last executing test programs: 877.1519ms ago: executing program 1 (id=2): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000340)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x2, 0x4, 0x7ffc0002}]}) setpgid(0x0, 0x0) 842.029271ms ago: executing program 1 (id=6): bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=ANY=[], 0x48) rmdir(&(0x7f0000000400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000300)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0, r0}, 0x18) r1 = socket(0x10, 0x3, 0x9) connect$netlink(r1, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) syz_emit_ethernet(0xfdef, &(0x7f0000000380)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x8}}}}}, 0x0) 799.498792ms ago: executing program 1 (id=7): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101c02, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) write$ppp(r0, &(0x7f0000000200)="7489", 0x2) 711.407334ms ago: executing program 3 (id=4): bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=ANY=[], 0x48) rmdir(&(0x7f0000000400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000300)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0, r0}, 0x18) r1 = socket(0x10, 0x3, 0x9) connect$netlink(r1, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) syz_emit_ethernet(0xfdef, &(0x7f0000000380)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast}, {0x0, 0x0, 0x8}}}}}, 0x0) 691.195775ms ago: executing program 3 (id=8): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\a\x00'/20, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_mount_image$vfat(&(0x7f0000000340), &(0x7f0000000000)='./file1\x00', 0x280809a, &(0x7f0000000f40)=ANY=[], 0x1, 0x2b2, &(0x7f00000006c0)="$eJzs3U9rY1UUAPDz0jR9OosUcaMIPtCFqzJ166ZRRhC7UiKoCw3ODEgSBqYQmArGruYTuPR7+BHcuPEbDLgV3E0XlSfvX/7ga402VXR+v9Xh3nfuPXm3TbLJeZ+/Mh3ffZDE2dMnkaZJdI7iKM6T2I9ONL6JbgAA/x/neR6/5mWY5JUNM7udGy0MALgx1ef/X/rgBwD+4z78+JP3B8fHdz7IsjRe6j+eDZOImD6eDav5wf34MiZxL25HPy4i8oUqfve94zvRzQr78fp0PhsWmdPPfqzXH/wSUeYfRj/22/MPs8pK/nw23I3nI4vB/d2m1H682J7/Zkt+DHvxxmsr9R9EP376Ih7EJO5GkbvM//owy97Jv3361afFNkV+0onhXnldKfcFCQAAAAAAAAAAAAAAAAAAAACA7TrIsqRq31P27ymG6v47Oxfl/EHW2F/vz1PlJ81CVX+gvOmWM8/ju6a/zu0sy/L6wmV+N17uerAAAAAAAAAAAAAAAAAAAAAAFE4ePbk1mkzuPTx5dDq+dtB0A2h+1v931zlaGXk1TsejncsX3Nt8r9VuA0WtV14c3W5s6ba0B2eLkeeKera+xV4sRj6KKmgOZqt7vfB2tejpeJTVU81NHo+SP9srbQ7u+9WpXly3sLz8k7jI1880XZS6ntXb0t3o3Wqd+i3P883Weevn6ozqkaRssbHZ7rt10PoCiyAtziJd/OMXUz9cvuClbxk7137TAQAAAAAAAAAAAAAAAAAAWi1/9NsyeXZlaufGigIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAf9jy+f9NkEbE+sgfgnmdfNU1ddCLhyf/8ksEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgGfB7AAAA//8rlFqg") r1 = open(&(0x7f0000000080)='./file0\x00', 0x40c5, 0x130) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x51) write$9p(r1, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff5295e8cd6f55ce071b304aa0a588b3b7a2efa2f167dd9c1b8b016268d37d9a30983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402c76caf85d4569a7", 0x1fc) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000009c0)={0x4f, 0x29, 0x2, {0x1, [{{0x40, 0x4, 0x5}, 0x3, 0x9, 0xd, './file1/file0'}, {{0x8, 0x3, 0x5}, 0x9c, 0x1, 0x7, './file2'}]}}, 0x4f) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x3b0, 0x0, 0x43, 0xa0, 0x1d0, 0x98, 0x318, 0x178, 0x178, 0x318, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1b0, 0x1d0, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@helper={{0x48}, {0x0, 'ftp-20000\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xe8, 0x148, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x410) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) sendfile(r1, r2, 0x0, 0xe065) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r4, 0x29, 0x39, &(0x7f00000000c0)=ANY=[], 0x8) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r5) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB], 0x30}, 0x1, 0x0, 0x0, 0x4008000}, 0x48004) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x2004000, &(0x7f00000003c0)=ANY=[@ANYBLOB='nr_inodes=2']) chdir(&(0x7f0000000340)='./file0\x00') mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(r7, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="01032dbd700018dcdf2501"], 0x14}, 0x1, 0x0, 0x0, 0x48880}, 0x4) sendmsg$NL802154_CMD_NEW_INTERFACE(r5, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000825bd7000fbdbdf25070000000c00060001000000010000000800050000000000"], 0x28}, 0x1, 0x0, 0x0, 0x20040000}, 0x4) unshare(0x22020400) r9 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000040), &(0x7f0000000180)=0x4) ioctl$TIOCSETD(r9, 0x5423, &(0x7f0000000140)=0xa) 675.953805ms ago: executing program 1 (id=9): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) r2 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70200001400000bb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000700)='kfree\x00', r3}, 0x18) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) 630.670546ms ago: executing program 1 (id=10): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000002c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='kmem_cache_free\x00', r2, 0x0, 0x800}, 0x18) setpgid(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x14, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x2008002, &(0x7f0000001e80)={[{@inlinecrypt}]}, 0x1, 0x549, &(0x7f0000001800)="$eJzs3c9vI1cdAPDvTH65222zCz1ABewChQWt1t5421XVS8sFhKpKiIoD4rANiTcKseMQO6UJkUj/BpBA4gR/AgckDkg9ceDGEYkDQpQDUoEItEHiYDRjJ+smNmtqx+7Gn480O/Pmzcz3PWdn3vNz4hfA1LoeEQcRMR8Rb0TEYmd/0lnilfaSHffgcH/l6HB/JYlW6/W/J3l+ti+6zsk82blmISK+/pWIbydn4zZ29zaWq9XKdiddata2So3dvVvrteW1ylpls1y+u3T39ot3XiiPrK7Xar9478vrr37j17/65Lu/O/ji97NiXe7kdddjlNpVnzuJk5mNiFfPI9gEzHTW8xMuBx9MGhEfiYjP5Pf/Yszk/zsBgIus1VqM1mJ3GgC46NJ8DCxJixGRpp1OQLE9hvdMXEqr9Ubz5v36zuZqe6zsSsyl99erldtXF/7w3fzguSRLL+V5eX6eLp9K34mIqxHxo4Un8nRxpV5dnUyXBwCm3pPd7X9E/GshTYvFgU7t8akeAPDYKEy6AADA2Gn/AWD6aP8BYPoM0P53Puw/OPeyAADj4f0/AEwf7T8ATB/tPwBMla+99lq2tI4633+9+ubuzkb9zVurlcZGsbazUlypb28V1+r1tfw7e2qPul61Xt9aej523io1K41mqbG7d69W39ls3su/1/teZW4stQIA/per1975fRIRBy89kS/RNZeDthoutnSERwGPl5lhTtZBgMea2b5geg3UhOedhN+ee1mAyej5Zd6Fnpvv95P/I4jfM4IPlRsfH3z83xzPcLEY2Yfp9cHG/18eeTmA8TP+D9Or1UpOz/k/f5IFAFxIQ/wKX+sHo+qEABP1qMm8R/L5PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFwwlyPiO5GkxXwu8DT7Ny0WI56KiCsxl9xfr1ZuR8TTcS0i5hay9NKkCw0ADCn9a9KZ/+vG4nOXT+fOJ/9eyNcR8b2fvv7jt5abze2lbP8/TvYvHE8fVn543hDzCgIAg/vzIAfl7Xe5s+56I//gcH/leDnHMp7x3pdOJh9dOTrcz5d2zmy0Wq1WRCHvS1z6ZxKznXMKEfFsRMyMIP7B2xHxsV71T/KxkSudmU+740cn9lNjjZ++L36a57XX2cv30RGUBabNO9nz55Ve918a1/N17/u/kD+hhpc//woRx8++o674s51IMz3iZ/f89UFjPP+br57Z2Vps570d8exsr/jJSfykT/znBoz/x0986ocv98lr/SziRvSO3x2r1KxtlRq7e7fWa8trlbXKZrl8d+nu7RfvvFAu5WPUpeOR6rP+9tLNp/uVLav/pT7xCz3rP39y7ucGrP/P//PGtz79MLlwOv4XPtv75/9Mz/htWZv4+QHjL1/6Zd/pu7P4q33q/6if/80B47/7l73VAQ8FAMagsbu3sVytVraH2sjehY7iOmc2siIOdvBxd3G4oH+KfGNEL0ufjawzNsjBc+f1qp77xuxJX3G0V/5mdsUxVycdeS2G2ngwrliTeyYB4/Hwpp90SQAAAAAAAAAAAAAAgH7G8adLk64jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF9d/AwAA//8+JMPM") open(&(0x7f0000000080)='./file0\x00', 0x2040, 0x20) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x2000414, 0x0, 0x1, 0x0, &(0x7f0000000480)) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000280)={0x0, 0xa2f8, 0x0, 0x81, 0xffffffff, 0x2}) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000100)=0x2) r3 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x141341) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f00000000c0)={0x80, 0x6, 0x2fe, 0xe5, 0xe0, 0x0, 0x0}) 538.834128ms ago: executing program 2 (id=3): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xb, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5c00000012006b04000000d86e6c1d0002887ea6ea65670000000000000090f9c3dc90f8f41f8ecff32c6e020075e300250045586c8da718ad4b4460bc24eab55600000000000000bf9367b4fa51f60a64c9f4d4938037e786a6d0bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000340)={0x0, 0xcc}, 0x8) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'dummy0\x00', 0x0}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r2, &(0x7f0000000780)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x2, @loopback, 0x3}, 0x1c, &(0x7f0000000500)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x3404c8d4) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000040)=ANY=[], 0x1000f) socket$nl_netfilter(0x10, 0x3, 0xc) 380.757462ms ago: executing program 2 (id=11): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r0}, &(0x7f0000000000), &(0x7f00000005c0)=r1}, 0x20) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r3, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) close_range(r2, 0xffffffffffffffff, 0x0) 289.301094ms ago: executing program 2 (id=12): syz_mount_image$ext4(&(0x7f0000000280)='ext4\x00', &(0x7f0000000240)='./bus\x00', 0x404, &(0x7f0000000200)={[{@data_err_ignore}, {@mb_optimize_scan}]}, 0x1, 0x5e6, &(0x7f0000001200)="$eJzs3c1vFVUbAPBnbj9oKe/bQt68igtpYgwkSksLGGJcwNaQBj/ixo2VFkQKNLRGiyaUBDcmxo0xJq5ciP+FEtmy0pULN64MCVHD0sRr5nam9LZzW3r7MZX5/ZJLZ+bc4TzT26fn3NNz5gZQWYPpP7WI/RExnUT0J/OLZZ2RFQ4uPO/Bnx+dTR9J1Ouv/Z5Ekh3Ln59kX/uyk3si4scfktjXsbLemblrF8enpiavZvvDs5emh2fmrh2+cGn8/OT5ycujL4yeOH7s+ImRI21d1/WCY6dvvvt+/ydjb37z1V/JyLe/jCVxMl7Onrj0OjbLYAw2vifJyqK+E5tdWUk6sp+TpS9x0lliQKxL/vp1RcQT0R8d8fDF64+PXyk1OGBL1ZOIOlBRifyHisr7Afl7++Xvg2ul9EqA7XD/1MIAwMr871wYG4yextjA7gdJLB3WSSKivZG5Znsi4u6dsZvn7ozdjC0ahwOKzd+IiCeL8j9p5P9A9MRAI/9rTfmf9gvOZF/T46+2Wf/yoWL5D9tnIf97Vs3/aJH/by3J/7fbrH/w4eY7vU3539vuJQEAAAAAAEBl3T4VEc8X/f2/tjj/Jwrm//RFxMlNqH9w2f7Kv//X7m1CNUCB+6ciXiqc/1vLZ/8OdGRb/2nMB+hKzl2YmjwSEf+NiEPRtSvdH1mljsOf7vuyVdlgNv8vf6T1383mAmZx3Ovc1XzOxPjs+EavG4i4fyPiqcL5v8li+58UtP/p74PpR6xj37O3zrQqWzv/ga1S/zriYGH7//CuFcnq9+cYbvQHhvNewUpPf/jZd63qbzf/3WICNi5t/3evnv8DydL79cysv46jc531VmXt9v+7k9cbt5zpzo59MD47e3Ukojs53ZEebTo+uv6Y4XGU50OeL2n+H3pm9fG/ov5/b0TML/u/kz+a1xTn/v9336+t4tH/h/Kk+T+xrvZ//Rujtwa+b1X/o7X/xxpt/aHsiPE/WPBFnqbdzccL0rGzqGi74wUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAx0EtIvZEUhta3K7VhoYi+iLif7G7NnVlZva5c1feuzyRljU+/7+Wf9Jv/8J+kn/+/8CS/dFl+0cjYm9EfN7R29gfOntlaqLsiwcAAAAAAAAAAAAAAAAAAIAdoq/F+v/Ubx1lRwdsuc6yAwBKU5D/P5URB7D9tP9QXfIfqkv+Q3XJf6gu+Q/VJf+huuQ/VNc68z/JHgAAAAAAwM6098Dtn5OImH+xt/FIdWdlXaVGBmy1WtkBAKVxix+oLlP/oLrW+x7/5BbFAZRnrfm8PS1P2shM4OmzGzgZAAAAAAAAAAAAACrn4H7r/6GqrP+H6rL+H6orX/9/oOQ4gO3nPT4Qa6zkL1z/v+ZZAAAAAAAAAAAAAMBmmpm7dnF8amryqo03dkYY27lRr9evpz8FOyWef/lGPhV+p8SzbCNf6/doZ5X3OwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGj2TwAAAP//030lBw==") r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1, 0x2}, 0x10) bind$tipc(r0, 0x0, 0x0) close(r0) timer_create(0x0, &(0x7f0000000300)={0x0, 0x21, 0x0, @thr={&(0x7f0000000000)="b3545b6673eb4cc4de880be516cdbec5b2a474b0a20c9132622c7e623a47b26dc145409077b9c6540e77ff8906c9daf22da2fc0ba7bd2099681186f530c2cd0ea0e7ddab2fd669ed651b4ce2da6ecdf4396bb4327e8830303869d947fe0565d351f2d0b236ed357a4680f2414305455d4fd3cbd59feef95edca5b76e611330d073692bec688bd01de0f88a7d99a43e3800f525", &(0x7f00000002c0)="81602b232e96706e1acd34e69005bc34e3286cc98f3956f30075"}}, &(0x7f0000000340)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{}, 0x0, &(0x7f0000000840)}, 0x20) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, @void, @value}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000240)='GPL\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x1300, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./bus\x00', 0x2, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='scsi_dispatch_cmd_start\x00', r4}, 0x10) madvise(&(0x7f00000fd000/0x2000)=nil, 0x2000, 0x4) write(r3, &(0x7f0000004200)='t', 0x1) mlock(&(0x7f00000fd000/0x1000)=nil, 0x1000) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="7a0af8ff75257075bfa100000000000007010000f9ffffffb702000005000000bf130000000000008500000071000000b7000000000000009500000000000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b257183fa3bcd48666d1ddd73f3047d248df061222193165274bc7f2382f6cda4bfdd45be583823c0f09601f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce7243d1aebd00000000000000005839c77edf2d34b12cd48a0c20fb7dd843267e0331759f4ec6b5b0af58e604f4942eb613eff289026d5045ef76d7d864409eb2dcc718a09f4886afc26abba34635d0e8b54bc76be40d435aa8b5202db761014b1b999a12df6bee431a666100"/296], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000180)=r6, 0x4) sendmsg$kcm(r5, &(0x7f0000000100)={0x0, 0x12a6, &(0x7f0000001340)=[{&(0x7f0000000040)="2e00000011008188040f46ecdb4cb9cca7480ef42b000081e3bd6efb010511000b0003000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x0) sendfile(r3, r1, 0x0, 0x3ffff) write$binfmt_aout(r3, &(0x7f0000000600)=ANY=[@ANYBLOB="000006b191000000910000a485dd0040000000aa020000080000000000000000"], 0x20) sendfile(r3, r1, 0x0, 0x7ffff000) 193.891066ms ago: executing program 3 (id=13): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a00002"], &(0x7f0000000280)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x27, 0x3, 0x1}, 0x6) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000001480)={'vlan0\x00', 0x1}) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008fd88500000004000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000004340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a300000000034000000030a010100000000000000000100000209000b0073797a31000000000900010073797a300000000008000a4000000004d4010000020a"], 0x250}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) mlock2(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0) process_vm_writev(0x0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 123.582458ms ago: executing program 3 (id=14): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70200001400000bb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000700)='kfree\x00', r3}, 0x18) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) 122.440098ms ago: executing program 4 (id=5): socket$packet(0x11, 0xa, 0x300) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x2) close(r1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000000085000000"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f00000004c0)='sched_switch\x00', r2}, 0x18) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x100001f, &(0x7f0000000280), 0x21, 0x44b, &(0x7f0000000dc0)="$eJzs281vG0UbAPBn7aR9274lKSof/YAGCqICkTRpgR44tAgkDiAhwaEcQ5JWoW6DmiDRKoKAUDmiShy4IY5I/AWc4IKAExJXuKNKFcqlhZPR2ruJ49hJnNh1iH8/aZWZ3XFmHu+OPbPjDaBnDUXEpxHx/4j4PSIGIiKpLzBU/XN3cX7i78X5iSTK5Tf/Sirl7izOT+RF89ftyzML1fyRBvXOXrt+abxUmrqa5UfmLr83Mnvt+rPTl8cvTl2cujJ25szpU6MvPD/2XFviTNt05/CHM0cPvfr2zdcnzt985+dvkyy8qIujTYbWOvhkmyvrtv016aSviw2hJcWISE9Xf6X/D0Qxlk/eQLzySVcbB3RUuVwu725+eKEM7GBJdLsFQHfkX/Tp/Dff7tHQY1u4fa46AUrjvptt1SN9UcjK9NfNb9spnW2dX/jnq3SLztyHAABY4ftz1b+rx3+FeLCm3NlsbWgwIg7ULG4cjIgHIiplH4qIh1usv36RZPX4p3CrxX/ZknT892K2trVy/JeP/mKwmOX2V+LvTy5Ml6ZORsR9EXEi+nen+dE16vjh5d8+b3ZsqGb8l25p/flYMGvHrb66G3ST43PjW4m51u2PIw73NYo/WVoJSCLiUEQcPra5Oqaf/uZos2Prx7+GNqwzlb+OeKp6/heiLv5csvb65Mj/ojR1ciS/Klb75dcbbzSrv9X4D3y5PGdrh/T87214/S/FP1gu1qzXzrZex40/Pms6p9ns9b8reauS3pXt+2B8bu7qaMSu5LVs/9nl/WPLr83zefk0/hPHG/f/+2P5nTgSEelF/EhEPBoRx7K2PxYRj0fE8TXi/+mlJ97dfPydlcY/uc75T2rX6zeRKF768bsVlQ62En96/k9XUieyPRv5/NtoA7f6/gEAAMB/QaHy2/+kMLyULhSGh6u/lz8Yewulmdm5Zy7MvH9lsvqMwGD0F/I7XQM190NHs2l9nh+ry5/K7ht/UdxTyQ9PzJQmux089Lh9Tfp/6s9it1sHdJzntaB36f/Qu/R/6F36P/SsRs//79lAGWAHaPT9/1EX2gHce8b/0Lta7f/VyYEpAewEvv+hd+n/0JO28lx/JxP5+sN2ac+KRLm8Xpm+7dLUziWisC2aIdGhRJc/mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANrk3wAAAP//+TvoKw==") r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), 0xffffffffffffffff) r5 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f00)={&(0x7f0000000ec0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000001400000408001d00", @ANYRES32=r5, @ANYBLOB="0800010000000000"], 0x24}}, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x24000080) r6 = socket(0x10, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000240)={r0}, 0x4) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', 0x0, 0x0, 0xff, 0x8, 0x7, 0x0, @dev, @private1, 0x0, 0x1, 0xfffffffe}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r8 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x8, 0x3, 0x460, 0xf0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x390, 0xffffffff, 0xffffffff, 0x390, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x2f, 0x0, 0x3}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@local, 'nicvf0\x00', {0x3f66}}}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3d}}, [0xffffffff], [], 'wg1\x00', 'gre0\x00', {}, {0xff}}, 0x0, 0x258, 0x2a0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x563e4515, 0x0, 0x7, 0x3fc, 0x20}}}, @common=@inet=@hashlimit3={{0x158}, {'veth0_vlan\x00', {0x3, 0x0, 0x48, 0x0, 0x15ab, 0x1000, 0x6, 0x5}}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x2, 0x5, {0x6}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4c0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f00000001c0)='kmem_cache_free\x00', r7, 0x0, 0x7}, 0x18) r9 = syz_open_dev$sg(&(0x7f0000000180), 0x0, 0x2000) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x56) ioctl$SG_GET_VERSION_NUM(r9, 0x2284, &(0x7f0000000080)) 107.527598ms ago: executing program 0 (id=1): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101c02, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) write$ppp(r0, &(0x7f0000000200)="7489", 0x2) 68.172889ms ago: executing program 3 (id=15): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae58e99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472ad529cefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc979ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa09acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b183940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000280)="61df718305a35997984d4763fcac", 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000580)=ANY=[@ANYBLOB="cf599d3baed500000000000086dd60f20000004c2c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa00060008"], 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa88000007"], 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000280)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000740)=ANY=[@ANYBLOB="180000000000000000008049369c2f00181100102c9dda7cac82", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @void, @value}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3}, 0x18) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r1, 0x40049366, &(0x7f00000004c0)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x10, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="91102d0000000000956088fe00000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1, @void, @value}, 0x94) r5 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x102004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r6}, &(0x7f0000000180), &(0x7f00000001c0)=r5}, 0x20) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='hrtimer_start\x00', r7}, 0x3d) sendmsg$AUDIT_TTY_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x3f8, 0x10, 0x70bd27, 0x25dfdbfd, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x840}, 0x240c0041) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000400)='io_uring_create\x00', r9}, 0x18) io_uring_setup(0x1de0, &(0x7f00000000c0)={0x0, 0x45d6}) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1001ff, 0x2804, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1f}, 0x80, 0x0, 0x80, 0x9, 0x200, 0xffffffff, 0x2}, 0x0, 0xbfffffffffffffff, r4, 0x0) 0s ago: executing program 0 (id=16): creat(&(0x7f0000000040)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) lsetxattr$security_selinux(0x0, 0x0, &(0x7f0000000000)='system_u:object_r:net_conf_t:s0\x00', 0x20, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xf, 0xc, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$selinux_user(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$selinux_user(r0, 0x0, 0x27) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r1, 0x0, 0x8}, 0x18) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_msfilter(r2, 0x0, 0x29, 0x0, 0x57) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r5, 0xffffffffffffffff}, 0x0, &(0x7f0000000140)=r4}, 0x20) memfd_secret(0x80000) syz_usb_disconnect(0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) syz_emit_ethernet(0x2e, &(0x7f0000000180)={@broadcast, @dev, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @empty}, {0x0, 0x8100, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000480)='cgroup.threads\x00', 0x2, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) socket$inet(0x2, 0x1, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000077a0d98d00000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000100000085000000030000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r3}, 0x10) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.42' (ED25519) to the list of known hosts. [ 25.403856][ T29] audit: type=1400 audit(1749553094.335:62): avc: denied { mounton } for pid=3297 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.404606][ T3297] cgroup: Unknown subsys name 'net' [ 25.426577][ T29] audit: type=1400 audit(1749553094.335:63): avc: denied { mount } for pid=3297 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.453972][ T29] audit: type=1400 audit(1749553094.365:64): avc: denied { unmount } for pid=3297 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.630102][ T3297] cgroup: Unknown subsys name 'cpuset' [ 25.636120][ T3297] cgroup: Unknown subsys name 'rlimit' [ 25.814900][ T29] audit: type=1400 audit(1749553094.745:65): avc: denied { setattr } for pid=3297 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.840955][ T29] audit: type=1400 audit(1749553094.745:66): avc: denied { create } for pid=3297 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.861440][ T29] audit: type=1400 audit(1749553094.745:67): avc: denied { write } for pid=3297 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.881939][ T29] audit: type=1400 audit(1749553094.745:68): avc: denied { read } for pid=3297 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.902232][ T29] audit: type=1400 audit(1749553094.745:69): avc: denied { mounton } for pid=3297 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.910156][ T3301] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.927205][ T29] audit: type=1400 audit(1749553094.745:70): avc: denied { mount } for pid=3297 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.959354][ T29] audit: type=1400 audit(1749553094.875:71): avc: denied { relabelto } for pid=3301 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.996738][ T3297] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.246191][ T3309] chnl_net:caif_netlink_parms(): no params data found [ 27.276346][ T3312] chnl_net:caif_netlink_parms(): no params data found [ 27.320482][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 27.370498][ T3315] chnl_net:caif_netlink_parms(): no params data found [ 27.385938][ T3312] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.393067][ T3312] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.400293][ T3312] bridge_slave_0: entered allmulticast mode [ 27.406578][ T3312] bridge_slave_0: entered promiscuous mode [ 27.419360][ T3309] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.426531][ T3309] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.433851][ T3309] bridge_slave_0: entered allmulticast mode [ 27.440274][ T3309] bridge_slave_0: entered promiscuous mode [ 27.448599][ T3309] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.455748][ T3309] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.462935][ T3309] bridge_slave_1: entered allmulticast mode [ 27.469240][ T3309] bridge_slave_1: entered promiscuous mode [ 27.477990][ T3312] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.485101][ T3312] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.492293][ T3312] bridge_slave_1: entered allmulticast mode [ 27.498846][ T3312] bridge_slave_1: entered promiscuous mode [ 27.512104][ T3313] chnl_net:caif_netlink_parms(): no params data found [ 27.552225][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.559318][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.566489][ T3307] bridge_slave_0: entered allmulticast mode [ 27.572893][ T3307] bridge_slave_0: entered promiscuous mode [ 27.580339][ T3312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.589413][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.596500][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.603613][ T3307] bridge_slave_1: entered allmulticast mode [ 27.610275][ T3307] bridge_slave_1: entered promiscuous mode [ 27.624582][ T3309] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.642965][ T3312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.657271][ T3309] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.672181][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.682030][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.715182][ T3315] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.722303][ T3315] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.729820][ T3315] bridge_slave_0: entered allmulticast mode [ 27.736281][ T3315] bridge_slave_0: entered promiscuous mode [ 27.751641][ T3309] team0: Port device team_slave_0 added [ 27.766930][ T3315] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.774135][ T3315] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.781405][ T3315] bridge_slave_1: entered allmulticast mode [ 27.787783][ T3315] bridge_slave_1: entered promiscuous mode [ 27.794561][ T3312] team0: Port device team_slave_0 added [ 27.801442][ T3312] team0: Port device team_slave_1 added [ 27.807741][ T3309] team0: Port device team_slave_1 added [ 27.822638][ T3307] team0: Port device team_slave_0 added [ 27.828310][ T3313] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.835617][ T3313] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.842732][ T3313] bridge_slave_0: entered allmulticast mode [ 27.849299][ T3313] bridge_slave_0: entered promiscuous mode [ 27.873484][ T3307] team0: Port device team_slave_1 added [ 27.879135][ T3313] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.886217][ T3313] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.893423][ T3313] bridge_slave_1: entered allmulticast mode [ 27.899785][ T3313] bridge_slave_1: entered promiscuous mode [ 27.907087][ T3315] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.921106][ T3309] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.928049][ T3309] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 27.954108][ T3309] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.978636][ T3315] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.988041][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.995077][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.020984][ T3312] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.032038][ T3309] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.039049][ T3309] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.064970][ T3309] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.075982][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.083051][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.109137][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.120229][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.127192][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.153240][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.173203][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.180208][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.206259][ T3312] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.225819][ T3313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.240033][ T3315] team0: Port device team_slave_0 added [ 28.246984][ T3315] team0: Port device team_slave_1 added [ 28.254733][ T3313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.312405][ T3313] team0: Port device team_slave_0 added [ 28.320294][ T3312] hsr_slave_0: entered promiscuous mode [ 28.326326][ T3312] hsr_slave_1: entered promiscuous mode [ 28.334462][ T3309] hsr_slave_0: entered promiscuous mode [ 28.340317][ T3309] hsr_slave_1: entered promiscuous mode [ 28.346124][ T3309] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.353709][ T3309] Cannot create hsr debugfs directory [ 28.359435][ T3315] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.366545][ T3315] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.392554][ T3315] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.405388][ T3307] hsr_slave_0: entered promiscuous mode [ 28.411454][ T3307] hsr_slave_1: entered promiscuous mode [ 28.417180][ T3307] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.424848][ T3307] Cannot create hsr debugfs directory [ 28.430869][ T3313] team0: Port device team_slave_1 added [ 28.437821][ T3315] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.444798][ T3315] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.470842][ T3315] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.516532][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.523901][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.550042][ T3313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.578499][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.585647][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 28.611571][ T3313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.630968][ T3315] hsr_slave_0: entered promiscuous mode [ 28.636805][ T3315] hsr_slave_1: entered promiscuous mode [ 28.642650][ T3315] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.650349][ T3315] Cannot create hsr debugfs directory [ 28.700064][ T3313] hsr_slave_0: entered promiscuous mode [ 28.706046][ T3313] hsr_slave_1: entered promiscuous mode [ 28.711873][ T3313] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 28.719480][ T3313] Cannot create hsr debugfs directory [ 28.843695][ T3307] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 28.852903][ T3307] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 28.869670][ T3307] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 28.880396][ T3307] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 28.896837][ T3309] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 28.906962][ T3309] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 28.917525][ T3309] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 28.925793][ T3309] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 28.957150][ T3312] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 28.968311][ T3312] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 28.977013][ T3312] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 28.985886][ T3312] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 29.032333][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.048135][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.056213][ T3313] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 29.064673][ T3313] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 29.082957][ T3313] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 29.091502][ T3313] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 29.109929][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.117072][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.136340][ T3312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.148204][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.155846][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.167459][ T3315] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 29.176647][ T3315] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 29.190215][ T3315] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 29.198687][ T3315] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 29.210401][ T3309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.218594][ T3312] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.232539][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.239613][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.260098][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.267170][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.307665][ T3309] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.331034][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.338288][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.350625][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.357734][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.375880][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.403624][ T3313] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.419041][ T3315] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.430951][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.445357][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.452606][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.470408][ T3309] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 29.491084][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.498197][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.515966][ T3315] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.543600][ T1792] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.550813][ T1792] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.559355][ T1792] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.566451][ T1792] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.597108][ T3312] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.648385][ T3309] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.671821][ T3307] veth0_vlan: entered promiscuous mode [ 29.679227][ T3307] veth1_vlan: entered promiscuous mode [ 29.721213][ T3313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.733140][ T3307] veth0_macvtap: entered promiscuous mode [ 29.749996][ T3307] veth1_macvtap: entered promiscuous mode [ 29.786010][ T3315] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.804694][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.837085][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.851255][ T3312] veth0_vlan: entered promiscuous mode [ 29.859466][ T3307] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.868405][ T3307] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.877168][ T3307] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.886073][ T3307] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.898581][ T3312] veth1_vlan: entered promiscuous mode [ 29.923880][ T3312] veth0_macvtap: entered promiscuous mode [ 29.937842][ T3313] veth0_vlan: entered promiscuous mode [ 29.951034][ T3312] veth1_macvtap: entered promiscuous mode [ 29.971603][ T3313] veth1_vlan: entered promiscuous mode [ 29.985449][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.998040][ T3315] veth0_vlan: entered promiscuous mode [ 30.015090][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.024938][ T3315] veth1_vlan: entered promiscuous mode [ 30.037070][ T3307] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.040174][ T3313] veth0_macvtap: entered promiscuous mode [ 30.062730][ T3313] veth1_macvtap: entered promiscuous mode [ 30.069479][ T3312] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.078525][ T3312] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.087572][ T3312] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.096650][ T3312] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.112060][ T3309] veth0_vlan: entered promiscuous mode [ 30.127472][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.144814][ T3315] veth0_macvtap: entered promiscuous mode [ 30.158524][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.166810][ T3315] veth1_macvtap: entered promiscuous mode [ 30.184729][ T3313] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.193646][ T3313] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.202513][ T3313] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.211292][ T3313] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.221899][ T3309] veth1_vlan: entered promiscuous mode [ 30.248109][ T3309] veth0_macvtap: entered promiscuous mode [ 30.262070][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.287151][ T3485] loop3: detected capacity change from 0 to 256 [ 30.290650][ T3309] veth1_macvtap: entered promiscuous mode [ 30.309267][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.335229][ T3309] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.343309][ T3315] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.352171][ T3315] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.361039][ T3315] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.369967][ T3315] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.380740][ T3491] xt_connbytes: Forcing CT accounting to be enabled [ 30.387624][ T3491] Cannot find set identified by id 0 to match [ 30.403954][ T3309] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.416162][ T29] kauditd_printk_skb: 46 callbacks suppressed [ 30.416180][ T29] audit: type=1400 audit(1749553099.345:118): avc: denied { map_read map_write } for pid=3492 comm="syz.2.3" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 30.425109][ T3309] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.451197][ T3309] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.460126][ T3309] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.468841][ T3309] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.478016][ T3490] loop1: detected capacity change from 0 to 512 [ 30.487501][ T3490] EXT4-fs: inline encryption not supported [ 30.502348][ T29] audit: type=1400 audit(1749553099.385:119): avc: denied { setopt } for pid=3484 comm="syz.3.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 30.521579][ T29] audit: type=1400 audit(1749553099.385:120): avc: denied { create } for pid=3484 comm="syz.3.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.541895][ T29] audit: type=1400 audit(1749553099.385:121): avc: denied { write } for pid=3484 comm="syz.3.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.562352][ T29] audit: type=1400 audit(1749553099.385:122): avc: denied { read } for pid=3484 comm="syz.3.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.582630][ T29] audit: type=1400 audit(1749553099.385:123): avc: denied { mounton } for pid=3484 comm="syz.3.8" path="/1/file1/file0" dev="loop3" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=file permissive=1 [ 30.607663][ T29] audit: type=1326 audit(1749553099.395:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3489 comm="syz.1.10" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f78df86e929 code=0x7ffc0000 [ 30.631101][ T29] audit: type=1326 audit(1749553099.395:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3489 comm="syz.1.10" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f78df86e929 code=0x7ffc0000 [ 30.648756][ T3498] loop2: detected capacity change from 0 to 1024 [ 30.654392][ T29] audit: type=1326 audit(1749553099.395:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3489 comm="syz.1.10" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f78df86e929 code=0x7ffc0000 [ 30.654430][ T29] audit: type=1326 audit(1749553099.395:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3489 comm="syz.1.10" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f78df86e929 code=0x7ffc0000 [ 30.685071][ T3490] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 30.711912][ T3498] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 30.735209][ T3490] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 30.762212][ T3498] netlink: 2 bytes leftover after parsing attributes in process `syz.2.12'. [ 30.797470][ T3506] netlink: 'syz.3.13': attribute type 11 has an invalid length. [ 30.907076][ T3490] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.10: corrupted inode contents [ 30.932802][ T3517] loop4: detected capacity change from 0 to 512 [ 30.956121][ C1] hrtimer: interrupt took 34983 ns [ 30.962833][ T3517] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 30.976939][ T3490] EXT4-fs error (device loop1): ext4_dirty_inode:6459: inode #2: comm syz.1.10: mark_inode_dirty error [ 31.001272][ T3517] EXT4-fs (loop4): orphan cleanup on readonly fs [ 31.014885][ T3517] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.5: bg 0: block 131: padding at end of block bitmap is not set [ 31.039235][ T3490] EXT4-fs error (device loop1): ext4_do_update_inode:5568: inode #2: comm syz.1.10: corrupted inode contents [ 31.075559][ T3517] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6548: Corrupt filesystem [ 31.087660][ T3490] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #2: comm syz.1.10: mark_inode_dirty error [ 31.101959][ T3517] EXT4-fs (loop4): 1 truncate cleaned up [ 31.105757][ T3490] capability: warning: `syz.1.10' uses 32-bit capabilities (legacy support in use) [ 31.130479][ T3517] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 31.144873][ T3490] syz.1.10 (3490) used greatest stack depth: 10920 bytes left [ 31.164149][ T3498] ================================================================== [ 31.172285][ T3498] BUG: KCSAN: data-race in filemap_splice_read / filemap_splice_read [ 31.180429][ T3498] [ 31.182775][ T3498] write to 0xffff888117e13828 of 8 bytes by task 3508 on cpu 0: [ 31.190443][ T3498] filemap_splice_read+0x47e/0x6b0 [ 31.195604][ T3498] ext4_file_splice_read+0x8f/0xb0 [ 31.200746][ T3498] splice_direct_to_actor+0x26c/0x680 [ 31.206146][ T3498] do_splice_direct+0xda/0x150 [ 31.210949][ T3498] do_sendfile+0x380/0x650 [ 31.215399][ T3498] __x64_sys_sendfile64+0x105/0x150 [ 31.220628][ T3498] x64_sys_call+0xb39/0x2fb0 [ 31.225235][ T3498] do_syscall_64+0xd2/0x200 [ 31.229765][ T3498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 31.235777][ T3498] [ 31.238115][ T3498] write to 0xffff888117e13828 of 8 bytes by task 3498 on cpu 1: [ 31.245778][ T3498] filemap_splice_read+0x47e/0x6b0 [ 31.250931][ T3498] ext4_file_splice_read+0x8f/0xb0 [ 31.256072][ T3498] splice_direct_to_actor+0x26c/0x680 [ 31.261487][ T3498] do_splice_direct+0xda/0x150 [ 31.266286][ T3498] do_sendfile+0x380/0x650 [ 31.270720][ T3498] __x64_sys_sendfile64+0x105/0x150 [ 31.275932][ T3498] x64_sys_call+0xb39/0x2fb0 [ 31.280540][ T3498] do_syscall_64+0xd2/0x200 [ 31.285059][ T3498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 31.290964][ T3498] [ 31.293290][ T3498] value changed: 0x000000000002292f -> 0x0000000000022950 [ 31.300408][ T3498] [ 31.302736][ T3498] Reported by Kernel Concurrency Sanitizer on: [ 31.308889][ T3498] CPU: 1 UID: 0 PID: 3498 Comm: syz.2.12 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(voluntary) [ 31.321142][ T3498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 31.331206][ T3498] ================================================================== [ 31.369150][ T3307] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.498836][ T3522] xt_hashlimit: size too large, truncated to 1048576 [ 31.514518][ T3508] syz.2.12 (3508) used greatest stack depth: 10784 bytes left [ 31.535663][ T3313] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 31.554381][ T3512] sd 0:0:1:0: device reset [ 31.631245][ T3309] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.