last executing test programs: 3m34.499856902s ago: executing program 2 (id=3): r0 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) mq_notify(r0, &(0x7f00000000c0)={0x0, 0xc, 0x0, @thr={0x0, 0x0}}) 3m34.439600283s ago: executing program 2 (id=10): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x3000000, &(0x7f0000000280)={[{@nodiscard}]}, 0x1, 0x512, &(0x7f0000000c40)="$eJzs3W1rZFcdAPD/vcmk2d3UTFVkLdgWW9ktujNJY9so0lYQfVVQ6/s1JpMQMsmEzKRuQtEsfgBBRAU/gG8EP4Ag+xFEWND3oqKI7upL3St35kbzMJMMySSzTn4/OJlz7sP5n3PJ3LkPh3sDuLJeioh3ImIsIl6NiOlielqk2OukfLnHjz5YzFMSWfbe35JIimn7deXl8Yi4Uaw2GRFf/0rEt5LjcZs7u2sL9XptqyhXW+ub1ebO7p3V9YWV2kptY25u9o35N+dfn5/JCufqZzki3vrSn370/Z99+a1ffebbv7/7l9vfyZv1hY912h0Ri+cK0EOn7lJ7W+zLt9HWRQQbkrw/pbFhtwIAgH7kx/gfjohPto//p2OsfTQHAAAAjJLs7an4VxKRAQAAACMrjYipSNJKMRZgKtK0UumM4f1oXE/rjWbr08uN7Y2lfF5EOUrp8mq9NlOMFS5HKcnLs8UY2/3ya0fKcxHxXET8cPpau1xZbNSXhn3xAwAAAK6IGy8ePv//53TazgMAAAAjptyzAAAAAIwKp/wAAAAw+pz/AwAAwEj76rvv5inbf4/30vs722uN9+8s1ZprlfXtxcpiY2uzstJorLSf2bd+Wn31RmPzs7Gxfa/aqjVb1ebO7t31xvZG6+7qoVdgAwAAAJfouRcf/C6JiL3PX2unKJ4DCHDIH4fdAGCQxobdAGBoxofdAGBoSqcuYQ8Boy45Zf7xwTuda4Xx64tpDwAAMHi3Pn78/v9EMe/0awPA/zNjfQDg6nF3D66u0llHAN4cdEuAYflQ5+OZXvN7Pryjj/v/nWsMWXamhgEAAAMz1U5JWimO06ciTSuViGfbrwUoJcur9dpMcX7w2+nSM3l5tr1mcuqYYQAAAAAAAAAAAAAAAAAAAAAAAACgI8uSyAAAAICRFpH+OWk/zT/i1vQrU4evDhx569dP3/vxvYVWa2s2YiL5+3Q+aSIiWj8ppr+WeSUAAAAAPAU65+nF5+ywWwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAqHn86IPF/XSZcf/6xYgod4s/HpPtz8koRcT1fyQxfmC9JCLGBhB/735E3OwWP4knWZaVi1Z0i3/tguOX25ume/w0Im4MID5cZQ/y/c873b5/abzU/uz+/Rsv0nn13v+l/93/jfXY/zx7pNzL8w9/Ue0Z/37E8+Pd9z/78ZNO/EMh8sLLffbxm9/Y3e0640CV3eIfjFVtrW9Wmzu7d1bXF1ZqK7WNubnZN+bfnH99fqa6vFqvFX+7hvnBJ3755KT+X+8Rv3y4/8e2/yt99T6Lfz+89+gjnUKpW/zbL3f//b3ZI35a/PZ9qsjn82/t5/c6+YNe+PlvXjip/0s9+j95Sv9v99X/+NyrX/veH7rOObY1AIDL0NzZXVuo12tbJ2Qm+1jmkjNvPx3NGGAmno5mDCuTfbfz/3i+es65+rFMdp7Vx2MAzZg49j0di7NWmETs5XX1+Q8JAACMmP8d9J90BwkAAAAAAAAAAAAAAAAAAAC4SGd8LNlkRPS98NGYe8PpKgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAif4TAAD//4RX0Xo=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r0, 0x0, 0x78) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000005, 0x12, r0, 0xadff9000) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_mount_image$vfat(&(0x7f0000000140), &(0x7f00000002c0)='./bus\x00', 0x800, &(0x7f0000000280)=ANY=[], 0x1, 0x384, &(0x7f0000001200)="$eJzs3c+LG2UYwPEn2/yYtHSTgygKsg960cuwu3pWg2yhGLBsG7EVhGl3oiFjssyESIq468mrePMfECw9FjwU1H9gL97qxYsn9yIIWkQcmV+bX5MfjVmard8PlDzJ+7wz7yST8rxZ5p3jd7/4qFn3zLrVkTVDJSMi8lCkLGuSyEQPeUlxKC9f+P3B81ev33irUq3u7Kpeqlx7ZVtV1ze++/iTYpx2vyBH5fePxfjl6OmjZ4//ufZhw9OGp612Ry292f65Y910bN1reE1T9YpjW56tjZZnu1F7O2qvO+39/Z5arb2L5/dd2/PUavW0afe009aO21PrA6vRUtM09eL5sbGeSzuAJ4axQJ/and1dq7LgDm8t2A/L9pfv+1OaXbdinRMxi2MttTunOi4AALCSRur/r5IaoSy5k5xMPBfIh/HwNCCo/0X8cIoQ1v9B1K//777wQ+fCO/fW4/r/fn6g/s8l9f+rP0XbGqr/g3J2yfW/yDcjz8crojPvIAnemCP5P9X/WA0bw9/IX/sz9lhQ/wffhpMZ/Wfv3d0MA+p/AAAAAAAAAAAAAAAAAAAAAADOgoe+X/J9v5Q8Jv/6lxDEz0MFmXqhMc6cSZ9/IV5R4OR8wBPp6vUbYoQX7mXXRZzPu7VuLXqM25PETSnJ3+H5EIsWnDgMGzVQlu+dg24tuW4wWm2jIqLiiC1bUpLyUP8wvnS5urOlkah/uP+DbiHaSqUujbD/tpTkqfT+22n9a3l56cWB/qaU5Mdb0hZH9sLzut//0y3VN9+ujvQvhnlpXj/FzwMAAAAAgNNgqhrx9Lk8PP+N5u+mqZrWHszlZXB+Pvr7gGSjhMvVnc3U+Xm29Fz2MR44AAAAAAD/I17+dtNyHNv1ehODoszKif9YLyNNWZmx5SDIzpEzFDwIg9y0nME7fcy75Xx8B415h+F6PRl8Jdnf1F5/FERuN8feqGayhOtQspH+rs4ZzDWeKDAe9SNwvTV51PEEwUYwHl3ocAaC5GejSTlyZdEtTwqSlXNnJT/z5dd/LraLTLxq72DTa/eMGUcaBpmRVw5nnLS/+f7M8eTS/7f4dpGbzAAAAABYEUnRX/SSV+a5bwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFimpS6TNiF43McIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArIp/AwAA//+ge+z+") (async) syz_mount_image$vfat(&(0x7f0000000140), &(0x7f00000002c0)='./bus\x00', 0x800, &(0x7f0000000280)=ANY=[], 0x1, 0x384, &(0x7f0000001200)="$eJzs3c+LG2UYwPEn2/yYtHSTgygKsg960cuwu3pWg2yhGLBsG7EVhGl3oiFjssyESIq468mrePMfECw9FjwU1H9gL97qxYsn9yIIWkQcmV+bX5MfjVmard8PlDzJ+7wz7yST8rxZ5p3jd7/4qFn3zLrVkTVDJSMi8lCkLGuSyEQPeUlxKC9f+P3B81ev33irUq3u7Kpeqlx7ZVtV1ze++/iTYpx2vyBH5fePxfjl6OmjZ4//ufZhw9OGp612Ry292f65Y910bN1reE1T9YpjW56tjZZnu1F7O2qvO+39/Z5arb2L5/dd2/PUavW0afe009aO21PrA6vRUtM09eL5sbGeSzuAJ4axQJ/and1dq7LgDm8t2A/L9pfv+1OaXbdinRMxi2MttTunOi4AALCSRur/r5IaoSy5k5xMPBfIh/HwNCCo/0X8cIoQ1v9B1K//777wQ+fCO/fW4/r/fn6g/s8l9f+rP0XbGqr/g3J2yfW/yDcjz8crojPvIAnemCP5P9X/WA0bw9/IX/sz9lhQ/wffhpMZ/Wfv3d0MA+p/AAAAAAAAAAAAAAAAAAAAAADOgoe+X/J9v5Q8Jv/6lxDEz0MFmXqhMc6cSZ9/IV5R4OR8wBPp6vUbYoQX7mXXRZzPu7VuLXqM25PETSnJ3+H5EIsWnDgMGzVQlu+dg24tuW4wWm2jIqLiiC1bUpLyUP8wvnS5urOlkah/uP+DbiHaSqUujbD/tpTkqfT+22n9a3l56cWB/qaU5Mdb0hZH9sLzut//0y3VN9+ujvQvhnlpXj/FzwMAAAAAgNNgqhrx9Lk8PP+N5u+mqZrWHszlZXB+Pvr7gGSjhMvVnc3U+Xm29Fz2MR44AAAAAAD/I17+dtNyHNv1ehODoszKif9YLyNNWZmx5SDIzpEzFDwIg9y0nME7fcy75Xx8B415h+F6PRl8Jdnf1F5/FERuN8feqGayhOtQspH+rs4ZzDWeKDAe9SNwvTV51PEEwUYwHl3ocAaC5GejSTlyZdEtTwqSlXNnJT/z5dd/LraLTLxq72DTa/eMGUcaBpmRVw5nnLS/+f7M8eTS/7f4dpGbzAAAAABYEUnRX/SSV+a5bwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFimpS6TNiF43McIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArIp/AwAA//+ge+z+") r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000000080)=""/87, 0x57) (async) getdents(r1, &(0x7f0000000080)=""/87, 0x57) getdents(r1, 0xfffffffffffffffd, 0x58) (async) getdents(r1, 0xfffffffffffffffd, 0x58) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800) (async) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800) open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) (async) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x20000, 0x0) open_tree(r2, &(0x7f0000000640)='\x00', 0x89901) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r4 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv2(r4, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) fstatfs(0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0xc, &(0x7f0000000300)=ANY=[@ANYRESOCT, @ANYBLOB="069bcf5ac5f77a2b9453be22823f85bd651ea8722c9c3ee5f764d23e7b3211666df4ca2f4d86dabaa5acce22c0ee6904dfe41c7760b67faf19c5824b5133d3f51e1dbd957c61f9aebddcc3348f4779e84f130193cbb4ecfd55f02a535cdaa206332b85b963d7db1c4c30b158e98f", @ANYBLOB="153edab1ebfebc4cc9d659eb53be0653411b9d0d6c2e0c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000500)='page_pool_state_release\x00', r5}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x11, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x11, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=@updsa={0xf0, 0x10, 0x1, 0x0, 0x200017, {{@in6=@dev, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x32}, {@in6=@private1, 0x0, 0x32}, @in=@multicast2, {}, {0xffffffffffffffff}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000a200401904000600000000000109022400010000000009040000010700000009210000012206a6578b7103e4f9dc0000009f64ac68fa4131b76c48980d1891c94deee2c4075e7bded981f3ba4b6fb31f8b0d4459"], 0x0) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000a200401904000600000000000109022400010000000009040000010700000009210000012206a6578b7103e4f9dc0000009f64ac68fa4131b76c48980d1891c94deee2c4075e7bded981f3ba4b6fb31f8b0d4459"], 0x0) close(r0) (async) close(r0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x400) (async) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x400) mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2226021, 0x0) 3m32.096240534s ago: executing program 2 (id=23): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000280)=[@mss, @sack_perm, @timestamp, @mss={0x2, 0x1}, @window, @window={0x3, 0x0, 0xfffc}, @timestamp, @timestamp], 0x8) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0xc7) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x712, 0x0, 0xfffffffffffffd25) 3m29.033036515s ago: executing program 2 (id=43): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000840)='/sys/power/wakeup_count', 0x42, 0x110) pwritev(r1, &(0x7f00000022c0)=[{&(0x7f0000000000)="de", 0x1}], 0x1, 0x9, 0x84) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000280)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000000000f6000000006debff00850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x61, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r2}, 0x10) lsm_get_self_attr(0x64, &(0x7f0000000040), &(0x7f0000000000)=0x101, 0x0) 3m29.011160656s ago: executing program 32 (id=43): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000840)='/sys/power/wakeup_count', 0x42, 0x110) pwritev(r1, &(0x7f00000022c0)=[{&(0x7f0000000000)="de", 0x1}], 0x1, 0x9, 0x84) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000280)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000000000f6000000006debff00850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x61, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r2}, 0x10) lsm_get_self_attr(0x64, &(0x7f0000000040), &(0x7f0000000000)=0x101, 0x0) 2m56.122457105s ago: executing program 3 (id=323): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x3f, 0x1, 0x0, 0x0, 0x0, 0x5, 0x590, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9, 0xa5d4}, 0x4c58, 0x0, 0x2, 0x1, 0x8, 0x2, 0xb, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080), 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x4, 0xb, &(0x7f00000003c0)=ANY=[@ANYRESHEX=0x0], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r2}, 0x10) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000003, 0x13, r0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x800) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000008850000007600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [], {0x14}}, 0x28}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtaction={0x64, 0x30, 0xffffffffffffffff, 0x0, 0x40002, {}, [{0x50, 0x1, [@m_bpf={0x4c, 0x1, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1}}, @TCA_ACT_BPF_FD={0x8, 0x5, r5}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000580)={0x2, 0x4e21, @private=0xa010101}, 0x10, &(0x7f0000000780)=[{&(0x7f0000000b40)="1ad0f87d9278a2065cc791eb4fae0dec37da9834ba4b0450fc8f04e6f6d8d88e7d3acc3f1c522d662f38f0785dcf1fb2cba604b8d294944a0a2e73fd386508a7fd9dd4c5e854c7b448c142053681f3d10de5345a969b6fb15ea325e254f78affa8ccab66f89fcd78ba6f838623d883c99d8cea461b3018bbc2012ac6e972bc27afa693450fbe24dfc3382d09652a6cac39e437dd98e0b50c08342285d1a4b09ad56107b2f734dae00729ee6eb48905b30705a75fc91526fca2e5fd768a53cd3594420ea1e5662f7372d3de42fa918752cd10d0703071241748994356f9c46b05a0a103dce0aa1804ef16d41ec82de4da97a73a011647c00819b41ede5034149a9bc2eda3f0acc464630c062a2baf252b045bf372e6404cf6b1c41763d6a347c2c8df441fe3fa540bbd6bfca0ed564efbce699d1061ac5ed0859ef8c1d89dc186dae27a9cc3330dd6e487392af82c9a9977e9dbcc880597aa5154b573cabdce899a65b712314212d373d03d7c516a541f296c66cb1be6c78e61f0d03f54632d3fc6576d1cb3d2163b438aa7fdd5590837071671545a27383ede493b7b253f339fa4702cc19ed421f63becd38f1e04db79fd28960f889a5172173ee4caf9c070afd8687f69c1036a71ae8892e73243d522a2cddc621212bd2fb95d4f6b0397bdfb4f799e06547995a0594f7e65c7cb61703d4f722897113c9c72661c21cbc0953a7a1f3abcc44dcde7fdfb4042d6f3defdafebc1a572f19df517cf0cad7f87f73050af420ab61ba3044df65dce49ef67739d7bd172c5b65059a58d61a5e1ea6cad16a41b13de6ce76fb8552b67720bac152fbee3daa59a6f84d57ed8bd5dcda6b56970666e442a0cf471e2400422d7aa06633299715d35930e6277b7345529f9d25af6ac831e494df7c652682d0f7315f9e5ca1040b0481c2169b687e062de0105d4dbdc5aa821dc8000214e71fc18104084d8cac25c0e867f9961ce2887a8038445a98f8fae56130ce19bc408a37c890e3cc3ae9a99dabf2c72d94f7c59ee6a84c93613eb2037f28068e767b4966f44f6e0865737e70a859ed57bd55009786537d24502695c72f243c560d4d1abd1749c40227e03d1eb4a70cdfb71ca95a3297340bd8ca60ca2640fc9f511073f06d9c441201f727cda32eb9e914d5793b4f40715a057b11cdebb40707aab2ad2c5c5035451a6315a9f750123d6347b9c86a648d81c62d48669fed291dca9046d83f8ab105de34cae9120bdb8884616a86a9972e6a7527d6cb240507a5e17a48ba325c73cf7060d307c1ad396be1341cbd0faf0dc6067d473be1e00a8a2e0800cfc7778efb0a7645f40cb2dd4b695182ecba2aba53ceafb046fe1f950d7de1f92dcc82df0ac74ab7576e474fdb1da196bd1bb5066a9df626db01502b61ad624d56125729b3a8b6d135876d1c9a3628cf3c90fe8660c48f50c0900c18aa90bf354e4f1636069558b04aee40a82aa2bce911b804c04bf8b40073b5cf9f860e2a40e6bc6cb411c209fb9c9d11d6d1861149efc02283ee02774ec127b8b3b1cf61522f525325787c8efc3587a2da68c9c77ea670040228f0d6a7e288773fc63190a6f7b84553499c2d5c5245f15a29d89288b64b4485b5367996851966eb416578f060fde37eeb71a1834bc0ce6dddc03f98ff7503b6c570be57a17ebd228c126864d78e629afbf3a0c6fe242f47f81603e4eb3b1e1e9561eec8e6b353d1014bbb7f0d8d105dd3fae4831987d4471070b33498cae22239c3092f4c26eaac666dfe98d80caa11b76ea90aa89d17fb93efa3903d667fa4e7794348fefd976f217145ea5040994c131cfa50492899a2358d1929c5868370deff804e117bbc6a547b2ce4a1b29bc0fb35a251bc667cfd247dc3b9279ef8f02540740d7ac4a3a04d5cdf784e2f2e3af95170f7e72b05107106c008d882cf7785af02561b59c408e7b5e47485f034162a193df56c998546e6e2eafae98eec513c140ce772933290bb3a4c82f6529f5697bc6e4749a3d3400016deb44fb17f3d8466836f6effc7c608906d6bf54fba48d12896685f0180ea95c3dc20df3c0be451193c1756db5d3d02886cec2475ec23ecca3cc7daf29eec6572b63228a4bb7ad30bd1afa72e8f8a388ac96d66e54eb1a2aaa610f0e950469d9a7aaba8771a601824b5d4ec98a7a229abf07367b4f56aaf6dcf4745b1dae2d8730432947afafd0ab2cd414e58cd9710178646e648559e4819a6e7ac58bb87880601d9f066b9066ef15c7d631c91eeaa96cb19db8eb8aca8dc11a984d7d14de6761c1c093cb59f0f78b24187f343afa1304c1e57eeb8d61cde5f4d446c01eeaba49ef62c9ab0801ede29a1bb3c291b551123c1a74642fe13361f9984947a1426cc843c5318d67d691efb2f6f0267950f61790e0692e6f7ba0352c8e711da309fc00f13dc0941e349b7d088e0c631572c266ad3d9248f45808e659e5d58358715a501233768fba16a6650b1e141ede041de7317300c1396fc848f2d60658c6d5a7823b8e27aac04325102479fae1bec58f60f422a0b120663c8eba4091be0afb83d90dbae85c38adc8e26a5faa982dc3e83f211cfb4d8def7ef35e6c9229fde17d34c2f01d87a8f615148f31e970521f576aed9e6aa786075080c051a7b0825de4e36f8804b239025fc1510a72c4702cf2c506c5ca278c8abf9d8fb6a11a5793cba6a0194db5f87c59d2c60b900c66659c88930a8c86bbbc5b13fd61838295d9918ca5b509036783e97338a5e3834c760f644c26b7153cfdeea06e25a7412e89bdf6a4180d61a6c96bc697e22ab1ac1e674449504101f7bfc77ad3d12761d283a17115462c575bb598d65d8219fe8e0b162380775d6cf935dc8adaa55c481ee072092b2c8af39980d8fe3fe1d382b94fdb7d419089cc38d3cc8b951492098b1b03526de7e35ff731fafd0428f6658e3282519b5419ab9b045095601a88985f85ee4b61ab67b3fbbdad98edd0548bcc868d140b304408a1d3a076239ec6edd92cc70225740f11a80852aecf8adc22d21c1cec19ebd75b5d2fde5336ac2720f1f75d36ef4e757af838b793b275427b8c580c3014059ea79a7a17c84d8c974985e7c6b92899751dedabd123e92e2aa16c3e46432a5da194cdf445040c8522f761b3d8d025e0f11005348912b9ee59e13b418e7edc23049ac374ae609bdda2499b666756a612fc4902e5a161968694b9162396de8b89ab5b388e17916fa6cabb41fbd35ae8b204c5428a258f81caccd59915f702e9955afa6e3ab5048cb0ff768cb650cdba0125a700d350d51aa178a77c4e82b090ff30d7b7ff1853e2d9ab4ed7e983948511e4d3c1416a5bb47439669c7c6c20be616ca122c3069f6ff4291b607408c8a233db054bc6e3c4ef1e8085b3698cbb24c5252f77e5970dee6048e61e55f52aa602470f09251249b2e04554e3da377e52eb9c026a762c1500449f3f5c098dce20328c479daf8fa7f936fce968dc51b3589341fc243d2b927591deacfe5122b6cb2f10db962db5960e7e4a93235478df96ef087e9bc5d119c85b08b07507e72e9729d8fd171d46756c2bea08af38effb613399b8055ef89ec219092993a7b03b94958c12de21014f37522a1631505f2080a0c741c3312b94b4280bfa5f560c9b1af7f701c3da014de6b762ab95f3fa991efb031c67c74e24a642024a2b1dc097f6bc568b8d4fd675d6fbd83a59ee0c030be37dde099dcc440111bc57460f86984d49550621fac145814376e26a3cf14a582cff13d8185278d981280ba0b6bbfaa307251c6172e29b35e4c6d619a0a7917fc0ade21459bb72643b79a4dad2259829ba9e97c0180f1ae554cf6cc5e91d99fe653a2d1a3d25b345c024d6152fde772867a4e90576ecfb1c51b3b1c91a3d3ba1a28b6e0a7480ec42359e3c8a808a682d0b6a00b65258848e0bd694098138fc3436d073782fe5930103746fef75f21894d6508663d782e1cdecba7668d9eada9935295a0624260dd55a4a8cca0a21840172b1cd764c43e4820d0a473cedd5e8be1e91ba75723b9c2a8801fe12fc4aa1ac1b4506010929e4ab3afb196dc1fb4c20a1178f19a4e1451ca0b619362d48f4b610a8c0682f2c4e0ecde6566d3e116f2ea844c440d7ff4ef680ba0299ba09ab4c7dd3ffe628ed6c1a5129a45923664bf9d3dfdc1c79c6c575e1339dbf9d342da263936e247eb470e79da2162146f2e4fa955cc15bc6b77e0e0e6f30e0ceb2c0ccd96a86f4fe0115d2c545d73fa2eb033d4e971cce9c84da5c6438d106be45e43ee8b294931dbd33cd878a8216c1ffdd53c90ed577e36858c82e4a339d974f582ec07d6e2207d6decafeeddd4b41284aabd5d375c48f6af773ac99b9c88a8fb50aaa10c087bcbb348c1fed6de043e9b7740af14c9247660c3f8abe804f241c6d12971ba9d7bce7a7c81491b03601f7abd545d34b65faa8ebfdb5648ec01efd8fe1adb3f6b11bf4189747b7e86a954ec9957d516bf193c3e1771ac846ad79d92c6725a9079e4124e506592b4ff6935427a74f9a3bc6354d93ae1d9b54c119ba5d07505f6d2cf2ee9cc04e1b8c8bcca13f1020419d0bf1c2b581a3f5e925a7df402e509b7dbc1d0c39c285f1da6cd1180beccbec429e4676db96fad1e68efa9c8f0b626bf88eb137b9bf223b5171ae4fc4a4ebcbc6ed4f8f216e462c64553c5a2898f161ceed86fd4dad989a101cbb304ebe69ee98ab47bb1c9eeed4030c2ab851b24fbfd8ecb08a8649265d62d406c6305895181b3408a8fe692a5b77ee6bab16c3df0aa89febcbf417161ec701872150a3e30a93d8bc50e8ab3c84812528198c8226cb3723e7dc75d8b82bcc68abf896c50b08ba1ad728c972e2d381f28b1a503b464ac7b8357845ee816205338261984af8e01f79d9dd4f6e08573d4c40350043ed569b44ef19f8ceaa360916bd65dbfe1fe078120d370b3d776851bad4c15750b8e1aacc383fd18368f9622736170de87214dc55bb6c02b97c888a95757d6489c0cbd36b8cb2912cc09e2a09f4469663eb3e87715476ad9af2bffaefa5dbf2273859f045a2bf76bf115c4dab482055bef4b3bc95a5050c5c1dc87adecf7cfd2729f0e296ad5d8de2e3c513a5f72ef59f496c8e75708be7eb82f8642119ea04190b29ac38f23b7586f4ad7139ee49fee0d1b4828b074494236249bc5e50e0501121512d9bae9b1ae6991ad0c24e73c562559b8fc78ddf4f217271f457f7610241d5cb9077d60bb5e85f4fb4c4dc438f5a2c92dd0f1e41b7d0ac01b12a4fef732f66a2b8db6081a56400b88e3f43ec0b461638bb96ecdb17ae3238f727134c4789b21591940626cf52f560d2e7099d56d4a224d23e9019b6eb4caea6dc01637e33917ab31d79a1725ce5cb7e1ee99d25b323fb9108b92061aec8146044c4514de7c2586b7960f137fbb67f4bc790e5ec1369d565e10758411ab4fb81f48a884fa55a726fd9a1dec7914ef8354cf7da68c9146b8f290d88f388b3ca530e41873a570b42fb3fad2a4a0926d3691271dd8ef0e5d117fbc814aabcb25802ad9416e2f041a0a1098955f22dbd7366788f9f9ebaffb9fc7557ca3908ba9c26fb7b9f2515222e8740511429757ed446fa1d28b99859f000981fd475e044d73e1f70f2066e65d431c8db1358ceee7403394ba093563afa7a752b492de2e881ddb759d06e31114e5ba27261b4cfd9ffa0a220aa1252916c3069bdcf98b12576535e0259d99c1f69dc07b6d508384e51e2293d99ae7613b0f48dfbc8107ab32317bf54eae11209bf3f81", 0x1000}], 0x1, &(0x7f00000007c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0xa010100, @private=0xa010102}}}, @ip_retopts={{0x2c, 0x0, 0x7, {[@generic={0x94, 0x9, "8d5c66f25111e0"}, @timestamp_prespec={0x44, 0xc, 0x7, 0x3, 0x8, [{@broadcast, 0x6}]}, @ra={0x94, 0x4}, @noop]}}}], 0x50}, 0x1) r6 = socket(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) 2m55.530436543s ago: executing program 3 (id=327): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r0}, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002ec0)={0x38, r1, 0x10ada85e65c25359, 0xfffffffd, 0x25dfdbfd, {{0x6b}, {@val={0x8}, @val={0xc, 0x99, {0x2, 0x72}}}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x8, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x4}]}]}]}]}, 0x38}}, 0x0) 2m55.399028145s ago: executing program 3 (id=329): socket$tipc(0x1e, 0x2, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f00000003c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x2d) ioctl$AUTOFS_IOC_FAIL(r0, 0x4c80, 0xffffffffffffffb6) unshare(0x40000000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) capset(&(0x7f0000000300)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) socket$key(0xf, 0x3, 0x2) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCXONC(r7, 0x5608, 0x3) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x52, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), r6) ioctl$TUNGETDEVNETNS(r6, 0x54e3, 0x0) sendmsg$GTP_CMD_NEWPDP(r6, 0x0, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='mm_lru_insertion\x00', r9}, 0x10) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r10, &(0x7f0000000180), 0x40010) 2m54.481635587s ago: executing program 3 (id=337): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000400)=ANY=[@ANYBLOB="61123800000000006113140000000000bf1000000000000015000200091b00003d020100000000008701000000000000bc26000000000000bf06000000000000560300000ee600f06702000007000000160300000ee600f0bf050000000000000f610000000000006507f2ff02000400070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dded13e83b20b236dcb695dbfd737cbf719506d2d6b05fe7030586e3f640f9f7e9a73b761ad4f0952a70046270d2b6436fdeecd791614ed46de741eb8cf91c046ef9beca574b350021c7ec6ef130f53748068ca432dae4e248b22b9ad8b2811f67916a1764578cba4b069037bfb3362d5691ac397f7e207145d970f0d97867552629b146645c78cd3e7dbeca38e49a9d5221f1f45f0a25890d04d91a15a05ae7e7ed6252c3d6c1973fb858de1da70d67317e7872b0603ce47ed2c1520e71b527bb42aa2e20e1e85df73736ed0a782ab7e7278dd54358cfdf6313d40f926332623625b49626481054787ab2dff85a9bebd6b317f26c691a65aa97bb3d1506a3a565e9c7ea5ad4611d2d77ee8a5c1b23814a26b6a20061fbb65bdd03770fa849f2a29ba69f90625f42592a70ba890f7a92878ae73574c3a233ee5954119931a1905210715fa77a8795f2fbec3797cb90f59fe8a4abec25"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000640)=@bpf_lsm={0x1d, 0x16, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x40a}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}}, @map_fd={0x18, 0x1, 0x1, 0x0, 0x1}]}, &(0x7f0000000180)='GPL\x00', 0xffffffff, 0xa5, &(0x7f0000000240)=""/165, 0x41000, 0x55, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000300)={0x3, 0x4, 0x8000, 0x7}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2d9, @void, @value}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r0) syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000140)='./file0\x00', 0x81c00a, &(0x7f00000003c0)=ANY=[@ANYBLOB="73686f72746e616d653d6d697865642c696f636861727365743d69736f383835392d312c666d61736b3d30303030303030303030303030303030303030303036362c6e6f6e756d7461696c3d302c756e695f786c6174653d302c666d61736b3d30303030303030303030303030303030303030303030332c73686f72746e616d653d6c6f7765722c756e695f786c6174653d302c757466383d312c636865636b3d7374726963742c757466383d302c756e695f786c6174653d312c756e695f786c6174653d302c666c7573682c757466383d302c726f6469722c747a3d5554432c00e696e27e745267d0e7f7d60cf64c4d116172285e0a94b37c3f04b4e454913b1615b6c103a4be033c3f79c81a7a0dc9f3282eb2b984b8df829f11f7b15ceaa2ddb341548691e92d41d923144fa5f6aa8b37c7698e74a04d87cb16f3c338160646d1719f9aa1097cb78032fa4c9c60c14840662537510c0ac9f95a646f5231c0c9eb096b898803099b3050797137354ed2fb2a3dd97ad790f0758b4561eb7180b4b366c9ac840ca3d57727827ab961af0bb24ac6b14796d3bedfa4addb1c2f59217a563ca0a3729d45669905a6f0f3dbf3fd22ab36dfe7cf80913ecb4656ca"], 0x6, 0x2cf, &(0x7f0000002080)="$eJzs3T9rJGUYAPBnNrN//AO7hZUIDmhhdVyutdlD7kBM5bGFWmjw7kCyi3AHAUUcrxI7v4CfQBD8DrY2dpaCH8DyhIORmZ3ZP8nsJpFsxMvv1+TJvO8z7zMzL8mkyLOfvDY7up/Fwydf/RGDQRKdcYzjaRKj6ETjm1gz/j4AgP+zp0URfxVzLcO/f7chL4mIwY5rAwB244zf/7V0Gf58JWUBADt074MP37t9cHDn/SwbxN3Zt8eT8i/78ut8/PbD+Cym8SBuxjCeRVQvCt2o3hbK8G5RFHmalUbx5iw/npSZs49/rc//y8t1sB/DGFXR4m2jyn/34M5+NreSn5d1vFivPy7XvxXDeGWRvJZ/qyU/Jr14642V+m/EMH77ND6Padyviljmf72fZe+UrzgfleWV+Ul+POlX85aKvWbx/AqfDwAAAAAAAAAAAAAAAAAAAAAAz6cbde+cflT9e8pDdf+dvWflN93IGqP1/jzz/KQ50Wp/oKIo8iJ+aPrr3MyyrKgnLvPTeDVdbSwIAAAAAAAAAAAAAAAAAAAA19fjL748OpxOHzy6lKDpBpBGxN/3Iv7tecYrR16P7ZP79ZqH02mnDtfnpKtHYq+Zk0RsLSPSRTODS7s/G4IXTtVcBz/+1JbVW39waazMGZy9aLd9rcsMmt11dJhE65z+oubBfJNUjSCWc3pxzrV6m4aKuMj267UODbdllXv99HleqoJ8w50vg0i2Ffb2n/M7Vx9JTl5Fr7qrrendOoi2wqq90f4sTgQxmKef/lmR6NYBAAAAAAAAAAAAAAAAAAA7tfzv35bBJ1tTO0V/Z2UBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJVafv7/BYK8Tj7H5F48evwfXyIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADXwD8BAAD//2T0YAU=") syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000001240)='./file0\x00', 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x24}}, 0x24000800) r3 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) fsetxattr$trusted_overlay_upper(r2, &(0x7f0000000400), &(0x7f00000001c0)={0x0, 0xfb, 0xd6, 0x3, 0x17, "d1fe10641f43d7b0b7daa953748a4be9", "b24953eed5e60d716a3bf06e52ed85d3ce69eca88f8d8a6d27aa35fbd2361d5593d24e9212cabff39d12d380d6a48f777ea21fc34e8849d115aac10626e5626a1cccab14ff1ccc470684371bac533a21ac2946246d454145f6454a9ea755dcd6216c1c9660fcdec47a461532f569ae39174a41a103c486cd111378ec9aef221aa5e313bc6b0f0a3d5552cae2e2fcd4574c7732fff00f0d2a82eff16efc02a990587f8adf75e29ef754bcb90a9edbd577bb85265d3267689ff4e741ec2260a5ff00"}, 0xd6, 0x0) write$selinux_attr(r3, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, 0x29, 0x1, 0x70bd25, 0x25dfdbfb, {0x11}, [@typed={0x8, 0x142, 0x0, 0x0, @fd=r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008004}, 0x48000) pread64(r3, 0x0, 0x0, 0x7) getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000100)=0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffdfc, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r6}, 0x10) keyctl$instantiate_iov(0x14, 0x0, 0x0, 0x0, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000300240248ff050005001200", 0x2e}], 0x1}, 0x4) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x30, &(0x7f00000003c0)="6272dd2cb9594a4223ca8784d92ac2b0cde2c61218b7d190c786d9b68bcf646c7649b51fee7bcf8ede9aa32934637f673cae979af94a", 0x36) ptrace(0x10, r1) ptrace$peekuser(0x3, r1, 0x200) r8 = add_key$fscrypt_provisioning(&(0x7f0000000700), &(0x7f0000000740)={'syz', 0x1}, &(0x7f0000000780)=ANY=[@ANYBLOB="020000000000000061626364656667686bc46b6c6d6e6f707172737475767778797a30313233343536"], 0x29, 0xffffffffffffffff) keyctl$get_keyring_id(0x0, r8, 0x2) rmdir(&(0x7f0000000000)='./file0\x00') 2m54.151735982s ago: executing program 3 (id=343): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x3e, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xffffffff}, 0x1320, 0x0, 0x3, 0x5, 0x0, 0x800001, 0xfffb, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$pppl2tp(0x18, 0x1, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="6daa00000000000071101f00000000009500"], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000001000000000000000000000071104d000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000c"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001"], 0xb8}}, 0x0) r2 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40088a01, &(0x7f0000000000)) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000040)={0x1}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="4800000010000104000000000400000000000000", @ANYRES32=r6, @ANYBLOB="0000000000000000280012800900010076657468000000001800028014000100000000", @ANYRES32=r6], 0x48}}, 0x0) 2m53.596768029s ago: executing program 3 (id=352): socket$tipc(0x1e, 0x2, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f00000003c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) ioctl$AUTOFS_IOC_FAIL(r0, 0x4c80, 0xffffffffffffffb6) unshare(0x40000000) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) capset(&(0x7f0000000300)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) socket$key(0xf, 0x3, 0x2) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCXONC(r6, 0x5608, 0x3) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x52, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), r5) ioctl$TUNGETDEVNETNS(r5, 0x54e3, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r8, &(0x7f0000000180), 0x40010) 2m53.49771237s ago: executing program 33 (id=352): socket$tipc(0x1e, 0x2, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f00000003c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) ioctl$AUTOFS_IOC_FAIL(r0, 0x4c80, 0xffffffffffffffb6) unshare(0x40000000) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) capset(&(0x7f0000000300)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) socket$key(0xf, 0x3, 0x2) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCXONC(r6, 0x5608, 0x3) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x52, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), r5) ioctl$TUNGETDEVNETNS(r5, 0x54e3, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r8, &(0x7f0000000180), 0x40010) 1m12.015311308s ago: executing program 4 (id=2096): sendmsg$sock(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000440)="d6f24b78df040dd1801acf91ba9456205e2f2276fd7950d26fb45f130e5d7f4b40a548051a3f98a4b242715790156c3876425af930fc34e7240b2cfccc4991d3d843ca42", 0x44}, {&(0x7f00000004c0)="e5b916a25382a9db640480918271b012e77bd94b08e50987c1779f1270f5", 0x1e}, {&(0x7f0000000780)="5d3ad3053f1ad8ae5e938b175ed74ddb0a1229e9654b441acc8df528c418a63e0d04345cd1a060fc2041bcba87971e8697216a18fda4c15584b3d69313f4b70cc07bab31458e55c7d1bd54b247e0885a70cce7c61106efdaf0fe736ffedfab295c0e0232fac67991db0549282ce34dd4cfde481dfe705de0cc4c83352cb6", 0x7e}], 0x3, &(0x7f00000008c0)=[@timestamping={{0x14, 0x1, 0x25, 0x6}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x8}}, @txtime={{0x18, 0x1, 0x3d, 0x9}}], 0x60}, 0x8040) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="7f454c4600000006010000000000000003003e000000000003000000000000004000000000000000980100000000000002000000000038000200000002000000000000600300000008000000000000000d00000000000000ed08000000000000f0ffffffffffffff0000000000000000080000000000000003000000cff5ffff800300000000000001000000000000000500000000000000ff"], 0x5b0) close(r0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) 1m11.930726699s ago: executing program 4 (id=2099): ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x20, 0x7800, 0x8, 0x2, {{0x21, 0x4, 0x0, 0x4, 0x84, 0x68, 0x0, 0x0, 0x4, 0x0, @private=0xa010101, @broadcast, {[@timestamp_prespec={0x44, 0x24, 0xd0, 0x3, 0x0, [{@multicast2, 0xcd}, {@multicast1, 0x9}, {@rand_addr=0x64010102, 0xffffffff}, {@multicast2, 0x6}]}, @ssrr={0x89, 0x1f, 0xdf, [@loopback, @loopback, @empty, @multicast1, @multicast1, @empty, @empty]}, @rr={0x7, 0xf, 0x41, [@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast]}, @lsrr={0x83, 0x1b, 0x84, [@broadcast, @multicast2, @dev={0xac, 0x14, 0x14, 0xc}, @dev={0xac, 0x14, 0x14, 0x35}, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xb, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000fdff00000000000000926403d89dd9f3000000180100002020702500000000002120207b1af8ff00000000bfa10000e600000007010000f8ffffffb70200000000b70300000000008385009d48159bd9726eb6b459626f6db4a29418fccea754009168d2f461dd8b996fc06f8d"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xe, '\x00', r0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0a00000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000500000000000000f894863173cb62847a3127b89e04289c93d3c2dea0cfb5546505b44720eb4c18151d3d545ab93ba565097296597f0cec3a46ba7b0ad6b658938fae8560061880ef173a74c8f144d77063e78ceec40f7e537b88908cba21290f80e61c0ba24dfa48e4f615e773776cbd843dbdfe0157a9600300415887e3713fd5a162e428e3964845c397e605e5333b23067d52dc1b354f07a3ca144ae6e424a2ea7f57f5a998e0410c7e861ee2eae715b9236ea6d2c02f9451a09a9040d858cc0a05eb3cde4bbf51a65b54a69210548cb2fe262f7ef92ab531066bc4e6b3e0f1b67864ebd06586ca5d6d828231a3306dd7a11ef788df06a9abebd274867c7dbe19eb2694c7374f362900632966cc4a56a8ecf80292177492ee0b6c1d012b6aff612cf5634cd2500319c317ec9e8a88001bb3d0692eeb8beeb6e0911a6711a42ee847adf85800eceec6f436e1f988c4410ec98b6ac145815bf892e5be00"/370], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a31000000004c000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d6163767461700000000800014000000005"], 0xe8}, 0x1, 0x0, 0x0, 0x40040000}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x0, 0x7fff0006}]}) socket$packet(0x11, 0xa, 0x300) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a000020095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000200)='kmem_cache_free\x00', r8}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2686dd4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) fsetxattr$security_selinux(r6, &(0x7f00000005c0), &(0x7f0000000540)='system_u:object_r:inetd_log_t:s0\x00', 0x21, 0x0) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) sendmsg$TIPC_CMD_GET_NODES(r4, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r9, 0x100, 0x70bd26, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000000}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) socket$packet(0x11, 0xa, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 1m11.720247501s ago: executing program 4 (id=2102): bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_open_dev$usbfs(0x0, 0xfffffffffffffffc, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={0x0}, 0x18) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000060a0b040000000000000000020000002400048020000180070001006374000014000280080002400000001108000440000000020900010073797a30000000000900020073797a32"], 0x78}}, 0x0) 1m11.703767352s ago: executing program 4 (id=2103): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) r2 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x60000, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0/../file0/../file0/../file0\x00', 0x10a) mount$bind(&(0x7f0000000140)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000180)='./file0/../file0/../file0/../file0\x00', 0x0, 0x100091, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001000000000000000640000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000e0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000300)='sys_enter\x00', r4}, 0x10) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f0000000280)={[{@jqfmt_vfsv1}, {}, {@quota}, {@noauto_da_alloc}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@noauto_da_alloc}, {@stripe={'stripe', 0x3d, 0x5}}, {@orlov}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") clock_settime(0x0, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f00000001c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="e9670000", @ANYRESHEX=0x0, @ANYBLOB="01002d3d7000fdcddf250d0000000a000900e4897f508bbf000005003000010000000a0e0900bbbbbbbbbbbb00000800320002000000000000000000000008003a000500000005003700000100"/86], 0x5c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40400c0) mount$bind(0x0, &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x201080, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x3125889, 0x0) mount$9p_xen(0x0, &(0x7f00000004c0)='./file0/../file0\x00', 0x0, 0x80000, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0/../file0/../file0/../file0\x00') getdents64(r2, 0xfffffffffffffffe, 0x29) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0xa, 0xc, &(0x7f0000001cc0)=ANY=[@ANYRES16=r1, @ANYBLOB="2827fe459937d59d4714d591efdf52de0fc51e90769c3be659b79e986e6b80ab", @ANYRES16=r2], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffe13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x0, 0xc, &(0x7f0000000600)=ANY=[@ANYRESDEC=0x0, @ANYRESHEX, @ANYRES64, @ANYRESDEC, @ANYRES8, @ANYRES8=r1, @ANYBLOB="1800000000000600060000000000000018110000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff, @void, @value}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x8000, 0x0) ioctl$TCSBRKP(r5, 0x5425, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x103000, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$TCSETSW2(r6, 0x5408, &(0x7f0000000300)={0xff, 0x3eb, 0xfffffffe, 0x7fffffef, 0x0, "23f555d9adb42d4408020e90d1beaa82dc1ecf", 0x1002, 0xfffffffc}) timer_create(0x2, &(0x7f0000000300)={0x0, 0x38, 0x4}, &(0x7f0000000340)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000080)='kfree\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffffa}, 0x18) ioctl$int_in(r0, 0x5421, &(0x7f0000000100)=0x100000001) 1m11.182943749s ago: executing program 4 (id=2109): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000f1ffffff0000000000100000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x18) r2 = socket(0x1e, 0x805, 0x0) connect$tipc(r2, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{}, 0x2}}, 0x10) close(r2) r3 = dup(r0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x64, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x24, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_DATA={0x10, 0x5, 0x0, 0x1, [{0xa, 0x4, @local}]}, @IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x3}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}]}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x64}, 0x1, 0x0, 0x0, 0x4001}, 0x0) 1m8.780649071s ago: executing program 4 (id=2133): r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) write(r1, &(0x7f0000000000)="1c0000001e005f800040000000000000020000000100000000001200", 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000080)='kfree\x00'}, 0x18) r2 = socket$pppl2tp(0x18, 0x1, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@private2, 0x2dcc6b48, 0x0, 0x2, 0xe, 0x0, 0x8}, 0x20) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_clone3(&(0x7f0000000580)={0x200800400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r4}}, 0x58) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) connect$pppl2tp(r2, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x8, 0x0, 0x1, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x32) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000200), 0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r6}, 0x10) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x34000}], 0x1) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@deltaction={0x40, 0x18, 0x1, 0x70bd2d, 0x25dfdbfe, {0xa}, [@TCA_ACT_TAB={0x2c, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}]}, 0x40}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="1801000000002000000000000000000018190000", @ANYRESDEC=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1a"], 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000004c0)='mm_page_free\x00', r7, 0x0, 0x178}, 0x18) mount$cgroup(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000880)={[{@subsystem='freezer'}, {@xattr}, {@subsystem='rlimit'}], [{@uid_eq}, {@flag='ro'}, {@audit}]}) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000280)}, 0x0, 0x0, 0x0, 0x3, 0x1, 0xfffffff5}, 0x0, 0x2, 0xffffffffffffffff, 0x9) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x50032, 0xffffffffffffffff, 0x0) 1m8.754206341s ago: executing program 34 (id=2133): r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) write(r1, &(0x7f0000000000)="1c0000001e005f800040000000000000020000000100000000001200", 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000080)='kfree\x00'}, 0x18) r2 = socket$pppl2tp(0x18, 0x1, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@private2, 0x2dcc6b48, 0x0, 0x2, 0xe, 0x0, 0x8}, 0x20) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_clone3(&(0x7f0000000580)={0x200800400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r4}}, 0x58) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) connect$pppl2tp(r2, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x8, 0x0, 0x1, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x32) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000200), 0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r6}, 0x10) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x34000}], 0x1) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@deltaction={0x40, 0x18, 0x1, 0x70bd2d, 0x25dfdbfe, {0xa}, [@TCA_ACT_TAB={0x2c, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}]}, 0x40}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="1801000000002000000000000000000018190000", @ANYRESDEC=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1a"], 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000004c0)='mm_page_free\x00', r7, 0x0, 0x178}, 0x18) mount$cgroup(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000880)={[{@subsystem='freezer'}, {@xattr}, {@subsystem='rlimit'}], [{@uid_eq}, {@flag='ro'}, {@audit}]}) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000280)}, 0x0, 0x0, 0x0, 0x3, 0x1, 0xfffffff5}, 0x0, 0x2, 0xffffffffffffffff, 0x9) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x50032, 0xffffffffffffffff, 0x0) 1m6.372106813s ago: executing program 7 (id=2163): perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x8020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRESHEX, @ANYRES32, @ANYBLOB="0000000000000000b7080000010000807b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, @void, @value}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001900)=ANY=[@ANYBLOB="0500000004000000ff0f00000700000000000000db4dbabe3cd8d14ab34afaf13ac59f9b4cb45c6e76a86e00a017dba8b2f6372894a5747c88dd05b003366f51d27f40cde074278ed4e571bf779bf27caa81d71973a5964e29b5af15f3c3b52739ad22241569e4acb332aee441f3fe9a", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000021b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000001b40)='sched_switch\x00', r1}, 0x10) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0xc0ed0040, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {@norecovery}, {@mblk_io_submit}, {@noload}, {@resgid}, {@nodiscard}]}, 0xfe, 0x472, &(0x7f0000000940)="$eJzs3MtvG8UfAPDvOk6a9PFLf6U8WloIFETFI2nSBz1wAYHEAQQSHIo4BSetSt0GNUGiVQSBQxDigCpxRxyR+As4wQUBJySucEeVEMqlhZPRenfTxLVDHk6c4s9H2nZmd92Z786OPTtjN4CuNZT+kUTsjohfI2Iwyy4/YSj76+bCbOWvhdlKErXaa38m9fNuLMxW8n9i8XW7sh21Wp7f0aTc+TcjxqvVyct5fmTm4jsj01euPnX+4vi5yXOTl8ZOnz5x/HDfqbGTbYkzjevGwfenDh148Y1rL1fOXHvrx6/T+u7OjxdxtNNQdnWberTdhXXYniXppNzBirAmabulzdVb7/+D0RMDi8cG44WPOlo5YFPVarVas8/n3FwN+A9LotM1ADqj+KBPn3+LbYuGHtvCH89mD0Bp3DfzLTtSjlJ+Tm/D82079UfEmbm/v0i32KR5CACApb5Nxz9PNhv/leKeJef9L19D2RsR/4+IfRFxV0Tsj4i7I+rn3hsR962x/MYVktvHP6Xr6wpsldLx3zP52tby8V8x+ou9PXluTz3+3uTs+erksfyaHI3eHWl+dNlLlvvu+V8+a9z3aT7NPrRk/JduafnFWDCvx/VywwTdxPjMeFuCT+P/MOJguVn8SRTLOElEHIiIg+ss4/zjXx1qdezf419BG9aZal9GPJa1/1w0xF9IWq5Pjj59auzkSH9UJ4+NFHfF7X76ef7VVuVvKP42SNt/Z9P7P4s/fUZM+iOmr1y9UF+vnV57GfO/fVxJWhzbv877vy95vZ7uy/e9Nz4zc3k0oi95Kc0OLNs/duu1Rb44P43/6JHm/X9f9nhWvxL3R0R6Ex+OiAci4sG87R6KiIcj4sgK8f/w3CNvtzrWuv1XmJVvozT+iRXaP33LS1O32n/tiZ4L33/Tqvzaqtr/RD11NN+zmve/1VZwI9cOAAAA7hSl+nfgk9LwYrpUGh7OvsO/P3aWqlPTM0+cnXr30kT2Xfm90VsqZroGl8yHjuZzw0V+rCF/PJ83/rxnoJ4frkxVJzodPHS5XS36f+r3nk7XDth0fq8F3Uv/h+6l/0P30v+he+n/0KX6mu/+YKvrAXTE2j//+zelHsDWM/6H7qX/Q/fS/6ErtfxtfGlDP/m/UxPl7VGNpomB7VGNIhGlbVGN9iVe+STrEtulPkWivOr/zGKdiR1ND3X6nQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKA9/gkAAP//Uo/mdg==") r2 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) write$binfmt_elf64(r2, &(0x7f0000000e00)=ANY=[@ANYBLOB="7f454c46080505fe080000000000000002000600080000008f0000000000000040000000000000002b0300000000000004000000ff0f3800020007007f00fcff00000000000000000300000000000000ffffffffffffff7f0400000000000000ff010000000000000000000000000000ee0f00000000000051e57464060000001910000000000000000000007000000007000000000000000700000000000000b90600000000000002000000000000000e61000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400"/1670], 0x8b2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x18, 0xb, &(0x7f0000000180)=ANY=[@ANYRESDEC], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff7, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001800)={&(0x7f00000017c0)='kfree\x00', r3}, 0x18) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000100001000000f5ffffffffffffff000a14000000060a0000000000000000000002"], 0x3c}}, 0x0) socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2688634c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000016c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002000000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000de"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000000)='kfree\x00', r3}, 0x18) syz_clone(0x2c9a4080, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x1) r4 = memfd_create(&(0x7f00000001c0)='\x00\xc76\xbe\x91\x8d\x182)!\x9a%\xd9\x19\x17\xb0\xed|\xb3\xc2\x017h\xe9kL\xa2\xd28\xd6\x06\a\x0e\xfc\xfe\x12\x8f&\x13\xae%@T\xa3\xb0>\\\xec\xa9\xf9Q@6A\x10\x8cn|\x00\x00\x00\x00\x00\x00\x00\x00\xeb0\xdd\xe8\x87\x05=\xfb\x8b$\xdcQ\xee\xc5\x1f\x8bQ\xf7fo\"i\xa1hk\x1d\xf5z\xc1\x7f\xa4\\]\xc4\xbe3\xf9\xa8\t?:\xd8\xda\x84\xeepI[\x1c\x00\x00\x00\x00\xf9v\x00\x00\x00\x00\x00T\xb6\xbe\x0f~\xc0\x92\xe9O{\xa8\x81(\x01\x14\xfc\x83\xf9\xfb\x05\x94Tr@Lq]\xf9\x15zj\x87\xc4\x8e\xe8/\xb9-&R\x8e\xb2\xb3bBx\x1e1\x18\x8f2\xf7]#\xed,\xc7\x03\x00\x00\x00\xa3\xee\xcb\xaf\xb3\xe3\'}\x18\xe8O\xa8#K\xb6\xe4R$\xaa\x00U\x92\xd2\x99\xb80x0}) syz_open_dev$vcsn(&(0x7f0000002300), 0x7, 0x12400) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002440)={&(0x7f0000000300)=@abs={0x0, 0x0, 0x3}, 0x6e, &(0x7f00000004c0)=[{&(0x7f00000001c0)="55bb5d", 0x3}, {&(0x7f00000003c0)="f37b29393e71bffc33cdf182068567c15ed3026c8dc73f37da98c717eed898e81da5ffe5997bb9b9fe6c0afd9e515b50d992fdeb191bbb4cb25e2e8bdbe688076a6bed966fb0ecd7207eae475205a04fffa9", 0x52}, {&(0x7f0000000d80)="6890d808002aaeac39635e3756608637c92f3ec8301819cf7cb04d8b7f9fa9c00339f0d74bf66552850a22bb15e0a86a1dc89042574e540c8f2e29134703825e3876d2c2d63dea71c548baa840cac7fcd153c286a09fa40f02df6b3c1dd6bcf1a94a15e9e4245fd197435e38b9b4cb734c918e3857fc08369db846c936e38760f09dc30b6247021900781b8ad8910899232a27e99bee26bdde61a017c3fc373c", 0xa0}, {&(0x7f0000000e40)="8eab1c27a03ddf138b5047c33fa5920003b1e78a2ba5c4930f875fbf7a8ccd726c5aa47299b1de212f8399971edb7348895412006d138214a98b2ff7d0e7e7dd8f9f5fce94515d351382e378a8bb976f9f9a3e646f123abf7c9e64dc3b5f3314c3f0f1796bd395c98dc914f33136956c3f7fcefec9bb14997b059d0ea64cb2bbebc46132e2c8b857e526e085a462ff0afdc74d5408ad3b5b3b920dc4883a865c3a4d", 0xa2}], 0x4, &(0x7f0000000f00)=ANY=[@ANYBLOB="65f39eb84e99227b941b2b1c00000200339774b0c70a4eb9cdbcad8c737fd1e8a2b3d3b2ad1593ea37597f80427c2d73b59a66512f1b6dc8c085270ca9ddf5c4763627547d2eb9f7c3170704d059764dbe6e71ba1e723d965187c45651e1732c14cd5bb9b638cf4e4ba790c23b755031432b0564dda789d597cc61ff", @ANYRES32=r2, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r2, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32, @ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="000000002c000000000000000100000001000000", @ANYRES32, @ANYRES16=r2, @ANYRES32=r3, @ANYRES32, @ANYRES32=r1, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x90, 0x845}, 0x24008000) preadv2(r5, &(0x7f0000000040)=[{&(0x7f0000001200)=""/4096, 0xfffffdef}], 0x1, 0x4000, 0x0, 0x0) 1m5.721548112s ago: executing program 7 (id=2175): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) r2 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x60000, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0/../file0/../file0/../file0\x00', 0x10a) mount$bind(&(0x7f0000000140)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000180)='./file0/../file0/../file0/../file0\x00', 0x0, 0x100091, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001000000000000000640000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000e0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000300)='sys_enter\x00', r4}, 0x10) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000c80)='./file1\x00', 0x210000, &(0x7f0000000280)={[{@jqfmt_vfsv1}, {}, {@quota}, {@noauto_da_alloc}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@noauto_da_alloc}, {@stripe={'stripe', 0x3d, 0x5}}, {@orlov}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") clock_settime(0x0, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f00000001c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="e9670000", @ANYRESHEX=0x0, @ANYBLOB="01002d3d7000fdcddf250d0000000a000900e4897f508bbf000005003000010000000a0e0900bbbbbbbbbbbb00000800320002000000000000000000000008003a000500000005003700000100"/86], 0x5c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40400c0) mount$bind(0x0, &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x201080, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x3125889, 0x0) mount$9p_xen(0x0, &(0x7f00000004c0)='./file0/../file0\x00', 0x0, 0x80000, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0/../file0/../file0/../file0\x00') getdents64(r2, 0xfffffffffffffffe, 0x29) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0xa, 0xc, &(0x7f0000001cc0)=ANY=[@ANYRES16=r1, @ANYBLOB="2827fe459937d59d4714d591efdf52de0fc51e90769c3be659b79e986e6b80ab", @ANYRES16=r2], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffe13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x0, 0xc, &(0x7f0000000600)=ANY=[@ANYRESDEC=0x0, @ANYRESHEX, @ANYRES64, @ANYRESDEC, @ANYRES8, @ANYRES8=r1, @ANYBLOB="1800000000000600060000000000000018110000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff, @void, @value}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x8000, 0x0) ioctl$TCSBRKP(r5, 0x5425, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x103000, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$TCSETSW2(r6, 0x5408, &(0x7f0000000300)={0xff, 0x3eb, 0xfffffffe, 0x7fffffef, 0x0, "23f555d9adb42d4408020e90d1beaa82dc1ecf", 0x1002, 0xfffffffc}) timer_create(0x2, &(0x7f0000000300)={0x0, 0x38, 0x4}, &(0x7f0000000340)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000080)='kfree\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffffa}, 0x18) ioctl$int_in(r0, 0x5421, &(0x7f0000000100)=0x100000001) 1m5.385169756s ago: executing program 7 (id=2177): bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0x7, &(0x7f0000000480)=ANY=[@ANYRES64=0x0, @ANYBLOB="5428ff1eda48a5adcbfde27aaf40facd6fe5b7dff96dab4d59acaac85379d62e5b12bd2a7f11177bff746db0877388baa87567f2c1a61b0454d0ede4a7204b5f6f69343413e3d7917f12c7399748e8e5717088d80fb2aecabb86b4df5511f216a4cd1dfaa3430b5dfb19f04481fce49cc16dd032d30f7350feda55da0dae63a21a09453be548a8653b2d4ae0c7b3fb81941171e413f589af1c6a8edce95cc62eb1737ff368aac6ee2518581930abaf1829e6ae7d1c978fd1000216c003f27a96de786b524b1e31d4aa69167db440bcb891b24fb4e88b86829eaf8088a80cae0250162140481a57b10c9813197299e6", @ANYRES16=0x0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000a80)='kfree\x00', r0}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x43, &(0x7f00000003c0)=ANY=[@ANYBLOB="3c41a5264ec3946e25af1c9f422df8e13c7e0fd85b5f5e80ab15964d547ab2ce47b0ac1cd804cb9a9777eccfaf4d0c36c45f5f789ea6c640d08ce02cf04f464b048ba0190890602c6c577a918d6ce2758196858c6809ba2db6346aebe2dcb30103e954266553cb4a950f69f4b49a2ae5444c6f00c1393bc1ce36b7594da6922a10bcf8e7a012682a82c7108469655e07c657cc831f913637710584c1e5ccae11"], &(0x7f0000000100)='GPL\x00', 0x20000000, 0x0, 0x0, 0x41000, 0x29, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x80, 0x3f, 0x1, 0x0, 0x0, 0x0, 0x3c, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x800000000000003, 0x1}, 0x18002, 0x8002, 0x0, 0x2, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x80}], 0x2c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x73) 1m1.737290215s ago: executing program 7 (id=2258): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000009c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_flash={0x33, 0xea5, './file0\x00'}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000800)={{}, &(0x7f0000000580), &(0x7f00000007c0)='%-5lx \x00'}, 0x20) syz_io_uring_setup(0x201834, &(0x7f0000000500)={0x0, 0x100000, 0x40, 0xffffffff}, &(0x7f0000000000), &(0x7f0000000380)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000", @ANYRES16=r3, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) 1m1.624897657s ago: executing program 35 (id=2258): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000009c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_flash={0x33, 0xea5, './file0\x00'}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000800)={{}, &(0x7f0000000580), &(0x7f00000007c0)='%-5lx \x00'}, 0x20) syz_io_uring_setup(0x201834, &(0x7f0000000500)={0x0, 0x100000, 0x40, 0xffffffff}, &(0x7f0000000000), &(0x7f0000000380)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000", @ANYRES16=r3, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) 27.812872448s ago: executing program 0 (id=2751): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x41, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x800000000003}, 0x1100, 0x5dd8, 0x0, 0x3, 0x0, 0x8, 0xfffb, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, @void, @value}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) (async) r2 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) creat(&(0x7f00000000c0)='./file1\x00', 0x99) (async) r4 = creat(&(0x7f00000000c0)='./file1\x00', 0x99) bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[], 0x48) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[], 0x48) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {0x5cce0883}}, './file1\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {0x5cce0883}}, './file1\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0xc, &(0x7f00000002c0)=ANY=[@ANYRES8=r5, @ANYRES32=r5, @ANYRES16=r2, @ANYRES16=r3, @ANYRES8=r1, @ANYRESHEX=r1], 0x0, 0x1, 0x0, 0x0, 0x0, 0x34, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socket$inet_sctp(0x2, 0x1, 0x84) bind$802154_raw(r6, &(0x7f0000000500)={0x24, @long={0x3, 0x1, {0xaaaaaaaaaaaa0002}}}, 0x14) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0xfe, 0x0, 0x7ffc9ffe}]}) rseq(&(0x7f0000000300), 0x20, 0x0, 0x0) (async) rseq(&(0x7f0000000300), 0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) connect$phonet_pipe(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000001140)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x410c84, &(0x7f0000000340), 0x1, 0x785, &(0x7f0000001900)="$eJzs3c9rHGUfAPDvbJImTfO+yQsvaD0FBA2UbkyNrYKHigcRLBT0bLtstqFmky3ZTWlCwBYRvAgqHgS99OyPevPqj6v+Fx7EUjUtVjxIZDYz7bbZ/GySrebzgck+z8xsnue788zMMzsPswHsW8Ppn0LE4Yh4L4kYzOYnEdHTTHVHnFxZ7/bSYjmdkhiIV39NmuvcWlosR8t7UoeyzKMR8e3bEUcKq8utzy9MlarVymyWH21MXxitzy8cPT9dmqxMVmaOj42PHzvxzInjOxfr7z8sDFx//6Unvzj551uPXHv3uyROxkC2rDWOnTIcw9ln0pN+hPd4cacL67Ck0xVgW9Jds2tlL4/DMRhdzRQA8G/2ZkQsAwD7TOL8DwD7TP49wK2lxXI+dfYbib1144WI6FuJP7+/ubKkO7tn19e8D9p/K7nnzkgSEUM7UP5wRHzy1eufpVPs0n1IgHYuX4mIs0PDq4//yaoxC1v11DrLDmSvw/fNd/yDvfN12v95tl3/r3Cn/xNt+j+9bfbd7dhw/z+4A4Ws40ZfxPMtY9tut8SfGerKcv9p9vl6knPnq5X02PbfiBiJnt40P7ZOGSM3/7q51rLW/t9vH7zxaVp++np3jcLP3b33vmei1Cg9SMytblyJeKx7Vfwtlwd9zb5uu/7v6U2W8fJz73y81rI0/jTefFodf2Sjk3bH8tWIJ9pu/7sj2pJ1xyeONpvDaN4o2vjyx4/61yq/dfunU1p+fi2wF9Lt379+/ENJ63jN+tbL+P7q4DdrLds4/vbt/0DyWjOd9yMulRqN2bGIA8krq+cfu/vePJ+vn8Y/8nj7/T8//rVr/+k14dlNxt99/ZfPtx//7krjn9jC9k9nZA3hTovYKHHt9lTXWuVvbvuPN1Mj2ZzNHP82W8EH+OgAAAAAAAAAAAAAAAAAAAAAAAAAYNMKETEQSaF4J10oFIsrv+H9/+gvVGv1xpFztbmZiWj+VvZQ9BTyR10OtjwPdSx7Hn6eP3Zf/umI+F9EfNh7MMmfozjR4dgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIHdojd//T/3U2+naAQC7pq/TFQAA9pzzPwDsP87/ALD/9EUklztdCQBgT7n+B4D9x/kfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAXXb61Kl0Wv5jabGc5icuzs9N1S4enajUp4rTc+ViuTZ7oThZq01WK8VybXqj/1et1S6Mx8zcpdFGpd4Yrc8vnJmuzc00zpyfLk1WzlR69iQqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANia+vzCVKlarcxKbCOx/HBUo/OJrqw5dbYa/Z0pPXkoNsFOJzp8YAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4h/g7AAD//7AaJtI=") keyctl$chown(0x4, 0x0, 0xffffffffffffffff, 0x0) (async) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000013c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r7}, 0x10) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r7}, 0x10) sync_file_range(0xffffffffffffffff, 0x6, 0xb25a, 0x6) (async) sync_file_range(0xffffffffffffffff, 0x6, 0xb25a, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1f, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1f, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r8}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) 26.617855395s ago: executing program 0 (id=2760): r0 = syz_open_dev$loop(&(0x7f0000000180), 0x7, 0x2480) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100002c34c027000000000000ea04850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f0000000000)=@ethtool_wolinfo={0x6, 0x9, 0x8, "4b2e5913bcad"}}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv6_delrule={0x30, 0x21, 0x1, 0x0, 0x25dfdbfd, {0xa, 0x20, 0x0, 0x8, 0x0, 0x0, 0x0, 0x1, 0x10}, [@FRA_DST={0x14, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x30}}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.stat\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000540)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0xd, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90018000001200000014000800000000000100007f0000000000000a00", [0x4]}}) socket$inet_mptcp(0x2, 0x1, 0x106) 26.609481025s ago: executing program 0 (id=2761): socket$tipc(0x1e, 0x2, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f00000003c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x2d) ioctl$AUTOFS_IOC_FAIL(r0, 0x4c80, 0xffffffffffffffb6) unshare(0x40000000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) socket$key(0xf, 0x3, 0x2) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCXONC(r7, 0x5608, 0x3) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x52, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), r6) ioctl$TUNGETDEVNETNS(r6, 0x54e3, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r9, &(0x7f0000000180), 0x40010) 25.655634157s ago: executing program 0 (id=2782): perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x8020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRESHEX, @ANYRES32, @ANYBLOB="0000000000000000b7080000010000807b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, @void, @value}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001900)=ANY=[@ANYBLOB="0500000004000000ff0f00000700000000000000db4dbabe3cd8d14ab34afaf13ac59f9b4cb45c6e76a86e00a017dba8b2f6372894a5747c88dd05b003366f51d27f40cde074278ed4e571bf779bf27caa81d71973a5964e29b5af15f3c3b52739ad22241569e4acb332aee441f3fe9a", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000021b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000001b40)='sched_switch\x00', r1}, 0x10) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0xc0ed0040, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {@norecovery}, {@mblk_io_submit}, {@noload}, {@resgid}, {@nodiscard}]}, 0xfe, 0x472, &(0x7f0000000940)="$eJzs3MtvG8UfAPDvOk6a9PFLf6U8WloIFETFI2nSBz1wAYHEAQQSHIo4BSetSt0GNUGiVQSBQxDigCpxRxyR+As4wQUBJySucEeVEMqlhZPRenfTxLVDHk6c4s9H2nZmd92Z786OPTtjN4CuNZT+kUTsjohfI2Iwyy4/YSj76+bCbOWvhdlKErXaa38m9fNuLMxW8n9i8XW7sh21Wp7f0aTc+TcjxqvVyct5fmTm4jsj01euPnX+4vi5yXOTl8ZOnz5x/HDfqbGTbYkzjevGwfenDh148Y1rL1fOXHvrx6/T+u7OjxdxtNNQdnWberTdhXXYniXppNzBirAmabulzdVb7/+D0RMDi8cG44WPOlo5YFPVarVas8/n3FwN+A9LotM1ADqj+KBPn3+LbYuGHtvCH89mD0Bp3DfzLTtSjlJ+Tm/D82079UfEmbm/v0i32KR5CACApb5Nxz9PNhv/leKeJef9L19D2RsR/4+IfRFxV0Tsj4i7I+rn3hsR962x/MYVktvHP6Xr6wpsldLx3zP52tby8V8x+ou9PXluTz3+3uTs+erksfyaHI3eHWl+dNlLlvvu+V8+a9z3aT7NPrRk/JduafnFWDCvx/VywwTdxPjMeFuCT+P/MOJguVn8SRTLOElEHIiIg+ss4/zjXx1qdezf419BG9aZal9GPJa1/1w0xF9IWq5Pjj59auzkSH9UJ4+NFHfF7X76ef7VVuVvKP42SNt/Z9P7P4s/fUZM+iOmr1y9UF+vnV57GfO/fVxJWhzbv877vy95vZ7uy/e9Nz4zc3k0oi95Kc0OLNs/duu1Rb44P43/6JHm/X9f9nhWvxL3R0R6Ex+OiAci4sG87R6KiIcj4sgK8f/w3CNvtzrWuv1XmJVvozT+iRXaP33LS1O32n/tiZ4L33/Tqvzaqtr/RD11NN+zmve/1VZwI9cOAAAA7hSl+nfgk9LwYrpUGh7OvsO/P3aWqlPTM0+cnXr30kT2Xfm90VsqZroGl8yHjuZzw0V+rCF/PJ83/rxnoJ4frkxVJzodPHS5XS36f+r3nk7XDth0fq8F3Uv/h+6l/0P30v+he+n/0KX6mu/+YKvrAXTE2j//+zelHsDWM/6H7qX/Q/fS/6ErtfxtfGlDP/m/UxPl7VGNpomB7VGNIhGlbVGN9iVe+STrEtulPkWivOr/zGKdiR1ND3X6nQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKA9/gkAAP//Uo/mdg==") 25.431520151s ago: executing program 0 (id=2786): r0 = open(&(0x7f0000000000)='.\x00', 0x400, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x10) socket$unix(0x1, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r4, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) unshare(0x68040200) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$llc(0x1a, 0x1, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0xb, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r6}, 0x18) syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f00000000c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[], 0x54}}, 0x0) sendmmsg(r7, 0x0, 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) 24.146084998s ago: executing program 0 (id=2787): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)) set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000e8000000000040d900008500000023000000850000000f00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000140)='mm_page_alloc\x00', r1}, 0x10) r3 = syz_open_dev$sg(&(0x7f00000003c0), 0x4, 0x400) r4 = open(&(0x7f0000000440)='./file0\x00', 0x183200, 0x6a) r5 = gettid() stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) r9 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, r10, 0x0) setregid(r10, r8) sendmsg$unix(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000001c0)=[{&(0x7f00000002c0)="d7652ea2de33589932f90ca9a0f7337a291e98052cf6a677f7cdf520a3be64eb680b1de2e8d89b201e9a61b23dbb1d9bfca85109db5e06ed4232fe7a966f4dd4f5e8566d2cf3a88f27771fd53e61d01e9a410cc550acda03470c5785d3da39ce8b78935fa5e930a7d77fd864f229afefcad498395e91737b37f1f77321c513c270c861e11d2ee70ca9fc912ce8ccb0b303ed2cdb66ccc8f3cc8db05aa8b7955b74452d8f667bf8b0944f927617eace3119c1ac683ff18ee233f08588e960a3a4acbcd9afd4999ced2bbd64184028313f50d5bba73a6a78c447040e2057", 0xdd}, {&(0x7f0000000540)="cb9ff29406de4bd0837c1a62c6a58fc56e0f2bc1d2ad8248fd16cfe2124169e25b50924241472c154b97dfab39b84ce3bddac91c53cc18da6e8d92f8694977fe0fcfe8e1f2478976cdf77ed5caa333ce7a28f93fe82e5d16aadcdc6dd1646826e4089f7fd2961b6ebbabd54f96c36151770255211e280ed86562d0484b3fc48763e1c1149750bf755c46064d241f072ff65af3494d59e4226dd10136b958fa0e0b18021a441f7d1ec2fae9b7c507f581d6e7d370dea6c50b225437d71f3cc23eac88a7bf53f03381f48a60c4b7020ce80629", 0xd2}], 0x2, &(0x7f00000006c0)=[@rights={{0x34, 0x1, 0x1, [r2, r2, r1, r1, r2, r3, r0, r2, r4]}}, @cred={{0x1c, 0x1, 0x2, {r5, r6, r10}}}], 0x58, 0x5}, 0x20000014) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x1, &(0x7f0000000000)=[{0x8, 0x0, 0x3, 0x1000}]}) 9.608278102s ago: executing program 36 (id=2787): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)) set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000e8000000000040d900008500000023000000850000000f00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000140)='mm_page_alloc\x00', r1}, 0x10) r3 = syz_open_dev$sg(&(0x7f00000003c0), 0x4, 0x400) r4 = open(&(0x7f0000000440)='./file0\x00', 0x183200, 0x6a) r5 = gettid() stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) r9 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, r10, 0x0) setregid(r10, r8) sendmsg$unix(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000001c0)=[{&(0x7f00000002c0)="d7652ea2de33589932f90ca9a0f7337a291e98052cf6a677f7cdf520a3be64eb680b1de2e8d89b201e9a61b23dbb1d9bfca85109db5e06ed4232fe7a966f4dd4f5e8566d2cf3a88f27771fd53e61d01e9a410cc550acda03470c5785d3da39ce8b78935fa5e930a7d77fd864f229afefcad498395e91737b37f1f77321c513c270c861e11d2ee70ca9fc912ce8ccb0b303ed2cdb66ccc8f3cc8db05aa8b7955b74452d8f667bf8b0944f927617eace3119c1ac683ff18ee233f08588e960a3a4acbcd9afd4999ced2bbd64184028313f50d5bba73a6a78c447040e2057", 0xdd}, {&(0x7f0000000540)="cb9ff29406de4bd0837c1a62c6a58fc56e0f2bc1d2ad8248fd16cfe2124169e25b50924241472c154b97dfab39b84ce3bddac91c53cc18da6e8d92f8694977fe0fcfe8e1f2478976cdf77ed5caa333ce7a28f93fe82e5d16aadcdc6dd1646826e4089f7fd2961b6ebbabd54f96c36151770255211e280ed86562d0484b3fc48763e1c1149750bf755c46064d241f072ff65af3494d59e4226dd10136b958fa0e0b18021a441f7d1ec2fae9b7c507f581d6e7d370dea6c50b225437d71f3cc23eac88a7bf53f03381f48a60c4b7020ce80629", 0xd2}], 0x2, &(0x7f00000006c0)=[@rights={{0x34, 0x1, 0x1, [r2, r2, r1, r1, r2, r3, r0, r2, r4]}}, @cred={{0x1c, 0x1, 0x2, {r5, r6, r10}}}], 0x58, 0x5}, 0x20000014) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x1, &(0x7f0000000000)=[{0x8, 0x0, 0x3, 0x1000}]}) 3.00180886s ago: executing program 8 (id=3100): capset(0x0, &(0x7f0000000040)={0x200000, 0x200003, 0x0, 0x0, 0x3}) setrlimit(0x40000000000008, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) sendmmsg$inet(r0, &(0x7f0000000780)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac1414aaffffffff0000000010000000000000000000000007"], 0x30}}], 0x1, 0x4008804) 2.983564861s ago: executing program 8 (id=3101): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000880)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0902000000000000000001000000050002000a00000014000700ff00000000000000000000000000000108000b00"], 0x38}}, 0x0) 2.852718663s ago: executing program 8 (id=3103): ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x20, 0x7800, 0x8, 0x2, {{0x22, 0x4, 0x0, 0x4, 0x88, 0x68, 0x0, 0x0, 0x4, 0x0, @private=0xa010101, @broadcast, {[@timestamp_prespec={0x44, 0x24, 0xd0, 0x3, 0x0, [{@multicast2, 0xcd}, {@multicast1, 0x9}, {@rand_addr=0x64010102, 0xffffffff}, {@multicast2, 0x6}]}, @ssrr={0x89, 0x23, 0xdf, [@loopback, @loopback, @empty, @multicast1, @multicast1, @broadcast, @empty, @empty]}, @rr={0x7, 0xf, 0x41, [@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast]}, @lsrr={0x83, 0x1b, 0x84, [@broadcast, @multicast2, @dev={0xac, 0x14, 0x14, 0xc}, @dev={0xac, 0x14, 0x14, 0x35}, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xb, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000fdff00000000000000926403d89dd9f3000000180100002020702500000000002120207b1af8ff00000000bfa10000e600000007010000f8ffffffb70200000000b70300000000008385009d48159bd9726eb6b459626f6db4a29418fccea754009168d2f461dd8b996fc06f8d"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0xe, '\x00', r0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x0, 0x7fff0006}]}) socket$packet(0x11, 0xa, 0x300) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a000020095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000200)='kmem_cache_free\x00', r7}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2686dd4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) fsetxattr$security_selinux(r5, &(0x7f00000005c0), &(0x7f0000000540)='system_u:object_r:inetd_log_t:s0\x00', 0x21, 0x0) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) sendmsg$TIPC_CMD_GET_NODES(r3, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r8, 0x100, 0x70bd26, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000000}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) socket$packet(0x11, 0xa, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 1.698293918s ago: executing program 5 (id=3104): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) accept(0xffffffffffffffff, 0x0, 0x0) lsm_get_self_attr(0x64, 0x0, 0x0, 0x0) timer_create(0x203e4093f5b38ae3, 0x0, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0x7, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r4, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) r5 = syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) ioctl$HIDIOCGFEATURE(r5, 0xc0404807, &(0x7f0000000300)={0x62, "a4395026f7fca8f411d271a8ac0352f02647be56f7af5c020d00a854bde7a3a2e42c1c5fcac45b88f2eb03642b134fd8e5b9bfd57889164508e1794a753cea7f"}) write$UHID_DESTROY(r4, &(0x7f00000001c0), 0x4) 1.54187148s ago: executing program 8 (id=3106): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1f, 0xa, &(0x7f0000000440)=ANY=[@ANYBLOB="7f20000004000000181100001c895e854e74cfc82b79f7a83b2b76dcebbca22e195d6147cfa761280acf6727f7ab30691e780b1cff5ab6dc5d095721d14bc280eaa1f711ccdba059dd8b17aa66284f51db6e722b8aa964f98c85b67c30edcf6c6a89fde4a08041b9e4ed9405fe2c76e6cd6d9b664b845e739738ba0b38c1d7cacb2fa39dda64fdd47b3375dc4c57b83122f3932bc84fd867442cebdcc1d89038ff1529e6df0fab2e4bab2c738589f980931dc5ac55e30c7b45b2190544e4add50e26456c0aec5ccf0000000000000000c1bf46d0cbaeb2602db105f7579351e3cfb7015b8632b030fd1177e4e0bb38932d702d3e5eaf6c42a959ebde4468199f7a973cf595bfb38f5b47a8922dd6f44ed455b870553e8db1483226c4ad3cbabb5ed7eb64522fdb11543e2c7dd7bab4a3e498c8806eefaebf8d627a5b5e33e0c23cb40641e8802e48da7976a4c34fd40a90536842fd0db1f537fede34b20aa6c33d578e48f8c2169d54e22ba521c0d85c72777620dd40f2faba968081da30bb2bf977162bd9321ffaab85f770d15c4e3f753b69cfb1de42251452587deb5cfb4115dba960b3ddbffec449efb1e2475b5a1160468e052ad87126ce70b359d34c9308d15d1a9b8ff2c4298d8e620f8b89520f5dcfec6ab9ae5146d6ecb154a7c03f8db1fef8d2ff20dfa42986d661c4f027a0349188ecbfc7fbc0daae41df0d9f2a23febd4c34e056b8b1e3caccd19a92e1cfb63414c3230f797c4257f2411eb3a9ed34e9b2c03b371970f36c9b", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082000000"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0xd}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_LIMIT={0x8, 0x2, 0x8001}]}}]}, 0x3c}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000040)={0x0, 0x0, 0x100, {0x0, 0xa}, {0x3}, @const={0x0, {0x1, 0x8, 0x4, 0x881}}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4808000010001fff3a4ee9bfd5c3a3696c40af0b", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e"], 0x3}}, 0x0) write$binfmt_misc(r2, &(0x7f0000000000), 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x4ffe6, 0x0) 1.500149051s ago: executing program 8 (id=3107): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x4, 0xdd, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa10000000000000701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f00000003c0)='percpu_alloc_percpu\x00', r2}, 0x18) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x3, &(0x7f0000000040)=@framed={{0x75, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x9c}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 1.499050701s ago: executing program 8 (id=3108): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xb, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x80}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000010000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000880)=0x80002) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syslog(0x2, &(0x7f0000000040)=""/36, 0x24) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) close(r4) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000280)=@newsa={0x138, 0x10, 0x1, 0x70bd28, 0x25dfdbff, {{@in=@local, @in=@loopback, 0x4e22, 0x0, 0x2000, 0x8000, 0x0, 0x20, 0x0, 0xc, 0x0, 0xffffffffffffffff}, {@in=@rand_addr=0x64010101, 0x20, 0x2b}, @in6=@empty, {0xfffffffffffffffe, 0x0, 0x0, 0x800000000000001, 0x10000000002cb, 0x6, 0x4000000000000}, {0x200000000000, 0x8, 0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x4055}, 0x4800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af882ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002a000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=@newtaction={0x80, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x6c, 0x1, [@m_tunnel_key={0x68, 0x1, 0x0, 0x0, {{0xf}, {0x38, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @remote}, @TCA_TUNNEL_KEY_ENC_KEY_ID={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x80}}, 0x0) 1.491106141s ago: executing program 5 (id=3109): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) fgetxattr(r1, &(0x7f0000000040)=@random={'security.', '\x00'}, &(0x7f00000000c0)=""/65, 0x41) 1.425111392s ago: executing program 5 (id=3110): r0 = socket$key(0xf, 0x3, 0x2) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) unshare(0x2c060000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r1}, 0x18) unshare(0x2a020400) syz_mount_image$ext4(0x0, &(0x7f0000000040)='./file0\x00', 0x21412ca, 0x0, 0x4, 0x0, &(0x7f00000002c0)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = socket(0x40000000015, 0x5, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=0x0) timer_settime(r4, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) recvmmsg(r2, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$key(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x38}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_emit_ethernet(0x4e, &(0x7f0000000380)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0xb, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x3, 0xa}, @timestamp={0x44, 0xc, 0x5, 0x0, 0x0, [0x0, 0x0]}, @cipso={0x86, 0x6}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r5}, &(0x7f0000000000), &(0x7f0000000180)=r6}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 1.316450303s ago: executing program 6 (id=3114): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x9, 0x0, 0x7ffc0002}]}) socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000ff000000850000000e000000c500000001f0ffff95"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) syz_emit_ethernet(0x52, &(0x7f0000000b80)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd60000000001c3c0020010000000000000000000000000002fe8000000000000000000000000000aa3300000000000000000000007c820ebfa65edb908027d4cc71e7effcc61d633db3d66f58f72d3b1efe1612d44ba2df4806693459fe817e91d78a7eeab540c18f6ca682f3dd90b264409a2451a34c71086d6657cb797fa7540297c08ed106a0003a9fe7f231a31d64ef5e2bca6c0a5f165007d7f5cb561ba6d7391425c4d78dba593dc39541d08c5eff49666fa069e3016564ac224954", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xf, &(0x7f0000000c80)=ANY=[@ANYBLOB="1803000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000800b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b700000000000000958ff6d15c5040659acd5c799a0b7c69e7315c108d176c86ea197a1508417731867e0d456c08e1ee73afb9f81e8b82431cf3df98bbcac35aa5faad636e5b1119b9d192d1316c759d2f76a973d1b76bebc92246fd6e076290ec48092fe9aa6068ca60b1b54184ac4d8ec47e4c23d924f39a0bb9fa801289f35b26c43d1be3161e9f197751a22c74f4edcde47cdf7d0fbb1ca4a9"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, @void, @value}, 0x94) signalfd4(r1, &(0x7f00000003c0)={[0x80000000]}, 0x8, 0x80000) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x2000c0, &(0x7f00000005c0), 0x1, 0x54e, &(0x7f0000000600)="$eJzs3U1oHOUbAPBnZrPtv23+pgUFlR6KChVKN0k/tHpKr2Kh0IPgpS6bbQjZZEN2U5uQQ3ovYkFR6aXe9OBR8eBBvHj06kXxLIgGhaYHiUx2N/1Isq61ydbO7wezfT+GPu+bmWey7zBDAsitI9lHGvFMRJxPIobu6huIdueR1n6rK0uV2ytLlSTW1i78mkQSEbdWliqd/ZP2vwciYjkino6Ib4oRx9LNcRsLi1PlWq06164PN6dnhxsLi8cnp8sT1YnqzMmXXzl95tTp0ROjD22u1368/s617167ef3Tzw4vV94vJzEWg+2+u+fxMLV+JsUYu6/91E4E66Ok3wPggRTaeV6MiKdiKArtrAcef2t7I9aAnErkP+RU53tAtv7tbLv5/eOXs60FSBZ3tb21egZa9ybif+trk/2/J/esTLL15sHdHCiPpeWrETEyMLD5/E/a59+DG3kYA2RHfX22daA2H/904/oTW1x/Bjv3Tv+lzvVvddP17078wjbXv/M9xvjzzZ8+2jb+1Yhnt4yfbMRPtoifRsRbPca/8caXZ7brW/s44mhsHb8j6X5/ePjSZK060vrcMsZXRw+/2m3++7eJP9Zl/lnbbI/z/+Lbz59b7hL/xee7H/+t4u+LiHd7jH/o1ievb9eXxR/fZv7d4mdtN3uM/9LYkR963BUAAAAAAAAAAPgH0vVn2ZK0tFFO01Kp9Q7vk7E/rdUbzWOX6vMz461n3g5GMe08aTXUqidZfbT9PG6nfuK++smIOBQR7xX2rddLlXptvN+TBwAAAAAAAAAAAAAAAAAAgEfEgfve//+j0Hr/H8gJf/Ib8kv+Q37dm/9J38YB7D6//yG/5D/kl/yH/JL/kF/yH/JL/kN+yX/IL/kPAAAAAAAAAAAAAAAAAAAAAAAAAAA74vy5c9m2dntlqZLVxy8vzE/VLx8frzamStPzlVKlPjdbmqjXJ2rVUqU+/Xf/X61enx2Jmfkrw81qozncWFi8OF2fn2lenJwuT1QvVou7MisAAAAAAAAAAAAAAAAAAAD4bxlc35K0FBHpejlNS6WI/0fEwSgmlyZr1ZGIeCIivi8U92b10X4PGgAAAAAAAAAAAAAAAAAAAB4zjYXFqXKtVp1T2FyIiOVHYBgKCn05+QEAAAAAAAAAAAAAAAAAgF1156Xffo8EAAAAAAAAAAAAAAAAAAAA8iz9OYmIbDs69MLg3T17I2JPslrIynsi4u0bFz64Um4250az9t822psftttP9GsOQC86edrJYwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCOxsLiVLlWq87tYKHfcwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4EH8FAAD//46R2W8=") perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x3e, 0x1, 0x0, 0x0, 0x0, 0x106, 0x40001, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x2, @perf_config_ext={0x0, 0x10000}, 0x1ba1, 0xfffffffd, 0x3, 0x7, 0x4, 0x1088f105, 0xfffb, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) creat(&(0x7f0000001740)='./bus\x00', 0x81) r3 = open(&(0x7f0000000100)='./bus\x00', 0x86602, 0x330269f53da8c4ce) pwritev2(r3, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0xffffffe4}], 0x1, 0x50000, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r4}, 0x18) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000400)='kfree\x00', r7}, 0x9) r8 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) writev(r8, &(0x7f0000000080)=[{&(0x7f0000000300)='4', 0x1}, {&(0x7f0000000040)='\\', 0x1}], 0x2) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a32000000000000010073797a30000000001400038008000240000000000800014000000000140000001100010000000000000000000000000a"], 0x68}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000008c0)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=0x0, @ANYBLOB="0524060000000000300012800b0001006272696467650000200002800c002e00fffff6ffffffffff050007001f000000020027000000000008000a00a8"], 0x6c}}, 0x0) 1.249177724s ago: executing program 1 (id=3115): r0 = syz_open_dev$evdev(&(0x7f0000000200), 0x8000, 0x101000) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000280)=[0x0, 0x1]) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a000000020000000900000008"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='mm_migrate_pages_start\x00', r2}, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYRES16=r3], 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='kfree_skb\x00', r5}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00'}, 0x10) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000", @ANYRES16, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2000}, [@ldst={0x6, 0x0, 0x6, 0x0, 0x0, 0xfffffffffffffffe, 0xa000000}]}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x93, &(0x7f0000000100)=""/147, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 1.196529905s ago: executing program 1 (id=3116): r0 = socket$key(0xf, 0x3, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0x1, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000300)}, 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@map=r1, 0x20, 0x0, 0x80, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0], &(0x7f0000000240)=[0x0]}, 0x40) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000001240)=ANY=[@ANYBLOB="020300000e000000000000000000000005000600000000000a00000000000000fc0200000000000000000000000000000000000000000000020001000000000000000a000000000005000500000000000a"], 0x70}, 0x1, 0x7}, 0x40000c0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000080)='kfree\x00', r2, 0x0, 0x2}, 0x18) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000), 0x80402, 0x0) write$cgroup_int(r3, 0x0, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x17, 0x2, 0x401, 0x4, 0x80, r1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x2, 0x0, @void, @value, @void, @value}, 0x50) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r4, &(0x7f0000000100)='-', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r5) sendmsg$ETHTOOL_MSG_FEATURES_SET(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000e00)=ANY=[@ANYBLOB="f0040000", @ANYRES16=r6, @ANYBLOB="01002bbd7000fddbdf250c00000070000180140002007665746831000000000000000000000008000100", @ANYRES32, @ANYBLOB="140002006970366772653000000000000000000008000300", @ANYRES32], 0x4f0}, 0x1, 0x0, 0x0, 0x20000080}, 0x42) setsockopt$inet6_int(r4, 0x29, 0x4a, &(0x7f0000000040)=0x14, 0x4) listen(r0, 0x52d7) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 792.40282ms ago: executing program 6 (id=3119): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x4, 0xdd, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa10000000000000701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f00000003c0)='percpu_alloc_percpu\x00', r2}, 0x18) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x3, &(0x7f0000000040)=@framed={{0x75, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x9c}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 698.111651ms ago: executing program 9 (id=3120): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) open_tree(0xffffffffffffff9c, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'syztnl2\x00', &(0x7f00000000c0)={'erspan0\x00', 0x0, 0x10, 0x7800, 0x0, 0xfffffffc, {{0x8, 0x4, 0x1, 0x30, 0x20, 0x65, 0x0, 0x2f, 0x4, 0x0, @loopback, @broadcast, {[@generic={0x82, 0x7, "5399654e06"}, @noop, @end]}}}}}) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x400000, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r3}, 0x10) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r4 = getpid() madvise(&(0x7f0000a5e000/0x1000)=nil, 0x1000, 0x17) process_vm_readv(r4, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000140)={{{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@mcast1}}, &(0x7f0000000240)=0xe8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x9c, &(0x7f0000000340)=[{}, {}], 0x10, 0x10, &(0x7f0000000380), &(0x7f00000003c0), 0x8, 0x73, 0x8, 0x8, &(0x7f0000000400)}}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000001880)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001840)={&(0x7f0000000580)=@newsa={0x12bc, 0x10, 0x800, 0x70bd29, 0x25dfdbfb, {{@in6=@local, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4e23, 0x0, 0x4e21, 0x1ff, 0x2, 0x140, 0x20, 0x21, r1, r5}, {@in6=@dev={0xfe, 0x80, '\x00', 0x33}, 0x4d5}, @in=@multicast2, {0x3, 0x2, 0x2, 0x7, 0x1d, 0xffff, 0x0, 0x5}, {0x40, 0x8, 0xffff, 0x1}, {0x8, 0x2, 0x1}, 0x70bd27, 0x3503, 0x0, 0x4, 0x81, 0x2}, [@XFRMA_IF_ID={0x8, 0x1f, 0x2}, @mark={0xc, 0x15, {0x35075b, 0x8}}, @srcaddr={0x14, 0xd, @in=@broadcast}, @srcaddr={0x14, 0xd, @in=@empty}, @sec_ctx={0xc5, 0x8, {0xc1, 0x8, 0x0, 0x1, 0xb9, "8f250cd71a0c2aa81ac32d3ab681711a5e11f92c639ebabc947accad0bc2045ded53f19abcc6fc5746c9c9c2c777cfc81eed0384584fd0a2a25f5b0ebc56ee966db1968879c53d56d8dba857c9e2d4c83fb91e2bbb77ccbbfb7ec49da236ce847efa7f7e9f34dddd5efcf20437c621ec02233327be079c4169dbb5290380427427439c79737cbe57f5b23d46b4d584a555df5f04d6fd6e0c5583c36a7e0521a7839879950d6b2a1d5699c71364a960222ed4aa7ff9cbcaf525"}}, @algo_aead={0xae, 0x12, {{'generic-gcm-aesni\x00'}, 0x310, 0x80, "ce847995443850d6baf1759d26eb011cba1b1d891c5511440938a63b2467902919a90614fca9dfc1829b330a27eb490eb74f2722b97b4e819019505688d7663e3cbf45ac12f11afb85dae240d2b03079d743571c423ece29b6f28acf53661ab99f88"}}, @offload={0xc, 0x1c, {r6, 0x1}}, @sec_ctx={0x100c, 0x8, {0x1008, 0x8, 0x1, 0x1a, 0x1000, "e94a9548e047393a9793a011639e7c2f2ab54b84667ab098e7da8f5114ebdf6f45d51f9ae34d0f84a13f21880dcfb59d0ea40e7c309b36ef12d8cac4ead56f69b74f8e73d3c4b1d0423fed77e2fab42b3900a17c5d3df1771155ffecad90c01c34d06c0b3e0f66ec8e86fbc44efceb9d9671def529d4df95666409bc6bb158b41143c768e60d4404d973fa264e8ada2fe92af0215ec918bdd877fd2dd94fe0581865da17c78fa145c67b9607123afa9646411f50a9b06f40478717fa7f81876d4a7eb24c276f395d29e629a33f4ef8e7101a7927013a06331bf9ec47cae00accada7d09a1b664068238875e5c25b94ce647d9135274ced582214a8739a6b3abb497a46859a878494b0ef3591bb939da47c5b64f45ad9739dd8514f348b304c88f12f1338d858146d5ee332d51addaea6e6159e3d88e7d167d371e2c4e869de71f4fc3a7b2ec624b0b4502fa2a0932d394b8b17ce2df2f06d480ffae9f5a698566108851f77dcbb91acee335ee99f95f7e256bc6e2f713625f42ac7659f0426ef1dd8e60538c54d531225bcfe6ea9f70d8995e81c4845111b02477f50aa11f459340bd174b9d85e2629029454c7a1634402788809eb710e9b109071bb3c11d303720507758b69123dc4c11c5c32cf57425ec01cd838288cf379477046f85192021fb6569e8e92641fdc210ee8f0aaa18c68e1b2f8866475f8b84aab2f6010dc25e8b4d3190d8d8a291767c0bb64b567c0952cba1836cb015bd7080b78d089bd5497072ab85a75931326245cdc3bb858893b38c0a1b1330e6c4677ef7756174de6cd272b122af7583931b0ff0978df6290fdeb72b528a86ae93d2b4795068e8e1683e1d3f815662c8800e8215e8772d6c30cad8ceb9a2874a26c3b404749c80edacd02f0a0bb3ef5d86516b3d53454a234932b5416a16fb5602bddeaa6d4dd12af5c1809bce1f916545aefbf624a5e3c2d59d5882eb1aa50707c28ef42e588bd98146e84c618525e9d210b54bfb827ae697450fa304a6bff79a1cd7d880d8b836985262802e67c2d6566736ebed0d3807c2c10d7b567a74f3c97d94fe738d002baf243f8798728aa3b744e52be695ba6236708057dca7cced2b02f62403cec22b13e4778e18770282a4201ab4bc6c970cd6f112e2cf261a8ae0d126b27bc458505300cd3db08f29c32f5bb5cb2d2ebe6b1645e5d525e174f7b4dd9239a74b39aac0b44710d3cad3c1bd873bd0329a4330a71e7d52ed1890404d9501dad8fd3fbc7f21fe66543af95d3869e105b25f76ff5ef6b3f78888da6c94947da9c3e12c59730cea782ddc61f69b05b808a3a01165e3a74e636aed1675f6455d9b509e3b59e35def5ff0b6c3cfc5eaf86d8e17a7fa0eed1dcb3384f7753c8e870f4c4de17cc415a5632f698be119f5dcceb3205980cff6d427048f8972fade6c318d0c42cb488fe85908dc6ce793f2b2e16899b1504327a4ce4eb96c3bacce50a8ecf3d5e19296f7d91e7ddb99393cd8b950f932e81715a20b00a1463a171b247a49c59cb9083c6afbdbe578184cf1bfb5bd15ed2ede7e30459407dea547da1eabdc2af11ce6538786ae0e94167e30e95884fdb732fd8c55ca7d83d091423e4eb8d8ce7f8cb119ca030a3659d2a29362c5865e75c36ffb2c19799521bdb4a7615667272de3c1c1b7d6a70e1c6d7794951537ba1a3c382a383cf2b47af5c95f8f08618c818993f0e6cfc9cdb59684785b36028dfa6c14cc2c98f277f0fa8379ff6d0a1f0554ca2df7298f12d27dc697bbea5486612aaf79571f8a2abf8eaef8904a1c844b4f524082a236a5f4cf11f6d480e760df2858a102c363bdd364aa22e6d139f46332a73b74164374a33e5c621a5c2b67ea6d36a239fc8fce6575b601056982093fdb3a79a5d062d3779ca15df7118771cd6f8a15b7c17650e94185e1f03332cd418c431e05c8c82ebb95ea2cf5f541969d378d66bb542e7afbbf296454ed174718cb27750a7e41701684b15cf30b156fdb468dc40c993924b13aa3d945ee99eebed8d43d38ec98935841197a628e8525824429b796edb82c05d14b09ce3c506154dae07f3b1c07d686388cf53fb1a2a4cd28a81153c3e85a1e033b86432433423a698e132270d3ebc53964747fa1cc810e544b7e258fb2597f671244417fcb80efd43799f184ebec115a8456f133fa2dfa2ef6a0b3ed8f5d1beb146f82251f12cac28637f1038a378d995f928074f8e1ee721fc4f6a79b4ae9dfbcd361569a0cd4ae72ec1569660bbf8f6b92dfc889eb99ffc21ea0aa5fec46627b1d9f742dda4d15ef626ec09de3388d3448d368ccf42d94a3f7dc4472246a58543ad5e2f917783fce754fc9c20a1424ebf21db5e65a3f3fe0c9701b2f87ba3d9fd5c73cd0b228d382e8cfd88ea14d0e3c638f0304770d8d470482ccf47748902b28164ea9763268a7b13e44ec5c3274023462532a17a452673649b89fd867c866dbae087012317e4272145e0a322cb096ae5bd982a9159a64ba2cac1605a989d0c5cae6c8ea64c0160354cc8dcec6f6fba7598939d5bd280e6fc6f44966e1eaba136f52c07bb78e2fdd607dbb44f390537fa594a3097edf8eb2d0f37b8b3201134f0f9a83fe36b89016fe85ca7db8b07778cdc5ed0b378427d9fb9f84159a6e77fbecec4cc53afc4044b0d75044bb68594fae76e4fcf295b6f235c28e7157d2a02b2a0d5d3036c4c0180e2fb92562b6ba7e86f14ae384bed1f871cf98377fca35e15bafbf162579b98699e2eea7146b8b96f74ebeae11b2f94aaa463977e2c2f02c96c1d045f350ab5cdd4afba01d22cd112d67d546adbfdf53056ccfe80b5be8671189aa42e2cbc771b48b38b65d191559d6c3784b68bf424f0b5d82cb7cd089dc9ce5b83171f9d79da6c54f6e56b2f44354500c4b3e9e77bce11ce883900200c9d3a9fa8eb09da7398bdecacf9f6eefe9c512079da45f9f73a148c7c9482f26a6a3e8d6dd730cf2a133b4df40b4968582f0cc1b92427236b596a0df49d4caf4b8e88946dcdf6f1e196ee78ba5702ec5693fd71a46f4219d043240346c2fcfd7eb74bd89afbf88ddb7f5c00a0c1aa765309012ef4ba25699c6cf996aa2f51f9a2bc5110e2f92079ae761e7db57c6db6d05a9d59b5915f7885a30f9df35099f892b1b1518fbb3f125580b483961f5271bc39553b5fddaa74877a15f7f5608715da304168f5d767c351f1cd766d40ce74e061d07d3d982c395478ce402e2e3fcfedc96a775a12efba802278a0ecfc9b93418ef916cc5cec8fe5a6aab4c880e71eb0a920dc64eb3d64fb601dd691b07a246632d0db19ed127d3f0f21ba72288063a9df23524390be6c1b3d1ab8af489dedd72802681fc77e7c72f5d49ba78ca955c4079b9b6705268858b72147fa630d0725e42126ef3f4eddee50da85e6d902a3224cbf052c1c513fefd71fd95280c833f8d7017c7088f4e3bbeab714b3c1d2df674cb240125f4326d884c8a0713536c8857e1b22c35a3b9e19686f5fd65b63ed749f1f6aac645664c4931814e8aad62df279200021b917af36b2a89c98144954235d0e293fcc2aacf46975a74d21cc2efe4944efa040c5864b6deb51ed69e32d8a9a5dc1e09433c5a3f3a7b8b275e7f93f62b45458754183652585101f192c9e5dadabfd750166a15dba5665b69aadb9308726744740e83295522c1b56476e00967ecc750a46aa899987c2ad2044b9d5011617a809cf84e35dd11547707d513bb6a68486803e64f857de49ca8113bbed8b0a08604e51eda1566986aa80fb831aa55f83ca12f81ac275ab3d867fdcc8003f746c38df7216497a04649c6dd572339e36656f54a0571ff6f638ac1ffc292b0f730d6b653982af7f4392bd3ebee582570e1388f0ba4c1d3508e12ab7d947ba807210c3d9ee7e26a8e9965fd6e5a854e43d52bbfc1a46f32f92b2495e438b9c5e258c02e36435c618ee0020d69f1a6feb505a27e9c1ba74fd69eba0cd5b20b48827f41352400db868b2909b094b6d79aaf0b44410988896041aa81b2f718ae9d7b3e90bdb1f76ee1c72b14cc53db087e972ef1c4bae04392463c8995b25bc4e6266fc090d367fff0267c8f0dc6014a69e6c8d71baf8890505d67101430b1192caafbc50e36dce4a9f0193114b68316c96abe66c4b8bb5e902733f175bfb1fea4c753b9db8247659d19766afaf004072df63c7b0c99edf318695bd14e40bc34a5ba09f8437d21dc914ca92e038c852ee33aa0e74718bc2db66a18a8d214cc50a66793502c83e973b6e0f8dc704b97c6a0640773de02b2e6dfdc7c2e9df9f19a02ce6bac243f0fd01dde7a6650a3023f2e810659e62278a0e4be18f72560d68a0ee06721d82245fd3dc6cc9c2fb31489453a892a077a8a4d14b80c67846df795ff3cbf1d6fd2747be49adb6402f79c5ae46e5dc28d705cb6a589119ff6d926cafd12e62905d11354fa70fb4b6033e5246e9bf27dd9d40fb22f2aa1f7b66c359530953c0e6e7fb7cef2b8ae6901b70a96e4076ad31524a0f2b04f56649acf82162f3bd1f2eac33bd4b3b2e8e965fc9fbb56818eb45e363ad0fe1934487f468d54188f60bd07f4e813c029bdc2d91364779f0e0271fc29ccb74a85d9513f3f4b6ddf83b0a5dc65f2d1844ed4c0b88a4666a6aea4447fbe3000de7ab960da4ccb9bcde737957b0f674a972616330bf52d3b7d791560e639b10f3f81693c562345c3265f67ccbd8e4d60a51dd9fcd303b90c0ae018f62d8cf4294dbbd96809b43ebc906646b6b8ff5ce4cbbe2df9d5eee345e9d4586edf0431a7750fbf61483ba1623d3d3e8c08d0dcbe45958b2f09e880157ff2b554b51178532b992af811223f2db6eded27a1daaf963d4824528c7d33d0443bd97d17f6f928009d3a61602a65981212a818851c9382b9db5412c865c800ad4e3d96bddb06ce2ae04c8eabb1b185d1b6521f87c6262b076a98421e7080f74ad1668c5c909548712749d2039a2c91129ad310a8c90e66a753b6ee07b25604d88dfa855e87c482f8c8405a706a78fb3e0a687fc6c713cd1a44d5b450de43e991fa52442f58f28fb3e2f75483b829c2f5876158de1806524be8af6cb8eb4228fdc746aed569ac03dabdc6ac019f646f639e40457a06f0ab0a469859a3a17aef2097da24c97be63cc147eccbf3d778e61455708cadeed45f85ef6610145a7adff3439724ae7171b16c6e8ca08fd0729ef5d7149d76fb1eb619f8254abb25ab84683007e4a23c27c45e49bfb8b08403330cf349395f8c72ddc2dbf14d68fc754a066fe53588e1d3390bdb6b5afbef20b51383674367c120014f162bacb290e61021d4342bf397884545a9524eae4405b18c86efc4fc145f97f11f904b890e3100988d7df83549cbbea5fdc851ad99d87540aa80d5589a6c7845e1a1b6471025df7cbcbec6a601a811d64e9d54faee326c7902a76a39077cb2b961a5d077e83fc8d0f7f95d82aacf50e81539de9c044921bcbe7d1314c84b2052af7e7f3658061b0e07e2bff3aa07df15b3b772967f3d48c6582d452430c67d62d77ae8b11102f65f29b666b65eee13d0ef1bcc335a2d912f5b0044a2fbe226df465b6fb448dc7d7f0edd321a6b245c71f3503f0ef9e23beabef6c0e40f10f3828c439597a3d9fd076552284d8133e7dd724d49891a6eb28744fbee0665a028de96fa75438c04a0b7d8e81c54e0145b9a6a1e4ccef1ce9cfe0f0bd5f6a33db59d7a0beebbe22449ed6603f7cbf54c60253b80f065eea6432340960304d8cc758a0a1090c7759a75b38e413eb05f58875"}}]}, 0x12bc}, 0x1, 0x0, 0x0, 0xc000}, 0x20000000) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) ftruncate(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) 656.594772ms ago: executing program 5 (id=3121): ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x20, 0x7800, 0x8, 0x2, {{0x22, 0x4, 0x0, 0x4, 0x88, 0x68, 0x0, 0x0, 0x4, 0x0, @private=0xa010101, @broadcast, {[@timestamp_prespec={0x44, 0x24, 0xd0, 0x3, 0x0, [{@multicast2, 0xcd}, {@multicast1, 0x9}, {@rand_addr=0x64010102, 0xffffffff}, {@multicast2, 0x6}]}, @ssrr={0x89, 0x23, 0xdf, [@loopback, @loopback, @empty, @multicast1, @multicast1, @broadcast, @empty, @empty]}, @rr={0x7, 0xf, 0x41, [@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast]}, @lsrr={0x83, 0x1b, 0x84, [@broadcast, @multicast2, @dev={0xac, 0x14, 0x14, 0xc}, @dev={0xac, 0x14, 0x14, 0x35}, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xb, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000fdff00000000000000926403d89dd9f3000000180100002020702500000000002120207b1af8ff00000000bfa10000e600000007010000f8ffffffb70200000000b70300000000008385009d48159bd9726eb6b459626f6db4a29418fccea754009168d2f461dd8b996fc06f"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xe, '\x00', r0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0a00000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000500000000000000f894863173cb62847a3127b89e04289c93d3c2dea0cfb5546505b44720eb4c18151d3d545ab93ba565097296597f0cec3a46ba7b0ad6b658938fae8560061880ef173a74c8f144d77063e78ceec40f7e537b88908cba21290f80e61c0ba24dfa48e4f615e773776cbd843dbdfe0157a9600300415887e3713fd5a162e428e3964845c397e605e5333b23067d52dc1b354f07a3ca144ae6e424a2ea7f57f5a998e0410c7e861ee2eae715b9236ea6d2c02f9451a09a9040d858cc0a05eb3cde4bbf51a65b54a69210548cb2fe262f7ef92ab531066bc4e6b3e0f1b67864ebd06586ca5d6d828231a3306dd7a11ef788df06a9abebd274867c7dbe19eb2694c7374f362900632966cc4a56a8ecf80292177492ee0b6c1d012b6aff612cf5634cd2500319c317ec9e8a88001bb3d0692eeb8beeb6e0911a6711a42ee847adf85800eceec6f436e1f988c4410ec98b6ac145815bf892e5be00"/370], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a31000000004c000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d6163767461700000000800014000000005"], 0xe8}, 0x1, 0x0, 0x0, 0x40040000}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x0, 0x7fff0006}]}) socket$packet(0x11, 0xa, 0x300) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a000020095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000200)='kmem_cache_free\x00', r8}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2686dd4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) fsetxattr$security_selinux(r6, &(0x7f00000005c0), &(0x7f0000000540)='system_u:object_r:inetd_log_t:s0\x00', 0x21, 0x0) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) sendmsg$TIPC_CMD_GET_NODES(r4, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r9, 0x100, 0x70bd26, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000000}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) socket$packet(0x11, 0xa, 0x300) 648.635322ms ago: executing program 6 (id=3122): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000027"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x33, 0x0, &(0x7f0000000080)="f6f4e9a10000502468da5eb1c6b2feff8833c0000000000000c548dc7914cb11ad63bf3707164aac031971c4be105eb953f86f", 0x0, 0x86, 0x0, 0x2b, 0x0, &(0x7f00000001c0)="daf9e846ab156efc71b59652333536dbfd26a6d0546366e36eb77dd0aaa2dbe567d168904cf0d5bce17718", 0x0}, 0x50) 530.268233ms ago: executing program 6 (id=3123): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r0}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) fallocate(r1, 0x0, 0x0, 0x2c2) 473.025085ms ago: executing program 9 (id=3124): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) rseq(0x0, 0x0, 0x0, 0x0) r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x6) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) readahead(r1, 0x0, 0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@bloom_filter={0x1e, 0x7, 0x5, 0x8, 0x424, r0, 0x0, '\x00', 0x0, r0, 0x4, 0x3, 0x0, 0x1, @void, @value, @void, @value}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x88002, 0x0) r5 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r5, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e24, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x200008c0) r6 = syz_io_uring_setup(0x6d0c, &(0x7f0000000340)={0x0, 0x0, 0x10100}, &(0x7f00000000c0), &(0x7f0000000140)=0x0) syz_io_uring_setup(0x1866, &(0x7f00000003c0), &(0x7f0000000040)=0x0, &(0x7f0000000100)) syz_io_uring_submit(r8, r7, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) io_uring_enter(r6, 0x184d, 0x0, 0x0, 0x0, 0x0) pwritev(r4, 0x0, 0x0, 0x0, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x72}, @exit], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYRES8=r9], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0}, 0x18) socket(0x10, 0x3, 0x0) socket$kcm(0x10, 0x4, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04004ce147342444a6bf9dd1000060005f000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x1c, &(0x7f00000006c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffff7, 0x0, 0x0, 0x0, 0x2}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @cb_func={0x18, 0x6, 0x4, 0x0, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @alu={0xeabeca907fc5a432, 0x1, 0x8, 0x9, 0x8, 0x6}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='fib6_table_lookup\x00', r10}, 0x10) r11 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r11, &(0x7f00000003c0)={&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000540)="b7", 0x1}], 0x1}, 0x40080c0) 400.421915ms ago: executing program 5 (id=3125): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e21, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x20000000) close(0x3) socket$nl_xfrm(0x10, 0x3, 0x6) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) r2 = msgget$private(0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000002c0)={0x0, 0x0}) msgctl$IPC_SET(r2, 0x1, &(0x7f0000258f88)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, r3}) msgsnd(r2, &(0x7f0000000380)=ANY=[@ANYBLOB="03"], 0x0, 0x0) msgctl$IPC_SET(r2, 0x1, &(0x7f0000000000)={{0x1, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0x800200000000000, 0x7, 0x2, 0xc1, 0xffffffffffffffff, 0x0, 0x0, 0xfffd}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) r6 = getegid() r7 = syz_open_dev$usbfs(&(0x7f0000000340), 0x800000001f7, 0x82) r8 = dup(r7) ioctl$USBDEVFS_CONTROL(r8, 0xc0185500, &(0x7f0000000040)={0x23, 0x3, 0x5, 0xf, 0x0, 0x2, 0x0}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r8, 0x89f3, &(0x7f0000000340)={'syztnl2\x00', &(0x7f00000006c0)={'syztnl0\x00', 0x0, 0x0, 0x700, 0x30a3e949, 0x9, {{0x31, 0x4, 0x0, 0x3b, 0xc4, 0xe4, 0x0, 0xc, 0x2f, 0x0, @remote, @loopback, {[@timestamp_addr={0x44, 0x34, 0xc9, 0x1, 0x5, [{@broadcast, 0xc89}, {@remote, 0x9}, {@multicast1, 0x47}, {@local, 0x9c22}, {@empty, 0xfffffffc}, {@private=0xa010102, 0x3}]}, @timestamp={0x44, 0x8, 0xd1, 0x0, 0xc, [0xc4]}, @cipso={0x86, 0x4a, 0x1, [{0x1, 0x6, '\x00\x00\x00\x00'}, {0x1, 0xb, "e370048ca3c978dfae"}, {0x5, 0xf, "b417180d90187320851ad9e052"}, {0x1, 0x4, "0300"}, {0x6, 0x12, "80a48d02cb3704e36a595d915c8c06e7"}, {0x2, 0xe, "058c3860c91a72772081f6f0"}]}, @rr={0x7, 0x1b, 0xd7, [@multicast2, @private=0xa010100, @empty, @private=0xa010100, @local, @dev={0xac, 0x14, 0x14, 0x33}]}, @ssrr={0x89, 0xf, 0x14, [@local, @dev={0xac, 0x14, 0x14, 0x1a}, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) msgctl$IPC_INFO(r2, 0x3, &(0x7f00000009c0)=""/142) r10 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r10, 0x6, 0x0, 0x0, 0x0) r11 = fsmount(r10, 0x0, 0x20) symlinkat(&(0x7f0000000000)='.\x00', r11, &(0x7f0000000140)='./file0\x00') bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000800)={{r4, 0xffffffffffffffff}, &(0x7f00000005c0), &(0x7f00000007c0)='%-5lx \x00'}, 0x20) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000840)={r4, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xd, &(0x7f0000000080)=@raw=[@printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x9}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r8}}], &(0x7f0000000300)='GPL\x00', 0x401, 0xfe, &(0x7f00000004c0)=""/254, 0x41000, 0x14, '\x00', r9, 0x0, r4, 0x8, &(0x7f00000003c0)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000400)={0x2, 0xe, 0x1}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000880)=[r4, r4, 0x1, r13, r4, r12, r13, r4], &(0x7f00000008c0)=[{0x0, 0x4, 0x5, 0x3}, {0x4, 0x3, 0x3, 0xf}, {0x1, 0x2, 0x2, 0x5}, {0x0, 0x1, 0x7, 0x8}], 0x10, 0x81, @void, @value}, 0x94) r14 = gettid() tkill(r14, 0x7) r15 = gettid() msgctl$IPC_SET(r2, 0x1, &(0x7f0000000240)={{0x3, r5, r6, 0xee00, r6, 0x140}, 0x0, 0x0, 0xa7ec, 0x6, 0xffffffff, 0x4, 0x8, 0x5, 0x8, 0x0, r14, r15}) lchown(&(0x7f0000000100)='./file0\x00', r1, r6) 332.930926ms ago: executing program 1 (id=3126): r0 = syz_open_dev$evdev(&(0x7f0000000200), 0x8000, 0x101000) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000280)=[0x0, 0x1]) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a000000020000000900000008"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='mm_migrate_pages_start\x00', r2}, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYRES16=r3], 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='kfree_skb\x00', r5}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00'}, 0x10) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000", @ANYRES16, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2000}, [@ldst={0x6, 0x0, 0x6, 0x0, 0x0, 0xfffffffffffffffe, 0xa000000}]}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x93, &(0x7f0000000100)=""/147, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 287.464817ms ago: executing program 1 (id=3127): capset(&(0x7f0000000080)={0x20071026}, 0x0) setrlimit(0x40000000000008, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) sendmmsg$inet(r0, &(0x7f0000000780)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac1414aaffffffff0000000010000000000000000000000007"], 0x30}}], 0x1, 0x4008804) 278.594387ms ago: executing program 9 (id=3128): r0 = getgid() lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f0000000280)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000005c0)={0x4, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x19, 0x6, &(0x7f0000000940)=ANY=[], 0x0, 0xfffffc01, 0x24, &(0x7f0000000480)=""/36, 0x41100, 0x9, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000580)={0x2, 0x3, 0x8, 0x3}, 0x10, r5, r3, 0x0, &(0x7f0000000600)=[r4], &(0x7f0000000640), 0x10, 0x3, @void, @value}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000009c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfbdf, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r6}, 0x18) r7 = getegid() getresuid(&(0x7f00000004c0)=0x0, &(0x7f0000000500), &(0x7f0000000540)) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="38000000031401002abd7000fedbdf250900020073727a3100000000080041007369770014003300626f6e643000"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$unix(r9, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000440)="e2bb1ed63a57576cc2dcd86b8604be154e8a7600393346db8d", 0x19}], 0x2, &(0x7f0000000600)=ANY=[@ANYBLOB, @ANYRESOCT=r9, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c00000000000000010000", @ANYRES32, @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="000000002800000000000000010000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES8=r8, @ANYRESDEC, @ANYBLOB="1c0000000000000001000000020000", @ANYRES32=0x0, @ANYRES32=r8, @ANYRES32, @ANYRES8, @ANYRES32, @ANYRES32=r9, @ANYRES32, @ANYBLOB="000000002c0000000000000001000000010000", @ANYRES32=r10, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32], 0xe8, 0x200400d1}, 0x80) r11 = getuid() syz_mount_image$msdos(&(0x7f0000000140), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYRES64=r11, @ANYRESDEC, @ANYRESHEX=r11], 0x1, 0x522, &(0x7f0000000a80)="$eJzs1b1u01AYBuCvaSiBqTNiOBILU1XYmAhCqVRhCQmUASYiNSwxQooXJ1MvgQvgwhi4CJSpW1BlF2jFWP+oeZ4ln/LaPuc9g/3p8ZfF2dfi849v32M03ovBOB4MLvbiMAZx5TwAgLvkYruNX9tK13sBANrh+w8Au+f9h49vXmXZ5F1Ko4jNeTktp9VvlZ+cZpPjdOngn7s2ZTnd/5M/S5Xr+b14WOfP/5sfxNMnVX6ZvX6b3cjvx1nj7QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYLcdpTSMiJRSOvz776Ysp/tVfpSu3Mir6eQ0mxzXF1zPh/Fo2FoNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4BYUq/Vilufz5R0bIn5Gy4uO6iNtuem4XrYvJ9/k8LKJJ7+IiL4U7NHQ4UsJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADoVLFaL2Z5Pl8WXe8EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiLYrVezPJ8vmxw6LojAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0I3fAQAA///PCC46") getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@dev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4}, 0x0, @in=@dev}}, &(0x7f00000005c0)=0xe8) mount$9p_fd(0x0, &(0x7f0000000180)='./file1\x00', &(0x7f0000000480), 0x1020, &(0x7f0000000840)=ANY=[@ANYBLOB='trans=f', @ANYRESHEX, @ANYRESHEX, @ANYBLOB="2c64666c746769643ddebfbfc61e71ad7db91b6b34b25011f418125578cac23d8ab1ef42c2d7a401d74bcbb9704bc5fb3b4bf2d9ce25cc14ef4ac7913895c89b88cf18dedbde11c6c1e722570dd491fd7125d192620c7ca11be810", @ANYRESHEX=r7, @ANYBLOB, @ANYRESDEC=r11, @ANYBLOB=',obj_role=,silent,fscontext=user_u,euid', @ANYRESDEC=r12]) r13 = getuid() newfstatat(0xffffffffffffff9c, &(0x7f0000003200)='./file0\x00', &(0x7f0000003240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000003380)={&(0x7f0000000280)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000001dc0)=[{0x0}, {&(0x7f0000000400)="5267beadc1e9c96f26c2795a9fde7d5bda53fae147d2b14af15ab6eb647e29567d92994a1a1a3abd0dcf21ef23dadd6590e3bf89395c4c7db96d25955ccc2f81e6ec01d32c7b99c09f104b7bcd155f880da9cf2c8ca898e3bd6249b763891b592751b1903264f67522416e435005d057a138b376f3cf35ecb3ee78830055317473dab64b36d962a6b99008f89bae0633267911b5535a12cf32c5c05410bdb826d467d7536d11e0049ce627b52d24df26485dee40f3f62cddecd8eaa8d9486d0c36810a1e0dbbd16beac71f46e66085b858021a96dbc8", 0xd6}, {&(0x7f0000000600)="8c30acdc0598b3f5378d561975bc8b8ec34eb21b57b904638e84c2a73cc9ff7eda8cd7c5f62589d1eaf4bb3205437b1bfb5d803f5891a24b22e82a9574ddee53efe7c8217ece993d6d0383ed46b32eea0b15459fdb3f62380dbe321f717b38b28d115fdaf018f16a5a110209d59957204707654775685fedebe08bb2bb359a0b0c975692d6116c03d3ce89802f1d0e94085969e33680ae86cf8e1660ac90b268804fdce8c4974bb30a6a", 0xaa}, {&(0x7f00000006c0)="46b66f1f8ec574f79c643cd65bba7e0b10f2eee9762400cd31ccd1457c515c9741fec04fa8a61c049fc05339a5bd7653d91fe0f04972e07d3d00c45e2e6ec1f646ded465b7f92bb0dc4758def8ff0eb860a8293f3f5303f904ca2726cc83ffb98ccf13ce67b9042b2d8bf6e846dde6494f685e19301ad3219b238cdf82f4e56d06ba01315b6d48b044622850f6bde08c99534cdef548c161d2b65e6d791d499b9f", 0xa1}, {&(0x7f0000000780)="94d865242916433752ac0725b6d999d0db42d96aa2216412cfa6761d8ea3621fc7b498144513a913461c4bbac6ac99a2747c2b5b5d846637340f31ebbffeb5155b317a0e694bf3bde70c8dfe402019a9309a6a9e818a6f72", 0x58}, {0x0}, {&(0x7f0000000800)="0b2f375dc611", 0x6}, {&(0x7f0000000840)="216dc9fc604f339978b1d4de3877d5213ef7e2facd4ce9b84e5d2550210e2a2fd9715e1a383238db02092d2a4438db1fde1189bf95d3237777bd5201f3cd3cb4eec64deb4e86cf5d3fb347e3807b1f75ea114af393ecd934b6b6bc7be4336e0478b1f8841a6b24dba94619", 0x6b}, {&(0x7f0000001cc0)="b7948240759d79fa534a482cfbfd60fa03666f31c95c446bb2d7bb9a90f61a4bcc5912442af13817030f07ba73e942b0e5e496a01a2a84b21f327caf2c1c5e0ffd88e8a37c84cd84ae51195b125db0ebc161267dc9a83ae9644d03af5638a833d6fe6fc08938b7200f4a0f3d7a3f7c167da53b988bb308c8e62edb98f8b0db7cb30c42aee9e16b30f01f584ae504e492fd155adc327dbcd95922c45abf27d4ae11405185fc020e72ceff19f796373541ee6767b8ef2d291db9c30d18929c80292e3e4a353081ae135f43899f9b41da", 0xcf}, {&(0x7f0000000940)="99fe3f3f21bf5e7b9305eb544a3e8e1d0455cc20c9b6561704785317463e3d2d601f1c167bc133897b5cb6e240a04b259fa5cf2e7bf416753e90a4b9f0d9ed4638e4603d51110e995df1404119acb5ca1308d33ed970c610", 0x58}], 0xa, &(0x7f00000032c0)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, r7}}}, @rights={{0x14, 0x1, 0x1, [r6]}}, @rights={{0x10}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r13, r14}}}], 0x88, 0x8080}, 0x800) r15 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r15, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0xffffffffffffffff, r16) getgroups(0x5, &(0x7f0000000180)=[r0, r1, r2, r14, r16]) r17 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0), 0x200000, 0x0) ioctl$RTC_RD_TIME(r17, 0x80247009, &(0x7f0000000380)) ioperm(0x3, 0xa, 0x3) 260.396777ms ago: executing program 1 (id=3129): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r4}, 0x10) getresuid(&(0x7f0000000e00), &(0x7f0000001140), &(0x7f0000001180)) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8}}]}, 0x40}}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000009900000001"], 0x48) r6 = socket$key(0xf, 0x3, 0x2) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) lsm_list_modules(0x0, &(0x7f0000000000), 0x0) sendmsg$key(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)={0x2, 0x10, 0x8, 0x9, 0xa, 0x0, 0x70bd2a, 0x25dfdbfc, [@sadb_x_policy={0x8, 0x12, 0x3, 0x0, 0x0, 0x6e6bbd, 0x0, {0x6, 0x5f, 0x4, 0x6, 0x0, 0x9, 0x0, @in6=@empty, @in=@broadcast}}]}, 0x50}}, 0x4040004) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r7, 0x0, 0x7}, 0x18) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x0, 0x11, 0x148, 0x0, 0x0, 0x440, 0x2a8, 0x2a8, 0x440, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x81}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x538) 161.106238ms ago: executing program 1 (id=3130): perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x8020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, @void, @value}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001900)=ANY=[@ANYBLOB="0500000004000000ff0f00000700000000000000db4dbabe3cd8d14ab34afaf13ac59f9b4cb45c6e76a86e00a017dba8b2f6372894a5747c88dd05b003366f51d27f40cde074278ed4e571bf779bf27caa81d71973a5964e29b5af15f3c3b52739ad22241569e4acb332aee441f3fe9a", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000021b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000001b40)='sched_switch\x00', r1}, 0x10) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0xc0ed0040, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {@norecovery}, {@mblk_io_submit}, {@noload}, {@resgid}, {@nodiscard}]}, 0xfe, 0x472, &(0x7f0000000940)="$eJzs3MtvG8UfAPDvOk6a9PFLf6U8WloIFETFI2nSBz1wAYHEAQQSHIo4BSetSt0GNUGiVQSBQxDigCpxRxyR+As4wQUBJySucEeVEMqlhZPRenfTxLVDHk6c4s9H2nZmd92Z786OPTtjN4CuNZT+kUTsjohfI2Iwyy4/YSj76+bCbOWvhdlKErXaa38m9fNuLMxW8n9i8XW7sh21Wp7f0aTc+TcjxqvVyct5fmTm4jsj01euPnX+4vi5yXOTl8ZOnz5x/HDfqbGTbYkzjevGwfenDh148Y1rL1fOXHvrx6/T+u7OjxdxtNNQdnWberTdhXXYniXppNzBirAmabulzdVb7/+D0RMDi8cG44WPOlo5YFPVarVas8/n3FwN+A9LotM1ADqj+KBPn3+LbYuGHtvCH89mD0Bp3DfzLTtSjlJ+Tm/D82079UfEmbm/v0i32KR5CACApb5Nxz9PNhv/leKeJef9L19D2RsR/4+IfRFxV0Tsj4i7I+rn3hsR962x/MYVktvHP6Xr6wpsldLx3zP52tby8V8x+ou9PXluTz3+3uTs+erksfyaHI3eHWl+dNlLlvvu+V8+a9z3aT7NPrRk/JduafnFWDCvx/VywwTdxPjMeFuCT+P/MOJguVn8SRTLOElEHIiIg+ss4/zjXx1qdezf419BG9aZal9GPJa1/1w0xF9IWq5Pjj59auzkSH9UJ4+NFHfF7X76ef7VVuVvKP42SNt/Z9P7P4s/fUZM+iOmr1y9UF+vnV57GfO/fVxJWhzbv877vy95vZ7uy/e9Nz4zc3k0oi95Kc0OLNs/duu1Rb44P43/6JHm/X9f9nhWvxL3R0R6Ex+OiAci4sG87R6KiIcj4sgK8f/w3CNvtzrWuv1XmJVvozT+iRXaP33LS1O32n/tiZ4L33/Tqvzaqtr/RD11NN+zmve/1VZwI9cOAAAA7hSl+nfgk9LwYrpUGh7OvsO/P3aWqlPTM0+cnXr30kT2Xfm90VsqZroGl8yHjuZzw0V+rCF/PJ83/rxnoJ4frkxVJzodPHS5XS36f+r3nk7XDth0fq8F3Uv/h+6l/0P30v+he+n/0KX6mu/+YKvrAXTE2j//+zelHsDWM/6H7qX/Q/fS/6ErtfxtfGlDP/m/UxPl7VGNpomB7VGNIhGlbVGN9iVe+STrEtulPkWivOr/zGKdiR1ND3X6nQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKA9/gkAAP//Uo/mdg==") r2 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) write$binfmt_elf64(r2, &(0x7f0000000e00)=ANY=[@ANYBLOB="7f454c46080505fe080000000000000002000600080000008f0000000000000040000000000000002b0300000000000004000000ff0f3800020007007f00fcff00000000000000000300000000000000ffffffffffffff7f0400000000000000ff010000000000000000000000000000ee0f00000000000051e57464060000001910000000000000000000007000000007000000000000000700000000000000b90600000000000002000000000000000e61000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400"/1670], 0x8b2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x18, 0xb, &(0x7f0000000180)=ANY=[@ANYRESDEC], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff7, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001800)={&(0x7f00000017c0)='kfree\x00', r3}, 0x18) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1800403, &(0x7f0000000940), 0x2, 0x5ad, &(0x7f0000000180)="$eJzs3c1vVFUbAPDnzkwLpe9rKzEqLkyjIZAoLS1g8GMBe0LwY+fGSgtBho/QGi2aWBLcmBg3LkhcuRD/CyW6dWXiwoUbV4akGsNGY3TMnbkzDO1MOy0dbu39/ZLbOeeeOz3nQp85Z+49ZyaAwhpLf5Qi9kTE5SRipK2sElnhWOO4O7+/fzrdkqjVXv0tiSTb1zw+yR6Hsyf/PRLx/TdJ7C6vrHdu4er56Wp19kqWn5i/cHlibuHqgXMXps/Onp29OPXc1NEjh48cnTx4X+dXakufuP7WOyMfnXz9i8/+Sia//OlkEsfi1zONsvbz2CxjMRZ/1GofLN+f/rse3ezKclJu/Z3clSzfwZZVyWJkMCIei5Eot/1vjsSHL+faOKCvaklEDSioRPxDQTXHAc339r29Dy71eVQCPAhLx9OfAx3iv9K4NhijMRARe5c9r8MlvQ1J6/ju25PX0y36dB0O6Gzx2o4stTz+k3psjsbOem7XndI913nTEcCp7DHd/8oG6x9blhf/8OAsXouIxzuN/9eO/zfa4v/NDdYv/gEAAAAAAGDz3DoeEc92uv9Xyu7N7Yyn6vf/ksb9vx/urhA8tgn1r33/r3R7E6oBOlg6HvFSx/m/rTm+o+Us9//GbMDkzLnq7MGIeCgi9sfAjjQ/uUodBz7efaNbWfv8v3RL62/OBczacbuy497nzEzPT9/POQMNS9cinqh0n/+T9v9Je/+fSV8PLvdYx+69N091K1s7/oF+qX0esa9j/5+0jklW/3yOifp4YKI5Kljpyfc++apb/eIf8pP2/7tWj//RpP3zeubW9/sHI+LQQqXWrXyj4//B5LVy8/en3p2en78yGTGYnFi5f2p9bYbtqhkPzXhJ43//06tf/2uN/9vicCgiFnus89F/hn/uVqb/h/yk8T+zrv5//Ympm6Nfd6u/t/7/cL1P35/tcf0PVtdrgObdTgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4LypFxP8iKY230qXS+HjEcEQ8ErtK1Utz88+cufT2xZm0rP79/6XmN/2ONPJJ8/v/R9vyU8vyhyLi4Yj4tDxUz4+fvlSdyfvkAQAAAAAAAAAAAAAAAAAAYIsY7rL+P/VLOe/WAX1XyR7FOxRPJe8GALkR/1Bc4h+KS/xDcYl/KK4Nxr/bBbAN6P+hqAZ6O2xnv9sB5EH/DwAAAAAA28qtF5+/kUTE4gtD9S01mJW1bgwO5dU6oJ9KeTcAyI05vFBcpv5AcfU4+RfYxpJW6s9ap/Lus/+T/jQIAAAAAAAAAAAAAFhh355bP665/h/Ylqz/h+Ky/h+Ky/p/KC7v8YG1VvFb/w8AAAAAAAAAAAAA+ZtbuHp+ulqdvSIhsdUSAxGxBZqRQ2Iw//DM+YUJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABo+TcAAP//Swsk/Q==") sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000100001000000f5ffffffffffffff000a14000000060a0000000000000000000002"], 0x3c}}, 0x0) socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2688634c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000016c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002000000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000de"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000000)='kfree\x00', r3}, 0x18) syz_clone(0x2c9a4080, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x1) r4 = memfd_create(&(0x7f00000001c0)='\x00\xc76\xbe\x91\x8d\x182)!\x9a%\xd9\x19\x17\xb0\xed|\xb3\xc2\x017h\xe9kL\xa2\xd28\xd6\x06\a\x0e\xfc\xfe\x12\x8f&\x13\xae%@T\xa3\xb0>\\\xec\xa9\xf9Q@6A\x10\x8cn|\x00\x00\x00\x00\x00\x00\x00\x00\xeb0\xdd\xe8\x87\x05=\xfb\x8b$\xdcQ\xee\xc5\x1f\x8bQ\xf7fo\"i\xa1hk\x1d\xf5z\xc1\x7f\xa4\\]\xc4\xbe3\xf9\xa8\t?:\xd8\xda\x84\xeepI[\x1c\x00\x00\x00\x00\xf9v\x00\x00\x00\x00\x00T\xb6\xbe\x0f~\xc0\x92\xe9O{\xa8\x81(\x01\x14\xfc\x83\xf9\xfb\x05\x94Tr@Lq]\xf9\x15zj\x87\xc4\x8e\xe8/\xb9-&R\x8e\xb2\xb3bBx\x1e1\x18\x8f2\xf7]#\xed,\xc7\x03\x00\x00\x00\xa3\xee\xcb\xaf\xb3\xe3\'}\x18\xe8O\xa8#K\xb6\xe4R$\xaa\x00U\x92\xd2\x99\xb80x0) timer_settime(r4, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) recvmmsg(r2, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$key(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x38}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_emit_ethernet(0x4e, &(0x7f0000000380)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0xb, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x3, 0xa}, @timestamp={0x44, 0xc, 0x5, 0x0, 0x0, [0x0, 0x0]}, @cipso={0x86, 0x6}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r5}, &(0x7f0000000000), &(0x7f0000000180)=r6}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 155.541769ms ago: executing program 6 (id=3132): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x18, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a30000000002c000000030a01010000000000000000020000000900010073797a30000000000900030073797a32000000003a000000030a03000000000000000000020000000900010073797a30000000000900030073797a32"], 0xa0}}, 0x8040) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0xa, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="89a000fe0000000069100c000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80, @void, @value}, 0x94) 130.148559ms ago: executing program 9 (id=3133): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, 0x0, 0x42) 60.62852ms ago: executing program 9 (id=3134): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r0, &(0x7f000000a7c0)=[{{&(0x7f0000002180)={0xa, 0x4e24, 0x7e5b, @private2, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="680000000000000029000000390000007a0a020200000000ff020000000000000010000000000001fc010000000000000000000000000001ff020000000000000000000000000001fc010000000000000000000000000000000000000000000000000a1ef09b141e180000000000000029000000360000003300000000000000"], 0x80}}], 0x1, 0x40) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000900)="5490", 0x2}], 0x1}, 0x4048841) recvmsg(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x10001) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000001380)={0x11, 0xb, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000080850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0xf2cccc7fae7881b8, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sys_enter\x00', r3}, 0x10) brk(0x9) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000002c0), 0x80042, 0x0) ioctl$PTP_EXTTS_REQUEST2(r5, 0x40043d14, &(0x7f0000000040)={0x43, 0x359f35d7abcd234}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r7}, 0x10) r8 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$selinux_access(r8, &(0x7f0000000240)={'system_u:object_r:nvram_device_t:s0', 0x20, '/usr/sbin/ntpd', 0x20, 0x38bb}, 0x48) 40.1686ms ago: executing program 9 (id=3135): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 0s ago: executing program 6 (id=3136): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) open_tree(0xffffffffffffff9c, 0x0, 0x0) kernel console output (not intermixed with test programs): t option [ 203.676174][T11082] EXT4-fs error (device loop8): ext4_orphan_get:1391: inode #15: comm syz.8.2535: iget: bad extended attribute block 1 [ 203.715254][T11099] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2542'. [ 203.726940][T11082] EXT4-fs error (device loop8): ext4_orphan_get:1396: comm syz.8.2535: couldn't read orphan inode 15 (err -117) [ 203.758336][T11082] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 203.812842][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 203.904772][T11123] FAULT_INJECTION: forcing a failure. [ 203.904772][T11123] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 203.920132][T11123] CPU: 1 UID: 0 PID: 11123 Comm: syz.1.2554 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 203.920158][T11123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 203.920170][T11123] Call Trace: [ 203.920176][T11123] [ 203.920185][T11123] __dump_stack+0x1d/0x30 [ 203.920208][T11123] dump_stack_lvl+0xe8/0x140 [ 203.920229][T11123] dump_stack+0x15/0x1b [ 203.920322][T11123] should_fail_ex+0x265/0x280 [ 203.920403][T11123] should_fail+0xb/0x20 [ 203.920428][T11123] should_fail_usercopy+0x1a/0x20 [ 203.920452][T11123] _copy_from_user+0x1c/0xb0 [ 203.920477][T11123] ___sys_sendmsg+0xc1/0x1d0 [ 203.920537][T11123] __x64_sys_sendmsg+0xd4/0x160 [ 203.920562][T11123] x64_sys_call+0x2999/0x2fb0 [ 203.920662][T11123] do_syscall_64+0xd0/0x1b0 [ 203.920811][T11123] ? clear_bhb_loop+0x40/0x90 [ 203.920836][T11123] ? clear_bhb_loop+0x40/0x90 [ 203.920900][T11123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 203.920922][T11123] RIP: 0033:0x7febd4c7e969 [ 203.920945][T11123] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 203.920963][T11123] RSP: 002b:00007febd32e7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 203.920981][T11123] RAX: ffffffffffffffda RBX: 00007febd4ea5fa0 RCX: 00007febd4c7e969 [ 203.921015][T11123] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 203.921027][T11123] RBP: 00007febd32e7090 R08: 0000000000000000 R09: 0000000000000000 [ 203.921038][T11123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 203.921051][T11123] R13: 0000000000000000 R14: 00007febd4ea5fa0 R15: 00007fff6b8c2be8 [ 203.921106][T11123] [ 204.200495][T11133] loop1: detected capacity change from 0 to 512 [ 204.212956][T11133] EXT4-fs (loop1): external journal device major/minor numbers have changed [ 204.237141][T11133] block device autoloading is deprecated and will be removed. [ 204.252370][T11133] syz.1.2556: attempt to access beyond end of device [ 204.252370][T11133] md185: rw=0, sector=2, nr_sectors = 2 limit=0 [ 204.274238][T11133] EXT4-fs (loop1): couldn't read superblock of external journal [ 204.326980][T11140] loop5: detected capacity change from 0 to 512 [ 204.351871][T11140] EXT4-fs: Ignoring removed mblk_io_submit option [ 204.383656][T11140] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2560: iget: bad extended attribute block 1 [ 204.402447][T11140] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2560: couldn't read orphan inode 15 (err -117) [ 204.420778][T11155] FAULT_INJECTION: forcing a failure. [ 204.420778][T11155] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 204.435671][T11155] CPU: 0 UID: 0 PID: 11155 Comm: syz.8.2563 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 204.435779][T11155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 204.435789][T11155] Call Trace: [ 204.435795][T11155] [ 204.435801][T11155] __dump_stack+0x1d/0x30 [ 204.435890][T11155] dump_stack_lvl+0xe8/0x140 [ 204.435943][T11155] dump_stack+0x15/0x1b [ 204.435961][T11155] should_fail_ex+0x265/0x280 [ 204.435991][T11155] should_fail+0xb/0x20 [ 204.436022][T11155] should_fail_usercopy+0x1a/0x20 [ 204.436046][T11155] strncpy_from_user+0x25/0x230 [ 204.436066][T11155] ? __fget_files+0x184/0x1c0 [ 204.436192][T11155] __se_sys_add_key+0x86/0x350 [ 204.436218][T11155] __x64_sys_add_key+0x67/0x80 [ 204.436239][T11155] x64_sys_call+0x1d0d/0x2fb0 [ 204.436304][T11155] do_syscall_64+0xd0/0x1b0 [ 204.436411][T11155] ? clear_bhb_loop+0x40/0x90 [ 204.436432][T11155] ? clear_bhb_loop+0x40/0x90 [ 204.436451][T11155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.436546][T11155] RIP: 0033:0x7fe3d767e969 [ 204.436560][T11155] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 204.436575][T11155] RSP: 002b:00007fe3d5ce7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 204.436592][T11155] RAX: ffffffffffffffda RBX: 00007fe3d78a5fa0 RCX: 00007fe3d767e969 [ 204.436607][T11155] RDX: 0000200000000280 RSI: 0000000000000000 RDI: 0000200000000440 [ 204.436675][T11155] RBP: 00007fe3d5ce7090 R08: 000000002fc6fd3d R09: 0000000000000000 [ 204.436686][T11155] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 204.436697][T11155] R13: 0000000000000000 R14: 00007fe3d78a5fa0 R15: 00007fff1e1b1a98 [ 204.436718][T11155] [ 204.454311][T11140] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 204.496745][T11156] tipc: Enabling of bearer rejected, failed to enable media [ 204.695305][T11163] netlink: 'syz.5.2560': attribute type 1 has an invalid length. [ 204.704605][T11163] netlink: 224 bytes leftover after parsing attributes in process `syz.5.2560'. [ 204.776322][T11171] loop8: detected capacity change from 0 to 1024 [ 204.791274][T11171] EXT4-fs: Ignoring removed bh option [ 204.797855][T11171] EXT4-fs: inline encryption not supported [ 204.801971][T11174] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2566'. [ 204.810495][T11171] EXT4-fs (loop8): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 204.825773][T11177] FAULT_INJECTION: forcing a failure. [ 204.825773][T11177] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 204.828749][T11171] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 204.841776][T11177] CPU: 0 UID: 0 PID: 11177 Comm: syz.6.2572 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 204.841818][T11177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 204.841831][T11177] Call Trace: [ 204.841838][T11177] [ 204.841847][T11177] __dump_stack+0x1d/0x30 [ 204.841872][T11177] dump_stack_lvl+0xe8/0x140 [ 204.841893][T11177] dump_stack+0x15/0x1b [ 204.841974][T11177] should_fail_ex+0x265/0x280 [ 204.842001][T11177] should_fail+0xb/0x20 [ 204.842025][T11177] should_fail_usercopy+0x1a/0x20 [ 204.842073][T11177] _copy_from_user+0x1c/0xb0 [ 204.842104][T11177] ___sys_sendmsg+0xc1/0x1d0 [ 204.842138][T11177] __x64_sys_sendmsg+0xd4/0x160 [ 204.842163][T11177] x64_sys_call+0x2999/0x2fb0 [ 204.842229][T11177] do_syscall_64+0xd0/0x1b0 [ 204.842251][T11177] ? clear_bhb_loop+0x40/0x90 [ 204.842274][T11177] ? clear_bhb_loop+0x40/0x90 [ 204.842296][T11177] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.842335][T11177] RIP: 0033:0x7fae3e6ce969 [ 204.842390][T11177] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 204.842408][T11177] RSP: 002b:00007fae3cd37038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 204.842490][T11177] RAX: ffffffffffffffda RBX: 00007fae3e8f5fa0 RCX: 00007fae3e6ce969 [ 204.842503][T11177] RDX: 0000000000004000 RSI: 0000200000001c80 RDI: 0000000000000004 [ 204.842517][T11177] RBP: 00007fae3cd37090 R08: 0000000000000000 R09: 0000000000000000 [ 204.842597][T11177] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 204.842668][T11177] R13: 0000000000000000 R14: 00007fae3e8f5fa0 R15: 00007ffe1fdae7d8 [ 204.842688][T11177] [ 204.879307][T11165] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2566'. [ 205.003726][T11171] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 2: comm syz.8.2569: lblock 2 mapped to illegal pblock 2 (length 1) [ 205.078809][T11096] EXT4-fs error (device loop5): ext4_validate_block_bitmap:432: comm ext4lazyinit: bg 0: block 13: invalid block bitmap [ 205.098363][T11171] __quota_error: 7 callbacks suppressed [ 205.098380][T11171] Quota error (device loop8): qtree_write_dquot: dquota write failed [ 205.118553][T11171] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 48: comm syz.8.2569: lblock 0 mapped to illegal pblock 48 (length 1) [ 205.137215][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 205.151979][T11171] Quota error (device loop8): v2_write_file_info: Can't write info structure [ 205.163282][T11171] EXT4-fs error (device loop8): ext4_acquire_dquot:6935: comm syz.8.2569: Failed to acquire dquot type 0 [ 205.183052][T11171] EXT4-fs error (device loop8) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 205.196764][T11171] EXT4-fs error (device loop8): ext4_evict_inode:259: inode #11: comm syz.8.2569: mark_inode_dirty error [ 205.214735][T11171] EXT4-fs warning (device loop8): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 205.229065][ T29] audit: type=1400 audit(2000000058.785:5640): avc: denied { read } for pid=11162 comm="syz.0.2566" name="nvram" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 205.245665][T11194] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2575'. [ 205.254989][ T29] audit: type=1400 audit(2000000058.785:5641): avc: denied { open } for pid=11162 comm="syz.0.2566" path="/dev/nvram" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 205.265498][T11194] netlink: 'syz.5.2575': attribute type 5 has an invalid length. [ 205.268322][T11194] netdevsim netdevsim5 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.294610][T11171] EXT4-fs (loop8): 1 orphan inode deleted [ 205.301319][T11194] netdevsim netdevsim5 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.323586][T11171] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 205.329786][T11194] netdevsim netdevsim5 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.357446][T11194] netdevsim netdevsim5 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.369979][ T3679] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:8: lblock 1 mapped to illegal pblock 1 (length 1) [ 205.379159][T11194] vxlan0: entered promiscuous mode [ 205.417435][ T3679] Quota error (device loop8): remove_tree: Can't read quota data block 1 [ 205.427708][ T3679] EXT4-fs error (device loop8): ext4_release_dquot:6971: comm kworker/u8:8: Failed to release dquot type 0 [ 205.486962][T11171] EXT4-fs: Cannot change journaled quota options when quota turned on [ 205.499063][ T29] audit: type=1326 audit(2000000059.079:5642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11170 comm="syz.8.2569" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 205.501909][T11210] tipc: Enabling of bearer rejected, failed to enable media [ 205.538626][ T29] audit: type=1326 audit(2000000059.131:5643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11170 comm="syz.8.2569" exe="/root/syz-executor" sig=0 arch=c000003e syscall=289 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 205.566340][ T29] audit: type=1326 audit(2000000059.131:5644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11170 comm="syz.8.2569" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 205.595572][ T29] audit: type=1326 audit(2000000059.131:5645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11170 comm="syz.8.2569" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 205.659463][ T29] audit: type=1326 audit(2000000059.247:5646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11170 comm="syz.8.2569" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 205.691673][T11171] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2569: lblock 0 mapped to illegal pblock 16 (length 1) [ 205.830223][T11221] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2569: lblock 0 mapped to illegal pblock 16 (length 1) [ 205.847318][T11221] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2569: lblock 0 mapped to illegal pblock 16 (length 1) [ 205.866542][T11221] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2569: lblock 0 mapped to illegal pblock 16 (length 1) [ 205.934112][T11223] loop6: detected capacity change from 0 to 512 [ 205.945033][T11223] EXT4-fs: Ignoring removed mblk_io_submit option [ 205.960016][T11223] EXT4-fs error (device loop6): ext4_orphan_get:1391: inode #15: comm syz.6.2585: iget: bad extended attribute block 1 [ 205.975656][T11223] EXT4-fs error (device loop6): ext4_orphan_get:1396: comm syz.6.2585: couldn't read orphan inode 15 (err -117) [ 205.995987][T11223] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 206.014331][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 206.030260][T10253] EXT4-fs error (device loop8): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 206.072383][T10253] EXT4-fs error (device loop8) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 206.086251][T11229] FAULT_INJECTION: forcing a failure. [ 206.086251][T11229] name failslab, interval 1, probability 0, space 0, times 0 [ 206.100501][T11229] CPU: 1 UID: 0 PID: 11229 Comm: syz.5.2588 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 206.100602][T11229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 206.100611][T11229] Call Trace: [ 206.100615][T11229] [ 206.100620][T11229] __dump_stack+0x1d/0x30 [ 206.100636][T11229] dump_stack_lvl+0xe8/0x140 [ 206.100647][T11229] dump_stack+0x15/0x1b [ 206.100670][T11229] should_fail_ex+0x265/0x280 [ 206.100728][T11229] ? __se_sys_mount+0xef/0x2e0 [ 206.100753][T11229] should_failslab+0x8c/0xb0 [ 206.100778][T11229] __kmalloc_cache_noprof+0x4c/0x320 [ 206.100792][T11229] ? memdup_user+0x99/0xd0 [ 206.100804][T11229] __se_sys_mount+0xef/0x2e0 [ 206.100820][T11229] ? fput+0x8f/0xc0 [ 206.100831][T11229] ? ksys_write+0x192/0x1a0 [ 206.100916][T11229] __x64_sys_mount+0x67/0x80 [ 206.100935][T11229] x64_sys_call+0xd36/0x2fb0 [ 206.100948][T11229] do_syscall_64+0xd0/0x1b0 [ 206.101060][T11229] ? clear_bhb_loop+0x40/0x90 [ 206.101081][T11229] ? clear_bhb_loop+0x40/0x90 [ 206.101094][T11229] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.101109][T11229] RIP: 0033:0x7f1e12b9e969 [ 206.101242][T11229] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 206.101253][T11229] RSP: 002b:00007f1e11207038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 206.101265][T11229] RAX: ffffffffffffffda RBX: 00007f1e12dc5fa0 RCX: 00007f1e12b9e969 [ 206.101273][T11229] RDX: 0000200000000040 RSI: 0000200000000080 RDI: 0000000000000000 [ 206.101280][T11229] RBP: 00007f1e11207090 R08: 0000200000000400 R09: 0000000000000000 [ 206.101287][T11229] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 206.101351][T11229] R13: 0000000000000000 R14: 00007f1e12dc5fa0 R15: 00007ffcc9fe4d48 [ 206.101432][T11229] [ 206.101701][T10253] EXT4-fs error (device loop8): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 206.175112][T11223] netlink: 'syz.6.2585': attribute type 1 has an invalid length. [ 206.359679][T11223] netlink: 224 bytes leftover after parsing attributes in process `syz.6.2585'. [ 206.391374][T11236] FAULT_INJECTION: forcing a failure. [ 206.391374][T11236] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 206.397716][ T4905] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 206.407304][T11236] CPU: 1 UID: 0 PID: 11236 Comm: syz.8.2586 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 206.407336][T11236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 206.407349][T11236] Call Trace: [ 206.407357][T11236] [ 206.407366][T11236] __dump_stack+0x1d/0x30 [ 206.407461][T11236] dump_stack_lvl+0xe8/0x140 [ 206.407492][T11236] dump_stack+0x15/0x1b [ 206.407511][T11236] should_fail_ex+0x265/0x280 [ 206.407539][T11236] should_fail+0xb/0x20 [ 206.407634][T11236] should_fail_usercopy+0x1a/0x20 [ 206.407662][T11236] _copy_from_user+0x1c/0xb0 [ 206.407758][T11236] ___sys_sendmsg+0xc1/0x1d0 [ 206.407823][T11236] __x64_sys_sendmsg+0xd4/0x160 [ 206.407852][T11236] x64_sys_call+0x2999/0x2fb0 [ 206.407875][T11236] do_syscall_64+0xd0/0x1b0 [ 206.407959][T11236] ? clear_bhb_loop+0x40/0x90 [ 206.407981][T11236] ? clear_bhb_loop+0x40/0x90 [ 206.408061][T11236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.408083][T11236] RIP: 0033:0x7fe3d767e969 [ 206.408100][T11236] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 206.408118][T11236] RSP: 002b:00007fe3d5ce7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 206.408138][T11236] RAX: ffffffffffffffda RBX: 00007fe3d78a5fa0 RCX: 00007fe3d767e969 [ 206.408151][T11236] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000006 [ 206.408164][T11236] RBP: 00007fe3d5ce7090 R08: 0000000000000000 R09: 0000000000000000 [ 206.408177][T11236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 206.408214][T11236] R13: 0000000000000000 R14: 00007fe3d78a5fa0 R15: 00007fff1e1b1a98 [ 206.408230][T11236] [ 206.555485][T11242] loop5: detected capacity change from 0 to 512 [ 206.650002][T11242] EXT4-fs: Ignoring removed mblk_io_submit option [ 206.670399][T11250] macvlan2: entered promiscuous mode [ 206.676279][T11250] bridge0: entered promiscuous mode [ 206.683038][T11250] bridge0: port 3(macvlan2) entered blocking state [ 206.691456][T11250] bridge0: port 3(macvlan2) entered disabled state [ 206.699427][T11250] macvlan2: entered allmulticast mode [ 206.705451][T11250] bridge0: entered allmulticast mode [ 206.712047][T11250] macvlan2: left allmulticast mode [ 206.717826][T11250] bridge0: left allmulticast mode [ 206.760456][T11252] loop6: detected capacity change from 0 to 128 [ 206.775807][T11250] bridge0: left promiscuous mode [ 206.795023][T11252] EXT4-fs: quotafile must be on filesystem root [ 206.813988][T11253] tipc: Enabling of bearer rejected, failed to enable media [ 206.879222][T11258] FAULT_INJECTION: forcing a failure. [ 206.879222][T11258] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 206.895486][T11258] CPU: 1 UID: 0 PID: 11258 Comm: syz.0.2598 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 206.895514][T11258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 206.895528][T11258] Call Trace: [ 206.895569][T11258] [ 206.895582][T11258] __dump_stack+0x1d/0x30 [ 206.895603][T11258] dump_stack_lvl+0xe8/0x140 [ 206.895621][T11258] dump_stack+0x15/0x1b [ 206.895636][T11258] should_fail_ex+0x265/0x280 [ 206.895716][T11258] should_fail+0xb/0x20 [ 206.895738][T11258] should_fail_usercopy+0x1a/0x20 [ 206.895761][T11258] _copy_from_user+0x1c/0xb0 [ 206.895790][T11258] ___sys_sendmsg+0xc1/0x1d0 [ 206.895853][T11258] __x64_sys_sendmsg+0xd4/0x160 [ 206.895878][T11258] x64_sys_call+0x2999/0x2fb0 [ 206.895979][T11258] do_syscall_64+0xd0/0x1b0 [ 206.896000][T11258] ? clear_bhb_loop+0x40/0x90 [ 206.896024][T11258] ? clear_bhb_loop+0x40/0x90 [ 206.896123][T11258] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.896221][T11258] RIP: 0033:0x7f2bedfce969 [ 206.896239][T11258] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 206.896250][T11258] RSP: 002b:00007f2bec637038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 206.896268][T11258] RAX: ffffffffffffffda RBX: 00007f2bee1f5fa0 RCX: 00007f2bedfce969 [ 206.896319][T11258] RDX: 0000000000000000 RSI: 00002000000004c0 RDI: 0000000000000005 [ 206.896329][T11258] RBP: 00007f2bec637090 R08: 0000000000000000 R09: 0000000000000000 [ 206.896340][T11258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 206.896349][T11258] R13: 0000000000000000 R14: 00007f2bee1f5fa0 R15: 00007fffc4bc72c8 [ 206.896366][T11258] [ 206.984032][T11242] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2593: iget: bad extended attribute block 1 [ 207.033595][T11264] loop0: detected capacity change from 0 to 128 [ 207.048205][T11242] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2593: couldn't read orphan inode 15 (err -117) [ 207.180508][T11275] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2602'. [ 207.193859][T11275] netlink: 48 bytes leftover after parsing attributes in process `syz.6.2602'. [ 207.207584][T11242] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 207.227577][T11275] FAULT_INJECTION: forcing a failure. [ 207.227577][T11275] name failslab, interval 1, probability 0, space 0, times 0 [ 207.227610][T11275] CPU: 0 UID: 0 PID: 11275 Comm: syz.6.2602 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 207.227640][T11275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 207.227654][T11275] Call Trace: [ 207.227660][T11275] [ 207.227668][T11275] __dump_stack+0x1d/0x30 [ 207.227692][T11275] dump_stack_lvl+0xe8/0x140 [ 207.227714][T11275] dump_stack+0x15/0x1b [ 207.227808][T11275] should_fail_ex+0x265/0x280 [ 207.227854][T11275] should_failslab+0x8c/0xb0 [ 207.227895][T11275] kmem_cache_alloc_noprof+0x50/0x310 [ 207.227919][T11275] ? getname_flags+0x80/0x3b0 [ 207.227964][T11275] getname_flags+0x80/0x3b0 [ 207.227984][T11275] user_path_at+0x28/0x130 [ 207.228086][T11275] __se_sys_mount+0x25b/0x2e0 [ 207.228121][T11275] ? fput+0x8f/0xc0 [ 207.228145][T11275] __x64_sys_mount+0x67/0x80 [ 207.228193][T11275] x64_sys_call+0xd36/0x2fb0 [ 207.228217][T11275] do_syscall_64+0xd0/0x1b0 [ 207.228282][T11275] ? clear_bhb_loop+0x40/0x90 [ 207.228306][T11275] ? clear_bhb_loop+0x40/0x90 [ 207.228327][T11275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.228427][T11275] RIP: 0033:0x7fae3e6ce969 [ 207.228494][T11275] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 207.228517][T11275] RSP: 002b:00007fae3cd37038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 207.228543][T11275] RAX: ffffffffffffffda RBX: 00007fae3e8f5fa0 RCX: 00007fae3e6ce969 [ 207.228557][T11275] RDX: 00002000000003c0 RSI: 0000200000000380 RDI: 0000000000000000 [ 207.228615][T11275] RBP: 00007fae3cd37090 R08: 0000200000001980 R09: 0000000000000000 [ 207.228629][T11275] R10: 0000000001000000 R11: 0000000000000246 R12: 0000000000000001 [ 207.228702][T11275] R13: 0000000000000000 R14: 00007fae3e8f5fa0 R15: 00007ffe1fdae7d8 [ 207.228722][T11275] [ 207.446407][T11290] tipc: Enabling of bearer rejected, failed to enable media [ 207.533152][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.744776][T11314] loop1: detected capacity change from 0 to 512 [ 207.763817][T11314] EXT4-fs: Ignoring removed bh option [ 207.770871][T11314] EXT4-fs: Ignoring removed mblk_io_submit option [ 207.812777][T11314] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 207.868434][T11314] ext4 filesystem being mounted at /58/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 207.886722][T11325] loop8: detected capacity change from 0 to 512 [ 207.911561][T11325] EXT4-fs: Ignoring removed mblk_io_submit option [ 207.930569][T11325] EXT4-fs error (device loop8): ext4_orphan_get:1391: inode #15: comm syz.8.2620: iget: bad extended attribute block 1 [ 207.961734][T11325] EXT4-fs error (device loop8): ext4_orphan_get:1396: comm syz.8.2620: couldn't read orphan inode 15 (err -117) [ 207.982200][T11325] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 208.019689][T11314] xt_hashlimit: max too large, truncated to 1048576 [ 208.096777][T11338] loop5: detected capacity change from 0 to 2048 [ 208.145854][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 208.157698][T11338] loop5: p1 < > p4 < > [ 208.359703][ T3396] hid-generic 0000:FFFFFFFF:0000.000F: unknown main item tag 0x0 [ 208.378321][ T3396] hid-generic 0000:FFFFFFFF:0000.000F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 208.633533][T11371] FAULT_INJECTION: forcing a failure. [ 208.633533][T11371] name failslab, interval 1, probability 0, space 0, times 0 [ 208.648326][T11371] CPU: 1 UID: 0 PID: 11371 Comm: syz.6.2637 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 208.648355][T11371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 208.648366][T11371] Call Trace: [ 208.648372][T11371] [ 208.648380][T11371] __dump_stack+0x1d/0x30 [ 208.648403][T11371] dump_stack_lvl+0xe8/0x140 [ 208.648423][T11371] dump_stack+0x15/0x1b [ 208.648502][T11371] should_fail_ex+0x265/0x280 [ 208.648525][T11371] should_failslab+0x8c/0xb0 [ 208.648559][T11371] kmem_cache_alloc_node_noprof+0x57/0x320 [ 208.648586][T11371] ? __alloc_skb+0x101/0x320 [ 208.648668][T11371] __alloc_skb+0x101/0x320 [ 208.648725][T11371] netlink_alloc_large_skb+0xba/0xf0 [ 208.648764][T11371] netlink_sendmsg+0x3cf/0x6b0 [ 208.648783][T11371] ? __pfx_netlink_sendmsg+0x10/0x10 [ 208.648816][T11371] __sock_sendmsg+0x145/0x180 [ 208.648914][T11371] ____sys_sendmsg+0x31e/0x4e0 [ 208.648940][T11371] ___sys_sendmsg+0x17b/0x1d0 [ 208.648988][T11371] __x64_sys_sendmsg+0xd4/0x160 [ 208.649009][T11371] x64_sys_call+0x2999/0x2fb0 [ 208.649028][T11371] do_syscall_64+0xd0/0x1b0 [ 208.649068][T11371] ? clear_bhb_loop+0x40/0x90 [ 208.649093][T11371] ? clear_bhb_loop+0x40/0x90 [ 208.649117][T11371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 208.649141][T11371] RIP: 0033:0x7fae3e6ce969 [ 208.649156][T11371] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 208.649229][T11371] RSP: 002b:00007fae3cd37038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 208.649246][T11371] RAX: ffffffffffffffda RBX: 00007fae3e8f5fa0 RCX: 00007fae3e6ce969 [ 208.649257][T11371] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000003 [ 208.649269][T11371] RBP: 00007fae3cd37090 R08: 0000000000000000 R09: 0000000000000000 [ 208.649283][T11371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 208.649361][T11371] R13: 0000000000000000 R14: 00007fae3e8f5fa0 R15: 00007ffe1fdae7d8 [ 208.649417][T11371] [ 209.592017][T11403] loop5: detected capacity change from 0 to 2048 [ 209.663921][T11403] loop5: p1 < > p4 [ 209.691941][T11403] loop5: p4 size 8388608 extends beyond EOD, truncated [ 209.924130][T11410] tipc: Enabling of bearer rejected, failed to enable media [ 210.212258][T11429] loop8: detected capacity change from 0 to 1024 [ 210.244499][T11429] EXT4-fs: Ignoring removed bh option [ 210.250790][T11429] EXT4-fs: inline encryption not supported [ 210.285008][T11429] EXT4-fs (loop8): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 210.306540][T11434] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2663'. [ 210.321569][T11429] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 210.336227][T11429] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 2: comm syz.8.2662: lblock 2 mapped to illegal pblock 2 (length 1) [ 210.357669][T11429] __quota_error: 80 callbacks suppressed [ 210.357685][T11429] Quota error (device loop8): qtree_write_dquot: dquota write failed [ 210.374833][T11429] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 48: comm syz.8.2662: lblock 0 mapped to illegal pblock 48 (length 1) [ 210.392689][T11429] Quota error (device loop8): v2_write_file_info: Can't write info structure [ 210.404564][T11429] EXT4-fs error (device loop8): ext4_acquire_dquot:6935: comm syz.8.2662: Failed to acquire dquot type 0 [ 210.423357][T11429] EXT4-fs error (device loop8) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 210.476463][T11429] EXT4-fs error (device loop8): ext4_evict_inode:259: inode #11: comm syz.8.2662: mark_inode_dirty error [ 210.489488][T11429] EXT4-fs warning (device loop8): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 210.502750][T11429] EXT4-fs (loop8): 1 orphan inode deleted [ 210.509871][T11429] EXT4-fs mount: 1 callbacks suppressed [ 210.509887][T11429] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 210.530373][ T5853] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:9: lblock 1 mapped to illegal pblock 1 (length 1) [ 210.551685][ T5853] Quota error (device loop8): remove_tree: Can't read quota data block 1 [ 210.561467][ T5853] EXT4-fs error (device loop8): ext4_release_dquot:6971: comm kworker/u8:9: Failed to release dquot type 0 [ 210.586192][T11429] EXT4-fs: Cannot change journaled quota options when quota turned on [ 210.601041][ T29] audit: type=1326 audit(2000000064.446:5727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11427 comm="syz.8.2662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 210.602738][T11429] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2662: lblock 0 mapped to illegal pblock 16 (length 1) [ 210.627815][ T29] audit: type=1326 audit(2000000064.446:5728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11427 comm="syz.8.2662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 210.742519][T11449] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2668'. [ 210.829052][ T29] audit: type=1326 audit(2000000064.446:5729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11427 comm="syz.8.2662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=289 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 210.847875][T11450] tipc: Enabling of bearer rejected, failed to enable media [ 210.858989][ T29] audit: type=1326 audit(2000000064.446:5730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11427 comm="syz.8.2662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 210.872879][T11449] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 210.894559][ T29] audit: type=1326 audit(2000000064.446:5731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11427 comm="syz.8.2662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 210.894589][ T29] audit: type=1326 audit(2000000064.446:5732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11427 comm="syz.8.2662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 210.959654][ T29] audit: type=1326 audit(2000000064.446:5733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11427 comm="syz.8.2662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 211.128492][T11429] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2662: lblock 0 mapped to illegal pblock 16 (length 1) [ 211.439600][T11429] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2662: lblock 0 mapped to illegal pblock 16 (length 1) [ 211.512136][T11429] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2662: lblock 0 mapped to illegal pblock 16 (length 1) [ 211.555271][T11459] loop0: detected capacity change from 0 to 512 [ 211.569463][T11459] EXT4-fs: Ignoring removed mblk_io_submit option [ 211.591132][T11460] loop5: detected capacity change from 0 to 512 [ 211.603916][T11460] EXT4-fs: Ignoring removed mblk_io_submit option [ 211.607643][T11467] macvlan2: entered promiscuous mode [ 211.617569][T11467] bridge0: entered promiscuous mode [ 211.624145][T11459] EXT4-fs error (device loop0): ext4_orphan_get:1391: inode #15: comm syz.0.2672: iget: bad extended attribute block 1 [ 211.628762][T11467] bridge0: port 3(macvlan2) entered blocking state [ 211.647057][T11467] bridge0: port 3(macvlan2) entered disabled state [ 211.654465][T11467] macvlan2: entered allmulticast mode [ 211.661001][T11467] bridge0: entered allmulticast mode [ 211.669808][T11473] loop6: detected capacity change from 0 to 128 [ 211.678536][T11459] EXT4-fs error (device loop0): ext4_orphan_get:1396: comm syz.0.2672: couldn't read orphan inode 15 (err -117) [ 211.690334][T11473] EXT4-fs: quotafile must be on filesystem root [ 211.701633][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 211.714236][T11459] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 211.725593][T11460] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2671: iget: bad extended attribute block 1 [ 211.735580][T10253] EXT4-fs error (device loop8): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 211.746370][T11460] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2671: couldn't read orphan inode 15 (err -117) [ 211.768097][T11467] macvlan2: left allmulticast mode [ 211.779416][T10253] EXT4-fs error (device loop8) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 211.780993][T11467] bridge0: left allmulticast mode [ 211.799029][T11460] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 211.800712][T10253] EXT4-fs error (device loop8): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 211.845307][T11467] bridge0: left promiscuous mode [ 211.962360][T11481] loop8: detected capacity change from 0 to 512 [ 211.982772][ T3580] hid-generic 0000:FFFFFFFF:0000.0010: unknown main item tag 0x0 [ 211.984172][T11481] EXT4-fs: Ignoring removed mblk_io_submit option [ 211.994677][ T3580] hid-generic 0000:FFFFFFFF:0000.0010: hidraw0: HID v0.00 Device [syz1] on syz0 [ 212.035487][T11481] EXT4-fs error (device loop8): ext4_orphan_get:1391: inode #15: comm syz.8.2678: iget: bad extended attribute block 1 [ 212.083669][T11481] EXT4-fs error (device loop8): ext4_orphan_get:1396: comm syz.8.2678: couldn't read orphan inode 15 (err -117) [ 212.112065][T11490] netlink: 'syz.5.2671': attribute type 1 has an invalid length. [ 212.122548][T11490] netlink: 224 bytes leftover after parsing attributes in process `syz.5.2671'. [ 212.164531][T11481] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 212.184239][T11491] netlink: 'syz.0.2672': attribute type 1 has an invalid length. [ 212.196804][T11491] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2672'. [ 212.268846][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 212.297056][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 212.337333][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 212.575313][T11519] loop5: detected capacity change from 0 to 512 [ 212.587104][T11519] EXT4-fs: Ignoring removed oldalloc option [ 212.599669][T11519] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 212.651514][T11519] EXT4-fs (loop5): failed to initialize system zone (-117) [ 212.659874][T11519] EXT4-fs (loop5): mount failed [ 212.689678][T11527] netlink: 96 bytes leftover after parsing attributes in process `syz.6.2696'. [ 212.701008][T11527] netlink: 'syz.6.2696': attribute type 5 has an invalid length. [ 212.709311][T11527] netlink: 44 bytes leftover after parsing attributes in process `syz.6.2696'. [ 213.140876][T11556] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.2707'. [ 213.153639][T11555] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.2707'. [ 213.298250][T11563] loop1: detected capacity change from 0 to 1024 [ 213.307327][T11563] EXT4-fs: Ignoring removed bh option [ 213.314774][T11563] EXT4-fs: inline encryption not supported [ 213.324132][T11563] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 213.341976][T11563] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 213.353387][T11563] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #3: block 2: comm syz.1.2710: lblock 2 mapped to illegal pblock 2 (length 1) [ 213.373991][T11563] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #3: block 48: comm syz.1.2710: lblock 0 mapped to illegal pblock 48 (length 1) [ 213.392612][T11563] EXT4-fs error (device loop1): ext4_acquire_dquot:6935: comm syz.1.2710: Failed to acquire dquot type 0 [ 213.407104][T11563] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 213.420019][T11563] EXT4-fs error (device loop1): ext4_evict_inode:259: inode #11: comm syz.1.2710: mark_inode_dirty error [ 213.432464][T11563] EXT4-fs warning (device loop1): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 213.452581][T11563] EXT4-fs (loop1): 1 orphan inode deleted [ 213.460076][T11563] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 213.474351][ T41] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 213.488938][T11563] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.2710: lblock 0 mapped to illegal pblock 16 (length 1) [ 213.513267][ T41] EXT4-fs error (device loop1): ext4_release_dquot:6971: comm kworker/u8:2: Failed to release dquot type 0 [ 213.934513][T11589] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.2710: lblock 0 mapped to illegal pblock 16 (length 1) [ 214.138619][T11589] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.2710: lblock 0 mapped to illegal pblock 16 (length 1) [ 214.243508][T11594] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.2710: lblock 0 mapped to illegal pblock 16 (length 1) [ 214.276319][ T3396] hid-generic 0000:FFFFFFFF:0000.0011: unknown main item tag 0x0 [ 214.287945][ T3396] hid-generic 0000:FFFFFFFF:0000.0011: hidraw0: HID v0.00 Device [syz1] on syz0 [ 214.434002][T10235] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 214.446852][T10235] EXT4-fs error (device loop1): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 214.461395][T10235] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 214.474374][T10235] EXT4-fs error (device loop1): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 214.500331][ T3393] kernel write not supported for file bpf-prog (pid: 3393 comm: kworker/0:4) [ 215.106188][T11650] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2742'. [ 215.225661][ T29] kauditd_printk_skb: 193 callbacks suppressed [ 215.225675][ T29] audit: type=1400 audit(2000000069.298:5924): avc: denied { connect } for pid=11658 comm="syz.0.2747" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 215.295004][T11663] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2748'. [ 215.307163][T11661] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2748'. [ 215.347322][ T29] audit: type=1326 audit(2000000069.435:5925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11664 comm="syz.0.2751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2bedfce969 code=0x7ffc0000 [ 215.384498][ T29] audit: type=1326 audit(2000000069.466:5926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11664 comm="syz.0.2751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2bedfce969 code=0x7ffc0000 [ 215.410289][ T29] audit: type=1326 audit(2000000069.466:5927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11664 comm="syz.0.2751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2bedfce969 code=0x7ffc0000 [ 215.436237][ T29] audit: type=1326 audit(2000000069.466:5928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11664 comm="syz.0.2751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2bedfce969 code=0x7ffc0000 [ 215.463722][ T29] audit: type=1326 audit(2000000069.466:5929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11664 comm="syz.0.2751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2bedfce969 code=0x7ffc0000 [ 215.489210][ T29] audit: type=1326 audit(2000000069.466:5930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11664 comm="syz.0.2751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2bedfce969 code=0x7ffc0000 [ 215.517654][ T29] audit: type=1326 audit(2000000069.466:5931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11664 comm="syz.0.2751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2bedfce969 code=0x7ffc0000 [ 215.547030][ T29] audit: type=1326 audit(2000000069.466:5932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11664 comm="syz.0.2751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2bedfce969 code=0x7ffc0000 [ 215.551591][T11667] loop8: detected capacity change from 0 to 512 [ 215.574790][ T29] audit: type=1326 audit(2000000069.466:5933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11664 comm="syz.0.2751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2bedfce969 code=0x7ffc0000 [ 215.704194][T11667] EXT4-fs: Ignoring removed mblk_io_submit option [ 215.752202][T11667] EXT4-fs error (device loop8): ext4_orphan_get:1391: inode #15: comm syz.8.2750: iget: bad extended attribute block 1 [ 215.772159][T11667] EXT4-fs error (device loop8): ext4_orphan_get:1396: comm syz.8.2750: couldn't read orphan inode 15 (err -117) [ 215.786096][T11669] loop0: detected capacity change from 0 to 2048 [ 215.800276][T11667] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 216.078173][T11669] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 216.148003][T11669] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 216.316234][T11687] netlink: 'syz.8.2750': attribute type 1 has an invalid length. [ 216.325753][T11687] netlink: 224 bytes leftover after parsing attributes in process `syz.8.2750'. [ 216.368579][T11687] SELinux: security_context_str_to_sid (Ð-šXܘ7.H\¹ÿ %ºu) failed with errno=-22 [ 216.461419][T11692] loop6: detected capacity change from 0 to 512 [ 216.474455][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 216.486266][T11692] EXT4-fs: Ignoring removed mblk_io_submit option [ 216.513788][T11692] EXT4-fs error (device loop6): ext4_orphan_get:1391: inode #15: comm syz.6.2757: iget: bad extended attribute block 1 [ 216.556892][T11692] EXT4-fs error (device loop6): ext4_orphan_get:1396: comm syz.6.2757: couldn't read orphan inode 15 (err -117) [ 216.595078][T11692] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 216.767700][T11713] netlink: 'syz.6.2757': attribute type 1 has an invalid length. [ 217.100518][ T3396] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 217.109802][ T3396] hid-generic 0000:0000:0000.0012: hidraw0: HID v0.00 Device [syz1] on syz0 [ 217.300287][ T4905] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 217.442688][T11736] loop6: detected capacity change from 0 to 512 [ 217.459439][T11749] loop1: detected capacity change from 0 to 2048 [ 217.473785][T11751] __nla_validate_parse: 5 callbacks suppressed [ 217.473800][T11751] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2780'. [ 217.503698][T11736] EXT4-fs: Ignoring removed mblk_io_submit option [ 217.520754][T11751] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 217.531251][T11749] loop1: p1 < > p4 [ 217.536611][T11749] loop1: p4 size 8388608 extends beyond EOD, truncated [ 217.573815][T11755] loop0: detected capacity change from 0 to 512 [ 217.578026][T11736] EXT4-fs error (device loop6): ext4_orphan_get:1391: inode #15: comm syz.6.2769: iget: bad extended attribute block 1 [ 217.600770][T11755] EXT4-fs: Ignoring removed mblk_io_submit option [ 217.641926][T11755] EXT4-fs error (device loop0): ext4_orphan_get:1391: inode #15: comm syz.0.2782: iget: bad extended attribute block 1 [ 217.672882][T11755] EXT4-fs error (device loop0): ext4_orphan_get:1396: comm syz.0.2782: couldn't read orphan inode 15 (err -117) [ 217.674804][T11736] EXT4-fs error (device loop6): ext4_orphan_get:1396: comm syz.6.2769: couldn't read orphan inode 15 (err -117) [ 217.701499][T11755] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 217.723009][ T3325] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 217.743573][T11736] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 218.977791][T11768] netlink: 'syz.6.2769': attribute type 1 has an invalid length. [ 218.986582][T11768] netlink: 224 bytes leftover after parsing attributes in process `syz.6.2769'. [ 219.094104][T11736] SELinux: security_context_str_to_sid (Ð-šXܘ7.H\¹ÿ %ºu) failed with errno=-22 [ 219.138986][ T4905] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.271640][T11794] tipc: Enabling of bearer rejected, failed to enable media [ 219.304218][T11791] loop1: detected capacity change from 0 to 512 [ 219.357792][T11791] EXT4-fs: Ignoring removed mblk_io_submit option [ 219.419289][T11791] EXT4-fs error (device loop1): ext4_orphan_get:1391: inode #15: comm syz.1.2796: iget: bad extended attribute block 1 [ 219.467544][T11808] loop6: detected capacity change from 0 to 512 [ 219.472086][T11791] EXT4-fs error (device loop1): ext4_orphan_get:1396: comm syz.1.2796: couldn't read orphan inode 15 (err -117) [ 219.481659][T11808] EXT4-fs: Ignoring removed mblk_io_submit option [ 219.521974][T11808] EXT4-fs error (device loop6): ext4_orphan_get:1391: inode #15: comm syz.6.2803: iget: bad extended attribute block 1 [ 219.542710][T11808] EXT4-fs error (device loop6): ext4_orphan_get:1396: comm syz.6.2803: couldn't read orphan inode 15 (err -117) [ 219.544139][T11791] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 219.580105][T11808] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 219.691070][T10235] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.794753][T11824] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2809'. [ 219.822384][T11825] netlink: 'syz.6.2803': attribute type 1 has an invalid length. [ 219.830499][T11825] netlink: 224 bytes leftover after parsing attributes in process `syz.6.2803'. [ 219.847613][T11825] SELinux: security_context_str_to_sid (Ð-šXܘ7.H\¹ÿ %ºu) failed with errno=-22 [ 219.874933][T11824] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 219.892309][T11827] loop8: detected capacity change from 0 to 512 [ 219.922491][T11827] EXT4-fs: Ignoring removed mblk_io_submit option [ 219.942858][ T4905] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.973145][T11827] EXT4-fs error (device loop8): ext4_orphan_get:1391: inode #15: comm syz.8.2810: iget: bad extended attribute block 1 [ 220.024782][T11827] EXT4-fs error (device loop8): ext4_orphan_get:1396: comm syz.8.2810: couldn't read orphan inode 15 (err -117) [ 220.064886][T11836] loop6: detected capacity change from 0 to 512 [ 220.076603][T11827] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 220.111730][T11836] EXT4-fs: Ignoring removed mblk_io_submit option [ 220.124523][T11841] tipc: Enabling of bearer rejected, failed to enable media [ 220.191523][T11836] EXT4-fs error (device loop6): ext4_orphan_get:1391: inode #15: comm syz.6.2812: iget: bad extended attribute block 1 [ 220.252013][T11836] EXT4-fs error (device loop6): ext4_orphan_get:1396: comm syz.6.2812: couldn't read orphan inode 15 (err -117) [ 220.316772][T11836] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 220.386092][T11844] loop5: detected capacity change from 0 to 512 [ 220.408790][T11844] EXT4-fs: Ignoring removed mblk_io_submit option [ 220.423948][T11845] netlink: 'syz.8.2810': attribute type 1 has an invalid length. [ 220.431870][T11845] netlink: 224 bytes leftover after parsing attributes in process `syz.8.2810'. [ 220.465839][T11844] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2817: iget: bad extended attribute block 1 [ 220.499900][T11844] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2817: couldn't read orphan inode 15 (err -117) [ 220.545356][T11844] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 220.572486][T11850] bridge0: entered promiscuous mode [ 220.579593][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 220.591738][T11850] macvlan2: entered promiscuous mode [ 220.603592][T11850] bridge0: port 3(macvlan2) entered blocking state [ 220.611552][T11850] bridge0: port 3(macvlan2) entered disabled state [ 220.618581][T11850] macvlan2: entered allmulticast mode [ 220.624073][T11850] bridge0: entered allmulticast mode [ 220.630329][T11850] macvlan2: left allmulticast mode [ 220.635787][T11850] bridge0: left allmulticast mode [ 220.646178][T11852] netlink: 'syz.6.2812': attribute type 1 has an invalid length. [ 220.654315][T11852] netlink: 224 bytes leftover after parsing attributes in process `syz.6.2812'. [ 220.664025][T11850] bridge0: left promiscuous mode [ 220.666506][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 220.671202][T11851] loop1: detected capacity change from 0 to 128 [ 220.698555][T11851] EXT4-fs: quotafile must be on filesystem root [ 220.746700][T11856] loop8: detected capacity change from 0 to 512 [ 220.756640][T11856] EXT4-fs: Ignoring removed mblk_io_submit option [ 220.793964][T11856] EXT4-fs error (device loop8): ext4_orphan_get:1391: inode #15: comm syz.8.2822: iget: bad extended attribute block 1 [ 220.813566][T11856] EXT4-fs error (device loop8): ext4_orphan_get:1396: comm syz.8.2822: couldn't read orphan inode 15 (err -117) [ 220.865711][T11865] loop5: detected capacity change from 0 to 512 [ 220.915107][ T4905] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 220.944557][T11865] EXT4-fs: Ignoring removed mblk_io_submit option [ 220.954179][T11856] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 220.970659][ T1107] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 220.982497][ T1107] hid-generic 0000:0000:0000.0013: hidraw0: HID v0.00 Device [syz1] on syz0 [ 220.998507][T11865] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2824: iget: bad extended attribute block 1 [ 221.089501][T11865] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2824: couldn't read orphan inode 15 (err -117) [ 221.116204][T11877] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2829'. [ 221.189074][T11865] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 221.212523][T11877] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 221.310901][T11884] netlink: 'syz.8.2822': attribute type 1 has an invalid length. [ 221.318861][T11884] netlink: 224 bytes leftover after parsing attributes in process `syz.8.2822'. [ 221.412719][T11856] SELinux: security_context_str_to_sid (Ð-šXܘ7.H\¹ÿ %ºu) failed with errno=-22 [ 221.477410][T11806] EXT4-fs error (device loop5): ext4_validate_block_bitmap:432: comm ext4lazyinit: bg 0: block 13: invalid block bitmap [ 221.513125][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.670218][T11891] netlink: 'syz.5.2824': attribute type 1 has an invalid length. [ 221.678673][T11891] netlink: 224 bytes leftover after parsing attributes in process `syz.5.2824'. [ 221.923995][T11901] macvlan2: entered promiscuous mode [ 221.929579][T11901] bridge0: entered promiscuous mode [ 221.938366][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.951183][T11901] bridge0: port 3(macvlan2) entered blocking state [ 221.958288][T11901] bridge0: port 3(macvlan2) entered disabled state [ 221.970779][T11906] loop6: detected capacity change from 0 to 128 [ 222.021399][T11901] macvlan2: entered allmulticast mode [ 222.027667][T11901] bridge0: entered allmulticast mode [ 222.042969][T11906] EXT4-fs: quotafile must be on filesystem root [ 222.066024][T11901] macvlan2: left allmulticast mode [ 222.072273][T11901] bridge0: left allmulticast mode [ 222.098786][T11901] bridge0: left promiscuous mode [ 222.111574][T11912] tipc: Enabling of bearer rejected, failed to enable media [ 222.144869][ T29] kauditd_printk_skb: 415 callbacks suppressed [ 222.144885][ T29] audit: type=1326 audit(2000000076.566:6349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11911 comm="syz.5.2843" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 222.199297][ T29] audit: type=1326 audit(2000000076.566:6350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11911 comm="syz.5.2843" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 222.226024][ T29] audit: type=1326 audit(2000000076.619:6351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11911 comm="syz.5.2843" exe="/root/syz-executor" sig=0 arch=c000003e syscall=25 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 222.252174][ T29] audit: type=1326 audit(2000000076.619:6352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11911 comm="syz.5.2843" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 222.277230][ T29] audit: type=1326 audit(2000000076.619:6353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11911 comm="syz.5.2843" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 222.303261][ T29] audit: type=1326 audit(2000000076.619:6354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11911 comm="syz.5.2843" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 222.327107][ T29] audit: type=1326 audit(2000000076.619:6355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11911 comm="syz.5.2843" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 222.351621][ T29] audit: type=1326 audit(2000000076.619:6356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11911 comm="syz.5.2843" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 222.390502][ T29] audit: type=1326 audit(2000000076.619:6357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11911 comm="syz.5.2843" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 222.416147][ T29] audit: type=1326 audit(2000000076.619:6358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11911 comm="syz.5.2843" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 222.474841][T11917] infiniband syz2: set down [ 222.479733][T11917] infiniband syz2: added veth0_to_bond [ 222.497001][T11921] macvlan2: entered promiscuous mode [ 222.502689][T11921] bridge0: entered promiscuous mode [ 222.509855][T11921] bridge0: port 3(macvlan2) entered blocking state [ 222.516941][T11921] bridge0: port 3(macvlan2) entered disabled state [ 222.564120][T11921] macvlan2: entered allmulticast mode [ 222.569743][T11921] bridge0: entered allmulticast mode [ 222.578184][T11921] macvlan2: left allmulticast mode [ 222.583521][T11921] bridge0: left allmulticast mode [ 222.589836][T11930] loop5: detected capacity change from 0 to 128 [ 222.593245][T11929] FAULT_INJECTION: forcing a failure. [ 222.593245][T11929] name failslab, interval 1, probability 0, space 0, times 0 [ 222.599032][T11930] EXT4-fs: quotafile must be on filesystem root [ 222.610386][T11929] CPU: 1 UID: 0 PID: 11929 Comm: syz.8.2849 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 222.610415][T11929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 222.610427][T11929] Call Trace: [ 222.610435][T11929] [ 222.610450][T11929] __dump_stack+0x1d/0x30 [ 222.610483][T11929] dump_stack_lvl+0xe8/0x140 [ 222.610504][T11929] dump_stack+0x15/0x1b [ 222.610525][T11929] should_fail_ex+0x265/0x280 [ 222.610552][T11929] should_failslab+0x8c/0xb0 [ 222.610585][T11929] kmem_cache_alloc_noprof+0x50/0x310 [ 222.610608][T11929] ? skb_clone+0x151/0x1f0 [ 222.610632][T11929] skb_clone+0x151/0x1f0 [ 222.610652][T11929] __netlink_deliver_tap+0x2c9/0x500 [ 222.610713][T11929] netlink_unicast+0x64c/0x670 [ 222.610823][T11929] netlink_sendmsg+0x58b/0x6b0 [ 222.610844][T11929] ? __pfx_netlink_sendmsg+0x10/0x10 [ 222.610877][T11929] __sock_sendmsg+0x145/0x180 [ 222.610904][T11929] ____sys_sendmsg+0x31e/0x4e0 [ 222.610988][T11929] ___sys_sendmsg+0x17b/0x1d0 [ 222.611033][T11929] __x64_sys_sendmsg+0xd4/0x160 [ 222.611058][T11929] x64_sys_call+0x2999/0x2fb0 [ 222.611137][T11929] do_syscall_64+0xd0/0x1b0 [ 222.611160][T11929] ? clear_bhb_loop+0x40/0x90 [ 222.611182][T11929] ? clear_bhb_loop+0x40/0x90 [ 222.611204][T11929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.611296][T11929] RIP: 0033:0x7fe3d767e969 [ 222.611312][T11929] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 222.611331][T11929] RSP: 002b:00007fe3d5ce7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 222.611370][T11929] RAX: ffffffffffffffda RBX: 00007fe3d78a5fa0 RCX: 00007fe3d767e969 [ 222.611383][T11929] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000006 [ 222.611395][T11929] RBP: 00007fe3d5ce7090 R08: 0000000000000000 R09: 0000000000000000 [ 222.611408][T11929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 222.611421][T11929] R13: 0000000000000000 R14: 00007fe3d78a5fa0 R15: 00007fff1e1b1a98 [ 222.611441][T11929] [ 222.621238][T11917] RDS/IB: syz2: added [ 222.840102][T11917] smc: adding ib device syz2 with port count 1 [ 222.840696][T11921] bridge0: left promiscuous mode [ 222.846647][T11917] smc: ib device syz2 port 1 has pnetid [ 222.994830][T11943] netlink: 2028 bytes leftover after parsing attributes in process `syz.5.2853'. [ 223.004166][T11943] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2853'. [ 223.098445][T11950] loop5: detected capacity change from 0 to 1024 [ 223.238462][T11950] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 223.268990][T11950] ext4 filesystem being mounted at /524/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 223.372756][T11949] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2856'. [ 223.399640][T11949] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2856'. [ 223.409308][T11949] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2856'. [ 223.475655][T11966] loop6: detected capacity change from 0 to 1024 [ 223.484332][T11966] EXT4-fs: Ignoring removed bh option [ 223.490394][T11966] EXT4-fs: inline encryption not supported [ 223.498756][T11966] EXT4-fs (loop6): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 223.512739][T11966] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 223.524312][T11966] EXT4-fs error (device loop6): ext4_map_blocks:675: inode #3: block 2: comm syz.6.2861: lblock 2 mapped to illegal pblock 2 (length 1) [ 223.545764][T11966] EXT4-fs error (device loop6): ext4_map_blocks:675: inode #3: block 48: comm syz.6.2861: lblock 0 mapped to illegal pblock 48 (length 1) [ 223.562442][T11966] EXT4-fs error (device loop6): ext4_acquire_dquot:6935: comm syz.6.2861: Failed to acquire dquot type 0 [ 223.577415][T11966] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 223.589146][T11966] EXT4-fs error (device loop6): ext4_evict_inode:259: inode #11: comm syz.6.2861: mark_inode_dirty error [ 223.614692][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 223.629241][T11966] EXT4-fs warning (device loop6): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 223.643561][T11966] EXT4-fs (loop6): 1 orphan inode deleted [ 223.656955][T11966] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 223.672065][ T3438] EXT4-fs error (device loop6): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:7: lblock 1 mapped to illegal pblock 1 (length 1) [ 223.692317][ T3438] EXT4-fs error (device loop6): ext4_release_dquot:6971: comm kworker/u8:7: Failed to release dquot type 0 [ 223.713531][ T1107] hid-generic 0000:FFFFFFFF:0000.0014: unknown main item tag 0x0 [ 223.723599][ T1107] hid-generic 0000:FFFFFFFF:0000.0014: hidraw0: HID v0.00 Device [syz1] on syz0 [ 223.743742][T11966] EXT4-fs (loop6): re-mounted 00000000-0000-0000-0000-000000000000. [ 223.768210][T11966] EXT4-fs error (device loop6): ext4_map_blocks:675: inode #2: block 16: comm syz.6.2861: lblock 0 mapped to illegal pblock 16 (length 1) [ 223.914461][T11979] EXT4-fs error (device loop6): ext4_map_blocks:675: inode #2: block 16: comm syz.6.2861: lblock 0 mapped to illegal pblock 16 (length 1) [ 223.967319][T11979] EXT4-fs error (device loop6): ext4_map_blocks:675: inode #2: block 16: comm syz.6.2861: lblock 0 mapped to illegal pblock 16 (length 1) [ 223.974675][T11981] loop1: detected capacity change from 0 to 512 [ 224.007330][T11979] EXT4-fs error (device loop6): ext4_map_blocks:675: inode #2: block 16: comm syz.6.2861: lblock 0 mapped to illegal pblock 16 (length 1) [ 224.029954][T11985] macvlan2: entered promiscuous mode [ 224.035939][T11985] bridge0: entered promiscuous mode [ 224.045872][T11981] EXT4-fs: Ignoring removed mblk_io_submit option [ 224.065339][T11985] bridge0: port 3(macvlan2) entered blocking state [ 224.072426][T11985] bridge0: port 3(macvlan2) entered disabled state [ 224.086344][T11981] EXT4-fs error (device loop1): ext4_orphan_get:1391: inode #15: comm syz.1.2867: iget: bad extended attribute block 1 [ 224.104824][T11985] macvlan2: entered allmulticast mode [ 224.111149][T11985] bridge0: entered allmulticast mode [ 224.119127][T11981] EXT4-fs error (device loop1): ext4_orphan_get:1396: comm syz.1.2867: couldn't read orphan inode 15 (err -117) [ 224.131547][T11987] loop5: detected capacity change from 0 to 128 [ 224.131987][T11987] EXT4-fs: quotafile must be on filesystem root [ 224.154248][T11985] macvlan2: left allmulticast mode [ 224.159504][T11985] bridge0: left allmulticast mode [ 224.167436][T11985] bridge0: left promiscuous mode [ 224.185781][T11981] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 224.218536][T10235] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.280938][ T4905] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.291443][ T4905] EXT4-fs error (device loop6): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 224.313309][T11990] loop5: detected capacity change from 0 to 512 [ 224.317439][ T4905] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 224.333995][ T4905] EXT4-fs error (device loop6): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 224.336163][T11990] EXT4-fs: Ignoring removed mblk_io_submit option [ 224.407663][ T3392] hid-generic 0000:FFFFFFFF:0000.0015: unknown main item tag 0x0 [ 224.419152][T11990] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2871: iget: bad extended attribute block 1 [ 224.496307][ T3392] hid-generic 0000:FFFFFFFF:0000.0015: hidraw0: HID v0.00 Device [syz1] on syz0 [ 224.550764][T11990] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2871: couldn't read orphan inode 15 (err -117) [ 224.597900][T12011] FAULT_INJECTION: forcing a failure. [ 224.597900][T12011] name failslab, interval 1, probability 0, space 0, times 0 [ 224.614013][T12011] CPU: 1 UID: 0 PID: 12011 Comm: syz.8.2879 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 224.614040][T12011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 224.614050][T12011] Call Trace: [ 224.614055][T12011] [ 224.614061][T12011] __dump_stack+0x1d/0x30 [ 224.614084][T12011] dump_stack_lvl+0xe8/0x140 [ 224.614112][T12011] dump_stack+0x15/0x1b [ 224.614127][T12011] should_fail_ex+0x265/0x280 [ 224.614153][T12011] ? __se_sys_memfd_create+0x1cc/0x590 [ 224.614181][T12011] should_failslab+0x8c/0xb0 [ 224.614220][T12011] __kmalloc_cache_noprof+0x4c/0x320 [ 224.614302][T12011] __se_sys_memfd_create+0x1cc/0x590 [ 224.614332][T12011] __x64_sys_memfd_create+0x31/0x40 [ 224.614359][T12011] x64_sys_call+0x122f/0x2fb0 [ 224.614415][T12011] do_syscall_64+0xd0/0x1b0 [ 224.614438][T12011] ? clear_bhb_loop+0x40/0x90 [ 224.614528][T12011] ? clear_bhb_loop+0x40/0x90 [ 224.614625][T12011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 224.614744][T12011] RIP: 0033:0x7fe3d767e969 [ 224.614759][T12011] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 224.614784][T12011] RSP: 002b:00007fe3d5ce6e18 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 224.614804][T12011] RAX: ffffffffffffffda RBX: 0000000000000246 RCX: 00007fe3d767e969 [ 224.614818][T12011] RDX: 00007fe3d5ce6ef0 RSI: 0000000000000000 RDI: 00007fe3d7701444 [ 224.614831][T12011] RBP: 0000200000000ac0 R08: 00007fe3d5ce6bb7 R09: 00007fe3d5ce6e40 [ 224.614845][T12011] R10: 000000000000000a R11: 0000000000000202 R12: 0000200000000740 [ 224.614858][T12011] R13: 00007fe3d5ce6ef0 R14: 00007fe3d5ce6eb0 R15: 00002000000006c0 [ 224.614877][T12011] [ 224.622631][T11990] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 224.668499][T12015] loop1: detected capacity change from 0 to 2048 [ 224.843497][T12015] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 224.881931][T10235] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.899028][T12025] pim6reg1: entered promiscuous mode [ 224.904524][T12025] pim6reg1: entered allmulticast mode [ 225.113876][T12034] netlink: 'syz.5.2871': attribute type 1 has an invalid length. [ 225.122081][T12034] netlink: 224 bytes leftover after parsing attributes in process `syz.5.2871'. [ 225.305728][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 225.741261][T12080] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2907'. [ 225.768819][T12080] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2907'. [ 225.800742][T12071] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2906'. [ 225.901615][T12082] bridge_slave_0: left allmulticast mode [ 225.908501][T12082] bridge_slave_0: left promiscuous mode [ 225.914473][T12082] bridge0: port 1(bridge_slave_0) entered disabled state [ 225.941992][T12082] bridge_slave_1: left allmulticast mode [ 225.948143][T12082] bridge_slave_1: left promiscuous mode [ 225.954524][T12082] bridge0: port 2(bridge_slave_1) entered disabled state [ 225.980367][T12082] bond0: (slave bond_slave_0): Releasing backup interface [ 225.993433][T12082] bond0: (slave bond_slave_1): Releasing backup interface [ 226.009488][T12082] team0: Port device team_slave_0 removed [ 226.021653][T12082] team0: Port device team_slave_1 removed [ 226.028898][T12082] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 226.036454][T12082] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 226.046907][T12082] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 226.054563][T12082] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 226.187945][ T3392] hid-generic 0000:FFFFFFFF:0000.0016: unknown main item tag 0x0 [ 226.199029][ T3392] hid-generic 0000:FFFFFFFF:0000.0016: hidraw0: HID v0.00 Device [syz1] on syz0 [ 226.290980][T12092] loop6: detected capacity change from 0 to 2048 [ 226.325918][T12092] loop6: p1 < > p4 [ 226.330789][T12092] loop6: p4 size 8388608 extends beyond EOD, truncated [ 226.456246][T12108] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2920'. [ 226.526329][T12108] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 227.098325][T12133] SELinux: Context system_u:object_r:logrotate_var_lib_t:s0 is not valid (left unmapped). [ 227.111834][ T29] kauditd_printk_skb: 214 callbacks suppressed [ 227.111849][ T29] audit: type=1400 audit(2000000081.786:6570): avc: denied { relabelto } for pid=12131 comm="syz.6.2929" name="cgroup.procs" dev="cgroup" ino=396 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:logrotate_var_lib_t:s0" [ 227.182009][ T29] audit: type=1400 audit(2000000081.786:6571): avc: denied { associate } for pid=12131 comm="syz.6.2929" name="cgroup.procs" dev="cgroup" ino=396 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 srawcon="system_u:object_r:logrotate_var_lib_t:s0" [ 227.233723][ T29] audit: type=1400 audit(2000000081.912:6572): avc: denied { write } for pid=12131 comm="syz.6.2929" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 227.534255][ T29] audit: type=1400 audit(2000000082.217:6573): avc: denied { setopt } for pid=12150 comm="syz.6.2938" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 227.703367][ T29] audit: type=1400 audit(2000000082.406:6574): avc: denied { read } for pid=12154 comm="syz.1.2939" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 227.728467][T12157] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 227.809887][T12165] __nla_validate_parse: 3 callbacks suppressed [ 227.809902][T12165] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2943'. [ 227.840413][ T3396] hid-generic 0000:FFFFFFFF:0000.0017: unknown main item tag 0x0 [ 227.850146][ T3396] hid-generic 0000:FFFFFFFF:0000.0017: hidraw0: HID v0.00 Device [syz1] on syz0 [ 227.861326][T12165] loop1: detected capacity change from 0 to 512 [ 227.869269][T12165] ext4: Unknown parameter 'subj_user' [ 227.879153][ T29] audit: type=1400 audit(2000000082.595:6575): avc: denied { write } for pid=12162 comm="syz.1.2943" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 227.900185][ T29] audit: type=1400 audit(2000000082.595:6576): avc: denied { ioctl } for pid=12163 comm="syz.8.2944" path="/dev/hidraw0" dev="devtmpfs" ino=1168 ioctlcmd=0x4807 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 228.335380][ T29] audit: type=1400 audit(2000000083.068:6577): avc: denied { read write } for pid=12183 comm="syz.6.2951" name="ppp" dev="devtmpfs" ino=140 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 228.359526][ T29] audit: type=1400 audit(2000000083.068:6578): avc: denied { open } for pid=12183 comm="syz.6.2951" path="/dev/ppp" dev="devtmpfs" ino=140 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 228.370373][T12184] loop6: detected capacity change from 0 to 1024 [ 228.392666][ T29] audit: type=1400 audit(2000000083.068:6579): avc: denied { ioctl } for pid=12183 comm="syz.6.2951" path="/dev/ppp" dev="devtmpfs" ino=140 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 228.400664][T12184] EXT4-fs: Ignoring removed nomblk_io_submit option [ 228.457910][T12184] EXT4-fs: Mount option(s) incompatible with ext2 [ 228.483334][T12188] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2953'. [ 228.492941][T12189] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2953'. [ 228.544732][T12184] geneve0: entered promiscuous mode [ 228.551200][T12184] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 228.564735][T12184] geneve0 (unregistering): left promiscuous mode [ 228.593508][T12195] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 228.628844][T12198] loop8: detected capacity change from 0 to 1024 [ 228.639635][T12198] EXT4-fs: Ignoring removed bh option [ 228.645764][T12198] EXT4-fs: inline encryption not supported [ 228.652119][T12198] EXT4-fs (loop8): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 228.677259][T12198] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 228.701497][T12198] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 2: comm syz.8.2955: lblock 2 mapped to illegal pblock 2 (length 1) [ 228.818199][T12198] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 48: comm syz.8.2955: lblock 0 mapped to illegal pblock 48 (length 1) [ 228.838056][T12198] EXT4-fs error (device loop8): ext4_acquire_dquot:6935: comm syz.8.2955: Failed to acquire dquot type 0 [ 228.865067][T12198] EXT4-fs error (device loop8) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 228.887129][T12198] EXT4-fs error (device loop8): ext4_evict_inode:259: inode #11: comm syz.8.2955: mark_inode_dirty error [ 228.918513][T12198] EXT4-fs warning (device loop8): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 228.929805][T12213] tipc: Enabling of bearer rejected, failed to enable media [ 228.944351][T12198] EXT4-fs (loop8): 1 orphan inode deleted [ 228.950837][T12198] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 228.965753][ T51] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 228.985170][T12198] EXT4-fs: Cannot change journaled quota options when quota turned on [ 228.993976][ T51] EXT4-fs error (device loop8): ext4_release_dquot:6971: comm kworker/u8:3: Failed to release dquot type 0 [ 229.014350][T12198] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2955: lblock 0 mapped to illegal pblock 16 (length 1) [ 229.132993][T12218] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2955: lblock 0 mapped to illegal pblock 16 (length 1) [ 229.151033][T12218] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2955: lblock 0 mapped to illegal pblock 16 (length 1) [ 229.172819][T12218] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2955: lblock 0 mapped to illegal pblock 16 (length 1) [ 229.406783][T12220] loop5: detected capacity change from 0 to 512 [ 229.414633][T12220] EXT4-fs: Ignoring removed mblk_io_submit option [ 229.426599][T12220] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2962: iget: bad extended attribute block 1 [ 229.443949][T12220] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2962: couldn't read orphan inode 15 (err -117) [ 229.467526][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 229.479140][T12220] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 229.492498][T10253] EXT4-fs error (device loop8): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 229.514207][T10253] EXT4-fs error (device loop8) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 229.537834][T10253] EXT4-fs error (device loop8): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 229.588489][T12220] netlink: 'syz.5.2962': attribute type 1 has an invalid length. [ 229.597210][T12220] netlink: 224 bytes leftover after parsing attributes in process `syz.5.2962'. [ 229.630731][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 229.695828][T12225] loop5: detected capacity change from 0 to 512 [ 229.704797][T12225] EXT4-fs: Ignoring removed mblk_io_submit option [ 229.721290][T12223] loop8: detected capacity change from 0 to 2048 [ 229.739779][T12225] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2964: iget: bad extended attribute block 1 [ 229.756649][T12225] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2964: couldn't read orphan inode 15 (err -117) [ 229.778899][T12225] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 229.795355][T12223] loop8: p1 < > p4 [ 229.799789][T12223] loop8: p4 size 8388608 extends beyond EOD, truncated [ 229.876412][T12232] loop1: detected capacity change from 0 to 1024 [ 229.884950][T12232] EXT4-fs: Ignoring removed bh option [ 229.890877][T12232] EXT4-fs: inline encryption not supported [ 229.900573][T12232] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 229.920606][T12232] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 229.934314][T12232] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #3: block 2: comm syz.1.2966: lblock 2 mapped to illegal pblock 2 (length 1) [ 229.981762][T12232] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #3: block 48: comm syz.1.2966: lblock 0 mapped to illegal pblock 48 (length 1) [ 230.022525][T12234] netlink: 'syz.5.2964': attribute type 1 has an invalid length. [ 230.031611][T12234] netlink: 224 bytes leftover after parsing attributes in process `syz.5.2964'. [ 230.043468][T12232] EXT4-fs error (device loop1): ext4_acquire_dquot:6935: comm syz.1.2966: Failed to acquire dquot type 0 [ 230.077409][T12232] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 230.107040][T12232] EXT4-fs error (device loop1): ext4_evict_inode:259: inode #11: comm syz.1.2966: mark_inode_dirty error [ 230.138819][T12232] EXT4-fs warning (device loop1): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 230.155808][T12232] EXT4-fs (loop1): 1 orphan inode deleted [ 230.173945][ T31] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 230.190353][T12232] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 230.204295][ T31] EXT4-fs error (device loop1): ext4_release_dquot:6971: comm kworker/u8:1: Failed to release dquot type 0 [ 230.219022][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 230.240053][T12232] EXT4-fs: Cannot change journaled quota options when quota turned on [ 230.255658][T12232] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.2966: lblock 0 mapped to illegal pblock 16 (length 1) [ 230.310795][T12245] loop5: detected capacity change from 0 to 1024 [ 230.318811][T12245] EXT4-fs: Ignoring removed bh option [ 230.324448][T12245] EXT4-fs: inline encryption not supported [ 230.331206][T12245] EXT4-fs (loop5): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 230.343815][T12245] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 230.353053][T12245] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #3: block 2: comm syz.5.2971: lblock 2 mapped to illegal pblock 2 (length 1) [ 230.367879][T12245] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #3: block 48: comm syz.5.2971: lblock 0 mapped to illegal pblock 48 (length 1) [ 230.382793][T12248] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.2966: lblock 0 mapped to illegal pblock 16 (length 1) [ 230.400925][T12248] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.2966: lblock 0 mapped to illegal pblock 16 (length 1) [ 230.415302][T12245] EXT4-fs error (device loop5): ext4_acquire_dquot:6935: comm syz.5.2971: Failed to acquire dquot type 0 [ 230.436336][T12245] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 230.458031][T12248] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.2966: lblock 0 mapped to illegal pblock 16 (length 1) [ 230.476152][T12245] EXT4-fs error (device loop5): ext4_evict_inode:259: inode #11: comm syz.5.2971: mark_inode_dirty error [ 230.497180][T12245] EXT4-fs warning (device loop5): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 230.513961][T12253] loop8: detected capacity change from 0 to 1024 [ 230.525291][T12245] EXT4-fs (loop5): 1 orphan inode deleted [ 230.532254][T12253] EXT4-fs: Ignoring removed bh option [ 230.537818][T12253] EXT4-fs: inline encryption not supported [ 230.545154][ T51] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 230.560807][T12245] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 230.563247][T12253] EXT4-fs (loop8): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 230.584271][ T51] EXT4-fs error (device loop5): ext4_release_dquot:6971: comm kworker/u8:3: Failed to release dquot type 0 [ 230.585651][T12253] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 230.606790][T12253] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 2: comm syz.8.2973: lblock 2 mapped to illegal pblock 2 (length 1) [ 230.621583][T12253] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 48: comm syz.8.2973: lblock 0 mapped to illegal pblock 48 (length 1) [ 230.636115][T12253] EXT4-fs error (device loop8): ext4_acquire_dquot:6935: comm syz.8.2973: Failed to acquire dquot type 0 [ 230.647778][T12253] EXT4-fs error (device loop8) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 230.658433][T12253] EXT4-fs error (device loop8): ext4_evict_inode:259: inode #11: comm syz.8.2973: mark_inode_dirty error [ 230.676502][T12245] EXT4-fs: Cannot change journaled quota options when quota turned on [ 230.680684][T12253] EXT4-fs warning (device loop8): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 230.697636][T10235] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 230.709713][T12245] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.2971: lblock 0 mapped to illegal pblock 16 (length 1) [ 230.725368][T10235] EXT4-fs error (device loop1): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 230.742539][T12253] EXT4-fs (loop8): 1 orphan inode deleted [ 230.750138][T12253] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 230.763089][ T31] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 230.780373][T10235] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 230.793662][ T31] EXT4-fs error (device loop8): ext4_release_dquot:6971: comm kworker/u8:1: Failed to release dquot type 0 [ 230.805474][T10235] EXT4-fs error (device loop1): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 230.833803][T12253] EXT4-fs: Cannot change journaled quota options when quota turned on [ 230.848707][T12258] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.2971: lblock 0 mapped to illegal pblock 16 (length 1) [ 230.848743][T12253] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2973: lblock 0 mapped to illegal pblock 16 (length 1) [ 230.884263][T12258] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.2971: lblock 0 mapped to illegal pblock 16 (length 1) [ 230.901642][T12258] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.2971: lblock 0 mapped to illegal pblock 16 (length 1) [ 230.918790][ T1107] hid-generic 0000:FFFFFFFF:0000.0018: unknown main item tag 0x0 [ 230.927251][ T1107] hid-generic 0000:FFFFFFFF:0000.0018: hidraw0: HID v0.00 Device [syz1] on syz0 [ 230.947503][T12260] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2975'. [ 230.956605][T12260] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2975'. [ 231.014264][T12263] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2973: lblock 0 mapped to illegal pblock 16 (length 1) [ 231.039108][T12263] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2973: lblock 0 mapped to illegal pblock 16 (length 1) [ 231.053918][T12263] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2973: lblock 0 mapped to illegal pblock 16 (length 1) [ 231.115742][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 231.130292][ T3613] EXT4-fs error (device loop5): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 231.219696][ T3613] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 231.231501][ T3613] EXT4-fs error (device loop5): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 231.562155][T12271] FAULT_INJECTION: forcing a failure. [ 231.562155][T12271] name failslab, interval 1, probability 0, space 0, times 0 [ 231.574908][T12271] CPU: 1 UID: 0 PID: 12271 Comm: syz.6.2976 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 231.574940][T12271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 231.574953][T12271] Call Trace: [ 231.574959][T12271] [ 231.574966][T12271] __dump_stack+0x1d/0x30 [ 231.575131][T12271] dump_stack_lvl+0xe8/0x140 [ 231.575154][T12271] dump_stack+0x15/0x1b [ 231.575193][T12271] should_fail_ex+0x265/0x280 [ 231.575224][T12271] should_failslab+0x8c/0xb0 [ 231.575305][T12271] kmem_cache_alloc_noprof+0x50/0x310 [ 231.575325][T12271] ? getname_flags+0x80/0x3b0 [ 231.575377][T12271] getname_flags+0x80/0x3b0 [ 231.575410][T12271] do_sys_openat2+0x60/0x110 [ 231.575431][T12271] __x64_sys_openat+0xf2/0x120 [ 231.575524][T12271] x64_sys_call+0x1af/0x2fb0 [ 231.575545][T12271] do_syscall_64+0xd0/0x1b0 [ 231.575565][T12271] ? clear_bhb_loop+0x40/0x90 [ 231.575584][T12271] ? clear_bhb_loop+0x40/0x90 [ 231.575676][T12271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.575699][T12271] RIP: 0033:0x7fae3e6cd2d0 [ 231.575719][T12271] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 [ 231.575735][T12271] RSP: 002b:00007fae3ccf4f60 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 231.575752][T12271] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fae3e6cd2d0 [ 231.575763][T12271] RDX: 0000000000000000 RSI: 00007fae3e750bc9 RDI: 00000000ffffff9c [ 231.575775][T12271] RBP: 00007fae3e750bc9 R08: 0000000000000000 R09: 0000000000000000 [ 231.575786][T12271] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 231.575797][T12271] R13: 0000000000000000 R14: 00007fae3e8f6160 R15: 00007ffe1fdae7d8 [ 231.575816][T12271] [ 232.245389][ T29] kauditd_printk_skb: 487 callbacks suppressed [ 232.245404][ T29] audit: type=1326 audit(2000000086.145:7055): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12269 comm="syz.5.2977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 232.275423][ T29] audit: type=1326 audit(2000000086.145:7056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12269 comm="syz.5.2977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 232.299434][ T29] audit: type=1326 audit(2000000086.145:7057): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12269 comm="syz.5.2977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 232.323759][ T29] audit: type=1326 audit(2000000086.229:7058): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12269 comm="syz.5.2977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 232.348430][ T29] audit: type=1326 audit(2000000086.229:7059): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12269 comm="syz.5.2977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 232.372184][ T29] audit: type=1326 audit(2000000086.271:7060): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12269 comm="syz.5.2977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 232.395785][ T29] audit: type=1326 audit(2000000086.271:7061): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12269 comm="syz.5.2977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 232.419393][ T29] audit: type=1326 audit(2000000086.271:7062): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12269 comm="syz.5.2977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 232.443100][ T29] audit: type=1326 audit(2000000086.271:7063): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12269 comm="syz.5.2977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 232.466704][ T29] audit: type=1326 audit(2000000086.271:7064): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12269 comm="syz.5.2977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e12b9e969 code=0x7ffc0000 [ 232.605724][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 232.617054][T10253] EXT4-fs error (device loop8): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 233.449100][T10253] EXT4-fs error (device loop8) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 233.471094][T10253] EXT4-fs error (device loop8): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 233.583820][T12278] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2981'. [ 233.620391][T12278] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 233.632522][ T3325] syz_tun (unregistering): left allmulticast mode [ 233.685495][T12281] loop8: detected capacity change from 0 to 512 [ 233.697470][T12281] EXT4-fs: Ignoring removed mblk_io_submit option [ 233.731298][T12290] loop5: detected capacity change from 0 to 2048 [ 233.773134][T12281] EXT4-fs error (device loop8): ext4_orphan_get:1391: inode #15: comm syz.8.2979: iget: bad extended attribute block 1 [ 233.787618][T12290] loop5: p1 < > p4 [ 233.789899][T12290] loop5: p4 size 8388608 extends beyond EOD, truncated [ 233.819179][T12281] EXT4-fs error (device loop8): ext4_orphan_get:1396: comm syz.8.2979: couldn't read orphan inode 15 (err -117) [ 233.839160][T12298] macvlan2: entered promiscuous mode [ 233.844618][T12298] bridge0: entered promiscuous mode [ 233.852156][T12298] bridge0: port 3(macvlan2) entered blocking state [ 233.858758][T12298] bridge0: port 3(macvlan2) entered disabled state [ 233.865316][T12281] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 233.883569][T12299] loop6: detected capacity change from 0 to 128 [ 233.890235][T12298] macvlan2: entered allmulticast mode [ 233.895751][T12298] bridge0: entered allmulticast mode [ 233.902911][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 233.914339][T12299] EXT4-fs: quotafile must be on filesystem root [ 233.930240][T12298] macvlan2: left allmulticast mode [ 233.935502][T12298] bridge0: left allmulticast mode [ 233.938965][T12301] loop8: detected capacity change from 0 to 1024 [ 233.949533][T12301] EXT4-fs: Ignoring removed bh option [ 233.955136][T12301] EXT4-fs: inline encryption not supported [ 233.961829][T12298] bridge0: left promiscuous mode [ 233.963108][T12301] EXT4-fs (loop8): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 233.978669][T12301] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 233.994695][T12301] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 2: comm syz.8.2985: lblock 2 mapped to illegal pblock 2 (length 1) [ 234.011942][T12301] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 48: comm syz.8.2985: lblock 0 mapped to illegal pblock 48 (length 1) [ 234.026568][T12301] EXT4-fs error (device loop8): ext4_acquire_dquot:6935: comm syz.8.2985: Failed to acquire dquot type 0 [ 234.038793][T12301] EXT4-fs error (device loop8) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 234.055472][T12284] chnl_net:caif_netlink_parms(): no params data found [ 234.067109][T12301] EXT4-fs error (device loop8): ext4_evict_inode:259: inode #11: comm syz.8.2985: mark_inode_dirty error [ 234.084275][T12301] EXT4-fs warning (device loop8): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 234.095589][T12301] EXT4-fs (loop8): 1 orphan inode deleted [ 234.101874][T12301] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 234.116088][ T3438] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:7: lblock 1 mapped to illegal pblock 1 (length 1) [ 234.131085][ T3438] EXT4-fs error (device loop8): ext4_release_dquot:6971: comm kworker/u8:7: Failed to release dquot type 0 [ 234.145592][T12284] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.153299][T12284] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.154904][T12301] EXT4-fs: Cannot change journaled quota options when quota turned on [ 234.170022][T12314] loop6: detected capacity change from 0 to 512 [ 234.177827][T12284] bridge_slave_0: entered allmulticast mode [ 234.181043][T12301] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2985: lblock 0 mapped to illegal pblock 16 (length 1) [ 234.186064][T12284] bridge_slave_0: entered promiscuous mode [ 234.207233][T12314] EXT4-fs (loop6): 1 orphan inode deleted [ 234.207449][T12284] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.220280][T12284] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.227504][ T3438] EXT4-fs error (device loop6): ext4_release_dquot:6971: comm kworker/u8:7: Failed to release dquot type 1 [ 234.227606][T12284] bridge_slave_1: entered allmulticast mode [ 234.239464][T12314] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 234.245456][T12284] bridge_slave_1: entered promiscuous mode [ 234.260450][T12314] ext4 filesystem being mounted at /499/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 234.286497][T12284] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 234.296400][T12314] EXT4-fs (loop6): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 234.297450][T12284] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 234.315910][T12318] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2985: lblock 0 mapped to illegal pblock 16 (length 1) [ 234.336756][T12318] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2985: lblock 0 mapped to illegal pblock 16 (length 1) [ 234.337892][T12284] team0: Port device team_slave_0 added [ 234.357858][T12284] team0: Port device team_slave_1 added [ 234.369080][T12318] EXT4-fs error (device loop8): ext4_map_blocks:675: inode #2: block 16: comm syz.8.2985: lblock 0 mapped to illegal pblock 16 (length 1) [ 234.384407][T12284] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 234.391462][T12284] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 234.417565][T12284] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 234.428965][T12284] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 234.435907][T12284] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 234.462073][T12284] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 234.500921][T12321] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2989'. [ 234.510882][T12321] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2989'. [ 234.531769][T12284] hsr_slave_0: entered promiscuous mode [ 234.541621][T12284] hsr_slave_1: entered promiscuous mode [ 234.548308][T12284] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 234.556697][T12284] Cannot create hsr debugfs directory [ 234.631117][T12284] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 234.639952][T12284] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 234.648553][T12284] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 234.660254][T12284] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 234.754521][ T4905] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 234.755516][T10253] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 234.765440][T12284] 8021q: adding VLAN 0 to HW filter on device bond0 [ 234.784429][T10253] EXT4-fs error (device loop8): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 234.792110][T12284] 8021q: adding VLAN 0 to HW filter on device team0 [ 234.809901][T10253] EXT4-fs error (device loop8) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 234.821280][T10253] EXT4-fs error (device loop8): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 234.856617][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.860761][ T3396] hid-generic 0000:FFFFFFFF:0000.0019: unknown main item tag 0x0 [ 234.864049][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 234.865819][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.886139][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 234.929654][T12284] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 234.940357][T12284] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 234.994066][ T3396] hid-generic 0000:FFFFFFFF:0000.0019: hidraw0: HID v0.00 Device [syz1] on syz0 [ 235.013445][T12351] loop1: detected capacity change from 0 to 1024 [ 235.020190][T12351] EXT4-fs: Ignoring removed bh option [ 235.025608][T12351] EXT4-fs: inline encryption not supported [ 235.039828][T12351] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 235.057912][T12354] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3003'. [ 235.068170][T12284] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 235.078597][T12354] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 235.102332][T12351] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 235.119460][T12351] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #3: block 2: comm syz.1.3002: lblock 2 mapped to illegal pblock 2 (length 1) [ 235.137078][T12351] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #3: block 48: comm syz.1.3002: lblock 0 mapped to illegal pblock 48 (length 1) [ 235.153761][T12351] EXT4-fs error (device loop1): ext4_acquire_dquot:6935: comm syz.1.3002: Failed to acquire dquot type 0 [ 235.160141][T12364] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3005'. [ 235.174667][T12351] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 235.199757][T12364] loop5: detected capacity change from 0 to 512 [ 235.206312][T12364] ext4: Unknown parameter 'subj_user' [ 235.212242][T12351] EXT4-fs error (device loop1): ext4_evict_inode:259: inode #11: comm syz.1.3002: mark_inode_dirty error [ 235.241745][T12351] EXT4-fs warning (device loop1): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 235.252555][T12351] EXT4-fs (loop1): 1 orphan inode deleted [ 235.259306][T12351] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 235.273007][T12371] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 235.273418][ T41] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 235.300566][T12351] EXT4-fs: Cannot change journaled quota options when quota turned on [ 235.311136][T12351] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.3002: lblock 0 mapped to illegal pblock 16 (length 1) [ 235.331456][ T41] EXT4-fs error (device loop1): ext4_release_dquot:6971: comm kworker/u8:2: Failed to release dquot type 0 [ 235.372921][T12284] veth0_vlan: entered promiscuous mode [ 235.382125][T12284] veth1_vlan: entered promiscuous mode [ 235.398147][T12284] veth0_macvtap: entered promiscuous mode [ 235.406799][T12284] veth1_macvtap: entered promiscuous mode [ 235.420850][T12284] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 235.431722][T12385] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.3002: lblock 0 mapped to illegal pblock 16 (length 1) [ 235.450456][T12284] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 235.459343][T12385] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.3002: lblock 0 mapped to illegal pblock 16 (length 1) [ 235.459413][T12386] tipc: Enabling of bearer rejected, failed to enable media [ 235.483740][T12284] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.492544][T12284] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.501283][T12284] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.510042][T12284] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.531256][T12385] EXT4-fs error (device loop1): ext4_map_blocks:675: inode #2: block 16: comm syz.1.3002: lblock 0 mapped to illegal pblock 16 (length 1) [ 235.621911][T12396] bridge0: entered promiscuous mode [ 235.638119][T12396] macvlan2: entered promiscuous mode [ 235.645061][T12396] bridge0: port 3(macvlan2) entered blocking state [ 235.651870][T12396] bridge0: port 3(macvlan2) entered disabled state [ 235.659521][T12400] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3014'. [ 235.662317][T12396] macvlan2: entered allmulticast mode [ 235.674259][T12396] bridge0: entered allmulticast mode [ 235.680567][T12403] loop9: detected capacity change from 0 to 128 [ 235.687744][T12403] EXT4-fs: quotafile must be on filesystem root [ 235.695026][T12396] macvlan2: left allmulticast mode [ 235.700180][T12396] bridge0: left allmulticast mode [ 235.707532][T12396] bridge0: left promiscuous mode [ 235.719903][T12400] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 235.822168][T10235] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 235.844555][T10235] EXT4-fs error (device loop1): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 235.864997][T10235] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 235.875699][T10235] EXT4-fs error (device loop1): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 235.989906][T12430] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3027'. [ 236.002108][T12430] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3027'. [ 236.077388][T12438] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3031'. [ 236.089839][T12438] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 236.173882][T12445] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3033'. [ 236.298643][T12454] macvlan2: entered promiscuous mode [ 236.304119][T12454] bridge0: entered promiscuous mode [ 236.317427][T12454] bridge0: port 3(macvlan2) entered blocking state [ 236.324326][T12454] bridge0: port 3(macvlan2) entered disabled state [ 236.331327][T12449] loop1: detected capacity change from 0 to 512 [ 236.364258][T12449] ext4: Unknown parameter 'subj_user' [ 236.464921][T12454] macvlan2: entered allmulticast mode [ 236.470551][T12454] bridge0: entered allmulticast mode [ 236.500137][T12454] macvlan2: left allmulticast mode [ 236.505578][T12454] bridge0: left allmulticast mode [ 236.610580][T12454] bridge0: left promiscuous mode [ 237.085781][T12476] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 237.339013][T12485] tipc: Enabling of bearer rejected, failed to enable media [ 237.571335][ T29] kauditd_printk_skb: 391 callbacks suppressed [ 237.571353][ T29] audit: type=1400 audit(2000000092.762:7449): avc: denied { ioctl } for pid=12489 comm="syz.9.3051" path="socket:[39141]" dev="sockfs" ino=39141 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 237.654040][T12498] loop9: detected capacity change from 0 to 512 [ 237.697632][T12496] loop6: detected capacity change from 0 to 512 [ 237.715229][T12498] ext4: Unknown parameter 'subj_user' [ 237.726320][T12496] EXT4-fs: Ignoring removed mblk_io_submit option [ 237.749738][T12496] EXT4-fs error (device loop6): ext4_orphan_get:1391: inode #15: comm syz.6.3052: iget: bad extended attribute block 1 [ 237.770281][T12496] EXT4-fs error (device loop6): ext4_orphan_get:1396: comm syz.6.3052: couldn't read orphan inode 15 (err -117) [ 237.833497][T12503] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 237.906827][T12511] macvlan2: entered promiscuous mode [ 237.912268][T12511] bridge0: entered promiscuous mode [ 237.918201][T12511] bridge0: port 3(macvlan2) entered blocking state [ 237.925146][T12511] bridge0: port 3(macvlan2) entered disabled state [ 237.932037][T12511] macvlan2: entered allmulticast mode [ 237.937467][T12511] bridge0: entered allmulticast mode [ 237.943253][T12511] macvlan2: left allmulticast mode [ 237.948385][T12511] bridge0: left allmulticast mode [ 237.954680][T12518] loop6: detected capacity change from 0 to 128 [ 237.962984][T12511] bridge0: left promiscuous mode [ 237.963088][T12518] EXT4-fs: quotafile must be on filesystem root [ 237.995348][ T29] audit: type=1400 audit(2000000093.214:7450): avc: denied { connect } for pid=12520 comm="syz.5.3063" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 238.075373][T12533] loop6: detected capacity change from 0 to 512 [ 238.081839][T12533] ext4: Unknown parameter 'subj_user' [ 238.110951][T12534] bridge_slave_0: left allmulticast mode [ 238.116728][T12534] bridge_slave_0: left promiscuous mode [ 238.122545][T12534] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.132144][T12534] bridge_slave_1: left allmulticast mode [ 238.137924][T12534] bridge_slave_1: left promiscuous mode [ 238.143881][T12534] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.155209][T12534] bond0: (slave bond_slave_0): Releasing backup interface [ 238.164211][T12534] bond0: (slave bond_slave_1): Releasing backup interface [ 238.173363][T12534] team0: Port device team_slave_0 removed [ 238.180809][T12534] team0: Port device team_slave_1 removed [ 238.186811][T12534] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 238.194796][T12534] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 238.208090][T12536] macvlan2: entered promiscuous mode [ 238.213625][T12536] bridge0: entered promiscuous mode [ 238.221119][T12536] bridge0: port 3(macvlan2) entered blocking state [ 238.227809][T12536] bridge0: port 3(macvlan2) entered disabled state [ 238.234918][T12536] macvlan2: entered allmulticast mode [ 238.240648][T12536] bridge0: entered allmulticast mode [ 238.246479][T12536] macvlan2: left allmulticast mode [ 238.251623][T12536] bridge0: left allmulticast mode [ 238.257924][T12536] bridge0: left promiscuous mode [ 238.481008][ T29] audit: type=1326 audit(2000000093.718:7451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12550 comm="syz.8.3073" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 238.536511][ T29] audit: type=1326 audit(2000000093.749:7452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12550 comm="syz.8.3073" exe="/root/syz-executor" sig=0 arch=c000003e syscall=103 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 238.560357][ T29] audit: type=1326 audit(2000000093.749:7453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12550 comm="syz.8.3073" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 238.583986][ T29] audit: type=1326 audit(2000000093.749:7454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12550 comm="syz.8.3073" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 238.608357][ T29] audit: type=1326 audit(2000000093.749:7455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12550 comm="syz.8.3073" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 238.631036][T12560] __nla_validate_parse: 5 callbacks suppressed [ 238.631053][T12560] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3077'. [ 238.633152][ T29] audit: type=1326 audit(2000000093.749:7456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12550 comm="syz.8.3073" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 238.644399][T12560] loop6: detected capacity change from 0 to 512 [ 238.648352][ T29] audit: type=1326 audit(2000000093.749:7457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12550 comm="syz.8.3073" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 238.675870][T12560] ext4: Unknown parameter 'subj_user' [ 238.678048][ T29] audit: type=1326 audit(2000000093.749:7458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12550 comm="syz.8.3073" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe3d767e969 code=0x7ffc0000 [ 238.793170][T12567] loop9: detected capacity change from 0 to 128 [ 238.908566][T12573] loop6: detected capacity change from 0 to 1024 [ 238.933735][T12573] ext4 filesystem being mounted at /520/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 238.933907][T12577] loop5: detected capacity change from 0 to 1024 [ 238.965154][T12577] EXT4-fs: Ignoring removed bh option [ 238.970924][T12577] EXT4-fs: inline encryption not supported [ 238.983691][T12573] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3082'. [ 238.992771][T12573] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3082'. [ 239.005334][T12577] EXT4-fs (loop5): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 239.024909][T12577] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 239.034503][T12577] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #3: block 2: comm syz.5.3085: lblock 2 mapped to illegal pblock 2 (length 1) [ 239.050401][T12577] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #3: block 48: comm syz.5.3085: lblock 0 mapped to illegal pblock 48 (length 1) [ 239.066374][T12577] EXT4-fs error (device loop5): ext4_acquire_dquot:6935: comm syz.5.3085: Failed to acquire dquot type 0 [ 239.079348][T12577] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 239.091648][T12577] EXT4-fs error (device loop5): ext4_evict_inode:259: inode #11: comm syz.5.3085: mark_inode_dirty error [ 239.104872][T12577] EXT4-fs warning (device loop5): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 239.115409][T12577] EXT4-fs (loop5): 1 orphan inode deleted [ 239.125633][T12577] EXT4-fs mount: 3 callbacks suppressed [ 239.125647][T12577] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 239.140667][ T41] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:2: lblock 1 mapped to illegal pblock 1 (length 1) [ 239.151944][T12577] EXT4-fs: Cannot change journaled quota options when quota turned on [ 239.158281][ T41] EXT4-fs error (device loop5): ext4_release_dquot:6971: comm kworker/u8:2: Failed to release dquot type 0 [ 239.172748][T12577] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.3085: lblock 0 mapped to illegal pblock 16 (length 1) [ 239.202901][ T4905] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 239.322014][T12594] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.3085: lblock 0 mapped to illegal pblock 16 (length 1) [ 239.340285][T12594] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.3085: lblock 0 mapped to illegal pblock 16 (length 1) [ 239.356880][T12594] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.3085: lblock 0 mapped to illegal pblock 16 (length 1) [ 239.709717][T12599] netlink: 12 bytes leftover after parsing attributes in process `syz.9.3092'. [ 239.724236][T12599] loop9: detected capacity change from 0 to 512 [ 239.740885][T12599] ext4: Unknown parameter 'subj_user' [ 239.748262][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 239.759740][ T3613] EXT4-fs error (device loop5): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 239.774748][ T3613] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 239.785580][ T3613] EXT4-fs error (device loop5): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 239.835096][T12603] loop5: detected capacity change from 0 to 1024 [ 239.843309][T12603] EXT4-fs: Ignoring removed bh option [ 239.849186][T12603] EXT4-fs: inline encryption not supported [ 239.859810][T12603] EXT4-fs (loop5): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 239.871078][T12603] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c80ce018, mo2=0000] [ 239.881361][T12603] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #3: block 2: comm syz.5.3094: lblock 2 mapped to illegal pblock 2 (length 1) [ 239.898542][T12603] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #3: block 48: comm syz.5.3094: lblock 0 mapped to illegal pblock 48 (length 1) [ 239.913387][T12603] EXT4-fs error (device loop5): ext4_acquire_dquot:6935: comm syz.5.3094: Failed to acquire dquot type 0 [ 239.924907][T12603] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 239.934867][T12603] EXT4-fs error (device loop5): ext4_evict_inode:259: inode #11: comm syz.5.3094: mark_inode_dirty error [ 239.946470][T12603] EXT4-fs warning (device loop5): ext4_evict_inode:262: couldn't mark inode dirty (err -117) [ 239.957268][T12603] EXT4-fs (loop5): 1 orphan inode deleted [ 239.963550][T12603] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 239.985381][ T31] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #3: block 1: comm kworker/u8:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 240.011066][T12603] EXT4-fs: Cannot change journaled quota options when quota turned on [ 240.025735][ T31] EXT4-fs error (device loop5): ext4_release_dquot:6971: comm kworker/u8:1: Failed to release dquot type 0 [ 240.059656][T12603] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.3094: lblock 0 mapped to illegal pblock 16 (length 1) [ 240.181824][T12626] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.3094: lblock 0 mapped to illegal pblock 16 (length 1) [ 240.299154][T12611] bridge_slave_0: left allmulticast mode [ 240.305218][T12611] bridge_slave_0: left promiscuous mode [ 240.310943][T12611] bridge0: port 1(bridge_slave_0) entered disabled state [ 240.322810][T12629] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.3094: lblock 0 mapped to illegal pblock 16 (length 1) [ 241.332953][T12632] EXT4-fs error (device loop5): ext4_map_blocks:675: inode #2: block 16: comm syz.5.3094: lblock 0 mapped to illegal pblock 16 (length 1) [ 241.400562][T12611] bridge_slave_1: left allmulticast mode [ 241.406328][T12611] bridge_slave_1: left promiscuous mode [ 241.411979][T12611] bridge0: port 2(bridge_slave_1) entered disabled state [ 241.430021][T12611] bond0: (slave bond_slave_0): Releasing backup interface [ 241.440962][T12611] bond0: (slave bond_slave_1): Releasing backup interface [ 241.450410][ T3613] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 241.460085][ T3613] EXT4-fs error (device loop5): __ext4_get_inode_loc:4450: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 241.461340][T12611] team0: Port device team_slave_0 removed [ 241.480057][ T3613] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5899: Corrupt filesystem [ 241.490398][ T3613] EXT4-fs error (device loop5): ext4_quota_off:7219: inode #3: comm syz-executor: mark_inode_dirty error [ 241.492764][T12611] team0: Port device team_slave_1 removed [ 241.509090][T12611] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 241.516796][T12611] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 241.526226][T12611] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 241.533847][T12611] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 241.549763][ T3580] hid-generic 0000:FFFFFFFF:0000.001A: unknown main item tag 0x0 [ 241.563196][ T3580] hid-generic 0000:FFFFFFFF:0000.001A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 241.581653][T12637] tipc: Enabling of bearer rejected, failed to enable media [ 241.860716][T12661] loop6: detected capacity change from 0 to 1024 [ 241.901252][T12661] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 241.921659][T12665] bridge0: entered promiscuous mode [ 241.925023][T12661] ext4 filesystem being mounted at /530/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 241.926986][T12665] macvlan2: entered promiscuous mode [ 241.943271][T12665] bridge0: port 1(macvlan2) entered blocking state [ 241.949947][T12665] bridge0: port 1(macvlan2) entered disabled state [ 241.956814][T12665] macvlan2: entered allmulticast mode [ 241.962401][T12665] bridge0: entered allmulticast mode [ 241.973692][T12665] macvlan2: left allmulticast mode [ 241.979121][T12665] bridge0: left allmulticast mode [ 241.985482][T12665] bridge0: left promiscuous mode [ 242.109695][T12661] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3114'. [ 242.144638][T12661] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3114'. [ 242.153855][T12661] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3114'. [ 242.311383][T12682] netlink: 60 bytes leftover after parsing attributes in process `syz.9.3118'. [ 242.355344][ T29] kauditd_printk_skb: 524 callbacks suppressed [ 242.355471][ T29] audit: type=1400 audit(2000000097.793:7977): avc: denied { unmount } for pid=4905 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 242.388320][ T4905] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 242.402799][ T29] audit: type=1326 audit(2000000097.845:7978): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12683 comm="syz.9.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f421c3de969 code=0x7ffc0000 [ 242.426539][ T29] audit: type=1326 audit(2000000097.845:7979): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12683 comm="syz.9.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f421c3de969 code=0x7ffc0000 [ 242.547537][ T29] audit: type=1326 audit(2000000097.845:7980): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12683 comm="syz.9.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=428 compat=0 ip=0x7f421c3de969 code=0x7ffc0000 [ 242.571325][ T29] audit: type=1326 audit(2000000097.845:7981): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12683 comm="syz.9.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f421c3de969 code=0x7ffc0000 [ 242.594878][ T29] audit: type=1326 audit(2000000097.845:7982): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12683 comm="syz.9.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f421c3de969 code=0x7ffc0000 [ 242.618598][ T29] audit: type=1326 audit(2000000097.845:7983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12683 comm="syz.9.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f421c3de969 code=0x7ffc0000 [ 242.642132][ T29] audit: type=1326 audit(2000000097.845:7984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12683 comm="syz.9.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f421c3de969 code=0x7ffc0000 [ 242.651088][T12693] tipc: Enabling of bearer rejected, failed to enable media [ 242.665816][ T29] audit: type=1326 audit(2000000097.845:7985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12683 comm="syz.9.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f421c3de969 code=0x7ffc0000 [ 242.698463][ T29] audit: type=1326 audit(2000000097.845:7986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12683 comm="syz.9.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f421c3de969 code=0x7ffc0000 [ 242.891365][T12706] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 242.902397][T12707] vhci_hcd: invalid port number 15 [ 242.907564][T12707] vhci_hcd: USB_PORT_FEAT_LINK_STATE req not supported for USB 2.0 roothub [ 242.911276][T12706] infiniband srz1: RDMA CMA: cma_listen_on_dev, error -98 [ 242.963770][T12712] loop9: detected capacity change from 0 to 2048 [ 243.056721][T12711] loop1: detected capacity change from 0 to 512 [ 243.078801][T12711] EXT4-fs: Ignoring removed mblk_io_submit option [ 243.086030][T12721] netlink: 14 bytes leftover after parsing attributes in process `syz.6.3132'. [ 243.132762][T12711] EXT4-fs error (device loop1): ext4_orphan_get:1391: inode #15: comm syz.1.3130: iget: bad extended attribute block 1 [ 243.153832][T12711] EXT4-fs error (device loop1): ext4_orphan_get:1396: comm syz.1.3130: couldn't read orphan inode 15 (err -117) [ 243.177589][T12722] ================================================================== [ 243.185932][T12722] BUG: KCSAN: data-race in memcpy_and_pad / rcu_tasks_trace_pregp_step [ 243.194204][T12722] [ 243.196528][T12722] write to 0xffff8881036a845c of 4 bytes by task 28 on cpu 0: [ 243.204072][T12722] rcu_tasks_trace_pregp_step+0x1ac/0x920 [ 243.209809][T12722] rcu_tasks_wait_gp+0x88/0x530 [ 243.214666][T12722] rcu_tasks_one_gp+0x7f3/0x8e0 [ 243.219631][T12722] rcu_tasks_kthread+0xf7/0x110 [ 243.224493][T12722] kthread+0x486/0x510 [ 243.228562][T12722] ret_from_fork+0x4e/0x60 [ 243.232984][T12722] ret_from_fork_asm+0x1a/0x30 [ 243.237785][T12722] [ 243.240109][T12722] read to 0xffff8881036a8000 of 3200 bytes by task 12722 on cpu 1: [ 243.248092][T12722] memcpy_and_pad+0x48/0x80 [ 243.252607][T12722] arch_dup_task_struct+0x2c/0x40 [ 243.257839][T12722] dup_task_struct+0x83/0x6a0 [ 243.262550][T12722] copy_process+0x399/0x1fe0 [ 243.267171][T12722] kernel_clone+0x16c/0x5b0 [ 243.271686][T12722] __se_sys_clone3+0x1c2/0x200 [ 243.277097][T12722] __x64_sys_clone3+0x31/0x40 [ 243.281797][T12722] x64_sys_call+0x10c9/0x2fb0 [ 243.286566][T12722] do_syscall_64+0xd0/0x1b0 [ 243.291264][T12722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.297166][T12722] [ 243.299483][T12722] Reported by Kernel Concurrency Sanitizer on: [ 243.305726][T12722] CPU: 1 UID: 0 PID: 12722 Comm: syz.9.3135 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(voluntary) [ 243.318069][T12722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 243.328316][T12722] ================================================================== [ 243.343174][T12711] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 243.424737][T12725] EXT4-fs error (device loop1): ext4_validate_block_bitmap:432: comm ext4lazyinit: bg 0: block 13: invalid block bitmap [ 243.573097][T12729] netlink: 'syz.1.3130': attribute type 1 has an invalid length. [ 243.581020][T12729] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3130'. [ 243.758620][T10235] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.