last executing test programs:

4m8.060532379s ago: executing program 3 (id=26):
openat$autofs(0xffffffffffffff9c, 0x0, 0xc2041, 0x0)
pipe(&(0x7f0000000080))
socket$nl_netfilter(0x10, 0x3, 0xc)
openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000700000000000000000000850000002300000095"], 0x0, 0x4}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r0}, 0x18)
bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50)
r1 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0)
syz_mount_image$iso9660(&(0x7f0000000040), &(0x7f0000000800)='./file0\x00', 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="757466382c626c6f636b3d307830303030303030303030303030323030006e6f726f636b2c63727566742c6d61703d6f66662c646d6f64653d3078303430303030303030303030303063664173657373696f6e3d3078303030303030303030303030303033382c756e686964652c756e686964652c6769643d29e0cd5c372ab078c28fb05c6421428d066455368833565fd726743513f4466efa8d4fba06d57341875f5775ab343c0f6bc59fbde784ec3597e0e286d8d0dbf360afa3bc5c145b6e4f8b0305932fb55ff13f9fcb5035769f5fca33ac02bdeacb24c58103edc3d8b46df7614aa493952584ee662174309b11a4ad19e64dcdeeca1c148170b8d1aaf26082364b0d90d63d8502ffa63dde945e4612ac134315f389af667a04931ad25ff10b9b5107e517dbbcf5dcb60f564f54b344218d9325b53e829c38c96c69adc9e745202923a1b8124333cce0a8f1c748d42a272eb3e5502051090f1ac34fe5e8f038", @ANYBLOB="0949529140986a926d45", @ANYBLOB="dd99401b1f441a835c3dfe053e0e094515e504b6316f2a67a040e860c8118441fc09df1fd193dfa63fcceb82dbd8c0c71b933214389bdf97fd6c3e72b4b836a0ee9b4d75f459e9e7a400ad5c01c749b8e8c6fc439e19077b742f12af535044eab14e1a16e1ed9b2552408b230507bb3d8db6c4b28f2bc0e55df68ae70f3f51e1a6f9a3931a26f5"], 0x2, 0x699, &(0x7f0000000140)="$eJzs3V9rG9n9x/HPyLIte3+E5dcSQsifk6QLDk2VkbxxMCl01dHInlbSiBm52FBY0o29hMjZNkmh8c3WN/0D2yfQu970og+i0Ot9Fr0pLSztXaE3KnNmJEvRv3ijOLvN+2V2NTrznTnfmaPoy9iaIwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADle1XVLjupBc2fXTOZVo7AxZX26t0XdTBduzuxXcpL/VCjoQtp04Zsnq88n/7uuS+mzSyokDwUdvXP+3XvfyOd6209J6MvQaXf49PnRo/udzv6Tl4hd0Kl3/yYp11taycZkTNCW3wziMGhUtnwTxKHZ3Nhwb2/XYlML6n68F7f9hvEiP9cOI7Pm3TSlzc114xf3wp3mVrVS93uNd79Tdt0N84PldKAlFWNvO6jXg+aWjUlWJzF3zWc/TgP8SsOYg4ed/fVZR5IElV4mqDwrqOyWy6VSuVzauLN5567r5kca3ITj9mkkYu4vWnzNzOeNG5iDXFL//+pIdRXU1I52Zcb+eKoqUqjGhPWZXv1/77Y/td/B+t+r8hek72WrL8rW/yvpsyuT6v+EXIyM3WDcGmdC++l+Fm1GRk/1XEd6pPvqqKN9PZnDvo3M1bns5Qx+tuSrqUCxQgVqqGJbTNZitKkNbcjVh9pWTbGMagpUl69Ye4rVlm9fUZ4i+aqorVCRjNbk6aaMStrUptZl5KuoPYXaUVNbqqqif3e73QM9tOd9fUqO6gWVJgQsDwaVp+xpUv3/yafp6zSr/y71/22Vvg6W04fPp8UAXwHd7Pp/UG72ZldfX0YAAAAAAGDeHPvbd8f+7f6ypK5qQd1333RaAAAAAABgjhx1l3VJTnL9L+myHK7/AQAAAAD4X+PYe+wcSav2Q/3OyZ1QL/NLgIUzSBEAAAAAALwie+f/lSWpayetuCrnVNf/AAAAAADga+A3A3Ps53tz7HZ7f9bPSYpby86f/7msaNE5bu1+yzmsJGsqh1nMyCcA2rWLzrlsol77sCTJPvP8S07WWzYJZn/ewS8OZs3170QvJLC0MLiDCQk4Sc8b+eyZPtO1dJNr2TzzD45ysmvSXlZrQd0vemH9XkmVyrlc299t//zxw19IUf84Dx529osffdJ5YHM5TpqOD5OdfjqUTm78yTjJ5Zmdb8HeczHuiFdU63X522Zj1bH9ur3jX1DlMDfY0bQBOOnzV7qejtn11TR29ag/435y/IXk+EtFO2RDRx8tOidZlF488nEDMSGLgs3iRhpzY+2Gyn9Ll/ujkHMK316QysXRMRjKojyYxexz4fxr5FwMZGEfemsGzsV6ksVfkh1NyGL9dFmMjAgAvCkHuiz7LnRZdhLzfhUqZHW3Vx56b2pfqu7Mru4fDFf3Z7/vdu0GC1I++9vE1F4KSt7R1xxbh5bSQ8pfHPOO7mZ1paAJ7+juK1S3pK8/nXwHUpb2SBb/6Xa790q239+9UFX/MNTdSL9xvbyQnMLbzw5/aifAT3y8//H+43J5fcN933XvlLVoDyN7WBC1BwAwYvZ37MyMcN7XtTTi2oN/vJcuDVW8/+9/pKCoj/SJOnqgW72vELg6fq+rAx9DuJVetWrgqtWcf/ee/V664diSbk28qrO1dCC23I9dVG+T4Up9Erv+mkcBAICzdX1GHR5f/wtD9f+W1tKItYtjr7uHa3l2ddy/pJ8UW5qd/AfzPhsAALwd/OgLZ7X9ayeKgtaHpc3NUqW97Zso9H5ooqC65Zug2fYjb7vS3PJNKwrboRfWTSvSclD1YxPvtFph1Da1MDKtMA527Te/m+yr32O/UWm2Ay9u1f1K7BsvbLYrXttUg9gzrZ3v14N424/sxnHL94Ja4FXaQdg0cbgTeX7RmNj3BwKDqt9sB7UgWWyaVhQ0KtGe+VFY32n4purHXhS02mG6w15fQbMWRg2722K+O+7zAgAAvHWePj96dL/T2X/y4sJKcmmethxrQszowpKePk+uypOWfLaKOYIAAPiKOSngp9io8BoTAgAAAAAAAAAAAAAAAAAAAAAAI2bf0nfKhcVxNwtK/Zafncta9Eud3GI4sh9H807sNAu5027VuyXi6NHnU4JX+i290z8Yc3xmB/j3/5PesS1KW/Lz72tlyuC+joXvHqRndGJMsnLsquX+WOTn/88hWXj8xwmrut1ud/rmy8PncGnaAQ4v5CU9WXqFITj79yIAZ+u/AQAA//9b5DOa")
write$binfmt_script(r1, &(0x7f00000012c0)={'#! ', './file0'}, 0xb)
execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000)
socket$inet_sctp(0x2, 0x1, 0x84)
socket$inet_sctp(0x2, 0x5, 0x84)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r3)
getsockname$packet(r3, &(0x7f0000000180)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14)
sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xffdff7e8, 0x0, 0x3}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffffb}, 0x2, r4}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x20008000}, 0x0)
r5 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010102}]}, &(0x7f0000000180)=0x10)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8)
write(0xffffffffffffffff, 0x0, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x2, 0x0, @multicast1=0xe000cc02}})
openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ppoll(&(0x7f0000000300)=[{0xffffffffffffffff, 0x4236}], 0x1, 0x0, 0x0, 0x0)

4m7.213008777s ago: executing program 3 (id=32):
syz_read_part_table(0x104c, &(0x7f00000002c0)="$eJzsz7GpAkEUhtF/HrtPQZApQWOrGFNNjWzCEgRrMdAeRVkNNDEUFM7JhrnfhRu+yDXJ+N3n5PWxuuxGyX42z6H93aMyhK3muFxkWpPtMLYuObX/lNqne4T9c0eXzflztwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA77gFAAD///krCKU=")
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001380)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = syz_open_dev$vcsa(&(0x7f0000000140), 0x4, 0x40)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000001440)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYRES16=r0, @ANYRES64=r1, @ANYRES32=0x0], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_generate\x00', r3}, 0x10)
rt_sigprocmask(0x0, &(0x7f0000000100)={[0xfffffffffffe]}, 0x0, 0x8)
r4 = gettid()
timer_create(0x2, &(0x7f0000000180)={0x0, 0x1e, 0x4, @tid=r4}, &(0x7f00000000c0)=<r5=>0x0)
timer_settime(r5, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0)
timer_settime(0x0, 0x1, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0)

4m7.047092094s ago: executing program 3 (id=39):
r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x24, 0x1, 0x0, 0x0, 0x0, 0x7, 0x1f0519, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x3}, 0x6025, 0x4005, 0xb, 0x3, 0x2, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket(0x2b, 0x1, 0x1)
ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x82307201, &(0x7f0000000080)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}])
setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, 0x0, 0x0)
mmap$perf(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x4000011, r0, 0x0)
perf_event_open(&(0x7f0000001d00)={0x2, 0x80, 0x26, 0x1, 0x0, 0x0, 0x0, 0x7, 0xed1ca, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x1, @perf_bp={0x0}, 0x120, 0x10000, 0x33f8, 0x1, 0x8, 0xd, 0x8b, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, r0, 0x2)
socket$key(0xf, 0x3, 0x2)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40107447, 0x0)

4m6.965001457s ago: executing program 3 (id=40):
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r0, &(0x7f0000000d40)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x5}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000040)="a4", 0x1}], 0x1}}], 0x1, 0x0)
shutdown(r0, 0x1)
setsockopt(r0, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000000", 0x8)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=<r2=>r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000580)='kmem_cache_free\x00', r3}, 0x18)
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]})
bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRESHEX=r2, @ANYRES64], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f00000007c0)='kmem_cache_free\x00', r4}, 0x18)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
io_getevents(0x0, 0x1, 0x1, &(0x7f0000000280)=[{}], 0x0)
io_submit(0x0, 0x1, &(0x7f00000001c0)=[&(0x7f0000001940)={0x0, 0x0, 0x0, 0x7, 0x2, 0xffffffffffffffff, 0x0, 0x0, 0x5}])
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x2000c16, &(0x7f0000000040)={[{@nobh}, {@usrjquota}]}, 0xff, 0x240, &(0x7f00000002c0)="$eJzs3T1oO2UcB/DvXRL/tg1SdRHEFxARLZS6CS51UShIKSKCChURF6UVaotb6+TioLNKJ5ciblZH6VJcFMGpaoe6CFocLA46RJJrpbYRX1Jz4n0+cLm75J77Pcfd97kQOBKgsaaTzCdpJZlJ0klSnN/gzmqaPl3dnthfTnq9x34oBttV65WzdlNJtpI8kGSvLPJCO9nYferop4NH7nl9vXP3u7tPToz1IE8dHx0+evLO4msfLNy/8dkX3y0WmU/3d8d19Yoh77WL5KZ/o9h/RNGuuwf8FUuvvP9lP/c3J7lrkP9OylQn74216/Y6ue/tP2r75vef3zrOvgJXr9fr9O+BWz2gccok3RTlbJJquSxnZ6vv8F+1JssXV9dennl+dX3lubpHKuCqdJPDhz+69uHUhfx/26ryD/xPVT9KHT6+tPN1f+GkVXeHgLG4rZr17/8zz2zeG/mHxpF/aC75h+aSf2gu+Yfmkn9oLvmH5pJ/aC75h+aSf2iu8/kHAJqld63uJ5CButQ9/gAAAAAAAAAAAAAAAAAAAJdtT+wvn03jqvnJW8nxQ0naw+q3Bv9HnFw/eJ38sehv9puiajaSp+8YcQcjeq/mp69v+Kbe+p/eXm/9zZVk69Ukc+325euvOL3+/rkb/+TzzrMjFvibigvrDz4x3voX/bJTb/2Fg+Tj/vgzN2z8KXPLYD58/On2z9+I9V/6ecQdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDa/BgAA//8YZW08")
perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0xb76e}, 0x100002, 0x6, 0xfffffffc, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000540)='rss_stat\x00'}, 0x18)
r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
write$binfmt_script(r5, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r5, 0x0)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
dup(r7)
syz_clone(0x22080400, 0x0, 0x3b, 0x0, 0x0, 0x0)
ioctl$FICLONERANGE(r6, 0x4020940d, &(0x7f0000000340)={{r5}, 0x7, 0x8000, 0x7})
socket(0x2c, 0x3, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17)

4m6.857119632s ago: executing program 3 (id=41):
r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0)
r2 = dup3(r0, r1, 0x0)
ioctl$MON_IOCX_MFETCH(r2, 0xc0109207, &(0x7f0000000200)={&(0x7f00000001c0)=[0x0], 0x1, 0x4})
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x3, 0x60, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000008c0)='kfree\x00', r4}, 0x18)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01080000000000000000020000000900020073797a2a0000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x40000)
sendmsg$NFT_BATCH(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x1}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="7f0000000000000000000000feffffff18010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000a3500000850000000600000085000000080000009500000000080000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000002000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r6}, 0x10)
bpf$MAP_CREATE(0x600000000000000, &(0x7f00000004c0)=@base={0xf, 0x4, 0x4, 0x20002, 0x0, 0x1, 0xfffffff9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x50)
syz_io_uring_setup(0x45b4, &(0x7f00000035c0)={0x0, 0xfffffffc, 0x10100}, &(0x7f0000000140), &(0x7f0000000040))
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
r7 = socket$inet(0x2, 0x2, 0x1)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48)
r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0xe, &(0x7f00000001c0)={@mcast1, <r10=>0x0}, &(0x7f0000000200)=0x14)
r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x6, '\x00', r10, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe68, 0x0, r9, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r11}, 0x10)
sendmsg$inet(r7, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000100)="96bc1480bb58", 0x6}], 0x2, &(0x7f0000000240)=[@ip_retopts={{0x10}}], 0x10}, 0x40010)
r12 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETRULE(r12, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000060000050900010073797a300000000000000000000000000000000000a0ad0854bb7430d6764221669df01ed7ec1c38d8eaa297bdec16274329"], 0x20}, 0x1, 0x0, 0x0, 0xf5c6694fe9d33e8a}, 0x4040080)
ioctl$HIDIOCSREPORT(0xffffffffffffffff, 0x400c4808, &(0x7f0000000180)={0x2, 0x3, 0x9})

4m6.313540146s ago: executing program 3 (id=47):
syz_io_uring_submit(0x0, 0x0, 0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4)
io_uring_enter(0xffffffffffffffff, 0x47f8, 0x0, 0x0, 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x442, 0x1c)
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, &(0x7f0000000080)})
r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1, 0x0, 0xfffffffffffffffc}, 0x18)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r0}, &(0x7f0000000500), &(0x7f0000000540)=r1}, 0x20)
msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x1)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10)
connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240))
sendmsg$inet(r2, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0)

4m6.299858686s ago: executing program 32 (id=47):
syz_io_uring_submit(0x0, 0x0, 0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4)
io_uring_enter(0xffffffffffffffff, 0x47f8, 0x0, 0x0, 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x442, 0x1c)
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, &(0x7f0000000080)})
r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1, 0x0, 0xfffffffffffffffc}, 0x18)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r0}, &(0x7f0000000500), &(0x7f0000000540)=r1}, 0x20)
msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x1)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10)
connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240))
sendmsg$inet(r2, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0)

4.1423848s ago: executing program 2 (id=3051):
unlinkat(0xffffffffffffff9c, &(0x7f0000000c40)='./file1\x00', 0x0)
r0 = open(&(0x7f0000000140)='./file1\x00', 0x64042, 0x1e9)
pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x78c00}], 0x1, 0x2000, 0x0, 0x3)

4.086996892s ago: executing program 2 (id=3052):
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f00000003c0)={[{@max_batch_time={'max_batch_time', 0x3d, 0x7}}, {@journal_dev={'journal_dev', 0x3d, 0x1}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@user_xattr}, {@errors_remount}, {@nouid32}]}, 0x1, 0x441, &(0x7f00000011c0)="$eJzs28tvG8UfAPDv2kn66zP5VeXRBxAoiIpH0qSl9MAFBBIHkJDgUI4hSatQt0FNkGgVQUCoHFEl7ogjEv8AnOCCgBMSV7ijShXKpYWT0dq7ie3aaZI62RR/PtK2M7tjzXw9O/bMThxAzxpO/0ki9kTE7xExWM82Fxiu/3draWHy76WFySSq1Tf/Smrlbi4tTOZF89ftzjN9EaVPkzjcpt65y1fOT1Qq05ey/Oj8hfdG5y5feXbmwsS56XPTF8dPnz55Yuz5U+PPdSXONK6bhz6cPXLw1bevvT555to7P3+T5PG3xNElw6tdfKJa7XJ1xdrbkE76CmwI61KuD9Por43/wSjHSucNxiufFNo4YFNVq9Xq/Z0vL1aB/7Akim4BUIz8iz5d/+bHFk09toUbL9YXQGnct7KjfqUvSlmZ/pb1bTcNR8SZxX++TI/YnOcQAABNvk/nP8+0m/+VovG50L5sD2UoIv4fEfsj4lREHIiI+yJqZR+IiAfXWX/rJsnt85/S9Q0Ftkbp/O+FbG+ref6Xz/5iqJzl9tbi70/OzlSmj2fvybHo35Hmx1ap44eXf/u807XG+V96pPXnc8GsHdf7djS/ZmpifuJuYm504+OIQ33t4k+WdwKSiDgYEYc2WMfMU18f6XTtzvGvogv7TNWvIp6s9/9itMSfS1bfnxz9X1Smj4/md8Xtfvn16hud6r+r+Lsg7f9dbe//5fiHksb92rn113H1j8/ar2n2bfz+H0jeajr3wcT8/KWxiIHktXqjG8+Pt5QbXymfxn/saPvxvz9W3onDEZHexA9FxMMR8UjWd49GxGMRcXSV+H966fF3O13bDv0/ta7+X0kMROuZ9ony+R+/a6p0aD3xp/1/spY6lp1Zy+ffWtq1sbsZAAAA7j2liNgTSWlkOV0qjYzU/4b/QOwqVWbn5p8+O/v+xan6bwSGor+UP+kabHgeOpYt6/P8eEv+RPbc+Ivyzlp+ZHK2MlV08NDjdncY/6k/y0W3Dth0fq8Fvcv4h95l/EPvMv6hd7UZ/zuLaAew9dp9/39UQDuArdcy/m37QQ+x/ofe1Tj+kwLbAWw93//Qk+Z2xp1/JN8DiYHt0Yx7KBGltRf+Nrvbim6zxNoTBX8wAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMm/AQAA//8iOuPQ")

4.023182495s ago: executing program 2 (id=3054):
set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9)
prctl$PR_SET_NAME(0xf, &(0x7f00000001c0)='w\xde\xa3\x05\xff\a\x00\x00\x00\x00\x00\x00\x8f\xc0\x9b\x86\xef\\\xc0\x89\av\x9f\xd6\xd1\x98<\xc8\x18E/\x8c\x1a\xe3\xbd')
r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000440)=@security={'security\x00', 0x4, 0x4, 0x3b8, 0xffffffff, 0xd0, 0x0, 0x1a8, 0xffffffff, 0xffffffff, 0x2e8, 0x2e8, 0x2e8, 0xffffffff, 0x7fffffe, 0x0, {[{{@ipv6={@dev, @ipv4={'\x00', '\xff\xff', @multicast1}, [], [], 'ipvlan1\x00', 'geneve0\x00', {}, {}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x3}}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}, {{@ipv6={@private1, @mcast1, [], [], 'geneve1\x00', 'macvlan0\x00'}, 0x0, 0x118, 0x140, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'syz0\x00'}}, @common=@ipv6header={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x5, 0x3, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r0}, 0x18)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000a7"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
gettid()
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x21081e, &(0x7f0000000080)={[{@i_version}, {@nogrpid}, {@bh}]}, 0x1, 0x523, &(0x7f0000000c00)="$eJzs3c9vHFcdAPDvTLK2k7h1WnoABG1oCwFFWceb1qp6gHJCCFVC9AgiNfbGsrzrtbzrUptIuGeuSFTiBEf+AM49ceeC4MalHJD4YYFqJA5TzezY2di79qaJvZb385FG89688X7fizPvzbxd7wtgbN2IiJ2ImIiIdyNipjyelFu81d3y8z7ZfbC4t/tgMYkse+dfSVGeH4uen8ldK19zKiJ+8J2InyRH47a3tlcXGo36Rpmf7TTXZ9tb27dXmgvL9eX6Wq02Pzd/5427r9ceozVTx5a+1JwoU1/++I873/hZXq3p8khvO56mbtMrB3FylyPie6cRbAQule2ZGHVF+EzSiHg+Il4urv+ZuFT8NgGAiyzLZiKb6c0DABddWsyBJWm1nAuYjjStVrtzeC/E1bTRandu3W9tri1158quRyW9v9Ko3ynnCq9HJcnzc0X6Yb52KH83Ip6LiF9OXiny1cVWY2mUNz4AMMauHRr//zvZHf8BgAvu+I/NAAAXkfEfAMaP8R8Axo/xHwDGT3f8v/K4P5Zl2c9PozoAwBnw/A8A48f4DwBj5ftvv51v2V75/ddL721trrbeu71Ub69Wm5uL1cXWxnp1udVaLr6zp3nS6zVarfW512Lz/evfXG93Zttb2/earc21zr3ie73v1SvFWTtn0DIAYJDnXvroL0k+Ir95pdiiZy2HykhrBpy2dNQVAEbm0qgrAIyM1b5gfD18xn/sDwGYHoALos8SvY+Y6vcHQlmWZadXJeCU3fyC+X8YVz3z/z4FDGPmpPn/Ym1gbxLChWT+H8ZXliXDrvkfw54IAJxvx8zxXz/L+xBgdAa8//98uf9d+ebAj5YOn/HhadYKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzrf99X+r5TK/05Gm1WrEM8UCQJXk/kqjficino2IP09WJvP83IjrDAA8qfTvSbn+182ZV6cfKXrx2kFyIiJ++ut3fvX+Qqez8aeIieTfk/vHOx+Wx2snBps6jRYAAMfbH6eLfc+D/Ce7Dxb3t7Oszz++3b0ryOPu7U7E3kH8y3G52E9FJSKu/icp811Jz9zFk9j5ICI+36/9SUwXcyDdW5bD8fPYz5xp/PSR+Gm5QHNa/lt87inUBcbNR3n/81a/6y+NG8W+//U/VfRQT67s//KXWtwr+sCH8ff7v0sD+r8bw8Z47Q/f7aauHC37IOKLlyP2Y+/19D/78ZMB8V8dMv5fv/Tiy4PKst9E3Iz+8XtjzXaa67Ptre3bK82F5fpyfa1Wm5+bv/PG3ddrs8Uc9ezg0eCfb956dlBZ3v6rA+JPndD+rw7Z/t/+/90ffuWY+F9/pV/8NF44Jn4+Jn5tyPgLV38/8Lk7j790tP3JML//W0PG//hv20eWDQcARqe9tb260GjUNyTGNPHjOBfVGC6R/5c9B9Xom/jWWcWaiP5Fv3ile00fKsqyzxRrUI/xNGbdgPPg4KKPiP+NujIAAAAAAAAAAAAAAEBfZ/EXS6NuIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABfXpwEAAP//+E3TQw==")
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
socket$key(0xf, 0x3, 0x2)
openat$vcsa(0xffffffffffffff9c, &(0x7f0000002fc0), 0x242002, 0x0)
fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000088fe508a85000000040000008500000023000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
fchdir(0xffffffffffffffff)
syz_clone(0x630c1100, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), 0xffffffffffffffff)

3.684233929s ago: executing program 2 (id=3060):
r0 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)=ANY=[], 0x58}}, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000780)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000006c59850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94)
r2 = pidfd_getfd(0xffffffffffffffff, r1, 0x0)
r3 = socket$kcm(0x2d, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000000340)={<r4=>r3})
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth1_to_hsr\x00'})
bind$xdp(r4, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@dev, @in6=@dev}}, {{@in=@remote}, 0x0, @in6=@private1}}, &(0x7f0000000280)=0xe8)
sendmsg$nl_xfrm(r2, 0x0, 0x81)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18)
socket(0x10, 0x3, 0x0)
r6 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x66, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc094, 0x2, @perf_config_ext={0x9, 0x6}, 0x0, 0x3ee53089, 0x10003, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0xc0}, 0x94)
recvmmsg(r6, &(0x7f0000003d40)=[{{0x0, 0x94, 0x0}, 0x5}], 0x1, 0x2, 0x0)
r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0xd9, 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r8}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
r9 = fsmount(r0, 0x0, 0x20)
symlinkat(&(0x7f0000000000)='.\x00', r9, &(0x7f0000000080)='./file0\x00')
setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000240)={@multicast1, @loopback, 0x0, 0x9, [@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @loopback, @multicast2, @private=0xa010102, @local, @local, @multicast1]}, 0x34)
openat(r9, &(0x7f00000000c0)='./file0\x00', 0x515a02, 0x52abe154ad664f26)

2.74842994s ago: executing program 1 (id=3077):
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2)
mmap(&(0x7f00003f0000/0x2000)=nil, 0x2000, 0x4, 0x11012, r0, 0x308000)
perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x10021, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
syz_clone(0x26801000, 0x0, 0x0, 0x0, 0x0, 0x0)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='kfree\x00', r1}, 0x18)

2.718382271s ago: executing program 2 (id=3079):
syz_emit_ethernet(0x2e, &(0x7f0000000200)=ANY=[@ANYBLOB="0180c200000ee43f6642531e0800610000a9aa43273eda279052967735689e20000000090000000000000090786110000036a32757b2e7a385cac6c9b9b1ff73fc6756b502cd109540b78137179790c02ced24c5a7e79e7e67759030c1dc7eb7a3cd4fef09e149af00ed829264fd"], 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x20000000000000ba, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfd71}, 0x94)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90)
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0})
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
r1 = gettid()
r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0)
read(r2, &(0x7f0000000200)=""/202, 0xca)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2042, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x4058534c, &(0x7f00000000c0)={0x80, 0x0, {0x3}})
tkill(r1, 0x7)
ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r2, 0x80045301, 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x4, &(0x7f0000000440)=ANY=[@ANYRESDEC=r3], &(0x7f00000000c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffeffd}, 0x94)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000005}, 0x1004)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x18)
r5 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0b00000008000000010001000900000001000000", @ANYRES32, @ANYBLOB="000000000009000000001ddeda00"/23, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ac0)={&(0x7f0000000a80)='mm_page_free\x00', r6}, 0x10)

2.602974447s ago: executing program 1 (id=3081):
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000340)={0x1, &(0x7f0000000640)=[{0x200000000006, 0x0, 0x80, 0x7ffc1ffb}]})
bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0)
r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r0}, 0x10)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f00000000c0)=0x20003, 0x4)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000540)={{0x1, 0x1, 0x18}, './file0\x00'})
r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0xa1b96aadc3618c72}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10)
r4 = gettid()
timer_create(0x0, &(0x7f0000000180)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=<r5=>0x0)
timer_settime(r5, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0)
futex(&(0x7f000000cffc)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc)

2.52041426s ago: executing program 0 (id=3083):
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x401, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff274140000001100"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r0, 0xc0189374, &(0x7f0000000240)={{0x1, 0x1, 0x1018, 0xffffffffffffffff, {0x29}}, './file0\x00'})

2.28566497s ago: executing program 0 (id=3086):
r0 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)=ANY=[], 0x58}}, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000780)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000006c59850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94)
r2 = pidfd_getfd(0xffffffffffffffff, r1, 0x0)
r3 = socket$kcm(0x2d, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000000340)={<r4=>r3})
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth1_to_hsr\x00'})
bind$xdp(r4, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@dev, @in6=@dev}}, {{@in=@remote}, 0x0, @in6=@private1}}, &(0x7f0000000280)=0xe8)
sendmsg$nl_xfrm(r2, 0x0, 0x81)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18)
socket(0x10, 0x3, 0x0)
r6 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x66, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc094, 0x2, @perf_config_ext={0x9, 0x6}, 0x0, 0x3ee53089, 0x10003, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0xc0}, 0x94)
recvmmsg(r6, &(0x7f0000003d40)=[{{0x0, 0x94, 0x0}, 0x5}], 0x1, 0x2, 0x0)
r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0xd9, 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x50)
r8 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r8}, 0x18)
r9 = fsmount(r0, 0x0, 0x20)
symlinkat(&(0x7f0000000000)='.\x00', r9, &(0x7f0000000080)='./file0\x00')
openat(r9, &(0x7f00000000c0)='./file0\x00', 0x515a02, 0x52abe154ad664f26)

1.993805943s ago: executing program 2 (id=3087):
prctl$PR_SET_NAME(0xf, &(0x7f0000000180)='wg1\x00')
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xf)
r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x10010, r1, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="1801000000000000000000006dfeff00850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='kfree\x00', r2, 0x0, 0x401}, 0x11)
r3 = io_uring_setup(0x21bf, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
syz_emit_ethernet(0x52, &(0x7f00000008c0)=ANY=[], 0x0)
syz_mount_image$ext4(&(0x7f0000000880)='ext2\x00', &(0x7f0000000140)='./file1\x00', 0x101868f, &(0x7f0000000240), 0xfe, 0x53f, &(0x7f0000000940)="$eJzs3V9rZGcZAPDnnMzsZrtZk6IXtdBarLK76M5sGttGL9oVxbuCUu/XkMyGsJNMyEzaTSiSxQ8giGhBvPDKG8EPIEi/gCCFgr0XFUV0qxdeqEfOzJltMjmzE2lmZpv8fnBmzvued87zvMnmzPm37wng3HouIm5FxExEXI+I+aI+LaY46E15uw8evLWaT/mS1/+WRFLUDa7zcvGx2d5bqfbe/t2VZrOxU5Trnc3tentv/8bG5sp6Y72xtbS0+NLyy8svLt8c2Yf5wYqF8javfP1PP/r+z7/xyq+/+Obvb//l2nfz/L/Wb3BwvB+n4f3uazX/WTxUiYidcQSbgpmiP9VpJwIAwInk+/ifLabrMR8z3b25rsFdutnJZwcAAACchuzVufh3EpE90kZlVAsAAADg8fVqRMxFktaKewHmIk1rtd49vJ+KJ9Jmq935wp3W7tZavixiIarpnY1m42ZxT+1CVJO8vFjcdtsvvzBQXvpyxJMR8cP5S91ybbXVXJv2yQ8AAAA4Jy4PHP//c753/A8AAACcMSXjZQEAAABnzLDj/2TCeQAAAADjM+z4/+KE8wAAAADG4puvvZZPWf853mtv7O3ebb1xY63Rvlvb3F2trbZ2tmvrrdZ6d8y+zVHra7Za21+Krd179U6j3am39/Zvb7Z2tzq3Nzw/EAAAAKblyc+8834SEQdfudSdchfyl5khHzBWAJwZ6aMX//RI6Y/jzQWYrGFf88DZVzlSujW1PIApOJh2AsC0HRnqo3J8+eGbd9LDjX87xqQAAIBTdfXT5df/80OA6rSTA8ZqxPV/4AzrXf//zZVp5wFMXsmp/uM+PPn/7jhzASar6g5AOPdGPepj6OAdZdf/L5Q1zLKR6wIAAMZqrvuapLXiWuBcpGmtFnGl+1/9q8mdjWbjZkR8IiJ+N1+9mJcXe5/xeEAAAAAAAAAAAAAAAAAAAAAAAAAAOKEsSyIDAAAAzrSI9M9JRFwacn7gQvKv+Sge6fXmT17/8b2VTmdnMa//+8P6zttF/QsTPXUBAAAADNE/Tu8fxwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAafrgwVurxXRhknH/+tWIWDgSf7W3pBKz3ffZqEbEE/9IonLoc0lEzJxC/IP7EfFUWfwkTysWiiwG46cRcWky8Z/Jsqw0/uVTiA/n2Tv59udW2d9fGs9138v//ivF9FEN3/6lD7d/M0O2f1dOGOPp935ZHxr/fsTTlfLtTz9+MiT+82UrLPmhfOfb+/vHKnsrj+xnEVejPP7hWPXO5na9vbd/Y2NzZb2x3thaWlp8afnl5ReXb9bvbDQbxWtpH3/wzK/+O1D1n6yn2/8YEn9hRP8/l89UD1Vmg2GKYO/de/DJ3mx1YBXd+NeeL//9P/WI+Pm/ic8X3wP58qv9+YPe/GHP/uLdZ0sTK+KvDen/qN//tWErHXD9W9/7wwmbAgAT0N7bv7vSbDZ2xj7zdpZlJ2o8N5l8GtuXJ9b3j8NMf+9ubCFmH5eefhxnLkZEvyaNcQc9jTNbAADA4+bDnf5pZwIAAAAAAAAAAAAAAAAAAADnV3sv0v9vhLCsGHb/Yc39UYPGDcY8mEI/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABG+V8AAAD//6rB04o=")
write$selinux_load(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x603f)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
syz_usb_connect(0x2, 0xfffffffffffffe86, 0x0, 0x0)
ioctl$TIOCVHANGUP(r0, 0x5437, 0x0)

1.989173763s ago: executing program 5 (id=3088):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="06000000040000000700000008"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x13, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000002c0)='sys_enter\x00', r1, 0x0, 0x3}, 0x18)
rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8)

1.895805377s ago: executing program 5 (id=3089):
socket$unix(0x1, 0x1, 0x0)
r0 = socket$unix(0x1, 0x1, 0x0)
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, 0x0})
bind$unix(r0, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
r1 = syz_open_dev$usbfs(0x0, 0xb, 0x3196c0)
prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
semget$private(0x0, 0x5, 0x0)
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0xfffffffd, 0x0, @perf_bp={&(0x7f0000000340), 0x8}, 0x0, 0x0, 0x0, 0x3, 0xfff, 0x8001, 0x7fff}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r3 = socket$inet6(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r4)
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0)
sendmsg$nl_route_sched(r5, 0x0, 0x4008004)
sendmmsg$inet(r3, &(0x7f00000017c0)=[{{&(0x7f0000000500)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="78010000000000000000000007000000860600000002071349ac1e0101ac1e0001ac1e0101ac14141086220000000305061faeda43050709af61d4c500434a050c864b14651a84ce4e04384410624000000003000002010000008d891b7de00000020a0101027f000001e000000200000000ffffffff443448130a01010000000009ac1414aa000000050a01010100000006ffffffff000000026401010000000ffeffffffff000000028646c82955600603b80205c768a10002071119c9abe7877075c051d183122548a90612735ee14f8fc4d07804fb6890342508f8996f359f5267000000000000000025f56407020609f3434e2931780701442c49730000000000000006ac14141300000000ac1414bb000000c07f000001000000020a0101020000000686590000000206020011e17bd22df454211202a98778403f3b021053d4fcb5fbc47c0f3aa85c9e99ca060f209f984f49362feeabba150f000000f57390d14a0d9fdf40a605057c2cf202105e83cf8856019905991a66dfd1bf0000"], 0x178}}], 0x1, 0x28000004)
r8 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095", @ANYRESHEX=r1, @ANYRES16], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x47, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000180)='kfree\x00', r8}, 0x18)
r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r9)

1.745081564s ago: executing program 1 (id=3090):
syz_emit_ethernet(0x2e, &(0x7f0000000200)=ANY=[@ANYBLOB="0180c200000ee43f6642531e0800610000a9aa43273eda279052967735689e20000000090000000000000090786110000036a32757b2e7a385cac6c9b9b1ff73fc6756b502cd109540b78137179790c02ced24c5a7e79e7e67759030c1dc7eb7a3cd4fef09e149af00ed829264fd"], 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x20000000000000ba, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200"/15], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40}, 0x94)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90)
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0})
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
r0 = gettid()
r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0)
read(r1, &(0x7f0000000200)=""/202, 0xca)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
recvmsg$unix(0xffffffffffffffff, 0x0, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0)
recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2042, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x4058534c, &(0x7f00000000c0)={0x80, 0x0, {0x3}})
preadv2(0xffffffffffffffff, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0)
tkill(r0, 0x7)
ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, 0x0)

1.653822298s ago: executing program 5 (id=3092):
r0 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)=ANY=[], 0x58}}, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000780)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000006c59850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94)
r2 = pidfd_getfd(0xffffffffffffffff, r1, 0x0)
r3 = socket$kcm(0x2d, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000000340)={<r4=>r3})
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth1_to_hsr\x00'})
bind$xdp(r4, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@dev, @in6=@dev}}, {{@in=@remote}, 0x0, @in6=@private1}}, &(0x7f0000000280)=0xe8)
sendmsg$nl_xfrm(r2, 0x0, 0x81)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18)
socket(0x10, 0x3, 0x0)
r6 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x66, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc094, 0x2, @perf_config_ext={0x9, 0x6}, 0x0, 0x3ee53089, 0x10003, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0xc0}, 0x94)
recvmmsg(r6, &(0x7f0000003d40)=[{{0x0, 0x94, 0x0}, 0x5}], 0x1, 0x2, 0x0)
r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0xd9, 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x50)
r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r8}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r9}, 0x18)
r10 = fsmount(r0, 0x0, 0x20)
symlinkat(0x0, r10, &(0x7f0000000080)='./file0\x00')
setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000240)={@multicast1, @loopback, 0x0, 0x9, [@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @loopback, @multicast2, @private=0xa010102, @local, @local, @multicast1]}, 0x34)
openat(r10, &(0x7f00000000c0)='./file0\x00', 0x515a02, 0x52abe154ad664f26)

1.359282841s ago: executing program 0 (id=3095):
readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b7"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f0000000200), &(0x7f0000000280)}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d00)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180100000100a7d9000000000020b200850000007b00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2, 0x0, 0x2}, 0x18)
r3 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendmsg$rds(r3, &(0x7f0000000300)={&(0x7f0000000040)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@rdma_map={0x30, 0x114, 0x3, {{0x0}, 0x0, 0x20}}], 0x30, 0x8004}, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000d00)='sched_switch\x00', r1}, 0x10)
prctl$PR_SET_THP_DISABLE(0x29, 0x0)
accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x80400)
r4 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
recvmsg$unix(r5, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002)
ioctl$int_in(r5, 0x5452, &(0x7f00000000c0)=0x400)
sendmsg$inet(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)='l', 0x1}], 0x1}, 0x400c941)

1.050155854s ago: executing program 1 (id=3096):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001380)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000818110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x41, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000280)='kfree\x00', r3, 0x0, 0xbc3}, 0x18)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x18, &(0x7f00000001c0)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff8}, @call={0x85, 0x0, 0x0, 0xb}, @generic={0x9, 0x6, 0x8, 0xffff, 0xd4b}, @alu={0x4, 0x0, 0x1, 0xb, 0x7, 0x100, 0xffffffffffffffff}, @exit, @ldst={0x3, 0x3, 0x0, 0x7, 0x8, 0xfffffffffffffff4}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], &(0x7f00000002c0)='GPL\x00', 0x40, 0x82, &(0x7f00000004c0)=""/130, 0x41000, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000380)={0x3, 0xe, 0xfffffff8, 0xb}, 0x10, 0x0, 0x0, 0x5, &(0x7f0000000400)=[r1, r1, r1, r1, r1], &(0x7f0000000a80)=[{0x0, 0x3, 0x10, 0x1}, {0x0, 0x5, 0x9, 0x2}, {0x2, 0x4, 0x0, 0xa}, {0x5, 0x4, 0x2, 0x7}, {0x1, 0x3, 0xa, 0x1}], 0x10, 0xf88}, 0x94)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000180)={@map=r1, 0xffffffffffffffff, 0x20, 0x1, r3, @void, @value=r4}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000580)=@mangle={'mangle\x00', 0x44, 0x6, 0x4a0, 0x138, 0x0, 0x368, 0x1d0, 0x138, 0x408, 0x408, 0x408, 0x408, 0x408, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x11000000, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x0, 0x4}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff000000, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {0xff}, {0xff}, 0x11, 0x0, 0x28}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x10, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0xffffff00, 'vlan1\x00', 'nr0\x00', {}, {0xff}}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @multicast2, 0xff, 0xffffff00, 'ip6gre0\x00', 'virt_wifi0\x00', {0xff}, {}, 0x2e, 0x0, 0x1}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00', {0xe6d959333babc205}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x500)

1.020247316s ago: executing program 1 (id=3097):
syz_emit_ethernet(0x2e, &(0x7f0000000200)=ANY=[@ANYBLOB="0180c200000ee43f6642531e0800610000a9aa43273eda279052967735689e20000000090000000000000090786110000036a32757b2e7a385cac6c9b9b1ff73fc6756b502cd109540b78137179790c02ced24c5a7e79e7e67759030c1dc7eb7a3cd4fef09e149af00ed829264fd"], 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x20000000000000ba, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfd71}, 0x94)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90)
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0})
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
r1 = gettid()
r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0)
read(r2, &(0x7f0000000200)=""/202, 0xca)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000840)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2042, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x4058534c, &(0x7f00000000c0)={0x80, 0x0, {0x3}})
tkill(r1, 0x7)
ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r2, 0x80045301, 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x4, &(0x7f0000000440)=ANY=[@ANYRESDEC=r3], &(0x7f00000000c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffeffd}, 0x94)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000005}, 0x1004)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x18)
r5 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0b00000008000000010001000900000001000000", @ANYRES32, @ANYBLOB="000000000009000000001ddeda00"/23, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ac0)={&(0x7f0000000a80)='mm_page_free\x00', r6}, 0x10)

771.958307ms ago: executing program 5 (id=3098):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r0, 0x0, 0xb}, 0x18)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
pipe2$9p(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000040), 0x200080, &(0x7f0000000600)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@cache_mmap}]}})

743.990468ms ago: executing program 5 (id=3099):
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="020000000400000008"], 0x50)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x8, 0x40008, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_bp={0x0, 0x5}, 0x0, 0x0, 0x800000, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
epoll_create1(0x0)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1, 0x0, 0xfffffffffffffffd}, 0x18)
pselect6(0x40, &(0x7f00000001c0)={0x2, 0x0, 0x3, 0xfffffffffffffffd, 0x3, 0x8, 0x0, 0xe}, 0x0, &(0x7f0000000300)={0x3ff, 0x7e7, 0x0, 0x9, 0x4, 0x0, 0x7fffffff, 0x3f8}, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000001000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000100006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a"], 0x0, 0x1000, 0x0, 0x0, 0x0, 0x8}, 0x94)
open(&(0x7f0000000740)='./bus\x00', 0x143c62, 0x0)
mount(&(0x7f0000000100), &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000300)='trans=rdma,')

694.15763ms ago: executing program 5 (id=3100):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kfree\x00', r0}, 0x10)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{0x1, <r1=>0xffffffffffffffff}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x4, &(0x7f0000000600)=ANY=[@ANYBLOB="d40a0000400000001800000000000000000000007430397695"], &(0x7f00000005c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x42}, 0x94)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000060000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{0xffffffffffffffff, <r3=>0xffffffffffffffff}, &(0x7f0000000400), &(0x7f0000000440)=r0}, 0x20)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1, <r4=>0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000500)=r0}, 0x20)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000800)={'syztnl2\x00', &(0x7f0000000780)={'syztnl2\x00', <r5=>0x0, 0x2f, 0x6, 0x51, 0x0, 0x0, @mcast1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x40, 0x10709, 0x80000000}})
bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000008c0)={0x30e, <r6=>0x0}, 0x8)
r7 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000940)=@generic={&(0x7f0000000900)='./file0\x00', 0x0, 0x18}, 0x18)
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x20, 0x2f, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x10}, [@printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6f}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2b416c36}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff8}, @call={0x85, 0x0, 0x0, 0x18}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x3}}]}, &(0x7f0000000700)='syzkaller\x00', 0x8, 0x1f, &(0x7f0000000740)=""/31, 0x40f00, 0x0, '\x00', r5, @fallback=0x1d, 0xffffffffffffffff, 0x8, &(0x7f0000000840)={0x1, 0x4}, 0x8, 0x10, &(0x7f0000000880)={0x4, 0x8, 0x2, 0x7fff}, 0x10, r6, r0, 0x3, &(0x7f0000000980)=[r7], &(0x7f00000009c0)=[{0x4, 0x5, 0x8, 0x4}, {0x2, 0x3, 0x9, 0x6}, {0x2, 0x1, 0x4, 0xa}], 0x10, 0xffffffff}, 0x94)
bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r8=>0xffffffffffffffff})
r9 = socket(0x400000000010, 0x3, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={<r10=>0xffffffffffffffff, <r11=>0xffffffffffffffff})
connect$unix(r10, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r11, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
pipe2(&(0x7f0000001cc0)={<r12=>0xffffffffffffffff}, 0x800)
mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x800000, &(0x7f0000000300)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r12, @ANYBLOB=',wfdno=', @ANYRESHEX=r11])
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', <r13=>0x0})
sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r13, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000001b00)=@newtfilter={0x38, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r13, {}, {}, {0xe, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20041090}, 0x0)
getsockopt$IPT_SO_GET_INFO(r9, 0x0, 0x40, &(0x7f00000001c0)={'mangle\x00', 0x0, [0xd, 0x4, 0x4, 0x9, 0x8]}, &(0x7f0000000240)=0x54)
ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000040)={'bond_slave_1\x00', &(0x7f0000000000)=@ethtool_gstrings={0x1b, 0x4}})

499.503868ms ago: executing program 0 (id=3103):
socket$inet6_sctp(0xa, 0x5, 0x84)
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x50)
chmod(&(0x7f0000001000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x30)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10)
mkdir(&(0x7f0000000400)='./file0\x00', 0x0)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000fbff000000000000001d8500000007000000850000002300000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94)
pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000003c0)='writeback_bdi_register\x00', r5}, 0x18)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='writeback_bdi_register\x00', r3}, 0x18)
dup(r4)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x4, &(0x7f0000000580)=ANY=[@ANYRESDEC=r2, @ANYRESOCT=r2, @ANYRES16=r5], &(0x7f00000004c0)='GPL\x00', 0x4, 0x8f, &(0x7f00000002c0)=""/143, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94)
r6 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xc3, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xa19a, 0x1000}, 0x18440, 0x0, 0xffffffff, 0x5, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x2)
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x40082406, &(0x7f0000000340)='cpu\t&0&&\t')
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ec0)={&(0x7f0000000bc0)='kfree\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffff4}, 0x18)
lsetxattr$security_selinux(&(0x7f00000000c0)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000040), &(0x7f0000000980)='system_u:object_r:getty_etc_t:s0\x00', 0x21, 0x1)
bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000980)='mm_page_free\x00', 0xffffffffffffffff, 0x0, 0x6}, 0x18)
syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

433.945261ms ago: executing program 0 (id=3105):
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x401, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff274140000001100"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r0, 0xc0189374, &(0x7f0000000240)={{0x1, 0x1, 0x1018, 0xffffffffffffffff, {0x29}}, './file0\x00'})

365.228704ms ago: executing program 1 (id=3106):
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x8, 0x40008, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_bp={0x0, 0x5}, 0x0, 0x0, 0x800000, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
epoll_create1(0x0)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1, 0x0, 0xfffffffffffffffd}, 0x18)
pselect6(0x40, &(0x7f00000001c0)={0x2, 0x0, 0x3, 0xfffffffffffffffd, 0x3, 0x8, 0x0, 0xe}, 0x0, &(0x7f0000000300)={0x3ff, 0x7e7, 0x0, 0x9, 0x4, 0x0, 0x7fffffff, 0x3f8}, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x18)
bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x200, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000001000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000100006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a"], 0x0, 0x1000, 0x0, 0x0, 0x0, 0x8}, 0x94)
mount(&(0x7f0000000100), &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000300)='trans=rdma,')

305.822057ms ago: executing program 4 (id=3107):
r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000111e6ca5b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800)
recvmmsg(r2, &(0x7f0000007700), 0x4000267, 0xfc0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kmem_cache_free\x00', r1, 0x0, 0x1}, 0x18)
syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff)
bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[], 0x48)
r3 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f00000002c0), &(0x7f0000000080)=0x60, 0x75745c9a15cf4f06)
accept4$nfc_llcp(r3, 0x0, &(0x7f0000000380), 0x81000)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000058000000788ee52d74f395b7080000000000007b8af8ff00000000bf89000000040000000000008500000003000000950000000000000000000000a3626a715029ab963f5c88fa13d2c4e29a16c08e20138cde7b562b620899450a01dbb6ac377f8f5f3d238e976966774dc3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000810018110000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r4}, 0x18)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000000a0500000000000000000003000000ac000000030a0101000000000000000005000000340008800c00024000000000000000070c00024000000080000000810c000240000000000000bf660c0002400000000000000a4d640008800c00014000000000000000860c00024000000000000000060c00024000000000000000060c00024000000000000000030c3ef9357e000000000000020c000140000000000000000b0ce9024000000000000000040c000140000000000000000214000000030a5d7000000000000000000100000a140000001100010000000000000000000000000a"], 0xfc}}, 0x0)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x200, 0x0, 0x0, 0x0, 0x68, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0xc2f00, 0x4d, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000980)='mm_page_free\x00', r7}, 0x18)
perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x80000000000, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00')
r8 = socket(0x1, 0x5, 0x0)
getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14)
r10 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'team_slave_0\x00', <r11=>0x0})
sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000010000100feffff7f0300000000000006", @ANYRES32=r11, @ANYBLOB="600000007198942e08000300", @ANYRES32=r9, @ANYBLOB], 0x28}, 0x1, 0xd, 0x0, 0x480c5}, 0x80c4)
stat(&(0x7f0000000000)='./file1\x00', 0x0)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)

286.111798ms ago: executing program 0 (id=3108):
r0 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)=ANY=[], 0x58}}, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000780)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000006c59850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94)
r2 = pidfd_getfd(0xffffffffffffffff, r1, 0x0)
r3 = socket$kcm(0x2d, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000000340)={<r4=>r3})
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth1_to_hsr\x00'})
bind$xdp(r4, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@dev, @in6=@dev}}, {{@in=@remote}, 0x0, @in6=@private1}}, &(0x7f0000000280)=0xe8)
sendmsg$nl_xfrm(r2, 0x0, 0x81)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18)
socket(0x10, 0x3, 0x0)
r6 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x66, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc094, 0x2, @perf_config_ext={0x9, 0x6}, 0x0, 0x3ee53089, 0x10003, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0xc0}, 0x94)
recvmmsg(r6, &(0x7f0000003d40)=[{{0x0, 0x94, 0x0}, 0x5}], 0x1, 0x2, 0x0)
r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0xd9, 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x50)
r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r8}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r9}, 0x18)
r10 = fsmount(r0, 0x0, 0x20)
symlinkat(0x0, r10, &(0x7f0000000080)='./file0\x00')
setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000240)={@multicast1, @loopback, 0x0, 0x9, [@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @loopback, @multicast2, @private=0xa010102, @local, @local, @multicast1]}, 0x34)
openat(r10, &(0x7f00000000c0)='./file0\x00', 0x515a02, 0x52abe154ad664f26)

189.736062ms ago: executing program 4 (id=3109):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000180000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000f0850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge0\x00', <r2=>0x0})
r3 = mq_open(&(0x7f0000000a00)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!T\xeeux\x00\xbf@\xf4\x1c\xbce\xca\x97\xd5pkv\x88L\xe8$\xef\xfeI\xdaW1\xfcg\xa1\xdb$,0y$\xcd{zl.\xae\x805\xa8\xd6\x85\x15\xd2\x0e~\xcc\x90\x97\xe8h\v\x1a9X\a\xca{\x11#\x95m{U\xe5-\xabRw\xcafy\xe6\aNhX4Ll[\x14\x15<z\xb2\x03d\xad\x925\xbfP\x1b\xea\vt\xe9C\xe9\xb4R\x85*\xdc\xc4@\xee\xd2\xae\x06\x1a\xe1\xd2s\x01\xb8\xf3\xf2\rr\x01mq\xd2\xaf\xe2{\xe4\x1a\xd3Z\x01C\xfbW', 0x6e93ebbbcc0884f2, 0x1c4, &(0x7f0000000040)={0x0, 0x2, 0x4, 0x3})
mq_timedreceive(r3, &(0x7f0000000280)=""/211, 0xd3, 0x800000000000, 0x0)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000f00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r5}, 0x10)
add_key(&(0x7f0000000280)='rxrpc\x00', 0x0, &(0x7f0000000100)="01000000020000000000006bb55a2a630b00c145f94cd977", 0x18, 0xffffffffffffffff)
mq_timedsend(r3, 0x0, 0x0, 0x3ed7, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000001c000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="5900b2000a000200aaaaaaaaaa1c000004000e80"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x40800)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10)

137.836144ms ago: executing program 4 (id=3110):
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="020000000400000008"], 0x50)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x8, 0x40008, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_bp={0x0, 0x5}, 0x0, 0x0, 0x800000, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
epoll_create1(0x0)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1, 0x0, 0xfffffffffffffffd}, 0x18)
pselect6(0x40, &(0x7f00000001c0)={0x2, 0x0, 0x3, 0xfffffffffffffffd, 0x3, 0x8, 0x0, 0xe}, 0x0, &(0x7f0000000300)={0x3ff, 0x7e7, 0x0, 0x9, 0x4, 0x0, 0x7fffffff, 0x3f8}, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000001000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000100006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a"], 0x0, 0x1000, 0x0, 0x0, 0x0, 0x8}, 0x94)
open(&(0x7f0000000740)='./bus\x00', 0x143c62, 0x0)
mount(&(0x7f0000000100), &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000300)='trans=rdma,')

134.433264ms ago: executing program 4 (id=3111):
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = gettid()
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000002c0)}], 0x1, 0x0, 0xa0}, 0x4004881)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x3, 0x60, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB], 0x0}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000008c0)='kfree\x00', r2}, 0x18)
recvmsg$unix(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x2000)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000840)={&(0x7f0000000080)='kfree\x00', r3, 0x0, 0x97a3}, 0x18)
ptrace$ARCH_GET_MAX_TAG_BITS(0x1e, r0, &(0x7f0000000100), 0x4003)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="020200030f0000002cbd7040fedbdf2503000900800000001cdc0dca1d9f68846960e56de42944af030006000000000002004e22ac1414bb000000000000000002000100000000000000070c00000080030005000000000002004e20ac1414bb00000000000000000200130002"], 0x78}, 0x1, 0x7}, 0x8000)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x98)
r4 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'veth0\x00', <r5=>0x0})
setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f00000004c0)={r5, 0x3, 0x6, @remote}, 0x10)
r6 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000000)={r5, 0x1, 0x6, @random="790c7edd3d8d"}, 0x10)
sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0x0, 0x1ffffff, {0x0, 0x0, 0x0, r5, {0x7, 0x9}, {0xd, 0xc}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000002000000001000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000950000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

46.911169ms ago: executing program 4 (id=3112):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48)
bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r1, 0x0, &(0x7f0000001700)=""/53}, 0x20)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10)
r3 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f0000000180)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300", 0xffffffff}, 0x48, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x4, r3, r3, 0x0, 0x0)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a00000014000780050015000000000008001240"], 0x60}}, 0x0)
sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000030601010000000000000000010100000500010007000000c7701c7d7c3275cfccd3398396badc737e4de5d5813faf2ae29e5e018af7b07417fc3dafc7e7ec9c546b63da2ecdca84"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x10000000)

0s ago: executing program 4 (id=3113):
readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b7"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f0000000200), &(0x7f0000000280)}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d00)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180100000100a7d9000000000020b200850000007b00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2, 0x0, 0x2}, 0x18)
r3 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendmsg$rds(r3, &(0x7f0000000300)={&(0x7f0000000040)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@rdma_map={0x30, 0x114, 0x3, {{0x0}, 0x0, 0x20}}], 0x30, 0x8004}, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000d00)='sched_switch\x00', r1}, 0x10)
prctl$PR_SET_THP_DISABLE(0x29, 0x0)
accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x80400)
r4 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
recvmsg$unix(r5, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002)
ioctl$int_in(r5, 0x5452, &(0x7f00000000c0)=0x400)
sendmsg$inet(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)='l', 0x1}], 0x1}, 0x400c941)

kernel console output (not intermixed with test programs):

: 12 bytes leftover after parsing attributes in process `syz.0.2391'.
[  223.361360][T10993] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2391'.
[  223.378272][T10993] bridge0: port 4(vlan2) entered blocking state
[  223.384663][T10993] bridge0: port 4(vlan2) entered disabled state
[  223.393685][T10993] vlan2: entered allmulticast mode
[  223.398826][T10993] bridge0: entered allmulticast mode
[  223.408965][T10993] vlan2: left allmulticast mode
[  223.413873][T10993] bridge0: left allmulticast mode
[  223.433015][T10991] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2388'.
[  223.485123][T11000] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2393'.
[  223.494274][T11000] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2393'.
[  223.506597][T11000] bridge0: port 3(vlan2) entered blocking state
[  223.513022][T11000] bridge0: port 3(vlan2) entered disabled state
[  223.520503][T11000] vlan2: entered allmulticast mode
[  223.523557][T11003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  223.525641][T11000] bridge0: entered allmulticast mode
[  223.537068][T11002] loop0: detected capacity change from 0 to 512
[  223.539871][T11003] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  223.547106][T11002] EXT4-fs: Ignoring removed i_version option
[  223.557282][T11000] vlan2: left allmulticast mode
[  223.559672][T11002] EXT4-fs: Ignoring removed bh option
[  223.564522][T11000] bridge0: left allmulticast mode
[  223.582274][T11002] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  223.595052][T11002] ext4 filesystem being mounted at /494/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  223.665854][T11002] lo speed is unknown, defaulting to 1000
[  223.756357][T11018] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING
[  223.767716][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  223.778085][T11016] loop5: detected capacity change from 0 to 512
[  223.788650][T11016] EXT4-fs: Ignoring removed i_version option
[  223.794896][T11016] EXT4-fs: Ignoring removed bh option
[  223.820712][T11018] xt_TPROXY: Can be used only with -p tcp or -p udp
[  223.846366][T11016] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  223.882144][T11023] loop0: detected capacity change from 0 to 512
[  223.889431][T11023] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended
[  223.898538][T11023] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem
[  223.899789][T11016] ext4 filesystem being mounted at /472/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  223.923555][T11023] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002]
[  223.931845][T11023] EXT4-fs (loop0): failed to initialize system zone (-117)
[  223.939256][T11023] EXT4-fs (loop0): mount failed
[  223.947364][ T5690] Bluetooth: hci0: Frame reassembly failed (-84)
[  223.960507][T11016] lo speed is unknown, defaulting to 1000
[  224.009408][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  224.191143][T11043] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2407'.
[  224.200223][T11043] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2407'.
[  224.228987][T11043] bridge0: port 3(vlan0) entered blocking state
[  224.235331][T11043] bridge0: port 3(vlan0) entered disabled state
[  224.245618][T11043] vlan0: entered allmulticast mode
[  224.250818][T11043] bridge0: entered allmulticast mode
[  224.258833][T11043] vlan0: left allmulticast mode
[  224.263774][T11043] bridge0: left allmulticast mode
[  224.307193][T11047] loop5: detected capacity change from 0 to 512
[  224.319277][T11047] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode
[  224.336096][T11050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  224.344640][T11047] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2410: inode has both inline data and extents flags
[  224.359500][T11050] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  224.368936][T11047] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2410: couldn't read orphan inode 15 (err -117)
[  224.383198][T11047] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  224.409657][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  224.435257][T11056] loop5: detected capacity change from 0 to 512
[  224.442918][T11056] EXT4-fs: dax option not supported
[  224.641423][   T29] kauditd_printk_skb: 1826 callbacks suppressed
[  224.641438][   T29] audit: type=1326 audit(1764977446.775:52499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11049 comm="syz.1.2411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f4d144865e7 code=0x7ffc0000
[  224.671247][   T29] audit: type=1326 audit(1764977446.775:52500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11031 comm="syz.4.2403" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f657dcf65e7 code=0x7ffc0000
[  224.694804][   T29] audit: type=1326 audit(1764977446.775:52501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11049 comm="syz.1.2411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4d1442b829 code=0x7ffc0000
[  224.718363][   T29] audit: type=1326 audit(1764977446.775:52502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11049 comm="syz.1.2411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d1448f749 code=0x7ffc0000
[  224.742000][   T29] audit: type=1326 audit(1764977446.775:52503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11031 comm="syz.4.2403" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f657dc9b829 code=0x7ffc0000
[  224.765572][   T29] audit: type=1326 audit(1764977446.775:52504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11031 comm="syz.4.2403" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f657dcff749 code=0x7ffc0000
[  224.789157][   T29] audit: type=1326 audit(1764977446.785:52505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11049 comm="syz.1.2411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f4d144865e7 code=0x7ffc0000
[  224.812679][   T29] audit: type=1326 audit(1764977446.785:52506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11049 comm="syz.1.2411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4d1442b829 code=0x7ffc0000
[  224.836223][   T29] audit: type=1326 audit(1764977446.785:52507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11049 comm="syz.1.2411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d1448f749 code=0x7ffc0000
[  224.859890][   T29] audit: type=1326 audit(1764977446.795:52508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11049 comm="syz.1.2411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f4d144865e7 code=0x7ffc0000
[  225.006787][T11064] loop4: detected capacity change from 0 to 512
[  225.014957][T11064] EXT4-fs: Ignoring removed i_version option
[  225.021226][T11064] EXT4-fs: Ignoring removed bh option
[  225.034705][T11064] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  225.049202][T11064] ext4 filesystem being mounted at /479/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  225.081618][T11064] lo speed is unknown, defaulting to 1000
[  225.165014][ T3319] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  225.405473][T11084] loop2: detected capacity change from 0 to 2048
[  225.429739][T11086] loop5: detected capacity change from 0 to 512
[  225.438619][T11086] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode
[  225.458684][T11086] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2422: inode has both inline data and extents flags
[  225.459539][T11084] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  225.485219][T11084] ext4 filesystem being mounted at /478/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  225.499265][T11086] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2422: couldn't read orphan inode 15 (err -117)
[  225.505627][T11089] syzkaller0: entered promiscuous mode
[  225.517035][T11089] syzkaller0: entered allmulticast mode
[  225.523913][T11086] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  225.530232][T11084] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.2420: bg 0: block 345: padding at end of block bitmap is not set
[  225.553729][T11084] EXT4-fs (loop2): Remounting filesystem read-only
[  225.561369][T11084] EXT4-fs warning (device loop2): ext4_xattr_inode_lookup_create:1606: inode #18: comm syz.2.2420: cleanup dec ref error -117
[  225.595321][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  225.607533][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  225.692903][T11100] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING
[  225.749346][T11103] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2428'.
[  225.758375][T11103] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2428'.
[  225.794181][T11103] bridge0: port 3(vlan2) entered blocking state
[  225.800534][T11103] bridge0: port 3(vlan2) entered disabled state
[  225.807060][T11103] vlan2: entered allmulticast mode
[  225.812262][T11103] bridge0: entered allmulticast mode
[  225.816878][T11109] EXT4-fs: Ignoring removed i_version option
[  225.823840][T11109] EXT4-fs: Ignoring removed bh option
[  225.829451][T11103] vlan2: left allmulticast mode
[  225.834390][T11103] bridge0: left allmulticast mode
[  225.844526][T11109] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  225.850347][T11100] xt_TPROXY: Can be used only with -p tcp or -p udp
[  225.858533][T11109] ext4 filesystem being mounted at /480/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  225.899125][T11109] lo speed is unknown, defaulting to 1000
[  226.008651][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  226.030462][ T3624] Bluetooth: hci0: command 0x1003 tx timeout
[  226.036500][ T3519] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  226.136920][T11125] bond1: option ad_user_port_key: invalid value (1136)
[  226.143844][T11125] bond1: option ad_user_port_key: allowed values 0 - 1023
[  226.153472][T11125] bond1 (unregistering): Released all slaves
[  226.272524][T11129] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2430'.
[  226.302997][T11130] random: crng reseeded on system resumption
[  226.311557][T11129] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2430'.
[  226.342448][T11129] SELinux:  Context system_u:object_r:initctl_t:s0 is not valid (left unmapped).
[  226.397894][T11132] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[  226.444847][T11132] EXT4-fs error (device loop4): ext4_orphan_get:1391: inode #15: comm syz.4.2435: inode has both inline data and extents flags
[  226.470760][T11132] EXT4-fs error (device loop4): ext4_orphan_get:1396: comm syz.4.2435: couldn't read orphan inode 15 (err -117)
[  226.490001][T11132] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  226.526683][ T3319] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  226.811785][T11148] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  226.820663][T11148] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  226.854846][T11151] EXT4-fs: dax option not supported
[  226.859755][T11152] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2442'.
[  226.869230][T11152] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2442'.
[  226.883798][T11152] bridge0: port 3(vlan2) entered blocking state
[  226.890305][T11152] bridge0: port 3(vlan2) entered disabled state
[  226.896838][T11152] vlan2: entered allmulticast mode
[  226.901991][T11152] bridge0: entered allmulticast mode
[  226.913575][T11152] vlan2: left allmulticast mode
[  226.918468][T11152] bridge0: left allmulticast mode
[  227.111903][T11157] bond1: option ad_user_port_key: invalid value (1136)
[  227.119006][T11157] bond1: option ad_user_port_key: allowed values 0 - 1023
[  227.170929][T11157] bond1 (unregistering): Released all slaves
[  227.290283][T11175] syzkaller0: entered promiscuous mode
[  227.295787][T11175] syzkaller0: entered allmulticast mode
[  227.441872][T11182] set_capacity_and_notify: 3 callbacks suppressed
[  227.441886][T11182] loop5: detected capacity change from 0 to 512
[  227.459021][T11182] EXT4-fs: dax option not supported
[  227.513254][T11187] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2456'.
[  227.522515][T11187] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2456'.
[  227.553557][T11187] bridge0: port 3(vlan2) entered blocking state
[  227.560008][T11187] bridge0: port 3(vlan2) entered disabled state
[  227.580402][T11187] vlan2: entered allmulticast mode
[  227.585653][T11187] bridge0: entered allmulticast mode
[  227.604592][T11187] vlan2: left allmulticast mode
[  227.609587][T11187] bridge0: left allmulticast mode
[  228.050051][T11205] all: renamed from team_slave_0 (while UP)
[  228.161129][T11211] loop0: detected capacity change from 0 to 512
[  228.170418][T11211] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2
[  228.178487][T11211] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2
[  228.180721][T11213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  228.187559][T11211] EXT4-fs (loop0): 1 truncate cleaned up
[  228.195227][T11213] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  228.203566][T11211] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  228.227935][T11211] EXT4-fs error (device loop0): ext4_map_blocks:783: inode #2: block 4: comm syz.0.2465: lblock 0 mapped to illegal pblock 4 (length 1)
[  228.242204][T11211] EXT4-fs (loop0): Remounting filesystem read-only
[  228.288917][T11216] loop4: detected capacity change from 0 to 512
[  228.296726][T11216] EXT4-fs: dax option not supported
[  228.536514][T11227] loop5: detected capacity change from 0 to 512
[  228.544260][T11227] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode
[  228.556193][T11227] EXT4-fs error (device loop5): ext4_orphan_get:1391: inode #15: comm syz.5.2470: inode has both inline data and extents flags
[  228.569978][T11227] EXT4-fs error (device loop5): ext4_orphan_get:1396: comm syz.5.2470: couldn't read orphan inode 15 (err -117)
[  228.583932][T11227] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  228.620411][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  228.987460][T11248] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  229.012366][T11248] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  229.030205][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  229.168966][T11251] loop0: detected capacity change from 0 to 512
[  229.175900][T11251] EXT4-fs: Ignoring removed i_version option
[  229.182030][T11251] EXT4-fs: Ignoring removed bh option
[  229.194130][T11251] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  229.207513][T11251] ext4 filesystem being mounted at /505/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  229.235945][T11251] lo speed is unknown, defaulting to 1000
[  229.284881][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  229.584377][T11267] loop4: detected capacity change from 0 to 512
[  229.592610][T11267] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[  229.605198][T11267] EXT4-fs error (device loop4): ext4_orphan_get:1391: inode #15: comm syz.4.2484: inode has both inline data and extents flags
[  229.621034][T11267] EXT4-fs error (device loop4): ext4_orphan_get:1396: comm syz.4.2484: couldn't read orphan inode 15 (err -117)
[  229.651920][   T29] kauditd_printk_skb: 1512 callbacks suppressed
[  229.651937][   T29] audit: type=1400 audit(1764977451.785:54021): avc:  denied  { bpf } for  pid=11270 comm="syz.5.2485" capability=39  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  229.655452][T11267] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  229.658598][   T29] audit: type=1400 audit(1764977451.785:54022): avc:  denied  { perfmon } for  pid=11270 comm="syz.5.2485" capability=38  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  229.744023][T11274] loop2: detected capacity change from 0 to 128
[  229.751924][   T29] audit: type=1400 audit(1764977451.785:54023): avc:  denied  { read write } for  pid=3314 comm="syz-executor" name="loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  229.767257][T11274] /dev/loop2: Can't open blockdev
[  229.776322][   T29] audit: type=1400 audit(1764977451.785:54024): avc:  denied  { read write open } for  pid=3314 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  229.806717][   T29] audit: type=1400 audit(1764977451.785:54025): avc:  denied  { ioctl } for  pid=3314 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=102 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  229.834622][   T29] audit: type=1400 audit(1764977451.825:54026): avc:  denied  { perfmon } for  pid=11270 comm="syz.5.2485" capability=38  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  229.855682][   T29] audit: type=1400 audit(1764977451.825:54027): avc:  denied  { bpf } for  pid=11270 comm="syz.5.2485" capability=39  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  229.876659][   T29] audit: type=1400 audit(1764977451.825:54028): avc:  denied  { prog_run } for  pid=11270 comm="syz.5.2485" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  229.895913][   T29] audit: type=1400 audit(1764977451.845:54029): avc:  denied  { map_create } for  pid=11270 comm="syz.5.2485" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  229.915373][   T29] audit: type=1400 audit(1764977451.845:54030): avc:  denied  { mount } for  pid=11266 comm="syz.4.2484" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[  229.949327][ T3319] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  230.027543][T11280] loop4: detected capacity change from 0 to 512
[  230.035329][T11280] EXT4-fs: Ignoring removed i_version option
[  230.041381][T11280] EXT4-fs: Ignoring removed bh option
[  230.053331][T11280] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  230.067152][T11280] ext4 filesystem being mounted at /498/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  230.114611][T11280] lo speed is unknown, defaulting to 1000
[  230.277344][ T3319] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  230.326949][T11294] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING
[  230.442535][T11297] xt_TPROXY: Can be used only with -p tcp or -p udp
[  231.048527][T11310] loop2: detected capacity change from 0 to 2048
[  231.074989][T11307] bond1: option ad_user_port_key: invalid value (1136)
[  231.081993][T11307] bond1: option ad_user_port_key: allowed values 0 - 1023
[  231.094428][T11310] /dev/loop2: Can't open blockdev
[  231.118712][T11307] bond1 (unregistering): Released all slaves
[  231.153330][T11314] loop0: detected capacity change from 0 to 512
[  231.160789][T11318] __nla_validate_parse: 1 callbacks suppressed
[  231.160804][T11318] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2499'.
[  231.163290][T11314] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[  231.167090][T11318] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2499'.
[  231.198269][T11318] bridge0: port 3(vlan2) entered blocking state
[  231.204598][T11318] bridge0: port 3(vlan2) entered disabled state
[  231.211613][T11318] vlan2: entered allmulticast mode
[  231.216743][T11318] bridge0: entered allmulticast mode
[  231.218028][T11319] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2500'.
[  231.231258][T11319] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2500'.
[  231.243268][T11318] vlan2: left allmulticast mode
[  231.248154][T11318] bridge0: left allmulticast mode
[  231.252215][T11322] EXT4-fs: dax option not supported
[  231.255447][T11314] EXT4-fs error (device loop0): ext4_orphan_get:1391: inode #15: comm syz.0.2498: inode has both inline data and extents flags
[  231.278041][T11314] EXT4-fs error (device loop0): ext4_orphan_get:1396: comm syz.0.2498: couldn't read orphan inode 15 (err -117)
[  231.289516][T11319] bridge0: port 3(vlan2) entered blocking state
[  231.296247][T11319] bridge0: port 3(vlan2) entered disabled state
[  231.302643][T11319] vlan2: entered allmulticast mode
[  231.302965][T11324] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING
[  231.307813][T11319] bridge0: entered allmulticast mode
[  231.312688][T11314] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  231.336299][T11319] vlan2: left allmulticast mode
[  231.341187][T11319] bridge0: left allmulticast mode
[  231.384505][T11328] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2503'.
[  231.395580][T11324] xt_TPROXY: Can be used only with -p tcp or -p udp
[  231.419832][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  231.450065][T11328] all: renamed from team_slave_0
[  231.565642][T11338] FAULT_INJECTION: forcing a failure.
[  231.565642][T11338] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  231.578816][T11338] CPU: 1 UID: 0 PID: 11338 Comm: syz.0.2508 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
[  231.578870][T11338] Tainted: [W]=WARN
[  231.578877][T11338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  231.578933][T11338] Call Trace:
[  231.578940][T11338]  <TASK>
[  231.578947][T11338]  __dump_stack+0x1d/0x30
[  231.578974][T11338]  dump_stack_lvl+0xe8/0x140
[  231.578998][T11338]  dump_stack+0x15/0x1b
[  231.579025][T11338]  should_fail_ex+0x265/0x280
[  231.579058][T11338]  should_fail+0xb/0x20
[  231.579094][T11338]  should_fail_usercopy+0x1a/0x20
[  231.579154][T11338]  _copy_from_user+0x1c/0xb0
[  231.579180][T11338]  __sys_bpf+0x183/0x7c0
[  231.579204][T11338]  __x64_sys_bpf+0x41/0x50
[  231.579230][T11338]  x64_sys_call+0x28e1/0x3000
[  231.579272][T11338]  do_syscall_64+0xd8/0x2a0
[  231.579307][T11338]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  231.579330][T11338] RIP: 0033:0x7fde9fcbf749
[  231.579348][T11338] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  231.579365][T11338] RSP: 002b:00007fde9e71f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  231.579382][T11338] RAX: ffffffffffffffda RBX: 00007fde9ff15fa0 RCX: 00007fde9fcbf749
[  231.579458][T11338] RDX: 0000000000000094 RSI: 0000200000000480 RDI: 0000000000000005
[  231.579472][T11338] RBP: 00007fde9e71f090 R08: 0000000000000000 R09: 0000000000000000
[  231.579486][T11338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  231.579544][T11338] R13: 00007fde9ff16038 R14: 00007fde9ff15fa0 R15: 00007fff6426fd68
[  231.579562][T11338]  </TASK>
[  231.886210][T11347] EXT4-fs: Ignoring removed i_version option
[  231.892435][T11347] EXT4-fs: Ignoring removed bh option
[  231.905106][T11347] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  231.916893][T11352] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2514'.
[  231.926772][T11352] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2514'.
[  231.930434][T11351] EXT4-fs: Ignoring removed i_version option
[  231.941666][T11351] EXT4-fs: Ignoring removed bh option
[  232.048672][T11347] ext4 filesystem being mounted at /490/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  232.158803][T11347] lo speed is unknown, defaulting to 1000
[  232.324164][ T3311] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  232.361990][T11351] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  232.382728][T11351] ext4 filesystem being mounted at /496/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  232.419915][T11368] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING
[  232.471609][T11351] lo speed is unknown, defaulting to 1000
[  232.535139][T11368] xt_TPROXY: Can be used only with -p tcp or -p udp
[  232.612884][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  232.872907][T11384] syzkaller0: entered promiscuous mode
[  232.878620][T11384] syzkaller0: entered allmulticast mode
[  233.129726][T11411] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2529'.
[  233.141726][T11411] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2529'.
[  233.151430][T11411] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2529'.
[  233.174415][T11411] all: renamed from team_slave_0 (while UP)
[  233.233492][T11414] set_capacity_and_notify: 3 callbacks suppressed
[  233.233507][T11414] loop0: detected capacity change from 0 to 512
[  233.248725][T11414] EXT4-fs: Ignoring removed i_version option
[  233.254757][T11414] EXT4-fs: Ignoring removed bh option
[  233.281456][T11414] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  233.294534][T11414] ext4 filesystem being mounted at /519/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  233.324424][T11414] lo speed is unknown, defaulting to 1000
[  233.387924][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  233.889569][T11438] syzkaller0: entered promiscuous mode
[  233.895420][T11438] syzkaller0: entered allmulticast mode
[  234.077884][T11444] bond1: option ad_user_port_key: invalid value (1136)
[  234.085357][T11444] bond1: option ad_user_port_key: allowed values 0 - 1023
[  234.096127][T11444] bond1 (unregistering): Released all slaves
[  234.230515][T11452] loop2: detected capacity change from 0 to 512
[  234.238838][T11452] EXT4-fs: Ignoring removed i_version option
[  234.245001][T11452] EXT4-fs: Ignoring removed bh option
[  234.278358][T11452] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  234.298585][T11452] ext4 filesystem being mounted at /501/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  234.340214][T11452] lo speed is unknown, defaulting to 1000
[  234.467813][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  234.660690][   T29] kauditd_printk_skb: 1502 callbacks suppressed
[  234.660752][   T29] audit: type=1326 audit(1764977456.795:55533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11458 comm="syz.0.2542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fde9fcb65e7 code=0x7ffc0000
[  234.690809][   T29] audit: type=1326 audit(1764977456.825:55534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11458 comm="syz.0.2542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fde9fc5b829 code=0x7ffc0000
[  234.720196][   T29] audit: type=1326 audit(1764977456.825:55535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11458 comm="syz.0.2542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fde9fcb65e7 code=0x7ffc0000
[  234.743914][   T29] audit: type=1326 audit(1764977456.825:55536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11458 comm="syz.0.2542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fde9fc5b829 code=0x7ffc0000
[  234.767606][   T29] audit: type=1326 audit(1764977456.825:55537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11458 comm="syz.0.2542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde9fcbf749 code=0x7ffc0000
[  234.791306][   T29] audit: type=1326 audit(1764977456.825:55538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11458 comm="syz.0.2542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fde9fcb65e7 code=0x7ffc0000
[  234.814853][   T29] audit: type=1326 audit(1764977456.825:55539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11458 comm="syz.0.2542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fde9fc5b829 code=0x7ffc0000
[  234.838588][   T29] audit: type=1326 audit(1764977456.825:55540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11458 comm="syz.0.2542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde9fcbf749 code=0x7ffc0000
[  234.862198][   T29] audit: type=1326 audit(1764977456.825:55541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11458 comm="syz.0.2542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fde9fcb65e7 code=0x7ffc0000
[  234.885744][   T29] audit: type=1326 audit(1764977456.825:55542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11458 comm="syz.0.2542" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fde9fc5b829 code=0x7ffc0000
[  235.139236][T11487] loop1: detected capacity change from 0 to 512
[  235.157710][T11487] EXT4-fs: Ignoring removed i_version option
[  235.163778][T11487] EXT4-fs: Ignoring removed bh option
[  235.203348][T11487] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  235.216550][T11487] ext4 filesystem being mounted at /494/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  235.242409][T11487] lo speed is unknown, defaulting to 1000
[  235.301909][T11489] all: renamed from team_slave_0 (while UP)
[  235.356016][ T3311] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  235.557495][T11509] loop1: detected capacity change from 0 to 2048
[  235.557610][T11507] loop5: detected capacity change from 0 to 2048
[  235.619790][T11507] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  235.663522][T11509] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  235.672908][T11507] ext4 filesystem being mounted at /507/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  235.688041][T11509] ext4 filesystem being mounted at /496/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  235.702772][T11509] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.2560: bg 0: block 345: padding at end of block bitmap is not set
[  235.717373][T11509] EXT4-fs (loop1): Remounting filesystem read-only
[  235.721153][T11507] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm syz.5.2559: bg 0: block 345: padding at end of block bitmap is not set
[  235.723977][T11509] EXT4-fs warning (device loop1): ext4_xattr_inode_lookup_create:1606: inode #18: comm syz.1.2560: cleanup dec ref error -117
[  235.771490][T11507] EXT4-fs (loop5): Remounting filesystem read-only
[  235.778197][T11507] EXT4-fs warning (device loop5): ext4_xattr_inode_lookup_create:1606: inode #18: comm syz.5.2559: cleanup dec ref error -117
[  235.806337][ T3311] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  235.837721][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  236.000481][T11530] bond1: option ad_user_port_key: invalid value (1136)
[  236.007423][T11530] bond1: option ad_user_port_key: allowed values 0 - 1023
[  236.049374][T11530] bond1 (unregistering): Released all slaves
[  236.340084][T11548] siw: device registration error -23
[  236.549701][T11559] bond1: option ad_user_port_key: invalid value (1136)
[  236.556638][T11559] bond1: option ad_user_port_key: allowed values 0 - 1023
[  236.558214][T11558] __nla_validate_parse: 11 callbacks suppressed
[  236.558229][T11558] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2577'.
[  236.579033][T11558] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2577'.
[  236.621220][T11559] bond1 (unregistering): Released all slaves
[  236.653325][T11558] bridge0: port 3(vlan2) entered blocking state
[  236.659632][T11558] bridge0: port 3(vlan2) entered disabled state
[  236.668091][T11558] vlan2: entered allmulticast mode
[  236.673299][T11558] bridge0: entered allmulticast mode
[  236.679458][T11558] vlan2: left allmulticast mode
[  236.684422][T11558] bridge0: left allmulticast mode
[  236.712534][T11563] loop1: detected capacity change from 0 to 512
[  236.733347][T11565] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2579'.
[  236.742489][T11565] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2579'.
[  236.757046][T11565] bridge0: port 4(vlan2) entered blocking state
[  236.759420][T11563] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2
[  236.763479][T11565] bridge0: port 4(vlan2) entered disabled state
[  236.764476][T11565] vlan2: entered allmulticast mode
[  236.782947][T11565] bridge0: entered allmulticast mode
[  236.789083][T11565] vlan2: left allmulticast mode
[  236.790186][T11563] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -2
[  236.794018][T11565] bridge0: left allmulticast mode
[  236.802597][T11563] EXT4-fs (loop1): 1 truncate cleaned up
[  236.813200][T11563] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  236.832918][T11563] EXT4-fs error (device loop1): ext4_map_blocks:783: inode #2: block 4: comm syz.1.2578: lblock 0 mapped to illegal pblock 4 (length 1)
[  236.847505][T11563] EXT4-fs (loop1): Remounting filesystem read-only
[  236.921655][T11574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  236.930218][T11574] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  236.991082][T11578] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2582'.
[  237.015172][T11578] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2582'.
[  237.101523][T11578] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2582'.
[  237.114868][T11578] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2582'.
[  237.116623][T11581] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2580'.
[  237.228625][T11585] all: renamed from team_slave_0 (while UP)
[  237.435990][T11594] loop5: detected capacity change from 0 to 512
[  237.443991][T11594] EXT4-fs: Ignoring removed i_version option
[  237.450039][T11594] EXT4-fs: Ignoring removed bh option
[  237.465893][T11594] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  237.479460][T11594] ext4 filesystem being mounted at /514/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  237.509706][T11594] lo speed is unknown, defaulting to 1000
[  237.593692][ T3311] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  237.628718][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  237.819242][T11611] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2593'.
[  237.846001][T11611] bridge0: port 3(vlan2) entered blocking state
[  237.852410][T11611] bridge0: port 3(vlan2) entered disabled state
[  237.860527][T11611] vlan2: entered allmulticast mode
[  237.865732][T11611] bridge0: entered allmulticast mode
[  237.875611][T11611] vlan2: left allmulticast mode
[  237.877345][T11614] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING
[  237.880582][T11611] bridge0: left allmulticast mode
[  237.912686][T11600] bond1: option ad_user_port_key: invalid value (1136)
[  237.919605][T11600] bond1: option ad_user_port_key: allowed values 0 - 1023
[  237.927800][T11600] bond1 (unregistering): Released all slaves
[  237.946831][T11614] xt_TPROXY: Can be used only with -p tcp or -p udp
[  237.977824][T11621] loop4: detected capacity change from 0 to 2048
[  238.016739][T11621] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  238.029806][T11621] ext4 filesystem being mounted at /519/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  238.044535][T11621] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.2596: bg 0: block 345: padding at end of block bitmap is not set
[  238.059255][T11621] EXT4-fs (loop4): Remounting filesystem read-only
[  238.065907][T11621] EXT4-fs warning (device loop4): ext4_xattr_inode_lookup_create:1606: inode #18: comm syz.4.2596: cleanup dec ref error -117
[  238.091924][ T3319] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  238.113367][T11631] loop5: detected capacity change from 0 to 512
[  238.148880][T11631] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -2
[  238.164711][T11631] EXT4-fs (loop5): Cannot turn on journaled quota: type 1: error -2
[  238.181656][T11631] EXT4-fs (loop5): 1 truncate cleaned up
[  238.200591][T11631] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  238.229038][T11623] loop2: detected capacity change from 0 to 512
[  238.247096][T11634] lo speed is unknown, defaulting to 1000
[  238.272979][T11631] EXT4-fs error (device loop5): ext4_map_blocks:783: inode #2: block 4: comm syz.5.2600: lblock 0 mapped to illegal pblock 4 (length 1)
[  238.289935][T11623] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended
[  238.299064][T11623] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem
[  238.307565][T11631] EXT4-fs (loop5): Remounting filesystem read-only
[  238.329780][T11623] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002]
[  238.340751][T11623] EXT4-fs (loop2): failed to initialize system zone (-117)
[  238.348253][T11623] EXT4-fs (loop2): mount failed
[  238.359364][   T12] Bluetooth: hci0: Frame reassembly failed (-84)
[  238.360638][T11635] syzkaller0: entered promiscuous mode
[  238.371521][T11635] syzkaller0: entered allmulticast mode
[  238.618068][T11656] bridge0: port 3(vlan2) entered blocking state
[  238.624427][T11656] bridge0: port 3(vlan2) entered disabled state
[  238.631125][T11656] vlan2: entered allmulticast mode
[  238.636245][T11656] bridge0: entered allmulticast mode
[  238.643424][T11656] vlan2: left allmulticast mode
[  238.648351][T11656] bridge0: left allmulticast mode
[  238.733403][T11657] bond1: option ad_user_port_key: invalid value (1136)
[  238.740383][T11657] bond1: option ad_user_port_key: allowed values 0 - 1023
[  238.748838][T11657] bond1 (unregistering): Released all slaves
[  238.789325][T11663] SELinux:  Context system_u:object_r:getty_etc_t:s0 is not valid (left unmapped).
[  238.947938][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  239.072329][T11685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  239.081118][T11685] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  239.293756][T11692] bond1: option ad_user_port_key: invalid value (1136)
[  239.300770][T11692] bond1: option ad_user_port_key: allowed values 0 - 1023
[  239.309445][T11692] bond1 (unregistering): Released all slaves
[  239.407093][T11698] loop0: detected capacity change from 0 to 512
[  239.414722][T11698] EXT4-fs: Ignoring removed i_version option
[  239.420837][T11698] EXT4-fs: Ignoring removed bh option
[  239.430345][T11700] loop5: detected capacity change from 0 to 2048
[  239.435130][T11698] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  239.449758][T11698] ext4 filesystem being mounted at /535/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  239.464337][T11700] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  239.477501][T11700] ext4 filesystem being mounted at /525/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  239.488256][T11698] lo speed is unknown, defaulting to 1000
[  239.497074][T11700] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm syz.5.2624: bg 0: block 345: padding at end of block bitmap is not set
[  239.512176][T11700] EXT4-fs (loop5): Remounting filesystem read-only
[  239.520452][T11700] EXT4-fs warning (device loop5): ext4_xattr_inode_lookup_create:1606: inode #18: comm syz.5.2624: cleanup dec ref error -117
[  239.548535][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  239.560016][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  239.674358][   T29] kauditd_printk_skb: 1316 callbacks suppressed
[  239.674372][   T29] audit: type=1400 audit(1764977461.805:56859): avc:  denied  { read write } for  pid=3665 comm="syz-executor" name="loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  239.704958][   T29] audit: type=1400 audit(1764977461.805:56860): avc:  denied  { open } for  pid=3665 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  239.734391][   T29] audit: type=1400 audit(1764977461.815:56861): avc:  denied  { ioctl } for  pid=3311 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  239.760153][   T29] audit: type=1400 audit(1764977461.845:56862): avc:  denied  { create } for  pid=11718 comm="syz.5.2629" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1
[  239.781033][   T29] audit: type=1400 audit(1764977461.845:56863): avc:  denied  { map_create } for  pid=11718 comm="syz.5.2629" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  239.800386][   T29] audit: type=1400 audit(1764977461.845:56864): avc:  denied  { bpf } for  pid=11718 comm="syz.5.2629" capability=39  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  239.821241][   T29] audit: type=1400 audit(1764977461.845:56865): avc:  denied  { map_read map_write } for  pid=11718 comm="syz.5.2629" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  239.841617][   T29] audit: type=1400 audit(1764977461.845:56866): avc:  denied  { prog_load } for  pid=11718 comm="syz.5.2629" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  239.860958][   T29] audit: type=1400 audit(1764977461.845:56867): avc:  denied  { bpf } for  pid=11718 comm="syz.5.2629" capability=39  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  239.881652][   T29] audit: type=1400 audit(1764977461.845:56868): avc:  denied  { perfmon } for  pid=11718 comm="syz.5.2629" capability=38  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  240.056077][T11734] loop4: detected capacity change from 0 to 512
[  240.064068][T11734] EXT4-fs: Ignoring removed i_version option
[  240.070142][T11734] EXT4-fs: Ignoring removed bh option
[  240.084143][T11734] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  240.097297][T11734] ext4 filesystem being mounted at /527/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  240.126961][T11734] lo speed is unknown, defaulting to 1000
[  240.146124][T11736] lo speed is unknown, defaulting to 1000
[  240.173384][T11740] loop1: detected capacity change from 0 to 2048
[  240.191935][ T3319] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  240.205077][T11740] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  240.220343][T11740] ext4 filesystem being mounted at /514/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  240.246150][T11740] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.2637: bg 0: block 345: padding at end of block bitmap is not set
[  240.262699][T11740] EXT4-fs (loop1): Remounting filesystem read-only
[  240.269280][T11740] EXT4-fs warning (device loop1): ext4_xattr_inode_lookup_create:1606: inode #18: comm syz.1.2637: cleanup dec ref error -117
[  240.297767][ T3311] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  240.339207][T11752] bridge0: port 3(vlan2) entered blocking state
[  240.345622][T11752] bridge0: port 3(vlan2) entered disabled state
[  240.354624][T11752] vlan2: entered allmulticast mode
[  240.359771][T11752] bridge0: entered allmulticast mode
[  240.366851][T11752] vlan2: left allmulticast mode
[  240.371740][T11752] bridge0: left allmulticast mode
[  240.427923][T11760] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  240.430257][ T3624] Bluetooth: hci0: command 0x1003 tx timeout
[  240.436699][T11760] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  240.442362][ T3519] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  241.332090][T11784] loop0: detected capacity change from 0 to 2048
[  241.364137][T11784] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  241.389984][T11784] ext4 filesystem being mounted at /540/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  241.414021][T11784] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.2650: bg 0: block 345: padding at end of block bitmap is not set
[  241.494359][T11784] EXT4-fs (loop0): Remounting filesystem read-only
[  241.512617][T11784] EXT4-fs warning (device loop0): ext4_xattr_inode_lookup_create:1606: inode #18: comm syz.0.2650: cleanup dec ref error -117
[  241.570088][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  241.652509][T11792] __nla_validate_parse: 10 callbacks suppressed
[  241.652578][T11792] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2652'.
[  242.073450][T11814] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2661'.
[  242.082539][T11814] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2661'.
[  242.133078][T11814] bridge0: port 4(vlan2) entered blocking state
[  242.139423][T11814] bridge0: port 4(vlan2) entered disabled state
[  242.161209][T11814] vlan2: entered allmulticast mode
[  242.166581][T11814] bridge0: entered allmulticast mode
[  242.189134][T11814] vlan2: left allmulticast mode
[  242.194099][T11814] bridge0: left allmulticast mode
[  242.598600][T11838] loop2: detected capacity change from 0 to 2048
[  242.633367][T11838] ext4 filesystem being mounted at /515/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  242.659128][T11838] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.2670: bg 0: block 345: padding at end of block bitmap is not set
[  242.673581][T11843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2671'.
[  242.682721][T11838] EXT4-fs (loop2): Remounting filesystem read-only
[  242.693396][T11838] EXT4-fs warning (device loop2): ext4_xattr_inode_lookup_create:1606: inode #18: comm syz.2.2670: cleanup dec ref error -117
[  242.722754][T11843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2671'.
[  242.735741][T11843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2671'.
[  242.745380][T11843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2671'.
[  242.919177][T11856] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2676'.
[  243.017682][T11859] loop5: detected capacity change from 0 to 512
[  243.093810][T11859] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -2
[  243.124369][T11859] EXT4-fs (loop5): Cannot turn on journaled quota: type 1: error -2
[  243.193215][T11859] EXT4-fs (loop5): 1 truncate cleaned up
[  243.239571][T11859] EXT4-fs error (device loop5): ext4_map_blocks:783: inode #2: block 4: comm syz.5.2677: lblock 0 mapped to illegal pblock 4 (length 1)
[  243.305028][T11859] EXT4-fs (loop5): Remounting filesystem read-only
[  243.606891][T11880] 9pnet_fd: Insufficient options for proto=fd
[  243.964312][T11896] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING
[  244.234738][T11917] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2696'.
[  244.243932][T11917] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2696'.
[  244.262652][T11917] bridge0: port 3(vlan2) entered blocking state
[  244.269001][T11917] bridge0: port 3(vlan2) entered disabled state
[  244.290318][T11917] vlan2: entered allmulticast mode
[  244.295493][T11917] bridge0: entered allmulticast mode
[  244.308445][T11917] vlan2: left allmulticast mode
[  244.313408][T11917] bridge0: left allmulticast mode
[  244.390013][T11928] loop4: detected capacity change from 0 to 512
[  244.424733][T11928] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2
[  244.473391][T11928] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -2
[  244.502423][T11928] EXT4-fs (loop4): 1 truncate cleaned up
[  244.530716][T11925] syzkaller0: entered promiscuous mode
[  244.536675][T11925] syzkaller0: entered allmulticast mode
[  244.553796][T11928] EXT4-fs error (device loop4): ext4_map_blocks:783: inode #2: block 4: comm syz.4.2700: lblock 0 mapped to illegal pblock 4 (length 1)
[  244.630749][T11928] EXT4-fs (loop4): Remounting filesystem read-only
[  244.690946][   T29] kauditd_printk_skb: 1326 callbacks suppressed
[  244.690961][   T29] audit: type=1400 audit(1764977466.825:58195): avc:  denied  { map_create } for  pid=11926 comm="syz.4.2700" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  244.760138][   T29] audit: type=1400 audit(1764977466.825:58196): avc:  denied  { bpf } for  pid=11926 comm="syz.4.2700" capability=39  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  244.781381][   T29] audit: type=1400 audit(1764977466.825:58197): avc:  denied  { map_read map_write } for  pid=11926 comm="syz.4.2700" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  244.801655][   T29] audit: type=1400 audit(1764977466.825:58198): avc:  denied  { prog_load } for  pid=11926 comm="syz.4.2700" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  244.820967][   T29] audit: type=1400 audit(1764977466.825:58199): avc:  denied  { perfmon } for  pid=11926 comm="syz.4.2700" capability=38  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  244.842192][   T29] audit: type=1400 audit(1764977466.825:58200): avc:  denied  { prog_run } for  pid=11926 comm="syz.4.2700" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  244.862024][   T29] audit: type=1400 audit(1764977466.865:58201): avc:  denied  { read write } for  pid=3313 comm="syz-executor" name="loop0" dev="devtmpfs" ino=583 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[  244.885377][   T29] audit: type=1400 audit(1764977466.865:58202): avc:  denied  { open } for  pid=3313 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=583 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[  244.908614][   T29] audit: type=1400 audit(1764977466.865:58203): avc:  denied  { ioctl } for  pid=3313 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=583 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[  244.933363][   T29] audit: type=1400 audit(1764977466.865:58204): avc:  denied  { ioctl } for  pid=11937 comm="syz.1.2703" path="/dev/autofs" dev="devtmpfs" ino=91 ioctlcmd=0x9374 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1
[  245.583336][T11979] loop2: detected capacity change from 0 to 512
[  245.590823][T11979] EXT4-fs: Ignoring removed i_version option
[  245.596942][T11979] EXT4-fs: Ignoring removed bh option
[  245.616599][T11979] ext4 filesystem being mounted at /523/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  245.657407][T11979] lo speed is unknown, defaulting to 1000
[  245.840808][T12001] loop0: detected capacity change from 0 to 512
[  245.854213][T12001] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2
[  245.862313][T12001] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2
[  245.871719][T12001] EXT4-fs (loop0): 1 truncate cleaned up
[  245.886452][T12001] EXT4-fs error (device loop0): ext4_map_blocks:783: inode #2: block 4: comm syz.0.2720: lblock 0 mapped to illegal pblock 4 (length 1)
[  245.901007][T12001] EXT4-fs (loop0): Remounting filesystem read-only
[  246.972507][T12028] loop0: detected capacity change from 0 to 512
[  246.980909][T12028] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended
[  246.990157][T12028] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem
[  247.000543][T12028] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002]
[  247.008933][T12028] EXT4-fs (loop0): failed to initialize system zone (-117)
[  247.022107][T12028] EXT4-fs (loop0): mount failed
[  247.030883][T12030] loop4: detected capacity change from 0 to 512
[  247.042916][ T5690] Bluetooth: hci0: Frame reassembly failed (-84)
[  247.076167][T12030] EXT4-fs: Ignoring removed i_version option
[  247.082259][T12030] EXT4-fs: Ignoring removed bh option
[  247.093003][T12030] ext4 filesystem being mounted at /554/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  247.109296][T12033] __nla_validate_parse: 1 callbacks suppressed
[  247.109313][T12033] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2731'.
[  247.135117][T12030] lo speed is unknown, defaulting to 1000
[  247.257206][T12051] loop5: detected capacity change from 0 to 512
[  247.265251][T12051] EXT4-fs: Ignoring removed i_version option
[  247.271307][T12051] EXT4-fs: Ignoring removed bh option
[  247.282909][T12051] ext4 filesystem being mounted at /545/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  247.427222][T12049] syzkaller0: entered promiscuous mode
[  247.433921][T12049] syzkaller0: entered allmulticast mode
[  247.445675][T12051] lo speed is unknown, defaulting to 1000
[  247.858792][T12081] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  247.878230][T12081] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  247.904835][T12083] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2747'.
[  248.157581][T12087] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2748'.
[  248.180917][T12087] all: renamed from team_slave_0 (while UP)
[  248.318024][T12089] bond1: option ad_user_port_key: invalid value (1136)
[  248.324966][T12089] bond1: option ad_user_port_key: allowed values 0 - 1023
[  248.332881][T12089] bond1 (unregistering): Released all slaves
[  248.386453][T12093] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2750'.
[  248.413764][T12093] all: renamed from team_slave_0 (while UP)
[  248.456925][T12096] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2751'.
[  248.466986][T12096] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2751'.
[  248.478687][T12096] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2751'.
[  248.494459][T12097] loop5: detected capacity change from 0 to 512
[  248.501249][T12096] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2751'.
[  248.511832][T12097] EXT4-fs: Ignoring removed i_version option
[  248.517926][T12097] EXT4-fs: Ignoring removed bh option
[  248.534010][T12097] ext4 filesystem being mounted at /552/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  248.601757][T12096] all: renamed from team_slave_0
[  248.628204][T12097] lo speed is unknown, defaulting to 1000
[  248.743511][T12117] loop2: detected capacity change from 0 to 512
[  248.751021][T12117] EXT4-fs: Ignoring removed i_version option
[  248.757272][T12117] EXT4-fs: Ignoring removed bh option
[  248.775436][T12117] ext4 filesystem being mounted at /535/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  248.791288][T12104] syzkaller0: entered promiscuous mode
[  248.797078][T12104] syzkaller0: entered allmulticast mode
[  248.838675][T12117] lo speed is unknown, defaulting to 1000
[  249.010581][T12136] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING
[  249.070182][ T3624] Bluetooth: hci0: command 0x1003 tx timeout
[  249.076540][ T3519] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  249.161567][T12144] loop5: detected capacity change from 0 to 512
[  249.161920][T12141] loop2: detected capacity change from 0 to 512
[  249.179430][T12141] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended
[  249.188535][T12141] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem
[  249.198171][T12144] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -2
[  249.206489][T12141] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002]
[  249.210223][T12144] EXT4-fs (loop5): Cannot turn on journaled quota: type 1: error -2
[  249.214971][T12141] EXT4-fs (loop2): failed to initialize system zone (-117)
[  249.229928][T12141] EXT4-fs (loop2): mount failed
[  249.237549][T12144] EXT4-fs (loop5): 1 truncate cleaned up
[  249.257050][T12144] EXT4-fs error (device loop5): ext4_map_blocks:783: inode #2: block 4: comm syz.5.2765: lblock 0 mapped to illegal pblock 4 (length 1)
[  249.280013][T12151] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2767'.
[  249.289953][T12151] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2767'.
[  249.302968][T12144] EXT4-fs (loop5): Remounting filesystem read-only
[  249.789223][   T29] kauditd_printk_skb: 1133 callbacks suppressed
[  249.789317][   T29] audit: type=1400 audit(1764977471.915:59338): avc:  denied  { prog_load } for  pid=12164 comm="syz.4.2771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  249.795416][T12165] syzkaller0: entered promiscuous mode
[  249.795644][   T29] audit: type=1400 audit(1764977471.915:59339): avc:  denied  { bpf } for  pid=12164 comm="syz.4.2771" capability=39  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  249.795669][   T29] audit: type=1400 audit(1764977471.915:59340): avc:  denied  { perfmon } for  pid=12164 comm="syz.4.2771" capability=38  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  249.848520][   T29] audit: type=1400 audit(1764977471.975:59341): avc:  denied  { create } for  pid=12164 comm="syz.4.2771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  249.863677][T12165] syzkaller0: entered allmulticast mode
[  249.885006][   T29] audit: type=1400 audit(1764977472.015:59342): avc:  denied  { write } for  pid=12164 comm="syz.4.2771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  249.910864][   T29] audit: type=1400 audit(1764977472.015:59343): avc:  denied  { read } for  pid=12164 comm="syz.4.2771" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  250.039953][   T29] audit: type=1400 audit(1764977472.105:59344): avc:  denied  { read } for  pid=12162 comm="syz.0.2770" name="loop-control" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1
[  250.064495][   T29] audit: type=1400 audit(1764977472.105:59345): avc:  denied  { read open } for  pid=12162 comm="syz.0.2770" path="/dev/loop-control" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1
[  250.089837][   T29] audit: type=1400 audit(1764977472.105:59346): avc:  denied  { ioctl } for  pid=12162 comm="syz.0.2770" path="/dev/loop-control" dev="devtmpfs" ino=99 ioctlcmd=0x4c80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1
[  250.116254][   T29] audit: type=1400 audit(1764977472.105:59347): avc:  denied  { read write } for  pid=3311 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  250.140752][T12172] loop1: detected capacity change from 0 to 512
[  250.148269][T12172] EXT4-fs: Ignoring removed i_version option
[  250.154371][T12172] EXT4-fs: Ignoring removed bh option
[  250.177992][T12172] ext4 filesystem being mounted at /537/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  250.208316][T12172] lo speed is unknown, defaulting to 1000
[  250.698777][T12199] loop0: detected capacity change from 0 to 512
[  250.716862][T12199] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended
[  250.725960][T12199] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem
[  250.742909][T12199] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002]
[  250.782330][T12199] EXT4-fs (loop0): failed to initialize system zone (-117)
[  250.789672][T12199] EXT4-fs (loop0): mount failed
[  250.809542][ T1229] Bluetooth: hci1: Frame reassembly failed (-84)
[  251.410817][T12216] loop1: detected capacity change from 0 to 512
[  251.417904][T12216] EXT4-fs: Ignoring removed i_version option
[  251.423942][T12216] EXT4-fs: Ignoring removed bh option
[  251.444505][T12216] ext4 filesystem being mounted at /540/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  251.473520][T12216] lo speed is unknown, defaulting to 1000
[  251.630559][   T45] Bluetooth: hci0: command 0x1003 tx timeout
[  251.630766][ T3519] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  252.624468][T12261] loop2: detected capacity change from 0 to 512
[  252.632056][T12261] EXT4-fs: Ignoring removed i_version option
[  252.638121][T12261] EXT4-fs: Ignoring removed bh option
[  252.658677][T12261] EXT4-fs mount: 24 callbacks suppressed
[  252.658694][T12261] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  252.680591][T12261] ext4 filesystem being mounted at /540/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  252.716525][T12261] lo speed is unknown, defaulting to 1000
[  252.776917][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  252.826269][T12275] __nla_validate_parse: 8 callbacks suppressed
[  252.826359][T12275] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2805'.
[  252.830177][ T3624] Bluetooth: hci1: Opcode 0x1003 failed: -110
[  252.832664][T12275] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2805'.
[  252.859467][T12275] bridge0: port 3(vlan2) entered blocking state
[  252.865819][T12275] bridge0: port 3(vlan2) entered disabled state
[  252.873164][T12275] vlan2: entered allmulticast mode
[  252.878310][T12275] bridge0: entered allmulticast mode
[  252.886809][T12275] vlan2: left allmulticast mode
[  252.891723][T12275] bridge0: left allmulticast mode
[  253.241684][T12282] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2807'.
[  253.251380][T12282] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2807'.
[  253.756343][T12291] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2808'.
[  253.768257][T12291] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2808'.
[  254.463553][T12311] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2814'.
[  254.485408][T12310] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2814'.
[  254.742442][T12321] loop4: detected capacity change from 0 to 512
[  254.750180][T12321] EXT4-fs: Ignoring removed i_version option
[  254.756251][T12321] EXT4-fs: Ignoring removed bh option
[  254.790173][   T29] kauditd_printk_skb: 1099 callbacks suppressed
[  254.790190][   T29] audit: type=1400 audit(1764977476.915:60447): avc:  denied  { bpf } for  pid=12318 comm="syz.0.2822" capability=39  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  254.832718][   T29] audit: type=1400 audit(1764977476.925:60448): avc:  denied  { perfmon } for  pid=12318 comm="syz.0.2822" capability=38  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  254.837734][T12321] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  254.853940][   T29] audit: type=1400 audit(1764977476.955:60449): avc:  denied  { create } for  pid=12318 comm="syz.0.2822" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1
[  254.877041][T12321] ext4 filesystem being mounted at /579/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  254.886664][   T29] audit: type=1400 audit(1764977476.965:60450): avc:  denied  { read write } for  pid=3313 comm="syz-executor" name="loop0" dev="devtmpfs" ino=583 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[  254.886689][   T29] audit: type=1400 audit(1764977476.965:60451): avc:  denied  { open } for  pid=3313 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=583 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[  254.919364][T12321] lo speed is unknown, defaulting to 1000
[  254.920342][   T29] audit: type=1400 audit(1764977476.965:60452): avc:  denied  { ioctl } for  pid=3313 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=583 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[  255.000594][   T29] audit: type=1400 audit(1764977477.005:60453): avc:  denied  { mount } for  pid=12320 comm=77DEA305FF07 name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[  255.022550][   T29] audit: type=1400 audit(1764977477.035:60454): avc:  denied  { read write } for  pid=12320 comm=77DEA305FF07 name="loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  255.047053][   T29] audit: type=1400 audit(1764977477.035:60455): avc:  denied  { open } for  pid=12320 comm=77DEA305FF07 path="/dev/loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  255.071520][   T29] audit: type=1400 audit(1764977477.035:60456): avc:  denied  { add_name } for  pid=12320 comm=77DEA305FF07 name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[  255.093994][T12329] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2824'.
[  255.106858][ T3319] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  255.286456][T12346] loop2: detected capacity change from 0 to 512
[  255.309610][T12346] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2
[  255.318651][T12346] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -2
[  255.327345][T12346] EXT4-fs (loop2): 1 truncate cleaned up
[  255.333390][T12346] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  255.348596][T12346] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #2: block 4: comm syz.2.2829: lblock 0 mapped to illegal pblock 4 (length 1)
[  255.362788][T12346] EXT4-fs (loop2): Remounting filesystem read-only
[  255.812695][T12371] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2837'.
[  256.146357][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  256.307189][T12376] ÿÿÿÿ: renamed from team_slave_0
[  256.431246][T12381] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  256.469834][T12381] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  256.792663][T12397] syzkaller0: entered promiscuous mode
[  256.798632][T12397] syzkaller0: entered allmulticast mode
[  256.930389][T12403] syzkaller0: entered promiscuous mode
[  256.935995][T12403] syzkaller0: entered allmulticast mode
[  257.174055][T12425] bridge0: port 3(vlan0) entered blocking state
[  257.180450][T12425] bridge0: port 3(vlan0) entered disabled state
[  257.187305][T12425] vlan0: entered allmulticast mode
[  257.192578][T12425] bridge0: entered allmulticast mode
[  257.206040][T12425] vlan0: left allmulticast mode
[  257.211000][T12425] bridge0: left allmulticast mode
[  257.397978][T12440] all: renamed from team_slave_0 (while UP)
[  257.739394][T12448] loop0: detected capacity change from 0 to 512
[  257.749559][T12448] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended
[  257.758679][T12448] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem
[  257.772070][T12448] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002]
[  257.785766][T12448] EXT4-fs (loop0): failed to initialize system zone (-117)
[  257.801486][T12448] EXT4-fs (loop0): mount failed
[  257.823311][ T1229] Bluetooth: hci0: Frame reassembly failed (-84)
[  257.905698][T12450] syzkaller0: entered promiscuous mode
[  257.912957][T12450] syzkaller0: entered allmulticast mode
[  258.315622][T12478] loop5: detected capacity change from 0 to 512
[  258.333538][T12478] EXT4-fs: Ignoring removed i_version option
[  258.339631][T12478] EXT4-fs: Ignoring removed bh option
[  258.373627][T12478] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  258.400460][T12478] ext4 filesystem being mounted at /580/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  258.472603][T12478] lo speed is unknown, defaulting to 1000
[  258.544463][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  258.932204][T12507] __nla_validate_parse: 9 callbacks suppressed
[  258.932220][T12507] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2890'.
[  258.947489][T12507] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2890'.
[  259.041753][T12507] bridge0: port 3(vlan2) entered blocking state
[  259.048229][T12507] bridge0: port 3(vlan2) entered disabled state
[  259.094214][T12507] vlan2: entered allmulticast mode
[  259.099408][T12507] bridge0: entered allmulticast mode
[  259.137045][T12507] vlan2: left allmulticast mode
[  259.142096][T12507] bridge0: left allmulticast mode
[  259.294638][T12519] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2894'.
[  259.304821][T12519] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2894'.
[  259.315894][T12519] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2894'.
[  259.325995][T12519] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2894'.
[  259.397291][T12519] all: renamed from team_slave_0 (while UP)
[  259.438333][T12526] loop2: detected capacity change from 0 to 512
[  259.449849][T12526] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -2
[  259.460444][T12526] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -2
[  259.483721][T12526] EXT4-fs (loop2): 1 truncate cleaned up
[  259.493001][T12526] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  259.508034][T12526] EXT4-fs error (device loop2): ext4_map_blocks:783: inode #2: block 4: comm syz.2.2898: lblock 0 mapped to illegal pblock 4 (length 1)
[  259.540507][T12526] EXT4-fs (loop2): Remounting filesystem read-only
[  259.600946][T12534] loop5: detected capacity change from 0 to 512
[  259.608757][T12534] EXT4-fs: Ignoring removed i_version option
[  259.614812][T12534] EXT4-fs: Ignoring removed bh option
[  259.655164][T12534] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  259.682021][T12534] ext4 filesystem being mounted at /588/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  259.707047][   T43] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  259.870812][ T3624] Bluetooth: hci0: command 0x1003 tx timeout
[  259.876985][ T3519] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  259.894368][T12530] lo speed is unknown, defaulting to 1000
[  259.925608][   T43] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  259.941466][T12534] lo speed is unknown, defaulting to 1000
[  259.961025][   T29] kauditd_printk_skb: 1110 callbacks suppressed
[  259.961041][   T29] audit: type=1400 audit(1764977482.095:61567): avc:  denied  { read write } for  pid=3311 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  259.992863][   T29] audit: type=1400 audit(1764977482.095:61568): avc:  denied  { open } for  pid=3311 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  260.017099][   T29] audit: type=1400 audit(1764977482.095:61569): avc:  denied  { ioctl } for  pid=3311 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  260.042755][   T29] audit: type=1400 audit(1764977482.125:61570): avc:  denied  { map_create } for  pid=12549 comm="syz.1.2902" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  260.062186][   T29] audit: type=1400 audit(1764977482.125:61571): avc:  denied  { open } for  pid=12549 comm="syz.1.2902" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1
[  260.081962][   T29] audit: type=1400 audit(1764977482.125:61572): avc:  denied  { perfmon } for  pid=12549 comm="syz.1.2902" capability=38  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  260.104218][   T29] audit: type=1400 audit(1764977482.125:61573): avc:  denied  { kernel } for  pid=12549 comm="syz.1.2902" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1
[  260.123954][   T29] audit: type=1400 audit(1764977482.125:61574): avc:  denied  { perfmon } for  pid=12549 comm="syz.1.2902" capability=38  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  260.148618][   T43] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  260.158953][   T29] audit: type=1400 audit(1764977482.285:61575): avc:  denied  { unmount } for  pid=3665 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[  260.169956][ T3665] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  260.193411][   T29] audit: type=1400 audit(1764977482.325:61576): avc:  denied  { read write } for  pid=3665 comm="syz-executor" name="loop5" dev="devtmpfs" ino=105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  260.229839][T12553] syzkaller0: entered promiscuous mode
[  260.235369][T12553] syzkaller0: entered allmulticast mode
[  260.257486][   T43] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  260.281154][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  260.303865][T12530] chnl_net:caif_netlink_parms(): no params data found
[  260.379649][T12530] bridge0: port 1(bridge_slave_0) entered blocking state
[  260.386797][T12530] bridge0: port 1(bridge_slave_0) entered disabled state
[  260.406491][T12530] bridge_slave_0: entered allmulticast mode
[  260.413246][T12530] bridge_slave_0: entered promiscuous mode
[  260.422186][T12530] bridge0: port 2(bridge_slave_1) entered blocking state
[  260.429387][T12530] bridge0: port 2(bridge_slave_1) entered disabled state
[  260.437117][T12530] bridge_slave_1: entered allmulticast mode
[  260.443962][T12530] bridge_slave_1: entered promiscuous mode
[  260.450815][   T43] bridge_slave_1: left allmulticast mode
[  260.456492][   T43] bridge_slave_1: left promiscuous mode
[  260.462240][   T43] bridge0: port 2(bridge_slave_1) entered disabled state
[  260.470737][   T43] bridge_slave_0: left allmulticast mode
[  260.476638][   T43] bridge_slave_0: left promiscuous mode
[  260.482365][   T43] bridge0: port 1(bridge_slave_0) entered disabled state
[  260.525493][T12566] loop1: detected capacity change from 0 to 512
[  260.533749][T12566] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended
[  260.543079][T12566] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem
[  260.552838][T12566] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002]
[  260.561626][T12566] EXT4-fs (loop1): failed to initialize system zone (-117)
[  260.568891][T12566] EXT4-fs (loop1): mount failed
[  260.602291][   T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  260.612100][   T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  260.621647][   T43] bond0 (unregistering): Released all slaves
[  260.629971][   T43] bond1 (unregistering): Released all slaves
[  260.693443][T12573] syzkaller0: entered promiscuous mode
[  260.699060][T12573] syzkaller0: entered allmulticast mode
[  260.707139][   T43] tipc: Disabling bearer <udp:£>
[  260.712137][   T43] tipc: Disabling bearer <udp:syz2>
[  260.717374][   T43] tipc: Left network mode
[  260.718737][T12530] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  260.732782][T12530] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  260.766485][   T43] hsr_slave_0: left promiscuous mode
[  260.772415][   T43] hsr_slave_1: left promiscuous mode
[  260.778040][   T43] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  260.785473][   T43] batman_adv: batadv0: Removing interface: batadv_slave_0
[  260.794185][   T43] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  260.801630][   T43] batman_adv: batadv0: Removing interface: batadv_slave_1
[  260.811530][   T43] veth1_macvtap: left promiscuous mode
[  260.817108][   T43] veth0_macvtap: left promiscuous mode
[  260.822857][   T43] veth1_vlan: left promiscuous mode
[  260.828193][   T43] veth0_vlan: left promiscuous mode
[  260.893692][   T43] team0 (unregistering): Port device team_slave_1 removed
[  260.904960][   T43] team0 (unregistering): Port device ÿÿÿÿ removed
[  260.933622][T12530] team0: Port device team_slave_0 added
[  260.939233][ T9469] lo speed is unknown, defaulting to 1000
[  260.942137][T12530] team0: Port device team_slave_1 added
[  260.945036][ T9469] infiniband syz2: ib_query_port failed (-19)
[  260.968920][T12530] batman_adv: batadv0: Adding interface: batadv_slave_0
[  260.976002][T12530] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  261.001920][T12530] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  261.013077][T12583] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2910'.
[  261.023169][T12530] batman_adv: batadv0: Adding interface: batadv_slave_1
[  261.030230][T12530] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  261.056260][T12530] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  261.071971][T12583] ÿÿÿÿ: renamed from team_slave_0 (while UP)
[  261.120968][T12530] hsr_slave_0: entered promiscuous mode
[  261.127174][T12530] hsr_slave_1: entered promiscuous mode
[  261.134275][T12530] debugfs: 'hsr0' already exists in 'hsr'
[  261.140019][T12530] Cannot create hsr debugfs directory
[  261.160650][T12589] loop0: detected capacity change from 0 to 512
[  261.194314][T12589] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -2
[  261.215760][   T43] IPVS: stop unused estimator thread 0...
[  261.224513][T12595] loop2: detected capacity change from 0 to 2048
[  261.239368][T12589] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -2
[  261.249200][T12589] EXT4-fs (loop0): 1 truncate cleaned up
[  261.250397][T12587] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2911'.
[  261.255397][T12589] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  261.279972][T12595] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  261.292790][T12595] ext4 filesystem being mounted at /561/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  261.305051][T12589] EXT4-fs error (device loop0): ext4_map_blocks:783: inode #2: block 4: comm syz.0.2913: lblock 0 mapped to illegal pblock 4 (length 1)
[  261.320270][T12595] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.2914: bg 0: block 345: padding at end of block bitmap is not set
[  261.334812][T12595] EXT4-fs (loop2): Remounting filesystem read-only
[  261.341637][T12589] EXT4-fs (loop0): Remounting filesystem read-only
[  261.341671][T12595] EXT4-fs warning (device loop2): ext4_xattr_inode_lookup_create:1606: inode #18: comm syz.2.2914: cleanup dec ref error -117
[  261.387346][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  261.636360][T12613] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2918'.
[  261.646253][T12613] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2918'.
[  261.655670][T12530] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  261.664557][T12530] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  261.673889][T12530] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  261.684577][T12530] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  261.703628][T12613] all: renamed from team_slave_0 (while UP)
[  261.739782][T12530] 8021q: adding VLAN 0 to HW filter on device bond0
[  261.755663][T12530] 8021q: adding VLAN 0 to HW filter on device team0
[  261.764767][   T43] bridge0: port 1(bridge_slave_0) entered blocking state
[  261.771897][   T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[  261.786398][   T43] bridge0: port 2(bridge_slave_1) entered blocking state
[  261.793525][   T43] bridge0: port 2(bridge_slave_1) entered forwarding state
[  261.902282][T12530] 8021q: adding VLAN 0 to HW filter on device batadv0
[  262.011810][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  262.124975][T12640] bridge0: port 4(vlan2) entered blocking state
[  262.131474][T12640] bridge0: port 4(vlan2) entered disabled state
[  262.137938][T12640] vlan2: entered allmulticast mode
[  262.143293][T12640] bridge0: entered allmulticast mode
[  262.149244][T12640] vlan2: left allmulticast mode
[  262.154209][T12640] bridge0: left allmulticast mode
[  262.166269][T12530] veth0_vlan: entered promiscuous mode
[  262.176003][T12530] veth1_vlan: entered promiscuous mode
[  262.191392][T12530] veth0_macvtap: entered promiscuous mode
[  262.198614][T12530] veth1_macvtap: entered promiscuous mode
[  262.214568][T12530] batman_adv: batadv0: Interface activated: batadv_slave_0
[  262.228329][T12530] batman_adv: batadv0: Interface activated: batadv_slave_1
[  262.240402][ T5616] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  262.260663][ T5616] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  262.274804][ T5616] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  262.309793][ T5616] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  262.361606][T12650] loop0: detected capacity change from 0 to 512
[  262.390141][T12650] EXT4-fs: Ignoring removed i_version option
[  262.396256][T12650] EXT4-fs: Ignoring removed bh option
[  262.435217][T12650] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  262.486384][T12650] ext4 filesystem being mounted at /584/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  262.590496][ T3624] Bluetooth: hci0: command 0x1003 tx timeout
[  262.596716][ T3519] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  262.670074][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  262.704023][T12678] loop4: detected capacity change from 0 to 512
[  262.711933][T12678] EXT4-fs: Ignoring removed i_version option
[  262.717983][T12678] EXT4-fs: Ignoring removed bh option
[  262.753423][T12678] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  262.769673][T12678] ext4 filesystem being mounted at /1/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  262.870181][T12530] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  263.030678][T12688] syzkaller0: entered promiscuous mode
[  263.036407][T12688] syzkaller0: entered allmulticast mode
[  263.065460][T12692] veth0: entered promiscuous mode
[  263.117875][T12691] bond1: option ad_user_port_key: invalid value (1136)
[  263.124883][T12691] bond1: option ad_user_port_key: allowed values 0 - 1023
[  263.135436][T12691] bond1 (unregistering): Released all slaves
[  263.190793][T12697] loop2: detected capacity change from 0 to 512
[  263.198620][T12697] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended
[  263.208212][T12697] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem
[  263.218399][T12697] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002]
[  263.226500][T12697] EXT4-fs (loop2): failed to initialize system zone (-117)
[  263.233890][T12697] EXT4-fs (loop2): mount failed
[  263.244542][ T5616] Bluetooth: hci0: Frame reassembly failed (-84)
[  263.480486][ T4092] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  263.536117][ T4092] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  263.600977][ T4092] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  263.697632][ T4092] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  263.742864][T12712] chnl_net:caif_netlink_parms(): no params data found
[  263.801193][ T4092] bridge_slave_1: left allmulticast mode
[  263.806959][ T4092] bridge_slave_1: left promiscuous mode
[  263.812699][ T4092] bridge0: port 2(bridge_slave_1) entered disabled state
[  263.821031][ T4092] bridge_slave_0: left allmulticast mode
[  263.826666][ T4092] bridge_slave_0: left promiscuous mode
[  263.832424][ T4092] bridge0: port 1(bridge_slave_0) entered disabled state
[  263.901821][ T4092] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  263.911879][ T4092] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  263.921305][ T4092] bond0 (unregistering): Released all slaves
[  263.935573][T12712] bridge0: port 1(bridge_slave_0) entered blocking state
[  263.942923][T12712] bridge0: port 1(bridge_slave_0) entered disabled state
[  263.950487][T12712] bridge_slave_0: entered allmulticast mode
[  263.956821][T12712] bridge_slave_0: entered promiscuous mode
[  263.963629][T12712] bridge0: port 2(bridge_slave_1) entered blocking state
[  263.970777][T12712] bridge0: port 2(bridge_slave_1) entered disabled state
[  263.977965][T12712] bridge_slave_1: entered allmulticast mode
[  263.984479][T12712] bridge_slave_1: entered promiscuous mode
[  264.012531][T12732] __nla_validate_parse: 8 callbacks suppressed
[  264.012544][T12732] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2942'.
[  264.030742][T12712] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  264.031656][T12732] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2942'.
[  264.053704][ T4092] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  264.061308][ T4092] batman_adv: batadv0: Removing interface: batadv_slave_0
[  264.068964][ T4092] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  264.076515][ T4092] batman_adv: batadv0: Removing interface: batadv_slave_1
[  264.092070][ T4092] veth1_macvtap: left promiscuous mode
[  264.097645][ T4092] veth0_macvtap: left promiscuous mode
[  264.103305][ T4092] veth1_vlan: left promiscuous mode
[  264.110470][ T4092] veth0_vlan: left promiscuous mode
[  264.224558][ T4092] team0 (unregistering): Port device team_slave_1 removed
[  264.234610][ T4092] team0 (unregistering): Port device team_slave_0 removed
[  264.272547][T12712] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  264.327290][T12712] team0: Port device team_slave_0 added
[  264.334234][T12712] team0: Port device team_slave_1 added
[  264.355733][T12712] batman_adv: batadv0: Adding interface: batadv_slave_0
[  264.362761][T12712] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  264.388682][T12712] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  264.401770][T12712] batman_adv: batadv0: Adding interface: batadv_slave_1
[  264.408763][T12712] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  264.434896][T12712] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  264.470067][T12712] hsr_slave_0: entered promiscuous mode
[  264.476819][T12712] hsr_slave_1: entered promiscuous mode
[  264.483030][T12712] debugfs: 'hsr0' already exists in 'hsr'
[  264.488789][T12712] Cannot create hsr debugfs directory
[  264.699898][T12743] loop0: detected capacity change from 0 to 2048
[  264.723889][T12743] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  264.736878][T12743] ext4 filesystem being mounted at /591/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  264.751564][T12743] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.2946: bg 0: block 345: padding at end of block bitmap is not set
[  264.770646][T12743] EXT4-fs (loop0): Remounting filesystem read-only
[  264.777334][T12743] EXT4-fs warning (device loop0): ext4_xattr_inode_lookup_create:1606: inode #18: comm syz.0.2946: cleanup dec ref error -117
[  264.785313][T12712] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  264.799813][T12712] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  264.810588][T12712] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  264.810990][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  264.828784][T12712] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  264.877886][T12712] 8021q: adding VLAN 0 to HW filter on device bond0
[  264.892391][T12712] 8021q: adding VLAN 0 to HW filter on device team0
[  264.903058][ T4092] bridge0: port 1(bridge_slave_0) entered blocking state
[  264.910225][ T4092] bridge0: port 1(bridge_slave_0) entered forwarding state
[  264.930245][T12712] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  264.940779][T12712] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  264.954622][ T4092] bridge0: port 2(bridge_slave_1) entered blocking state
[  264.961804][ T4092] bridge0: port 2(bridge_slave_1) entered forwarding state
[  264.978079][   T29] kauditd_printk_skb: 875 callbacks suppressed
[  264.978096][   T29] audit: type=1400 audit(1764977487.105:62452): avc:  denied  { module_request } for  pid=12712 comm="syz-executor" kmod="netdev-nicvf0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[  265.035402][   T29] audit: type=1400 audit(1764977487.125:62453): avc:  denied  { sys_module } for  pid=12712 comm="syz-executor" capability=16  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[  265.056904][   T29] audit: type=1400 audit(1764977487.125:62454): avc:  denied  { module_request } for  pid=12712 comm="syz-executor" kmod="nicvf0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[  265.078770][   T29] audit: type=1400 audit(1764977487.135:62455): avc:  denied  { module_request } for  pid=12712 comm="syz-executor" kmod="netdev-nicvf0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[  265.085105][T12712] 8021q: adding VLAN 0 to HW filter on device batadv0
[  265.101126][   T29] audit: type=1400 audit(1764977487.155:62456): avc:  denied  { sys_module } for  pid=12712 comm="syz-executor" capability=16  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[  265.129256][   T29] audit: type=1400 audit(1764977487.155:62457): avc:  denied  { module_request } for  pid=12712 comm="syz-executor" kmod="nicvf0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[  265.166654][   T29] audit: type=1400 audit(1764977487.185:62458): avc:  denied  { unlink } for  pid=3311 comm="syz-executor" name="file0" dev="tmpfs" ino=3050 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1
[  265.189517][   T29] audit: type=1400 audit(1764977487.185:62459): avc:  denied  { read write } for  pid=3311 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  265.213842][   T29] audit: type=1400 audit(1764977487.185:62460): avc:  denied  { open } for  pid=3311 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  265.238039][   T29] audit: type=1400 audit(1764977487.185:62461): avc:  denied  { ioctl } for  pid=3311 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  265.320458][ T3624] Bluetooth: hci0: command 0x1003 tx timeout
[  265.326496][ T3519] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  265.497075][T12712] veth0_vlan: entered promiscuous mode
[  265.505344][T12712] veth1_vlan: entered promiscuous mode
[  265.522193][T12712] veth0_macvtap: entered promiscuous mode
[  265.529811][T12712] veth1_macvtap: entered promiscuous mode
[  265.542257][T12712] batman_adv: batadv0: Interface activated: batadv_slave_0
[  265.589376][T12712] batman_adv: batadv0: Interface activated: batadv_slave_1
[  265.703671][T12777] syzkaller0: entered promiscuous mode
[  265.709366][T12777] syzkaller0: entered allmulticast mode
[  265.734390][ T4092] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  265.747588][ T4092] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  265.780040][ T4092] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  265.800246][ T4092] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  265.877357][T12788] loop5: detected capacity change from 0 to 512
[  265.896756][T12788] EXT4-fs: Ignoring removed i_version option
[  265.902926][T12788] EXT4-fs: Ignoring removed bh option
[  265.971567][T12788] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  265.984517][T12788] ext4 filesystem being mounted at /0/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  266.082318][T12793] loop1: detected capacity change from 0 to 512
[  266.091003][T12793] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended
[  266.100148][T12793] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem
[  266.119559][T12793] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002]
[  266.128542][T12712] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  266.147739][T12793] EXT4-fs (loop1): failed to initialize system zone (-117)
[  266.180277][T12793] EXT4-fs (loop1): mount failed
[  266.208900][ T5616] Bluetooth: hci0: Frame reassembly failed (-84)
[  266.247694][T12809] loop4: detected capacity change from 0 to 128
[  266.541113][T12818] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  266.564939][T12818] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  267.398707][T12834] syzkaller0: entered promiscuous mode
[  267.404638][T12834] syzkaller0: entered allmulticast mode
[  267.419774][T12838] loop2: detected capacity change from 0 to 256
[  267.455023][T12838] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2967'.
[  267.625047][T12852] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2972'.
[  267.634196][T12852] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2972'.
[  267.648461][T12852] bridge0: port 3(vlan2) entered blocking state
[  267.654871][T12852] bridge0: port 3(vlan2) entered disabled state
[  267.662871][T12852] vlan2: entered allmulticast mode
[  267.668084][T12852] bridge0: entered allmulticast mode
[  267.674274][T12852] vlan2: left allmulticast mode
[  267.679168][T12852] bridge0: left allmulticast mode
[  267.752343][T12859] loop4: detected capacity change from 0 to 128
[  267.811698][T12862] loop2: detected capacity change from 0 to 512
[  267.819360][T12862] EXT4-fs: Ignoring removed i_version option
[  267.825555][T12862] EXT4-fs: Ignoring removed bh option
[  267.876538][T12862] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  267.926764][T12862] ext4 filesystem being mounted at /575/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  268.100520][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  268.270669][ T3624] Bluetooth: hci0: command 0x1003 tx timeout
[  268.276741][ T3519] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  268.409634][T12883] loop2: detected capacity change from 0 to 512
[  268.417576][T12883] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
[  268.454406][T12883] EXT4-fs error (device loop2): ext4_free_branches:1023: inode #16: comm syz.2.2982: invalid indirect mapped block 1024 (level 0)
[  268.473329][T12883] EXT4-fs (loop2): Remounting filesystem read-only
[  268.492488][T12883] EXT4-fs (loop2): 1 orphan inode deleted
[  268.498274][T12883] EXT4-fs (loop2): 1 truncate cleaned up
[  268.512895][T12883] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  268.569051][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  268.665799][T12894] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2987'.
[  268.675846][T12894] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2987'.
[  268.685213][T12894] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2987'.
[  268.694524][T12894] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2987'.
[  268.803197][T12897] loop2: detected capacity change from 0 to 2048
[  268.848293][T12897] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  268.863085][T12897] ext4 filesystem being mounted at /581/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  268.895464][T12904] loop0: detected capacity change from 0 to 2048
[  268.916543][T12904] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  268.934813][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  268.944569][T12904] ext4 filesystem being mounted at /599/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  269.042989][T12911] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  269.057691][T12911] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  269.089072][ T3313] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  269.160610][T12915] loop5: detected capacity change from 0 to 512
[  269.168469][T12915] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode
[  269.262209][T12915] EXT4-fs (loop5): 1 truncate cleaned up
[  269.269373][T12915] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  269.414799][T12712] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  269.454769][ T3441] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  269.575667][ T3441] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  269.645609][ T3441] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  269.669977][T12936] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2997'.
[  269.687961][T12936] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2997'.
[  269.703844][T12936] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2997'.
[  269.819685][ T3441] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  269.843047][T12936] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2997'.
[  269.861594][T12919] chnl_net:caif_netlink_parms(): no params data found
[  269.914169][T12941] all: renamed from team_slave_0 (while UP)
[  270.016365][   T29] kauditd_printk_skb: 1200 callbacks suppressed
[  270.016385][   T29] audit: type=1400 audit(1764977492.105:63662): avc:  denied  { map_read map_write } for  pid=12951 comm="syz.5.3002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  270.042753][   T29] audit: type=1400 audit(1764977492.115:63663): avc:  denied  { prog_load } for  pid=12943 comm="syz.1.3000" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  270.062236][   T29] audit: type=1400 audit(1764977492.115:63664): avc:  denied  { bpf } for  pid=12943 comm="syz.1.3000" capability=39  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  270.083117][   T29] audit: type=1400 audit(1764977492.115:63665): avc:  denied  { perfmon } for  pid=12943 comm="syz.1.3000" capability=38  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  270.104291][   T29] audit: type=1400 audit(1764977492.115:63666): avc:  denied  { prog_run } for  pid=12943 comm="syz.1.3000" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  270.123522][   T29] audit: type=1400 audit(1764977492.135:63667): avc:  denied  { read write } for  pid=12530 comm="syz-executor" name="loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  270.147900][   T29] audit: type=1400 audit(1764977492.135:63668): avc:  denied  { open } for  pid=12530 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  270.172340][   T29] audit: type=1400 audit(1764977492.135:63669): avc:  denied  { ioctl } for  pid=12530 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=104 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  270.183296][T12955] loop4: detected capacity change from 0 to 2048
[  270.217996][   T29] audit: type=1400 audit(1764977492.155:63670): avc:  denied  { prog_load } for  pid=12951 comm="syz.5.3002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  270.237255][   T29] audit: type=1400 audit(1764977492.155:63671): avc:  denied  { bpf } for  pid=12951 comm="syz.5.3002" capability=39  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  270.263053][ T3441] dummy0: left allmulticast mode
[  270.272676][ T3441] bridge0: port 3(dummy0) entered disabled state
[  270.288752][ T3441] bridge_slave_1: left allmulticast mode
[  270.294499][ T3441] bridge_slave_1: left promiscuous mode
[  270.300354][ T3441] bridge0: port 2(bridge_slave_1) entered disabled state
[  270.308283][T12955] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  270.324191][ T3441] bridge_slave_0: left allmulticast mode
[  270.324439][T12955] ext4 filesystem being mounted at /18/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  270.329911][ T3441] bridge_slave_0: left promiscuous mode
[  270.346330][ T3441] bridge0: port 1(bridge_slave_0) entered disabled state
[  270.492608][T12530] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  270.623097][ T3441] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  270.636536][ T3441] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  270.651803][ T3441] bond0 (unregistering): Released all slaves
[  270.668026][T12919] bridge0: port 1(bridge_slave_0) entered blocking state
[  270.675345][T12919] bridge0: port 1(bridge_slave_0) entered disabled state
[  270.701595][T12919] bridge_slave_0: entered allmulticast mode
[  270.730930][T12919] bridge_slave_0: entered promiscuous mode
[  270.746661][ T3441] hsr_slave_0: left promiscuous mode
[  270.757893][ T3441] hsr_slave_1: left promiscuous mode
[  270.770705][ T3441] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  270.778126][ T3441] batman_adv: batadv0: Removing interface: batadv_slave_0
[  270.814713][ T3441] veth1_macvtap: left promiscuous mode
[  270.820595][ T3441] veth0_macvtap: left promiscuous mode
[  270.830266][ T3441] veth1_vlan: left promiscuous mode
[  270.840929][ T3441] veth0_vlan: left promiscuous mode
[  270.979853][ T3441] team_slave_1 (unregistering): left promiscuous mode
[  270.998318][ T3441] team0 (unregistering): Port device team_slave_1 removed
[  271.015776][ T3441] ÿÿÿÿ (unregistering): left promiscuous mode
[  271.022757][ T3441] team0 (unregistering): Port device ÿÿÿÿ removed
[  271.056264][T12919] bridge0: port 2(bridge_slave_1) entered blocking state
[  271.063501][T12919] bridge0: port 2(bridge_slave_1) entered disabled state
[  271.076533][T12981] FAULT_INJECTION: forcing a failure.
[  271.076533][T12981] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[  271.082133][T12919] bridge_slave_1: entered allmulticast mode
[  271.089944][T12981] CPU: 0 UID: 0 PID: 12981 Comm: syz.2.3008 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
[  271.089980][T12981] Tainted: [W]=WARN
[  271.089988][T12981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  271.090002][T12981] Call Trace:
[  271.090090][T12981]  <TASK>
[  271.090099][T12981]  __dump_stack+0x1d/0x30
[  271.090125][T12981]  dump_stack_lvl+0xe8/0x140
[  271.090149][T12981]  dump_stack+0x15/0x1b
[  271.090205][T12981]  should_fail_ex+0x265/0x280
[  271.090321][T12981]  should_fail_alloc_page+0xf2/0x100
[  271.090344][T12981]  __alloc_frozen_pages_noprof+0xff/0x360
[  271.090421][T12981]  alloc_pages_mpol+0xb3/0x260
[  271.090494][T12981]  vma_alloc_folio_noprof+0x1aa/0x300
[  271.090525][T12981]  do_wp_page+0xf60/0x2510
[  271.090581][T12981]  ? css_rstat_updated+0xb7/0x240
[  271.090623][T12981]  ? __rcu_read_lock+0x37/0x50
[  271.090648][T12981]  handle_mm_fault+0x77d/0x2be0
[  271.090677][T12981]  ? __rcu_read_unlock+0x4f/0x70
[  271.090721][T12981]  ? mt_find+0x21b/0x330
[  271.090859][T12981]  do_user_addr_fault+0x3fe/0x1080
[  271.090893][T12981]  exc_page_fault+0x62/0xa0
[  271.090916][T12981]  asm_exc_page_fault+0x26/0x30
[  271.090954][T12981] RIP: 0010:rep_movs_alternative+0x4a/0x90
[  271.091019][T12981] Code: 19 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 <f3> a4 e9 cf 19 02 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48
[  271.091049][T12981] RSP: 0018:ffffc900016afbd0 EFLAGS: 00050206
[  271.091066][T12981] RAX: ffff8881495dcc90 RBX: ffff888125550000 RCX: 0000000000000d00
[  271.091142][T12981] RDX: 0000000000000000 RSI: ffff888125550300 RDI: 0000200000008000
[  271.091155][T12981] RBP: 0000200000007d00 R08: 0000000000000999 R09: 0000000000000000
[  271.091173][T12981] R10: 0001888125550000 R11: 0001888125550fff R12: 0000200000008d00
[  271.091187][T12981] R13: ffffc900016afdf8 R14: 0000000000001000 R15: 00007ffffffff000
[  271.091206][T12981]  _copy_to_iter+0x141/0xe70
[  271.091228][T12981]  ? _raw_spin_unlock+0x26/0x50
[  271.091374][T12981]  ? __free_frozen_pages+0x284/0x510
[  271.091398][T12981]  ? __mem_cgroup_uncharge+0x50/0x80
[  271.091430][T12981]  ? __folio_put+0x11e/0x150
[  271.091455][T12981]  copy_page_to_iter+0x18f/0x2d0
[  271.091550][T12981]  anon_pipe_read+0x236/0x750
[  271.091578][T12981]  ? __pfx_anon_pipe_read+0x10/0x10
[  271.091598][T12981]  vfs_read+0x64c/0x770
[  271.091680][T12981]  ? __pfx_anon_pipe_read+0x10/0x10
[  271.091706][T12981]  ksys_read+0xda/0x1a0
[  271.091737][T12981]  __x64_sys_read+0x40/0x50
[  271.091787][T12981]  x64_sys_call+0x2889/0x3000
[  271.091877][T12981]  do_syscall_64+0xd8/0x2a0
[  271.091906][T12981]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  271.091959][T12981] RIP: 0033:0x7f68c095f749
[  271.091976][T12981] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  271.091994][T12981] RSP: 002b:00007f68bf39e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  271.092091][T12981] RAX: ffffffffffffffda RBX: 00007f68c0bb6090 RCX: 00007f68c095f749
[  271.092105][T12981] RDX: 0000000000018fe4 RSI: 0000200000004d00 RDI: 0000000000000005
[  271.092118][T12981] RBP: 00007f68bf39e090 R08: 0000000000000000 R09: 0000000000000000
[  271.092132][T12981] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  271.092145][T12981] R13: 00007f68c0bb6128 R14: 00007f68c0bb6090 R15: 00007ffdfe1d8338
[  271.092188][T12981]  </TASK>
[  271.184742][T12988] loop4: detected capacity change from 0 to 512
[  271.186175][T12919] bridge_slave_1: entered promiscuous mode
[  271.196552][T12988] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2
[  271.200320][T12977] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3009'.
[  271.204916][T12988] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -2
[  271.467690][T12988] EXT4-fs (loop4): 1 truncate cleaned up
[  271.492642][T12988] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  271.575354][T12919] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  271.591984][T12988] EXT4-fs error (device loop4): ext4_map_blocks:783: inode #2: block 4: comm syz.4.3013: lblock 0 mapped to illegal pblock 4 (length 1)
[  271.613231][T12919] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  271.627626][T12988] EXT4-fs (loop4): Remounting filesystem read-only
[  271.642397][T12919] team0: Port device team_slave_0 added
[  271.651059][T12919] team0: Port device team_slave_1 added
[  271.705480][T12919] batman_adv: batadv0: Adding interface: batadv_slave_0
[  271.712561][T12919] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  271.738604][T12919] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  271.751628][T12919] batman_adv: batadv0: Adding interface: batadv_slave_1
[  271.758579][T12919] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  271.784537][T12919] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  271.824356][T12919] hsr_slave_0: entered promiscuous mode
[  271.832871][T12919] hsr_slave_1: entered promiscuous mode
[  271.839328][T12919] debugfs: 'hsr0' already exists in 'hsr'
[  271.845121][T12919] Cannot create hsr debugfs directory
[  272.074971][T13011] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3019'.
[  272.088086][T13011] netlink: 204 bytes leftover after parsing attributes in process `syz.2.3019'.
[  272.097460][T13011] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3019'.
[  272.118195][T13011] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3019'.
[  272.127990][T12530] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  272.142599][T12919] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  272.152642][T12919] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  272.162761][T12919] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  272.180555][T12919] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  272.276697][T13024] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3017'.
[  272.569622][T12919] 8021q: adding VLAN 0 to HW filter on device bond0
[  272.598964][T12919] 8021q: adding VLAN 0 to HW filter on device team0
[  272.618978][ T1229] bridge0: port 1(bridge_slave_0) entered blocking state
[  272.626081][ T1229] bridge0: port 1(bridge_slave_0) entered forwarding state
[  272.661527][ T1229] bridge0: port 2(bridge_slave_1) entered blocking state
[  272.668702][ T1229] bridge0: port 2(bridge_slave_1) entered forwarding state
[  272.707749][T12919] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  272.829208][T12919] 8021q: adding VLAN 0 to HW filter on device batadv0
[  272.945487][T13035] loop2: detected capacity change from 0 to 256
[  273.045382][T12919] veth0_vlan: entered promiscuous mode
[  273.064648][T12919] veth1_vlan: entered promiscuous mode
[  273.089461][T12919] veth0_macvtap: entered promiscuous mode
[  273.110420][T12919] veth1_macvtap: entered promiscuous mode
[  273.140658][T12919] batman_adv: batadv0: Interface activated: batadv_slave_0
[  273.163155][T12919] batman_adv: batadv0: Interface activated: batadv_slave_1
[  273.188651][T13043] bridge0: port 3(vlan2) entered blocking state
[  273.195144][T13043] bridge0: port 3(vlan2) entered disabled state
[  273.206890][T13043] vlan2: entered allmulticast mode
[  273.212117][T13043] bridge0: entered allmulticast mode
[  273.219955][T13043] vlan2: left allmulticast mode
[  273.224892][T13043] bridge0: left allmulticast mode
[  273.249282][   T43] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  273.267224][   T43] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  273.284503][   T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  273.294055][   T43] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  273.419446][T13056] loop0: detected capacity change from 0 to 128
[  274.183729][T13076] loop4: detected capacity change from 0 to 512
[  274.205795][T13076] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[  274.225288][T13076] EXT4-fs (loop4): 1 truncate cleaned up
[  274.239786][T13076] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  274.370826][T13084] bridge0: port 3(vlan2) entered blocking state
[  274.377219][T13084] bridge0: port 3(vlan2) entered disabled state
[  274.388051][T13084] vlan2: entered allmulticast mode
[  274.393312][T13084] bridge0: entered allmulticast mode
[  274.401678][T13084] vlan2: left allmulticast mode
[  274.406543][T13084] bridge0: left allmulticast mode
[  274.418856][T12530] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  274.530933][T13091] all: renamed from team_slave_0 (while UP)
[  274.888853][T13121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  274.900699][ T1092] Bluetooth: hci0: Frame reassembly failed (-84)
[  274.909090][T13121] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  275.022562][   T29] kauditd_printk_skb: 753 callbacks suppressed
[  275.022578][   T29] audit: type=1400 audit(1764977497.155:64425): avc:  denied  { create } for  pid=13124 comm="syz.1.3050" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1
[  275.091972][   T29] audit: type=1400 audit(1764977497.175:64426): avc:  denied  { write } for  pid=13124 comm="syz.1.3050" name="file0" dev="tmpfs" ino=3157 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1
[  275.114671][   T29] audit: type=1400 audit(1764977497.175:64427): avc:  denied  { open } for  pid=13124 comm="syz.1.3050" path="/584/file0" dev="tmpfs" ino=3157 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1
[  275.137771][   T29] audit: type=1400 audit(1764977497.185:64428): avc:  denied  { ioctl } for  pid=13124 comm="syz.1.3050" path="/584/file0" dev="tmpfs" ino=3157 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1
[  275.166957][   T29] audit: type=1400 audit(1764977497.295:64429): avc:  denied  { map_create } for  pid=13124 comm="syz.1.3050" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  275.186315][   T29] audit: type=1400 audit(1764977497.295:64430): avc:  denied  { map_read map_write } for  pid=13124 comm="syz.1.3050" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  275.284857][   T29] audit: type=1400 audit(1764977497.315:64431): avc:  denied  { prog_load } for  pid=13124 comm="syz.1.3050" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  275.304251][   T29] audit: type=1400 audit(1764977497.315:64432): avc:  denied  { bpf } for  pid=13124 comm="syz.1.3050" capability=39  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  275.324990][   T29] audit: type=1400 audit(1764977497.315:64433): avc:  denied  { perfmon } for  pid=13124 comm="syz.1.3050" capability=38  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  275.346161][   T29] audit: type=1400 audit(1764977497.315:64434): avc:  denied  { prog_run } for  pid=13124 comm="syz.1.3050" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  275.387950][T13129] bond1: option ad_user_port_key: invalid value (1136)
[  275.395063][T13129] bond1: option ad_user_port_key: allowed values 0 - 1023
[  275.402932][T13129] bond1 (unregistering): Released all slaves
[  275.453464][T13134] loop2: detected capacity change from 0 to 512
[  275.460480][T13134] /dev/loop2: Can't open blockdev
[  275.538614][T13138] loop2: detected capacity change from 0 to 512
[  275.546629][T13138] EXT4-fs: Ignoring removed i_version option
[  275.552867][T13138] EXT4-fs: Ignoring removed bh option
[  275.565133][T13138] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  275.587238][T13138] ext4 filesystem being mounted at /596/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  275.651653][T13147] loop5: detected capacity change from 0 to 512
[  275.669340][T13147] EXT4-fs: Ignoring removed i_version option
[  275.675467][T13147] EXT4-fs: Ignoring removed bh option
[  275.741187][T13147] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  275.764996][T13147] ext4 filesystem being mounted at /23/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  275.806331][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  275.917961][T13164] __nla_validate_parse: 14 callbacks suppressed
[  275.917976][T13164] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3061'.
[  276.003013][T13164] all: renamed from team_slave_0 (while UP)
[  276.029396][T12712] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  276.117998][T13180] loop5: detected capacity change from 0 to 2048
[  276.144781][   T45] Bluetooth: hci1: sending frame failed (-49)
[  276.151094][ T3624] Bluetooth: hci1: Opcode 0x1003 failed: -49
[  276.160861][T13180] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  276.174570][T13180] ext4 filesystem being mounted at /24/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  276.200624][T12712] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  276.660897][T13207] bond1: option ad_user_port_key: invalid value (1136)
[  276.667815][T13207] bond1: option ad_user_port_key: allowed values 0 - 1023
[  276.676217][T13207] bond1 (unregistering): Released all slaves
[  276.867707][T13223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  276.886520][T13223] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  276.910131][ T3519] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  276.917427][T13222] loop4: detected capacity change from 0 to 512
[  276.927243][T13222] EXT4-fs: Ignoring removed i_version option
[  276.933411][T13222] EXT4-fs: Ignoring removed bh option
[  276.952781][T13222] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  276.970784][T13222] ext4 filesystem being mounted at /38/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  277.103719][T12530] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  277.231692][T13241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  277.240264][T13241] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  277.577010][T13250] loop2: detected capacity change from 0 to 512
[  277.586125][T13250] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended
[  277.595323][T13250] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem
[  277.609095][T13250] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a042c01c, mo2=0002]
[  277.621368][T13250] EXT4-fs (loop2): failed to initialize system zone (-117)
[  277.628631][T13250] EXT4-fs (loop2): mount failed
[  277.679728][ T5690] Bluetooth: hci0: Frame reassembly failed (-84)
[  277.712634][T13253] syzkaller0: entered promiscuous mode
[  277.718282][T13253] syzkaller0: entered allmulticast mode
[  277.826945][T13257] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  277.851728][T13257] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  278.464065][T13277] xt_SECMARK: invalid security context 'system_u:object_r:dbusd_etc_t:s0'
[  278.545340][T13280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  278.553922][T13280] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  278.744101][T13283] 9pnet_fd: Insufficient options for proto=fd
[  279.050451][T13297] loop4: detected capacity change from 0 to 512
[  279.058500][T13297] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[  279.073758][T13297] EXT4-fs (loop4): 1 truncate cleaned up
[  279.079894][T13297] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  279.097303][T13297] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3104'.
[  279.200365][T12530] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  279.235949][T13307] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3107'.
[  279.245730][T13307] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3107'.
[  279.255383][T13307] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3107'.
[  279.265141][T13307] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3107'.
[  279.284669][T13307] all: renamed from team_slave_0 (while UP)
[  279.429891][T13315] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3111'.
[  279.584015][T13308] ==================================================================
[  279.592209][T13308] BUG: KCSAN: data-race in page_pool_put_unrefed_netmem / page_pool_release
[  279.600877][T13308] 
[  279.603195][T13308] write to 0xffff88811a9cd980 of 8 bytes by task 13309 on cpu 1:
[  279.610981][T13308]  page_pool_release+0x28a/0x780
[  279.615918][T13308]  page_pool_destroy+0x202/0x370
[  279.620847][T13308]  bpf_test_run_xdp_live+0x1145/0x11d0
[  279.626334][T13308]  bpf_prog_test_run_xdp+0x525/0x970
[  279.631627][T13308]  bpf_prog_test_run+0x22a/0x390
[  279.636560][T13308]  __sys_bpf+0x4c0/0x7c0
[  279.640788][T13308]  __x64_sys_bpf+0x41/0x50
[  279.645206][T13308]  x64_sys_call+0x28e1/0x3000
[  279.649872][T13308]  do_syscall_64+0xd8/0x2a0
[  279.654372][T13308]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  279.660252][T13308] 
[  279.662596][T13308] read to 0xffff88811a9cd980 of 8 bytes by task 13308 on cpu 0:
[  279.670205][T13308]  page_pool_put_unrefed_netmem+0x38b/0x4b0
[  279.676115][T13308]  napi_pp_put_page+0xe9/0x200
[  279.680861][T13308]  skb_free_head+0x12c/0x150
[  279.685451][T13308]  skb_release_data+0x33b/0x370
[  279.690386][T13308]  __kfree_skb+0x44/0x150
[  279.694799][T13308]  sk_skb_reason_drop+0xbd/0x270
[  279.699718][T13308]  udp_recvmsg+0x11a/0xb90
[  279.704117][T13308]  inet_recvmsg+0x143/0x290
[  279.708621][T13308]  sock_recvmsg+0xf6/0x170
[  279.713044][T13308]  ____sys_recvmsg+0xf5/0x280
[  279.717705][T13308]  ___sys_recvmsg+0x11f/0x370
[  279.722364][T13308]  do_recvmmsg+0x1ef/0x540
[  279.726763][T13308]  __x64_sys_recvmmsg+0xe5/0x170
[  279.731687][T13308]  x64_sys_call+0x2b75/0x3000
[  279.736348][T13308]  do_syscall_64+0xd8/0x2a0
[  279.740842][T13308]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  279.746728][T13308] 
[  279.749040][T13308] value changed: 0xffffea000528b8c0 -> 0x0000000000000000
[  279.756123][T13308] 
[  279.758432][T13308] Reported by Kernel Concurrency Sanitizer on:
[  279.764561][T13308] CPU: 0 UID: 0 PID: 13308 Comm: syz.0.3108 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
[  279.775911][T13308] Tainted: [W]=WARN
[  279.779692][T13308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  279.789729][T13308] ==================================================================
[  279.797967][ T3519] Bluetooth: hci0: command 0x1003 tx timeout
[  279.800915][ T3624] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  280.108787][   T29] kauditd_printk_skb: 1100 callbacks suppressed
[  280.108804][   T29] audit: type=1400 audit(1764977502.235:65535): avc:  denied  { read write } for  pid=12919 comm="syz-executor" name="loop0" dev="devtmpfs" ino=583 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[  280.138751][   T29] audit: type=1400 audit(1764977502.235:65536): avc:  denied  { read write open } for  pid=12919 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=583 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[  280.163096][   T29] audit: type=1400 audit(1764977502.235:65537): avc:  denied  { ioctl } for  pid=12919 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=583 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1
[  280.328046][   T29] audit: type=1400 audit(1764977502.455:65538): avc:  denied  { read write } for  pid=3314 comm="syz-executor" name="loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  280.352447][   T29] audit: type=1400 audit(1764977502.455:65539): avc:  denied  { read write open } for  pid=3314 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  280.377638][   T29] audit: type=1400 audit(1764977502.455:65540): avc:  denied  { ioctl } for  pid=3314 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=102 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1