audit: type=1400 audit(1755988363.730:71237): avc: denied { bind } for pid=28070 comm="syz.1.8453" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 578.175278][ T29] audit: type=1400 audit(1755988363.730:71238): avc: denied { perfmon } for pid=28070 comm="syz.1.8453" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 578.274142][T28080] loop6: detected capacity change from 0 to 512 [ 578.281900][T28080] ext4: Unknown parameter 'nouser_xattr' [ 578.301418][T28054] can0 (unregistered): slcan off ttyS3. [ 578.309580][T28078] can0: slcan on ttyS3. [ 578.428293][T28053] can0 (unregistered): slcan off ttyS3. [ 580.427863][T28106] loop6: detected capacity change from 0 to 2048 [ 580.472135][T28107] loop5: detected capacity change from 0 to 2048 [ 580.482937][T28106] EXT4-fs: Ignoring removed bh option [ 580.488560][T28106] EXT4-fs: Ignoring removed mblk_io_submit option [ 580.537227][T28107] EXT4-fs: Ignoring removed bh option [ 580.542790][T28107] EXT4-fs: Ignoring removed mblk_io_submit option [ 580.652043][T28106] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 580.664932][T28107] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 580.726434][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 580.750540][T27641] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 582.252639][T28134] Invalid logical block size (536872960) [ 582.300950][T28134] bridge0: entered promiscuous mode [ 582.307190][T28137] loop4: detected capacity change from 0 to 512 [ 582.315887][T28134] macsec1: entered promiscuous mode [ 582.323880][T28134] bridge0: port 3(macsec1) entered blocking state [ 582.330408][T28134] bridge0: port 3(macsec1) entered disabled state [ 582.337152][T28134] macsec1: entered allmulticast mode [ 582.342491][T28134] bridge0: entered allmulticast mode [ 582.349084][T28137] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 582.364530][T28134] macsec1: left allmulticast mode [ 582.369866][T28134] bridge0: left allmulticast mode [ 582.387102][T28137] EXT4-fs error (device loop4): ext4_acquire_dquot:6937: comm syz.4.8470: Failed to acquire dquot type 1 [ 582.414432][T28134] bridge0: left promiscuous mode [ 582.434357][T28137] EXT4-fs (loop4): 1 truncate cleaned up [ 582.462616][T28137] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 582.519901][T28144] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8472'. [ 582.547581][T28137] EXT4-fs error (device loop4): ext4_lookup:1791: inode #2: comm syz.4.8470: deleted inode referenced: 12 [ 582.566625][T28144] IPVS: Error joining to the multicast group [ 582.591742][T28137] EXT4-fs error (device loop4): ext4_lookup:1791: inode #2: comm syz.4.8470: deleted inode referenced: 12 [ 582.639586][T28150] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 582.652685][T28137] IPVS: stopping master sync thread 28150 ... [ 582.861106][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 582.916933][T28149] netlink: 168 bytes leftover after parsing attributes in process `syz.5.8473'. [ 583.082595][T28179] FAULT_INJECTION: forcing a failure. [ 583.082595][T28179] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 583.085040][T28149] loop5: detected capacity change from 0 to 512 [ 583.095717][T28179] CPU: 1 UID: 0 PID: 28179 Comm: syz.0.8484 Not tainted syzkaller #0 PREEMPT(voluntary) [ 583.095806][T28179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 583.095825][T28179] Call Trace: [ 583.095834][T28179] [ 583.095846][T28179] __dump_stack+0x1d/0x30 [ 583.095877][T28179] dump_stack_lvl+0xe8/0x140 [ 583.095902][T28179] dump_stack+0x15/0x1b [ 583.095927][T28179] should_fail_ex+0x265/0x280 [ 583.096044][T28179] should_fail+0xb/0x20 [ 583.096151][T28179] should_fail_usercopy+0x1a/0x20 [ 583.096182][T28179] _copy_from_user+0x1c/0xb0 [ 583.096222][T28179] memdup_user+0x5e/0xd0 [ 583.096258][T28179] strndup_user+0x68/0xb0 [ 583.096324][T28179] __se_sys_mount+0x4d/0x2e0 [ 583.096354][T28179] ? fput+0x8f/0xc0 [ 583.096455][T28179] ? ksys_write+0x192/0x1a0 [ 583.096494][T28179] __x64_sys_mount+0x67/0x80 [ 583.096553][T28179] x64_sys_call+0x2b4d/0x2ff0 [ 583.096612][T28179] do_syscall_64+0xd2/0x200 [ 583.096650][T28179] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 583.096755][T28179] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 583.096791][T28179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 583.096885][T28179] RIP: 0033:0x7fb4bbddebe9 [ 583.096907][T28179] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 583.096931][T28179] RSP: 002b:00007fb4ba847038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 583.096957][T28179] RAX: ffffffffffffffda RBX: 00007fb4bc005fa0 RCX: 00007fb4bbddebe9 [ 583.096975][T28179] RDX: 0000200000000280 RSI: 0000200000000300 RDI: 0000000000000000 [ 583.097022][T28179] RBP: 00007fb4ba847090 R08: 0000200000000600 R09: 0000000000000000 [ 583.097040][T28179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 583.097132][T28179] R13: 00007fb4bc006038 R14: 00007fb4bc005fa0 R15: 00007fffbb399978 [ 583.097159][T28179] [ 583.313917][ T29] kauditd_printk_skb: 606 callbacks suppressed [ 583.313992][ T29] audit: type=1400 audit(1755988368.659:71843): avc: denied { perfmon } for pid=28182 comm="syz.0.8486" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 584.356397][T28181] loop6: detected capacity change from 0 to 512 [ 584.392292][T28181] EXT4-fs (loop6): feature flags set on rev 0 fs, running e2fsck is recommended [ 584.394419][ T29] audit: type=1400 audit(1755988368.705:71844): avc: denied { create } for pid=28162 comm="syz.4.8474" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 584.421186][ T29] audit: type=1400 audit(1755988368.705:71845): avc: denied { module_request } for pid=28162 comm="syz.4.8474" kmod="net-pf-2-proto-5-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 584.444238][ T29] audit: type=1400 audit(1755988368.752:71846): avc: denied { create } for pid=28162 comm="syz.4.8474" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 584.456093][T28149] ext4: Unknown parameter 'nouser_xattr' [ 584.464224][ T29] audit: type=1400 audit(1755988368.761:71847): avc: denied { sys_admin } for pid=28162 comm="syz.4.8474" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 584.491029][ T29] audit: type=1400 audit(1755988368.973:71848): avc: denied { map_create } for pid=28162 comm="syz.4.8474" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 584.510572][ T29] audit: type=1400 audit(1755988368.973:71849): avc: denied { bpf } for pid=28162 comm="syz.4.8474" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 584.531507][ T29] audit: type=1400 audit(1755988368.973:71850): avc: denied { map_read map_write } for pid=28162 comm="syz.4.8474" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 584.551552][ T29] audit: type=1400 audit(1755988369.084:71851): avc: denied { prog_load } for pid=28162 comm="syz.4.8474" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 584.570870][ T29] audit: type=1400 audit(1755988369.259:71852): avc: denied { perfmon } for pid=28162 comm="syz.4.8474" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 584.723588][T28181] EXT4-fs error (device loop6): ext4_acquire_dquot:6937: comm syz.6.8485: Failed to acquire dquot type 1 [ 584.749275][T28200] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8488'. [ 584.758213][T28200] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8488'. [ 584.779589][T28181] EXT4-fs (loop6): 1 truncate cleaned up [ 584.785732][T28181] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 584.949346][T27641] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 585.145505][T28208] loop6: detected capacity change from 0 to 8192 [ 585.686811][T28227] can0: slcan on ttyS3. [ 585.751710][T28227] can0 (unregistered): slcan off ttyS3. [ 585.766022][T28227] can0: slcan on ttyS3. [ 585.787820][T28227] loop5: detected capacity change from 0 to 512 [ 585.803846][T28227] ext4: Unknown parameter 'nouser_xattr' [ 585.881778][T28226] can0 (unregistered): slcan off ttyS3. [ 586.503104][T28248] loop5: detected capacity change from 0 to 512 [ 586.519975][T28248] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 586.544920][T28248] EXT4-fs error (device loop5): ext4_acquire_dquot:6937: comm syz.5.8509: Failed to acquire dquot type 1 [ 586.562177][T28248] EXT4-fs (loop5): 1 truncate cleaned up [ 586.572985][T28248] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 586.626968][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 586.834257][T28257] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8512'. [ 586.966539][T28252] can0: slcan on ttyS3. [ 587.022031][T28267] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 587.033876][T28264] IPVS: stopping master sync thread 28267 ... [ 587.041220][T28252] can0 (unregistered): slcan off ttyS3. [ 587.066688][T28252] can0: slcan on ttyS3. [ 587.080348][T28252] loop5: detected capacity change from 0 to 512 [ 587.093637][T28252] ext4: Unknown parameter 'nouser_xattr' [ 587.203960][T28251] can0 (unregistered): slcan off ttyS3. [ 587.207409][T28285] Invalid logical block size (536872960) [ 587.229215][T28285] bridge0: entered promiscuous mode [ 587.234601][T28285] macsec1: entered promiscuous mode [ 587.241017][T28285] bridge0: port 3(macsec1) entered blocking state [ 587.247535][T28285] bridge0: port 3(macsec1) entered disabled state [ 587.254259][T28285] macsec1: entered allmulticast mode [ 587.259614][T28285] bridge0: entered allmulticast mode [ 587.265680][T28285] macsec1: left allmulticast mode [ 587.270758][T28285] bridge0: left allmulticast mode [ 587.276727][T28285] bridge0: left promiscuous mode [ 587.620234][T28314] loop4: detected capacity change from 0 to 512 [ 587.629139][T28314] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 587.651865][T28314] EXT4-fs error (device loop4): ext4_acquire_dquot:6937: comm syz.4.8535: Failed to acquire dquot type 1 [ 587.664110][T28314] EXT4-fs (loop4): 1 truncate cleaned up [ 587.671554][T28314] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 587.683790][T28320] loop1: detected capacity change from 0 to 512 [ 587.690779][T28314] EXT4-fs error (device loop4): ext4_lookup:1791: inode #2: comm syz.4.8535: deleted inode referenced: 12 [ 587.703071][T28320] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 587.704054][T28314] EXT4-fs error (device loop4): ext4_lookup:1791: inode #2: comm syz.4.8535: deleted inode referenced: 12 [ 587.737701][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 587.739864][T28320] EXT4-fs error (device loop1): ext4_acquire_dquot:6937: comm syz.1.8537: Failed to acquire dquot type 1 [ 587.758857][T28320] EXT4-fs (loop1): 1 truncate cleaned up [ 587.771344][T28320] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 587.844395][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 587.923534][T28334] loop1: detected capacity change from 0 to 512 [ 587.936339][T28334] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 587.967951][T28334] EXT4-fs error (device loop1): ext4_acquire_dquot:6937: comm syz.1.8542: Failed to acquire dquot type 1 [ 587.988484][T28334] EXT4-fs (loop1): 1 truncate cleaned up [ 587.999209][T28344] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 588.008477][T28334] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 588.022020][T28344] vhci_hcd: invalid port number 96 [ 588.027238][T28344] vhci_hcd: default hub control req: 0300 vfffa i0060 l0 [ 588.039172][T28334] EXT4-fs error (device loop1): ext4_lookup:1791: inode #2: comm syz.1.8542: deleted inode referenced: 12 [ 588.064268][T28334] EXT4-fs error (device loop1): ext4_lookup:1791: inode #2: comm syz.1.8542: deleted inode referenced: 12 [ 588.094040][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 588.233366][T28355] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8551'. [ 588.351718][T28347] can0: slcan on ttyS3. [ 588.395348][T28347] can0 (unregistered): slcan off ttyS3. [ 588.404837][T28347] can0: slcan on ttyS3. [ 588.471543][T28345] can0 (unregistered): slcan off ttyS3. [ 588.851347][ T29] kauditd_printk_skb: 1087 callbacks suppressed [ 588.851365][ T29] audit: type=1400 audit(1755988373.773:72930): avc: denied { read write } for pid=27641 comm="syz-executor" name="loop6" dev="devtmpfs" ino=106 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 588.882161][ T29] audit: type=1400 audit(1755988373.773:72931): avc: denied { open } for pid=27641 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=106 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 588.906441][ T29] audit: type=1400 audit(1755988373.773:72932): avc: denied { ioctl } for pid=27641 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=106 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 589.221781][ T29] audit: type=1400 audit(1755988373.883:72933): avc: denied { read write } for pid=22567 comm="syz-executor" name="loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 589.246277][ T29] audit: type=1400 audit(1755988373.883:72934): avc: denied { open } for pid=22567 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 589.270728][ T29] audit: type=1400 audit(1755988373.883:72935): avc: denied { ioctl } for pid=22567 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 589.296580][ T29] audit: type=1400 audit(1755988373.902:72936): avc: denied { map_create } for pid=28380 comm="syz.6.8561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 589.316002][ T29] audit: type=1400 audit(1755988373.911:72937): avc: denied { map_read map_write } for pid=28380 comm="syz.6.8561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 589.336060][ T29] audit: type=1400 audit(1755988373.911:72938): avc: denied { prog_load } for pid=28380 comm="syz.6.8561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 589.355392][ T29] audit: type=1400 audit(1755988373.911:72939): avc: denied { bpf } for pid=28380 comm="syz.6.8561" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 589.812000][T28396] vhci_hcd: invalid port number 255 [ 589.905650][T28399] loop4: detected capacity change from 0 to 512 [ 589.945567][T28399] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 590.005525][T28399] EXT4-fs error (device loop4): ext4_acquire_dquot:6937: comm syz.4.8568: Failed to acquire dquot type 1 [ 590.051972][T28399] EXT4-fs (loop4): 1 truncate cleaned up [ 590.084376][T28399] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 590.141552][T28399] EXT4-fs error (device loop4): ext4_lookup:1791: inode #2: comm syz.4.8568: deleted inode referenced: 12 [ 590.180674][T28409] SELinux: failed to load policy [ 590.192691][T28399] EXT4-fs error (device loop4): ext4_lookup:1791: inode #2: comm syz.4.8568: deleted inode referenced: 12 [ 590.217589][T28414] netlink: 39285 bytes leftover after parsing attributes in process `syz.0.8572'. [ 590.290875][T28413] loop5: detected capacity change from 0 to 2048 [ 590.300677][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 590.324661][T28413] EXT4-fs: Ignoring removed bh option [ 590.330133][T28413] EXT4-fs: Ignoring removed mblk_io_submit option [ 590.370226][T28413] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 590.629957][T28417] can0: slcan on ttyS3. [ 590.703550][T28417] can0 (unregistered): slcan off ttyS3. [ 590.712763][T28417] can0: slcan on ttyS3. [ 590.721472][T28417] loop6: detected capacity change from 0 to 512 [ 590.729935][T28417] ext4: Unknown parameter 'nouser_xattr' [ 590.747885][T28442] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8583'. [ 590.756778][T28442] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8583'. [ 590.789712][T28416] can0 (unregistered): slcan off ttyS3. [ 590.981916][T28458] Invalid logical block size (536872960) [ 591.001278][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 591.336088][T28478] loop4: detected capacity change from 0 to 512 [ 591.344429][T28478] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 591.367745][T28478] EXT4-fs error (device loop4): ext4_acquire_dquot:6937: comm syz.4.8597: Failed to acquire dquot type 1 [ 591.382327][T28478] EXT4-fs (loop4): 1 truncate cleaned up [ 591.388816][T28478] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 591.427458][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 591.647564][T28491] loop4: detected capacity change from 0 to 2048 [ 591.682966][T28491] EXT4-fs: Ignoring removed bh option [ 591.688455][T28491] EXT4-fs: Ignoring removed mblk_io_submit option [ 591.745230][T28491] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 591.762135][T28496] can0: slcan on ttyS3. [ 591.879030][T28505] vlan0: entered allmulticast mode [ 591.927873][T28495] can0 (unregistered): slcan off ttyS3. [ 592.155383][T28510] loop5: detected capacity change from 0 to 512 [ 592.184509][T28510] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 592.389302][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 592.455198][T28524] loop1: detected capacity change from 0 to 512 [ 592.477843][T28524] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 592.498935][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 592.538351][T28524] EXT4-fs error (device loop1): ext4_acquire_dquot:6937: comm syz.1.8613: Failed to acquire dquot type 1 [ 592.553565][T28526] netlink: 'syz.0.8614': attribute type 13 has an invalid length. [ 592.567278][T28528] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8612'. [ 592.576171][T28528] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8612'. [ 592.590236][T28524] EXT4-fs (loop1): 1 truncate cleaned up [ 592.599333][T28524] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 592.689318][T28526] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 592.719273][T21888] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 592.763265][T28534] Invalid logical block size (536872960) [ 593.775933][T28554] loop4: detected capacity change from 0 to 512 [ 593.980237][T28554] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 595.022831][ T29] kauditd_printk_skb: 834 callbacks suppressed [ 595.022904][ T29] audit: type=1400 audit(1755988378.803:73768): avc: denied { create } for pid=28555 comm="syz.1.8617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 595.048968][ T29] audit: type=1400 audit(1755988378.803:73769): avc: denied { module_request } for pid=28555 comm="syz.1.8617" kmod="net-pf-2-proto-5-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 595.072231][ T29] audit: type=1400 audit(1755988378.812:73770): avc: denied { create } for pid=28555 comm="syz.1.8617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 595.092322][ T29] audit: type=1400 audit(1755988378.812:73771): avc: denied { sys_admin } for pid=28555 comm="syz.1.8617" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 595.113488][ T29] audit: type=1400 audit(1755988379.043:73772): avc: denied { map_create } for pid=28555 comm="syz.1.8617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 595.132858][ T29] audit: type=1400 audit(1755988379.043:73773): avc: denied { bpf } for pid=28555 comm="syz.1.8617" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 595.153612][ T29] audit: type=1400 audit(1755988379.043:73774): avc: denied { map_read map_write } for pid=28555 comm="syz.1.8617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 595.173745][ T29] audit: type=1400 audit(1755988379.145:73775): avc: denied { prog_load } for pid=28555 comm="syz.1.8617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 595.193112][ T29] audit: type=1400 audit(1755988379.246:73776): avc: denied { perfmon } for pid=28555 comm="syz.1.8617" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 595.214296][ T29] audit: type=1326 audit(1755988379.338:73777): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28555 comm="syz.1.8617" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d4886ebe9 code=0x7ffc0000 [ 595.471792][T28564] loop5: detected capacity change from 0 to 512 [ 595.489556][T28564] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 595.542681][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 595.593370][T28564] EXT4-fs error (device loop5): ext4_acquire_dquot:6937: comm syz.5.8624: Failed to acquire dquot type 1 [ 595.608869][T28573] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8625'. [ 595.631910][T28564] EXT4-fs (loop5): 1 truncate cleaned up [ 595.643175][T28564] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 595.698704][T28564] EXT4-fs error (device loop5): ext4_lookup:1791: inode #2: comm syz.5.8624: deleted inode referenced: 12 [ 595.733173][T28564] EXT4-fs error (device loop5): ext4_lookup:1791: inode #2: comm syz.5.8624: deleted inode referenced: 12 [ 595.801882][T28569] IPVS: stopping master sync thread 28582 ... [ 595.819581][T28582] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 595.853065][T28580] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8626'. [ 595.881907][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 596.043172][T28604] can0: slcan on ttyS3. [ 596.120137][T28599] can0 (unregistered): slcan off ttyS3. [ 596.216899][T28598] netlink: 168 bytes leftover after parsing attributes in process `syz.6.8633'. [ 596.224987][T28602] netlink: 168 bytes leftover after parsing attributes in process `syz.1.8634'. [ 596.249168][T28598] loop6: detected capacity change from 0 to 512 [ 596.258882][T28602] loop1: detected capacity change from 0 to 512 [ 596.259366][T28598] ext4: Unknown parameter 'nouser_xattr' [ 596.265973][T28602] ext4: Unknown parameter 'nouser_xattr' [ 596.296966][T28619] Invalid logical block size (536872960) [ 596.312165][T28619] bridge0: entered promiscuous mode [ 596.317530][T28619] macsec1: entered promiscuous mode [ 596.323725][T28619] bridge0: port 3(macsec1) entered blocking state [ 596.330312][T28619] bridge0: port 3(macsec1) entered disabled state [ 596.337069][T28619] macsec1: entered allmulticast mode [ 596.342421][T28619] bridge0: entered allmulticast mode [ 596.348460][T28619] macsec1: left allmulticast mode [ 596.353501][T28619] bridge0: left allmulticast mode [ 596.360360][T28619] bridge0: left promiscuous mode [ 596.452833][T28622] loop4: detected capacity change from 0 to 512 [ 596.512288][T28622] bridge0: port 2(bridge_slave_1) entered disabled state [ 596.519491][T28622] bridge0: port 1(bridge_slave_0) entered disabled state [ 596.571792][T28622] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 596.593781][T28637] loop4: detected capacity change from 0 to 1024 [ 596.602219][T28637] EXT4-fs: inline encryption not supported [ 596.608321][T28637] EXT4-fs: Ignoring removed i_version option [ 596.615269][T28637] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 596.616781][T28622] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 596.630662][T28637] EXT4-fs error (device loop4): ext4_map_blocks:814: inode #3: block 1: comm syz.4.8643: lblock 1 mapped to illegal pblock 1 (length 1) [ 596.650153][T28637] EXT4-fs error (device loop4): ext4_acquire_dquot:6937: comm syz.4.8643: Failed to acquire dquot type 0 [ 596.683110][T28637] EXT4-fs error (device loop4): ext4_free_blocks:6696: comm syz.4.8643: Freeing blocks not in datazone - block = 0, count = 4096 [ 596.730344][T28637] EXT4-fs error (device loop4): ext4_read_inode_bitmap:139: comm syz.4.8643: Invalid inode bitmap blk 0 in block_group 0 [ 596.731567][ T4113] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.745252][T28637] EXT4-fs error (device loop4) in ext4_free_inode:361: Corrupt filesystem [ 596.765011][T28637] EXT4-fs (loop4): 1 orphan inode deleted [ 596.771561][T28637] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 596.805420][ T12] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #3: block 1: comm kworker/u8:0: lblock 1 mapped to illegal pblock 1 (length 1) [ 596.821948][ T4113] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.831096][ T12] EXT4-fs error (device loop4): ext4_release_dquot:6973: comm kworker/u8:0: Failed to release dquot type 0 [ 596.866299][T28643] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8645'. [ 596.867851][ T4113] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.915551][ T4121] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.042023][T28622] netlink: 4268 bytes leftover after parsing attributes in process `syz.4.8643'. [ 597.051192][T28622] netlink: 4268 bytes leftover after parsing attributes in process `syz.4.8643'. [ 597.065607][T28643] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 597.143503][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 597.240880][T28661] loop4: detected capacity change from 0 to 2048 [ 597.255240][T28661] EXT4-fs: Ignoring removed bh option [ 597.260749][T28661] EXT4-fs: Ignoring removed mblk_io_submit option [ 597.282281][T28661] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 597.333454][ C0] ================================================================== [ 597.341572][ C0] BUG: KCSAN: data-race in wq_worker_tick / wq_worker_tick [ 597.348792][ C0] [ 597.351127][ C0] read-write to 0xffff8881000732b8 of 8 bytes by interrupt on cpu 1: [ 597.359214][ C0] wq_worker_tick+0x60/0x230 [ 597.363835][ C0] sched_tick+0x11a/0x270 [ 597.368184][ C0] update_process_times+0x15f/0x190 [ 597.373434][ C0] tick_nohz_handler+0x249/0x2d0 [ 597.378389][ C0] __hrtimer_run_queues+0x20c/0x5a0 [ 597.383683][ C0] hrtimer_interrupt+0x21a/0x460 [ 597.388640][ C0] __sysvec_apic_timer_interrupt+0x5c/0x1d0 [ 597.394553][ C0] sysvec_apic_timer_interrupt+0x6f/0x80 [ 597.400200][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 597.406197][ C0] _raw_spin_unlock_irq+0x2f/0x50 [ 597.411243][ C0] process_scheduled_works+0x486/0x9d0 [ 597.416723][ C0] worker_thread+0x582/0x770 [ 597.421329][ C0] kthread+0x486/0x510 [ 597.425411][ C0] ret_from_fork+0xda/0x150 [ 597.429923][ C0] ret_from_fork_asm+0x1a/0x30 [ 597.434694][ C0] [ 597.437022][ C0] read-write to 0xffff8881000732b8 of 8 bytes by interrupt on cpu 0: [ 597.445101][ C0] wq_worker_tick+0x60/0x230 [ 597.449701][ C0] sched_tick+0x11a/0x270 [ 597.454033][ C0] update_process_times+0x15f/0x190 [ 597.459254][ C0] tick_nohz_handler+0x249/0x2d0 [ 597.464197][ C0] __hrtimer_run_queues+0x20c/0x5a0 [ 597.469401][ C0] hrtimer_interrupt+0x21a/0x460 [ 597.474343][ C0] __sysvec_apic_timer_interrupt+0x5c/0x1d0 [ 597.480247][ C0] sysvec_apic_timer_interrupt+0x6f/0x80 [ 597.485888][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 597.492234][ C0] _raw_spin_unlock_irqrestore+0x3c/0x60 [ 597.497887][ C0] tty_insert_flip_string_and_push_buffer+0x1aa/0x1f0 [ 597.504679][ C0] pty_write+0x70/0x90 [ 597.508758][ C0] tty_put_char+0x8f/0xc0 [ 597.513089][ C0] __process_echoes+0x2f9/0x6b0 [ 597.517952][ C0] n_tty_receive_buf_common+0x8e4/0xbe0 [ 597.523529][ C0] n_tty_receive_buf2+0x33/0x40 [ 597.528395][ C0] tty_ldisc_receive_buf+0x63/0xf0 [ 597.533621][ C0] tty_port_default_receive_buf+0x59/0x90 [ 597.539351][ C0] flush_to_ldisc+0x148/0x340 [ 597.544049][ C0] process_scheduled_works+0x4ce/0x9d0 [ 597.549525][ C0] worker_thread+0x582/0x770 [ 597.554138][ C0] kthread+0x486/0x510 [ 597.558224][ C0] ret_from_fork+0xda/0x150 [ 597.562738][ C0] ret_from_fork_asm+0x1a/0x30 [ 597.567521][ C0] [ 597.569849][ C0] value changed: 0x00000000003b3440 -> 0x00000000003b5b50 [ 597.576955][ C0] [ 597.579347][ C0] Reported by Kernel Concurrency Sanitizer on: [ 597.585508][ C0] CPU: 0 UID: 0 PID: 31 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(voluntary) [ 597.595238][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 597.605299][ C0] Workqueue: events_unbound flush_to_ldisc [ 597.611133][ C0] ================================================================== [ 597.648355][T25972] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 597.728123][T28674] loop5: detected capacity change from 0 to 2048 [ 597.736243][T28674] EXT4-fs: Ignoring removed bh option [ 597.741648][T28674] EXT4-fs: Ignoring removed mblk_io_submit option [ 597.758293][T28674] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 598.222957][T22567] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.