last executing test programs: 1.755943348s ago: executing program 0 (id=97): r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x1}}, 0x10, 0x0}, 0x20008000) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000040)=[{0x9, 0x2, 0x6b, 0x4}, {0x81, 0x7f, 0xf7, 0x5}]}, 0x10) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x33, &(0x7f00000011c0)={0x1, &(0x7f0000000680)=[{0x6, 0x4, 0x0, 0x2}]}, 0x10) listen(r2, 0xb) ptrace(0x10, r1) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x804) ptrace$setregs(0x1a, r1, 0xc, &(0x7f0000000040)) r3 = fcntl$getown(r0, 0x9) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r4, 0x25, &(0x7f0000000140)={0x2, 0x0, 0x3, 0x6, r3}) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0x10) ioctl$AUTOFS_IOC_EXPIRE(r4, 0x810c9365, &(0x7f0000000180)={{0xc17, 0x7}, 0x100, './file0\x00'}) 1.543636986s ago: executing program 0 (id=103): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x607}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2000000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) r2 = inotify_init() r3 = creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) inotify_add_watch(r2, &(0x7f0000000200)='./file0\x00', 0x400008bf) write$binfmt_elf32(r3, &(0x7f0000000040)=ANY=[], 0x69) close(r3) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 1.525358427s ago: executing program 1 (id=104): r0 = socket(0x2, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000280)={'bridge0\x00', &(0x7f00000000c0)=@ethtool_cmd={0x1, 0x9, 0x8, 0x82e8, 0x2, 0x2, 0x4, 0x9, 0x8, 0x1, 0x5, 0x3, 0x5ef, 0x9, 0xbe, 0xd1, [0x3, 0xf2]}}) (fail_nth: 6) 1.524925607s ago: executing program 2 (id=105): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000080000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000400)='f2fs_write_end\x00', r1, 0x0, 0xffffffffffffffff}, 0x18) socketpair(0x0, 0x6, 0xfffffff9, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x403, 0x0, 0x0, 0x0, 0x72}, [@call={0x85, 0x0, 0x0, 0x89}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$ext4(&(0x7f0000001140)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x410c84, &(0x7f0000000340), 0x1, 0x785, &(0x7f0000001900)="$eJzs3c9rHGUfAPDvbJImTfO+yQsvaD0FBA2UbkyNrYKHigcRLBT0bLtstqFmky3ZTWlCwBYRvAgqHgS99OyPevPqj6v+Fx7EUjUtVjxIZDYz7bbZ/GySrebzgck+z8xsnue788zMMzsPswHsW8Ppn0LE4Yh4L4kYzOYnEdHTTHVHnFxZ7/bSYjmdkhiIV39NmuvcWlosR8t7UoeyzKMR8e3bEUcKq8utzy9MlarVymyWH21MXxitzy8cPT9dmqxMVmaOj42PHzvxzInjOxfr7z8sDFx//6Unvzj551uPXHv3uyROxkC2rDWOnTIcw9ln0pN+hPd4cacL67Ck0xVgW9Jds3dlL4/DMRhdzRQA8G/2ZkQsAwD7TOL8DwD7TP49wK2lxXI+dfYbib1144WI6FuJP7+/ubKkO7tn19e8D9p/K7nnzkgSEUM7UP5wRHzy1eufpVPs0n1IgHYuX4mIs0PDq4//yaoxC1v11DrLDmSvw/fNd/yDvfN12v95tl3/r3Cn/xNt+j+9bfbd7dhw/z+4A4Ws40ZfxPMtY9tut8SfGerKcv9p9vl6knPnq5X02PbfiBiJnt40P7ZOGSM3/7q51rLW/t9vH7zxaVp++np3jcLP3b33vmei1Cg9SMytblyJeKx7Vfwtlwd9zb5uu/7v6U2W8fJz73y81rI0/jTefFodf2Sjk3bH8tWIJ9pu/7sj2pJ1xyeONpvDaN4o2vjyx4/61yq/dfunU1p+fi2wF9Lt379+/ENJ63jN+tbL+P7q4DdrLds4/vbt/0DyWjOd9yMulRqN2bGIA8krq+cfu/vePJ+vn8Y/8nj7/T8//rVr/+k14dlNxt99/ZfPtx//7krjn9jC9k9nZA3hTovYKHHt9lTXWuVvbvuPN1Mj2ZzNHP82W8EH+OgAAAAAAAAAAAAAAAAAAAAAAAAAYNMKETEQSaF4J10oFIsrv+H9/+gvVGv1xpFztbmZiWj+VvZQ9BTyR10OtjwPdSx7Hn6eP3Zf/umI+F9EfNh7MMmfozjR4dgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIHdojd//T/3U2+naAQC7pq/TFQAA9pzzPwDsP87/ALD/9EUklztdCQBgT7n+B4D9x/kfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAXXb61Kl0Wv5jabGc5icuzs9N1S4enajUp4rTc+ViuTZ7oThZq01WK8VybXqj/1et1S6Mx8zcpdFGpd4Yrc8vnJmuzc00zpyfLk1WzlR69iQqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANia+vzCVKlarcxKbCOx/HBUo/OJrqw5dbYa/Z0pPXkoNsFOJzp8YAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4h/g7AAD//5PKJtY=") r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) renameat2(r3, &(0x7f0000000140)='./file0\x00', r3, &(0x7f0000000200)='./bus\x00', 0x0) r4 = getpid() ioctl$SG_BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000180)={'\x00', 0x401, 0x8, 0x7, 0x408, 0x9, r4}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.idle_time\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) io_uring_setup(0x1de0, &(0x7f00000000c0)={0x0, 0x45d6}) cachestat(r2, &(0x7f0000000040)={0x9, 0x7b8}, &(0x7f0000000080), 0x0) 1.456439333s ago: executing program 0 (id=106): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r0}, &(0x7f0000000000), &(0x7f0000000400)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000180)={'ip_vti0\x00', 0x0, 0x10, 0x20, 0x8, 0x4, {{0xa, 0x4, 0x3, 0x9, 0x28, 0x68, 0x0, 0x3, 0x2f, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x17}, {[@lsrr={0x83, 0x13, 0xaf, [@remote, @multicast2, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x3d}]}]}}}}}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9febd3c03edd0dada3d48df04051ef01001800000000000000b8e80000b8000000060000000b00000007000004290b00000400000002000000030000000c000000fdffffff0200000004000000050000000a00000004000000000000000b0000000b00000000000000ffff00000a0000000200000009000000070000000400000007000000000000000600000d000000000d000000010000000f000000050000000f00000003000000050000000200000004000000030000000d000000020000000c0000000000000100000000370047000b00000000"], &(0x7f00000005c0)=""/159, 0xd6, 0x9f, 0x0, 0xd9}, 0x28) sched_setscheduler(0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r0, 0x8040942d, &(0x7f0000000040)) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0200000004000000020000000c"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r5}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) r7 = dup(r6) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c) setsockopt$IPT_SO_SET_REPLACE(r7, 0x4000000000000, 0x4, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_io_uring_setup(0xbc3, &(0x7f0000001480)={0x0, 0x3bdb, 0x1000, 0x200003, 0x1b1}, 0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(0x0, r8, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) 1.191414094s ago: executing program 1 (id=108): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='kfree\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='mm_page_free\x00', r2}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x4000, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) syz_clone(0x630c1100, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) write$binfmt_misc(r5, &(0x7f0000000000), 0xfffffecc) splice(r4, 0x0, r6, 0x0, 0x7fff, 0x0) 1.067036874s ago: executing program 2 (id=113): mount(0x0, 0x0, &(0x7f0000000080)='ramfs\x00', 0x2014800, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)=ANY=[@ANYBLOB="24000000160001ee0000000000000000000001"], 0x24}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x10) perf_event_open(&(0x7f0000000180)={0x8, 0x80, 0x0, 0x4, 0x5, 0x8, 0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000000080), 0x4}, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x4, 0x0, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 1.001461729s ago: executing program 2 (id=117): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000700000045000000a000020095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000003c0)='kfree\x00', r0}, 0x18) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800019f000000000000000002000000000000000800010001000000040004"], 0x24}, 0x1, 0x0, 0x0, 0x4005}, 0x0) sendmmsg(r1, 0x0, 0x0, 0x0) 1.00123831s ago: executing program 3 (id=118): bpf$ITER_CREATE(0x21, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x2}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) 982.172451ms ago: executing program 2 (id=119): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000000c0)='kfree\x00', r1, 0x0, 0xfffffffffffffffd}, 0x18) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x300000c, 0x50032, 0xffffffffffffffff, 0x0) nanosleep(0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008004}, 0x8010) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000a40)={&(0x7f0000000840)='xprtrdma_op_connect\x00', r3}, 0x18) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f00000000c0)={0x1d, r6}, 0x18) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@newtaction={0x488, 0x30, 0xffff, 0x5, 0x0, {}, [{0x474, 0x1, [@m_police={0x470, 0x1, 0x0, 0x0, {{0xb}, {0x444, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x2, 0x4, 0x0, 0xfffffffe, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0x5, 0x4, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xb, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x400, 0x0, 0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x2, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x800, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x4, 0x21, 0x8000000, 0x8, 0x0, 0x104, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, 0x0, 0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x9, 0x7, 0x6b71, 0x0, 0xfffffffe, {0x4, 0x0, 0x0, 0x0, 0xb, 0x3}, {0x4, 0x2, 0x0, 0x0, 0x0, 0xff}, 0x20000, 0x3, 0x2}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x2}}}}]}]}, 0x488}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0xfffff000) 981.677511ms ago: executing program 3 (id=120): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000002000000000000000018090000", @ANYRES32, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='kfree\x00', r0}, 0x18) r1 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) write$selinux_attr(r1, &(0x7f0000000380)='system_u:object_r:hald_sonypic_exec_t:s0\x00', 0x29) 941.868214ms ago: executing program 2 (id=123): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000021"], 0x50) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r2}, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000510700140000000000000001b7080000000000007b8af8ff00000000b7080000fcffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a3000000000080002"], 0x7c}}, 0x0) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000304040018fb034c3cc4708e1560", @ANYRES32=0x0, @ANYBLOB="4101030000000000140012800b0001006970766c616e00000400028008000500", @ANYRES32=r8, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r8], 0x44}, 0x1, 0xba01}, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000040000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r9}, 0x18) syz_clone(0x64087000, 0x0, 0xffffff59, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r10 = geteuid() ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, r9, {0xee01, 0xee01}}, './file0\x00'}) mount$cgroup(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x2110010, &(0x7f00000005c0)={[{@nofavordynmods}, {@none}, {@noprefix}, {@clone_children}, {@nofavordynmods}, {@none}], [{@uid_eq={'uid', 0x3d, r10}}, {@euid_gt={'euid>', r11}}, {@seclabel}, {@smackfsdef={'smackfsdef', 0x3d, ','}}, {@obj_role}, {@dont_hash}]}) openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x1840, 0x124, 0x8}, 0x18) 922.988656ms ago: executing program 3 (id=124): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x19, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYRESOCT, @ANYRES8=r0], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x68, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r1, 0x0, 0xb}, 0x18) fsopen(&(0x7f0000000400)='autofs\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r4 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) mq_timedsend(r4, 0x0, 0x0, 0x6, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x14, 0x8, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="2000000004000000020000000000000001020000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="01000000ffffff3102000000000000000000000000000000000008007760ff4c533a49887a70543df50180dc2e473de7f5a0073016a1dddaab48053d75cb8e6869ed427a468c00f9d15fffed91606543a02ce32a6b5a54375bc71583a63b3fb6a9"], 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x44080) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x55}, 0x4000) syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) memfd_create(0x0, 0x0) r6 = io_uring_setup(0x556d, &(0x7f0000000180)={0x0, 0x8d48, 0x400, 0x1, 0x2b2}) r7 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x35, 0x8, 0x0, 0x0, 0x0, 0x7, 0x2d5b2, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0, 0xd}, 0x4c5a, 0x1, 0x6, 0x3, 0x4, 0x3fd, 0xb, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80}, 0xffffffffffffffff, 0x0, r7, 0xb) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) clock_getres(0x5, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/keys\x00', 0x0, 0x0) preadv(r8, &(0x7f0000000240)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1, 0x7fff, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r6, 0x7, &(0x7f0000000040), 0x1) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="d8000000180081084e81f782db44b904021d080006067c09e8fe55a10a0015400a00142603600e120800160000001001a8000400a400014003000000036004fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1, 0x0, 0x0, 0x6000}, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x3c}, @remote, @mcast1, 0x9, 0x2, 0x0, 0x0, 0xb7, 0xc20022}) 568.841075ms ago: executing program 4 (id=126): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000700000045000000a000020095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800019f000000000000000002000000000000000800010001000000040004"], 0x24}, 0x1, 0x0, 0x0, 0x4005}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 568.465095ms ago: executing program 4 (id=127): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000001000000b703000000000080850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sys_enter\x00', r0}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="12000000070000000400000002"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) socket$key(0xf, 0x3, 0x2) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x28, 0x5, 0x0) socket(0x28, 0x5, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800060000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES64=r3], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x88010) (fail_nth: 9) 524.807588ms ago: executing program 4 (id=128): syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1008002, &(0x7f0000000000), 0x4, 0x5eb, &(0x7f0000000c00)="$eJzs3ctvFEcaAPCvxw9sjNYDWu0ue1gsrVYg7WJjAysU5QDXCFnkoVxyiYMNIRiwsKPEJBJGIpdIUS5RFCmnHEL+iwSFK6fklEMuOUVIKIk4RspEPdNtPHaPX9jTiP79pGG6q6Zd1djfVHVNVU8AlTWS/lOLOBgRc0nEcLK0nNcbWeZI63WPfnv/fPpIotF4+Zckkiwtf32SPQ9lBw9ExHffJnGgZ22584s3Lk/Nzs5cz/bHFq7Mjc0v3jh66crUxZmLM1cn/j9x6uSJk6fGj23rvG4WpJ29/dY7wx9Ovvbl578n41/9OJnE6Xghe+HK89gpIzHS/D9J1mYNndrpwkrSk/2dNBqNRp6W9JZbJzYv//31RcTfYzh64vEvbzg+eLHUygG7qpG03ruBKkrEP1RU3g/Ir+1XXwfXSumVAN3w8ExrAGBt/Pe2xgZjoDk2sPdREiuHdZKI2N7IXLt9EXH/3uTtC/cmb8cujcMBxZZuRcQ/iuI/acZ/PQai3oz/Wlv8p/2Cc9lzmv7SNstfPVQs/qF7WvE/sG78R4f4fz19vtmK4Te2WX798eabg23xP7jdUwIAAAAAAIDKunsmIv5X9Pl/bXn+TxTM/xmKiNM7UP7Iqv21n//XHuxAMUCBh2cini+c/1vLZ//We1YsYa1HX3Lh0uzMsYj4S0Qcib496f74OmUc/ejAZ53yRrL5f/kjLf9+Nhcwq8eD3j3tx0xPLUw9wSkDmYe3Iv5ZOP83WW7/k4L2P31nmNtkGQf+c+dcp7yN4x/YLY0vIg4Xtv+P71qRrH9/jrFmf2As7xWs9a/3Pv66U/nbjX+3mIAnl7b/e9eP/3qy8n4981sv4/hib6NT3nb7//3JK827CvVnae9OLSxcH4/oT872pKlt6RNbrzM8i/J4yOMljf8j/15//K+o/z8YEUurfnbya/ua4tzf/hj6qVN99P+hPGn8T2+p/d/6xsSd+jedyt9c+3+i2dYfyVKM/0HLp3mY9renF4Rjb1FWt+sLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM+CWkTsi6Q2urxdq42ORgxFxF9jb2322vzCfy9ce/vqdJrX/P7/Wv5Nv8Ot/ST//v/6iv2JVfvHI2J/RHzSM9jcHz1/bXa67JMHAAAAAAAAAAAAAAAAAACAp8RQh/X/qZ97yq4dsOt6y64AUJqC+P++jHoA3af9h+oS/1Bd4h+qS/xDdYl/qC7xD9Ul/qG6xD8AAAAAADxT9h+6+0MSEUvPDTYfqf4sr6/UmgG7rVZ2BYDSuMUPVJepP1BdrvGBZIP8gY4HbXTkeubOP8HBAAAAAAAAAAAAAFA5hw9a/w9VZf0/VJf1/1Bd+fr/QyXXA+g+1/hAbLCSv3D9/4ZHAQAAAAAAAAAAAAA7aX7xxuWp2dmZ6zZefTqq0c2NRqNxM/0reFrqs/MbSTZDvSuF5lPhu3+m/Zs5wXyt3+Z+cnnvSQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQLs/AwAA//+JjCTl") r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000800)=ANY=[@ANYRES16=r0, @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000005600)='sys_enter\x00', r1, 0x0, 0x1}, 0x18) r2 = io_uring_setup(0x1962, &(0x7f0000000100)={0x0, 0xa28c, 0x100, 0x0, 0x210}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r3}, 0x18) r4 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f00000000c0)={0x5, 0x897, 0x200, 0x0, 0xf}) r6 = fsmount(r4, 0x0, 0x5) fchdir(r6) r7 = open(&(0x7f0000000300)='.\x00', 0x0, 0x2) close_range(r7, 0xffffffffffffffff, 0x0) close(r2) clock_nanosleep(0x9, 0x0, &(0x7f0000000080)={0x0, 0x3938700}, 0x0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) getdents64(r8, &(0x7f0000000f80)=""/4096, 0x1000) semget$private(0x0, 0x3, 0x80) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a000020095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000200)='kmem_cache_free\x00', r9}, 0x10) perf_event_open(&(0x7f0000000380)={0x1, 0x80, 0x0, 0x73, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x8008a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_config_ext={0x0, 0x6}, 0xa28c, 0xc8, 0x0, 0x6, 0x200, 0x511, 0xffff}, 0x0, 0x10, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="000000c76d0000000000000081"], 0x48) close(r11) recvmsg$unix(r10, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r12, &(0x7f0000000000), 0xe) 362.291961ms ago: executing program 4 (id=129): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xb, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r0}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SURVEY(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2], 0x1c}}, 0x4004050) 341.345042ms ago: executing program 1 (id=130): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000700000045000000a000020095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000003c0)='kfree\x00', r0}, 0x18) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800019f000000000000000002000000000000000800010001000000040004"], 0x24}, 0x1, 0x0, 0x0, 0x4005}, 0x0) sendmmsg(r1, 0x0, 0x0, 0x0) 195.934924ms ago: executing program 0 (id=131): bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x2}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r2, &(0x7f0000000040)=ANY=[], 0x6) 194.216235ms ago: executing program 3 (id=132): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) 148.388718ms ago: executing program 1 (id=133): bpf$ITER_CREATE(0x21, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x2}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) 82.618533ms ago: executing program 3 (id=134): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000002000000000000000018090000", @ANYRES32, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='kfree\x00', r0}, 0x18) r1 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) write$selinux_attr(r1, &(0x7f0000000380)='system_u:object_r:hald_sonypic_exec_t:s0\x00', 0x29) 81.928354ms ago: executing program 0 (id=135): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000000c0)='kfree\x00', r1, 0x0, 0xfffffffffffffffd}, 0x18) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x300000c, 0x50032, 0xffffffffffffffff, 0x0) nanosleep(0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008004}, 0x8010) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000a40)={&(0x7f0000000840)='xprtrdma_op_connect\x00', r3}, 0x18) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f00000000c0)={0x1d, r6}, 0x18) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@newtaction={0x488, 0x30, 0xffff, 0x5, 0x0, {}, [{0x474, 0x1, [@m_police={0x470, 0x1, 0x0, 0x0, {{0xb}, {0x444, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x2, 0x4, 0x0, 0xfffffffe, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0x5, 0x4, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xb, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x400, 0x0, 0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x2, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x800, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x4, 0x21, 0x8000000, 0x8, 0x0, 0x104, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, 0x0, 0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x9, 0x7, 0x6b71, 0x0, 0xfffffffe, {0x4, 0x0, 0x0, 0x0, 0xb, 0x3}, {0x4, 0x2, 0x0, 0x0, 0x0, 0xff}, 0x20000, 0x3, 0x2}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x2}}}}]}]}, 0x488}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0xfffff000) 80.107114ms ago: executing program 1 (id=136): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x300000c, 0x50032, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="18090000002300810000000000000000850000"], &(0x7f0000000000)='syzkaller\x00', 0x9, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8001}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000280)='kfree\x00', r1, 0x0, 0x1000000000000}, 0x18) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0xfffff000) 79.755824ms ago: executing program 3 (id=137): r0 = socket$inet6(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x50) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, 0x0, &(0x7f0000000ec0)) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000020c0)={0x0, 0x8, 0x557d, 0x5, 0x24, 0x1, 0x8a00, 0x7ff, {0x0, @in6={{0xa, 0x4e20, 0x5, @local, 0x2}}, 0xe3, 0x80000001, 0x7, 0x101, 0x2}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001000000000000000640000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000e0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r4}, 0x10) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x2000008, &(0x7f0000000080), 0x0, 0x52e, &(0x7f0000000f00)="$eJzs3cFvI1cZAPBvnDib7GabFDhApZZCi7IVrJ00tI04lCIhOFVClPsSEieK4sRR7LSbqILsX4CEECBxggsXJP4AJLQSF44IqRKcQSoCIdiCBAfoINvjJDjjxFuceNf5/aTZeW/GM9/3vHnjmfHTOIAr69mIeC0i3k/T9IWImMmWF7IpDttT83XvPXh7pTklkaZv/DWJJFvW2VeSzW9km01GxFe/HPGN5HTc+v7B5nK1WtnN6uXG1k65vn9we2Nreb2yXtleXFx4eemVpZeW5gfSzpsR8eoX//i9b//kS6/+4jNv/eHOn299s5nWdLb+ZDse0vhZK9tNL16b7Npg9wMGexQ121PsVKb62+beBeYDAEBvzXP8D0XEJyPihZiJsbNPZwEAAIDHUPr56fh3EpHmm+ixHAAAAHiMFFpjYJNCKRsLMB2FQqnUHsP7kbheqNbqjU+v1fa2V9tjZWejWFjbqFbms7HCs1FMmvWFVvm4/mJXfTEinoyI785MteqllVp1ddg3PwAAAOCKuNF1/f+Pmfb1PwAAADBiZoedAAAAAHDhXP8DAADA6HP9DwAAACPtK6+/3pzSzu9fr765v7dZe/P2aqW+WdraWymt1HZ3Suu12nrrmX1b5+2vWqvtfDa29+6WG5V6o1zfP7izVdvbbtzZiMlLaRAAAABwypMfv/+7JCIOPzfVmpomhp0UcCnGj0pJNs/p/b9/oj1/95KSAi7FWB+vefda/nLnCfB4G+9e0KOvA6OnOOwEgKFLzlnfc/DOr7P5JwabDwAAMHhzH8v//v/87wUOC5eQHnCBdGK4uro+59OZYSUCXLrWff9+B/I4WYCRUuxrBCAwyv7v7//PlaYPlRAAADBw060pKZSy23vTUSiUShE3Wz8LUEzWNqqV+Yh4IiJ+O1O81qwvtLZMzr1mAAAAAAAAAAAAAAAAAAAAAAAAAADa0jSJFAAAABhpEYU/Jb9sP8t/bub56e77AxPJv1o/CTwREW/98I3v311uNHYXmsv/drS88YNs+YvDuIMBAAAAdOtcp7fm/xx2NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACMmvcevL3Smfp4+dSg4v7lCxExmxd/PCZb88koRsT1vycxfmK7JCLGBhD/8F5EfDQvftJM6yhkXvxBvAnnxI/Z7F3Ii39jAPHhKrvfPP68ltf/CvFsa57f/8Yj/qf+QfU+/sXR8W+sR/+/2WeMp975Wbln/HsRT43nH3868ZMe8Z/rM/7Xv3Zw0Gtd+qOIuc7nT+uIdzLCcanc2Nop1/cPbm9sLa9X1ivbi4sLLy+9svTS0nx5baNayf7NjfGdp3/+/lntv577+Zdk2fRu//M5+8v7TPrPO3cffLhTOTwd/9ZzOfF/9ePsFafjF7I4n8rKzfVznfJhu3zSMz/9zTNntX/1uP3Fh/n/v9Vrp91OdZSn+/3TAQAuQH3/YHO5Wq3sjmyheZX+CKSh8AgWvjXQHaZpmjb7VM6q+xHRz36SGHBLC/n5HBd6HgGGfWQCAAAG7fikf9iZAAAAAAAAAAAAAAAAAAAAwNV1GU9Z6455/AjkZBCP0AYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGIj/BgAA//8RHtP4") r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000380)='neigh_update\x00', r6}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendto$inet6(r0, &(0x7f00000000c0)="900000001c001f4d154a817393278bff0a80a578020000000120740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) 79.504654ms ago: executing program 4 (id=138): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000700000045000000a000020095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800019f000000000000000002000000000000000800010001000000040004"], 0x24}, 0x1, 0x0, 0x0, 0x4005}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 65.097885ms ago: executing program 2 (id=139): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000800000008"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000400000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r4, 0x0, 0xfffffffffffffffc}, 0x18) sendmsg$AUDIT_USER_AVC(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f00000003c0)={0x0, 0x61, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYRES16=r0, @ANYRESOCT=r1, @ANYBLOB="010000000000005e6bf02f000000180001801400020076657468315f746f5f626174616476000c000380"], 0x38}}, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240), &(0x7f0000000400)={0x0, 0xfb, 0x104, 0x0, 0x5, "48d9e58277dc3e64af25f8c08ef83edd", "e3fd2cb9869bff82a824f148faeccc05a4e0cdea206eeb76c08fa01552edb6518ec7b7ef7d06ee3412da301363680f72b8d944f22ec7e877e4302342d29bd903a975de271f97c389751674f78b58b39de0a42d1b77102a8da673f8e5e4ca9e7eabf55ad5e2cda6bf5b1818a080365533ec9a9ac8a76edb980164144795e386c9fd894ba757acc2014174d56b094b9375bf2956fdcc471720f020a5f004e1e0eb79c85f6e8d9e2a94dc5f396b231186d30de4b172b5982b4035c7911a02789a74ed17340085252f1fa2e54ccdf8f7c3b76a1993118b08bdbb541383856d2b8c123d3821eaf6cc37e10dbc8bc3b9b47c"}, 0x104, 0x4) 10.602269ms ago: executing program 4 (id=140): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d000000", @ANYBLOB], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x67, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000004c0)='objagg_obj_root_destroy\x00', r0, 0x0, 0x2}, 0x18) r1 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r1, 0x110, 0x3) r2 = fsmount(0xffffffffffffffff, 0x0, 0x20) symlinkat(&(0x7f0000000000)='.\x00', r2, &(0x7f0000000140)='./file0\x00') timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1000001) timer_settime(r3, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0xfffff000) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004000000"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r4, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) futex(&(0x7f000000cffc), 0x1, 0x0, 0x0, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000900)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES64=0x0], 0x20) fcntl$setlease(r7, 0x400, 0x0) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000000)=ANY=[@ANYRESHEX], 0x8) socket$packet(0x11, 0x2, 0x300) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x5, 0x6f, 0x0, &(0x7f0000000340)="259a53f271a76d7f86dd4c6588a8b5d305e7fa936b651c0c8fc7f72671bb7d8967e65adb4aacc25bcf08af6a9ee107000000b6c3461ef00d9bdac797dbeb9a7295a58f71d62e2b94dfdbf79a50b0674d6ec2cd4c8cb40de47f3579b07e8a088f7436141a9cb30550df074a94df0136", 0x0, 0xd02, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) openat$autofs(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) renameat2(0xffffffffffffff9c, 0x0, r5, &(0x7f0000000000)='./file0\x00', 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r6}, 0x18) 9.810529ms ago: executing program 1 (id=141): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='kfree\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='mm_page_free\x00', r2}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x4000, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) syz_clone(0x630c1100, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) pipe(&(0x7f0000000580)={0xffffffffffffffff}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r4, 0x0, r5, 0x0, 0x7fff, 0x0) 0s ago: executing program 0 (id=142): set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) syz_io_uring_setup(0x7cbb, &(0x7f0000000500)={0x0, 0x2b94, 0x1000, 0x5, 0x140}, &(0x7f0000000040), &(0x7f0000000000)) r0 = socket(0x10, 0x803, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, 0x0, &(0x7f00000000c0)) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000002c0)={0x0, 0x0, 0x6, [0xa5, 0x0, 0x2, 0x4, 0x200, 0x7f]}, &(0x7f0000000300)=0x14) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) getpgid(0x0) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) (fail_nth: 9) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x84000) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f00000001c0)=0x200922, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'dummy0\x00'}) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'dummy0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x4000091}, 0x10044000) r5 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41100, 0x15}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000640)={{r1}, &(0x7f0000000180), &(0x7f0000000380)=r5}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.39' (ED25519) to the list of known hosts. [ 33.995437][ T29] audit: type=1400 audit(1755821814.578:62): avc: denied { mounton } for pid=3293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.996611][ T3293] cgroup: Unknown subsys name 'net' [ 34.018273][ T29] audit: type=1400 audit(1755821814.578:63): avc: denied { mount } for pid=3293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.045737][ T29] audit: type=1400 audit(1755821814.608:64): avc: denied { unmount } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.187710][ T3293] cgroup: Unknown subsys name 'cpuset' [ 34.194212][ T3293] cgroup: Unknown subsys name 'rlimit' [ 34.304858][ T29] audit: type=1400 audit(1755821814.888:65): avc: denied { setattr } for pid=3293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.332591][ T29] audit: type=1400 audit(1755821814.888:66): avc: denied { create } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.353115][ T29] audit: type=1400 audit(1755821814.888:67): avc: denied { write } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.373553][ T29] audit: type=1400 audit(1755821814.888:68): avc: denied { read } for pid=3293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.393855][ T29] audit: type=1400 audit(1755821814.888:69): avc: denied { mounton } for pid=3293 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 34.402836][ T3297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 34.418673][ T29] audit: type=1400 audit(1755821814.888:70): avc: denied { mount } for pid=3293 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 34.450508][ T29] audit: type=1400 audit(1755821815.018:71): avc: denied { relabelto } for pid=3297 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.483033][ T3293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 36.446876][ T3304] chnl_net:caif_netlink_parms(): no params data found [ 36.499515][ T3303] chnl_net:caif_netlink_parms(): no params data found [ 36.548632][ T3310] chnl_net:caif_netlink_parms(): no params data found [ 36.587967][ T3304] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.595040][ T3304] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.602304][ T3304] bridge_slave_0: entered allmulticast mode [ 36.608854][ T3304] bridge_slave_0: entered promiscuous mode [ 36.635439][ T3304] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.642568][ T3304] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.649761][ T3304] bridge_slave_1: entered allmulticast mode [ 36.656586][ T3304] bridge_slave_1: entered promiscuous mode [ 36.675207][ T3303] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.682444][ T3303] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.689696][ T3303] bridge_slave_0: entered allmulticast mode [ 36.696089][ T3303] bridge_slave_0: entered promiscuous mode [ 36.716339][ T3303] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.723461][ T3303] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.730708][ T3303] bridge_slave_1: entered allmulticast mode [ 36.737237][ T3303] bridge_slave_1: entered promiscuous mode [ 36.743473][ T3307] chnl_net:caif_netlink_parms(): no params data found [ 36.753587][ T3304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.765522][ T3304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.792123][ T3309] chnl_net:caif_netlink_parms(): no params data found [ 36.814234][ T3303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.824546][ T3303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.846756][ T3310] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.853839][ T3310] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.861036][ T3310] bridge_slave_0: entered allmulticast mode [ 36.867519][ T3310] bridge_slave_0: entered promiscuous mode [ 36.874320][ T3310] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.881445][ T3310] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.888706][ T3310] bridge_slave_1: entered allmulticast mode [ 36.895084][ T3310] bridge_slave_1: entered promiscuous mode [ 36.914708][ T3304] team0: Port device team_slave_0 added [ 36.938070][ T3304] team0: Port device team_slave_1 added [ 36.948866][ T3303] team0: Port device team_slave_0 added [ 36.969155][ T3310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.978834][ T3303] team0: Port device team_slave_1 added [ 36.998757][ T3310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.023820][ T3307] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.030953][ T3307] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.039238][ T3307] bridge_slave_0: entered allmulticast mode [ 37.045688][ T3307] bridge_slave_0: entered promiscuous mode [ 37.052531][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.059560][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.085587][ T3304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.111123][ T3307] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.118283][ T3307] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.125430][ T3307] bridge_slave_1: entered allmulticast mode [ 37.132002][ T3307] bridge_slave_1: entered promiscuous mode [ 37.138498][ T3304] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.145443][ T3304] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.171406][ T3304] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.183187][ T3310] team0: Port device team_slave_0 added [ 37.189339][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.196345][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.222438][ T3303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.233314][ T3309] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.240582][ T3309] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.247772][ T3309] bridge_slave_0: entered allmulticast mode [ 37.254134][ T3309] bridge_slave_0: entered promiscuous mode [ 37.269228][ T3310] team0: Port device team_slave_1 added [ 37.275837][ T3303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.282899][ T3303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.308910][ T3303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.319672][ T3309] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.326804][ T3309] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.334036][ T3309] bridge_slave_1: entered allmulticast mode [ 37.340564][ T3309] bridge_slave_1: entered promiscuous mode [ 37.375188][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.390214][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.397208][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.423274][ T3310] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.444794][ T3309] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.460628][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.471687][ T3303] hsr_slave_0: entered promiscuous mode [ 37.477657][ T3303] hsr_slave_1: entered promiscuous mode [ 37.483913][ T3310] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.491071][ T3310] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.517044][ T3310] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.537143][ T3304] hsr_slave_0: entered promiscuous mode [ 37.543280][ T3304] hsr_slave_1: entered promiscuous mode [ 37.549210][ T3304] debugfs: 'hsr0' already exists in 'hsr' [ 37.554937][ T3304] Cannot create hsr debugfs directory [ 37.561497][ T3309] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.588602][ T3307] team0: Port device team_slave_0 added [ 37.619781][ T3307] team0: Port device team_slave_1 added [ 37.631166][ T3309] team0: Port device team_slave_0 added [ 37.637788][ T3309] team0: Port device team_slave_1 added [ 37.680496][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.687579][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.713947][ T3307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.734975][ T3309] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.742001][ T3309] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.768023][ T3309] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.781248][ T3310] hsr_slave_0: entered promiscuous mode [ 37.787456][ T3310] hsr_slave_1: entered promiscuous mode [ 37.793274][ T3310] debugfs: 'hsr0' already exists in 'hsr' [ 37.799040][ T3310] Cannot create hsr debugfs directory [ 37.804990][ T3307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.811997][ T3307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.838029][ T3307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.859053][ T3309] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.866029][ T3309] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.892067][ T3309] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.950837][ T3307] hsr_slave_0: entered promiscuous mode [ 37.956952][ T3307] hsr_slave_1: entered promiscuous mode [ 37.962811][ T3307] debugfs: 'hsr0' already exists in 'hsr' [ 37.968596][ T3307] Cannot create hsr debugfs directory [ 38.013208][ T3309] hsr_slave_0: entered promiscuous mode [ 38.019260][ T3309] hsr_slave_1: entered promiscuous mode [ 38.025274][ T3309] debugfs: 'hsr0' already exists in 'hsr' [ 38.031061][ T3309] Cannot create hsr debugfs directory [ 38.129526][ T3304] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.138942][ T3304] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.149898][ T3304] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.169479][ T3304] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.202855][ T3303] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 38.212925][ T3303] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 38.233079][ T3303] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 38.242308][ T3303] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 38.268716][ T3310] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 38.277673][ T3310] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 38.286624][ T3310] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 38.302265][ T3310] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 38.322027][ T3309] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 38.334817][ T3309] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 38.344636][ T3309] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 38.353827][ T3309] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 38.384109][ T3307] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 38.392976][ T3307] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 38.402918][ T3307] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 38.415606][ T3304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.427143][ T3307] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 38.442404][ T3304] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.468319][ T263] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.475401][ T263] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.484306][ T263] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.491466][ T263] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.542305][ T3303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.568188][ T3310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.581657][ T3310] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.589579][ T3303] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.600280][ T3304] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 38.610686][ T3304] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 38.625870][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.632961][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.642412][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.649547][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.665742][ T3309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.683919][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.691012][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.712765][ T3309] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.727782][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.734928][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.751375][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.760470][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.767572][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.784396][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.791656][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.810602][ T3304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.831452][ T3307] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.849341][ T3303] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 38.862165][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.869399][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.878937][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.886060][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.982629][ T3310] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.018505][ T3303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.048669][ T3309] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.092781][ T3307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.146167][ T3304] veth0_vlan: entered promiscuous mode [ 39.196420][ T3304] veth1_vlan: entered promiscuous mode [ 39.217746][ T3310] veth0_vlan: entered promiscuous mode [ 39.225530][ T3310] veth1_vlan: entered promiscuous mode [ 39.252495][ T3304] veth0_macvtap: entered promiscuous mode [ 39.264475][ T3304] veth1_macvtap: entered promiscuous mode [ 39.277321][ T3310] veth0_macvtap: entered promiscuous mode [ 39.289906][ T3310] veth1_macvtap: entered promiscuous mode [ 39.302283][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.319748][ T3309] veth0_vlan: entered promiscuous mode [ 39.337787][ T3307] veth0_vlan: entered promiscuous mode [ 39.343921][ T3309] veth1_vlan: entered promiscuous mode [ 39.350956][ T3310] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.363379][ T3303] veth0_vlan: entered promiscuous mode [ 39.370153][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.382733][ T3304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.393036][ T3307] veth1_vlan: entered promiscuous mode [ 39.404879][ T31] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.418049][ T3303] veth1_vlan: entered promiscuous mode [ 39.428185][ T31] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.451683][ T31] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.468439][ T31] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.477486][ T3309] veth0_macvtap: entered promiscuous mode [ 39.484676][ T3307] veth0_macvtap: entered promiscuous mode [ 39.493781][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 39.493795][ T29] audit: type=1400 audit(1755821820.078:81): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/root/syzkaller.5RLoSQ/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 39.502863][ T3303] veth0_macvtap: entered promiscuous mode [ 39.530146][ T29] audit: type=1400 audit(1755821820.078:82): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 39.534073][ T31] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.552154][ T29] audit: type=1400 audit(1755821820.078:83): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/root/syzkaller.5RLoSQ/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 39.552184][ T29] audit: type=1400 audit(1755821820.088:84): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 39.563708][ T31] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.586159][ T29] audit: type=1400 audit(1755821820.088:85): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/root/syzkaller.5RLoSQ/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 39.610868][ T31] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.616802][ T29] audit: type=1400 audit(1755821820.088:86): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/root/syzkaller.5RLoSQ/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 39.655911][ T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.679362][ T29] audit: type=1400 audit(1755821820.088:87): avc: denied { unmount } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 39.708566][ T3309] veth1_macvtap: entered promiscuous mode [ 39.719654][ T3309] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.727957][ T3307] veth1_macvtap: entered promiscuous mode [ 39.734934][ T3309] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.739682][ T29] audit: type=1400 audit(1755821820.328:88): avc: denied { mounton } for pid=3304 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=536 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 39.765019][ T29] audit: type=1400 audit(1755821820.328:89): avc: denied { mount } for pid=3304 comm="syz-executor" name="/" dev="gadgetfs" ino=4644 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 39.796068][ T3304] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 39.810488][ T3303] veth1_macvtap: entered promiscuous mode [ 39.821893][ T386] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.831129][ T386] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.848237][ T29] audit: type=1400 audit(1755821820.428:90): avc: denied { read write } for pid=3304 comm="syz-executor" name="loop0" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 39.858882][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.879800][ T386] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.911649][ T386] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.922183][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.938365][ T3303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.959210][ T3307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.995415][ T51] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.028793][ T51] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.063757][ T51] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.103023][ T51] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.159144][ T263] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.177252][ T3494] IPv6: Can't replace route, no match found [ 40.178815][ T263] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.193872][ T3496] Zero length message leads to an empty skb [ 40.207558][ T263] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.236553][ T263] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.290389][ T3505] netlink: 100 bytes leftover after parsing attributes in process `syz.0.14'. [ 40.337018][ T3497] syz.1.11 (3497) used greatest stack depth: 10176 bytes left [ 40.391174][ T3506] netlink: 'syz.2.15': attribute type 10 has an invalid length. [ 40.400491][ T3506] team0: Device hsr_slave_0 failed to register rx_handler [ 40.424936][ T3506] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.433557][ T3506] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.590082][ T3529] loop1: detected capacity change from 0 to 164 [ 40.626547][ T3529] process 'syz.1.26' launched '/dev/fd/3' with NULL argv: empty string added [ 40.646379][ T3529] syz.1.26: attempt to access beyond end of device [ 40.646379][ T3529] loop1: rw=524288, sector=263328, nr_sectors = 4 limit=164 [ 40.660411][ T3532] loop0: detected capacity change from 0 to 128 [ 40.670083][ T3529] syz.1.26: attempt to access beyond end of device [ 40.670083][ T3529] loop1: rw=0, sector=263328, nr_sectors = 4 limit=164 [ 40.875972][ T3532] syz.0.27: attempt to access beyond end of device [ 40.875972][ T3532] loop0: rw=2049, sector=145, nr_sectors = 8 limit=128 [ 40.965596][ T3532] syz.0.27: attempt to access beyond end of device [ 40.965596][ T3532] loop0: rw=2049, sector=161, nr_sectors = 8 limit=128 [ 41.048264][ T3532] syz.0.27: attempt to access beyond end of device [ 41.048264][ T3532] loop0: rw=2049, sector=177, nr_sectors = 8 limit=128 [ 41.089364][ T3532] syz.0.27: attempt to access beyond end of device [ 41.089364][ T3532] loop0: rw=2049, sector=193, nr_sectors = 8 limit=128 [ 41.120665][ T3532] syz.0.27: attempt to access beyond end of device [ 41.120665][ T3532] loop0: rw=2049, sector=209, nr_sectors = 8 limit=128 [ 41.168142][ T3532] syz.0.27: attempt to access beyond end of device [ 41.168142][ T3532] loop0: rw=2049, sector=225, nr_sectors = 8 limit=128 [ 41.216981][ T3532] syz.0.27: attempt to access beyond end of device [ 41.216981][ T3532] loop0: rw=2049, sector=241, nr_sectors = 8 limit=128 [ 41.262525][ T3532] syz.0.27: attempt to access beyond end of device [ 41.262525][ T3532] loop0: rw=2049, sector=257, nr_sectors = 8 limit=128 [ 41.316246][ T3553] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 41.349848][ T3552] loop3: detected capacity change from 0 to 512 [ 41.405733][ T3558] netlink: 27 bytes leftover after parsing attributes in process `syz.4.36'. [ 41.427637][ T3552] ======================================================= [ 41.427637][ T3552] WARNING: The mand mount option has been deprecated and [ 41.427637][ T3552] and is ignored by this kernel. Remove the mand [ 41.427637][ T3552] option from the mount to silence this warning. [ 41.427637][ T3552] ======================================================= [ 41.518273][ T3563] netlink: 12 bytes leftover after parsing attributes in process `syz.2.39'. [ 41.552577][ T3564] : renamed from bond0 (while UP) [ 41.588938][ T3552] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 not in group (block 4)! [ 41.599330][ T3552] EXT4-fs (loop3): group descriptors corrupted! [ 41.625651][ T3568] loop1: detected capacity change from 0 to 512 [ 41.716829][ T3568] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 not in group (block 4)! [ 41.727084][ T3568] EXT4-fs (loop1): group descriptors corrupted! [ 41.872024][ T3524] erspan1: entered promiscuous mode [ 41.885418][ T3584] loop0: detected capacity change from 0 to 512 [ 42.050594][ T3536] erspan1: entered promiscuous mode [ 42.068131][ T3598] netlink: 'syz.4.52': attribute type 10 has an invalid length. [ 42.081736][ T3598] team0: Device hsr_slave_0 failed to register rx_handler [ 42.121442][ T3602] loop0: detected capacity change from 0 to 256 [ 42.132016][ T3603] random: crng reseeded on system resumption [ 42.162329][ T3598] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.187084][ T3598] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.201586][ T3603] netlink: 12 bytes leftover after parsing attributes in process `syz.3.54'. [ 42.230597][ T3607] loop1: detected capacity change from 0 to 164 [ 42.334372][ T2993] udevd[2993]: worker [3295] terminated by signal 33 (Unknown signal 33) [ 42.356082][ T3604] netlink: 'syz.2.53': attribute type 1 has an invalid length. [ 42.363726][ T3604] netlink: 224 bytes leftover after parsing attributes in process `syz.2.53'. [ 42.374572][ T3613] netlink: 'syz.1.57': attribute type 10 has an invalid length. [ 42.504126][ T3613] team0: Device hsr_slave_0 failed to register rx_handler [ 42.507404][ T3617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.532334][ T3583] Process accounting resumed [ 42.538042][ T3617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.566218][ T3619] netlink: 'syz.0.59': attribute type 10 has an invalid length. [ 42.600467][ T3619] team0: Device hsr_slave_0 failed to register rx_handler [ 42.615719][ T3621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.624857][ T3621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.635770][ T3620] netlink: 'syz.2.53': attribute type 1 has an invalid length. [ 42.643479][ T3620] netlink: 224 bytes leftover after parsing attributes in process `syz.2.53'. [ 42.662963][ T3619] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.672903][ T3619] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.200232][ T3632] netlink: 'syz.1.62': attribute type 10 has an invalid length. [ 43.230679][ T3632] team0: Device hsr_slave_0 failed to register rx_handler [ 43.258199][ T3632] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.278082][ T3632] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.523134][ T3656] netlink: 'syz.2.73': attribute type 10 has an invalid length. [ 43.549089][ T3656] team0: Device hsr_slave_0 failed to register rx_handler [ 43.580816][ T3656] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.602517][ T3656] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.729673][ T3627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.771484][ T3664] loop3: detected capacity change from 0 to 512 [ 43.827237][ T3627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.837668][ T3626] Set syz1 is full, maxelem 65536 reached [ 43.976325][ T3669] loop3: detected capacity change from 0 to 256 [ 44.064770][ T3672] loop1: detected capacity change from 0 to 512 [ 44.212387][ T3675] loop1: detected capacity change from 0 to 256 [ 44.530319][ T29] kauditd_printk_skb: 1805 callbacks suppressed [ 44.530337][ T29] audit: type=1326 audit(1755821825.118:1896): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3671 comm="syz.1.81" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58091debe9 code=0x7ffc0000 [ 44.655907][ T29] audit: type=1326 audit(1755821825.148:1897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3671 comm="syz.1.81" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58091debe9 code=0x7ffc0000 [ 44.679428][ T29] audit: type=1326 audit(1755821825.228:1898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3665 comm="syz.0.79" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6fdb66ebe9 code=0x7ffc0000 [ 44.702775][ T29] audit: type=1326 audit(1755821825.228:1899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3665 comm="syz.0.79" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6fdb66ebe9 code=0x7ffc0000 [ 44.757686][ T3689] loop4: detected capacity change from 0 to 2048 [ 44.766763][ T29] audit: type=1400 audit(1755821825.298:1900): avc: denied { read write } for pid=3688 comm="syz.4.86" name="sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 44.790666][ T29] audit: type=1400 audit(1755821825.298:1901): avc: denied { open } for pid=3688 comm="syz.4.86" path="/dev/sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 44.804129][ T3667] Process accounting resumed [ 44.879727][ T3689] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 44.911681][ T29] audit: type=1400 audit(1755821825.498:1902): avc: denied { mount } for pid=3688 comm="syz.4.86" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 44.988486][ T3699] netlink: 'syz.3.89': attribute type 21 has an invalid length. [ 45.042296][ T3700] netlink: 8 bytes leftover after parsing attributes in process `syz.3.89'. [ 45.132836][ T3672] Process accounting resumed [ 45.237484][ T29] audit: type=1400 audit(1755821825.798:1903): avc: denied { read } for pid=3709 comm="syz.3.92" name="msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 45.259990][ T29] audit: type=1400 audit(1755821825.798:1904): avc: denied { open } for pid=3709 comm="syz.3.92" path="/dev/cpu/0/msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 45.545869][ T29] audit: type=1326 audit(1755821826.128:1905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3688 comm="syz.4.86" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04a135ebe9 code=0x7fc00000 [ 45.639933][ T3303] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.711088][ T3725] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 45.735094][ T3741] FAULT_INJECTION: forcing a failure. [ 45.735094][ T3741] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 45.748261][ T3741] CPU: 0 UID: 0 PID: 3741 Comm: syz.1.104 Not tainted syzkaller #0 PREEMPT(voluntary) [ 45.748289][ T3741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 45.748301][ T3741] Call Trace: [ 45.748308][ T3741] [ 45.748316][ T3741] __dump_stack+0x1d/0x30 [ 45.748384][ T3741] dump_stack_lvl+0xe8/0x140 [ 45.748408][ T3741] dump_stack+0x15/0x1b [ 45.748457][ T3741] should_fail_ex+0x265/0x280 [ 45.748519][ T3741] should_fail+0xb/0x20 [ 45.748539][ T3741] should_fail_usercopy+0x1a/0x20 [ 45.748566][ T3741] _copy_to_user+0x20/0xa0 [ 45.748599][ T3741] simple_read_from_buffer+0xb5/0x130 [ 45.748620][ T3741] proc_fail_nth_read+0x10e/0x150 [ 45.748711][ T3741] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 45.748735][ T3741] vfs_read+0x1a8/0x770 [ 45.748759][ T3741] ? __rcu_read_unlock+0x4f/0x70 [ 45.748780][ T3741] ? __fget_files+0x184/0x1c0 [ 45.748806][ T3741] ksys_read+0xda/0x1a0 [ 45.748834][ T3741] __x64_sys_read+0x40/0x50 [ 45.748859][ T3741] x64_sys_call+0x27bc/0x2ff0 [ 45.748884][ T3741] do_syscall_64+0xd2/0x200 [ 45.748916][ T3741] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 45.748944][ T3741] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 45.748983][ T3741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.749009][ T3741] RIP: 0033:0x7f58091dd5fc [ 45.749024][ T3741] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 45.749040][ T3741] RSP: 002b:00007f5807c47030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 45.749073][ T3741] RAX: ffffffffffffffda RBX: 00007f5809405fa0 RCX: 00007f58091dd5fc [ 45.749086][ T3741] RDX: 000000000000000f RSI: 00007f5807c470a0 RDI: 0000000000000004 [ 45.749098][ T3741] RBP: 00007f5807c47090 R08: 0000000000000000 R09: 0000000000000000 [ 45.749145][ T3741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 45.749159][ T3741] R13: 00007f5809406038 R14: 00007f5809405fa0 R15: 00007ffcb2030e28 [ 45.749251][ T3741] [ 45.985055][ T3751] syz.4.101 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 45.985189][ T3744] loop2: detected capacity change from 0 to 2048 [ 46.088534][ T3744] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 46.104689][ T3744] EXT4-fs error (device loop2): ext4_lookup:1787: inode #12: comm syz.2.105: iget: bogus i_mode (4355) [ 46.118659][ T3744] EXT4-fs error (device loop2): __ext4_new_inode:1073: comm syz.2.105: reserved inode found cleared - inode=1 [ 46.149158][ T3769] netlink: 24 bytes leftover after parsing attributes in process `syz.3.112'. [ 46.166482][ T3307] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.403852][ T3802] FAULT_INJECTION: forcing a failure. [ 46.403852][ T3802] name failslab, interval 1, probability 0, space 0, times 1 [ 46.416684][ T3802] CPU: 1 UID: 0 PID: 3802 Comm: syz.4.127 Not tainted syzkaller #0 PREEMPT(voluntary) [ 46.416798][ T3802] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 46.416812][ T3802] Call Trace: [ 46.416819][ T3802] [ 46.416828][ T3802] __dump_stack+0x1d/0x30 [ 46.416898][ T3802] dump_stack_lvl+0xe8/0x140 [ 46.416918][ T3802] dump_stack+0x15/0x1b [ 46.416933][ T3802] should_fail_ex+0x265/0x280 [ 46.416957][ T3802] should_failslab+0x8c/0xb0 [ 46.416988][ T3802] __kmalloc_noprof+0xa5/0x3e0 [ 46.417137][ T3802] ? ethnl_default_notify+0xef/0x6a0 [ 46.417163][ T3802] ethnl_default_notify+0xef/0x6a0 [ 46.417189][ T3802] ? __ethnl_set_coalesce+0xbce/0xc20 [ 46.417243][ T3802] ethnl_notify+0xbe/0x1c0 [ 46.417270][ T3802] ethnl_default_set_doit+0x468/0x6c0 [ 46.417324][ T3802] genl_family_rcv_msg_doit+0x143/0x1b0 [ 46.417370][ T3802] genl_rcv_msg+0x422/0x460 [ 46.417405][ T3802] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 46.417435][ T3802] netlink_rcv_skb+0x123/0x220 [ 46.417503][ T3802] ? __pfx_genl_rcv_msg+0x10/0x10 [ 46.417546][ T3802] genl_rcv+0x28/0x40 [ 46.417573][ T3802] netlink_unicast+0x5bd/0x690 [ 46.417678][ T3802] netlink_sendmsg+0x58b/0x6b0 [ 46.417700][ T3802] ? __pfx_netlink_sendmsg+0x10/0x10 [ 46.417775][ T3802] __sock_sendmsg+0x142/0x180 [ 46.417883][ T3802] ____sys_sendmsg+0x31e/0x4e0 [ 46.417915][ T3802] ___sys_sendmsg+0x17b/0x1d0 [ 46.417986][ T3802] __x64_sys_sendmsg+0xd4/0x160 [ 46.418012][ T3802] x64_sys_call+0x191e/0x2ff0 [ 46.418091][ T3802] do_syscall_64+0xd2/0x200 [ 46.418125][ T3802] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 46.418151][ T3802] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 46.418235][ T3802] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 46.418313][ T3802] RIP: 0033:0x7f04a135ebe9 [ 46.418328][ T3802] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 46.418350][ T3802] RSP: 002b:00007f049fdc7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 46.418374][ T3802] RAX: ffffffffffffffda RBX: 00007f04a1585fa0 RCX: 00007f04a135ebe9 [ 46.418388][ T3802] RDX: 0000000000088010 RSI: 0000200000000540 RDI: 0000000000000009 [ 46.418400][ T3802] RBP: 00007f049fdc7090 R08: 0000000000000000 R09: 0000000000000000 [ 46.418412][ T3802] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 46.418423][ T3802] R13: 00007f04a1586038 R14: 00007f04a1585fa0 R15: 00007ffec4ed5b18 [ 46.418445][ T3802] [ 46.712512][ T3794] netlink: 'syz.3.124': attribute type 21 has an invalid length. [ 46.718321][ T3806] loop4: detected capacity change from 0 to 1024 [ 46.720410][ T3794] netlink: 'syz.3.124': attribute type 4 has an invalid length. [ 46.732747][ T3806] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.823946][ T3793] ipvlan2: entered promiscuous mode [ 46.830077][ T3793] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 46.838196][ T3793] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 46.895761][ T3303] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 47.187019][ T3830] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=12 sclass=netlink_audit_socket pid=3830 comm=syz.2.139 [ 47.204914][ T3827] loop3: detected capacity change from 0 to 512 [ 47.241929][ T3837] FAULT_INJECTION: forcing a failure. [ 47.241929][ T3837] name failslab, interval 1, probability 0, space 0, times 0 [ 47.254630][ T3837] CPU: 0 UID: 0 PID: 3837 Comm: syz.0.142 Not tainted syzkaller #0 PREEMPT(voluntary) [ 47.254664][ T3837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 47.254738][ T3837] Call Trace: [ 47.254746][ T3837] [ 47.254756][ T3837] __dump_stack+0x1d/0x30 [ 47.254781][ T3837] dump_stack_lvl+0xe8/0x140 [ 47.254865][ T3837] dump_stack+0x15/0x1b [ 47.254881][ T3837] should_fail_ex+0x265/0x280 [ 47.254905][ T3837] should_failslab+0x8c/0xb0 [ 47.255007][ T3837] kmem_cache_alloc_noprof+0x50/0x310 [ 47.255122][ T3837] ? __mpol_dup+0x42/0x1b0 [ 47.255153][ T3837] __mpol_dup+0x42/0x1b0 [ 47.255182][ T3837] ? is_rlimit_overlimit+0xd8/0xf0 [ 47.255207][ T3837] copy_process+0xa2b/0x2000 [ 47.255232][ T3837] ? kstrtouint+0x76/0xc0 [ 47.255262][ T3837] ? __rcu_read_unlock+0x4f/0x70 [ 47.255293][ T3837] kernel_clone+0x16c/0x5c0 [ 47.255373][ T3837] ? vfs_write+0x7e8/0x960 [ 47.255397][ T3837] __x64_sys_clone+0xe6/0x120 [ 47.255489][ T3837] x64_sys_call+0x119c/0x2ff0 [ 47.255516][ T3837] do_syscall_64+0xd2/0x200 [ 47.255549][ T3837] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 47.255572][ T3837] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 47.255642][ T3837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 47.255720][ T3837] RIP: 0033:0x7f6fdb66ebe9 [ 47.255736][ T3837] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 47.255817][ T3837] RSP: 002b:00007f6fda0d6fe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 47.255837][ T3837] RAX: ffffffffffffffda RBX: 00007f6fdb895fa0 RCX: 00007f6fdb66ebe9 [ 47.255853][ T3837] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000640c7000 [ 47.255869][ T3837] RBP: 00007f6fda0d7090 R08: 0000000000000000 R09: 0000000000000000 [ 47.255884][ T3837] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001 [ 47.255939][ T3837] R13: 00007f6fdb896038 R14: 00007f6fdb895fa0 R15: 00007ffe8b96f378 [ 47.255958][ T3837] [ 47.466771][ C0] ================================================================== [ 47.475193][ C0] BUG: KCSAN: data-race in wq_worker_tick / wq_worker_tick [ 47.482411][ C0] [ 47.484751][ C0] read-write to 0xffff8881000732b8 of 8 bytes by interrupt on cpu 1: [ 47.492842][ C0] wq_worker_tick+0x60/0x230 [ 47.497449][ C0] sched_tick+0x11a/0x270 [ 47.501802][ C0] update_process_times+0x15f/0x190 [ 47.507042][ C0] tick_nohz_handler+0x249/0x2d0 [ 47.512063][ C0] __hrtimer_run_queues+0x20c/0x5a0 [ 47.517279][ C0] hrtimer_interrupt+0x21a/0x460 [ 47.522235][ C0] __sysvec_apic_timer_interrupt+0x5c/0x1d0 [ 47.528153][ C0] sysvec_apic_timer_interrupt+0x6f/0x80 [ 47.533801][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 47.539882][ C0] crng_make_state+0xf7/0x250 [ 47.544571][ C0] _get_random_bytes+0x85/0x190 [ 47.549427][ C0] get_random_bytes+0x1d/0x30 [ 47.554107][ C0] nsim_dev_trap_report_work+0x474/0x630 [ 47.559758][ C0] process_scheduled_works+0x4ce/0x9d0 [ 47.572354][ C0] worker_thread+0x582/0x770 [ 47.576968][ C0] kthread+0x486/0x510 [ 47.581079][ C0] ret_from_fork+0xda/0x150 [ 47.585764][ C0] ret_from_fork_asm+0x1a/0x30 [ 47.590553][ C0] [ 47.592877][ C0] read-write to 0xffff8881000732b8 of 8 bytes by interrupt on cpu 0: [ 47.600942][ C0] wq_worker_tick+0x60/0x230 [ 47.605540][ C0] sched_tick+0x11a/0x270 [ 47.609880][ C0] update_process_times+0x15f/0x190 [ 47.615098][ C0] tick_nohz_handler+0x249/0x2d0 [ 47.620058][ C0] __hrtimer_run_queues+0x20c/0x5a0 [ 47.625278][ C0] hrtimer_interrupt+0x21a/0x460 [ 47.630234][ C0] __sysvec_apic_timer_interrupt+0x5c/0x1d0 [ 47.636154][ C0] sysvec_apic_timer_interrupt+0x6f/0x80 [ 47.641821][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 47.647851][ C0] kcsan_setup_watchpoint+0x415/0x430 [ 47.653245][ C0] crng_make_state+0x43/0x250 [ 47.657956][ C0] _get_random_bytes+0x85/0x190 [ 47.662844][ C0] get_random_bytes+0x1d/0x30 [ 47.667543][ C0] nsim_dev_trap_report_work+0x23c/0x630 [ 47.673237][ C0] process_scheduled_works+0x4ce/0x9d0 [ 47.678715][ C0] worker_thread+0x582/0x770 [ 47.683319][ C0] kthread+0x486/0x510 [ 47.687491][ C0] ret_from_fork+0xda/0x150 [ 47.692050][ C0] ret_from_fork_asm+0x1a/0x30 [ 47.696837][ C0] [ 47.699161][ C0] value changed: 0x0000000000038270 -> 0x000000000003a980 [ 47.706271][ C0] [ 47.708610][ C0] Reported by Kernel Concurrency Sanitizer on: [ 47.714769][ C0] CPU: 0 UID: 0 PID: 2747 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(voluntary) [ 47.724669][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 47.734767][ C0] Workqueue: events_unbound nsim_dev_trap_report_work [ 47.741573][ C0] ================================================================== [ 47.778643][ T3827] EXT4-fs error (device loop3): ext4_acquire_dquot:6937: comm syz.3.137: Failed to acquire dquot type 1 [ 47.791153][ T3827] EXT4-fs (loop3): 1 truncate cleaned up [ 47.800442][ T3827] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.813696][ T3827] ext4 filesystem being mounted at /32/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 47.826426][ T3827] netlink: 96 bytes leftover after parsing attributes in process `syz.3.137'. [ 47.845225][ T3310] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.