last executing test programs: 4.068154107s ago: executing program 2 (id=172): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0xd, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r1, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000008000000000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x10}, 0xc) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback, 0x7fff}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r0, &(0x7f0000000900)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="a8", 0x1}], 0x1}}], 0x1, 0x24040) 4.067689807s ago: executing program 2 (id=173): r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0e00009bd029ef8020ab070004000523a608460400", @ANYRES16=r0], 0xfe33) syz_mount_image$vfat(&(0x7f0000000340), &(0x7f0000000000)='./file1\x00', 0x280809a, &(0x7f0000000f40)=ANY=[], 0x1, 0x2b2, &(0x7f00000006c0)="$eJzs3U9rY1UUAPDz0jR9OosUcaMIPtCFqzJ166ZRRhC7UiKoCw3ODEgSBqYQmArGruYTuPR7+BHcuPEbDLgV3E0XlSfvX/7ga402VXR+v9Xh3nfuPXm3TbLJeZ+/Mh3ffZDE2dMnkaZJdI7iKM6T2I9ONL6JbgAA/x/neR6/5mWY5JUNM7udGy0MALgx1ef/X/rgBwD+4z78+JP3B8fHdz7IsjRe6j+eDZOImD6eDav5wf34MiZxL25HPy4i8oUqfve94zvRzQr78fp0PhsWmdPPfqzXH/wSUeYfRj/22/MPs8pK/nw23I3nI4vB/d2m1H682J7/Zkt+DHvxxmsr9R9EP376Ih7EJO5GkbvM//owy97Jv3361afFNkV+0onhXnldKfcFCQAAAAAAAAAAAAAAAAAAAACA7TrIsqRq31P27ymG6v47Oxfl/EHW2F/vz1PlJ81CVX+gvOmWM8/ju6a/zu0sy/L6wmV+N17uerAAAAAAAAAAAAAAAAAAAAAAFE4ePbk1mkzuPTx5dDq+dtB0A2h+1v931zlaGXk1TsejncsX3Nt8r9VuA0WtV14c3W5s6ba0B2eLkeeKera+xV4sRj6KKmgOZqt7vfB2tejpeJTVU81NHo+SP9srbQ7u+9WpXly3sLz8k7jI1880XZS6ntXb0t3o3Wqd+i3P883Weevn6ozqkaRssbHZ7rt10PoCiyAtziJd/OMXUz9cvuClbxk7137TAQAAAAAAAAAAAAAAAAAAWi1/9NsyeXZlaufGigIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAf9jy+f9NkEbE+sgfgnmdfNU1ddCLhyf/8ksEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgGfB7AAAA//8rlFqg") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x9c, 0x30, 0x1, 0x0, 0x0, {}, [{0x88, 0x1, [@m_simple={0x84, 0x1, 0x0, 0x0, {{0xb}, {0x58, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x53, 0x3, '}mJ3[\xc59\xdf\xdd=i\xedQ\xc1]\xc8l\x00a\x02\xfbH\xa0\x8e\ng&\x92X\x9aD\x1eJ+\xad0s\xfd*\xdbwU\xd4\x0f\xcb}\x1e\x02_@\x8d\x9b\xb9R8D\xbb\xfe\x8cp\xcd9\xde\xccm\x98\xc3\xd3\xfb\xfd1\xb6w\xb4q\xd4\xe6V\xb9'}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x9c}}, 0x0) r2 = open(&(0x7f0000000080)='./file0\x00', 0x40c5, 0x130) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x51) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x105042, 0x40) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0x32600) write$9p(r2, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff5295e8cd6f55ce071b304aa0a588b3b7a2efa2f167dd9c1b8b016268d37d9a30983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402c76caf85d4569a75dde2f64", 0x200) sendfile(r2, r3, 0x0, 0xe065) 4.036399707s ago: executing program 0 (id=174): r0 = socket$tipc(0x1e, 0x5, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000006c0), 0x1, 0x0) writev(r1, &(0x7f00000025c0)=[{&(0x7f0000000240)='4', 0x1}], 0x1) bind$tipc(r1, &(0x7f0000001540)=@name={0x1e, 0x2, 0x0, {{0x2, 0x2}, 0x1}}, 0x10) bind$tipc(r0, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000021"], 0x50) syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200010, &(0x7f0000000300)={[{@jqfmt_vfsold}]}, 0xfe, 0x55d, &(0x7f0000000980)="$eJzs3d9rW1UcAPDvTX/sp66DMdQHKezByVy6tv6Y4MN8FB0O9H2G9q6Mpsto0rHWgduDe9mLDEHEgfgH+O7j8B/wrxjoYMgo+uBL5aY3XbYmbZZlSzSfD9ztnPuj55yce07OyUm4AQytyeyfQsSrEfFNEnGo6dho5AcnN89bf3htLtuS2Nj47M8kknxf4/wk//9AHnklIn79OuJEYXu61dW1xVK5nC7n8ana0uWp6urayYtLpYV0Ib00Mzt7+p3Zmfffe7dnZX3z3N/ff3r3o9O3jq1/9/P9w7eTOBMH82PN5XgG15sjkzGZvyZjceaJE6d7kNggSfqdAboykrfzscj6gEMxkrd64P/vq4jYAIZUov3DkGqMAxpz+x7Ng/8zHny4OQHaXv7Rzc9GYm99brR/PXlsZpTNdyd6kH6Wxi9/3LmdbdG7zyEAdnX9RkScGh3d3v8lef/XvVMdnPNkGvo/eHHuZuOft1qNfwpb459oMf450KLtdmP39l+43+KypFefUmfjvw9ajn+3Fq0mRvLYS/Ux31hy4WI5zfq2lyPieIztyeI7reecXr+30e5Y8/gv27L0G2PBPB/3R/c8fs18qVZ6ljI3e3Aj4rWW499kq/6TFvWfvR7nOkzjaHrn9XbHdi//87XxU8QbLev/0YpWsvP65FT9fphq3BXb/XXz6G/t0u93+bP6379z+SeS5vXa6tOn8ePef9J2x7q9/8eTz+vh8Xzf1VKttjwdMZ58sn3/zKNrG/HG+Vn5jx/buf9rdf/vi4gvOiz/zSM32546CPU//1T1//SBex9/+UO79Dur/7froeP5nk76v04z+CyvHQAAAAAAAAyaQkQcjKRQ3AoXCsXi5vc7jsT+QrlSrZ24UFm5NB/138pOxFihsdJ9qOn7ENP592Eb8Zkn4rMRcTgivh3ZV48X5yrl+X4XHgAAAAAAAAAAAAAAAAAAAAbEgTa//8/8PtLykvEXm0PgufLIbxheu7b/XjzpCRhI3v9heHXV/vf1Ph/Ai+f9H4bUWL8zAPST938YXto/DC/tH4aX9g8AAAAAAAAAAAAAAAAAAAAAAAAAAAA9de7s2WzbWH94bS6Lz19ZXVmsXDk5n1YXi0src8W5yvLl4kKlslBOi3OVpd3+XrlSuTw9EytXp2pptTZVXV07v1RZuVQ7f3GptJCeTz1tCAAAAAAAAAAAAAAAAAAAALarrq4tlsrldFlAoKvA6GBkQ6ApcKsHrbvPHRMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANPk3AAD//0unNek=") pwrite64(0xffffffffffffffff, &(0x7f0000000480)='2', 0x1, 0x8080c64) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x38, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0, 0xd}, 0x0, 0x10000, 0x1, 0x1, 0x8, 0x20005, 0x2b, 0x0, 0x0, 0x0, 0xffffffffffffff7f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) sendfile(r3, r3, 0x0, 0x800000009) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0xe, 0xb, &(0x7f0000000180)=ANY=[@ANYRES32=r1], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, @void, @value}, 0x94) socket$qrtr(0x2a, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sys_enter\x00', r4}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000016c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000180)=ANY=[], 0x118) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r6}, 0x10) r7 = syz_io_uring_setup(0x1725, &(0x7f0000000080)={0x0, 0x0, 0x80, 0x400002, 0x9c}, &(0x7f0000000100)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000040)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x35, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r7, 0x264b, 0x4, 0x1, 0x0, 0x0) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000001640)=ANY=[@ANYBLOB="0e0000000000005a36dc1f4b909f180018128db4bd257a658849e21bbb770000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000001b000000b7000000000000009500000000000000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r10}, 0x18) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) 3.90894438s ago: executing program 2 (id=176): r0 = socket(0x10, 0x803, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x400c0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000380)='afs_make_fs_call2\x00', 0xffffffffffffffff, 0x0, 0x40000000000000}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x27, 0x0, 0x0) request_key(&(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f0000000140)='\\\\@[\x01\x00\x00\x00', 0xfffffffffffffffe) syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000c40)='./file0\x00', 0x808080, &(0x7f0000000000)={[{@discard}, {@bh}, {@noblock_validity}], [{@pcr={'pcr', 0x3d, 0x29}}, {@measure}]}, 0x2c, 0x52c, &(0x7f0000000640)="$eJzs3d9rY1kdAPBvMv2Rdjrbru7DKuqO6+oowyRtZrcs+6DriyDLssK6TyKzpc2U0qQpTbpua8EO+Oar4IBP+if4IPggzJPvvumbLyMojDo4TAWRyE1uOm2adMq0aWaazwcuOefc2/s9J3DP6T1J7glgaF2NiN2IGIuIjyNiOi3PpFu829qS4x4/3Fnce7izmIlG48N/jqRH7iy2j2+7nJ4zF/FBkh/vEre2tb26UC6XNtJ8oV5ZL9S2tm+sVBaWS8ultWJxfm5+9u2bbxXPrK2vVX7z4Dsr7330+9998f4fd7/x46TO32rtGkvadmaBDmi9L6MxdaAseefe60ewAbiUtmds0BXhmWQj4jMR8Xqa3pcbXJ0AgP5qNKajMX0w31vmBMcAAM+/5J5/KjLZfHr/PxXZbD7fnMPLvRKT2XK1Vr9+u7q5thTNOayZGM3eXimXZtO5wpkYzST5uWb6Sb7Ykb8ZES9HxM/HJ5r5/GK1vDSof3oAYMhd7hj/H423xv8T8AkBALzIjOQAMHyOjv+jA6kHAHB+3P8DwPA5MP53+60uAHAB5Tp++w8AXHwH7v9Huh7wavzkh+dXHQDgHPj8HwCGyvfefz/ZGnvp86+XPtnaXK1+cmOpVFvNVzYX84vVjfX8crW63HxmT+Vp5ytXq+tzb8bmp4V6qVYv1La2b1Wqm2v1W83net8q+WEBAAzey6/d+3MmInbfmWhu0V7LwRcC4MJzmcPwujToCgAD0/37PsAwMB8PZJ6yv+dXhO72/puJU9QH6L9rn+sx/9/tf4M7+6n/Nc6vikCfmP+H4XW6+X+zB/AiM/8Pw6vRyFjPHwCGzAnu4H1FEC64Z/78HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIbYVHPLZPPpWuBTkc3m8xFXImJmYjRze6Vcmo2IlyLiT+Oj40l+btCVBgBOKfv3TLr+17XpN6Y6945l/jPefI2IH/3yw198ulCvb8wl5f/aL6/fTcuLXQOM978NAMABI50F7XG6PY631/d9/HBnsb2dZwUffLu1uGgSdy/d2lVvVT4XoxEx+e/MocZkzmhh4t07EfFqZ/uz+/tn0pVPO+Mnsa/0LX40Wzh1KH72UPxsc1/rNXkvPnsGdYFhcy/pf97tdv1l42rzNb3+Moc701z87Gjn+gza/d9eo7P/a13vH1zJNfuabv3f1ZPGePMP3+25786lxudHIvaO9L/tFaFzzdSR+CMRb3Q74U+/+Wizo+gvX/jS673iN34VcS2Oi99KFeqV9UJta/vGSmVhubRcWisW5+fmZ9+++Vax0JyjLrRnqo/6xzvXX+rd/ojJHvFzx7U/Ir7a66Qdfv3fj3/w5WPif/0r3eJn45Vj4idj4tdOGH9h8rc9l+9O4i/1aP/Iofhjh/4uKbt+wvj3/7q9dMJDAYBzUNvaXl0ol0sbEqdN5Pp15svPSQMleiT+9tGha2rg9TmTxMC6JOCcPLnoB10TAAAAAAAAAAAAAACgl9r300f+9fHHcINuIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABfX/wMAAP//OkHLZw==") r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002680)=ANY=[@ANYBLOB="140000001000010000000000000007000000000a60000000060a0b0400000000000000000200000034000480200001800e000100636f6e6e6c696d69740000000c000280080001400000000010000180090001006c617374000000000900010073797a30000000000900020073797a320000000014000000"], 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x0) close(r3) 3.730664672s ago: executing program 0 (id=179): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r1, &(0x7f0000000040)={0x2c, 0x8, 0x0, 0x20}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @multicast1}}}], 0x20}}], 0x1, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r4, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r5, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027f"], 0x57) setsockopt$inet_mreqsrc(r2, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) 3.152695061s ago: executing program 0 (id=187): syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000080)=[{{&(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000012c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @private=0xa010102}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x10000}}], 0x38}}], 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000800000008"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="180000000000040000000026e890d98490ad69cfc8000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], &(0x7f0000000240)='GPL\x00', 0xfb81, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) unshare(0x26000400) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0xffffffffffffffff, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x602, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRESOCT=r1, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESHEX=r1, @ANYRESHEX=r4, @ANYRES16=r1, @ANYBLOB="7fa4d35559d3aa3159cd7b372728a99d931ae5d2601228f1b8431a6fbb3c5c60ac625099635dbb39507382f94dda3c919d", @ANYRES16=r3, @ANYBLOB="2e400f7f3cb4f111464309"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xd, 0x0, &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r5, 0x0, 0x2}, 0x18) r6 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$UHID_CREATE2(r6, 0x0, 0x8) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000003c0)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000080)=[{&(0x7f00000004c0)='|', 0x1}, {&(0x7f0000000540)}], 0x2, 0x0) 2.777960617s ago: executing program 3 (id=188): perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{}, &(0x7f0000000180), 0x0}, 0x20) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) r2 = socket$inet6(0xa, 0x3, 0x2c) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) openat$selinux_load(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="50020000", @ANYRES16=r4, @ANYBLOB="0100000000000000000001000000080001000000000004000480080002000100000010000c7d0c000b8008000a00b4ed000004000880c8000c8024000900f36aad4208000a156878badf10076800d5441e0f080009002bd49f3b0c00008008000a00697100002c000b8008000a"], 0x250}}, 0x4c000) 2.465210612s ago: executing program 3 (id=191): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, @void, @value}, 0x94) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x18) socket$nl_route(0x10, 0x3, 0x0) r2 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x4}, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f00000001c0)='cpu~\'\'\t|\t') 2.376869113s ago: executing program 3 (id=192): syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000080)=[{{&(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000012c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @private=0xa010102}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x10000}}], 0x38}}], 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000800000008"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="180000000000040000000026e890d98490ad69cfc8000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], &(0x7f0000000240)='GPL\x00', 0xfb81, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) unshare(0x26000400) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0xffffffffffffffff, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x602, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRESOCT=r1, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESHEX=r1, @ANYRESHEX=r4, @ANYRES16=r1, @ANYBLOB="7fa4d35559d3aa3159cd7b372728a99d931ae5d2601228f1b8431a6fbb3c5c60ac625099635dbb39507382f94dda3c919d", @ANYRES16=r3, @ANYBLOB="2e400f7f3cb4f111464309"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', 0xffffffffffffffff, 0x0, 0x2}, 0x18) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$UHID_CREATE2(r5, 0x0, 0x8) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x2, 0x96) ioctl$FS_IOC_FIEMAP(r7, 0xc020660b, &(0x7f0000000a00)={0x8, 0x40000000000002, 0x4, 0xf, 0x6, 0x0, [{0x9, 0x4, 0x3, '\x00', 0x2000}, {0x4, 0x4, 0x2, '\x00', 0xa}, {0x5, 0x7, 0x1}, {0x1, 0x2, 0xbe7, '\x00', 0x2081}, {0x5, 0x4, 0x8, '\x00', 0x89}, {0xff, 0x33, 0x80, '\x00', 0x81}]}) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000080)=[{&(0x7f00000004c0)='|', 0x1}, {&(0x7f0000000540)}], 0x2, 0x0) 2.301925484s ago: executing program 0 (id=193): syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000080)=[{{&(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000012c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @private=0xa010102}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x10000}}], 0x38}}], 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000800000008"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="180000000000040000000026e890d98490ad69cfc8000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], &(0x7f0000000240)='GPL\x00', 0xfb81, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) unshare(0x26000400) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0xffffffffffffffff, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x602, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRESOCT=r1, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESHEX=r1, @ANYRESHEX=r4, @ANYRES16=r1, @ANYBLOB="7fa4d35559d3aa3159cd7b372728a99d931ae5d2601228f1b8431a6fbb3c5c60ac625099635dbb39507382f94dda3c919d", @ANYRES16=r3, @ANYBLOB="2e400f7f3cb4f111464309"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xd, 0x0, &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r5, 0x0, 0x2}, 0x18) r6 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$UHID_CREATE2(r6, 0x0, 0x8) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000080)=[{&(0x7f00000004c0)='|', 0x1}, {&(0x7f0000000540)}], 0x2, 0x0) 2.291983024s ago: executing program 1 (id=195): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x1, 0x6e, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x6, 0x20, 0x5, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x22}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x34fd, 0x0, 0x1}, {0x6, 0x24, 0x1a, 0xb, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0x99, 0xe0}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x400, 0x9, 0x2, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x0, 0x0, 0x6}}}}}}}]}}, 0x0) 2.173559697s ago: executing program 2 (id=196): creat(&(0x7f00000000c0)='./file0\x00', 0x18e) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', 0xffffffffffffffff, 0x0, 0xffffffffffffffff}, 0x18) mount$9p_rdma(&(0x7f0000000280), &(0x7f0000000380)='./file0\x00', &(0x7f0000000040), 0x40, &(0x7f0000000000)={'trans=rdma,', {'port', 0x3d, 0x4e1d}}) 2.156528947s ago: executing program 2 (id=197): pipe(&(0x7f00000002c0)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000080)=[{&(0x7f00000004c0)='|', 0x1}, {&(0x7f0000000540)}], 0x2, 0x0) 1.965588909s ago: executing program 4 (id=200): bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000008000000000000020000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000010010000000ffdbdf2500000000", @ANYRES32, @ANYBLOB="20000000280e0400280012800b0001006d6163736563000018000280050003"], 0x48}, 0x1, 0x0, 0x0, 0x24008001}, 0x0) 1.94593193s ago: executing program 4 (id=201): perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{}, &(0x7f0000000180), 0x0}, 0x20) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) r2 = socket$inet6(0xa, 0x3, 0x2c) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) openat$selinux_load(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="50020000", @ANYRES16=r4, @ANYBLOB="0100000000000000000001000000080001000000000004000480080002000100000010000c7d0c000b8008000a00b4ed000004000880c8000c8024000900f36aad4208000a156878badf10076800d5441e0f080009002bd49f3b0c00008008000a00697100002c000b8008000a"], 0x250}}, 0x4c000) 1.883745881s ago: executing program 4 (id=202): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0xd, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback, 0x7fff}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 1.859494861s ago: executing program 4 (id=203): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000900)=ANY=[@ANYBLOB="440000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100626f6e64000000000c000280050001000600000008000a0079"], 0x44}}, 0x0) (fail_nth: 2) 1.601750305s ago: executing program 1 (id=204): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000180)="10030600e0ff020004004788aa96a13bb100001100007fca1a00", 0x10608, 0x0, &(0x7f0000000140)={0x11, 0x0, r4}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000002000000000000000018090000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x39, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='sys_enter\x00', r5}, 0x10) timerfd_gettime(0xffffffffffffffff, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000700)=ANY=[@ANYBLOB="500000001000010400000000000000000000ffff", @ANYBLOB="10000000000000001c001280090001"], 0x50}}, 0x0) 1.552873206s ago: executing program 4 (id=205): r0 = socket$tipc(0x1e, 0x5, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000006c0), 0x1, 0x0) writev(r1, &(0x7f00000025c0)=[{&(0x7f0000000240)='4', 0x1}], 0x1) bind$tipc(r1, &(0x7f0000001540)=@name={0x1e, 0x2, 0x0, {{0x2, 0x2}, 0x1}}, 0x10) bind$tipc(r0, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000021"], 0x50) syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200010, &(0x7f0000000300)={[{@jqfmt_vfsold}]}, 0xfe, 0x55d, &(0x7f0000000980)="$eJzs3d9rW1UcAPDvTX/sp66DMdQHKezByVy6tv6Y4MN8FB0O9H2G9q6Mpsto0rHWgduDe9mLDEHEgfgH+O7j8B/wrxjoYMgo+uBL5aY3XbYmbZZlSzSfD9ztnPuj55yce07OyUm4AQytyeyfQsSrEfFNEnGo6dho5AcnN89bf3htLtuS2Nj47M8kknxf4/wk//9AHnklIn79OuJEYXu61dW1xVK5nC7n8ana0uWp6urayYtLpYV0Ib00Mzt7+p3Zmfffe7dnZX3z3N/ff3r3o9O3jq1/9/P9w7eTOBMH82PN5XgG15sjkzGZvyZjceaJE6d7kNggSfqdAboykrfzscj6gEMxkrd64P/vq4jYAIZUov3DkGqMAxpz+x7Ng/8zHny4OQHaXv7Rzc9GYm99brR/PXlsZpTNdyd6kH6Wxi9/3LmdbdG7zyEAdnX9RkScGh3d3v8lef/XvVMdnPNkGvo/eHHuZuOft1qNfwpb459oMf450KLtdmP39l+43+KypFefUmfjvw9ajn+3Fq0mRvLYS/Ux31hy4WI5zfq2lyPieIztyeI7reecXr+30e5Y8/gv27L0G2PBPB/3R/c8fs18qVZ6ljI3e3Aj4rWW499kq/6TFvWfvR7nOkzjaHrn9XbHdi//87XxU8QbLev/0YpWsvP65FT9fphq3BXb/XXz6G/t0u93+bP6379z+SeS5vXa6tOn8ePef9J2x7q9/8eTz+vh8Xzf1VKttjwdMZ58sn3/zKNrG/HG+Vn5jx/buf9rdf/vi4gvOiz/zSM32546CPU//1T1//SBex9/+UO79Dur/7froeP5nk76v04z+CyvHQAAAAAAAAyaQkQcjKRQ3AoXCsXi5vc7jsT+QrlSrZ24UFm5NB/138pOxFihsdJ9qOn7ENP592Eb8Zkn4rMRcTgivh3ZV48X5yrl+X4XHgAAAAAAAAAAAAAAAAAAAAbEgTa//8/8PtLykvEXm0PgufLIbxheu7b/XjzpCRhI3v9heHXV/vf1Ph/Ai+f9H4bUWL8zAPST938YXto/DC/tH4aX9g8AAAAAAAAAAAAAAAAAAAAAAAAAAAA9de7s2WzbWH94bS6Lz19ZXVmsXDk5n1YXi0src8W5yvLl4kKlslBOi3OVpd3+XrlSuTw9EytXp2pptTZVXV07v1RZuVQ7f3GptJCeTz1tCAAAAAAAAAAAAAAAAAAAALarrq4tlsrldFlAoKvA6GBkQ6ApcKsHrbvPHRMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANPk3AAD//0unNek=") pwrite64(0xffffffffffffffff, &(0x7f0000000480)='2', 0x1, 0x8080c64) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x38, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0, 0xd}, 0x0, 0x10000, 0x1, 0x1, 0x8, 0x20005, 0x2b, 0x0, 0x0, 0x0, 0xffffffffffffff7f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) sendfile(r3, r3, 0x0, 0x800000009) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0xe, 0xb, &(0x7f0000000180)=ANY=[@ANYRES32=r1], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, @void, @value}, 0x94) socket$qrtr(0x2a, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sys_enter\x00', r4}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000016c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000180)=ANY=[], 0x118) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0x11, 0x8, 0x0, &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r6}, 0x10) r7 = syz_io_uring_setup(0x1725, &(0x7f0000000080)={0x0, 0x0, 0x80, 0x400002, 0x9c}, &(0x7f0000000100)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000040)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x35, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r7, 0x264b, 0x4, 0x1, 0x0, 0x0) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000001640)=ANY=[@ANYBLOB="0e0000000000005a36dc1f4b909f180018128db4bd257a658849e21bbb770000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000001b000000b7000000000000009500000000000000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r10}, 0x18) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) 1.552546856s ago: executing program 1 (id=206): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) unshare(0x64000600) 1.520449606s ago: executing program 3 (id=207): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0xd, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r1, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback, 0x7fff}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 1.453970797s ago: executing program 3 (id=208): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r2}, 0x18) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r7, 0x0, 0xab1}, 0x18) r8 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x4}, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x40082406, &(0x7f00000001c0)='cpu~\'\'\t|\t') getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x3f, &(0x7f00000001c0)={&(0x7f0000000000)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r9}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000007c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x378, 0x1d8, 0x12, 0x60d, 0x1d8, 0x202, 0x2a8, 0x2e8, 0x2e8, 0x2a8, 0x2c0, 0x4, 0x0, {[{{@ipv6={@local, @mcast1, [0x0, 0x0, 0xc0], [], 'veth0_to_team\x00', 'macsec0\x00', {0xff}}, 0x0, 0x190, 0x1d8, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "000000165a8c2e0617ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f672225d6147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac05a602061c96baebc989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b5", 0x4, 0x2}}, @inet=@rpfilter={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1b, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@generic={0x5, 0x4, 0x3, 0x0, 0x6}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0x92, &(0x7f00000002c0)=""/146, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 1.419470428s ago: executing program 0 (id=209): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f600000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000059"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) unshare(0x64000600) 1.096842153s ago: executing program 2 (id=210): prctl$PR_SET_NAME(0xf, &(0x7f0000000200)='gtp\x00\xe4\xaa\xae\xdf~2\xa6X\x14\x92\xdarV\xf4U\xf7\xa2\xc3l\x1b@\xaf\xf9\xc9\xa9#\xf0S\xd9=q\xd6\x14\xedt\xc8!W\xe9@\xeb\x7f~\tB0EE\x9a:\xb7\xff\xc1\xfc\x9a\x1f\xf2\xfb\x19\xda#x\xc5F\x1c~\x8c\xe1\xdf\xdc\x01k\f\xde0~\x95\r\xa2\x80\b4M\x14\xe7\xd0\t`n!g\x14\xe6\xd1\xc2\xd3\x88\xf8cVtd\xbeY\xa5\xe7\x16sD\x96}7\n\x88e\x00\xf0\xff\xff\xf0\xcb\x94\xb4S\x00\x00') r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r0, 0x0, 0xe3b9}, 0x18) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="b400000010000904000000000000000000002200", @ANYRES32=0x0, @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200367da1650e000000280003800c00010001800000002000000c000100a1000000c84200000c0001000800000008000000340004800c00010006000000ff0300000c00010004000000080000000c00010004000000020000000c000100050000000300000008000500", @ANYRES32, @ANYBLOB='\b'], 0xb4}}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000000)='\x06\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xd9z\x81\x91\x8aP}I\xc6\x0e\xd9\v\xda\xbfS\x16 \x04\r\xcd\xdb\x9a\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x000x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x35, 0x0, 0x0, 0x0, 0x12345}) faccessat(r2, &(0x7f0000000800)='./file0\x00', 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000001640)=ANY=[@ANYBLOB="0e0000000000005a36dc1f4b909f180018128db4bd257a658849e21bbb770000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000001b000000b7000000000000009500000000000000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r8}, 0x18) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) 2.54012ms ago: executing program 1 (id=215): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a9"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r4, 0x0, 0xab1}, 0x18) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x3f, &(0x7f00000001c0)={&(0x7f0000000000)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r5}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) 0s ago: executing program 0 (id=216): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) syz_usb_connect$cdc_ncm(0x1, 0x6e, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x6, 0x20, 0x5, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x22}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x34fd, 0x0, 0x1}, {0x6, 0x24, 0x1a, 0xb, 0x1}}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0x99, 0xe0}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x400, 0x9, 0x2, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x0, 0x0, 0x6}}}}}}}]}}, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 25.382849][ T29] kauditd_printk_skb: 45 callbacks suppressed [ 25.382869][ T29] audit: type=1400 audit(1749848304.151:57): avc: denied { transition } for pid=3285 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.416067][ T29] audit: type=1400 audit(1749848304.151:58): avc: denied { noatsecure } for pid=3285 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.435929][ T29] audit: type=1400 audit(1749848304.151:59): avc: denied { write } for pid=3285 comm="sh" path="pipe:[494]" dev="pipefs" ino=494 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 25.458173][ T29] audit: type=1400 audit(1749848304.151:60): avc: denied { rlimitinh } for pid=3285 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.477854][ T29] audit: type=1400 audit(1749848304.151:61): avc: denied { siginh } for pid=3285 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.67' (ED25519) to the list of known hosts. [ 33.669303][ T29] audit: type=1400 audit(1749848312.441:62): avc: denied { mounton } for pid=3298 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.670492][ T3298] cgroup: Unknown subsys name 'net' [ 33.692397][ T29] audit: type=1400 audit(1749848312.441:63): avc: denied { mount } for pid=3298 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.720213][ T29] audit: type=1400 audit(1749848312.471:64): avc: denied { unmount } for pid=3298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.877781][ T3298] cgroup: Unknown subsys name 'cpuset' [ 33.884393][ T3298] cgroup: Unknown subsys name 'rlimit' [ 34.055299][ T29] audit: type=1400 audit(1749848312.821:65): avc: denied { setattr } for pid=3298 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.081188][ T29] audit: type=1400 audit(1749848312.821:66): avc: denied { create } for pid=3298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 34.098198][ T3300] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 34.102305][ T29] audit: type=1400 audit(1749848312.821:67): avc: denied { write } for pid=3298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.102331][ T29] audit: type=1400 audit(1749848312.831:68): avc: denied { read } for pid=3298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.138552][ T3298] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 34.152332][ T29] audit: type=1400 audit(1749848312.831:69): avc: denied { mounton } for pid=3298 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 34.186725][ T29] audit: type=1400 audit(1749848312.831:70): avc: denied { mount } for pid=3298 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 34.210331][ T29] audit: type=1400 audit(1749848312.881:71): avc: denied { relabelto } for pid=3300 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 35.411241][ T3314] chnl_net:caif_netlink_parms(): no params data found [ 35.463817][ T3310] chnl_net:caif_netlink_parms(): no params data found [ 35.484486][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 35.513697][ T3308] chnl_net:caif_netlink_parms(): no params data found [ 35.540694][ T3314] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.547914][ T3314] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.555097][ T3314] bridge_slave_0: entered allmulticast mode [ 35.562059][ T3314] bridge_slave_0: entered promiscuous mode [ 35.585688][ T3314] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.592852][ T3314] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.600137][ T3314] bridge_slave_1: entered allmulticast mode [ 35.606598][ T3314] bridge_slave_1: entered promiscuous mode [ 35.640607][ T3316] chnl_net:caif_netlink_parms(): no params data found [ 35.660220][ T3314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.679431][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.686560][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.695407][ T3307] bridge_slave_0: entered allmulticast mode [ 35.702151][ T3307] bridge_slave_0: entered promiscuous mode [ 35.709480][ T3314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.738456][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.745725][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.753164][ T3307] bridge_slave_1: entered allmulticast mode [ 35.759817][ T3307] bridge_slave_1: entered promiscuous mode [ 35.771352][ T3310] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.778575][ T3310] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.785915][ T3310] bridge_slave_0: entered allmulticast mode [ 35.792566][ T3310] bridge_slave_0: entered promiscuous mode [ 35.817229][ T3314] team0: Port device team_slave_0 added [ 35.823094][ T3310] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.830330][ T3310] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.838135][ T3310] bridge_slave_1: entered allmulticast mode [ 35.844833][ T3310] bridge_slave_1: entered promiscuous mode [ 35.851547][ T3308] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.858937][ T3308] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.866242][ T3308] bridge_slave_0: entered allmulticast mode [ 35.872809][ T3308] bridge_slave_0: entered promiscuous mode [ 35.882571][ T3308] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.889901][ T3308] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.897244][ T3308] bridge_slave_1: entered allmulticast mode [ 35.903684][ T3308] bridge_slave_1: entered promiscuous mode [ 35.915213][ T3314] team0: Port device team_slave_1 added [ 35.939710][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.950321][ T3308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.975009][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.990353][ T3308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.005832][ T3310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.020043][ T3316] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.027407][ T3316] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.034638][ T3316] bridge_slave_0: entered allmulticast mode [ 36.041196][ T3316] bridge_slave_0: entered promiscuous mode [ 36.052659][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.059745][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.086009][ T3314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.098044][ T3310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.112277][ T3316] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.119802][ T3316] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.127190][ T3316] bridge_slave_1: entered allmulticast mode [ 36.133760][ T3316] bridge_slave_1: entered promiscuous mode [ 36.151535][ T3308] team0: Port device team_slave_0 added [ 36.157575][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.164840][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.191658][ T3314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.208933][ T3307] team0: Port device team_slave_0 added [ 36.225118][ T3308] team0: Port device team_slave_1 added [ 36.239080][ T3307] team0: Port device team_slave_1 added [ 36.245872][ T3310] team0: Port device team_slave_0 added [ 36.253155][ T3316] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.274291][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.281516][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.308158][ T3308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.324384][ T3310] team0: Port device team_slave_1 added [ 36.331281][ T3316] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.345876][ T3308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.352958][ T3308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.379012][ T3308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.410085][ T3314] hsr_slave_0: entered promiscuous mode [ 36.416342][ T3314] hsr_slave_1: entered promiscuous mode [ 36.431318][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.438533][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.465075][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.482625][ T3316] team0: Port device team_slave_0 added [ 36.501055][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.508116][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.534388][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.545785][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.553114][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.579331][ T3310] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.591258][ T3316] team0: Port device team_slave_1 added [ 36.613576][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.620613][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.646904][ T3310] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.665946][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.673135][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.699553][ T3316] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.711640][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.718760][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 36.744855][ T3316] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.765359][ T3308] hsr_slave_0: entered promiscuous mode [ 36.771522][ T3308] hsr_slave_1: entered promiscuous mode [ 36.777624][ T3308] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 36.785587][ T3308] Cannot create hsr debugfs directory [ 36.821961][ T3307] hsr_slave_0: entered promiscuous mode [ 36.828149][ T3307] hsr_slave_1: entered promiscuous mode [ 36.834815][ T3307] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 36.842565][ T3307] Cannot create hsr debugfs directory [ 36.889594][ T3310] hsr_slave_0: entered promiscuous mode [ 36.895983][ T3310] hsr_slave_1: entered promiscuous mode [ 36.902222][ T3310] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 36.909988][ T3310] Cannot create hsr debugfs directory [ 36.922879][ T3316] hsr_slave_0: entered promiscuous mode [ 36.929301][ T3316] hsr_slave_1: entered promiscuous mode [ 36.935460][ T3316] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 36.943264][ T3316] Cannot create hsr debugfs directory [ 37.108831][ T3314] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 37.126269][ T3314] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 37.137116][ T3314] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 37.146894][ T3310] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 37.157229][ T3314] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 37.165978][ T3310] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 37.178542][ T3310] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 37.191082][ T3310] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 37.214010][ T3307] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.225792][ T3307] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 37.235133][ T3307] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 37.247357][ T3307] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 37.282511][ T3316] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 37.295547][ T3316] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 37.305359][ T3316] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 37.328507][ T3316] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 37.366274][ T3308] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 37.375575][ T3308] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 37.385678][ T3308] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 37.399177][ T3308] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 37.413094][ T3314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.440066][ T3310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.453743][ T3314] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.464207][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.471541][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.484597][ T3310] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.499545][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.506726][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.518972][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.531139][ T1727] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.538328][ T1727] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.557122][ T1727] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.564308][ T1727] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.595699][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.606485][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.613856][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.639328][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.646496][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.669553][ T3314] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 37.680482][ T3314] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 37.703502][ T3308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.723564][ T3316] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.735691][ T3308] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.754670][ T3316] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.787957][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.795188][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.813928][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.821058][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.843896][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.851370][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.885025][ T3316] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 37.896306][ T3316] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 37.915163][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.922742][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.953172][ T3314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 37.964453][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 37.976346][ T3310] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.083162][ T3308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.096599][ T3316] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.184842][ T3314] veth0_vlan: entered promiscuous mode [ 38.193671][ T3310] veth0_vlan: entered promiscuous mode [ 38.212680][ T3307] veth0_vlan: entered promiscuous mode [ 38.222933][ T3310] veth1_vlan: entered promiscuous mode [ 38.234836][ T3307] veth1_vlan: entered promiscuous mode [ 38.244130][ T3314] veth1_vlan: entered promiscuous mode [ 38.278216][ T3310] veth0_macvtap: entered promiscuous mode [ 38.288809][ T3310] veth1_macvtap: entered promiscuous mode [ 38.305417][ T3307] veth0_macvtap: entered promiscuous mode [ 38.319022][ T3308] veth0_vlan: entered promiscuous mode [ 38.325663][ T3307] veth1_macvtap: entered promiscuous mode [ 38.334016][ T3314] veth0_macvtap: entered promiscuous mode [ 38.344125][ T3308] veth1_vlan: entered promiscuous mode [ 38.355768][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.368820][ T3314] veth1_macvtap: entered promiscuous mode [ 38.383007][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.394031][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.411370][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.421888][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.430974][ T3307] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.439950][ T3307] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.448830][ T3307] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.457670][ T3307] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.471583][ T3308] veth0_macvtap: entered promiscuous mode [ 38.481740][ T3308] veth1_macvtap: entered promiscuous mode [ 38.492961][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.505001][ T3310] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.514118][ T3310] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.523247][ T3310] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.532154][ T3310] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.550799][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.565297][ T3314] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.574250][ T3314] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.583408][ T3314] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.592419][ T3314] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.611592][ T3308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.625033][ T3316] veth0_vlan: entered promiscuous mode [ 38.638187][ T3308] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.647066][ T3308] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.655947][ T3308] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.664852][ T3308] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.681187][ T3307] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 38.698226][ T3316] veth1_vlan: entered promiscuous mode [ 38.712724][ T29] kauditd_printk_skb: 18 callbacks suppressed [ 38.712744][ T29] audit: type=1400 audit(1749848317.481:90): avc: denied { read write } for pid=3310 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 38.745981][ T29] audit: type=1400 audit(1749848317.481:91): avc: denied { open } for pid=3310 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 38.770201][ T29] audit: type=1400 audit(1749848317.481:92): avc: denied { ioctl } for pid=3310 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 38.795879][ T29] audit: type=1400 audit(1749848317.501:93): avc: denied { create } for pid=3476 comm="syz.1.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 38.815821][ T29] audit: type=1400 audit(1749848317.501:94): avc: denied { write } for pid=3476 comm="syz.1.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 38.836071][ T29] audit: type=1400 audit(1749848317.561:95): avc: denied { prog_load } for pid=3478 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 38.856175][ T29] audit: type=1400 audit(1749848317.561:96): avc: denied { bpf } for pid=3478 comm="syz.0.1" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 38.876904][ T29] audit: type=1400 audit(1749848317.561:97): avc: denied { allowed } for pid=3476 comm="syz.1.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 38.896150][ T29] audit: type=1400 audit(1749848317.561:98): avc: denied { create } for pid=3476 comm="syz.1.2" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 38.917743][ T29] audit: type=1400 audit(1749848317.561:99): avc: denied { map } for pid=3476 comm="syz.1.2" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4407 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 38.956635][ T3316] veth0_macvtap: entered promiscuous mode [ 38.979176][ T3316] veth1_macvtap: entered promiscuous mode [ 38.997924][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.007877][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.017250][ T3316] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.026318][ T3316] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.035181][ T3316] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.044067][ T3316] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.244673][ T3488] loop2: detected capacity change from 0 to 1024 [ 39.372661][ T3488] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 39.495869][ T3496] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5'. [ 39.517515][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.530169][ T3496] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5'. [ 39.554898][ T3498] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 39.597193][ T3500] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7'. [ 39.646879][ C1] hrtimer: interrupt took 48343 ns [ 39.686567][ T3504] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9'. [ 39.710049][ T3504] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9'. [ 39.716505][ T3505] netlink: 332 bytes leftover after parsing attributes in process `syz.4.8'. [ 39.735681][ T3505] netlink: 'syz.4.8': attribute type 9 has an invalid length. [ 39.744829][ T3505] netlink: 108 bytes leftover after parsing attributes in process `syz.4.8'. [ 39.760432][ T3505] netlink: 32 bytes leftover after parsing attributes in process `syz.4.8'. [ 39.779046][ T3509] SELinux: security_context_str_to_sid () failed with errno=-22 [ 39.827043][ T3509] vhci_hcd: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub [ 39.836084][ T3512] loop4: detected capacity change from 0 to 1024 [ 39.853408][ T3514] x_tables: ip6_tables: tcpmss match: only valid for protocol 6 [ 39.871543][ T3512] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 39.894489][ T3509] vhci_hcd: default hub control req: 800f v0000 i0000 l31125 [ 39.956286][ T3514] syz.2.13 uses obsolete (PF_INET,SOCK_PACKET) [ 39.974175][ T3507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.983377][ T3507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.992498][ T3316] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.173028][ T3522] loop3: detected capacity change from 0 to 1024 [ 40.221923][ T3522] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 40.280623][ T3527] loop1: detected capacity change from 0 to 512 [ 40.391890][ T3308] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.406823][ T3527] EXT4-fs: Ignoring removed bh option [ 40.433694][ T3530] loop4: detected capacity change from 0 to 512 [ 40.473988][ T3527] ext2: Unknown parameter 'pcr' [ 40.487305][ T3530] EXT4-fs: Ignoring removed bh option [ 40.548233][ T3530] ext2: Unknown parameter 'pcr' [ 40.749619][ T3535] loop0: detected capacity change from 0 to 1024 [ 40.764271][ T3535] ======================================================= [ 40.764271][ T3535] WARNING: The mand mount option has been deprecated and [ 40.764271][ T3535] and is ignored by this kernel. Remove the mand [ 40.764271][ T3535] option from the mount to silence this warning. [ 40.764271][ T3535] ======================================================= [ 40.921980][ T3535] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 40.983697][ T3535] ext4 filesystem being mounted at /3/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 40.997023][ T3539] netlink: 24 bytes leftover after parsing attributes in process `syz.3.17'. [ 41.008267][ T3539] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17'. [ 41.075245][ T3307] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.233905][ T3548] random: crng reseeded on system resumption [ 41.540179][ T3550] loop1: detected capacity change from 0 to 1024 [ 41.562899][ T3550] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.631326][ T3561] serio: Serial port ptm0 [ 41.690264][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.720312][ T3564] futex_wake_op: syz.1.26 tries to shift op by -1; fix this program [ 41.948316][ T3570] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 42.260683][ T3585] SELinux: security_context_str_to_sid () failed with errno=-22 [ 42.318209][ T3585] vhci_hcd: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub [ 42.334925][ T3557] syz.4.25 (3557) used greatest stack depth: 10792 bytes left [ 42.335772][ T3585] vhci_hcd: default hub control req: 800f v0000 i0000 l31125 [ 42.381127][ T3593] random: crng reseeded on system resumption [ 42.457930][ T3597] loop1: detected capacity change from 0 to 1024 [ 42.502967][ T3597] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.586368][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.711761][ T3606] loop4: detected capacity change from 0 to 512 [ 43.198459][ T3606] EXT4-fs: Ignoring removed bh option [ 43.410785][ T3606] ext2: Unknown parameter 'pcr' [ 43.506674][ T3617] Zero length message leads to an empty skb [ 43.565934][ T3622] random: crng reseeded on system resumption [ 43.614161][ T3624] loop0: detected capacity change from 0 to 512 [ 43.636213][ T3626] random: crng reseeded on system resumption [ 43.671067][ T3624] EXT4-fs error (device loop0): ext4_xattr_inode_iget:433: comm syz.0.45: Parent and EA inode have the same ino 15 [ 43.718716][ T3624] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2848: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 43.732059][ T3624] EXT4-fs error (device loop0): ext4_xattr_inode_iget:433: comm syz.0.45: Parent and EA inode have the same ino 15 [ 43.747280][ T29] kauditd_printk_skb: 245 callbacks suppressed [ 43.747295][ T29] audit: type=1400 audit(1749848322.521:345): avc: denied { write } for pid=3628 comm="syz.3.48" name="kcm" dev="proc" ino=4026532694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 43.779290][ T3624] EXT4-fs (loop0): 1 orphan inode deleted [ 43.780491][ T3619] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.785816][ T3624] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 43.806399][ T29] audit: type=1400 audit(1749848322.541:346): avc: denied { create } for pid=3630 comm="syz.1.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 43.825737][ T29] audit: type=1400 audit(1749848322.541:347): avc: denied { bind } for pid=3630 comm="syz.1.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 43.845035][ T29] audit: type=1400 audit(1749848322.551:348): avc: denied { read } for pid=3630 comm="syz.1.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 43.856178][ T3629] loop3: detected capacity change from 0 to 1024 [ 43.864999][ T29] audit: type=1400 audit(1749848322.551:349): avc: denied { read write } for pid=3618 comm="syz.2.43" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 43.894860][ T29] audit: type=1400 audit(1749848322.551:350): avc: denied { open } for pid=3618 comm="syz.2.43" path="/dev/raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 43.918120][ T29] audit: type=1400 audit(1749848322.551:351): avc: denied { ioctl } for pid=3618 comm="syz.2.43" path="/dev/raw-gadget" dev="devtmpfs" ino=142 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 43.943436][ T3619] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.956767][ T29] audit: type=1400 audit(1749848322.591:352): avc: granted { setsecparam } for pid=3628 comm="syz.3.48" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 43.976055][ T29] audit: type=1326 audit(1749848322.591:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3628 comm="syz.3.48" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3531a3e929 code=0x7ffc0000 [ 43.999617][ T29] audit: type=1326 audit(1749848322.591:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3628 comm="syz.3.48" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3531a3e929 code=0x7ffc0000 [ 44.028830][ T3629] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.042424][ T3307] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.049340][ T3629] ext4 filesystem being mounted at /11/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.142714][ T3308] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.250468][ T3643] random: crng reseeded on system resumption [ 44.425074][ T3647] SELinux: security_context_str_to_sid () failed with errno=-22 [ 44.457440][ T3647] vhci_hcd: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub [ 44.472757][ T3647] vhci_hcd: default hub control req: 800f v0000 i0000 l31125 [ 44.628725][ T3654] SELinux: security_context_str_to_sid () failed with errno=-22 [ 44.667995][ T3654] vhci_hcd: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub [ 44.684063][ T3654] vhci_hcd: default hub control req: 800f v0000 i0000 l31125 [ 44.876589][ T3661] __nla_validate_parse: 4 callbacks suppressed [ 44.876606][ T3661] netlink: 24 bytes leftover after parsing attributes in process `syz.1.59'. [ 44.934161][ T3662] netlink: 4 bytes leftover after parsing attributes in process `syz.1.59'. [ 44.964586][ T3662] team0: Port device team_slave_0 removed [ 45.672848][ T3680] netlink: 12 bytes leftover after parsing attributes in process `syz.3.66'. [ 45.833312][ T3682] loop3: detected capacity change from 0 to 1024 [ 45.849596][ T3682] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 46.044201][ T3308] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.334758][ T3693] loop4: detected capacity change from 0 to 128 [ 46.383508][ T3692] netlink: 20 bytes leftover after parsing attributes in process `syz.4.71'. [ 46.403129][ T3693] netlink: 20 bytes leftover after parsing attributes in process `syz.4.71'. [ 46.566483][ T3698] FAULT_INJECTION: forcing a failure. [ 46.566483][ T3698] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 46.580046][ T3698] CPU: 0 UID: 0 PID: 3698 Comm: syz.4.72 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(voluntary) [ 46.580076][ T3698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 46.580088][ T3698] Call Trace: [ 46.580104][ T3698] [ 46.580112][ T3698] __dump_stack+0x1d/0x30 [ 46.580233][ T3698] dump_stack_lvl+0xe8/0x140 [ 46.580256][ T3698] dump_stack+0x15/0x1b [ 46.580276][ T3698] should_fail_ex+0x265/0x280 [ 46.580316][ T3698] should_fail+0xb/0x20 [ 46.580414][ T3698] should_fail_usercopy+0x1a/0x20 [ 46.580441][ T3698] _copy_from_user+0x1c/0xb0 [ 46.580468][ T3698] vmemdup_user+0x59/0xd0 [ 46.580492][ T3698] path_setxattrat+0x1b6/0x310 [ 46.580601][ T3698] __x64_sys_fsetxattr+0x6b/0x80 [ 46.580630][ T3698] x64_sys_call+0x2f7c/0x2fb0 [ 46.580651][ T3698] do_syscall_64+0xd2/0x200 [ 46.580672][ T3698] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 46.580774][ T3698] ? clear_bhb_loop+0x40/0x90 [ 46.580796][ T3698] ? clear_bhb_loop+0x40/0x90 [ 46.580851][ T3698] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 46.580878][ T3698] RIP: 0033:0x7f059de7e929 [ 46.580904][ T3698] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 46.580960][ T3698] RSP: 002b:00007f059c4e7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000be [ 46.581009][ T3698] RAX: ffffffffffffffda RBX: 00007f059e0a5fa0 RCX: 00007f059de7e929 [ 46.581021][ T3698] RDX: 00002000000002c0 RSI: 0000200000000000 RDI: 0000000000000005 [ 46.581032][ T3698] RBP: 00007f059c4e7090 R08: 0000000000000000 R09: 0000000000000000 [ 46.581046][ T3698] R10: 000000000000fe44 R11: 0000000000000246 R12: 0000000000000001 [ 46.581061][ T3698] R13: 0000000000000000 R14: 00007f059e0a5fa0 R15: 00007ffd68f276c8 [ 46.581078][ T3698] [ 46.831250][ T3702] loop2: detected capacity change from 0 to 1024 [ 46.847885][ T3703] serio: Serial port ptm0 [ 46.880626][ T3702] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 46.941665][ T3314] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.943207][ T3715] netlink: 24 bytes leftover after parsing attributes in process `syz.4.78'. [ 46.971278][ T3715] netlink: 4 bytes leftover after parsing attributes in process `syz.4.78'. [ 46.989975][ T3715] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 46.991298][ T3718] loop2: detected capacity change from 0 to 1024 [ 47.009154][ T3718] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 47.023026][ T3715] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 47.033480][ T3718] EXT4-fs error (device loop2): ext4_ext_check_inode:523: inode #3: comm syz.2.79: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 3, max 3(4), depth 0(0) [ 47.052870][ T3718] EXT4-fs error (device loop2): ext4_quota_enable:7127: comm syz.2.79: Bad quota inode: 3, type: 0 [ 47.063992][ T3718] EXT4-fs warning (device loop2): ext4_enable_quotas:7168: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 47.080308][ T3718] EXT4-fs (loop2): mount failed [ 47.118625][ T3718] netlink: 'syz.2.79': attribute type 10 has an invalid length. [ 47.135648][ T3718] team0: Device dummy0 is up. Set it down before adding it as a team port [ 47.161547][ T3716] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.171653][ T3716] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.244754][ T3745] random: crng reseeded on system resumption [ 47.366786][ T3756] loop0: detected capacity change from 0 to 1024 [ 47.399925][ T3756] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 47.436392][ T3761] xt_hashlimit: max too large, truncated to 1048576 [ 47.449851][ T3307] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.495978][ T3763] netlink: 8 bytes leftover after parsing attributes in process `syz.0.86'. [ 47.517994][ T3765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.528492][ T3765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.643122][ T3763] syz.0.86 (3763) used greatest stack depth: 9440 bytes left [ 47.673927][ T3770] loop0: detected capacity change from 0 to 1024 [ 47.786499][ T3770] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 47.851938][ T3307] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.866568][ T3781] netlink: 132 bytes leftover after parsing attributes in process `syz.1.93'. [ 47.935253][ T3787] loop3: detected capacity change from 0 to 512 [ 47.961587][ T3787] EXT4-fs: Ignoring removed bh option [ 47.981185][ T3787] ext2: Unknown parameter 'pcr' [ 49.255874][ T3802] netlink: 24 bytes leftover after parsing attributes in process `syz.1.99'. [ 49.511663][ T3802] veth0_macvtap: left promiscuous mode [ 49.677769][ T29] kauditd_printk_skb: 711 callbacks suppressed [ 49.677788][ T29] audit: type=1400 audit(1749848328.451:1066): avc: denied { write } for pid=3809 comm="syz.4.102" name="kcm" dev="proc" ino=4026532982 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 49.780349][ T3817] SELinux: security_context_str_to_sid () failed with errno=-22 [ 49.799330][ T29] audit: type=1400 audit(1749848328.511:1067): avc: granted { setsecparam } for pid=3809 comm="syz.4.102" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 49.818535][ T29] audit: type=1400 audit(1749848328.531:1068): avc: denied { create } for pid=3816 comm="gtp" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 49.837535][ T29] audit: type=1400 audit(1749848328.551:1069): avc: granted { setsecparam } for pid=3814 comm="syz.1.104" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 49.856710][ T29] audit: type=1326 audit(1749848328.551:1070): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3814 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0ca15e929 code=0x7ffc0000 [ 49.880233][ T29] audit: type=1326 audit(1749848328.561:1071): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3814 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7ff0ca15e929 code=0x7ffc0000 [ 49.903775][ T29] audit: type=1326 audit(1749848328.561:1072): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3814 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0ca15e929 code=0x7ffc0000 [ 49.927433][ T29] audit: type=1326 audit(1749848328.561:1073): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3814 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff0ca15e929 code=0x7ffc0000 [ 49.951078][ T29] audit: type=1326 audit(1749848328.561:1074): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3814 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0ca15e929 code=0x7ffc0000 [ 49.975111][ T29] audit: type=1326 audit(1749848328.561:1075): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3814 comm="syz.1.104" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0ca15e929 code=0x7ffc0000 [ 49.978397][ T3817] vhci_hcd: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub [ 50.092451][ T3831] x_tables: ip6_tables: tcpmss match: only valid for protocol 6 [ 50.103873][ T3817] vhci_hcd: default hub control req: 800f v0000 i0000 l31125 [ 50.388681][ T3848] random: crng reseeded on system resumption [ 50.440952][ T3851] __nla_validate_parse: 3 callbacks suppressed [ 50.440969][ T3851] netlink: 24 bytes leftover after parsing attributes in process `syz.2.112'. [ 50.565081][ T3855] loop4: detected capacity change from 0 to 512 [ 50.572290][ T3851] netlink: 4 bytes leftover after parsing attributes in process `syz.2.112'. [ 50.572368][ T3855] EXT4-fs: Ignoring removed bh option [ 50.572410][ T3855] ext2: Unknown parameter 'pcr' [ 50.608341][ T3851] team0: Port device team_slave_0 removed [ 50.937043][ T3858] netlink: 24 bytes leftover after parsing attributes in process `syz.1.114'. [ 50.982486][ T3858] netlink: 4 bytes leftover after parsing attributes in process `syz.1.114'. [ 51.079254][ T3859] Cannot find add_set index 0 as target [ 51.120998][ T3861] netlink: 24 bytes leftover after parsing attributes in process `syz.0.115'. [ 51.173056][ T3861] netlink: 4 bytes leftover after parsing attributes in process `syz.0.115'. [ 51.214429][ T3861] veth1_macvtap: left promiscuous mode [ 51.405960][ T3869] loop1: detected capacity change from 0 to 1024 [ 51.443872][ T3869] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 51.460531][ T3871] netlink: 24 bytes leftover after parsing attributes in process `syz.3.120'. [ 51.489843][ T3871] netlink: 4 bytes leftover after parsing attributes in process `syz.3.120'. [ 51.528957][ T3881] random: crng reseeded on system resumption [ 51.537179][ T3871] Cannot find add_set index 0 as target [ 51.558146][ T3310] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.617077][ T3885] loop0: detected capacity change from 0 to 1024 [ 51.670483][ T3885] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 51.736575][ T3893] netlink: 24 bytes leftover after parsing attributes in process `syz.3.129'. [ 51.751343][ T3893] netlink: 4 bytes leftover after parsing attributes in process `syz.3.129'. [ 51.764199][ T3893] Cannot find add_set index 0 as target [ 51.931967][ T3307] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.216476][ T3910] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 52.313369][ T3915] random: crng reseeded on system resumption [ 52.400143][ T3912] loop3: detected capacity change from 0 to 1024 [ 52.479270][ T3912] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.492646][ T3933] FAULT_INJECTION: forcing a failure. [ 52.492646][ T3933] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 52.506205][ T3933] CPU: 1 UID: 0 PID: 3933 Comm: syz.4.142 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(voluntary) [ 52.506304][ T3933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 52.506319][ T3933] Call Trace: [ 52.506327][ T3933] [ 52.506336][ T3933] __dump_stack+0x1d/0x30 [ 52.506359][ T3933] dump_stack_lvl+0xe8/0x140 [ 52.506456][ T3933] dump_stack+0x15/0x1b [ 52.506474][ T3933] should_fail_ex+0x265/0x280 [ 52.506518][ T3933] should_fail+0xb/0x20 [ 52.506556][ T3933] should_fail_usercopy+0x1a/0x20 [ 52.506580][ T3933] _copy_from_user+0x1c/0xb0 [ 52.506619][ T3933] __sys_bpf+0x178/0x790 [ 52.506669][ T3933] __x64_sys_bpf+0x41/0x50 [ 52.506703][ T3933] x64_sys_call+0x2478/0x2fb0 [ 52.506758][ T3933] do_syscall_64+0xd2/0x200 [ 52.506808][ T3933] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 52.506885][ T3933] ? clear_bhb_loop+0x40/0x90 [ 52.506910][ T3933] ? clear_bhb_loop+0x40/0x90 [ 52.506931][ T3933] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 52.506952][ T3933] RIP: 0033:0x7f059de7e929 [ 52.506968][ T3933] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 52.507038][ T3933] RSP: 002b:00007f059c4e7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 52.507060][ T3933] RAX: ffffffffffffffda RBX: 00007f059e0a5fa0 RCX: 00007f059de7e929 [ 52.507075][ T3933] RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005 [ 52.507090][ T3933] RBP: 00007f059c4e7090 R08: 0000000000000000 R09: 0000000000000000 [ 52.507105][ T3933] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 52.507117][ T3933] R13: 0000000000000000 R14: 00007f059e0a5fa0 R15: 00007ffd68f276c8 [ 52.507136][ T3933] [ 52.795501][ T3308] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.811856][ T3940] futex_wake_op: syz.0.143 tries to shift op by -1; fix this program [ 52.886463][ T3944] loop4: detected capacity change from 0 to 1024 [ 52.905031][ T3942] serio: Serial port ttyS3 [ 52.914602][ T3947] veth0_vlan: entered allmulticast mode [ 52.924741][ T3944] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.932183][ T3947] veth0_vlan: left promiscuous mode [ 52.942830][ T3947] veth0_vlan: entered promiscuous mode [ 52.991412][ T3942] netlink: 'syz.3.146': attribute type 1 has an invalid length. [ 53.010670][ T3316] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 53.259604][ T3963] FAULT_INJECTION: forcing a failure. [ 53.259604][ T3963] name failslab, interval 1, probability 0, space 0, times 0 [ 53.272407][ T3963] CPU: 0 UID: 0 PID: 3963 Comm: syz.3.154 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(voluntary) [ 53.272444][ T3963] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 53.272465][ T3963] Call Trace: [ 53.272525][ T3963] [ 53.272535][ T3963] __dump_stack+0x1d/0x30 [ 53.272564][ T3963] dump_stack_lvl+0xe8/0x140 [ 53.272640][ T3963] dump_stack+0x15/0x1b [ 53.272661][ T3963] should_fail_ex+0x265/0x280 [ 53.272764][ T3963] should_failslab+0x8c/0xb0 [ 53.272932][ T3963] kmem_cache_alloc_node_noprof+0x57/0x320 [ 53.272963][ T3963] ? __alloc_skb+0x101/0x320 [ 53.273007][ T3963] __alloc_skb+0x101/0x320 [ 53.273064][ T3963] netlink_alloc_large_skb+0xba/0xf0 [ 53.273108][ T3963] netlink_sendmsg+0x3cf/0x6b0 [ 53.273174][ T3963] ? __pfx_netlink_sendmsg+0x10/0x10 [ 53.273216][ T3963] __sock_sendmsg+0x145/0x180 [ 53.273256][ T3963] ____sys_sendmsg+0x31e/0x4e0 [ 53.273370][ T3963] ___sys_sendmsg+0x17b/0x1d0 [ 53.273411][ T3963] __x64_sys_sendmsg+0xd4/0x160 [ 53.273442][ T3963] x64_sys_call+0x2999/0x2fb0 [ 53.273470][ T3963] do_syscall_64+0xd2/0x200 [ 53.273544][ T3963] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 53.273572][ T3963] ? clear_bhb_loop+0x40/0x90 [ 53.273593][ T3963] ? clear_bhb_loop+0x40/0x90 [ 53.273634][ T3963] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 53.273688][ T3963] RIP: 0033:0x7f3531a3e929 [ 53.273717][ T3963] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 53.273739][ T3963] RSP: 002b:00007f35300a7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 53.273763][ T3963] RAX: ffffffffffffffda RBX: 00007f3531c65fa0 RCX: 00007f3531a3e929 [ 53.273779][ T3963] RDX: 00000000000400dc RSI: 0000200000000080 RDI: 0000000000000008 [ 53.273794][ T3963] RBP: 00007f35300a7090 R08: 0000000000000000 R09: 0000000000000000 [ 53.273880][ T3963] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 53.273897][ T3963] R13: 0000000000000000 R14: 00007f3531c65fa0 R15: 00007ffdc2c16d08 [ 53.273922][ T3963] [ 53.519699][ T3964] loop4: detected capacity change from 0 to 512 [ 53.537229][ T3964] EXT4-fs: Ignoring removed bh option [ 53.542821][ T3964] ext2: Unknown parameter 'pcr' [ 53.561021][ T3967] x_tables: ip6_tables: tcpmss match: only valid for protocol 6 [ 54.770991][ T29] kauditd_printk_skb: 456 callbacks suppressed [ 54.771009][ T29] audit: type=1400 audit(1749848333.541:1532): avc: denied { setopt } for pid=3983 comm="syz.1.161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 54.882857][ T29] audit: type=1400 audit(1749848333.541:1533): avc: denied { bind } for pid=3983 comm="syz.1.161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 54.902596][ T29] audit: type=1400 audit(1749848333.541:1534): avc: denied { name_bind } for pid=3983 comm="syz.1.161" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 54.924824][ T29] audit: type=1400 audit(1749848333.541:1535): avc: denied { node_bind } for pid=3983 comm="syz.1.161" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 55.028280][ T3990] random: crng reseeded on system resumption [ 55.034494][ T29] audit: type=1400 audit(1749848333.801:1536): avc: denied { write } for pid=3989 comm="syz.0.164" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 55.057627][ T29] audit: type=1400 audit(1749848333.801:1537): avc: denied { open } for pid=3989 comm="syz.0.164" path="/dev/snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 55.173531][ T3997] loop1: detected capacity change from 0 to 128 [ 55.175559][ T29] audit: type=1400 audit(1749848333.941:1538): avc: denied { validate_trans } for pid=3993 comm="syz.1.166" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 55.210718][ T3997] FAT-fs (loop1): bogus number of reserved sectors [ 55.217418][ T3997] FAT-fs (loop1): This doesn't look like a DOS 1.x volume; DOS 2.x BPB is non-zero [ 55.223032][ T29] audit: type=1400 audit(1749848333.991:1539): avc: denied { read write } for pid=4000 comm="syz.2.167" name="virtual_nci" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 55.226780][ T3997] FAT-fs (loop1): Can't find a valid FAT filesystem [ 55.257386][ T29] audit: type=1400 audit(1749848333.991:1540): avc: denied { open } for pid=4000 comm="syz.2.167" path="/dev/virtual_nci" dev="devtmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 55.283590][ T3999] SELinux: security_context_str_to_sid () failed with errno=-22 [ 55.333190][ T4004] mmap: syz.2.167 (4004) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 55.352755][ T3999] vhci_hcd: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub [ 55.385152][ T3999] vhci_hcd: default hub control req: 800f v0000 i0000 l31125 [ 55.401665][ T29] audit: type=1400 audit(1749848334.051:1541): avc: denied { create } for pid=3998 comm="gtp" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 55.438355][ T4013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.449925][ T4013] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.496647][ T4018] netlink: 'syz.2.173': attribute type 3 has an invalid length. [ 55.508713][ T4018] loop2: detected capacity change from 0 to 256 [ 55.532558][ T4018] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 198) [ 55.541904][ T4018] FAT-fs (loop2): Filesystem has been set read-only [ 55.550354][ T4018] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 198) [ 55.571903][ T4020] loop0: detected capacity change from 0 to 1024 [ 55.667351][ T4020] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 55.712787][ T4022] __nla_validate_parse: 6 callbacks suppressed [ 55.712911][ T4022] netlink: 332 bytes leftover after parsing attributes in process `syz.3.175'. [ 55.730320][ T4022] netlink: 'syz.3.175': attribute type 9 has an invalid length. [ 55.739269][ T4022] netlink: 108 bytes leftover after parsing attributes in process `syz.3.175'. [ 55.749149][ T4022] netlink: 32 bytes leftover after parsing attributes in process `syz.3.175'. [ 55.825718][ T3307] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.895143][ T4035] netlink: 'syz.0.179': attribute type 4 has an invalid length. [ 55.919501][ T4040] loop2: detected capacity change from 0 to 512 [ 55.920563][ T4039] FAULT_INJECTION: forcing a failure. [ 55.920563][ T4039] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 55.939946][ T4039] CPU: 1 UID: 0 PID: 4039 Comm: syz.3.180 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(voluntary) [ 55.940009][ T4039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 55.940021][ T4039] Call Trace: [ 55.940029][ T4039] [ 55.940038][ T4039] __dump_stack+0x1d/0x30 [ 55.940068][ T4039] dump_stack_lvl+0xe8/0x140 [ 55.940093][ T4039] dump_stack+0x15/0x1b [ 55.940114][ T4039] should_fail_ex+0x265/0x280 [ 55.940202][ T4039] should_fail_alloc_page+0xf2/0x100 [ 55.940229][ T4039] __alloc_frozen_pages_noprof+0xff/0x360 [ 55.940350][ T4039] alloc_pages_mpol+0xb3/0x250 [ 55.940393][ T4039] alloc_pages_noprof+0x90/0x130 [ 55.940433][ T4039] pte_alloc_one+0x2d/0x120 [ 55.940529][ T4039] __pte_alloc+0x32/0x2b0 [ 55.940568][ T4039] handle_mm_fault+0x1c16/0x2be0 [ 55.940596][ T4039] ? __rcu_read_lock+0x37/0x50 [ 55.940631][ T4039] __get_user_pages+0x1036/0x1fb0 [ 55.940725][ T4039] __gup_longterm_locked+0x9c9/0x1010 [ 55.940753][ T4039] ? exc_page_fault+0x62/0xa0 [ 55.940791][ T4039] ? do_user_addr_fault+0xbb8/0x1090 [ 55.940827][ T4039] ? should_fail_ex+0xdb/0x280 [ 55.940934][ T4039] pin_user_pages_remote+0x7e/0xb0 [ 55.940964][ T4039] process_vm_rw+0x484/0x950 [ 55.941041][ T4039] __x64_sys_process_vm_readv+0x78/0x90 [ 55.941073][ T4039] x64_sys_call+0x2978/0x2fb0 [ 55.941098][ T4039] do_syscall_64+0xd2/0x200 [ 55.941121][ T4039] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 55.941192][ T4039] ? clear_bhb_loop+0x40/0x90 [ 55.941218][ T4039] ? clear_bhb_loop+0x40/0x90 [ 55.941246][ T4039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 55.941319][ T4039] RIP: 0033:0x7f3531a3e929 [ 55.941348][ T4039] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 55.941366][ T4039] RSP: 002b:00007f35300a7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000136 [ 55.941389][ T4039] RAX: ffffffffffffffda RBX: 00007f3531c65fa0 RCX: 00007f3531a3e929 [ 55.941411][ T4039] RDX: 0000000000000002 RSI: 0000200000008400 RDI: 000000000000006b [ 55.941425][ T4039] RBP: 00007f35300a7090 R08: 0000000000000286 R09: 0000000000000000 [ 55.941439][ T4039] R10: 0000200000008640 R11: 0000000000000246 R12: 0000000000000001 [ 55.941453][ T4039] R13: 0000000000000000 R14: 00007f3531c65fa0 R15: 00007ffdc2c16d08 [ 55.941476][ T4039] [ 56.182125][ T4042] netlink: 'syz.0.179': attribute type 4 has an invalid length. [ 56.256158][ T4040] EXT4-fs: Ignoring removed bh option [ 56.262130][ T4040] ext2: Unknown parameter 'pcr' [ 56.302159][ T4048] SELinux: security_context_str_to_sid () failed with errno=-22 [ 56.455445][ T4050] netlink: 24 bytes leftover after parsing attributes in process `syz.4.185'. [ 56.473576][ T4048] vhci_hcd: USB_PORT_FEAT_SUSPEND req not supported for USB 3.0 roothub [ 56.496637][ T4050] netlink: 4 bytes leftover after parsing attributes in process `syz.4.185'. [ 56.537472][ T4048] vhci_hcd: default hub control req: 800f v0000 i0000 l31125 [ 56.734128][ T4050] Cannot find add_set index 0 as target [ 56.955684][ T4061] netlink: 12 bytes leftover after parsing attributes in process `syz.4.189'. [ 56.983855][ T4059] netlink: 332 bytes leftover after parsing attributes in process `syz.3.188'. [ 57.027133][ T4059] netlink: 'syz.3.188': attribute type 9 has an invalid length. [ 57.036035][ T4059] netlink: 108 bytes leftover after parsing attributes in process `syz.3.188'. [ 57.045953][ T4059] netlink: 32 bytes leftover after parsing attributes in process `syz.3.188'. [ 57.079836][ T4063] loop4: detected capacity change from 0 to 1024 [ 57.120461][ T4063] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 57.252413][ T3316] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.292403][ T4074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.324588][ T4074] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.342890][ T4076] netlink: 24 bytes leftover after parsing attributes in process `syz.4.194'. [ 57.510726][ T4082] 9pnet_fd: Insufficient options for proto=fd [ 57.651213][ T4088] netlink: 'syz.4.201': attribute type 9 has an invalid length. [ 57.703920][ T4092] FAULT_INJECTION: forcing a failure. [ 57.703920][ T4092] name failslab, interval 1, probability 0, space 0, times 0 [ 57.717072][ T4092] CPU: 1 UID: 0 PID: 4092 Comm: syz.4.203 Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(voluntary) [ 57.717099][ T4092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 57.717110][ T4092] Call Trace: [ 57.717117][ T4092] [ 57.717131][ T4092] __dump_stack+0x1d/0x30 [ 57.717151][ T4092] dump_stack_lvl+0xe8/0x140 [ 57.717169][ T4092] dump_stack+0x15/0x1b [ 57.717263][ T4092] should_fail_ex+0x265/0x280 [ 57.717294][ T4092] should_failslab+0x8c/0xb0 [ 57.717315][ T4092] kmem_cache_alloc_node_noprof+0x57/0x320 [ 57.717388][ T4092] ? __alloc_skb+0x101/0x320 [ 57.717429][ T4092] __alloc_skb+0x101/0x320 [ 57.717503][ T4092] netlink_alloc_large_skb+0xba/0xf0 [ 57.717533][ T4092] netlink_sendmsg+0x3cf/0x6b0 [ 57.717628][ T4092] ? __pfx_netlink_sendmsg+0x10/0x10 [ 57.717647][ T4092] __sock_sendmsg+0x145/0x180 [ 57.717671][ T4092] ____sys_sendmsg+0x31e/0x4e0 [ 57.717692][ T4092] ___sys_sendmsg+0x17b/0x1d0 [ 57.717744][ T4092] __x64_sys_sendmsg+0xd4/0x160 [ 57.717766][ T4092] x64_sys_call+0x2999/0x2fb0 [ 57.717807][ T4092] do_syscall_64+0xd2/0x200 [ 57.717826][ T4092] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 57.717848][ T4092] ? clear_bhb_loop+0x40/0x90 [ 57.717919][ T4092] ? clear_bhb_loop+0x40/0x90 [ 57.717937][ T4092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.717955][ T4092] RIP: 0033:0x7f059de7e929 [ 57.717969][ T4092] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 57.717984][ T4092] RSP: 002b:00007f059c4e7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 57.718034][ T4092] RAX: ffffffffffffffda RBX: 00007f059e0a5fa0 RCX: 00007f059de7e929 [ 57.718045][ T4092] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 57.718056][ T4092] RBP: 00007f059c4e7090 R08: 0000000000000000 R09: 0000000000000000 [ 57.718074][ T4092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 57.718090][ T4092] R13: 0000000000000000 R14: 00007f059e0a5fa0 R15: 00007ffd68f276c8 [ 57.718114][ T4092] [ 58.093966][ T4099] loop4: detected capacity change from 0 to 1024 [ 58.120396][ T4099] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 59.227975][ T4115] SELinux: security_context_str_to_sid () failed with errno=-22 [ 59.516506][ T3316] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.531721][ T4115] vhci_hcd: default hub control req: 800f v0000 i0000 l31125 [ 59.564566][ T4122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.574247][ T4122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.594400][ T2998] ================================================================== [ 59.602637][ T2998] BUG: KCSAN: data-race in avc_policy_seqno / avc_ss_reset [ 59.610155][ T2998] [ 59.612538][ T2998] write to 0xffffffff88e8ac18 of 4 bytes by task 4125 on cpu 1: [ 59.620372][ T2998] avc_ss_reset+0x20c/0x240 [ 59.624916][ T2998] security_set_bools+0x301/0x340 [ 59.630151][ T2998] sel_commit_bools_write+0x1ea/0x270 [ 59.635566][ T2998] vfs_writev+0x406/0x8b0 [ 59.639944][ T2998] do_writev+0xe7/0x210 [ 59.644156][ T2998] __x64_sys_writev+0x45/0x50 [ 59.649138][ T2998] x64_sys_call+0x2006/0x2fb0 [ 59.653875][ T2998] do_syscall_64+0xd2/0x200 [ 59.658427][ T2998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.664355][ T2998] [ 59.666890][ T2998] read to 0xffffffff88e8ac18 of 4 bytes by task 2998 on cpu 0: [ 59.674471][ T2998] avc_policy_seqno+0x15/0x30 [ 59.679190][ T2998] selinux_file_permission+0x1cd/0x320 [ 59.684715][ T2998] security_file_permission+0x3e/0x80 [ 59.690426][ T2998] iterate_dir+0x57/0x330 [ 59.695072][ T2998] __se_sys_getdents64+0x88/0x1b0 [ 59.700506][ T2998] __x64_sys_getdents64+0x43/0x50 [ 59.705789][ T2998] x64_sys_call+0x1302/0x2fb0 [ 59.710618][ T2998] do_syscall_64+0xd2/0x200 [ 59.715278][ T2998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.721401][ T2998] [ 59.723866][ T2998] value changed: 0x00000011 -> 0x00000012 [ 59.729598][ T2998] [ 59.731992][ T2998] Reported by Kernel Concurrency Sanitizer on: [ 59.738465][ T2998] CPU: 0 UID: 0 PID: 2998 Comm: udevd Not tainted 6.16.0-rc1-syzkaller-00157-g02adc1490e6d #0 PREEMPT(voluntary) [ 59.750676][ T2998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 59.760763][ T2998] ================================================================== [ 59.790494][ T29] kauditd_printk_skb: 181 callbacks suppressed [ 59.790511][ T29] audit: type=1400 audit(1749848338.561:1723): avc: denied { open } for pid=4127 comm="syz.4.213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 59.816225][ T29] audit: type=1400 audit(1749848338.561:1724): avc: denied { kernel } for pid=4127 comm="syz.4.213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 59.838891][ T4125] loop3: detected capacity change from 0 to 1024 [ 59.885719][ T29] audit: type=1400 audit(1749848338.611:1725): avc: denied { read write } for pid=4123 comm="syz.3.214" name="loop3" dev="devtmpfs" ino=103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 59.895462][ T4125] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 59.909829][ T29] audit: type=1400 audit(1749848338.611:1726): avc: denied { open } for pid=4123 comm="syz.3.214" path="/dev/loop3" dev="devtmpfs" ino=103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 59.946278][ T29] audit: type=1400 audit(1749848338.611:1727): avc: denied { ioctl } for pid=4123 comm="syz.3.214" path="/dev/loop3" dev="devtmpfs" ino=103 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 59.972059][ T29] audit: type=1400 audit(1749848338.611:1728): avc: denied { map_create } for pid=4127 comm="syz.4.213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 59.991787][ T29] audit: type=1400 audit(1749848338.611:1729): avc: denied { map_read map_write } for pid=4127 comm="syz.4.213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 60.011943][ T29] audit: type=1400 audit(1749848338.621:1730): avc: denied { mounton } for pid=4123 comm="syz.3.214" path="/50/file1" dev="tmpfs" ino=276 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 60.035071][ T29] audit: type=1400 audit(1749848338.621:1731): avc: denied { create } for pid=4127 comm="syz.4.213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 60.054684][ T29] audit: type=1400 audit(1749848338.621:1732): avc: denied { setopt } for pid=4127 comm="syz.4.213" lport=44 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 60.098782][ T3308] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.