last executing test programs: 1m50.021607246s ago: executing program 32 (id=1899): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000004c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0xb0c9fa2cdd4cf720}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) unshare(0x8000000) semget$private(0x0, 0x4000, 0x555) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) semtimedop(0x0, &(0x7f0000000040)=[{0x3, 0x8, 0x1800}], 0x1, 0x0) unshare(0x2c040000) 1m0.809616631s ago: executing program 1 (id=2981): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000580)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x57, 0x7fc00100}]}) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000740)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r1, 0xc0182101, &(0x7f00000000c0)={r2}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f00000003c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000080)={r3, 0x3, r0, 0x5}) mount$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, 0x0, 0x0) 1m0.209559226s ago: executing program 4 (id=2989): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r2}, 0x10) r3 = socket$unix(0x1, 0x1, 0x0) connect$unix(r3, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 1m0.166109688s ago: executing program 4 (id=2990): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000ffffffdd850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000008850000007600000095"], &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe468}, 0x94) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=@newtaction={0x64, 0x30, 0xffffffffffffffff, 0x0, 0x0, {}, [{0x50, 0x1, [@m_bpf={0x4c, 0x1, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1, 0x0, 0x6, 0x0, 0x4}}, @TCA_ACT_BPF_FD={0x8, 0x5, r3}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[], 0x7c}, 0x1, 0x2000000, 0x0, 0xa25bb844b084a7a1}, 0x0) 1m0.13964006s ago: executing program 0 (id=2991): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000fa540000850000008200000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x18) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000040)=@gcm_128={{0x304}, "db748d6b120426ad", "4fe429faa1e90c473725b5e429ac42fa", "917e060b", "92816af8b4efb2ad"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x304}, "a6341a1a379332f5", "1fd33c81cf7995313c09de00fd6ded74", "62266bd8", "1e00040000000100"}, 0x28) 1m0.13896861s ago: executing program 4 (id=2992): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x16, 0x0, 0x4, 0x800, 0x0, 0x1, 0x5}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='br_fdb_add\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000001c000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB="4000aa000a0002"], 0x28}, 0x1, 0x0, 0x0, 0x44800}, 0x8000) 1m0.13263662s ago: executing program 0 (id=2993): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000fa540000850000008200000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x18) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x88002, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="090240000000000000010100000008000600ac"], 0x34}, 0x1, 0x0, 0x0, 0x4008080}, 0x10) 1m0.111934731s ago: executing program 4 (id=2994): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xa4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000800)="cc5a4dbac0affd0a979c63ea8352d608a51fc8625318716ddf62b7752be4540c4ac7d344c53a3ad28313abc2437b60b03c0e587cafcf9a435bf90c618351f70a828238fdf90bc5d36c7d614b82552649954e0185662defd28f78449f073bad544f586136c5076a6f0f1b6fc9adf80557eb44db1b41824e9ef104c95e999766bbf27d74ad5d8fa63210cde65d384dd3e87c1fedaec3144d1ee66a0eb0750363e346cb930dae6109df6b9955bf8af119b5c9a86622af4ff8b5949fb90f8edbde416d046d61512fe4c453bb601a780e1bbc00dbedc5e50d3cd9bc920810eaefd5f9a171e9d32ab46b42e3e78c60087318bab42e94653cbdd600fba37c5a31d095500e91d02256f101e82447e34733220cdaaabc947f5b815080b5214c94a06fe96450ea42f48006c032b24d9e8d722841b7c7244b1d2cc012fcda1f7472fdbabb673ef862e32b359fad715b3f5cef6ef951abab80a4a0f5f8574395c5820fa25d", 0x15f}], 0x1}}, {{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000540)="6f433f8987fc9e72c982b56a37a1c7b7ab31e2f6b098f57a62f9d8a98a9d4f", 0x1f}, {&(0x7f0000002240)="6e2ebb87dca38cb8b3378e86c02cafa0bd62c7a2cddda54f6a0a1c1b92bae9731f4063d80b5110c9d03f91a7a36de1b85a723f5902e290250ad0f1ba3a09733260816749c0336324bd84b178c88fa2d67602e2444a7e61aa569282cd7ce83e6c2faa97a4f99d042e50e79936490023788174b7af0c760ea8723eed6912bd85156d534474c9e5629951d6e4287bd996f0f801217b1567d0a160a44f5c122d4512a0c8cde478f738110e77ae94c9add0b05940b71bfecd3f0a7caa562d694634388ee577c44c873818cd358c9ce80ca10c5292a03540a6350546bfe7f8b54f57db5f2a969f2624f588643e2ad9be66d45d45354c164bb186522bf2130f43c84ad5d56f74afd23a06362f2b30dcc2ac95c3b5264aaccf66d52fc57615449e5362c1c6aea5d903a198742c9c8507ddb0cab935043afdb803d0d9ce631a557e82bbc1c1409723e5c975d85c867aec479700b5ef4933ede52c51d9b545b162820c875a0200a984f2c54ccc84b967885aa5b6c57838818ddef4e29ce05fb9ca801652e1cdc36dd9111bdcdd4ddd900744c3d2c781aa533bf9cb3b4ad57f3d3c83dafbff9a52c5b369cede1782bbd3b4a7389f8edfcb92e83c07d37baba4a7c7258c7bfa98a3381adc7c035a088077e2e6774a34504731c8241e2c4f62d9de9a3dc73c04e7a9acd50af380a843e81f0eb8cf6b7a330b8359211d452995bb479fde09832416b2d9a8b1692815e0a3bc96b80ebcc58da391da464318f46877449d9fc72ccb9e3e19db900a9d84d9d8fe217f9bdbf0bffa7753953e6f53a261fe12697b6f3a203b53defbcb3b71c9e4ee2fd0dcdb339c51279e0099571ad3edd9e6d0f4ca6fe4abd10f9171e4051143cb718e31ad44bdc9a276629814b7d6a1d4f9434319d605dc108cdfefbdb2db72075d3861cfad540c1c6fbca241e6ae3f97ca10b7f53349e8f4136e5deff9cf86f806cb26b172027c971031cb7935aa0489509ce6a4cf38776f8c864135246245dbf0c84805fd6e4f534491ea247599f5e98aa06b8cb88894bbfaad86b87e2547015a74d4b735060925c23ddb95e14c9245313cfde10c4300f0fc505a2e53a0444f104daeb9dd64ceced775", 0x315}], 0x2}}], 0x2, 0x2090) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000b00)=""/4096, 0x1000, 0x1, 0x0}, &(0x7f0000000180)=0x40) sendto$inet(r0, &(0x7f0000000580)="04", 0x1, 0x10008095, 0x0, 0x0) 1m0.066112973s ago: executing program 0 (id=2995): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x10) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x2042, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200000008000300ac1414aa0800060001"], 0x38}, 0x1, 0x0, 0x0, 0x4000011}, 0x4c080) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="010028bd7000fcdbdf2504"], 0x14}}, 0x0) 1m0.065760723s ago: executing program 0 (id=2996): r0 = getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r2, 0x0, 0x0, 0x40448c0) shutdown(r2, 0x1) 59.949668628s ago: executing program 1 (id=3000): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2, 0x4}, 0x10) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000008da4b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0xf) r3 = dup3(r1, r0, 0x0) recvmmsg(r3, &(0x7f0000008840)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000040)=""/8, 0x8}], 0x1}, 0xffffffff}], 0x1, 0x40000001, 0x0) 59.853030152s ago: executing program 1 (id=3001): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8d}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1, 0x0, 0x1}, 0x18) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0xff, 0x0, 0x7fff0026}]}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, 0x0, 0x0, 0x16, 0x0, "0af5a212a1bd3bbda613efd9c8b4965dca66db42f66a86e5781cf86717055a7c1d1408407e5a774ef95f2fc1b947e00f000000123f2f1d34b0882e83d41b67cb9ff147c6d33a097d2269351b3ed300"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3d}}}, 0x0, 0x0, 0x11, 0x0, "a1c1dd75a68473ba07d945c3b03e10950cd4b347113e55eb4285bf274bca67efbff2fdf98328de9434031348589bf28046d14810000000e3ffffff00"}, 0xd8) close_range(r2, 0xffffffffffffffff, 0x0) 59.770507726s ago: executing program 1 (id=3003): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffbfff, 0x1, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000810018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='task_newtask\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='task_newtask\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r0}, &(0x7f0000000000), &(0x7f0000000180)}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) 59.769882526s ago: executing program 1 (id=3004): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000340)='kfree\x00', r0, 0x0, 0x328}, 0x18) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000006c0)={0x1, &(0x7f0000000500)=[{0x6, 0x43, 0x0, 0x8a5c}]}) bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=ANY=[@ANYBLOB="0500000004000000080000000b"], 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000002000000000a3c000000120a01080000000000000000020000000900020073797a2a0000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x4001}, 0x8014) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x74}}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 59.264529278s ago: executing program 4 (id=3007): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mlockall(0x7) 59.22378651s ago: executing program 0 (id=3008): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000080850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x52) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='kmem_cache_free\x00', r0}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) pivot_root(0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x2004c000) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newtfilter={0x24, 0x11, 0x1, 0x691522eb, 0x0, {0x0, 0x0, 0x74, r2, {0x10, 0x4}, {}, {0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x4000010) 58.976455341s ago: executing program 4 (id=3009): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xa, 0x7fffffffffffffff}, 0x101489, 0x0, 0x10000000, 0x0, 0x0, 0x20, 0xfffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x8a, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x4108, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xb, 0x2, 0x0, 0x0, 0x0, 0x0, 0x20029, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xf}, 0x105d30, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_pressure(0xffffffffffffffff, 0x0, 0x2, 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="620ac4ff00000000711046000000000095"], &(0x7f0000000100)='GPL\x00'}, 0x94) 58.97612427s ago: executing program 33 (id=3009): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xa, 0x7fffffffffffffff}, 0x101489, 0x0, 0x10000000, 0x0, 0x0, 0x20, 0xfffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x8a, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x4108, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xb, 0x2, 0x0, 0x0, 0x0, 0x0, 0x20029, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xf}, 0x105d30, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_pressure(0xffffffffffffffff, 0x0, 0x2, 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="620ac4ff00000000711046000000000095"], &(0x7f0000000100)='GPL\x00'}, 0x94) 58.946210682s ago: executing program 0 (id=3011): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='qdisc_create\x00', r3}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='qdisc_create\x00', r4}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) 58.945888152s ago: executing program 34 (id=3011): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='qdisc_create\x00', r3}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='qdisc_create\x00', r4}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) 57.940013415s ago: executing program 1 (id=3012): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="18010000008000000000000000000004850000006d00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='initcall_level\x00', r0, 0x0, 0x38000000000}, 0x18) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='kfree\x00', r3, 0x0, 0x10000001}, 0x18) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x80000001}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_read_part_table(0x5be, &(0x7f00000005c0)="$eJzs2z9o02kYB/AnahAUzsXJ4bAOTi6KoxmsJFFRCNEu4qCgiJgpghAhINihzdDSDKVjl1LI0j9T0wwdjpYWOpfSoUehQ6ejXQpdmuOu7+3t9Q8Inw/8ePK+7zd58gy/8Q1+aZfir263m4mI7tWTf7uvlS88u116XH4dkYm3EdHzx28z/5xkUuK/X72T1ptpPTF+rTO49zTb2ni1f/fdYuNSOv+RnuuT7b5TD8e5m8ot3fjZXy0O1XKf14v17YG11ZfTu/ly+0WjOfM8++RDyi2neiXVr1GL7/El3kclKvExqmfUf6y1df/wVrE19+nRQaEzvPAg5UqnnPO4/b/1jLxp1nvvzd4cfVibXynvXD7KVf7H2wUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMWbyi3d+NlfLQ7Vcp/Xi/XtgbXVl9O7+XL7RaM58zz75EPKLad6JdWvUYvv8SXeRyUq8TGqZ9R/rLV1//BWsTX36dFBoTO88CDlSqec87j9v/WMvGnWe+/N3hx9WJtfKe9cPspVrp7THwAAAAAAAAAAAAAAAAAAAICIyBee3S49Lr+OyMTbiGj/3vvvVf9uuu+eSbk76cNm2p8Yv9YZ3HuabW282r/7brHxZ9r/kZ7rk+2+i5+Gk/o7AAD//5Yblcc=") 57.938771235s ago: executing program 35 (id=3012): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="18010000008000000000000000000004850000006d00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='initcall_level\x00', r0, 0x0, 0x38000000000}, 0x18) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='kfree\x00', r3, 0x0, 0x10000001}, 0x18) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x80000001}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_read_part_table(0x5be, &(0x7f00000005c0)="$eJzs2z9o02kYB/AnahAUzsXJ4bAOTi6KoxmsJFFRCNEu4qCgiJgpghAhINihzdDSDKVjl1LI0j9T0wwdjpYWOpfSoUehQ6ejXQpdmuOu7+3t9Q8Inw/8ePK+7zd58gy/8Q1+aZfir263m4mI7tWTf7uvlS88u116XH4dkYm3EdHzx28z/5xkUuK/X72T1ptpPTF+rTO49zTb2ni1f/fdYuNSOv+RnuuT7b5TD8e5m8ot3fjZXy0O1XKf14v17YG11ZfTu/ly+0WjOfM8++RDyi2neiXVr1GL7/El3kclKvExqmfUf6y1df/wVrE19+nRQaEzvPAg5UqnnPO4/b/1jLxp1nvvzd4cfVibXynvXD7KVf7H2wUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMWbyi3d+NlfLQ7Vcp/Xi/XtgbXVl9O7+XL7RaM58zz75EPKLad6JdWvUYvv8SXeRyUq8TGqZ9R/rLV1//BWsTX36dFBoTO88CDlSqec87j9v/WMvGnWe+/N3hx9WJtfKe9cPspVrp7THwAAAAAAAAAAAAAAAAAAAICIyBee3S49Lr+OyMTbiGj/3vvvVf9uuu+eSbk76cNm2p8Yv9YZ3HuabW282r/7brHxZ9r/kZ7rk+2+i5+Gk/o7AAD//5Yblcc=") 29.637286319s ago: executing program 5 (id=3606): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x7, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000001000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f00000006c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000340)={0x0, 0xb16, 0x80, 0xfffffffe, 0x1f9}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r2, 0x0, &(0x7f0000000040)='./file0\x00', 0x64, 0x183000, 0x12345}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) io_uring_enter(r2, 0x47f6, 0x0, 0x0, 0x0, 0x0) 29.235978196s ago: executing program 5 (id=3619): mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xffff, 0xb7, @loopback}, 0x1c) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f02, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000280)='kfree\x00', r1, 0x0, 0x1075}, 0x18) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000080)=@gcm_128={{0x303}, "ba28597967d1b54c", "9712b0d86846b5ecc522bc6f13a6e30c", "ea0292da", "9e87dc79f4c04982"}, 0x28) close(r0) 29.121317251s ago: executing program 5 (id=3634): bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1000, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_config_ext={0xfffffffffffffffc, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 28.984329467s ago: executing program 5 (id=3625): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x23e9c9e, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x28a5291, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file0/file0\x00', 0x500, 0x40) open_tree(r0, &(0x7f0000000300)='\x00', 0x89901) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='tracefs\x00', 0x800000, 0x0) 28.977478787s ago: executing program 5 (id=3627): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) 28.355745495s ago: executing program 5 (id=3647): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r0}, &(0x7f0000000200), &(0x7f0000000240)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x10) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) listen(0xffffffffffffffff, 0x722) alarm(0x9) 28.325810986s ago: executing program 36 (id=3647): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r0}, &(0x7f0000000200), &(0x7f0000000240)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x10) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) listen(0xffffffffffffffff, 0x722) alarm(0x9) 23.200895849s ago: executing program 8 (id=3756): socket$netlink(0x10, 0x3, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xcd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000100)='!~u&\t0|\t\t') bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x1d, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) io_pgetevents(0x0, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)={[0xe]}, 0x8}) 23.138401272s ago: executing program 8 (id=3758): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = add_key$keyring(&(0x7f0000000080), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r3) keyctl$KEYCTL_MOVE(0x1e, r3, r3, r4, 0x0) 23.103498344s ago: executing program 8 (id=3761): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0xfffc}, 0x4000800) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000003080)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000940)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x3f00, {0x0, 0x0, 0x0, r4}}, 0x24}}, 0x0) 23.011337428s ago: executing program 8 (id=3764): syz_emit_ethernet(0x3e, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)={0x0, 0xdffffffe, 0x87d, 0xffffffff, 0x5, "8100e1c8e80b598c36ff000800"}) r1 = syz_open_pts(r0, 0x141601) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r3}, 0x10) readv(0xffffffffffffffff, 0x0, 0x0) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TCFLSH(r0, 0x540b, 0x2) 22.130716296s ago: executing program 8 (id=3786): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x2c020400) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) io_setup(0x4, &(0x7f00000014c0)=0x0) r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='mounts\x00') io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0xfffe, r1, 0x0}]) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) 22.009406861s ago: executing program 8 (id=3788): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x10, 0x4, 0x8, 0x8}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000003000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10208}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000180), &(0x7f00000001c0)=r2}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r4}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xe, 0x0, &(0x7f00000003c0)="7993ff01190000e5ffa53b00008f", 0x0, 0x400, 0x503, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff80fe}, 0x59) 6.963941247s ago: executing program 37 (id=3788): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x10, 0x4, 0x8, 0x8}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000003000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10208}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000180), &(0x7f00000001c0)=r2}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r4}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xe, 0x0, &(0x7f00000003c0)="7993ff01190000e5ffa53b00008f", 0x0, 0x400, 0x503, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff80fe}, 0x59) 3.384889473s ago: executing program 7 (id=4152): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r0}, &(0x7f0000000000), &(0x7f00000005c0)=r1}, 0x20) socketpair$tipc(0x1e, 0x4, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r3, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000005c0)='kfree_skb\x00', r4}, 0x18) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='kfree_skb\x00', r5}, 0x10) close(r2) 3.310726716s ago: executing program 7 (id=4156): r0 = socket(0x10, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000480)=@gcm_256={{0x303}, "000200", "e123c5876ff425b1ebe250a8486be34705f4f827ae60ecb65e528248d5552bff", "7e25837b", "15d0db2c77179e1a"}, 0x38) write$binfmt_script(r1, &(0x7f0000000500)={'#! ', './file0'}, 0xb) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000007200000095"], &(0x7f0000001480)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000380)='kfree\x00', r2, 0x0, 0x4804}, 0x18) close_range(r0, r1, 0x0) 3.274002638s ago: executing program 7 (id=4158): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000130000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000280), &(0x7f00000002c0)=r1}, 0x20) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000001100)=@req3={0x8000, 0x200, 0x80, 0x20000}, 0x1c) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r3}, 0x10) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) 2.98510885s ago: executing program 7 (id=4168): r0 = socket$netlink(0x10, 0x3, 0xf) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000008da4b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x18) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) r2 = getpid() r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r3) sendmsg$DEVLINK_CMD_RELOAD(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r4, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r2}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0xb0) 2.603853417s ago: executing program 7 (id=4175): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r2 = accept(r0, 0x0, 0x0) setsockopt$sock_timeval(r2, 0x1, 0x42, &(0x7f0000000300)={0x0, 0xea60}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x12, 0x4, 0x4, 0xa4}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000080), &(0x7f00000002c0)=@tcp=r2}, 0x20) recvmsg$can_bcm(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x2000) 2.500796912s ago: executing program 7 (id=4178): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x4, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='fib_table_lookup\x00', r4}, 0x10) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0x0, 0x1ffffff, {0x0, 0x0, 0x0, r1, {0x7, 0x9}, {0xd, 0xc}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) 2.020495713s ago: executing program 9 (id=4186): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r1, 0x0, r4, 0x0, 0xf, 0x8) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) tee(r3, r5, 0x4e, 0x0) 1.195533858s ago: executing program 9 (id=4207): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x80000, 0x0, 0x0, 0x41100}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) unshare(0x2c020400) r2 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x5885, 0x100, 0x0, 0xffeffc03}, &(0x7f0000000340)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_RENAMEAT={0x23, 0xc, 0x0, 0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', &(0x7f0000000500)='./file0\x00', 0xffffffffffffffff, 0x0, 0x1}) io_uring_enter(r2, 0x351e, 0x483, 0x0, 0x0, 0x0) 1.055927715s ago: executing program 9 (id=4211): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc4002}]}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x45, 0xf}]}) sendmsg$NL80211_CMD_DEL_PMKSA(r3, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000640)={0x64, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3, 0x69}}}}, [@NL80211_ATTR_SSID={0x1e, 0x34, @random="384c7ff547ca79b3ea4dac6b9cbbde1b240b14066b37687b350c"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x44}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xc0c}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x4000800) close_range(r2, 0xffffffffffffffff, 0x0) openat$cgroup_freezer_state(r0, &(0x7f0000000040), 0x2, 0x0) 755.807627ms ago: executing program 3 (id=4224): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000086"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000000000000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x100002, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='hrtimer_start\x00', r1}, 0x3d) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='hrtimer_start\x00', r2}, 0x3d) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) 671.446961ms ago: executing program 3 (id=4225): r0 = socket(0x10, 0x3, 0x0) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd0, &(0x7f0000000080)=0x6, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000040)={'syztnl1\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x2f, 0x5, 0x35, 0x9, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0={0xfc, 0x0, '\x00', 0x1}, 0x700, 0x80, 0x40, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000280)={'syztnl2\x00', &(0x7f0000000140)={'syztnl1\x00', r3, 0x4, 0x0, 0x40, 0x10, 0x4, @remote, @private2, 0x8040, 0x0, 0xfffffffa, 0x2}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newneigh={0x30, 0x1c, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, r4, 0x0, 0x1}, [@NDA_DST_MAC={0xa, 0x1, @link_local}, @NDA_FLAGS_EXT={0x8, 0xf, 0x1}]}, 0x30}}, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f0000000200)={{0x2, 0x0, @empty}, {0x0, @dev}, 0x12, {0x2, 0x0, @remote}, 'lo\x00'}) 670.779721ms ago: executing program 2 (id=4227): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='page_pool_release\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='page_pool_release\x00', r3}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r4, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000280)="b9ff03076804268c989e14f088a8", 0x0, 0x2, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 669.458521ms ago: executing program 2 (id=4229): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, 0x0, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41002, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$tun(0xffffffffffffff9c, 0x0, 0xa2f01, 0x0) dup(0xffffffffffffffff) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6c, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r0}, &(0x7f0000000400), &(0x7f00000003c0)=r1}, 0x20) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x14, 0x453, 0x4, 0x70bd2b, 0x25dfdbfc, "e4"}, 0x14}}, 0x2080) 610.215284ms ago: executing program 2 (id=4230): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20004015}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500004000002020207b1af8ff00001e00bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x0, 0x0, 0x0, 0x2000004, 0x0, 0x0, 0x1f00, 0x3d, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x2, 0x200008, 0x5, 0x20000}, 0x10}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800800000000000850a602200000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r0], 0x4c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 609.719024ms ago: executing program 6 (id=4231): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xb, 0x8, 0xa7c, 0x7fffffff, 0x1}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000cc0)='mmap_lock_acquire_returned\x00', r1}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/mdstat\x00', 0x41, 0x0) 608.734154ms ago: executing program 3 (id=4232): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000039"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='rxrpc_local\x00', r2, 0x0, 0x80000001}, 0x18) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0x4000000) close_range(r0, 0xffffffffffffffff, 0x0) 608.281374ms ago: executing program 6 (id=4233): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000130000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000002780)=""/4096, 0x1000}], 0x1, 0x5b3d2934, 0xb) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r5], 0x1c}}, 0x0) 564.492926ms ago: executing program 2 (id=4234): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32, @ANYBLOB=' '], 0x38}}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r2, &(0x7f0000000100), &(0x7f0000000000), 0x2}, 0x20) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 563.644166ms ago: executing program 3 (id=4244): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000090000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r2}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r2}, 0x18) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r3}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r0}, 0x18) 562.921346ms ago: executing program 6 (id=4245): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='mem_disconnect\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='mem_disconnect\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000004100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f00000003c0)="131c8701feaa16bca4ac74ab821d", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) 227.704631ms ago: executing program 9 (id=4235): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kfree\x00', r0}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000bc0)=@bpf_tracing={0x1a, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1c99a}, 0x94) io_uring_enter(0xffffffffffffffff, 0x47f8, 0x0, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x2501, 0x0) ioctl$SNAPSHOT_FREE(r1, 0x3305) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000780)=ANY=[@ANYBLOB="61128c000000000061138c0000000000bf2000000000000015000000081400002d0301000000000095000000000000006916600000000000bf67000000000000260300000fff0748670600000f000000170300000ee60020bf050000000000001d360000000000006507f9ff01000000070700004c000000cc75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000000500000000000000950000000000000032ff7f5be95e09b67754bb12feffffff8ecf264e0f84f9f17d3c51e3c7bdd2d17f2f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd399703d6c4f6f3be5b369289aa6812b8e007e733b9a4f16d0abbd5ad9381806ef08513e3d3778a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad5b803306b17cf4ef3f1d45f65727546e7c955ccefa1f6ab689fde4de4e63edf10271a5144ddc8da3aa5b0ab733a1b901627b562ed04ae76002d4519af619e3a2a4d69e0dee5eb106774a8f3e6916dfec88b5634ef79b02d2ca8ff54c158f0200000000eafb735fd552bdc206004aeb0743eb2dc819c75c8ac86d8a297dff0445a13d006723888fb126a163f16fb2ad9bc1162ba7cbebe174cecac4d03723f1c932b3faffffffffffffff5fc998e13b670e373e3e5897f7ad2e99e0e67a993716dbf580469f0f53acbb40b401e3738270b315d362ed834f2a0700000096649a462e7ee4bcf8b07a101c879730beb4000000000000000000000000000000bc00f674629709e7e78f4ddc3d1bc3ebf0bd9d42ca019dd5d022cf7468659fbe2562671cd47840a7afaab43176e65ec1118d46d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7eab04871bc47287cd313f3bea788ea2bcdc340ffb567b40407d000000000000000000000000005f37d83f84e98a523d80bd0d0d703f3767ce603c9d4867b63d20a268bb9f15a0a6e66ce4660fbee91629ab028acfc1d9260e9659a0f6a5480a55c22fe3ae5f562d0ae520c38d2bab6528000000596fb73a96b33c81cdbbd421a27f7f1db054cc7a0a4d372849c99a98822103b9851d924b85b1ca4b21b187db00000000000000066dead3b9670a7604a5ddd0fd2e4fb8a5749a8a8ad78454ba1eebeff1b528da294247d294d2487babb176fdfafeb3d492a325671e6b91afb41f87feda4ce2f468a3758750c0b8f151d4d8574bbbe027687a0e12311cdf3384a26ee3f6f2424ba1e5be98ef1f8f2db9a4991e234f9f447e1730ceaf54cf25c0e3ad7cbb0de06d55db89d154c9d3fcd01c551b0ef58034c252629aefbfd5305845b9a8763b264e8f0bcd0f606fe92e511f122325ebc5fef1b68f2e2ec7bebe423d4baae0e27845d0eb8b8a4f97f83424221e94a5c4623feb8496ccdbc55b27773bf1b3e6a91a20e0c27fc80262647f88d8d1123d199b2c7729bb7700e887ea963f00004a1d0851dbfb9308d16cadcc7b477c9a9586571182526898735552a203c4797228533b1a73ab44aa115136353964648abcc4adbe765556643842290a92eafea0ec2c000000000000000000000000000000e1f3518dc3fc2bbefe043804ac1b6b1c8b7e3afed045a3a808700bca61a39d5bfa83877803013e2d145e642253632f3a283c6eee0e22cb69fe7f94786220c31e9b2a82a9856e947bace74923e4740bf1c17cb41ef19161c3d417655517c28bd08dee32d77a40b834ba7a12223354e9321b8300f7d5d63fa0e8f074adc176285a8f41609ce040cec99943792f5443ca5292447b0f0f240743c4b2b8142ce0b43d4d1731ce11533f61ef241c83557f5aae58a848b5ccce86b8b0fb21fe369c90f06e2d9680003df72f3f0060e6c3415cc1026d342003bece09fbfd062efdd9b48377335903f3b4e87386915e3ac429a4db646da1cc6e29ad8650f4da326cbfdce12c8d5deba32549d6aefe422e0d665d62325c737fe76ec1f3c3670ed96f86738a2cf1c59b5f9b84ffd068f7b4509f53617910a41b811a3f7cd6251f8100008133af11a4db2d00c0ad86ce9f40f3e06b41b45f72b1598a12abddf58ac778bff2f1e49306a1d2f80b2a7d7a28f3997ee60793c62ffee96535e47adac9f367395cf26056a4b76d646f7682f21beafcdb7a9c07acfd145487426f1a009327b8ec6e695e6a7ddcc2c9151cc9c4efa413fa1e521b398151247104bc47748199441cf298e925ef2e3374f4ec0193b38a355c35ee44962fceb3f418510742c93a442f857733b74b6d9197cd62784d7f2afa6a4bc5cae18e33435665250241a7ffd96fc0790000009c17c570096bb75de737107e029b18ec0e61ab3761366452a1c6e3e3c912170f874555aaefc9644cffa768eb2b47c6b040698746df86026730db64859c46cdfb775b86214cfd1932d5ad87c56ea4f38bca780000000000000000000000003bf179c894590cb06b546082451bb735e7152afd5340683663e8effbfb49855ec98703a1e141ab7510fc0e3b081e72d25bfa4e52bedadd11e152bb1dcfcfe942b97b813cf4cdd8626ecfb630425db071c1bfdb03fee96f80b1a96f9427e17edfdc902749ccbab746e26a3a46527b3a32c49dab9608ab1dca3982590c1e78ff5c87d10eef5c3707974981c01c00000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xf000000}, 0x48) 226.77971ms ago: executing program 3 (id=4247): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'gre0\x00', 0x0}) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180100000100a7d9000000000020b200850000007b00000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000340)='kfree\x00', r2, 0x0, 0x2}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) bind$packet(r0, &(0x7f0000000300)={0x11, 0x1b, r1, 0x1, 0x0, 0x6, @local}, 0x14) bind$packet(r0, &(0x7f0000000000)={0x11, 0xf6, r1, 0x1, 0x9, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 226.49ms ago: executing program 2 (id=4236): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000140)=ANY=[], 0x8) getsockopt$inet6_opts(r0, 0x29, 0x37, 0x0, &(0x7f0000000000)) close(0x3) socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001ec0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r2, 0x1, 0x70bd25, 0x0, {{}, {}, {0x14, 0x19, {0x80000000, 0xfffffff9, 0x1, 0x5}}}}, 0x30}, 0x1, 0x0, 0x0, 0x20040803}, 0x20000000) 226.20479ms ago: executing program 6 (id=4237): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000181100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0xa, 0x101, 0x7fff, 0xcc, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000008280), r2) sendmsg$DEVLINK_CMD_SB_POOL_GET(r2, &(0x7f00000084c0)={0x0, 0x0, &(0x7f0000008480)={&(0x7f00000082c0)={0x44, r3, 0x1, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xfffffffffffffe51, 0xb, 0x8001}, {0x6, 0x11, 0x40}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000084}, 0x40080) 182.827202ms ago: executing program 2 (id=4238): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000280)='kmem_cache_free\x00', r3, 0x0, 0x200000000000006}, 0x18) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2, 0x4}, 0x10) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) r4 = dup3(r1, r0, 0x0) recvmmsg(r4, &(0x7f0000008840)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000040)=""/8, 0x8}], 0x1}, 0xffffffff}], 0x1, 0x40000001, 0x0) 160.655283ms ago: executing program 3 (id=4239): bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000002000000000000000018090000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00000004c0)={0x0, 0x7ce}, &(0x7f0000000500)=0x8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000540)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f00000002c0)='./bus\x00', 0x404, &(0x7f0000000580)={[{@orlov}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}]}, 0x1, 0x5d8, &(0x7f0000000c00)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./bus\x00', 0x42, 0x61) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1202, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) sendfile(r1, r0, 0x0, 0x7ffff000) 118.321255ms ago: executing program 6 (id=4240): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xa, 0x1fffffffffffffcd, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000072"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='page_pool_release\x00', r0}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000300)="b9ff030768f1258c989e14f05c71", 0x0, 0x2, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 98.630006ms ago: executing program 9 (id=4241): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000780)='netlink_extack\x00', r0}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xe}, {0x5, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4, 0xc0000000, 0xfffffffe, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_BETA={0x8, 0x6, 0x16}, @TCA_FQ_PIE_TARGET={0x8, 0x3, 0x4}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[], 0xd0}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 47.243378ms ago: executing program 6 (id=4242): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xffffe000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f0000000000), 0x10) read(r0, &(0x7f00000017c0)=""/4090, 0xffa) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f0000000340)=0x1, 0x4) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) sendmsg$can_raw(r0, &(0x7f0000000240)={&(0x7f0000000780)={0x1d, r1}, 0x10, &(0x7f0000000200)={&(0x7f0000000140)=@can={{0x3, 0x0, 0x1, 0x1}, 0x0, 0x0, 0x0, 0x0, "e5631d6f20af6daa"}, 0x10}}, 0x0) 0s ago: executing program 9 (id=4243): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000400000000000000000000850000005000000085000000d000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r0}, 0xe) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={r2, 0x2, 0x6}, 0x10) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000000)={r2, 0x1, 0x6, @multicast}, 0x10) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x89a1, &(0x7f0000000040)={'syzkaller0\x00'}) kernel console output (not intermixed with test programs): 4374.610:4685): avc: denied { mounton } for pid=12493 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 172.154052][T12493] lo speed is unknown, defaulting to 1000 [ 172.235736][T12493] chnl_net:caif_netlink_parms(): no params data found [ 172.273318][T12493] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.280430][T12493] bridge0: port 1(bridge_slave_0) entered disabled state [ 172.288283][T12493] bridge_slave_0: entered allmulticast mode [ 172.294778][T12493] bridge_slave_0: entered promiscuous mode [ 172.301632][T12493] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.308740][T12493] bridge0: port 2(bridge_slave_1) entered disabled state [ 172.316778][T12493] bridge_slave_1: entered allmulticast mode [ 172.323231][T12493] bridge_slave_1: entered promiscuous mode [ 172.341170][T12493] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 172.352236][T12493] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 172.372227][T12493] team0: Port device team_slave_0 added [ 172.379160][T12493] team0: Port device team_slave_1 added [ 172.395345][T12493] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 172.402297][T12493] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 172.428271][T12493] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 172.439746][T12493] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 172.446742][T12493] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 172.472664][T12493] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 172.500037][T12493] hsr_slave_0: entered promiscuous mode [ 172.506096][T12493] hsr_slave_1: entered promiscuous mode [ 172.512019][T12493] debugfs: 'hsr0' already exists in 'hsr' [ 172.517760][T12493] Cannot create hsr debugfs directory [ 172.584063][T12493] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 172.593358][T12493] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 172.602304][T12493] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 172.611330][T12493] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 172.627735][T12493] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.634909][T12493] bridge0: port 2(bridge_slave_1) entered forwarding state [ 172.642177][T12493] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.649242][T12493] bridge0: port 1(bridge_slave_0) entered forwarding state [ 172.658258][ T3865] bridge0: port 1(bridge_slave_0) entered disabled state [ 172.666211][ T3865] bridge0: port 2(bridge_slave_1) entered disabled state [ 172.698692][T12493] 8021q: adding VLAN 0 to HW filter on device bond0 [ 172.712497][T12493] 8021q: adding VLAN 0 to HW filter on device team0 [ 172.722373][ T3865] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.729548][ T3865] bridge0: port 1(bridge_slave_0) entered forwarding state [ 172.740648][ T3865] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.747736][ T3865] bridge0: port 2(bridge_slave_1) entered forwarding state [ 172.871591][ T29] audit: type=1400 audit(1764824375.401:4686): avc: denied { read } for pid=12524 comm="syz.2.3017" name="usbmon7" dev="devtmpfs" ino=163 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 172.895093][ T29] audit: type=1400 audit(1764824375.401:4687): avc: denied { open } for pid=12524 comm="syz.2.3017" path="/dev/usbmon7" dev="devtmpfs" ino=163 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 172.919524][ T29] audit: type=1400 audit(1764824375.401:4688): avc: denied { ioctl } for pid=12524 comm="syz.2.3017" path="/dev/usbmon7" dev="devtmpfs" ino=163 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 172.996009][T12493] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 173.017075][T12549] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3019'. [ 173.043129][T12549] 8021q: adding VLAN 0 to HW filter on device bond7 [ 173.061956][T12549] bond7: (slave gretap1): Enslaving as an active interface with an up link [ 173.088497][T12532] lo speed is unknown, defaulting to 1000 [ 173.100318][T12521] lo speed is unknown, defaulting to 1000 [ 173.246586][T12563] bridge0: port 1(gretap0) entered blocking state [ 173.253209][T12563] bridge0: port 1(gretap0) entered disabled state [ 173.261365][T12563] gretap0: entered allmulticast mode [ 173.267700][T12563] gretap0: entered promiscuous mode [ 173.276122][T12565] gretap0: left allmulticast mode [ 173.281190][T12565] gretap0: left promiscuous mode [ 173.286374][T12565] bridge0: port 1(gretap0) entered disabled state [ 173.309047][T12569] loop5: detected capacity change from 0 to 512 [ 173.321855][T12569] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 173.369794][T12532] chnl_net:caif_netlink_parms(): no params data found [ 173.380122][T12580] netlink: 80 bytes leftover after parsing attributes in process `syz.5.3026'. [ 173.461396][T12521] chnl_net:caif_netlink_parms(): no params data found [ 173.524669][T12493] veth0_vlan: entered promiscuous mode [ 173.538028][T12532] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.545976][T12532] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.553730][T12532] bridge_slave_0: entered allmulticast mode [ 173.560380][T12532] bridge_slave_0: entered promiscuous mode [ 173.630587][T12532] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.637738][T12532] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.647323][T12532] bridge_slave_1: entered allmulticast mode [ 173.654342][T12532] bridge_slave_1: entered promiscuous mode [ 173.679383][T12493] veth1_vlan: entered promiscuous mode [ 173.708732][T12532] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 173.719751][T12532] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 173.784295][T12521] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.791524][T12521] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.799106][T12521] bridge_slave_0: entered allmulticast mode [ 173.805856][T12521] bridge_slave_0: entered promiscuous mode [ 173.827142][T12602] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3030'. [ 173.841481][T12521] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.848620][T12521] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.857040][T12521] bridge_slave_1: entered allmulticast mode [ 173.905658][T12521] bridge_slave_1: entered promiscuous mode [ 173.951797][T12532] team0: Port device team_slave_0 added [ 174.018339][T12521] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 174.056817][T12521] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 174.121202][T12521] team0: Port device team_slave_0 added [ 174.141974][T12521] team0: Port device team_slave_1 added [ 174.271248][T12521] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 174.278263][T12521] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 174.304953][T12521] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 174.381614][T12532] team0: Port device team_slave_1 added [ 174.395069][T12521] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 174.402071][T12521] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 174.428762][T12521] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 174.466288][T12493] veth0_macvtap: entered promiscuous mode [ 174.481207][T12532] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 174.488999][T12532] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 174.515712][T12532] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 174.537126][T12532] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 174.544827][T12532] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 174.570941][T12532] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 174.607804][T12532] hsr_slave_0: entered promiscuous mode [ 174.614073][T12532] hsr_slave_1: entered promiscuous mode [ 174.620037][T12532] debugfs: 'hsr0' already exists in 'hsr' [ 174.625818][T12532] Cannot create hsr debugfs directory [ 174.702961][T12493] veth1_macvtap: entered promiscuous mode [ 174.738098][T12493] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 174.763613][T12521] hsr_slave_0: entered promiscuous mode [ 174.773168][T12521] hsr_slave_1: entered promiscuous mode [ 174.784095][T12521] debugfs: 'hsr0' already exists in 'hsr' [ 174.789848][T12521] Cannot create hsr debugfs directory [ 174.810933][T12493] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 174.895117][ T3812] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 174.912929][ T3813] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 174.931975][ T3813] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 174.982446][ T3813] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.016777][T12532] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 175.026719][ T29] audit: type=1400 audit(1764824377.562:4689): avc: denied { mounton } for pid=12493 comm="syz-executor" path="/root/syzkaller.bTxRsH/syz-tmp" dev="sda1" ino=2051 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 175.051336][ T29] audit: type=1400 audit(1764824377.562:4690): avc: denied { mounton } for pid=12493 comm="syz-executor" path="/root/syzkaller.bTxRsH/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 175.078713][ T29] audit: type=1400 audit(1764824377.562:4691): avc: denied { mounton } for pid=12493 comm="syz-executor" path="/root/syzkaller.bTxRsH/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=33736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 175.112895][ T29] audit: type=1400 audit(1764824377.652:4692): avc: denied { mounton } for pid=12493 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 175.118923][T12532] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 175.143683][T12623] netlink: 'syz.5.3038': attribute type 4 has an invalid length. [ 175.151430][T12623] netlink: 152 bytes leftover after parsing attributes in process `syz.5.3038'. [ 175.157292][ T29] audit: type=1400 audit(1764824377.682:4693): avc: denied { mount } for pid=12493 comm="syz-executor" name="/" dev="gadgetfs" ino=4575 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 175.183044][ T29] audit: type=1400 audit(1764824377.682:4694): avc: denied { add_name } for pid=12493 comm="syz-executor" name="syz6" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:logrotate_exec_t:s0" [ 175.218584][T12623] .`: renamed from bond0 (while UP) [ 175.235543][T12532] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 175.253461][T12532] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 175.325253][T12521] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 175.343856][T12521] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 175.364162][T12532] 8021q: adding VLAN 0 to HW filter on device bond0 [ 175.371652][T12521] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 175.389374][T12532] 8021q: adding VLAN 0 to HW filter on device team0 [ 175.397709][T12521] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 175.410950][ T3812] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.418092][ T3812] bridge0: port 1(bridge_slave_0) entered forwarding state [ 175.434938][ T3862] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.442084][ T3862] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.491289][T12532] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 175.501796][T12532] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 175.572553][T12521] 8021q: adding VLAN 0 to HW filter on device bond0 [ 175.589383][T12521] 8021q: adding VLAN 0 to HW filter on device team0 [ 175.601530][ T3812] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.608659][ T3812] bridge0: port 1(bridge_slave_0) entered forwarding state [ 175.622780][ T3812] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.629933][ T3812] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.658828][T12532] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 175.764128][T12521] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 175.910759][T12532] veth0_vlan: entered promiscuous mode [ 175.930016][T12532] veth1_vlan: entered promiscuous mode [ 175.957959][T12532] veth0_macvtap: entered promiscuous mode [ 175.966209][T12532] veth1_macvtap: entered promiscuous mode [ 175.979323][T12532] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 175.992762][T12532] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 176.010928][ T37] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.020423][ T37] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.029498][ T37] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.039030][ T37] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.076275][T12521] veth0_vlan: entered promiscuous mode [ 176.099701][T12521] veth1_vlan: entered promiscuous mode [ 176.115405][T12707] netlink: 'syz.5.3051': attribute type 30 has an invalid length. [ 176.166860][T12521] veth0_macvtap: entered promiscuous mode [ 176.174937][T12521] veth1_macvtap: entered promiscuous mode [ 176.199693][T12521] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 176.236216][T12521] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 176.259962][ T3812] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.286799][ T3812] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.317248][T12716] loop6: detected capacity change from 0 to 128 [ 176.323950][ T3812] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.349465][T12716] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 176.363503][ T3812] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.385012][T12716] ext4 filesystem being mounted at /2/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 176.462161][T12716] EXT4-fs error (device loop6): ext4_check_dx_root:2203: inode #2: comm syz.6.3054: Corrupt dir, invalid name for '.', running e2fsck is recommended [ 176.515717][T12493] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 176.548636][T12727] syzkaller0: entered allmulticast mode [ 176.587919][T12727] syzkaller0: entered promiscuous mode [ 176.610635][T12727] syzkaller0 (unregistering): left allmulticast mode [ 176.617511][T12727] syzkaller0 (unregistering): left promiscuous mode [ 176.676131][T12736] loop5: detected capacity change from 0 to 512 [ 176.681997][T12740] lo speed is unknown, defaulting to 1000 [ 176.708037][T12736] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a842c01c, mo2=0002] [ 176.727815][T12745] loop8: detected capacity change from 0 to 512 [ 176.731442][T12736] System zones: 0-2, 18-18, 34-35 [ 176.752438][T12745] EXT4-fs (loop8): revision level too high, forcing read-only mode [ 176.761614][T12736] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 176.775367][T12745] EXT4-fs (loop8): orphan cleanup on readonly fs [ 176.782607][T12736] ext4 filesystem being mounted at /221/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 176.794422][T12745] EXT4-fs error (device loop8): ext4_do_update_inode:5628: inode #16: comm syz.8.3063: corrupted inode contents [ 176.813656][T12745] EXT4-fs (loop8): Remounting filesystem read-only [ 176.815920][T12736] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3061'. [ 176.820438][T12745] EXT4-fs (loop8): 1 truncate cleaned up [ 176.836187][ T3862] EXT4-fs (loop8): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 176.846961][ T3862] EXT4-fs (loop8): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 176.857837][ T3862] EXT4-fs (loop8): Quota write (off=8, len=24) cancelled because transaction is not started [ 176.869577][T12745] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 176.965686][ T9056] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 177.273593][T12780] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3077'. [ 177.488365][ T29] kauditd_printk_skb: 26 callbacks suppressed [ 177.488384][ T29] audit: type=1400 audit(1764824380.023:4715): avc: denied { watch } for pid=12791 comm="syz.5.3083" path="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 177.534904][T12521] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 177.589340][ T29] audit: type=1400 audit(1764824380.123:4716): avc: denied { ioctl } for pid=12797 comm="syz.8.3084" path="socket:[34719]" dev="sockfs" ino=34719 ioctlcmd=0x4947 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 177.634055][ T29] audit: type=1400 audit(1764824380.153:4717): avc: denied { read } for pid=12797 comm="syz.8.3084" name="autofs" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 177.657457][ T29] audit: type=1400 audit(1764824380.153:4718): avc: denied { open } for pid=12797 comm="syz.8.3084" path="/dev/autofs" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 177.681227][ T29] audit: type=1400 audit(1764824380.153:4719): avc: denied { ioctl } for pid=12797 comm="syz.8.3084" path="/dev/autofs" dev="devtmpfs" ino=91 ioctlcmd=0x937e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 177.910231][ T29] audit: type=1400 audit(1764824380.443:4720): avc: denied { read } for pid=12795 comm="syz.5.3085" path="socket:[34728]" dev="sockfs" ino=34728 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 178.155913][T12819] loop2: detected capacity change from 0 to 764 [ 178.171370][T12819] rock: corrupted directory entry. extent=32, offset=2044, size=237 [ 178.597051][T12836] netlink: 20 bytes leftover after parsing attributes in process `syz.8.3099'. [ 178.720153][T12842] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 178.825251][ T29] audit: type=1400 audit(1764824381.364:4721): avc: denied { watch } for pid=12848 comm="syz.7.3106" path="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 178.883753][T12852] loop8: detected capacity change from 0 to 512 [ 178.906501][T12852] EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode [ 178.948204][T12852] EXT4-fs (loop8): 1 truncate cleaned up [ 178.982977][T12852] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 179.031532][ T29] audit: type=1400 audit(1764824381.564:4722): avc: denied { setattr } for pid=12851 comm="syz.8.3107" name="file1" dev="loop8" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 179.235526][T12521] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 179.509368][T12881] bridge0: entered promiscuous mode [ 179.517824][T12881] macsec1: entered promiscuous mode [ 179.531918][T12881] bridge0: port 3(macsec1) entered blocking state [ 179.538455][T12881] bridge0: port 3(macsec1) entered disabled state [ 179.561605][T12881] macsec1: entered allmulticast mode [ 179.566948][T12881] bridge0: entered allmulticast mode [ 179.582986][T12881] macsec1: left allmulticast mode [ 179.588048][T12881] bridge0: left allmulticast mode [ 179.610805][T12881] bridge0: left promiscuous mode [ 179.674337][T12885] loop2: detected capacity change from 0 to 128 [ 179.890530][ T29] audit: type=1400 audit(1764824382.434:4723): avc: denied { create } for pid=12894 comm="syz.7.3124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 179.949754][ T29] audit: type=1400 audit(1764824382.454:4724): avc: denied { bind } for pid=12894 comm="syz.7.3124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 179.978924][T12899] syzkaller0: entered allmulticast mode [ 179.985715][T12899] syzkaller0: entered promiscuous mode [ 180.012611][T12899] syzkaller0 (unregistering): left allmulticast mode [ 180.019383][T12899] syzkaller0 (unregistering): left promiscuous mode [ 180.071042][T12902] loop5: detected capacity change from 0 to 1024 [ 180.077965][T12902] EXT4-fs: Ignoring removed orlov option [ 180.092585][T12902] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 180.143516][ T9056] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 180.664685][T12926] netlink: 4 bytes leftover after parsing attributes in process `+}[@'. [ 180.813972][T12934] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3140'. [ 180.823753][T12934] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3140'. [ 180.914591][T12937] bridge0: entered promiscuous mode [ 180.921817][T12937] macsec1: entered allmulticast mode [ 180.927212][T12937] bridge0: entered allmulticast mode [ 181.117889][T12952] loop5: detected capacity change from 0 to 8192 [ 181.242924][T12987] loop5: detected capacity change from 0 to 512 [ 181.262474][T12987] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 181.290474][T12987] EXT4-fs (loop5): 1 truncate cleaned up [ 181.304101][T12987] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 181.456278][T13009] loop6: detected capacity change from 0 to 1024 [ 181.486713][ T9056] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 181.507183][T13009] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 181.533798][T13012] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 181.533798][T13012] program syz.2.3176 not setting count and/or reply_len properly [ 181.613193][T13026] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3182'. [ 181.631544][T13024] syzkaller0: entered allmulticast mode [ 181.649083][T13024] syzkaller0: entered promiscuous mode [ 181.664503][T13024] syzkaller0 (unregistering): left allmulticast mode [ 181.672017][T13024] syzkaller0 (unregistering): left promiscuous mode [ 181.676211][T13030] loop2: detected capacity change from 0 to 1024 [ 181.707993][T12493] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 181.722793][T13030] EXT4-fs (loop2): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 181.735530][T13030] ext4 filesystem being mounted at /717/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 181.781320][T13030] EXT4-fs error (device loop2): ext4_map_blocks:813: inode #15: comm syz.2.3184: lblock 0 mapped to illegal pblock 0 (length 6) [ 181.810250][T13033] bridge_slave_0: left promiscuous mode [ 181.816009][T13033] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.823943][T13039] netlink: 'syz.5.3185': attribute type 10 has an invalid length. [ 181.831928][T13039] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3185'. [ 181.832973][T13030] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 6 with error 117 [ 181.854521][T13030] EXT4-fs (loop2): This should not happen!! Data will be lost [ 181.854521][T13030] [ 181.870270][T13033] bridge_slave_1: left allmulticast mode [ 181.876039][T13033] bridge_slave_1: left promiscuous mode [ 181.881758][T13033] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.903194][T13033] .`: (slave bond_slave_0): Releasing backup interface [ 181.926050][T13033] .`: (slave bond_slave_1): Releasing backup interface [ 181.937783][T13030] EXT4-fs error (device loop2): ext4_map_blocks:777: inode #15: comm syz.2.3184: lblock 0 mapped to illegal pblock 0 (length 1) [ 181.946496][T13044] loop8: detected capacity change from 0 to 128 [ 181.959426][T13033] team0: Port device team_slave_0 removed [ 181.968859][T13033] team0: Port device team_slave_1 removed [ 181.969031][T13030] EXT4-fs error (device loop2): ext4_ext_remove_space:2955: inode #15: comm syz.2.3184: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 181.976664][T13033] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 182.000242][T13033] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 182.008999][T13030] EXT4-fs error (device loop2) in ext4_setattr:6046: Corrupt filesystem [ 182.023495][T13033] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 182.030959][T13033] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 182.041051][T13033] net_ratelimit: 3496 callbacks suppressed [ 182.041073][T13033] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 182.076792][T13038] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3186'. [ 182.087342][T13039] batman_adv: batadv0: Adding interface: veth1_vlan [ 182.094002][T13039] batman_adv: batadv0: The MTU of interface veth1_vlan is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 182.120134][T13039] batman_adv: batadv0: Interface activated: veth1_vlan [ 182.141510][ T3317] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 182.206180][T13052] loop8: detected capacity change from 0 to 512 [ 182.233274][T13052] EXT4-fs (loop8): mounting ext3 file system using the ext4 subsystem [ 182.252505][T13052] EXT4-fs (loop8): invalid journal inode [ 182.271126][T13052] EXT4-fs (loop8): can't get journal size [ 182.296626][T13052] EXT4-fs (loop8): 1 truncate cleaned up [ 182.328832][T13052] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 182.370708][T12521] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 182.464610][T13072] loop7: detected capacity change from 0 to 8192 [ 182.509210][ T29] kauditd_printk_skb: 58 callbacks suppressed [ 182.509225][ T29] audit: type=1326 audit(1764824385.056:4783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13071 comm="syz.7.3201" exe="/root/syz-executor" sig=0 arch=c000003e syscall=262 compat=0 ip=0x7fe71e97de3a code=0x7ffc0000 [ 182.574255][ T29] audit: type=1326 audit(1764824385.086:4784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13071 comm="syz.7.3201" exe="/root/syz-executor" sig=0 arch=c000003e syscall=262 compat=0 ip=0x7fe71e97de3a code=0x7ffc0000 [ 182.597979][ T29] audit: type=1326 audit(1764824385.086:4785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13071 comm="syz.7.3201" exe="/root/syz-executor" sig=0 arch=c000003e syscall=262 compat=0 ip=0x7fe71e97de3a code=0x7ffc0000 [ 182.622871][ T29] audit: type=1326 audit(1764824385.086:4786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13071 comm="syz.7.3201" exe="/root/syz-executor" sig=0 arch=c000003e syscall=262 compat=0 ip=0x7fe71e97de3a code=0x7ffc0000 [ 182.646632][ T29] audit: type=1326 audit(1764824385.086:4787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13071 comm="syz.7.3201" exe="/root/syz-executor" sig=0 arch=c000003e syscall=262 compat=0 ip=0x7fe71e97de3a code=0x7ffc0000 [ 182.671038][ T29] audit: type=1326 audit(1764824385.086:4788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13071 comm="syz.7.3201" exe="/root/syz-executor" sig=0 arch=c000003e syscall=262 compat=0 ip=0x7fe71e97de3a code=0x7ffc0000 [ 182.695262][ T29] audit: type=1326 audit(1764824385.086:4789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13071 comm="syz.7.3201" exe="/root/syz-executor" sig=0 arch=c000003e syscall=262 compat=0 ip=0x7fe71e97de3a code=0x7ffc0000 [ 182.718798][ T29] audit: type=1326 audit(1764824385.086:4790): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13071 comm="syz.7.3201" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fe71e97e3aa code=0x7ffc0000 [ 182.743081][ T29] audit: type=1326 audit(1764824385.086:4791): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13071 comm="syz.7.3201" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 182.766619][ T29] audit: type=1326 audit(1764824385.086:4792): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13071 comm="syz.7.3201" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 182.852979][T13084] loop7: detected capacity change from 0 to 128 [ 182.914202][T13089] loop2: detected capacity change from 0 to 512 [ 182.921293][T13089] ext4: Unknown parameter 'fowner' [ 182.946453][T13092] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3218'. [ 183.169217][T13112] sctp: [Deprecated]: syz.6.3217 (pid 13112) Use of struct sctp_assoc_value in delayed_ack socket option. [ 183.169217][T13112] Use struct sctp_sack_info instead [ 183.341808][T13122] loop6: detected capacity change from 0 to 512 [ 183.361836][T13122] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 183.381131][T13122] ext4 filesystem being mounted at /26/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 183.575950][T13120] Set syz1 is full, maxelem 65536 reached [ 183.643445][T12493] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 183.659599][T13132] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3234'. [ 183.711246][T13140] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3227'. [ 183.723085][T13138] loop6: detected capacity change from 0 to 512 [ 183.738018][T13138] ext4: Unknown parameter 'fowner' [ 183.744052][T13136] loop2: detected capacity change from 0 to 512 [ 183.756608][T13136] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 183.770988][T13136] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 183.802237][ T3317] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 183.873995][T13148] loop2: detected capacity change from 0 to 8192 [ 183.981683][T13152] sctp: [Deprecated]: syz.2.3232 (pid 13152) Use of struct sctp_assoc_value in delayed_ack socket option. [ 183.981683][T13152] Use struct sctp_sack_info instead [ 184.202575][T13161] loop7: detected capacity change from 0 to 512 [ 184.290268][T13161] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 184.310244][T13161] ext4 filesystem being mounted at /44/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 184.370617][T13159] Set syz1 is full, maxelem 65536 reached [ 184.407815][T12532] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 184.496784][T13171] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3240'. [ 184.560221][T13178] loop7: detected capacity change from 0 to 512 [ 184.567284][T13178] EXT4-fs (loop7): feature flags set on rev 0 fs, running e2fsck is recommended [ 184.579296][T13178] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 184.606464][T12532] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 184.633887][T13184] loop7: detected capacity change from 0 to 512 [ 184.642719][T13184] ext4: Unknown parameter 'fowner' [ 184.651814][T13186] loop8: detected capacity change from 0 to 164 [ 185.030084][T13205] loop2: detected capacity change from 0 to 512 [ 185.069270][T13205] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 185.082129][T13205] ext4 filesystem being mounted at /728/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 185.182858][T13202] Set syz1 is full, maxelem 65536 reached [ 185.220060][ T3317] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 185.256786][T13215] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3252'. [ 185.357957][T13217] loop6: detected capacity change from 0 to 512 [ 185.370234][T13217] EXT4-fs (loop6): feature flags set on rev 0 fs, running e2fsck is recommended [ 185.402793][T13217] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 185.455209][T12493] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 185.548596][T13241] loop5: detected capacity change from 0 to 164 [ 185.551905][T13238] loop8: detected capacity change from 0 to 512 [ 185.569717][T13240] netlink: 2184 bytes leftover after parsing attributes in process `syz.2.3264'. [ 185.580119][T13238] ext4: Unknown parameter 'fowner' [ 185.586336][T13240] netlink: 144 bytes leftover after parsing attributes in process `syz.2.3264'. [ 185.636173][T13244] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3266'. [ 185.761354][T13263] loop8: detected capacity change from 0 to 512 [ 185.787496][T13263] EXT4-fs (loop8): feature flags set on rev 0 fs, running e2fsck is recommended [ 185.858259][T13270] pimreg: entered allmulticast mode [ 185.859877][T13263] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 185.879042][T13270] pimreg: left allmulticast mode [ 185.923306][T12521] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 186.004351][T13282] loop5: detected capacity change from 0 to 512 [ 186.019571][T13282] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 186.064736][T13282] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 186.142185][ T9056] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 186.209456][T13293] loop5: detected capacity change from 0 to 512 [ 186.231122][T13293] ext4: Unknown parameter 'fowner' [ 186.511035][T13302] loop6: detected capacity change from 0 to 164 [ 186.524645][T13301] netlink: 'syz.5.3291': attribute type 10 has an invalid length. [ 186.562282][T13301] team0: Failed to send options change via netlink (err -105) [ 186.570669][T13301] team0: Port device dummy0 added [ 186.594865][T13305] netlink: 'syz.5.3291': attribute type 10 has an invalid length. [ 186.605470][T13305] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 186.627386][T13305] team0: Failed to send options change via netlink (err -105) [ 186.644460][T13305] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 186.662803][T13305] team0: Port device dummy0 removed [ 186.679499][T13305] .`: (slave dummy0): Enslaving as an active interface with an up link [ 186.699357][T13308] pimreg: entered allmulticast mode [ 186.718955][T13308] pimreg: left allmulticast mode [ 187.513988][T13362] pimreg: entered allmulticast mode [ 187.523160][T13362] pimreg: left allmulticast mode [ 187.540265][T13361] bridge: RTM_NEWNEIGH with invalid ether address [ 187.760986][T13373] netlink: 'syz.2.3330': attribute type 10 has an invalid length. [ 187.789294][T13373] team0: Failed to send options change via netlink (err -105) [ 187.796858][T13373] team0: Port device dummy0 added [ 187.823137][T13374] netlink: 'syz.2.3330': attribute type 10 has an invalid length. [ 187.843334][T13374] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 187.883818][T13374] team0: Failed to send options change via netlink (err -105) [ 187.893368][T13374] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 187.902627][T13374] team0: Port device dummy0 removed [ 187.909830][T13374] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 187.926403][T13378] Set syz1 is full, maxelem 65536 reached [ 187.951769][T13377] lo speed is unknown, defaulting to 1000 [ 188.165926][T13392] __nla_validate_parse: 3 callbacks suppressed [ 188.165942][T13392] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3326'. [ 188.204222][T13392] netlink: 32 bytes leftover after parsing attributes in process `syz.8.3326'. [ 188.289189][T13396] netlink: 60 bytes leftover after parsing attributes in process `syz.8.3329'. [ 188.499246][T13408] netlink: 'syz.7.3335': attribute type 10 has an invalid length. [ 188.547980][T13408] team0: Failed to send options change via netlink (err -105) [ 188.555653][T13408] team0: Port device dummy0 added [ 188.565936][T13414] netlink: 'syz.7.3335': attribute type 10 has an invalid length. [ 188.594934][T13414] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 188.625973][T13414] team0: Failed to send options change via netlink (err -105) [ 188.640207][T13414] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 188.654058][T13419] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3339'. [ 188.659534][T13414] team0: Port device dummy0 removed [ 188.685704][T13414] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 188.723573][T13424] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3341'. [ 188.775609][T13424] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3341'. [ 188.792677][T13426] loop7: detected capacity change from 0 to 512 [ 188.809860][T13426] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (3832!=33349) [ 188.835908][T13426] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a842e02c, mo2=0002] [ 188.854150][T13426] System zones: 1-12 [ 188.858625][T13426] EXT4-fs (loop7): orphan cleanup on readonly fs [ 188.875212][T13426] EXT4-fs error (device loop7): ext4_read_inode_bitmap:167: comm syz.7.3342: Inode bitmap for bg 0 marked uninitialized [ 188.888205][T13426] EXT4-fs (loop7): Remounting filesystem read-only [ 188.895271][T13426] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 188.959338][T12532] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 189.077740][T13446] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3348'. [ 189.097355][ T29] kauditd_printk_skb: 83 callbacks suppressed [ 189.097480][ T29] audit: type=1326 audit(1764824391.639:4876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13447 comm="syz.7.3360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 189.190666][T13450] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 189.194656][ T29] audit: type=1326 audit(1764824391.639:4877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13447 comm="syz.7.3360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 189.225793][ T29] audit: type=1326 audit(1764824391.639:4878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13447 comm="syz.7.3360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 189.249429][ T29] audit: type=1326 audit(1764824391.669:4879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13447 comm="syz.7.3360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 189.273993][ T29] audit: type=1326 audit(1764824391.669:4880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13447 comm="syz.7.3360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 189.298442][ T29] audit: type=1326 audit(1764824391.669:4881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13447 comm="syz.7.3360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 189.322088][ T29] audit: type=1326 audit(1764824391.679:4882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13447 comm="syz.7.3360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 189.346681][ T29] audit: type=1326 audit(1764824391.679:4883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13447 comm="syz.7.3360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 189.370288][ T29] audit: type=1326 audit(1764824391.679:4884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13447 comm="syz.7.3360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 189.394611][ T29] audit: type=1326 audit(1764824391.679:4885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13447 comm="syz.7.3360" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71e97f749 code=0x7ffc0000 [ 189.546144][T13463] netlink: 'syz.6.3353': attribute type 10 has an invalid length. [ 189.578055][T13463] team0: Failed to send options change via netlink (err -105) [ 189.585671][T13463] team0: Port device dummy0 added [ 189.600920][T13466] netlink: 'syz.6.3353': attribute type 10 has an invalid length. [ 189.613966][T13466] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 189.638631][T13466] team0: Failed to send options change via netlink (err -105) [ 189.655689][T13466] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 189.672363][T13466] team0: Port device dummy0 removed [ 189.689117][T13466] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 189.786708][T13472] bridge0: entered promiscuous mode [ 189.798113][T13472] macsec1: entered allmulticast mode [ 189.803603][T13472] bridge0: entered allmulticast mode [ 189.946141][T13480] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3356'. [ 190.136905][T13496] loop5: detected capacity change from 0 to 512 [ 190.161954][T13497] lo speed is unknown, defaulting to 1000 [ 190.169332][T13496] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 190.200325][T13496] EXT4-fs (loop5): 1 truncate cleaned up [ 190.220184][T13496] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 190.419262][ T9056] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 190.577930][T13509] loop5: detected capacity change from 0 to 764 [ 190.605288][T13509] rock: corrupted directory entry. extent=32, offset=2044, size=237 [ 190.631551][T13509] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 190.814045][T13524] loop2: detected capacity change from 0 to 512 [ 190.838778][T13524] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 190.901683][T13524] EXT4-fs (loop2): 1 truncate cleaned up [ 190.921102][T13524] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 190.951031][T13536] loop7: detected capacity change from 0 to 512 [ 190.980795][T13536] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 190.997421][T13536] EXT4-fs (loop7): 1 truncate cleaned up [ 191.003580][T13536] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 191.096341][ T3317] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 191.181145][T12532] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 191.199978][T13549] loop6: detected capacity change from 0 to 764 [ 191.225220][T13549] rock: corrupted directory entry. extent=32, offset=2044, size=237 [ 191.255513][T13549] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 191.972330][T13561] netlink: 'syz.8.3391': attribute type 10 has an invalid length. [ 192.020249][T13561] team0: Failed to send options change via netlink (err -105) [ 192.028607][T13561] team0: Port device dummy0 added [ 192.034312][T13563] netlink: 'syz.8.3391': attribute type 10 has an invalid length. [ 192.047951][T13563] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 192.072577][T13563] team0: Failed to send options change via netlink (err -105) [ 192.081015][T13563] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 192.095357][T13563] team0: Port device dummy0 removed [ 192.105448][T13563] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 192.124072][T13568] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3396'. [ 193.255916][T13597] netlink: 'syz.5.3412': attribute type 10 has an invalid length. [ 193.272405][T13597] .`: (slave dummy0): Releasing backup interface [ 193.292591][T13597] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 193.302781][T13597] team0: Failed to send options change via netlink (err -105) [ 193.313343][T13597] team0: Port device dummy0 added [ 193.320643][T13607] netlink: 'syz.5.3412': attribute type 10 has an invalid length. [ 193.329430][T13604] loop8: detected capacity change from 0 to 1024 [ 193.339286][T13607] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 193.365133][T13607] team0: Failed to send options change via netlink (err -105) [ 193.373957][T13607] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 193.383198][T13607] team0: Port device dummy0 removed [ 193.391402][T13607] .`: (slave dummy0): Enslaving as an active interface with an up link [ 193.400572][T13604] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 193.413282][T13614] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3416'. [ 193.463629][T13618] loop6: detected capacity change from 0 to 512 [ 193.471282][T13618] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 193.490211][T13618] EXT4-fs (loop6): 1 truncate cleaned up [ 193.509335][T13618] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 193.553707][T12521] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 193.602242][T12493] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 194.015297][T13647] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3425'. [ 194.024412][T13647] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3425'. [ 194.113947][T13653] netlink: 'syz.2.3430': attribute type 10 has an invalid length. [ 194.123317][T13653] bond0: (slave dummy0): Releasing backup interface [ 194.134576][T13653] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 194.147073][T13653] team0: Failed to send options change via netlink (err -105) [ 194.154780][T13653] team0: Port device dummy0 added [ 194.163457][T13653] netlink: 'syz.2.3430': attribute type 10 has an invalid length. [ 194.171762][T13653] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 194.182005][T13653] team0: Failed to send options change via netlink (err -105) [ 194.189781][T13653] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 194.199158][T13653] team0: Port device dummy0 removed [ 194.214986][T13653] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 194.410641][T13665] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3431'. [ 194.439246][T13669] loop7: detected capacity change from 0 to 512 [ 194.462360][T13669] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 194.490859][T13669] EXT4-fs (loop7): 1 truncate cleaned up [ 194.504690][T13669] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 194.660039][T12532] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 194.715578][ T4373] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 194.741015][ T4373] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 194.758298][ T29] kauditd_printk_skb: 30 callbacks suppressed [ 194.758313][ T29] audit: type=1400 audit(1764824397.302:4916): avc: denied { bind } for pid=13685 comm="syz.2.3443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 194.804443][T13688] ip6gretap0: entered promiscuous mode [ 194.814723][T13688] ip6gretap0: left promiscuous mode [ 194.839368][T13690] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3447'. [ 194.848494][T13690] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3447'. [ 194.976820][T13699] random: crng reseeded on system resumption [ 194.996187][ T29] audit: type=1400 audit(1764824397.542:4917): avc: denied { ioctl } for pid=13698 comm="syz.6.3450" path="/dev/snapshot" dev="devtmpfs" ino=90 ioctlcmd=0x3305 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 194.999212][T13699] Restarting kernel threads ... [ 195.042729][T13704] netlink: 'syz.2.3452': attribute type 10 has an invalid length. [ 195.048154][T13699] Done restarting kernel threads. [ 195.059755][T13705] ------------[ cut here ]------------ [ 195.065401][T13705] verifier bug: REG INVARIANTS VIOLATION (true_reg1): range bounds violation u64=[0x0, 0x0] s64=[0x0, 0x0] u32=[0x80632f4, 0x0] s32=[0x0, 0x0] var_off=(0x0, 0x0) [ 195.081847][T13705] WARNING: kernel/bpf/verifier.c:2748 at 0x0, CPU#1: syz.6.3450/13705 [ 195.090919][T13705] Modules linked in: [ 195.094993][T13705] CPU: 1 UID: 0 PID: 13705 Comm: syz.6.3450 Not tainted syzkaller #0 PREEMPT(voluntary) [ 195.103835][T13704] batadv0: entered allmulticast mode [ 195.104962][T13705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 195.111117][T13704] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 195.121363][T13705] RIP: 0010:reg_bounds_sanity_check+0x27d/0x660 [ 195.133785][T13705] Code: 24 78 4c 8b 44 24 70 4c 8b 4c 24 60 41 ff 74 24 20 41 55 53 ff 74 24 68 ff 74 24 78 ff b4 24 90 00 00 00 ff b4 24 b0 00 00 00 <67> 48 0f b9 3a 48 83 c4 38 4c 8b ac 24 98 00 00 00 49 8d 85 80 08 [ 195.137937][T13704] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 195.154262][T13705] RSP: 0018:ffffc90001a9f3a0 EFLAGS: 00010246 [ 195.168569][T13705] RAX: ffff888150f5ab90 RBX: 0000000000000000 RCX: 0000000000000000 [ 195.176795][T13705] RDX: ffffffff865ec23e RSI: ffffffff864b7f28 RDI: ffffffff86db3a40 [ 195.182910][T13704] netlink: 'syz.2.3452': attribute type 10 has an invalid length. [ 195.185612][T13705] RBP: ffff88810af8dae0 R08: 0000000000000000 R09: 0000000000000000 [ 195.192816][T13704] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3452'. [ 195.200670][T13705] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88810af8daa0 [ 195.209959][T13704] batadv0: entered promiscuous mode [ 195.218447][T13705] R13: 0000000000000000 R14: ffff88810af8daec R15: ffff88810af8dad8 [ 195.231201][T13705] FS: 00007fc69a7166c0(0000) GS:ffff8882aeee2000(0000) knlGS:0000000000000000 [ 195.240222][T13705] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 195.247630][T13705] CR2: 00007fc69a715f98 CR3: 000000015bd20000 CR4: 00000000003506f0 [ 195.255680][T13705] DR0: fffffffffffffffe DR1: 0000000000000000 DR2: 0000000000000000 [ 195.263715][T13705] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 195.271797][T13705] Call Trace: [ 195.276008][T13705] [ 195.278984][T13705] reg_set_min_max+0x1c8/0x260 [ 195.283939][T13705] check_cond_jmp_op+0x13bd/0x1a80 [ 195.289108][T13705] do_check+0x3347/0x81f0 [ 195.293694][T13705] do_check_common+0xccf/0x1300 [ 195.298586][T13705] bpf_check+0x2f98/0xc860 [ 195.303918][T13705] ? __alloc_frozen_pages_noprof+0x188/0x360 [ 195.309939][T13705] ? __rcu_read_unlock+0x4f/0x70 [ 195.315047][T13705] ? __perf_event_task_sched_in+0xa5b/0xac0 [ 195.320985][T13705] ? __perf_event_task_sched_in+0xa5b/0xac0 [ 195.326959][T13705] ? __list_add_valid_or_report+0x38/0xe0 [ 195.332906][T13705] ? xfd_validate_state+0x45/0xf0 [ 195.338904][T13705] ? __rcu_read_unlock+0x4f/0x70 [ 195.343929][T13705] ? __perf_event_task_sched_in+0xa5b/0xac0 [ 195.349880][T13705] ? __list_add_valid_or_report+0x38/0xe0 [ 195.355693][T13705] ? xfd_validate_state+0x45/0xf0 [ 195.360796][T13705] ? save_fpregs_to_fpstate+0x100/0x160 [ 195.367222][T13705] ? _raw_spin_unlock+0x26/0x50 [ 195.372201][T13705] ? __schedule+0x85f/0xcd0 [ 195.376749][T13705] ? bpf_prog_alloc+0x5b/0x150 [ 195.381651][T13705] ? should_fail_ex+0x30/0x280 [ 195.386490][T13705] ? should_failslab+0x8c/0xb0 [ 195.391331][T13705] ? __kmalloc_noprof+0x29f/0x590 [ 195.397067][T13705] ? security_bpf_prog_load+0x60/0x140 [ 195.402635][T13705] ? selinux_bpf_prog_load+0xad/0xd0 [ 195.407958][T13705] ? security_bpf_prog_load+0x9e/0x140 [ 195.413627][T13705] bpf_prog_load+0xf6e/0x1140 [ 195.418583][T13705] ? security_bpf+0x2b/0x90 [ 195.423873][T13705] __sys_bpf+0x469/0x7c0 [ 195.428177][T13705] __x64_sys_bpf+0x41/0x50 [ 195.432750][T13705] x64_sys_call+0x28e1/0x3000 [ 195.437551][T13705] do_syscall_64+0xd8/0x2a0 [ 195.442131][T13705] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.448148][T13705] RIP: 0033:0x7fc69bccf749 [ 195.453536][T13705] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 195.473289][T13705] RSP: 002b:00007fc69a716038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 195.481736][T13705] RAX: ffffffffffffffda RBX: 00007fc69bf26090 RCX: 00007fc69bccf749 [ 195.490587][T13705] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005 [ 195.498760][T13705] RBP: 00007fc69bd53f91 R08: 0000000000000000 R09: 0000000000000000 [ 195.506858][T13705] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 195.515570][T13705] R13: 00007fc69bf26128 R14: 00007fc69bf26090 R15: 00007fff3117a318 [ 195.523712][T13705] [ 195.526740][T13705] ---[ end trace 0000000000000000 ]--- [ 195.533784][T13704] bond0: (slave batadv0): Releasing backup interface [ 195.554660][T13704] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 195.651967][T13728] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3463'. [ 195.661119][T13728] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3463'. [ 195.693405][T13732] netlink: 63503 bytes leftover after parsing attributes in process `syz.5.3464'. [ 195.743058][T13737] bridge0: port 1(bridge_slave_0) entered disabled state [ 195.768919][T13737] bridge_slave_0 (unregistering): left allmulticast mode [ 195.776246][T13737] bridge_slave_0 (unregistering): left promiscuous mode [ 195.784168][T13737] bridge0: port 1(bridge_slave_0) entered disabled state [ 195.799332][T13746] loop8: detected capacity change from 0 to 512 [ 195.806935][T13746] EXT4-fs (loop8): feature flags set on rev 0 fs, running e2fsck is recommended [ 196.785492][ T4373] IPVS: starting estimator thread 0... [ 196.878099][T13809] IPVS: using max 2160 ests per chain, 108000 per kthread [ 196.943156][ T29] audit: type=1326 audit(1764824399.493:4918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13816 comm="syz.2.3494" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 196.974283][ T29] audit: type=1326 audit(1764824399.493:4919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13816 comm="syz.2.3494" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 196.988379][T13819] 8021q: adding VLAN 0 to HW filter on device bond1 [ 196.997990][ T29] audit: type=1326 audit(1764824399.493:4920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13816 comm="syz.2.3494" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 197.028393][ T29] audit: type=1326 audit(1764824399.493:4921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13816 comm="syz.2.3494" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 197.051998][ T29] audit: type=1326 audit(1764824399.493:4922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13816 comm="syz.2.3494" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 197.075552][ T29] audit: type=1326 audit(1764824399.493:4923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13816 comm="syz.2.3494" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 197.099101][ T29] audit: type=1326 audit(1764824399.493:4924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13816 comm="syz.2.3494" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 197.122690][ T29] audit: type=1326 audit(1764824399.493:4925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13816 comm="syz.2.3494" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 197.154980][T13822] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 197.230216][T13827] bridge0: port 1(gretap0) entered blocking state [ 197.236757][T13827] bridge0: port 1(gretap0) entered disabled state [ 197.243453][T13827] gretap0: entered allmulticast mode [ 197.250590][T13827] gretap0: entered promiscuous mode [ 197.258713][T13827] bridge0: port 1(gretap0) entered blocking state [ 197.265273][T13827] bridge0: port 1(gretap0) entered forwarding state [ 197.280136][T13827] gretap0: left allmulticast mode [ 197.286013][T13827] gretap0: left promiscuous mode [ 197.291372][T13827] bridge0: port 1(gretap0) entered disabled state [ 197.377334][T13843] netlink: 'syz.6.3505': attribute type 11 has an invalid length. [ 197.588746][T13876] netlink: 'syz.5.3519': attribute type 6 has an invalid length. [ 197.609446][T13876] netlink: 'syz.5.3519': attribute type 6 has an invalid length. [ 197.737366][T13887] netlink: 'syz.7.3524': attribute type 30 has an invalid length. [ 198.104013][T13932] .`: (slave dummy0): Releasing backup interface [ 198.122062][T13932] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 198.131785][T13932] team0: Failed to send options change via netlink (err -105) [ 198.139391][T13932] team0: Port device dummy0 added [ 198.147639][T13932] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 198.162991][T13932] team0: Failed to send options change via netlink (err -105) [ 198.171164][T13932] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 198.180527][T13932] team0: Port device dummy0 removed [ 198.193001][T13932] .`: (slave dummy0): Enslaving as an active interface with an up link [ 198.279884][T13946] loop5: detected capacity change from 0 to 1024 [ 198.287228][T13946] EXT4-fs: Ignoring removed orlov option [ 198.307849][T13946] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 198.398302][T13962] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 198.503467][T13987] __nla_validate_parse: 11 callbacks suppressed [ 198.503492][T13987] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3543'. [ 198.864481][ T9056] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 198.955874][T14052] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3559'. [ 199.000408][T14062] bridge0: port 1(gretap0) entered blocking state [ 199.006936][T14062] bridge0: port 1(gretap0) entered disabled state [ 199.013734][T14062] gretap0: entered allmulticast mode [ 199.019912][T14062] gretap0: entered promiscuous mode [ 199.025764][T14062] bridge0: port 1(gretap0) entered blocking state [ 199.032258][T14062] bridge0: port 1(gretap0) entered forwarding state [ 199.044875][T14062] gretap0: left allmulticast mode [ 199.049968][T14062] gretap0: left promiscuous mode [ 199.055380][T14062] bridge0: port 1(gretap0) entered disabled state [ 199.078366][T14068] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3565'. [ 199.133968][T14077] syz_tun: entered allmulticast mode [ 199.158117][T14076] syz_tun: left allmulticast mode [ 199.254154][T14087] syzkaller0: entered allmulticast mode [ 199.260344][T14087] syzkaller0: entered promiscuous mode [ 199.271235][T14087] syzkaller0 (unregistering): left allmulticast mode [ 199.277993][T14087] syzkaller0 (unregistering): left promiscuous mode [ 199.455236][T14099] lo speed is unknown, defaulting to 1000 [ 199.596271][T14105] bridge0: port 3(gretap0) entered blocking state [ 199.603469][T14105] bridge0: port 3(gretap0) entered disabled state [ 199.635335][T14105] gretap0: entered allmulticast mode [ 199.670629][T14105] gretap0: entered promiscuous mode [ 199.676052][T14105] bridge0: port 3(gretap0) entered blocking state [ 199.682626][T14105] bridge0: port 3(gretap0) entered forwarding state [ 199.724712][T14109] gretap0: left allmulticast mode [ 199.730631][T14109] gretap0: left promiscuous mode [ 199.735868][T14109] bridge0: port 3(gretap0) entered disabled state [ 199.764747][T14111] validate_nla: 2 callbacks suppressed [ 199.764762][T14111] netlink: 'syz.6.3581': attribute type 30 has an invalid length. [ 199.963593][T14130] netlink: 14 bytes leftover after parsing attributes in process `syz.5.3592'. [ 199.977585][T14132] netlink: 'syz.2.3591': attribute type 4 has an invalid length. [ 199.985418][T14132] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3591'. [ 199.995752][T14130] hsr_slave_0: left promiscuous mode [ 200.010847][T14130] hsr_slave_1: left promiscuous mode [ 200.029896][T14132] .`: renamed from bond0 [ 200.754162][T14153] netlink: 40 bytes leftover after parsing attributes in process `syz.8.3600'. [ 200.774059][T14156] bridge0: port 3(gretap0) entered blocking state [ 200.781383][T14156] bridge0: port 3(gretap0) entered disabled state [ 200.800902][T14156] gretap0: entered allmulticast mode [ 200.825747][T14156] gretap0: entered promiscuous mode [ 200.851304][T14156] bridge0: port 3(gretap0) entered blocking state [ 200.858067][T14156] bridge0: port 3(gretap0) entered forwarding state [ 200.905711][T14159] gretap0: left allmulticast mode [ 200.911090][T14159] gretap0: left promiscuous mode [ 200.916400][T14159] bridge0: port 3(gretap0) entered disabled state [ 200.991354][T14165] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3604'. [ 201.003254][T14165] hsr_slave_0: left promiscuous mode [ 201.004670][ T29] kauditd_printk_skb: 154 callbacks suppressed [ 201.004740][ T29] audit: type=1326 audit(1764824403.555:5080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14168 comm="syz.5.3603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb21674f749 code=0x7ffc0000 [ 201.039514][T14165] hsr_slave_1: left promiscuous mode [ 201.055127][ T29] audit: type=1326 audit(1764824403.555:5081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14168 comm="syz.5.3603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=88 compat=0 ip=0x7fb21674f749 code=0x7ffc0000 [ 201.078937][ T29] audit: type=1326 audit(1764824403.555:5082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14168 comm="syz.5.3603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb21674f749 code=0x7ffc0000 [ 201.102534][ T29] audit: type=1326 audit(1764824403.555:5083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14168 comm="syz.5.3603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=89 compat=0 ip=0x7fb21674f749 code=0x7ffc0000 [ 201.126108][ T29] audit: type=1326 audit(1764824403.555:5084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14168 comm="syz.5.3603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb21674f749 code=0x7ffc0000 [ 201.149716][ T29] audit: type=1326 audit(1764824403.555:5085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14168 comm="syz.5.3603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb21674f749 code=0x7ffc0000 [ 201.173450][ T29] audit: type=1326 audit(1764824403.555:5086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14168 comm="syz.5.3603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fb21674f749 code=0x7ffc0000 [ 201.197501][ T29] audit: type=1326 audit(1764824403.555:5087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14168 comm="syz.5.3603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb21674f749 code=0x7ffc0000 [ 201.221226][ T29] audit: type=1326 audit(1764824403.555:5088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14168 comm="syz.5.3603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb21674f749 code=0x7ffc0000 [ 201.244881][ T29] audit: type=1326 audit(1764824403.555:5089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14168 comm="syz.5.3603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fb21674f749 code=0x7ffc0000 [ 201.341666][T14183] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2660 [ 201.483030][T14200] netlink: 40 bytes leftover after parsing attributes in process `syz.7.3621'. [ 201.661991][T14215] netlink: 14 bytes leftover after parsing attributes in process `syz.6.3624'. [ 201.679738][T14215] hsr_slave_0: left promiscuous mode [ 201.694323][T14215] hsr_slave_1: left promiscuous mode [ 201.792761][T14227] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3630'. [ 202.235528][T14257] hsr_slave_0: left promiscuous mode [ 202.241888][T14257] hsr_slave_1: left promiscuous mode [ 202.278795][T14262] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 202.307015][T14264] netlink: 'syz.2.3646': attribute type 1 has an invalid length. [ 202.322319][T14264] 8021q: adding VLAN 0 to HW filter on device bond0 [ 202.338312][T14264] bond0 (unregistering): Released all slaves [ 202.357996][ T52] netdevsim netdevsim5 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.422206][ T52] netdevsim netdevsim5 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.481683][ T52] netdevsim netdevsim5 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.507431][T14281] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 202.541641][ T52] netdevsim netdevsim5 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.584013][T14271] lo speed is unknown, defaulting to 1000 [ 202.626168][T14291] netlink: 'syz.6.3656': attribute type 5 has an invalid length. [ 202.684937][T14298] loop8: detected capacity change from 0 to 1024 [ 202.692262][T14298] EXT4-fs (loop8): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 202.703286][T14298] EXT4-fs (loop8): ext4_check_descriptors: Checksum for group 0 failed (30349!=20869) [ 202.714853][T14298] EXT4-fs (loop8): invalid journal inode [ 202.721045][T14298] EXT4-fs (loop8): can't get journal size [ 202.728767][T14298] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 202.742091][T14298] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 202.751767][ T52] bridge0 (unregistering): left allmulticast mode [ 202.881373][ T52] .` (unregistering): (slave dummy0): Releasing backup interface [ 202.890797][ T52] .` (unregistering): Released all slaves [ 202.900118][ T52] bond1 (unregistering): (slave bond2): Releasing backup interface [ 202.908089][ T52] bond2 (unregistering): left promiscuous mode [ 202.915155][ T52] bond1 (unregistering): Released all slaves [ 202.925309][ T52] bond2 (unregistering): Released all slaves [ 202.934827][ T52] bond3 (unregistering): Released all slaves [ 202.951079][T14291] batman_adv: batadv0: Adding interface: vxlan0 [ 202.957433][T14291] batman_adv: batadv0: The MTU of interface vxlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 202.984089][T14291] batman_adv: batadv0: Interface activated: vxlan0 [ 203.001093][ T3825] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 203.015784][ T52] tipc: Left network mode [ 203.022926][ T3825] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 203.034467][ T3825] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 203.046068][ T3825] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 203.078239][ T52] batman_adv: batadv0: Interface deactivated: veth1_vlan [ 203.085323][ T52] batman_adv: batadv0: Removing interface: veth1_vlan [ 203.094795][ T52] veth1_macvtap: left promiscuous mode [ 203.101283][ T52] veth0_macvtap: left promiscuous mode [ 203.106786][ T52] veth1_vlan: left promiscuous mode [ 203.112335][ T52] veth0_vlan: left promiscuous mode [ 203.239458][T14271] chnl_net:caif_netlink_parms(): no params data found [ 203.280460][T14271] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.287623][T14271] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.295039][T14271] bridge_slave_0: entered allmulticast mode [ 203.301688][T14271] bridge_slave_0: entered promiscuous mode [ 203.309541][T14271] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.316615][T14271] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.323872][T14271] bridge_slave_1: entered allmulticast mode [ 203.330682][T14271] bridge_slave_1: entered promiscuous mode [ 203.349817][T14271] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 203.360495][T14271] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 203.381880][T14271] team0: Port device team_slave_0 added [ 203.388990][T14271] team0: Port device team_slave_1 added [ 203.405720][T14271] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 203.412804][T14271] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 203.439507][T14271] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 203.451143][T14271] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 203.458181][T14271] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 203.484915][T14271] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 203.515849][T14271] hsr_slave_0: entered promiscuous mode [ 203.521970][T14271] hsr_slave_1: entered promiscuous mode [ 203.593023][T14271] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 203.602540][T14271] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 203.611436][T14271] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 203.620574][T14271] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 203.636612][T14271] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.643830][T14271] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.651234][T14271] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.658385][T14271] bridge0: port 1(bridge_slave_0) entered forwarding state [ 203.687647][T14271] 8021q: adding VLAN 0 to HW filter on device bond0 [ 203.700583][ T3852] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.708649][ T3852] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.721258][T14271] 8021q: adding VLAN 0 to HW filter on device team0 [ 203.731708][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.738785][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 203.751011][ T3852] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.758201][ T3852] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.825782][T14271] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 203.937392][T14271] veth0_vlan: entered promiscuous mode [ 203.945600][T14271] veth1_vlan: entered promiscuous mode [ 203.961499][T14271] veth0_macvtap: entered promiscuous mode [ 203.969338][T14271] veth1_macvtap: entered promiscuous mode [ 203.981931][T14271] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 203.993928][T14271] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 204.005103][ T3845] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.014607][ T3845] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.023676][ T3845] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.032844][ T3845] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.346063][T14353] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.413872][T14353] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.502533][T14353] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.533274][T14375] __nla_validate_parse: 7 callbacks suppressed [ 204.533294][T14375] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3670'. [ 204.551613][T14375] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3670'. [ 204.624401][T14353] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.703786][ T3852] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.733585][ T3852] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.754518][ T3852] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.777353][ T3852] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 204.872446][T14405] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3692'. [ 204.958133][T14408] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.965394][T14408] bridge0: port 1(bridge_slave_0) entered disabled state [ 205.023115][T14408] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 205.036260][T14408] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 205.081379][T14408] bridge0: left allmulticast mode [ 205.086546][T14408] macsec1: left allmulticast mode [ 205.100580][ T3845] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.131208][ T3845] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.157157][ T3845] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.166086][ T3845] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.317106][T14430] lo speed is unknown, defaulting to 1000 [ 205.349462][T14433] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3703'. [ 205.379227][T14436] loop7: detected capacity change from 0 to 1024 [ 205.408264][T14436] EXT4-fs (loop7): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 205.434895][T14436] ext4 filesystem being mounted at /134/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 205.453707][T14439] EXT4-fs error (device loop7): ext4_validate_block_bitmap:441: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 205.518499][T14436] EXT4-fs error (device loop7): ext4_map_blocks:813: inode #15: comm syz.7.3704: lblock 0 mapped to illegal pblock 0 (length 1) [ 205.547371][T14436] EXT4-fs (loop7): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 205.559731][T14436] EXT4-fs (loop7): This should not happen!! Data will be lost [ 205.559731][T14436] [ 205.629403][T12532] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 205.692309][T14451] loop7: detected capacity change from 0 to 512 [ 205.770709][T14451] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 205.787303][T14455] lo speed is unknown, defaulting to 1000 [ 205.811532][T14451] ext4 filesystem being mounted at /136/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 205.844284][T14465] bridge0: port 1(gretap0) entered blocking state [ 205.850821][T14465] bridge0: port 1(gretap0) entered disabled state [ 205.899088][T14465] gretap0: entered allmulticast mode [ 205.927754][T14465] gretap0: entered promiscuous mode [ 205.943926][T14466] gretap0: left allmulticast mode [ 205.949059][T14466] gretap0: left promiscuous mode [ 205.954281][T14466] bridge0: port 1(gretap0) entered disabled state [ 206.050899][T14473] bridge0: port 1(gretap0) entered blocking state [ 206.057437][T14473] bridge0: port 1(gretap0) entered disabled state [ 206.059531][T14451] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 206.063992][ T29] kauditd_printk_skb: 95 callbacks suppressed [ 206.064066][ T29] audit: type=1400 audit(1764824408.617:5185): avc: denied { remount } for pid=14450 comm="syz.7.3709" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 206.074813][T14473] gretap0: entered allmulticast mode [ 206.102788][T14475] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3717'. [ 206.106053][T14473] gretap0: entered promiscuous mode [ 206.113825][T14451] EXT4-fs (loop7): changing journal_checksum during remount not supported; ignoring [ 206.120348][T14476] gretap0: left allmulticast mode [ 206.133321][T14476] gretap0: left promiscuous mode [ 206.138483][T14476] bridge0: port 1(gretap0) entered disabled state [ 206.145450][T14451] EXT4-fs (loop7): re-mounted 00000000-0000-0000-0000-000000000000. [ 206.164339][T14475] 8021q: adding VLAN 0 to HW filter on device bond1 [ 206.233510][T12532] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 206.360534][T14494] syzkaller0: entered allmulticast mode [ 206.370915][T14494] syzkaller0: entered promiscuous mode [ 206.379214][T14494] syzkaller0 (unregistering): left allmulticast mode [ 206.386198][T14494] syzkaller0 (unregistering): left promiscuous mode [ 206.429073][T14502] netlink: 'syz.7.3729': attribute type 1 has an invalid length. [ 206.444525][T14502] 8021q: adding VLAN 0 to HW filter on device bond1 [ 206.463045][T14502] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 206.483276][T14502] bond1: (slave batadv1): making interface the new active one [ 206.498111][T14502] bond1: (slave batadv1): Enslaving as an active interface with an up link [ 206.556702][T14509] No such timeout policy "syz1" [ 206.598355][T14500] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3728'. [ 206.599132][T14516] loop6: detected capacity change from 0 to 164 [ 206.737872][T14532] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3742'. [ 206.753925][T14532] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3742'. [ 206.822070][ T29] audit: type=1326 audit(1764824409.378:5186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14538 comm="syz.2.3745" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 206.856388][ T29] audit: type=1326 audit(1764824409.408:5187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14538 comm="syz.2.3745" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 206.880028][ T29] audit: type=1326 audit(1764824409.408:5188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14538 comm="syz.2.3745" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 206.903555][ T29] audit: type=1326 audit(1764824409.408:5189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14538 comm="syz.2.3745" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 206.927228][ T29] audit: type=1326 audit(1764824409.408:5190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14538 comm="syz.2.3745" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 206.950878][ T29] audit: type=1326 audit(1764824409.408:5191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14538 comm="syz.2.3745" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 206.974474][ T29] audit: type=1326 audit(1764824409.408:5192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14538 comm="syz.2.3745" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 206.998130][ T29] audit: type=1326 audit(1764824409.408:5193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14538 comm="syz.2.3745" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 207.021821][ T29] audit: type=1326 audit(1764824409.408:5194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14538 comm="syz.2.3745" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 207.199613][T14550] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3750'. [ 207.226509][T14552] netlink: 'syz.2.3751': attribute type 30 has an invalid length. [ 207.556678][T14572] netlink: '+}[@': attribute type 10 has an invalid length. [ 207.573654][T14572] team0 (unregistering): Port device team_slave_0 removed [ 207.584432][T14572] team0 (unregistering): Port device team_slave_1 removed [ 207.594591][T14574] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3761'. [ 207.716945][T14584] loop9: detected capacity change from 0 to 1764 [ 207.805250][T14589] netlink: 'syz.9.3768': attribute type 1 has an invalid length. [ 207.822723][T14589] bond0: (slave bond_slave_0): Releasing backup interface [ 208.035794][T14605] syz_tun: entered allmulticast mode [ 208.043683][T14604] syz_tun: left allmulticast mode [ 208.191686][T14618] can0: slcan on ptm1. [ 208.245738][T14618] can0 (unregistered): slcan off ptm1. [ 208.618486][T14632] loop6: detected capacity change from 0 to 8192 [ 208.629247][T14632] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 209.401196][T14677] ip6gre1: entered allmulticast mode [ 209.515718][T14687] pimreg: entered allmulticast mode [ 209.527670][T14687] pimreg: left allmulticast mode [ 209.632454][T14692] loop9: detected capacity change from 0 to 512 [ 209.655182][T14692] EXT4-fs: Ignoring removed i_version option [ 209.661301][T14692] EXT4-fs: Ignoring removed bh option [ 209.703334][T14692] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 209.742558][T14692] ext4 filesystem being mounted at /26/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 209.786936][T14271] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 209.982309][T14706] __nla_validate_parse: 4 callbacks suppressed [ 209.982329][T14706] netlink: 24 bytes leftover after parsing attributes in process `syz.9.3818'. [ 210.130982][T14712] loop6: detected capacity change from 0 to 2048 [ 210.168814][T14712] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 210.255690][T12493] EXT4-fs error (device loop6): ext4_validate_block_bitmap:441: comm syz-executor: bg 0: block 234: padding at end of block bitmap is not set [ 210.270704][T12493] EXT4-fs error (device loop6) in ext4_mb_clear_bb:6667: Corrupt filesystem [ 210.290787][T12493] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 210.798596][T14747] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3835'. [ 210.819845][T14747] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 210.827340][T14747] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 210.842031][T14747] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 210.849716][T14747] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 210.875994][T14751] netlink: 'syz.6.3837': attribute type 10 has an invalid length. [ 210.884139][T14751] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.891320][T14751] bridge0: port 1(bridge_slave_0) entered disabled state [ 210.903722][T14751] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.910908][T14751] bridge0: port 2(bridge_slave_1) entered forwarding state [ 210.918772][T14751] bridge0: port 1(bridge_slave_0) entered blocking state [ 210.926086][T14751] bridge0: port 1(bridge_slave_0) entered forwarding state [ 210.936525][T14751] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 210.984705][T14753] loop7: detected capacity change from 0 to 7 [ 211.153274][T14760] netlink: 'syz.7.3841': attribute type 1 has an invalid length. [ 211.162483][T14760] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 211.173956][T14762] loop9: detected capacity change from 0 to 128 [ 211.301939][ T29] kauditd_printk_skb: 622 callbacks suppressed [ 211.301955][ T29] audit: type=1400 audit(1764824413.850:5817): avc: denied { bind } for pid=14768 comm="syz.7.3845" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 211.352872][ T29] audit: type=1400 audit(1764824413.880:5818): avc: denied { listen } for pid=14768 comm="syz.7.3845" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 211.448822][T14774] netlink: 24 bytes leftover after parsing attributes in process `syz.9.3846'. [ 211.460472][T14776] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3847'. [ 211.546179][T14779] netlink: 48 bytes leftover after parsing attributes in process `syz.9.3846'. [ 211.752232][ T29] audit: type=1326 audit(1764824414.300:5819): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14795 comm="syz.2.3855" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 211.776072][ T29] audit: type=1326 audit(1764824414.300:5820): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14795 comm="syz.2.3855" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 211.799659][ T29] audit: type=1326 audit(1764824414.300:5821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14795 comm="syz.2.3855" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 211.823274][ T29] audit: type=1326 audit(1764824414.300:5822): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14795 comm="syz.2.3855" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 211.847051][ T29] audit: type=1326 audit(1764824414.300:5823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14795 comm="syz.2.3855" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 211.889315][ T29] audit: type=1326 audit(1764824414.400:5824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14795 comm="syz.2.3855" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 211.912893][ T29] audit: type=1326 audit(1764824414.400:5825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14795 comm="syz.2.3855" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 211.936508][ T29] audit: type=1326 audit(1764824414.420:5826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14795 comm="syz.2.3855" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 212.030448][T14812] loop6: detected capacity change from 0 to 512 [ 212.037762][T14812] EXT4-fs: Ignoring removed nobh option [ 212.083048][T14812] EXT4-fs (loop6): failed to initialize system zone (-117) [ 212.102730][T14812] EXT4-fs (loop6): mount failed [ 212.201292][T14827] loop9: detected capacity change from 0 to 512 [ 212.319981][T14827] ext4: Unknown parameter 'init_itable"jqfmt' [ 212.409618][T14830] loop9: detected capacity change from 0 to 1024 [ 212.436248][T14830] EXT4-fs error (device loop9): __ext4_fill_super:5512: inode #2: comm syz.9.3870: iget: checksum invalid [ 212.447897][T14830] EXT4-fs (loop9): get root inode failed [ 212.453706][T14830] EXT4-fs (loop9): mount failed [ 212.481513][T14830] futex_wake_op: syz.9.3870 tries to shift op by -1; fix this program [ 212.498570][T14838] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3871'. [ 212.508326][T14838] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3871'. [ 212.518326][T14838] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3871'. [ 212.528511][T14838] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3871'. [ 212.538275][T14838] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3871'. [ 212.852639][T14850] IPv6: Can't replace route, no match found [ 212.925022][T14856] loop6: detected capacity change from 0 to 1024 [ 212.935068][T14856] loop6: detected capacity change from 0 to 128 [ 212.944362][T14856] FAT-fs (loop6): error, invalid access to FAT (entry 0x00000100) [ 212.952230][T14856] FAT-fs (loop6): Filesystem has been set read-only [ 212.959754][T14856] bio_check_eod: 103 callbacks suppressed [ 212.959769][T14856] syz.6.3879: attempt to access beyond end of device [ 212.959769][T14856] loop6: rw=524288, sector=2065, nr_sectors = 8 limit=128 [ 212.979812][T14856] FAT-fs (loop6): error, invalid access to FAT (entry 0x00000100) [ 212.987703][T14856] FAT-fs (loop6): error, invalid access to FAT (entry 0x00000100) [ 212.996503][T14856] syz.6.3879: attempt to access beyond end of device [ 212.996503][T14856] loop6: rw=0, sector=2065, nr_sectors = 8 limit=128 [ 213.009985][T14857] syz.6.3879: attempt to access beyond end of device [ 213.009985][T14857] loop6: rw=0, sector=2065, nr_sectors = 1 limit=128 [ 213.023320][T14857] Buffer I/O error on dev loop6, logical block 2065, async page read [ 213.048821][T14857] syz.6.3879: attempt to access beyond end of device [ 213.048821][T14857] loop6: rw=0, sector=2066, nr_sectors = 1 limit=128 [ 213.062279][T14857] Buffer I/O error on dev loop6, logical block 2066, async page read [ 213.082647][T14857] syz.6.3879: attempt to access beyond end of device [ 213.082647][T14857] loop6: rw=0, sector=2067, nr_sectors = 1 limit=128 [ 213.096710][T14857] Buffer I/O error on dev loop6, logical block 2067, async page read [ 213.110230][T14857] syz.6.3879: attempt to access beyond end of device [ 213.110230][T14857] loop6: rw=0, sector=2068, nr_sectors = 1 limit=128 [ 213.124266][T14857] Buffer I/O error on dev loop6, logical block 2068, async page read [ 213.138656][T14857] syz.6.3879: attempt to access beyond end of device [ 213.138656][T14857] loop6: rw=0, sector=2069, nr_sectors = 1 limit=128 [ 213.152066][T14857] Buffer I/O error on dev loop6, logical block 2069, async page read [ 213.164967][T14862] gtp1: entered promiscuous mode [ 213.165929][T14857] syz.6.3879: attempt to access beyond end of device [ 213.165929][T14857] loop6: rw=0, sector=2070, nr_sectors = 1 limit=128 [ 213.184010][T14857] Buffer I/O error on dev loop6, logical block 2070, async page read [ 213.195826][T14857] syz.6.3879: attempt to access beyond end of device [ 213.195826][T14857] loop6: rw=0, sector=2071, nr_sectors = 1 limit=128 [ 213.209178][T14857] Buffer I/O error on dev loop6, logical block 2071, async page read [ 213.218556][T14857] syz.6.3879: attempt to access beyond end of device [ 213.218556][T14857] loop6: rw=0, sector=2072, nr_sectors = 1 limit=128 [ 213.231869][T14857] Buffer I/O error on dev loop6, logical block 2072, async page read [ 213.240148][T14856] Buffer I/O error on dev loop6, logical block 2065, async page read [ 213.257172][T14864] loop7: detected capacity change from 0 to 1024 [ 213.265053][T14864] EXT4-fs (loop7): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 213.276037][T14864] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 213.285886][T14856] Buffer I/O error on dev loop6, logical block 2066, async page read [ 213.300690][T14864] JBD2: no valid journal superblock found [ 213.306705][T14864] EXT4-fs (loop7): Could not load journal inode [ 213.325499][T14864] SELinux: security_context_str_to_sid (Ð-šXܘ7.H\¹ÿ %ºu@) failed with errno=-22 [ 213.536073][T14876] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 213.562932][T14876] vhci_hcd: invalid port number 96 [ 213.568119][T14876] vhci_hcd: default hub control req: 0300 vfffa i0060 l0 [ 213.588688][T14877] loop9: detected capacity change from 0 to 128 [ 213.626846][T14877] EXT4-fs (loop9): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 213.687393][T14877] ext4 filesystem being mounted at /57/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 213.832060][T14271] EXT4-fs (loop9): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 213.905754][T14892] netlink: 'syz.2.3895': attribute type 3 has an invalid length. [ 214.079540][T14898] loop9: detected capacity change from 0 to 8192 [ 214.430293][T14907] netlink: 'syz.7.3901': attribute type 13 has an invalid length. [ 214.470539][T14907] gretap0: refused to change device tx_queue_len [ 214.476993][T14907] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 214.502675][T14911] netlink: 'syz.9.3900': attribute type 2 has an invalid length. [ 214.523300][T14912] loop7: detected capacity change from 0 to 512 [ 214.545640][T14912] FAT-fs (loop7): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 214.734292][T14920] loop9: detected capacity change from 0 to 512 [ 214.753206][T14920] EXT4-fs (loop9): encrypted files will use data=ordered instead of data journaling mode [ 214.784574][T14920] EXT4-fs error (device loop9): ext4_free_branches:1023: inode #16: comm syz.9.3905: invalid indirect mapped block 4294967295 (level 0) [ 214.822775][T14920] EXT4-fs error (device loop9): ext4_free_branches:1023: inode #16: comm syz.9.3905: invalid indirect mapped block 4294967295 (level 1) [ 214.861787][T14920] EXT4-fs (loop9): 1 orphan inode deleted [ 214.867696][T14920] EXT4-fs (loop9): 1 truncate cleaned up [ 214.876536][T14929] netlink: 'syz.7.3909': attribute type 7 has an invalid length. [ 214.923483][T14920] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 214.999682][T14271] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 215.044960][T14941] __nla_validate_parse: 3 callbacks suppressed [ 215.044980][T14941] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3913'. [ 215.103338][T14942] vhci_hcd: invalid port number 9 [ 215.108402][T14942] vhci_hcd: invalid port number 9 [ 215.148046][T14949] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 215.167505][T14948] veth2: entered promiscuous mode [ 215.172718][T14948] veth2: entered allmulticast mode [ 215.625258][T14967] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3925'. [ 215.730748][T14969] loop6: detected capacity change from 0 to 128 [ 215.776784][T14969] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 215.807325][T14969] ext4 filesystem being mounted at /162/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 215.859258][T14962] Set syz1 is full, maxelem 65536 reached [ 215.883716][T14969] EXT4-fs error (device loop6): htree_dirblock_to_tree:1080: inode #2: block 4: comm syz.6.3926: bad entry in directory: inode out of bounds - offset=1012, inode=128, rec_len=12, size=1024 fake=1 [ 215.906351][T14969] EXT4-fs error (device loop6): htree_dirblock_to_tree:1080: inode #2: block 4: comm syz.6.3926: bad entry in directory: inode out of bounds - offset=1012, inode=128, rec_len=12, size=1024 fake=1 [ 215.941040][T12493] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 216.037065][T14984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 216.049242][T14984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 216.077999][ T3495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 216.085525][ T3495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 216.093010][ T3495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 216.100727][ T3495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 216.108975][ T3495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 216.116601][ T3495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 216.124050][ T3495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 216.131514][ T3495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 216.139613][ T3495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 216.147165][ T3495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 216.162514][ T3495] hid-generic 0000:0000:0000.0002: hidraw0: HID v8.00 Device [syz0] on syz0 [ 216.875131][T15070] netlink: 96 bytes leftover after parsing attributes in process `syz.7.3943'. [ 217.027018][T15094] 0ªX¹¦À: left allmulticast mode [ 217.032949][T15094] batadv0: left promiscuous mode [ 217.038006][T15094] batadv0: left allmulticast mode [ 217.046288][T15094] bond1: left promiscuous mode [ 217.051467][T15094] team1: left promiscuous mode [ 217.056361][T15094] team1: left allmulticast mode [ 217.076503][T15094] bond4: left promiscuous mode [ 217.081504][T15094] bond5: left promiscuous mode [ 217.091940][T15104] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15104 comm=syz.7.3948 [ 217.136048][T15094] ip6gre1: left allmulticast mode [ 217.146740][T15094] gtp1: left promiscuous mode [ 217.380828][T15143] loop7: detected capacity change from 0 to 512 [ 217.393678][T15143] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 217.413731][T15143] EXT4-fs (loop7): 1 truncate cleaned up [ 217.426738][T15143] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 217.601780][T12532] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 217.879975][ T29] kauditd_printk_skb: 54 callbacks suppressed [ 217.879993][ T29] audit: type=1400 audit(1764824420.433:5881): avc: denied { bind } for pid=15191 comm="syz.7.3964" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 217.972820][ T29] audit: type=1400 audit(1764824420.523:5882): avc: denied { mounton } for pid=15201 comm="syz.2.3968" path="/file0" dev="ramfs" ino=43576 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 218.183839][T15216] uprobe: syz.7.3973:15216 failed to unregister, leaking uprobe [ 218.329387][T15222] loop7: detected capacity change from 0 to 128 [ 218.352141][T15222] bio_check_eod: 15552 callbacks suppressed [ 218.352159][T15222] syz.7.3977: attempt to access beyond end of device [ 218.352159][T15222] loop7: rw=2049, sector=154, nr_sectors = 6 limit=128 [ 218.389267][T15222] syz.7.3977: attempt to access beyond end of device [ 218.389267][T15222] loop7: rw=2049, sector=158, nr_sectors = 2 limit=128 [ 218.402794][T15222] buffer_io_error: 15550 callbacks suppressed [ 218.402819][T15222] Buffer I/O error on dev loop7, logical block 79, lost async page write [ 218.418398][T15222] syz.7.3977: attempt to access beyond end of device [ 218.418398][T15222] loop7: rw=2049, sector=160, nr_sectors = 2 limit=128 [ 218.431990][T15222] Buffer I/O error on dev loop7, logical block 80, lost async page write [ 218.445266][ T29] audit: type=1326 audit(1764824420.994:5883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.6.3980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc69bccf749 code=0x7ffc0000 [ 218.469383][ T29] audit: type=1326 audit(1764824420.994:5884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.6.3980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc69bccf749 code=0x7ffc0000 [ 218.493304][ T29] audit: type=1326 audit(1764824420.994:5885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.6.3980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc69bccf749 code=0x7ffc0000 [ 218.518472][ T29] audit: type=1326 audit(1764824420.994:5886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.6.3980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc69bccf749 code=0x7ffc0000 [ 218.542478][ T29] audit: type=1326 audit(1764824420.994:5887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.6.3980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc69bccf749 code=0x7ffc0000 [ 218.566153][ T29] audit: type=1326 audit(1764824420.994:5888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.6.3980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc69bccf749 code=0x7ffc0000 [ 218.589744][ T29] audit: type=1326 audit(1764824420.994:5889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.6.3980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc69bccf749 code=0x7ffc0000 [ 218.596517][T15231] SELinux: policydb magic number 0x2 does not match expected magic number 0xf97cff8c [ 218.613450][ T29] audit: type=1326 audit(1764824420.994:5890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15227 comm="syz.6.3980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc69bccf749 code=0x7ffc0000 [ 218.648526][T15222] syz.7.3977: attempt to access beyond end of device [ 218.648526][T15222] loop7: rw=2049, sector=162, nr_sectors = 6 limit=128 [ 218.668026][T15222] syz.7.3977: attempt to access beyond end of device [ 218.668026][T15222] loop7: rw=2049, sector=166, nr_sectors = 2 limit=128 [ 218.682586][T15222] Buffer I/O error on dev loop7, logical block 83, lost async page write [ 218.691479][T15231] SELinux: failed to load policy [ 218.696758][T15222] syz.7.3977: attempt to access beyond end of device [ 218.696758][T15222] loop7: rw=2049, sector=168, nr_sectors = 2 limit=128 [ 218.711119][T15222] Buffer I/O error on dev loop7, logical block 84, lost async page write [ 218.722688][T15222] syz.7.3977: attempt to access beyond end of device [ 218.722688][T15222] loop7: rw=2049, sector=186, nr_sectors = 6 limit=128 [ 218.739713][T15222] syz.7.3977: attempt to access beyond end of device [ 218.739713][T15222] loop7: rw=2049, sector=190, nr_sectors = 2 limit=128 [ 218.753948][T15222] Buffer I/O error on dev loop7, logical block 95, lost async page write [ 218.762628][T15222] syz.7.3977: attempt to access beyond end of device [ 218.762628][T15222] loop7: rw=2049, sector=192, nr_sectors = 2 limit=128 [ 218.776342][T15222] Buffer I/O error on dev loop7, logical block 96, lost async page write [ 218.801987][T15222] syz.7.3977: attempt to access beyond end of device [ 218.801987][T15222] loop7: rw=2049, sector=194, nr_sectors = 6 limit=128 [ 218.823906][T15222] Buffer I/O error on dev loop7, logical block 99, lost async page write [ 218.832811][T15222] Buffer I/O error on dev loop7, logical block 100, lost async page write [ 218.843177][T15222] Buffer I/O error on dev loop7, logical block 111, lost async page write [ 218.851841][T15222] Buffer I/O error on dev loop7, logical block 112, lost async page write [ 219.135265][T15267] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3995'. [ 219.238654][T15275] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3999'. [ 219.240884][T15277] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=44816 sclass=netlink_route_socket pid=15277 comm=syz.9.4000 [ 219.253064][T15279] netlink: 'syz.2.4001': attribute type 1 has an invalid length. [ 219.268381][T15279] netlink: 'syz.2.4001': attribute type 4 has an invalid length. [ 219.276875][T15279] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.4001'. [ 219.286129][T15275] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 219.327018][T15284] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4003'. [ 219.338619][T15279] netlink: 'syz.2.4001': attribute type 1 has an invalid length. [ 219.346431][T15279] netlink: 'syz.2.4001': attribute type 4 has an invalid length. [ 219.354299][T15279] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.4001'. [ 219.424468][T15287] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4004'. [ 220.183212][T15328] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4021'. [ 220.192386][T15324] loop6: detected capacity change from 0 to 8192 [ 220.230177][T15324] loop6: p1 < > p2 < > p3 p4 < > [ 220.235257][T15324] loop6: partition table partially beyond EOD, truncated [ 220.243547][T15324] loop6: p1 start 67108864 is beyond EOD, truncated [ 220.251602][T15324] loop6: p3 start 100859904 is beyond EOD, truncated [ 220.325507][T15333] netlink: 'syz.7.4023': attribute type 1 has an invalid length. [ 220.341847][T15333] 8021q: adding VLAN 0 to HW filter on device bond2 [ 220.365377][T15333] bond2: (slave ip6gretap1): making interface the new active one [ 220.375229][T15333] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 221.543073][T15373] loop7: detected capacity change from 0 to 1024 [ 221.579451][T15373] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 221.593049][T15373] ext4 filesystem being mounted at /224/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 221.670391][T12532] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.734286][T15385] loop9: detected capacity change from 0 to 512 [ 221.781824][T15385] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 221.839352][T15385] ext4 filesystem being mounted at /89/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 222.022700][T15400] netdevsim netdevsim6 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 222.033231][T15400] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.122845][T15400] netdevsim netdevsim6 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 222.134013][T15400] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.184943][T15400] netdevsim netdevsim6 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 222.195308][T15400] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.282719][T15400] netdevsim netdevsim6 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 222.293090][T15400] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.362800][ T3813] netdevsim netdevsim6 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 222.371348][ T3813] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.431777][ T3813] netdevsim netdevsim6 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 222.441168][ T3813] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.463986][ T3813] netdevsim netdevsim6 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 222.473140][ T3813] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.481748][ T3813] netdevsim netdevsim6 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 222.489992][ T3813] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 223.124412][T14271] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 223.243310][T15441] loop7: detected capacity change from 0 to 1024 [ 223.279817][T15441] EXT4-fs (loop7): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 223.313760][T15441] ext4 filesystem being mounted at /238/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 223.343037][T15441] EXT4-fs error (device loop7): ext4_map_blocks:813: inode #15: comm syz.7.4077: lblock 0 mapped to illegal pblock 0 (length 6) [ 223.358536][T15451] netlink: 12 bytes leftover after parsing attributes in process `syz.9.4070'. [ 223.408293][T15441] EXT4-fs (loop7): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 6 with error 117 [ 223.420795][T15441] EXT4-fs (loop7): This should not happen!! Data will be lost [ 223.420795][T15441] [ 223.451955][T15453] EXT4-fs error (device loop7): ext4_map_blocks:777: inode #15: comm syz.7.4077: lblock 0 mapped to illegal pblock 0 (length 1) [ 223.486707][T15453] EXT4-fs error (device loop7): ext4_ext_remove_space:2955: inode #15: comm syz.7.4077: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 223.527545][T15453] EXT4-fs error (device loop7) in ext4_setattr:6046: Corrupt filesystem [ 223.599388][T12532] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 223.610557][T15463] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4074'. [ 223.823336][ T2969] hid_parser_main: 19 callbacks suppressed [ 223.823360][ T2969] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 223.839027][ T2969] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 224.144033][T15483] lo speed is unknown, defaulting to 1000 [ 224.254221][T15501] bond0: (slave dummy0): Releasing backup interface [ 224.283442][T15501] bridge_slave_1: left allmulticast mode [ 224.289177][T15501] bridge_slave_1: left promiscuous mode [ 224.294965][T15501] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.303430][T15502] netlink: 'syz.7.4087': attribute type 10 has an invalid length. [ 224.312001][T15502] netlink: 40 bytes leftover after parsing attributes in process `syz.7.4087'. [ 224.334157][T15501] bond0: (slave bond_slave_0): Releasing backup interface [ 224.366501][T15501] bond0: (slave bond_slave_1): Releasing backup interface [ 224.383972][T15501] team0: Port device team_slave_0 removed [ 224.395460][T15501] team0: Port device team_slave_1 removed [ 224.403364][T15501] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 224.410820][T15501] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 224.420862][T15501] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 224.428556][T15501] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 224.438757][T15501] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 224.582170][T15483] chnl_net:caif_netlink_parms(): no params data found [ 224.710601][T15483] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.717934][T15483] bridge0: port 1(bridge_slave_0) entered disabled state [ 224.729849][T15483] bridge_slave_0: entered allmulticast mode [ 224.736739][T15483] bridge_slave_0: entered promiscuous mode [ 224.755754][T15483] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.763178][T15483] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.770849][T15483] bridge_slave_1: entered allmulticast mode [ 224.779483][T15483] bridge_slave_1: entered promiscuous mode [ 224.803460][T15529] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4097'. [ 224.815370][T15483] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 224.826928][T15483] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 224.844318][T15532] veth2: entered promiscuous mode [ 224.849464][T15532] veth2: entered allmulticast mode [ 224.913278][T15483] team0: Port device team_slave_0 added [ 224.925345][T15483] team0: Port device team_slave_1 added [ 224.949250][T15541] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4102'. [ 224.968119][T15483] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 224.975131][T15483] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 225.001321][T15483] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 225.016735][T15483] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 225.023858][T15483] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 225.023928][T15545] loop7: detected capacity change from 0 to 512 [ 225.050079][T15483] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 225.068138][T15541] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4102'. [ 225.154211][T15483] hsr_slave_0: entered promiscuous mode [ 225.160725][T15483] hsr_slave_1: entered promiscuous mode [ 225.166792][T15483] debugfs: 'hsr0' already exists in 'hsr' [ 225.172624][T15483] Cannot create hsr debugfs directory [ 225.284138][T15558] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4109'. [ 225.504583][T15571] xt_hashlimit: max too large, truncated to 1048576 [ 225.525648][T15573] netlink: 63503 bytes leftover after parsing attributes in process `syz.9.4116'. [ 225.594056][T15483] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 225.620644][T15483] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 225.643277][T15483] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 225.657212][ T6672] page_pool_release_retry() stalled pool shutdown: id 26, 50 inflight 181 sec [ 225.672808][T15483] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 225.785632][ T29] kauditd_printk_skb: 134 callbacks suppressed [ 225.785649][ T29] audit: type=1326 audit(1764824428.347:6025): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15591 comm="syz.2.4121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 225.850782][T15483] 8021q: adding VLAN 0 to HW filter on device bond0 [ 225.867142][ T29] audit: type=1326 audit(1764824428.387:6026): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15591 comm="syz.2.4121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=238 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 225.891998][ T29] audit: type=1326 audit(1764824428.387:6027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15591 comm="syz.2.4121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 225.916430][ T29] audit: type=1326 audit(1764824428.387:6028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15591 comm="syz.2.4121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 225.940278][ T29] audit: type=1326 audit(1764824428.387:6029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15591 comm="syz.2.4121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 225.969962][ T29] audit: type=1326 audit(1764824428.387:6030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15591 comm="syz.2.4121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 225.993656][ T29] audit: type=1326 audit(1764824428.387:6031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15591 comm="syz.2.4121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 225.994041][T15483] 8021q: adding VLAN 0 to HW filter on device team0 [ 226.017665][ T29] audit: type=1326 audit(1764824428.387:6032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15591 comm="syz.2.4121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 226.017710][ T29] audit: type=1326 audit(1764824428.387:6033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15591 comm="syz.2.4121" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f721387f749 code=0x7ffc0000 [ 226.169158][T15581] netlink: 7 bytes leftover after parsing attributes in process `syz.7.4119'. [ 226.253426][ T3815] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.260549][ T3815] bridge0: port 1(bridge_slave_0) entered forwarding state [ 226.294759][ T3815] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.301889][ T3815] bridge0: port 2(bridge_slave_1) entered forwarding state [ 226.587851][T15483] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 226.846661][T15483] veth0_vlan: entered promiscuous mode [ 226.887361][T15483] veth1_vlan: entered promiscuous mode [ 226.964912][T15483] veth0_macvtap: entered promiscuous mode [ 226.980202][T15483] veth1_macvtap: entered promiscuous mode [ 226.999419][ T29] audit: type=1326 audit(1764824429.568:6034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15670 comm="syz.2.4145" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f72138765e7 code=0x7ffc0000 [ 227.028072][T15483] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 227.049026][T15483] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 227.066888][ T3840] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.089858][ T3840] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.128706][ T3875] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.153535][ T2025] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.399799][T15699] xt_CT: You must specify a L4 protocol and not use inversions on it [ 227.687263][T15724] netlink: 'syz.6.4167': attribute type 14 has an invalid length. [ 227.719074][T15729] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.768578][T15729] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.837374][T15729] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.897722][T15729] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.999470][ T53] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.018146][ T53] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.053262][ T53] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.086379][ T53] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.206663][T15750] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4178'. [ 228.261244][T15754] netlink: 83992 bytes leftover after parsing attributes in process `syz.9.4180'. [ 228.282284][T15754] netlink: zone id is out of range [ 228.288285][T15754] netlink: zone id is out of range [ 228.323378][T15754] netlink: set zone limit has 8 unknown bytes [ 228.932061][T15786] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4192'. [ 229.003698][T15788] bridge0: entered promiscuous mode [ 229.009474][T15788] macsec1: entered promiscuous mode [ 229.017143][T15788] bridge0: port 3(macsec1) entered blocking state [ 229.023721][T15788] bridge0: port 3(macsec1) entered disabled state [ 229.030980][T15788] macsec1: entered allmulticast mode [ 229.036397][T15788] bridge0: entered allmulticast mode [ 229.043824][T15788] macsec1: left allmulticast mode [ 229.049013][T15788] bridge0: left allmulticast mode [ 229.055239][T15788] bridge0: left promiscuous mode [ 229.405428][T15808] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4204'. [ 229.425305][T15810] random: crng reseeded on system resumption [ 229.444623][T15810] Restarting kernel threads ... [ 229.477217][T15810] Done restarting kernel threads. [ 229.772223][T15831] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4216'. [ 229.808047][T15836] wireguard0: entered promiscuous mode [ 229.813677][T15836] wireguard0: entered allmulticast mode [ 229.868667][T15845] random: crng reseeded on system resumption [ 229.880448][T15845] Restarting kernel threads ... [ 229.886213][T15845] Done restarting kernel threads. [ 229.938143][T15853] veth4: entered promiscuous mode [ 229.943339][T15853] veth4: entered allmulticast mode [ 230.089923][T15880] netlink: 'syz.2.4234': attribute type 39 has an invalid length. [ 230.469458][T15888] random: crng reseeded on system resumption [ 230.490402][T15888] Restarting kernel threads ... [ 230.500213][T15888] Done restarting kernel threads. [ 230.542800][T15891] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4237'. [ 230.599823][T15901] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4241'. [ 230.609726][T15901] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4241'. [ 230.618829][T15901] netlink: 'syz.9.4241': attribute type 6 has an invalid length. [ 230.640644][T15901] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4241'. [ 230.649715][T15901] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4241'. [ 230.658708][T15901] netlink: 'syz.9.4241': attribute type 6 has an invalid length. [ 230.700456][T15896] ================================================================== [ 230.704615][T15906] syzkaller0: entered allmulticast mode [ 230.708606][T15896] BUG: KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read [ 230.722816][T15896] [ 230.725166][T15896] write to 0xffff888136e4cca8 of 8 bytes by task 15904 on cpu 0: [ 230.729584][T15906] syzkaller0: entered promiscuous mode [ 230.732906][T15896] shmem_file_splice_read+0x470/0x600 [ 230.743857][T15896] splice_direct_to_actor+0x26f/0x680 [ 230.749442][T15896] do_splice_direct+0xda/0x150 [ 230.754400][T15896] do_sendfile+0x380/0x650 [ 230.758937][T15896] __x64_sys_sendfile64+0x105/0x150 [ 230.764158][T15896] x64_sys_call+0x2db1/0x3000 [ 230.768873][T15896] do_syscall_64+0xd8/0x2a0 [ 230.773411][T15896] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.779327][T15896] [ 230.781664][T15896] write to 0xffff888136e4cca8 of 8 bytes by task 15896 on cpu 1: [ 230.789402][T15896] shmem_file_splice_read+0x470/0x600 [ 230.794819][T15896] splice_direct_to_actor+0x26f/0x680 [ 230.800230][T15896] do_splice_direct+0xda/0x150 [ 230.805037][T15896] do_sendfile+0x380/0x650 [ 230.809474][T15896] __x64_sys_sendfile64+0x105/0x150 [ 230.814755][T15896] x64_sys_call+0x2db1/0x3000 [ 230.819488][T15896] do_syscall_64+0xd8/0x2a0 [ 230.824209][T15896] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.830220][T15896] [ 230.832562][T15896] value changed: 0x0000000000000671 -> 0x0000000000000672 [ 230.839703][T15896] [ 230.842047][T15896] Reported by Kernel Concurrency Sanitizer on: [ 230.848235][T15896] CPU: 1 UID: 0 PID: 15896 Comm: syz.3.4239 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 230.859803][T15896] Tainted: [W]=WARN [ 230.863628][T15896] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 230.873890][T15896] ================================================================== [ 230.924958][T15906] syzkaller0 (unregistering): left allmulticast mode [ 230.931854][T15906] syzkaller0 (unregistering): left promiscuous mode