last executing test programs: 9m2.202133577s ago: executing program 3 (id=4): open(&(0x7f0000000000)='./file0\x00', 0x148640, 0x78e22799f4a46f8e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2, 0x0, 0x803}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x64}, 0x1, 0x0, 0x0, 0x800}, 0x4040000) 9m2.097335861s ago: executing program 3 (id=6): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000007c0)='./bus\x00', 0x400c84, &(0x7f0000000340), 0x1, 0x786, &(0x7f0000000800)="$eJzs3c9rHGUfAPDvbJKmTfu+yQsvaL0YEDRQmpgaWwWFigcRLBT0bLtstqFmky3ZTWlCQIsIXgQVD4JeevLgj3rz6o+r/hcexFI1LVY8SGQ2s+2m2U03abIbzecDk32emdl8n+/Or2d3hpkA9qzh9E8u4nBEvJtEDGbjk4joq5V6I06uzndreamQDkmsrLz8a1Kb5+byUiEa3pM6mFUejIhv34o4klsft7KwOJ0vlYpzWX2sOnNhrLKwePT8TH6qOFWcPT4+MXHsxJMnjm9frr//sHjo2nsvPPbFyT/ffODqO98lcTIOZdMa89iyZ9dWh2M4+0z60o9wjefvO9juknS7AWxJumn2rG7lcTgGo6dWAgD+zV6PiBUAYI9JHP8BYI+p/w5wc3mpUB+6+4tEZ11/LiL2r+ZfP7+5OqU3O2e3v3YedOBmsubMSBIRQ9sQfzgiPv7q1c/SIbbrPCRAG964HBFnh4bX7/+TddcsbNbjG0zbl70O3zU+je8MNHTG12n/56lm/b/c7f5PNOn/9DfZdrei2fa/ZsSBbQiygeufRDzTcG3brYb8M0M9We0/tT5fX3LufKmY7tv+GxEj0def1sc3iDFy468braY19v9+e/+1T9P46eudOXI/9/avfc9kvpq/n5wbXb8c8VBvs/yT28s/adH/Pd1mjBeffvujVtPS/NN868P6/CO7OmlnrFyJeLTp8r9zRVuy4fWJY7XVYay+UjTx5Y8fDrSK37j80yGNX/8u0Anp8h/YOP+hpPF6zcrmY3x/ZfCbVtPunX/z9X9f8kqtXO9HXMpXq3PjEfuSl9aPP3bnvZfyD2el1fnT/Eceab79b7T+p98Jz7aZf++1Xz7fev47K81/clPLf/OFq7eme1rFb2/5T9RKI9mYdvZ/7Tbwfj47AAAAAAAAAAAAAAAAAAAAAAAAAGhXLiIORZIbvV3O5UZHV5/h/f8YyJXKleqRc+X52cmoPSt7KPpy9VtdDjbcD3U8ux9+vX7srvoTEfG/iPig/0BSv4/iZJdzBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC6gy2e/5/6qb/brQMAdsz+bjcAAOg4x38A2Hsc/wFg72nv+N+z4+0AADrH938A2Hsc/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANhhp0+dSoeVP5aXCml98uLC/HT54tHJYmV6dGa+MFooz10YnSqXp0rF0UJ55l7/r1QuX5iI2flLY9VipTpWWVg8M1Oen62eOT+TnyqeKfZ1JCsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2JzKwuJ0vlQqzilsobCyO5rR/UJPtjrtlvZ0tJDsjmZsc6HLOyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAf4i/AwAA//+3ACFj") creat(&(0x7f0000000580)='./bus\x00', 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, 0x0) 9m1.863628392s ago: executing program 3 (id=8): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000007c0)='./bus\x00', 0x400c84, &(0x7f0000000340), 0x1, 0x786, &(0x7f0000000800)="$eJzs3c9rHGUfAPDvbJKmTfu+yQsvaL0YEDRQmpgaWwWFigcRLBT0bLtstqFmky3ZTWlCQIsIXgQVD4JeevLgj3rz6o+r/hcexFI1LVY8SGQ2s+2m2U03abIbzecDk32emdl8n+/Or2d3hpkA9qzh9E8u4nBEvJtEDGbjk4joq5V6I06uzndreamQDkmsrLz8a1Kb5+byUiEa3pM6mFUejIhv34o4klsft7KwOJ0vlYpzWX2sOnNhrLKwePT8TH6qOFWcPT4+MXHsxJMnjm9frr//sHjo2nsvPPbFyT/ffODqO98lcTIOZdMa89iyZ9dWh2M4+0z60o9wjefvO9juknS7AWxJumn2rG7lcTgGo6dWAgD+zV6PiBUAYI9JHP8BYI+p/w5wc3mpUB+6+4tEZ11/LiL2r+ZfP7+5OqU3O2e3v3YedOBmsubMSBIRQ9sQfzgiPv7q1c/SIbbrPCRAG964HBFnh4bX7/+TddcsbNbjG0zbl70O3zU+je8MNHTG12n/56lm/b/c7f5PNOn/9DfZdrei2fa/ZsSBbQiygeufRDzTcG3brYb8M0M9We0/tT5fX3LufKmY7tv+GxEj0def1sc3iDFy468braY19v9+e/+1T9P46eudOXI/9/avfc9kvpq/n5wbXb8c8VBvs/yT28s/adH/Pd1mjBeffvujVtPS/NN868P6/CO7OmlnrFyJeLTp8r9zRVuy4fWJY7XVYay+UjTx5Y8fDrSK37j80yGNX/8u0Anp8h/YOP+hpPF6zcrmY3x/ZfCbVtPunX/z9X9f8kqtXO9HXMpXq3PjEfuSl9aPP3bnvZfyD2el1fnT/Eceab79b7T+p98Jz7aZf++1Xz7fev47K81/clPLf/OFq7eme1rFb2/5T9RKI9mYdvZ/7Tbwfj47AAAAAAAAAAAAAAAAAAAAAAAAAGhXLiIORZIbvV3O5UZHV5/h/f8YyJXKleqRc+X52cmoPSt7KPpy9VtdDjbcD3U8ux9+vX7srvoTEfG/iPig/0BSv4/iZJdzBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC6gy2e/5/6qb/brQMAdsz+bjcAAOg4x38A2Hsc/wFg72nv+N+z4+0AADrH938A2Hsc/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANhhp0+dSoeVP5aXCml98uLC/HT54tHJYmV6dGa+MFooz10YnSqXp0rF0UJ55l7/r1QuX5iI2flLY9VipTpWWVg8M1Oen62eOT+TnyqeKfZ1JCsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2JzKwuJ0vlQqzilsobCyO5rR/UJPtjrtlvZ0tJDsjmZsc6HLOyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAf4i/AwAA//+3ACFj") creat(&(0x7f0000000580)='./bus\x00', 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, 0x0) 8m59.063894963s ago: executing program 3 (id=23): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000012c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000012c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r1}, 0x18) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000001, 0x31, 0xffffffffffffffff, 0xffffd000) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000001, 0x31, 0xffffffffffffffff, 0xffffd000) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10) (async) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x804) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @dev, 0x4}, 0x1c) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc093, 0x2, @perf_bp={0x0, 0x8}, 0x4, 0x0, 0x10000, 0x0, 0x2, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x1) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000440)={'erspan0\x00', &(0x7f0000000880)={'tunl0\x00', 0x0, 0x80, 0x80, 0x7fffffff, 0x41bd, {{0xe, 0x4, 0x1, 0x6, 0x38, 0x65, 0x0, 0x7, 0x2f, 0x0, @local, @local, {[@cipso={0x86, 0x20, 0x3, [{0x5, 0xb, "5df4655f922098a237"}, {0x5, 0x6, "83252c1c"}, {0x1, 0x2}, {0x1, 0x3, ' '}, {0x0, 0x4, "ef8b"}]}, @generic={0x83, 0x2}]}}}}}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'syz_tun\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0xffc3, &(0x7f00000001c0)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xfff3}}}, 0x24}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000059"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5f}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000059"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5f}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r6}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) (async) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f00000001c0)='./bus\x00', 0x41, &(0x7f0000000080), 0x67, 0x53c, &(0x7f0000000f40)="$eJzs3U9vHGcZAPBn1rvBTpzaBQ5QiVJoIYkgu3FNW4tDKRKCUyWg3IuxN5aVtdfyrtvYqrAjPgASQoDECS5ckPgASKgSF44IqRKcQYBACFI4cIBONbuztmPvvzRrr2v/ftJ43nnnnXmed5OZndkZzQRwYT0VES9FxDtpmt6IiJm8vpAPsdcesnZv339jKRuSSNNX/plEktd11pXk4yv5YpMR8fWvRHwrOR63sb1zZ7FWq27m05Xm2kalsb1zc3VtcaW6Ul2fn597fuGFhecWbvXIvPBQ/bwaES9+6a8/+O7Pvvzirz77+p9e/fv1b2dpTefzD/fjIRX7zWx3vdT6LA4vsPkeg51FxVYPc1PdWkwcq7l3wjkBANBddhT9wYj4ZETciJmY6H84CwAAALwPpV+Yjv8lEWl3l3rUAwAAAO8jhdY9sEmhnN8LMB2FQrncvof3w3G5UKs3mp+5Xd9aX27fKzsbpcLt1Vr1Vn6v8GyUkmx6rlU+mH72yPR8RDweEd+fmWpNl5fqteVx//gBAAAAF8SVI+f//5lpn/937I4zOQAAAGB0ZsedAAAAAHDihj3/v3zCeQAAAAAnx/V/AAAAONe++vLL2ZB23n+9/Nr21p36azeXq4075bWtpfJSfXOjvFKvr7Se2bc2aH21en3jc7G+dbfSrDaalcb2ZKzVt9abr64+8ApsAAAA4BQ9/vE3/5BExN7np1pD5tJwiw7ZDDirivulJB932az/+Fh7/JdTSgo4FRPjTgAYm+K4EwDGpjTuBICxSwbM73nzzm/z8SdGmw8AADB61z7a+/p/oe+Se/1nA2eejRguLtf/4eJqXf8f9k5eBwtwrpQGHQH03eZ3R5wNMA6PfP1/oDR9qIQAAICRm24NSaFc7EwXCuVyxNXWawFKye3VWvVWRDwWEb+fKX0gm55rtUwGnjMAAAAAAAAAAAAAAAAAAAAAAAAAAG1pmkQKAAAAnGsRhb8lv24/y//azDPTR38fuJT8dybyV4S+/uNXfnh3sdncnMvq/7Vf3/xRXv/sOH7BAAAAgAthwAv8H9Q5T++cxwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAKL19/42lznCacf/xxYiY7Ra/GJOt8WSUIuLyv5MoHlouiYiJEcSfyv58pFv8JEtrP2S3+FMjiL93r2/82Ms/hW7xr4wgPlxkb2b7n5e6bX+FeKo17r79FSMemH6veu//Yn//N9Fj+7/66cZQMZ546xeVnvHvRTxRPBZ/N4vQiZ/0iP/0kH385jd2dnrNS38Sca3r90/SaZLtIaPSXNuoNLZ3bq6uLa5UV6rr8/Nzzy+8sPDcwq3K7dVaNf/bNcb3PvbLd/r1/3KP+LMD+v/MsbVd6hrj/2/dvf+hdrHULf71p7vE/81P8xbH4xfy775P5eVs/rVOea9dPuzJn//uyX79X+7R/0H//td7rfSIG1/7zp+HbAoAnILG9s6dxVqtunluC9lZ+pCNs6OzM5HzOAqd/xFnJZ/TKOw++nomDmrSNE2zT/ARVpjEWfhYWoWx7pYAAIATcHDQP+5MAAAAAAAAAAAAAAAAAAAA4OI6jceJHQk5eVBMRvEIbQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAkXg3AAD//wuK1X0=") r7 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r7, 0x7, 0x0, 0x0, 0x0) 8m59.063467154s ago: executing program 32 (id=23): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000012c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000012c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r1}, 0x18) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000001, 0x31, 0xffffffffffffffff, 0xffffd000) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000001, 0x31, 0xffffffffffffffff, 0xffffd000) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10) (async) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x804) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @dev, 0x4}, 0x1c) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc093, 0x2, @perf_bp={0x0, 0x8}, 0x4, 0x0, 0x10000, 0x0, 0x2, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x1) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000440)={'erspan0\x00', &(0x7f0000000880)={'tunl0\x00', 0x0, 0x80, 0x80, 0x7fffffff, 0x41bd, {{0xe, 0x4, 0x1, 0x6, 0x38, 0x65, 0x0, 0x7, 0x2f, 0x0, @local, @local, {[@cipso={0x86, 0x20, 0x3, [{0x5, 0xb, "5df4655f922098a237"}, {0x5, 0x6, "83252c1c"}, {0x1, 0x2}, {0x1, 0x3, ' '}, {0x0, 0x4, "ef8b"}]}, @generic={0x83, 0x2}]}}}}}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'syz_tun\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0xffc3, &(0x7f00000001c0)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xfff3}}}, 0x24}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000059"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5f}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000059"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5f}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r6}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) (async) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f00000001c0)='./bus\x00', 0x41, &(0x7f0000000080), 0x67, 0x53c, &(0x7f0000000f40)="$eJzs3U9vHGcZAPBn1rvBTpzaBQ5QiVJoIYkgu3FNW4tDKRKCUyWg3IuxN5aVtdfyrtvYqrAjPgASQoDECS5ckPgASKgSF44IqRKcQYBACFI4cIBONbuztmPvvzRrr2v/ftJ43nnnnXmed5OZndkZzQRwYT0VES9FxDtpmt6IiJm8vpAPsdcesnZv339jKRuSSNNX/plEktd11pXk4yv5YpMR8fWvRHwrOR63sb1zZ7FWq27m05Xm2kalsb1zc3VtcaW6Ul2fn597fuGFhecWbvXIvPBQ/bwaES9+6a8/+O7Pvvzirz77+p9e/fv1b2dpTefzD/fjIRX7zWx3vdT6LA4vsPkeg51FxVYPc1PdWkwcq7l3wjkBANBddhT9wYj4ZETciJmY6H84CwAAALwPpV+Yjv8lEWl3l3rUAwAAAO8jhdY9sEmhnN8LMB2FQrncvof3w3G5UKs3mp+5Xd9aX27fKzsbpcLt1Vr1Vn6v8GyUkmx6rlU+mH72yPR8RDweEd+fmWpNl5fqteVx//gBAAAAF8SVI+f//5lpn/937I4zOQAAAGB0ZsedAAAAAHDihj3/v3zCeQAAAAAnx/V/AAAAONe++vLL2ZB23n+9/Nr21p36azeXq4075bWtpfJSfXOjvFKvr7Se2bc2aH21en3jc7G+dbfSrDaalcb2ZKzVt9abr64+8ApsAAAA4BQ9/vE3/5BExN7np1pD5tJwiw7ZDDirivulJB932az/+Fh7/JdTSgo4FRPjTgAYm+K4EwDGpjTuBICxSwbM73nzzm/z8SdGmw8AADB61z7a+/p/oe+Se/1nA2eejRguLtf/4eJqXf8f9k5eBwtwrpQGHQH03eZ3R5wNMA6PfP1/oDR9qIQAAICRm24NSaFc7EwXCuVyxNXWawFKye3VWvVWRDwWEb+fKX0gm55rtUwGnjMAAAAAAAAAAAAAAAAAAAAAAAAAAG1pmkQKAAAAnGsRhb8lv24/y//azDPTR38fuJT8dybyV4S+/uNXfnh3sdncnMvq/7Vf3/xRXv/sOH7BAAAAgAthwAv8H9Q5T++cxwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAKL19/42lznCacf/xxYiY7Ra/GJOt8WSUIuLyv5MoHlouiYiJEcSfyv58pFv8JEtrP2S3+FMjiL93r2/82Ms/hW7xr4wgPlxkb2b7n5e6bX+FeKo17r79FSMemH6veu//Yn//N9Fj+7/66cZQMZ546xeVnvHvRTxRPBZ/N4vQiZ/0iP/0kH385jd2dnrNS38Sca3r90/SaZLtIaPSXNuoNLZ3bq6uLa5UV6rr8/Nzzy+8sPDcwq3K7dVaNf/bNcb3PvbLd/r1/3KP+LMD+v/MsbVd6hrj/2/dvf+hdrHULf71p7vE/81P8xbH4xfy775P5eVs/rVOea9dPuzJn//uyX79X+7R/0H//td7rfSIG1/7zp+HbAoAnILG9s6dxVqtunluC9lZ+pCNs6OzM5HzOAqd/xFnJZ/TKOw++nomDmrSNE2zT/ARVpjEWfhYWoWx7pYAAIATcHDQP+5MAAAAAAAAAAAAAAAAAAAA4OI6jceJHQk5eVBMRvEIbQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAkXg3AAD//wuK1X0=") r7 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r7, 0x7, 0x0, 0x0, 0x0) 8m21.709917562s ago: executing program 5 (id=532): r0 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000a, 0x12, r0, 0x852ac000) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x5b3, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x80, &(0x7f0000000180)={0xa, 0x4e24, 0x8041, @empty, 0x77}, 0x1c) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x8, 0x4) recvmmsg(r0, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000fc0)=""/4097, 0x1001}, 0x7ffffffe}], 0x1, 0x40002000, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x6, &(0x7f0000000180)="10000000000000000100000025000000", 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYRES32=r1, @ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet6_mreq(r2, 0x29, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f00000005c0)='kmem_cache_free\x00', r3}, 0x10) r4 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000000)=@req3={0x80000000, 0x0, 0x0, 0x9, 0x0, 0x0, 0x9}, 0x1c) listen(r4, 0x4) r5 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r5, &(0x7f0000000080)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2}, 0x1c) accept4$inet6(r4, 0x0, 0x0, 0x0) sendmsg$tipc(r5, &(0x7f0000000640)={&(0x7f0000000300)=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'vxcan0\x00'}) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\t\x00\x00\x00\x00', @ANYRES64=0x0, @ANYRES64=0xea60, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000010000a5976ac6acd41fd8"], 0x48}}, 0x0) 8m21.632496716s ago: executing program 5 (id=533): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') pread64(r0, &(0x7f0000000500)=""/31, 0x1f, 0x40000000007) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/partitions\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xb, &(0x7f0000001f80)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002a20702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d00000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r1, &(0x7f0000000080), &(0x7f00000000c0)=""/102}, 0x20) 8m21.568088439s ago: executing program 5 (id=534): pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r1, &(0x7f0000000640)=ANY=[], 0x200002e6) fcntl$setpipe(r1, 0x407, 0x7000000) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r4, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f00000001c0)='m', 0xfffffdfc}]) io_destroy(r4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000640)=@bpf_ext={0x1c, 0x5, &(0x7f00000007c0)=ANY=[@ANYBLOB="950000000000000018480000010000000000000000000000850000003b0000007ab4ffff0f00000058116ea5f07fa528ff44cfffc321c573734e24e12eb8cbd623e1fee2147388667ec5345ba2972c2f79941a12dff75d0aeb73bedf7ac84c8aaeb1f037613273a528cbba0e356fa5318d1ebaf9f9d4b022b758c38589e890cbb0517b8cbdecdd930329afdd8976021ccca1605a13ba8f76"], &(0x7f0000000400)='syzkaller\x00', 0x2, 0x2c, &(0x7f0000000440)=""/44, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x1, 0x2}, 0x8, 0x10, &(0x7f00000004c0)={0x2, 0xc, 0x6, 0x2}, 0x10, 0x1a50f, r3, 0xa, &(0x7f0000000540)=[r2, r1, r2, r1, r2, r0], &(0x7f0000000580)=[{0x0, 0x3, 0xb, 0x3}, {0x3, 0x3, 0x5, 0x6}, {0x5, 0x5, 0xb, 0x2}, {0x3, 0x4, 0xf, 0x5}, {0x0, 0x1, 0xd, 0x1}, {0x5, 0x4, 0xc}, {0x2, 0x3, 0x1, 0x8}, {0x0, 0x2, 0xe, 0x5}, {0x2, 0x3, 0x9, 0x7}, {0x1, 0x1, 0xf, 0xc}], 0x10, 0x9f}, 0x94) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000700)={&(0x7f0000000380)={0x5c, 0x8, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800) r5 = perf_event_open$cgroup(&(0x7f0000000280)={0x3, 0x80, 0xff, 0x5, 0x9, 0x4, 0x0, 0x100000000, 0x80, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0xb3, 0x0, @perf_bp={&(0x7f0000000100), 0x1}, 0x40, 0x0, 0xfffffff8, 0x4, 0x3, 0x4, 0x86, 0x0, 0x8, 0x0, 0x80}, r1, 0x10, r3, 0x1) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r5, 0x4002f516, &(0x7f0000000180)={0x3, 0x6}) 8m20.644489739s ago: executing program 5 (id=552): modify_ldt$write2(0x11, &(0x7f0000000400)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) syz_io_uring_setup(0x53c0, &(0x7f0000000080)={0x0, 0x61bf, 0x40, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100), &(0x7f0000000040)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$selinux_create(r1, &(0x7f00000001c0)=@access={'system_u:object_r:bsdpty_device_t:s0', 0x20, 'unconfined', 0x20, 0x1ff}, 0x45) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000300)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2b}}, 0x10) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xc8, 0x9, 0x0, 0x0, 0x0, 0x80000000, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_config_ext={0x6, 0x8000000000000001}, 0x100, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x400c0000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0xe, &(0x7f0000000800), 0x3, 0x447, &(0x7f0000000840)="$eJzs3MtvG1UXAPAzdpJ+fX0JVXn0AQQKorySJi2lCzYgkFiAhASLsgxJWoW6DWqCRKsIAkJliSqxYoNYIvEXsIINAlZIbGGPKlUomxZWRmPPJLZru3HqxKH+/aRx7p0Z557jmWvfmRsngL41mj4kEXsi4veIGK5W63cYrf64ubI0/ffK0nQS5fKbfyWV/W6sLE3nu+bP251XBiIKnyZxqEm7C5cun5sqlWYvZvXxxfPvjS9cuvzs3Pmps7NnZy9Mnjp14vjE8ycnn+tKnmleNw5+OH/4wKtvX319+vTVd37+Nsnzb8ijS0bbbXy8XO5yc721t6acDPQwEDpSrHbTGKz0/+EoxtrBG45XPulpcMCmKpfL5ftab14uA3exJHodAdAb+Qd9ev2bL1s09NgWrr9YvQBK876ZLdUtA1HI9hlsuL7tptGIOL38z1fpEptzHwIAoM736fjnmWbjv0LU3hf6fzaHMhIR90TEvog4GRH7I+LeiMq+90fEAx223zhJcuv4p3BtQ4mtUzr+eyGb26of/+WjvxgpZrW9lfwHkzNzpdlj2WtyNAZ3pPWJNm388PJvn7faVjv+S5e0/XwsmMVxbWBH/XNmphan7iTnWtc/jjg40Cz/ZHUmIImIAxFxcINtzD31zeFW226ffxtdmGcqfx3xRPX4L0dD/rmk/fzk+P+iNHtsPD8rbvXLr1feaNX+HeXfBenx39X0/F/NfySpna9d6OS3f/lk+njlj89aXtNs9PwfSt6qW/fB1OLixYmIoeS1atC16ycb9ptc2z/N/+iR5v1/X6y9EociIj2JH4yIhyLi4Sz2RyLi0Yg40uZV+Omlx97deP6bK81/pqPjv1YYisY1zQvFcz9+V9foSCf5p8f/RKV0NFuznve/9cTV6dkMAAAA/1WFiNgTSWFstVwojI1V/4Z/f+wqlOYXFp8+M//+hZnqdwRGYrCQ3+karrkfOpFd1uf1yYb68ey+8RfFnZX62PR8aabXyUOf292i/6f+LPY6OmDT+b4W9C/9H/qX/g/9S/+H/tWk/+/sRRzA1mv2+f9RD+IAtl5D/zftB33E9T/0r430f+8ZcHdo25eHti4OYEst7Izbf0leof5fBiSxDcLodSEK2yIMhU0q9PqdCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDv+DQAA//+SIuXk") openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty, 0x4000006}, 0x1c) listen(r4, 0x6) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r6 = accept(r3, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYRESDEC=r2], 0xfffffdef}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) recvfrom(r5, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x3e8, 0x0, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r7, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008fd8850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x24, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_clone(0x100100, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000800000000000000000000000018010000", @ANYRESDEC, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0}, 0x94) 8m20.352246742s ago: executing program 5 (id=558): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r1, &(0x7f00000005c0)={&(0x7f0000000000), 0x10, &(0x7f0000000480)=[{&(0x7f0000000180)="f7", 0x79ca}], 0x1}, 0x0) 8m19.531955468s ago: executing program 5 (id=563): r0 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x14) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xb, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002a20702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d00000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000280)='kfree\x00', r1}, 0x18) r2 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000a, 0x12, r2, 0x852ac000) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000080)=0x5b3, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x80, &(0x7f0000000180)={0xa, 0x4e24, 0x8041, @empty, 0x77}, 0x1c) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x80002, 0x0) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x23, &(0x7f0000000040)=0x8, 0x4) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000002800)={"a584741d7615f7283ecdd7408566960a", 0x0, 0x0, {0x6, 0xfffffffd}, {0x2, 0x5}, 0x5, [0x7f, 0xd8, 0x2, 0x8000000000000000, 0x215, 0x999e, 0x7, 0x7, 0xffffffffffffffff, 0x10, 0x9, 0x0, 0x6, 0x3, 0x24a1, 0x8249]}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000001500)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000002900)={"78be8d535fd62766f26bc423d86d0689", r3, r4, {0x7, 0x3}, {0xd5, 0x6d3}, 0x6, [0xd54, 0x9, 0x5, 0x7ff, 0xb92, 0x8, 0x7fffffff, 0x3f2c, 0x5, 0x401, 0x9, 0x2, 0x0, 0x8, 0xfffffffffffffff8, 0x8]}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000002000)={{r1}, r4, 0x1c, @unused=[0x5, 0xb3, 0x72e6, 0x7f], @subvolid=0xe1}) recvmmsg(r2, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000fc0)=""/4097, 0x1001}, 0x7ffffffe}], 0x1, 0x40002000, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYRES32=r5, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f00000005c0)='kmem_cache_free\x00', r6}, 0x10) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)=@req3={0x80000000, 0x0, 0x0, 0x9, 0x0, 0x0, 0x9}, 0x1c) r7 = socket(0x1e, 0x805, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2}, 0x1c) sendmsg$tipc(r7, &(0x7f0000000640)={&(0x7f0000000300)=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x0) 8m19.531210397s ago: executing program 33 (id=563): r0 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/kernel/notes', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x14) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xb, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002a20702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d00000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000280)='kfree\x00', r1}, 0x18) r2 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000a, 0x12, r2, 0x852ac000) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000080)=0x5b3, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x80, &(0x7f0000000180)={0xa, 0x4e24, 0x8041, @empty, 0x77}, 0x1c) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x80002, 0x0) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x23, &(0x7f0000000040)=0x8, 0x4) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000002800)={"a584741d7615f7283ecdd7408566960a", 0x0, 0x0, {0x6, 0xfffffffd}, {0x2, 0x5}, 0x5, [0x7f, 0xd8, 0x2, 0x8000000000000000, 0x215, 0x999e, 0x7, 0x7, 0xffffffffffffffff, 0x10, 0x9, 0x0, 0x6, 0x3, 0x24a1, 0x8249]}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000001500)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000002900)={"78be8d535fd62766f26bc423d86d0689", r3, r4, {0x7, 0x3}, {0xd5, 0x6d3}, 0x6, [0xd54, 0x9, 0x5, 0x7ff, 0xb92, 0x8, 0x7fffffff, 0x3f2c, 0x5, 0x401, 0x9, 0x2, 0x0, 0x8, 0xfffffffffffffff8, 0x8]}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000002000)={{r1}, r4, 0x1c, @unused=[0x5, 0xb3, 0x72e6, 0x7f], @subvolid=0xe1}) recvmmsg(r2, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000fc0)=""/4097, 0x1001}, 0x7ffffffe}], 0x1, 0x40002000, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYRES32=r5, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f00000005c0)='kmem_cache_free\x00', r6}, 0x10) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)=@req3={0x80000000, 0x0, 0x0, 0x9, 0x0, 0x0, 0x9}, 0x1c) r7 = socket(0x1e, 0x805, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2}, 0x1c) sendmsg$tipc(r7, &(0x7f0000000640)={&(0x7f0000000300)=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x0) 8m8.066946217s ago: executing program 2 (id=759): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000201000085000000430000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r4}, 0x10) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000880)={0x44, r1, 0x1, 0x4070bd28, 0x1, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x44}}, 0x18) 8m8.039353149s ago: executing program 2 (id=760): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x1, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x961}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r2 = io_uring_setup(0xad5, &(0x7f0000000240)={0x0, 0x4, 0x0, 0x1, 0xe9}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r2, 0xc0096616, &(0x7f0000000180)={0x2, [0x0, 0x0]}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x40, 0x4, 0xffff}, 0x0) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000100)=""/90, 0x5a, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x1, @perf_bp={0x0, 0x1}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x20005, 0xc, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0) 8m7.946101293s ago: executing program 2 (id=765): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x2000007d, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r1}, 0x18) r2 = socket$tipc(0x1e, 0x5, 0x0) listen(r2, 0x0) 8m7.868011656s ago: executing program 2 (id=768): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100), 0x2, 0x500, &(0x7f0000000500)="$eJzs3U9sI1cZAPBvJn/sTdMmhR4AFbqUwoJWayfeNqp6oZwqhCoheuSwDYkTRbHjKHZKE/aQPXJHohInOHHmgMQBqSfuSBzgxqUckAqsQA0SByOP7V3njzfWbmzvxr+fNJo38+L53tvRvGd91s4LYGJdj4ijiJiNiPcjYqFzPuls8XZ7a/3dZ/fvrh3fv7uWRLP53j+TrL51Lno+0/Jc55r5iPjBOxE/Sk4F/VNE/eBwe7VSKe91ThUb1d1i/eDw1lZ1dbO8Wd4plVaWV5bevP1G6dL6+kr1N59ei4jf/+7Ln/zx6Fs/aTVrvlPX24/L1O76zIM4LdMR8b1hBBuDqU5/Zh/nw4/1IS5TGhGfi4hXs+d/Iaayu3nSydv07RG2DgAYhmZzIZoLvccAwFWXZjmwJC10cgHzkaaFQjuH91LMpZVavXFzo7a/s97OlS3GTLqxVSkvdXKFizGTbGxNl5ezcve4Ui6dOr4dES9GxM9y17Ljwlqtsj7OLz4AMMGeOzX//yfXnv8BgCsu/7CYG2c7AIDRyY+7AQDAyJn/AWDymP8BYPKY/wFg8pj/AWDymP8BYKJ8/913W1vzuPP+6/UPDva3ax/cWi/XtwvV/bXCWm1vt7BZq21m7+ypXnS9Sq22u/x67H9YbJTrjWL94PBOtba/07iTvdf7TnlmJL0CAB7lxVc+/ksSEUdvXcu26Hnf/4Vz9cvDbh0wTOm4GwCMzdS4GwCMzdnVvoBJIR8P9CzRe6/ndP5M4bSPBrp8at1QePrc+OIT5P+BZ5r8P0yux8v/+y4PV4H8P0yuZjOx5j8ATBg5fiC5oL739/+lZs/BYL//AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJU0n21JWuisBT4faVooRDwfEYsxk2xsVcpLEfFCRPw5N5NrHS9HhHWDAOBZlv496az/dWPhtfnTtbO5/+ayfUT8+Bfv/fzD1UZjbzliNvnXg/ONjzrnS+NoPwBwke483Z3Huz67f3etu42yPZ9+p724aCvucWdr10zHdLbPZ7mGuX8nneO21veVqUuIf3QvIr5wXv+TLDey2Fn59HT8VuznRxo/PRE/zera+9a/xecvoS0waT5ujT9vn/f8pXE925///OezEerJdce/4zPjX/pg/JvqM/5dHzTG63/47pmTzYV23b2IL01HHHcv3jP+dOMnfeK/NmD8v778lVf71TV/GXEjzut/ciJWsVHdLdYPDm9tVVc3y5vlnVJpZXll6c3bb5SKWY662M1Un/WPt26+0C9+q/9zfeLnL+j/1wfs/6/+9/4Pv/qI+N/82vn3/6VHxG/Nid8YMP7q3G/z/epa8df79P+i+39zwPif/O1wfcA/BQBGoH5wuL1aqZT3hl1Ihx8iKyQRRyPoTruQ+/VP3xlVrCEW4ulohsLTVBj3yAQM28OHftwtAQAAAAAAAAAAAAAA+hnFfycadx8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4uv4fAAD//5iA1Hs=") ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) perf_event_open(&(0x7f0000000140)={0x4, 0x80, 0x37, 0x1, 0x0, 0x0, 0x0, 0x9, 0x528, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb8, 0x1, @perf_config_ext={0x5, 0x1}, 0x4dc8, 0x10000, 0xfffffffc, 0x4, 0x1008, 0x20002, 0xb, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x7, 0xffffffffffffffff, 0x2) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="1801000000000000000000006dfeff00850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='kfree\x00', r0, 0x0, 0x401}, 0x11) r1 = syz_io_uring_setup(0x354, &(0x7f0000000240)={0x0, 0x6862, 0x4000, 0x2, 0x1c0}, &(0x7f0000000300)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x4004, @fd, 0x1, 0x0, 0x0, 0x9, 0x1, {0x3}}) io_uring_enter(r1, 0x4b5e, 0x95c, 0xe, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_emit_ethernet(0x8a, &(0x7f0000000740)=ANY=[@ANYBLOB="ffffffffffff00000000000088a800008100000086dd60661040004c2f00654790092033f8ddb30e48fc0000000000000000000000000000fcff0200000000000000000000000000013c00080067000100242081000000000200000800000086dd080088be00000000100000000100000000000000080022eb00000000200000080200000000"], 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r4}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) socket$tipc(0x1e, 0x2, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYRES32=r6], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r8) ptrace$setregset(0x4205, r8, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c98e1f92b0f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c571a70e7ca7b0451a6cc55c", 0x98}) ptrace$setregset(0x4205, r8, 0x1, &(0x7f00000001c0)={&(0x7f0000000000)="c945eb6a3f6d", 0x4}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={0x0, r7}, 0x18) add_key(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000003140100c68f7bec9aff068609000200737962320000000008004100736977001400330062726964676530"], 0x38}, 0x1, 0x0, 0x0, 0x44805}, 0x50) syz_usbip_server_init(0x6) 8m6.908175568s ago: executing program 2 (id=791): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001000)={&(0x7f0000000140)='kmem_cache_free\x00', r0, 0x0, 0x2}, 0x18) r1 = socket(0x10, 0x3, 0x0) connect$netlink(r1, &(0x7f0000000300)=@proc={0x10, 0x0, 0x25dfdffc}, 0xc) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x18, 0x31, 0x829, 0x0, 0x0, {0x0, 0x0, 0x2}, [{0x4}]}, 0x18}}, 0x0) 8m6.700134527s ago: executing program 2 (id=795): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x6, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000000c0)='fdb_delete\x00', r0}, 0x18) r1 = socket$netlink(0x10, 0x3, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x871ac4b30833d133}, 0x0) r2 = socket(0x2c, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0xc2f00, 0x4d, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000980)='mm_page_free\x00', r3}, 0x18) kexec_load(0x0, 0x1, &(0x7f0000000140)=[{0x0, 0x3e00, 0x116094000, 0x41000000}], 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r1) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r4, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r2}, 0x20) close_range(r1, 0xffffffffffffffff, 0x0) 8m6.699105107s ago: executing program 34 (id=795): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x6, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000000c0)='fdb_delete\x00', r0}, 0x18) r1 = socket$netlink(0x10, 0x3, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x871ac4b30833d133}, 0x0) r2 = socket(0x2c, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0xc2f00, 0x4d, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000980)='mm_page_free\x00', r3}, 0x18) kexec_load(0x0, 0x1, &(0x7f0000000140)=[{0x0, 0x3e00, 0x116094000, 0x41000000}], 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r1) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r4, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r2}, 0x20) close_range(r1, 0xffffffffffffffff, 0x0) 3.134355632s ago: executing program 0 (id=6816): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="09000000040000"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x10) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0xf00) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(0xffffffffffffffff, 0x28, 0x2, &(0x7f0000000000)=0x3d0e6fee, 0x8) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1e00000001000080090000000800000010880000680c0086ee3c0c47b6e04a9d085758c63b6d7eb5569940f07d664abbee76ccd25172ccc4eb629cf359c366fd9f5f54", @ANYRES32=r0, @ANYBLOB="fcffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0100020003000000000000000d0000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50) socket$key(0xf, 0x3, 0x2) r2 = syz_clone(0x8500, &(0x7f00000003c0)="0d01804277f6547d10bcab34fbb22af6c7cd7fcaa7bb53870dd029863497b45deeae9e5315c8e248283829f647337b5378da9846f6f483d15d7911", 0x3b, &(0x7f0000000400), &(0x7f00000004c0), &(0x7f0000000500)="32262d71dfb13b8a4b9b8b") syz_clone3(&(0x7f0000000880)={0x40000100, &(0x7f0000000600), &(0x7f0000000640), &(0x7f0000000680), {0x26}, &(0x7f00000006c0)=""/229, 0xe5, &(0x7f00000007c0)=""/99, &(0x7f0000000840)=[r2, r2, r2, r2, r2], 0x5}, 0x58) prlimit64(r2, 0x8, &(0x7f0000000900)={0x7f, 0xd}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) chdir(&(0x7f00000001c0)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x17) r3 = getpid() r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_opts(r4, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="3c1204"], 0x98) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e24, 0x8, @remote, 0x8}]}, &(0x7f0000000400)=0x10) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x75b08000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e27}, 0x6e) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0}, 0x18) signalfd(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 2.880189434s ago: executing program 7 (id=6817): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020641700000000002020007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) kexec_load(0x0, 0x0, 0x0, 0x0) 2.879839603s ago: executing program 7 (id=6818): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x18) socket$inet6_udp(0xa, 0x2, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 2.842283735s ago: executing program 7 (id=6820): r0 = creat(&(0x7f0000000200)='./file0\x00', 0x100) close(r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000001100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="2c00131f9f21c2176f1c9fc603eafd050bae1684cdee1c235ad3fa0d395a3185745c5c948c054b13799901a42113a54f1c00684502e4903af26db39c11f22947f24428f44c6d06820f84e3cbe99afd9769deb1a42c29b4c15bb2f604e397b3ee89d90d71e500000000e42cfee2ddda7bdc25c6d19a8e3e5784"]) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0xfe, 0x0, 0x7ffc0002}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000410"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000040)=""/106) (fail_nth: 6) 2.794931027s ago: executing program 1 (id=6821): socket(0x2, 0x3, 0xff) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x6, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0, 0x4}, 0x0, 0x7, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_bp={0x0, 0x1}, 0x0, 0x2, 0xfffffffe, 0x0, 0x8, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$inet(0x2, 0x4000000000000001, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0xfc, 0x0, 0x7ffc0002}]}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000019240)=@IORING_OP_SENDMSG={0x9, 0xc, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xe3d08660d3cd4684}) io_uring_enter(0xffffffffffffffff, 0x92, 0x0, 0x0, 0x0, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) ptrace$setregs(0xd, r1, 0x7, &(0x7f0000000440)) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = creat(&(0x7f0000000040)='./file0\x00', 0x0) r4 = gettid() r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x50) sendfile(r6, r6, 0x0, 0x800000009) ioctl$NS_GET_OWNER_UID(r3, 0xb704, &(0x7f0000000000)=0x0) fstat(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RSTATu(r6, &(0x7f0000000380)={0x63, 0x7d, 0x2, {{0x0, 0x49, 0x6, 0xf1, {0x20, 0x0, 0x1}, 0x8e050000, 0x7, 0x9, 0x4ea43382, 0x1, '\x00', 0xa, '/dev/ptp0\x00', 0xa, '/dev/ptp0\x00', 0x1, '\x00'}, 0x5, ':\'$%{', r7, 0xee01, r8}}, 0x63) read$ptp(r5, 0x0, 0x0) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=0x0) r10 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x16, 0x0, @tid=r10}) timer_settime(r9, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') 2.251517071s ago: executing program 6 (id=6824): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7eba07d4d7c2df8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000005c0)=ANY=[@ANYBLOB="64010000", @ANYRES16=r2, @ANYBLOB="0100000000000000000001000000040004800800020001000000080001000000000070000880240007"], 0x164}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000660000000000"], 0x0, 0x7ff}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r3}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)=ANY=[@ANYBLOB="240000003f000500000000000000df25047c0000040000000c0001"], 0x24}, 0x1, 0x0, 0x0, 0x48800}, 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000200), 0x42082) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000040)={{0x1, 0x2}}) unshare(0x2c060000) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='setgroups\x00') r7 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r7, &(0x7f0000000500)={0xa, 0x2, 0x0, @empty}, 0x1c) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000380)=0x1, 0x4) listen(r7, 0x7ff) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'vxcan1\x00'}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x9, &(0x7f0000000240)=0x1, 0x4) sendto$inet6(r8, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) socket$netlink(0x10, 0x3, 0x8000000004) close_range(r6, 0xffffffffffffffff, 0x0) 2.223090583s ago: executing program 0 (id=6825): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x2182) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) write$evdev(r0, 0x0, 0x0) 2.212096793s ago: executing program 6 (id=6826): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x12, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x70, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xb, 0xfff3}, {}, {0xe, 0x300}}, [@filter_kind_options=@f_fw={{0x7}, {0x44, 0x2, [@TCA_FW_POLICE={0x40, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x7, 0x6, 0x7fffffff, 0x7, 0x400, {0x4, 0x0, 0x9b1, 0x63c8, 0x800}, {0x5, 0x2, 0x8, 0x7fff, 0xff, 0x8c2c}, 0x400, 0x16ff, 0x7}}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r2}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x45, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010400000000000000000100000a74000000060a0b04000000000000000002000008400004803c000180080001006c6f670030000280060004400001000008000340fffffffa0a0002407d5def2e2100000008f503400000000806000140000100000900010073797a30000000000900020073797a32"], 0x9c}}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000fff000/0x1000)=nil) read$usbmon(0xffffffffffffffff, 0x0, 0x2f) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000feffffff000000e9aa6964c81547000400000095"], &(0x7f0000000180)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$llc(0x1a, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r6}, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000009c0)={0x3a, 0x4, &(0x7f0000000240)=ANY=[@ANYRESHEX=r1], &(0x7f00000001c0)='GPL\x00', 0x6, 0x0, 0x0, 0x40f00, 0x0, '\x00', r4, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='kfree\x00', r7, 0x0, 0x401}, 0x11) r8 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0xa, r8, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000640)='iF\x14\xb0\xfd\x11+|\x948\xf2\x98_\xce\xb0\xbd\xdfg\x1f\x0e4\x12\xf6\x9c&\xe5\x18\xb6#\xb10)\xd9\x10\x0ft*\x94\x0fc\xc0w{\xd8\x94') r9 = signalfd4(0xffffffffffffffff, &(0x7f00000008c0), 0x8, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r9}}) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x3}, 0x94) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x42, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r11}, 0x10) socket$can_raw(0x1d, 0x3, 0x1) r12 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r12, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) 1.931983555s ago: executing program 7 (id=6829): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000340)='kfree\x00', r0, 0x0, 0x200000000}, 0x18) r1 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20040845}, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x90, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff8, 0xfff, 0x0, 0x200, 0xa}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x13, 0x6}}]}, 0x90}, 0x1, 0x0, 0x0, 0x20000004}, 0x24000000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x600) (fail_nth: 6) 1.692220766s ago: executing program 7 (id=6831): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x18) socket$inet6_udp(0xa, 0x2, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 1.683222016s ago: executing program 1 (id=6833): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$tmpfs(0xfffffdf9, &(0x7f0000000380)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='mpol=interleave,m']) 1.671322247s ago: executing program 7 (id=6834): r0 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r0, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000940)=ANY=[@ANYRES64, @ANYRES64=r0], 0x48) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) write$cgroup_type(r2, &(0x7f00000009c0), 0xd4ba0ff) r3 = syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x2082) ioctl$SCSI_IOCTL_SYNC(r3, 0x4) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000380)=0x17) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x11, 0x10, &(0x7f0000000a80)=ANY=[@ANYRES32=r6, @ANYRESOCT, @ANYRES32=r4, @ANYRES32=r0], &(0x7f0000000340)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000280)='sched_switch\x00', r7}, 0x18) r8 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r8, 0x65, 0x1, &(0x7f0000000140)=[{{0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}, {{}, {0x0, 0x0, 0x1, 0x1}}], 0x10) socket(0x40000000015, 0x5, 0x0) unlink(&(0x7f0000000100)='./file0/file1\x00') rmdir(&(0x7f0000000000)='./file0\x00') ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, &(0x7f0000000200)=@req={0x28, &(0x7f0000000180)={'ipvlan1\x00', @ifru_hwaddr=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}}) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r9}, 0x10) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000210400"/20, @ANYRES32=0x0, @ANYBLOB="00626f6e64004b789c910002800500060001000000"], 0x3c}}, 0x0) r11 = socket$inet_tcp(0x2, 0x1, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000400)='kfree\x00', r12}, 0x18) setsockopt$IPT_SO_SET_REPLACE(r11, 0x0, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x420, 0x288, 0x43, 0xa0, 0x288, 0x98, 0x388, 0x178, 0x178, 0x388, 0x178, 0x7fffffe, 0x0, {[{{@ip={@loopback, @multicast1, 0x0, 0x0, 'bridge_slave_1\x00', 'ip6erspan0\x00'}, 0x12a, 0x228, 0x288, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@string={{0xc0}, {0x0, 0x3, 'kmp\x00', "7af8bdb4c056dc65949041982abfe9ed51b01289c0026e2e6034ed587be5f09017b907388134b0ede40eb8d493f20d534fc37f23ec524d91a7a041f36bb1d1c3ab474544c5ef3f2fa69a80a0d967ee4464257d28d31e6843bc1221dfb9a6a27ad13af7061b737fd97d94f50942c68242819c941c0b4d9ec154c7d327187e8198", 0x38, 0x2, {0x1}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x4, 0x7, 0x5, 0x4, 0x3, 0x4], 0x2, 0x4}, {0xffffffffffffffff, [0x1, 0x1, 0x1, 0x1, 0x1, 0x2], 0x4}}}}, {{@uncond, 0x0, 0xe0, 0x100, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x1b, 0x408, 0xfffffffb}}, @common=@set={{0x40}, {{0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300], 0x0, 0x1}}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x480) r13 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r13, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="d800000018007b7be00212ba0d1605040a003f00000f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b3162700e06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5005ccca262f3d40fad95667e04adcdf63cc1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e0700000004000000", 0xd8}], 0x1, 0x0, 0x0, 0x2663}, 0x0) 1.643288068s ago: executing program 1 (id=6835): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x4f, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r4, 0x0, 0x4}, 0x18) r5 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x10) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r6}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r3}, &(0x7f0000000040), &(0x7f0000000080)=r6}, 0x20) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x4}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r9, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r9, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) 1.345740661s ago: executing program 6 (id=6838): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0xc, &(0x7f0000000040)=@framed={{0x18, 0x7}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00'}, 0x94) 1.337185561s ago: executing program 6 (id=6840): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000010000000a00000008"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x400c84, &(0x7f0000000340), 0x1, 0x789, &(0x7f0000000fc0)="$eJzs3c1rXFUbAPDnTpKmTfu+iSBo3RgQNFA6MTW2CgoVFyJYKOjadphMQ80kUzKT0oSALSK4EVRcCLrpyoUfdefWj63+Fy7EUjUtVlxI5E5m0kkzk07SZCaa3w9u5px77+ScZ879ODPncm8Ae9Zw+icTcTgi3ksiBmvzk4joq6Z6I06urHd7aTGfTkksL7/6W1Jd59bSYj4a3pM6WMs8HBHfvR1xJLO+3PL8wlSuWCzM1vKjlekLo+X5haPnp3OThcnCzPGx8fFjJ54+cXz7Yv3jx4VD199/6YkvT/711kPX3v0+iZNxqLasMY4te35tdjiGa59JX/oRrvHifRe2uyTdrgBbku6aPSt7eRyOweippgCA/7I3I2IZANhjEud/ANhj6r8D3FpazNen7v4i0Vk3XoiI/Svx18c3V5b01sbs9lfHQQduJWtGRpKIGNqG8ocj4pOvX/88nWK7xiEB2nD5SkScHRpef/xP1l2zsFlPbrBsX+11+K75aflGoKEzvkn7P8806/9lVvs/0aT/099k392KZvt/EnF5dcaBbShkAzc+jXiu4dq22w3x1wz11HL/q/b5+pJz54uF9Nj2/4gYib7+ND+2QRkjN/++2WpZY//v9w/e+CwtP329s0bml97+te+ZyFVy9xNzoxtXIh7pbRZ/str+SYv+7+k2y3j52Xc+brUsjT+Ntz6ti7/a/jt3Rli+GvF40/a/c0VbsuH1iaPVzWG0vlE08dVPHw20Kr+x/dMpLb/+XaAT0vYf2Dj+oaTxes3y5sv44ergt62W3Tv+5tv/vuS1arrej7iUq1RmxyL2Ja+sn3/sznsv5R6tpVbWT+Mfeaz5/r/R9p9+JzzbZvy913/9Yuvx76w0/olNtf/mE9duT/W0Kr+99h+vpkZqc9o5/rVbwfv57AAAAAAAAAAAAAAAAAAAAAAAAACgXZmIOBRJJruazmSy2ZVneD8YA5liqVw5cq40NzMR1WdlD0Vfpn6ry8GG+6GO1e6HX88fuyv/VEQ8EBEf9h9I6vdRnOhy7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQd7DF8/9TP/d3u3YAwI7Z3+0KAAAd5/wPAHuP8z8A7D3tnf97drweAEDn+P4PAHuP8z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA77PSpU+m0/OfSYj7NT1ycn5sqXTw6UShPZafn8tl8afZCdrJUmiwWsvnS9L3+X7FUujAeM3OXRiuFcmW0PL9wZro0N1M5c346N1k4U+jrSFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsDnl+YWpXLFYmJXYQmJ5d1Sj+4me2ua0W+rT0USyO6qxzYkuH5gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/iX+CQAA//8vWSHt") creat(&(0x7f00000000c0)='./file0\x00', 0x81) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) gettid() unshare(0x2a020480) r0 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_int(r0, 0x29, 0x7, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000020000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000000)='kmem_cache_free\x00', r2, 0x0, 0x81}, 0x18) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000380)={0x43, 0x4, 0x3, 0x3}, 0x10) sendmsg$tipc(r3, &(0x7f0000000400)={&(0x7f00000008c0)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x4008030) vmsplice(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000500)='|', 0x1}], 0x1, 0x0) 1.227775996s ago: executing program 6 (id=6841): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1802000066"], 0x0, 0x7ff}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0xce56fe61a68fc369, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e02003c000b05d25a806f8c6394f90124fc600c05000f90c60100053582c137153e370a48018004f01700d1bd", 0x33fe0}], 0x1, 0x0, 0x0, 0x5}, 0x0) r4 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0x20000000000000cd, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8e}, 0x94) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r5}, &(0x7f00000003c0), &(0x7f00000001c0)=r1}, 0x20) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000040)=ANY=[@ANYRESHEX=r6], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a, 0x0, 0x0, 0x0}, 0x94) io_setup(0x80000000, &(0x7f00000000c0)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r7, 0x0, 0xd2d4}, 0x18) pipe2(0x0, 0x80000) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000008c0), r9) sendmsg$NLBL_UNLABEL_C_STATICLIST(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="140033e1", @ANYRES16=r10, @ANYBLOB="330725bd7000fedbdf2505000000"], 0x14}, 0x1, 0x0, 0x0, 0x80b0}, 0x4000000) perf_event_open(0x0, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x1) ioctl$sock_FIOGETOWN(r5, 0x8903, &(0x7f0000000240)=0x0) rt_tgsigqueueinfo(0x0, r11, 0x18, 0x0) sched_setscheduler(0x0, 0x2, 0x0) syz_clone(0x41aa1000, 0x0, 0x0, 0x0, 0x0, 0x0) fgetxattr(r4, &(0x7f0000000180)=@random={'system.', '\x00'}, &(0x7f0000000280)=""/226, 0xe2) 1.160007649s ago: executing program 0 (id=6842): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0xd, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000008002b000000000000000018040000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x18, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r1}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) socket(0x200000100000011, 0x803, 0x4) socket$packet(0x11, 0x3, 0x300) r3 = syz_open_procfs(0x0, &(0x7f0000000200)='net/packet\x00') preadv(r3, &(0x7f00000005c0)=[{&(0x7f0000000840)=""/237, 0xed}], 0x1, 0x64, 0x5) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r5}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xb, 0x4, &(0x7f00000002c0)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x7fe3}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x400}], &(0x7f0000000300)='GPL\x00', 0x9, 0x0, 0x0, 0x41100, 0x42, '\x00', r5, @fallback=0xd, r3, 0x8, &(0x7f0000000340)={0x8, 0x1}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0xe, 0x7f, 0x2}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000440)=[r3, r3, r3], 0x0, 0x10, 0x7a}, 0x94) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000f40)=ANY=[@ANYBLOB="4000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="81ffffff00000000180012800e0001007769726567756172640000000400028008000a00bc"], 0x40}}, 0x0) ioctl$IMGETVERSION(0xffffffffffffffff, 0x80044942, &(0x7f0000000180)) creat(&(0x7f00000001c0)='./file0\x00', 0x1c) 924.48257ms ago: executing program 0 (id=6843): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x18) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f00000000c0), 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 895.473241ms ago: executing program 0 (id=6844): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x2d) r1 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x8, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xa]}}) 756.143997ms ago: executing program 0 (id=6845): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000660000000000"], 0x0, 0x7ff}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0xce56fe61a68fc369, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) socket$kcm(0x10, 0x2, 0x10) r2 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r3}, 0x0, &(0x7f00000001c0)=r0}, 0x20) io_setup(0x80000000, &(0x7f00000000c0)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', 0xffffffffffffffff, 0x0, 0xd2d4}, 0x18) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000008c0), r5) sendmsg$NLBL_UNLABEL_C_STATICLIST(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="140033e1", @ANYRES16=r6, @ANYBLOB="330725bd7000fedbdf2505000000"], 0x14}, 0x1, 0x0, 0x0, 0x80b0}, 0x4000000) rt_tgsigqueueinfo(0x0, 0x0, 0x18, 0x0) syz_clone(0x41aa1000, 0x0, 0x0, 0x0, 0x0, 0x0) fgetxattr(r2, &(0x7f0000000180)=@random={'system.', '\x00'}, &(0x7f0000000280)=""/226, 0xe2) 744.347677ms ago: executing program 1 (id=6846): getpid() r0 = io_uring_setup(0x6858, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x28}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r1, 0x0, 0x0) io_uring_enter(r0, 0x0, 0xcb, 0xf, &(0x7f0000000000)={[0x20]}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='sched_switch\x00'}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0x8000f28, 0x0) r6 = socket$netlink(0x10, 0x3, 0x8000000004) capset(&(0x7f0000000dc0)={0x20080522}, &(0x7f0000000e00)={0x0, 0x2, 0x4, 0x0, 0x80002, 0xffffffff}) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000", 0x42}], 0x1) splice(r4, 0x0, r3, 0x0, 0x7f, 0xe) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r2, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r7 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r7, 0x2004, 0x0) syz_open_dev$usbfs(0x0, 0x70, 0x103301) 536.339436ms ago: executing program 4 (id=6848): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r1, 0x0, 0x3}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a7c000000060a0b0400000000000000000200000050000480280001800a00010071756f74610000001800028008000240000000000c000140000000000000086724000180090001006d6574610000000014000280080002400000001a08000140000000060900010073797a30000000000900020073797a32"], 0xa4}}, 0x0) 518.580358ms ago: executing program 4 (id=6849): openat$ptmx(0xffffffffffffff9c, 0x0, 0x441, 0x0) syz_open_dev$loop(&(0x7f0000000000), 0x8001, 0x800042) syz_open_dev$loop(&(0x7f0000000040), 0x80000001, 0x181600) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r0}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) capset(&(0x7f0000000380)={0x20080522}, &(0x7f0000000040)={0x200000, 0x40200003, 0x0, 0x6, 0x7}) 463.95171ms ago: executing program 4 (id=6850): readv(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="02000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000010000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = memfd_create(&(0x7f0000000ec0)='\x103q}2[\xe0\x9a\xee\xaf\x03\x97\x9et\v\"|Ma\x86\xe7\xc0\x14\x9f\xb9h\xb1\x96\xe7=I\x860S6\xb5\xa8\xc2\x95Je%\xfeG\'e\xe5\x8f\xf8\xd2\x1c\xc0\xfb\x1c\xa6\xab\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94k\xcd\t\x00\x90k\xd6\x05\xb6\x03\x00\x00\x00A\xc5\x9c_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2Oc\xc0c\x03gB!\xb0\xb8n\x01\x9bT\x95\x10\x86\xe8$\x7f\r[\xf9\x0e1v\xb1\n\x88\v\x95uy\xb5:`\x8b\nC\x18A;\xaa%\xaf\xc7\xa3\xac\xa2D\xb5\xe2\xe1\xdc(\xfd\x05\x9fB\x84O\xfe@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\xa0\x17\xe3\xac\xe9\xc9\xa7\x8a\x1b\x03\"&\xac\xcap>\xccZ\x01\xbc\x18\xc1\xb9\xe9\v\x8b\x9c\xb4Q\xd4\x96EV<>\x99\xca\xb3\xe0\xc4tL\xed\xf5W\xbd#\xcf\x8a\x84\xed\x9f/\xd4\xbb\xea;-Dp\xf8\xd0F\x90\xf8\x92Ip6\xf4\x16\xe8\x14\xe0\x92!\x92-F\xe2\x14D\x91\xa8b\x04\xdd\x1d\a\xdc\xe0\x18\x85{\x80Q\xf6k\x96\xfaQ\x9fW\vO\xf0\xe4O\\\xceS\xf2\xde\x049d\x06#\x88\xc3\xdf\x85O\x1c\xc3\xad?r\xd7\x0e\x00\xd7\x83\xb0\x88\x9c\xf6Y-F\x98\xdd\x9c~\xfd\x95\xc3\xb6lC\xaa\"Y\xa2K\xecz\x84:*\xf5Y\xd1\x9b1\x91\x9b\x15\xd4\xec\x02o\x01&\xaa\x90w\xc4\xc7yn\xb5\x1ag\xab&?\xbe\xcb\xe8v\xa8\xe0\xa4\x81sW\xacf\x149\xd2}\xefCGa\x9a$4\x8c\xa5!p\x83\x05\x96%\x02%\xabj\n\b\xc8NC\x91}&y\xd3\xe1\xeep\'\xc5\xab\x19GsX5\x8c\n\x9fh\xee;4\xb1%V\xe0\xa9\x8e\xf30:\xd8\x18N~G\x139\xcas\xf4D\xd4\xd0s\r3\xcb\x9a&\xdf+(\xc9S\x9eL5\x84\xb1\x90pN\xe7/\r\b\x9a\xf13Q\xf9\xdf\x7fX\xa0\xafK\xefh\xbfOv\x9bh\xb3\xc0\xf5\x80\xba\"@\'\x02\xafi\xeaE\xa6a6F\xde\xd4\xfa\x84\xe4+A\xb7\xa2\x8f\xc9\xee|xxn\xefw\x93]%\xd0\x19\x132\x86\xabn\xfe\x91\xb6Cl\xcf\x04\x1cq\xc1\x1d~\x8d\x01\x83\x93_\x83\x8a`v\xb0K,|S\xe4\xba\xb1\f\xc8`\xa6s\xad\x11\xd4wG\x80u\x87u\xff\x87\xee', 0x2) ioctl$FS_IOC_RESVSP(r1, 0x40305828, 0x0) fcntl$addseals(r1, 0x409, 0xb) 355.927234ms ago: executing program 4 (id=6851): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x2) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) setrlimit(0x1, &(0x7f0000000000)={0x8000, 0x100}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000080b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b702000000000000850000008400"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockopt$inet_sctp_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000300), &(0x7f0000000380)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3}, 0x10) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)=ANY=[@ANYBLOB="5400000009060108000000000000e600050000000900020073797a3100070000002c000500000000000000000005100700a24e46b2d847bbff0000000c000180080001400a0101010c00028008d9b77f748e78035ff7e8a654ce1ba8944390f8704967a7f1939e8332cd8a26595105cf28561ac6d98ec600000000000000"], 0x54}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYRES16], 0x48) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp6\x00') preadv(r5, &(0x7f00000000c0)=[{&(0x7f0000000740)=""/4100, 0x1004}], 0x1, 0x144, 0x80000000) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f0000000580)=ANY=[@ANYRESHEX, @ANYRES16=r4, @ANYBLOB="01002abd7000fedbdf25050000000800050005000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000010) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x9, 0x10, &(0x7f0000001780)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018", @ANYRES64=0x0, @ANYBLOB="0000000000000000b7040000080000008500000078000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x10, 0x0, &(0x7f0000000180)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000000514010026bd7000fbdbdf250800010001000000080003000100d300"], 0x20}, 0x1, 0x0, 0x0, 0x24008857}, 0x4000808) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kmem_cache_free\x00', r6}, 0x10) r8 = socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa000800450000280000000002", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB='\\\x00'], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f00000000c0)=ANY=[], 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x220, 0xb8, 0x11, 0x148, 0xb8, 0x0, 0x188, 0x2a8, 0x2a8, 0x188, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x0, 0x10, {0x8}}}}, {{@ip={@multicast2, @local, 0x0, 0x0, 'wg2\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x1}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x1, 0x0, 0x4, 0x1, 0x1], 0x0, 0x3}, {0xffffffffffffffff, [0x4, 0x0, 0x0, 0x3, 0x3, 0x4], 0x2, 0x2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x280) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, 0x0, 0x0) 181.639302ms ago: executing program 4 (id=6852): r0 = epoll_create1(0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)={0x30000000}) 155.869623ms ago: executing program 1 (id=6853): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000004c0)="99", 0x1}], 0x1}, 0x4048043) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x3, 0xfffc, 0xe652, 0x2, 0x14, 0x8, 0xff}, 0x9c) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x50) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000200)={0xffff, 0x200, 0x3, 0xff, 0x0}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000300)={r3, @in={{0x2, 0x4e22, @remote}}, [0xe2, 0x80, 0xf, 0x8, 0x1e, 0x6, 0x2, 0x7, 0x7ec9, 0xef1, 0x100000001, 0xd66, 0x8001, 0x9445, 0x3]}, &(0x7f00000007c0)=0x100) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000008c0)={'syztnl2\x00', &(0x7f0000000880)={'syztnl2\x00', 0x0, 0x7800, 0x80, 0xfffffffa, 0x5, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x67, 0x0, 0x6, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x33}, @dev={0xac, 0x14, 0x14, 0x38}, {[@ra={0x94, 0x4}]}}}}}) sendmsg$nl_route_sched(r1, &(0x7f0000000980)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@delqdisc={0x2c, 0x25, 0x1, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff1, 0x3}, {0x4, 0xf}, {0x10, 0xfff3}}, [@TCA_RATE={0x6, 0x5, {0x52, 0x5}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x8008811) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xd, 0x4, 0x4, 0x7, 0x0, r2, 0x10000}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000a40)="44236413c102793a84bbbc04a4a5e358874c82b43dabeca81ab7282c788f2660a495ab880d9760c8010e60123b8d32aa7fd97600b8a14da40cc290e249865b83e3c9003db5f83e42a1bc8029eed85ef092d582e6d081bf766dbb36664aae2d729a71acd13c396f7caab91bc99de1f8b3cfbeeb91e987925b28b7d30f0b5807c5cce298fa428b62a723d62f4ba502ffdac71fdeacfc022803c6beb710a6ecd1a8ce576a0434973803517570a782e0e3e755c37017247b6b96ed58b710bd9967b64810bdd32db241dceae3de8bed87f68300"/224, 0x10003, r5}, 0x38) 89.674966ms ago: executing program 6 (id=6854): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x16, 0x0, 0x4, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x18) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002b2000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000c80)=ANY=[@ANYBLOB="b70200000f000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00010000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca7f8fbc9cdfa146ec56175037958e271f60d25b7937f02c8695e5a1b2cdf41dc10d1e8bf076d83923dd29c0301000000010000003d5d78c07fa1f7e4d5b318e2ec0e0700897a74a0091ff110026e6d2ef831ab7ea0c34f17e3ad6e70af07da5ceb01b7551ef3bb622003b538dfd8e012e79578e51bc53099e90fbdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e3670ef0e789f93781965f1328d6704902cbe7bc0476619f28d99cde7a6b73340cc2160a1fe3c184b751c51160fbce841dfebd31a08b32808b80200000000009dd27080e71113610e10d8fb9c2aec61ce63a3462fd50117b89a9ab759b4eeb8cb000067d42b4e54861d0227dbfd2ed8576a3f7f3deadd7130856f756436303767d2e24f29e5dad9796edb697a6ea0180aabc18cae2ed4b4390af9a9ceafd07ed0030000002cab154ad029a119ca3c972780870014605c83d7d11c3c975d5aec84222fff0d7216fdb0d3a0ec4bfae563858dc06e7c337642d3e5a815212f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc788bee1b47683db01a46939868d75211bbae0e7313bff5d4c391ddece00fc772dd6b4d4d0a917b239fe12280fc92c88c5b8dcdcc22ee1747790a8992533ac2a9f5a699593f084419cae0b4183fb01c73f99857399537f5cc2acb72c7eae993fc9eb22d130665b6341da114f08cd0509d380578673fffffff7f23877a6b24db0e067345560942fa629fbef2461c96a08707671215c302fae29187d4f5c06a960fd37c10223fdae7ed04935c3c90d3add8eebc8619d73415e6adcda2130f5011e42e50adab988dd8e12baf5cc9398c88607a08009c2977aab37d9a44cfc1c7b4000000000000fa47742f6c5b9c4b11e7d7262a1457c39495c826b956ba859adfe38f77b91bd7d5ca1664fe2f3ced8468911806e8916dc15e21644db60c2499d5d16d7d915836ab26c169482008ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc874b2f663ddeef0005b3d96c7aae73835d5a3cda9e90d76c1993e0799d4894ee7f8249dc1e3428d2129369ee1b85afa1a5b6154eb2eea0d0df414b315f65112412392191fa83ee830548f11e1038debd64cbe359454a3f2239cfe35f81b7ade8a5b859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b20428d6474a0a91ee90b8de802c6b538622e6bbcb80f87b415263c401e64ed69a2f75409000000000000001d695c4559b82cabac3cccadc1e1c19af4e03020abf5ff0433d660f20898d2a045d009a0ffb20a77c9af2b80c05184a66d30bbea2ca45a4d6d6d1e6e79aef42355a500587b603306a5af8d867d80a07f10d82eafb03062e95196d5e3ffea0000000000000be959096ea948cfa8e7194123e918914a71ad5a8521fb9553bc60f7d9719b55b3abb6bba3d113a680a8d46fe074c83fbe378a3889e8145b2eaceab05ef932c6e4f8ef0ed0d818a7b76d839cf3c63ebb4380b168c38fa32e49563cfee3a7f0fc18bfa32c418cef875fb49e2989177a1bcd1e30280bc586e79a5dd80701018e7d6e97b3ce267dd4e27b6ef206660090bb2164474cef378f97ca33fc03000000000000001547053453d0c9aec91a24079b21d52fb5516bf0c28ef37aa76442f6083dc99cd61afaf6be45d7b00d3639f2f10ac2d5c759c3e5468f0000000011d415b6b085fb73a2c7c3852e0e658ffeb4e863428a792bee94f6cd895424360e0464f9d7ea425f2fa6aac029d15af607ad83532ff181c985f54b39370c06e63055b4d6a36fa98a44e379d28307c9912fb097601f3f88a2ca6fd1f9320cfe7fc8e9f7f15f02e177ce23f43a154b42e26f037e8a01377cbd3f509e6e540c9ba9c2a589c95d8ad67a65e9a44c576dc24452eaa9d819e2b04bdd1c000000070000000000000000000000005333c6199c12dcd926891927a7267c47cf897853d160100b39b613faefe16bed1fc105dddd77ab929b837d4442d13d5a29179a00837918dd7854aa17eb9fbdc2bdc0e98ae2c3f23a6131e2879f04ff01000030b92dd493be66c2242f8184733b80ba28e8ffffff7f00000000bb2f89049c5f6d63d56995747639964217aacfe548bc869098aa8e07e51dbc9e2d4db3c5f79fd355222ec2a00cf7f2ccd6dd6d2dc2a815d8314221a5472f1318a9dfbec5a759579caf3262129b14e99040b5d91398e17df85c25ccae973eecc7d187168d5c9cd848d566cc17587641ed01889c927da38d83314480b15e23138c5b877a72bd4cf74a299df4fbfc8e6ea96939f15d254d9033c5d371c61f550e9d86aabda45706bda78ab60200000000000000000000000000000000000000706f78f0a2ea9667fb5b951808545a46830970c2dfae01adbda7d29bf1f7abdaf52e0de6f9d7150808ed086642e64ebf98762b34338b80e41b704c3eefaf0bb5ff070000000000000ea15ccc0d7a830b6eb33b6b61675511d693ef5e3c44bbf71cabc5f45c879e7499f8baae2a1a09cf38da73297764fbc0e723e1cc3abb12e3076982ed32c94a2ce3e6f37c47e983da4ca5c96187db5a2a2e1742bc93a65d7187126126b3a80f17dd2f7dbbe82d104ede9ba6925afc2ee6cb94f56f1363cad635abf8f983292c49c0ebf5005154c7b58a3a2a2ea86d2fd92b8661264f781e3fb02d05a28f3f17b64d0258853d45cb5ebde10cd3d82eeed2f1ed925b7cf400304932c5ed0a362b235ce37e1f17700f7d1fecf8be8a2c5d25a9c60657560d05441387ff158a018d19a286c58684a1d2f624c3eb59d509ee89cc2df52881d005b2e5c27563ba54e4153c132d0366aa660000000000000009c1aaec93ec0f925921fb2e9eb202a29bef28224dbabe723de5c584bc398a8792e493048c87f60a51a391e95921218149403558fd13c649f90b0911d57eeb298b590581eba1ce383b539ab80fd15445987b1bb4eb512545e1ab65fef3103ce10b1ee362b51c72f82edf2f502ddf52567775e34a56d1be892f1e62b08950d517fa6fb1b0ef2edf1b67f8644786116b037d4a36fdd30b000063e58c856ec44cbbc2d370553f832af9480215e09aaa3843fe360b1c293a14627f2cfbe278f31d0abc0f5aaa10926dbbfe8a4b131c13a73d4e6d065c2c0fed3ab8442520ce0e0ad7d2d177377ab197ace3ef8b1c24ceb0bdee84bd6e6317633938dd19dc42de7f8f860eca6d9c74525fcd3497526df4c13e3ba5f0d75365a4542ae9440d2fede416d618cdaaf7e038879c5d177b3876fda4121e00000100000000003edd3d43cc64e0d26b46907b42e08d000000000000903350932d3eef7fdada20c19807066e2c72d0d816eb9fa50be213bf6bbb7ccb9f2e8a153e6ced68f192ebed6e86af0f2cec7335fa8039fd6eb025440bc2a34d071f0a0e6774308a74748b8cd994ed368695aa2c5986aa9200a1306ffa5a71ca69e89a6980612b35fc858f37c2c398515a910a35e22ab0573c10b85df4c2972a2fb8b9c080fbb41a753791df727fdeaded2930376eda31312256191c620cce34d1e3bf40a4a207ab1575b399eb8155781bfc7cb5920b49c039935a888d77041894f60fbbcafa487ee96b368e8769da90b44190e569fe8b923c32c288baaca5c5558b5a78bb43e5d9e47a1d5809bb178184b5672d08e29aecf1f572ac1e6cab7e820751e95999b7532603494d37a2bff35a9eec46dfc8a52433f605ebf151c837b4966b5f3628a406175a87e32c5e4268d3000933b580415b162e2946446b8f02554c8a1225217d69d049685dd06aa8528673a9673a723ac414af77f523ad730d00e8700c213f95c87a94f39f506b9e000000000000000000000000000000000000000000000000000090668ac41a1c2a4f7831e6c6a3e9c68ca2c449482bb70a994e71a7f24873848fbb128c820c1de19cc003dfa65a2b296caeb1253802080e08eeb724c4c7b7e052afa19b0f2cd7a13bda4b5a8f3b8fa3ca70bb756a3d529718d5c79d9bdb89e5d33793533211d76d00a45079eff797476106bf76f1fed952a7c9162b88911b5b00c3d26fd2fb4d7b29d1ce025e102d458efd5cca3f3835ce760359eaa01cb13cb28d60e8942fdc02b6824c00dac62f8a2d4c680ae284a82f09d6641921536814b444e4188d9b2e97eb3b108e7876f0f3f3863147ab694218c7cecc075d52d590dddbb57fc6fedf5ec69d7894a7b5c8109f303dab998815c80534b0bd34c49eea63997e56728a8185a8bb6988a7197b87f5548f5edfdfb3efc907fe561b33a6f7c707f7828c6adaf3b2a39929b4b65253e787d65c08aff5e4a9b2267bd8f803ea38f10a6e9c4a49bf23525e08c12d229211fe4d88cf1440f29accfa50f327ac1fb20d7f164100111bd21fca713b2475f1c997f3000000000080c426bcec79c6bc83ce4e6cbb17c01be69db342192d0a716cc24710d23321441f475ec485d642b61c6bd907071dbbe37c0b78f60fd2ad0d13ca62d9d9aafb01c3920b64cb5e023810e2de4327f90c389ce36d90ff9f3cb9d8cd2260d05a8126943a3df17157470595c68ac8df7fea6d42ecb2cdb65b4f2aef0db2b2de949a6d4ec37f2fd693ae44944041a64fe6336aba1c66b1b95d2edbc40364a049616ae962d75eae619548aa86bd5f0bad56e7ad7de2ee5e6f3b42e3a27094b6b5face99456d9af1926b21d37faf7612d9752cf58e6424decd530b5419e117ec08647566b1bdd75d6a9a1e600aaf0f42ce94b4725d4c2da80150dc34e5975d6904f061ed9a7608959f2d24ee6ec4f2395d16e02f53c746f74b12013f738d76456c3407188eff97f31ca36e5d79e1f1c7c3b688ee21d37ba5ebf4afc2a61f16"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x55}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x18000000000002a0, 0xe06, 0x1000000, &(0x7f0000000100)="b9ff030f6044238cb89e14f088ca1bff430500001100630377fbac141414e000000162079f4b4d2f87e56dca6aab845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000}, 0x2c) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000480)=ANY=[@ANYRES64=r2], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r5}, 0x10) lstat(&(0x7f0000000140)='./file0\x00', 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fc, &(0x7f0000001300)={0x2, 0x4e23, @local}, 0x10) syz_clone3(&(0x7f0000000380)={0x80101200, &(0x7f0000000040), &(0x7f0000000080)=0x0, &(0x7f0000000180), {0xa}, &(0x7f00000001c0)=""/29, 0x1d, &(0x7f0000000280)=""/128, &(0x7f0000000200)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff], 0x8}, 0x58) fcntl$setown(r1, 0x8, r6) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="700000001000ffff25bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1720000021200000340012800c0001006d6163766c616e002400028008000300030000000800010010000000100005800a000400aaaaaaaaaaaa000008000500", @ANYRES32=r8, @ANYBLOB="140003"], 0x70}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r9 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x2182) r10 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) ioctl$EVIOCGRAB(r9, 0x40044590, &(0x7f0000000100)) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r11, &(0x7f0000001280)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)={0x20, 0x2d, 0x1, 0xfffffffc, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid}, @nested={0x8, 0x0, 0x0, 0x1, [@typed={0x4, 0xb9}]}]}, 0x20}], 0x1, 0x0, 0x0, 0x4}, 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r9, @ANYBLOB=',wfdno=', @ANYRESHEX=r10]) write$evdev(r9, &(0x7f0000000040)=[{{}, 0x0, 0x2}], 0x37) sendto$inet(r2, &(0x7f0000002240)="2d12376647d788ad2cdbd0e68c140c7f72d35ae5869c470a1f53ea73c32220190e02cb0b770bb154d1d5d1b343cb1feadca1752e4397955e1a151721f1b28b9e32b7966f9ddd7ad3822c5ff3dc03786c1c86c2a6f7c271710c573396ca95e95a524201b0bf0539042ae14072693f9734306f7a21f92421e8e0ea335d07d1f2839c4c195930cd35c65dfc527de84f2cab4f0c78474734d7c5cba0c70ee0fd10ad5ed3f4b70308c29000e8cd98d57c90c7d9298ee4a2c41b141614627880ace9cfde45a0ae5f6f5cf3eb31254454e92eacdab64eb048b144e4fcc16afe59e7d7dad7696df64aa223d14d69bbe8ee2f76e1d4a32477a7cf108fea86a7e085c1575f683857cff342574109f74cf05e3f63f328f46735ba0578d84b4978ce545621b1666ca7da451d40e961a037822eebcbba9bf9e92af7281442efcaa8e0d3ecd6111d8fc1c742d0e7efe8e51a1c5e6ea04fec02a986cba677d9dc642d110df6f55c786c73f7ce4ebf9415bdb2680d0ff4597006d96e3c164114a4effae84380e492822c002b2e96f160a0784fd0ebe448eddaa801921576287f61a15be332a94eea951c0826874d105173a6b3f2a6e420ed5ef00b1f699b74c524a1859cb7d6dfb7257b6f0b92e17ce21237da0ec892735601b29693dce455876447f76df303a8cb34bd9c9241da9904c1c17d416753c71aeed9cc07d26b4a438df4e302cf120cda73c04d5a1b7295f1cb7ff88084211adde5fdf991f97cb522b56c561ad1119a4675fbf566b77660dfd457467652d23c739cc9ba93bbd5b464c46e46187ce71d7aab533e670c861b227454d7c21f9f16000eee0c1772a152c26acd2744c5553ace622369f15d5354a3b5ac4bb9261a766830d351fa931558dee7ff30768b2e29025c3b115179ed6a12ea76a23db3626bc033f85a43c3c3f50b75b89a418277837ba571189e708f4aaaacc19537e7aa156b7058c200e8f9be1da8a63c7e878f3e733060a1cb24a2a09ea76413efdc4e0b1027a09c6830b4ca5ccd4695e2e0bb1610a21b0cc66012aab283b6c5dfbd20aef8d7ad04e4c618a065a588d05e3f780126eee290cf0f94fb4a2c5a8cb97f60d9e50301a4f01f3787ab052ef8782d6ef0f92385ab59015670a054dab1ab0400be74fdc4ac3d18fb5b5da13e55a05e29ad14dd0abf0435dea601ce80573548f3c8f21ecfcbe5361d1505a91c355d8477fe7e3866be005acae25cbab7bd8684294963c3c95924f7d62ca0ed2d7aa01048cbdcd4d7ae9717d4feb97e1e825f6156e9c5fc456509798d2f5adc9356752a8974894ff5bf9d14aab3ddf18fd4f9af23c66f7e4ef7e345e769260fd9d2a22ddd078dd7e44f904ea78dd3db5b0f4a8d7ce9ae7909cedde165b7458da24d576fc0e18d3c27cccaff21146ad51c1681c629a8f0b8a4ae213c88910c54de9af7890b0a4414e0d38c31d76a130b587b764260655f17f901f96b835a1fecb1f7438f5e18ff60720d37d19b1a9ae3e03dc10aa1c4f2abb918883d56ddd4e74b48a4aeadccf2329956ed18b2001d1e1e80bdf325449beda911916f802234f5b182264754cd3bb26b2ae658cc0ee185a19cba7f9e54e47c32f8b87d0fed97c911d28f971e70be5fb830109a57b600f734a4cc734cbb67a58e6a696ccb39c328c537fe467fd194183aad728f95b0a4afb4557615408a83785c0d313e666d1dab18d49a4feaf12993e73f5537998a1ed25b93f9bca346376129dee3a5a78675d30bd19a78b77f45ea8b5b48cb4c78a1bc30df00badb811585966b8f8ef42d89236f5e99f849a44d62d1431eb187333dcde91582a29e777b9cd6e1bc86eff512ba48d6030681d395bfb8c5259b0c22028400a1d3929a6e3fa0fcda3deb9cf8e7e079c21d7c20b1670eb880789ae809608bac2b05c45da5a3a0377d1d06b917a5a6ee7dbf35f54c327d7d7921266bcb4e8e816b02872139d03d575c491ee077140f7d1aca286f977869288bf90eedaf41727abcd79056936d830bf6480bf6b4573e4dd402f6206099716593a04813cd07437ffa80f10f72ef64e320e48fa59b5ac0e412d9ed14bfc2e9365c67fc21c327d5699f58c3984db4f3ec0c362b633a784c4dfba44187801a0f0fc0f6b7a4610594556b33f1617c7b8b4f95d5d6fba7553512a6098a2e64d10a45347f3a41d11e19f7690ebcbfb9239c59b489061aad4317a08c435fa92c4f5feb662f6413c3d06dca92647fef304d9f8e96a78b5251b0a4d15710937428ab676cc7da5f0006cd04f7fa884625116a0cbddabc012cf55e3f26a4b411cfa1ba8473c3aef570cd23fe2165bf1f9b54632c7e76e5a5818bb70086c5fa609f2199424b8f2de5387a5bf44d3f246bec62433182b0c950ecc2968dba1e6a845c48c506daf90ffb0c13d376be0ac8283abb4e4283f703206a47c2b9c6a642d4bf4a245b8ec978b09d8620fc5d9f917842f83bf5e2efd976e9b98c38a8f836773357ad6d23fca68ee26431acf0196ef0fcef25a979782dc2f1688acacc53b1b2c2f694b638c1256a869f56098b89bb4a14b2dc2d187773e6a75f7d37ed91b8f8aee84c0bdbaeec229139809eaa9948e7a5e18d783ece0cd7ea8996dc3e650b1cff351ad9fbd661f303f40de084d111ec1489ae42d2fc55ce8d892a3d6290f2d2eb72733b4fdc8c433569c34854a84653884b3d90652f499eeb83886bd4246b41f231141cf1a412f1c7840fb8a1595895cfdec1961d887ac9dd1f5ad4b66bbb451d5471fcb1fb4bb25a4c4d43b9c0e3c72a00e8fc83f700c812b1b9c2f37e40bd746c39cbbca41e6fecb8d64424c82e640d8f887cb7d8e75828b2969e1628c7000fba626381dcfdc7262b2b06f47f898d0aa0dab8636c089d4339a37e80f20f8f5196608a3d1ac1418ff9ac0ac54c45c124b15a77d61d50ca05e1603b1b6476cf09d79b138a7f7394a9cf35e6d64654504663db381712da505d0985cd9a4edbd067c0f09c393486b138f01deb4771566d987ac16a6ed0ac5c9b592a20878e5b4050e594f376523697a0aba321a6704db28b0f0fcdf0d8e2a6f1788064d49807f080d7aa29f795935d61bcf152fe39a45a713fd0a3b2982f65437828e110b2edcdbd7b462d5ef8e87ad0aa2352cf3fb1e05787602ed66efd77a7b88c73e76dd1b368e5845cc032ed719635b0db27b39ddc12d899b742a1499ffaa4b95c0a1f29cd85a7d2d30be5bd1fd384a6e4dd3b93b46352ece5144a2ce989bcb8e6255e04e6d5d0a6b4b2736715b116b06189491b4a4a9fd9e482413b2b8851b273b10820040b490de9414fcdee5126ddbedaaddcb8c844cc7e0264f65c4d3607dddf0dbd88a7f3d1ff35bea1bcb48eb576e7083fd8bf8d6a6a1567f77819c3bbe93ff92418632d30fa2b933b33fcf163b5a942d870f22d13ad6be938ddf61de391b35e68fc9ad71aeb7cddfb73e071162bfd1c7facd10e50e9f8046c7ee6f89830b70955a3908c18cc79138c335a5159adb3229e02576cbd1829b4c67504fbe785e3c2129d53cbc3b00a62b232e16a01e01b2dc159fea676ea8c0ad0d8f41ea1840092f4900d26f48b5c549211240a5c5ab663b4f9ac463df05c86af9a3f2e595d4f9981b108d44e9ee060fc8736d7ff71a609252fe6becd2aacb23b7ac66ad8a3dfca068fb7846b9588a0b027e45f96d73cdf6c2d9494c6c5c129a8f5a1e8c4f4e6a1adec722ba74e5a002b1c87793cfc5c689ac82881ac346c3e5be4f6570d3669f797916e2018a784d6a88671c6cd803585ba49cabea506177c5e41145d2c7f192012e1478e409d2dde7de2ac2b03b9d808afaf5f761032fd562d587c653eb07ad8ede76dc1aa8a1e7fb5a56f04e3dfa10e77ee1e51f6879c2670278c8471e03b0f62eee8ec60336b604b6721a81d8ef630749dac6298b488ec09a4aa61ced579231d4231a9cf6d7f20683194e6709fbea4ed66cfdec9a7238bbad6894ceb6c0ca3307274f2749be8450180456280289d0179d8396902250cddd7a440c24ae7df78bc8e146b1b8e5c9924d2b07646ff577da61968503bad37d240aacc9dbba0f665acf1d56667d1aa7e497b7947cca22f7a55113f5e10bc9987e9b5d9405f625a604f7099cf365ea8d3530dfba6b9977f8441e23147049ae8bf0231d824397e885589c693d8a7e756e46baf67f21b062cf6d8db25140c4301233bcb18b408e3c7959056a3307546f09f13e2e732dc26b9bab0ac74d72bc0f115f7cf682aed23d9c627da1c4e4b221bd85a6c19f0391b23137f551cfb99cb1da33d42840439d0ec5f2d0e75c74d15918460e915c18dccf2f9d0ee508292c871ec9f4f2a2d1628a914487df2e8aa43bbb0bf1427e2f99e8eaaa588df310b9e50aeba057b2ce863eaaf9ecca3fc190d88bf10", 0xfffffffffffffee9, 0x4004085, 0x0, 0x49) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000740)={r4, 0xe0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000400)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x8, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x95, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000580), &(0x7f00000005c0), 0x8, 0xb4, 0x8, 0x8, &(0x7f0000000600)}}, 0x10) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000780)={0x3, 0x4, 0x4, 0xa, 0x0, r0, 0x8, '\x00', r12, 0xffffffffffffffff, 0x0, 0x1, 0x1}, 0x50) 70.982837ms ago: executing program 4 (id=6855): getpid() r0 = io_uring_setup(0x6858, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x28}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r1, 0x0, 0x0) io_uring_enter(r0, 0x0, 0xcb, 0xf, &(0x7f0000000000)={[0x20]}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='sched_switch\x00'}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0x8000f28, 0x0) r6 = socket$netlink(0x10, 0x3, 0x8000000004) capset(&(0x7f0000000dc0)={0x20080522}, &(0x7f0000000e00)={0x0, 0x2, 0x4, 0x0, 0x80002, 0xffffffff}) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e5700", 0x2c}], 0x1) splice(r4, 0x0, r3, 0x0, 0x7f, 0xe) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r2, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r7 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps_rollup\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) lseek(r7, 0x2004, 0x0) syz_open_dev$usbfs(0x0, 0x70, 0x103301) 0s ago: executing program 1 (id=6856): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x4f, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r4, 0x0, 0x4}, 0x18) r5 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x10) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r6}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r3}, &(0x7f0000000040), &(0x7f0000000080)=r6}, 0x20) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x4}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r9, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r9, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) kernel console output (not intermixed with test programs): 518.154408][T13126] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 518.184999][T13126] EXT4-fs error (device loop7): ext4_mb_mark_diskspace_used:4215: comm syz.7.6335: Allocating blocks 385-513 which overlap fs metadata [ 518.200812][T13126] FAULT_INJECTION: forcing a failure. [ 518.200812][T13126] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 518.214203][T13126] CPU: 1 UID: 0 PID: 13126 Comm: syz.7.6335 Not tainted syzkaller #0 PREEMPT(voluntary) [ 518.214233][T13126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 518.214294][T13126] Call Trace: [ 518.214302][T13126] [ 518.214310][T13126] __dump_stack+0x1d/0x30 [ 518.214338][T13126] dump_stack_lvl+0xe8/0x140 [ 518.214362][T13126] dump_stack+0x15/0x1b [ 518.214383][T13126] should_fail_ex+0x265/0x280 [ 518.214411][T13126] should_fail_alloc_page+0xf2/0x100 [ 518.214541][T13126] __alloc_frozen_pages_noprof+0x109/0x360 [ 518.214576][T13126] alloc_pages_mpol+0xb3/0x260 [ 518.214675][T13126] ? ext4_get_group_desc+0x16b/0x190 [ 518.214712][T13126] folio_alloc_noprof+0x97/0x150 [ 518.214756][T13126] filemap_alloc_folio_noprof+0x93/0x230 [ 518.214793][T13126] __filemap_get_folio_mpol+0x295/0x650 [ 518.214819][T13126] ? ext4_chunk_trans_extent+0x178/0x1a0 [ 518.214905][T13126] ext4_write_begin+0x2fa/0xe90 [ 518.214935][T13126] ? __ext4_journal_stop+0x48/0x120 [ 518.214961][T13126] ext4_da_write_begin+0x1f0/0x6b0 [ 518.215027][T13126] ? inode_to_bdi+0x47/0xa0 [ 518.215045][T13126] ? balance_dirty_pages_ratelimited_flags+0x40b/0x5e0 [ 518.215146][T13126] generic_perform_write+0x184/0x490 [ 518.215180][T13126] ext4_buffered_write_iter+0x1ee/0x3c0 [ 518.215215][T13126] ? ext4_file_write_iter+0xfe/0xf60 [ 518.215325][T13126] ext4_file_write_iter+0x387/0xf60 [ 518.215423][T13126] ? kstrtouint_from_user+0x9f/0xf0 [ 518.215446][T13126] ? 0xffffffff81000000 [ 518.215460][T13126] ? __rcu_read_unlock+0x4f/0x70 [ 518.215482][T13126] ? avc_policy_seqno+0x15/0x30 [ 518.215570][T13126] ? selinux_file_permission+0x1e2/0x320 [ 518.215605][T13126] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 518.215640][T13126] vfs_write+0x52a/0x960 [ 518.215665][T13126] __x64_sys_pwrite64+0xfd/0x150 [ 518.215764][T13126] x64_sys_call+0x9f7/0x3000 [ 518.215790][T13126] do_syscall_64+0xd8/0x2a0 [ 518.215882][T13126] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.215905][T13126] RIP: 0033:0x7f2e2f9af749 [ 518.215992][T13126] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 518.216089][T13126] RSP: 002b:00007f2e2e40f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 518.216109][T13126] RAX: ffffffffffffffda RBX: 00007f2e2fc05fa0 RCX: 00007f2e2f9af749 [ 518.216122][T13126] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000005 [ 518.216135][T13126] RBP: 00007f2e2e40f090 R08: 0000000000000000 R09: 0000000000000000 [ 518.216147][T13126] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000001 [ 518.216160][T13126] R13: 00007f2e2fc06038 R14: 00007f2e2fc05fa0 R15: 00007fffee6bfb88 [ 518.216184][T13126] [ 518.218603][T13139] netlink: 16 bytes leftover after parsing attributes in process `syz.6.6339'. [ 518.226403][T13126] EXT4-fs (loop7): pa ffff888107a6c850: logic 16, phys. 129, len 24 [ 518.501268][T13126] EXT4-fs error (device loop7): ext4_mb_release_inode_pa:5466: group 0, free 0, pa_free 8 [ 518.511380][T13126] EXT4-fs (loop7): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 1 with error 28 [ 518.523631][T13126] EXT4-fs (loop7): This should not happen!! Data will be lost [ 518.523631][T13126] [ 518.533276][T13126] EXT4-fs (loop7): Total free blocks count 0 [ 518.539341][T13126] EXT4-fs (loop7): Free/Dirty block details [ 518.545330][T13126] EXT4-fs (loop7): free_blocks=128 [ 518.550445][T13126] EXT4-fs (loop7): dirty_blocks=0 [ 518.553867][ T4612] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.555606][T13126] EXT4-fs (loop7): Block reservation details [ 518.564826][ T4612] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.569683][T13126] EXT4-fs (loop7): i_reserved_data_blocks=0 [ 518.628122][T13150] loop1: detected capacity change from 0 to 1024 [ 518.818011][T13161] netlink: 'syz.7.6340': attribute type 39 has an invalid length. [ 518.869014][T13163] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 518.904103][T13165] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=13165 comm=syz.0.6343 [ 518.918351][T13163] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 519.017213][T13165] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6343'. [ 519.026234][T13165] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6343'. [ 519.060633][ T4612] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 519.068923][ T4612] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 519.090205][T13165] bridge1: entered promiscuous mode [ 519.095480][T13165] bridge1: entered allmulticast mode [ 519.163838][T13179] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6347'. [ 519.284423][T13178] team_slave_0: entered promiscuous mode [ 519.290199][T13178] team_slave_1: entered promiscuous mode [ 519.300134][T13184] SET target dimension over the limit! [ 519.322790][T13187] loop4: detected capacity change from 0 to 1024 [ 519.416784][T13178] 8021q: adding VLAN 0 to HW filter on device { [ 519.477025][T10763] kernel read not supported for file /input/event2 (pid: 10763 comm: kworker/0:17) [ 519.571885][T13203] netlink: 'syz.7.6345': attribute type 1 has an invalid length. [ 519.592080][T13202] openvswitch: netlink: Missing key (keys=40, expected=100) [ 519.721722][T13205] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.765731][T13205] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.829910][T13205] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.983537][ T29] kauditd_printk_skb: 221 callbacks suppressed [ 519.983558][ T29] audit: type=1400 audit(1765333113.799:17571): avc: denied { setopt } for pid=13253 comm="syz.7.6353" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 520.216343][T13205] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.238787][ T29] audit: type=1400 audit(1765333113.849:17572): avc: denied { bind } for pid=13253 comm="syz.7.6353" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 520.533931][T13265] lo speed is unknown, defaulting to 1000 [ 520.540224][T13265] lo speed is unknown, defaulting to 1000 [ 520.678409][T13293] netlink: 'syz.6.6356': attribute type 39 has an invalid length. [ 520.821580][ T4612] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.790880][ T4612] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.809889][ T4612] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.942781][T13303] lo speed is unknown, defaulting to 1000 [ 521.948832][T13303] lo speed is unknown, defaulting to 1000 [ 522.740671][ T4612] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 522.754615][ T29] audit: type=1326 audit(1765333116.569:17573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13332 comm="syz.4.6361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 522.872007][T13338] lo speed is unknown, defaulting to 1000 [ 522.878138][T13338] lo speed is unknown, defaulting to 1000 [ 523.281191][T13364] vlan2: entered allmulticast mode [ 523.310737][ T29] audit: type=1326 audit(1765333116.679:17574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13332 comm="syz.4.6361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=140 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 523.334484][ T29] audit: type=1326 audit(1765333116.679:17575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13332 comm="syz.4.6361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 523.358071][ T29] audit: type=1326 audit(1765333116.679:17576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13332 comm="syz.4.6361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 523.381736][ T29] audit: type=1326 audit(1765333116.679:17577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13332 comm="syz.4.6361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 523.405481][ T29] audit: type=1326 audit(1765333116.679:17578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13332 comm="syz.4.6361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 523.429124][ T29] audit: type=1326 audit(1765333116.679:17579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13332 comm="syz.4.6361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 523.452764][ T29] audit: type=1326 audit(1765333116.759:17580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13332 comm="syz.4.6361" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 523.484871][T13364] dummy0: entered allmulticast mode [ 523.815397][T13368] lo speed is unknown, defaulting to 1000 [ 523.864762][T13368] lo speed is unknown, defaulting to 1000 [ 523.898441][T13335] 9pnet: Limiting 'msize' to 1048576 as this is the maximum supported by transport fd [ 524.111458][T13388] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6367'. [ 524.205181][T13413] SET target dimension over the limit! [ 524.220880][T13398] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 524.236398][T13407] tipc: New replicast peer: 255.255.255.255 [ 524.242507][T13407] tipc: Enabled bearer , priority 10 [ 524.282024][T13415] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6369'. [ 524.291113][T13415] tipc: Disabling bearer [ 524.302912][T13417] xt_hashlimit: max too large, truncated to 1048576 [ 524.346196][T13407] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6369'. [ 524.367837][T13398] netlink: 860 bytes leftover after parsing attributes in process `syz.4.6368'. [ 524.663108][T13438] netlink: 52 bytes leftover after parsing attributes in process `syz.6.6375'. [ 524.725900][T13438] SET target dimension over the limit! [ 524.756664][ T3481] kernel read not supported for file /input/event2 (pid: 3481 comm: kworker/1:5) [ 524.767070][T13440] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6376'. [ 524.780197][T13440] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 524.910708][T13456] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.939590][T13456] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.959532][T13462] loop7: detected capacity change from 0 to 1024 [ 524.968137][T13462] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 524.973716][T13457] lo speed is unknown, defaulting to 1000 [ 524.983281][T13462] EXT4-fs (loop7): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 524.994716][T13462] EXT4-fs (loop7): revision level too high, forcing read-only mode [ 524.995382][T13457] lo speed is unknown, defaulting to 1000 [ 525.008680][T13462] EXT4-fs (loop7): orphan cleanup on readonly fs [ 525.027587][T13456] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.038371][T13462] EXT4-fs error (device loop7): ext4_free_blocks:6728: comm syz.7.6382: Freeing blocks not in datazone - block = 0, count = 4096 [ 525.069164][T13462] EXT4-fs (loop7): Remounting filesystem read-only [ 525.108139][T13462] EXT4-fs (loop7): 1 orphan inode deleted [ 525.119134][T13462] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 525.143490][T13456] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.199270][T26162] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 525.251815][ T4636] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.274621][ T4601] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.296269][ T4601] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.403533][ T4601] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.516569][T13518] loop7: detected capacity change from 0 to 1024 [ 525.637678][T13526] lo speed is unknown, defaulting to 1000 [ 525.645762][T13526] lo speed is unknown, defaulting to 1000 [ 526.533671][ T29] kauditd_printk_skb: 141 callbacks suppressed [ 526.533686][ T29] audit: type=1326 audit(1765333120.359:17722): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13552 comm="syz.7.6387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2f9af749 code=0x7ffc0000 [ 526.773390][ T29] audit: type=1326 audit(1765333120.389:17723): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13552 comm="syz.7.6387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2e2f9af749 code=0x7ffc0000 [ 526.773443][ T29] audit: type=1326 audit(1765333120.389:17724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13552 comm="syz.7.6387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2f9af749 code=0x7ffc0000 [ 526.773475][ T29] audit: type=1326 audit(1765333120.389:17725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13552 comm="syz.7.6387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2e2f9af749 code=0x7ffc0000 [ 526.773563][ T29] audit: type=1326 audit(1765333120.389:17726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13552 comm="syz.7.6387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2f9af749 code=0x7ffc0000 [ 526.773587][ T29] audit: type=1326 audit(1765333120.389:17727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13552 comm="syz.7.6387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f2e2f9af749 code=0x7ffc0000 [ 526.773614][ T29] audit: type=1326 audit(1765333120.389:17728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13552 comm="syz.7.6387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2f9af749 code=0x7ffc0000 [ 526.773646][ T29] audit: type=1326 audit(1765333120.389:17729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13552 comm="syz.7.6387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2e2f9af749 code=0x7ffc0000 [ 526.773732][ T29] audit: type=1326 audit(1765333120.389:17730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13552 comm="syz.7.6387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2f9af749 code=0x7ffc0000 [ 526.773783][ T29] audit: type=1326 audit(1765333120.389:17731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13552 comm="syz.7.6387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2e2f9af749 code=0x7ffc0000 [ 526.966854][T13559] netlink: 'syz.7.6387': attribute type 6 has an invalid length. [ 526.967206][T13559] netlink: 'syz.7.6387': attribute type 6 has an invalid length. [ 526.979897][T13559] loop7: detected capacity change from 0 to 1024 [ 526.984712][T13559] EXT4-fs: Ignoring removed bh option [ 526.984752][T13559] EXT4-fs: inline encryption not supported [ 526.985214][T13559] EXT4-fs (loop7): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 527.034534][T13560] lo speed is unknown, defaulting to 1000 [ 527.034822][T13560] lo speed is unknown, defaulting to 1000 [ 527.078462][T13559] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=684ce018, mo2=0000] [ 527.078500][T13559] System zones: 0-1, 3-12 [ 527.495022][T13559] EXT4-fs error (device loop7): ext4_map_blocks:825: inode #3: block 1: comm syz.7.6387: lblock 1 mapped to illegal pblock 1 (length 1) [ 527.495227][T13559] EXT4-fs error (device loop7): ext4_acquire_dquot:6986: comm syz.7.6387: Failed to acquire dquot type 0 [ 527.495507][T13559] EXT4-fs error (device loop7): ext4_free_blocks:6728: comm syz.7.6387: Freeing blocks not in datazone - block = 0, count = 4096 [ 527.583684][T13559] EXT4-fs error (device loop7): ext4_read_inode_bitmap:139: comm syz.7.6387: Invalid inode bitmap blk 0 in block_group 0 [ 527.583870][T13559] EXT4-fs error (device loop7) in ext4_free_inode:361: Corrupt filesystem [ 527.583933][T13559] EXT4-fs (loop7): 1 orphan inode deleted [ 527.584314][T13559] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 527.663887][ T4612] EXT4-fs error (device loop7): ext4_map_blocks:783: inode #3: block 1: comm kworker/u8:29: lblock 1 mapped to illegal pblock 1 (length 1) [ 527.706836][T13592] FAULT_INJECTION: forcing a failure. [ 527.706836][T13592] name failslab, interval 1, probability 0, space 0, times 0 [ 527.798462][T13600] 9p: Bad value for 'wfdno' [ 527.809964][T13592] CPU: 0 UID: 0 PID: 13592 Comm: syz.0.6391 Not tainted syzkaller #0 PREEMPT(voluntary) [ 527.810039][T13592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 527.810059][T13592] Call Trace: [ 527.810070][T13592] [ 527.810083][T13592] __dump_stack+0x1d/0x30 [ 527.810117][T13592] dump_stack_lvl+0xe8/0x140 [ 527.810153][T13592] dump_stack+0x15/0x1b [ 527.810181][T13592] should_fail_ex+0x265/0x280 [ 527.810297][T13592] should_failslab+0x8c/0xb0 [ 527.810355][T13592] kmem_cache_alloc_noprof+0x69/0x4b0 [ 527.810387][T13592] ? getname_flags+0x80/0x3b0 [ 527.810502][T13592] getname_flags+0x80/0x3b0 [ 527.810573][T13592] __x64_sys_rmdir+0x21/0x40 [ 527.810601][T13592] x64_sys_call+0x2469/0x3000 [ 527.810645][T13592] do_syscall_64+0xd8/0x2a0 [ 527.810695][T13592] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.810777][T13592] RIP: 0033:0x7f150716f749 [ 527.810800][T13592] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 527.810825][T13592] RSP: 002b:00007f1505bd7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 527.810870][T13592] RAX: ffffffffffffffda RBX: 00007f15073c5fa0 RCX: 00007f150716f749 [ 527.810894][T13592] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 527.810912][T13592] RBP: 00007f1505bd7090 R08: 0000000000000000 R09: 0000000000000000 [ 527.810987][T13592] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 527.811004][T13592] R13: 00007f15073c6038 R14: 00007f15073c5fa0 R15: 00007ffe41ddc0d8 [ 527.811033][T13592] [ 527.985897][ T4612] EXT4-fs error (device loop7): ext4_release_dquot:7022: comm kworker/u8:29: Failed to release dquot type 0 [ 528.139079][T13611] tipc: Started in network mode [ 528.144085][T13611] tipc: Node identity ac14140f, cluster identity 4711 [ 528.151065][T13611] tipc: New replicast peer: 255.255.255.255 [ 528.157281][T13611] tipc: Enabled bearer , priority 10 [ 528.164816][T26162] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 528.174629][T13611] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6396'. [ 528.183804][T13611] tipc: Disabling bearer [ 528.208082][T13609] lo speed is unknown, defaulting to 1000 [ 528.214352][T13609] lo speed is unknown, defaulting to 1000 [ 528.263189][T13611] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6396'. [ 528.342972][T13644] lo speed is unknown, defaulting to 1000 [ 528.349473][T13644] lo speed is unknown, defaulting to 1000 [ 528.733035][T13676] loop1: detected capacity change from 0 to 1024 [ 528.766679][T13676] EXT4-fs: inline encryption not supported [ 529.205684][T13676] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 529.356496][T13685] lo speed is unknown, defaulting to 1000 [ 529.362591][T13685] lo speed is unknown, defaulting to 1000 [ 529.816680][T13676] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4215: comm syz.1.6400: Allocating blocks 385-513 which overlap fs metadata [ 530.725221][T13712] veth0_to_batadv: entered promiscuous mode [ 530.731341][T13712] macvtap1: entered allmulticast mode [ 530.736877][T13712] veth0_to_batadv: entered allmulticast mode [ 530.754290][T13676] EXT4-fs (loop1): pa ffff888107a6ca80: logic 16, phys. 129, len 24 [ 530.762320][T13676] EXT4-fs error (device loop1): ext4_mb_release_inode_pa:5466: group 0, free 0, pa_free 8 [ 530.830690][T13712] veth0_to_batadv: left allmulticast mode [ 530.836647][T13712] veth0_to_batadv: left promiscuous mode [ 530.955437][T13728] 9p: Bad value for 'wfdno' [ 530.976891][T13718] lo speed is unknown, defaulting to 1000 [ 531.028236][ T6022] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 531.072440][T13718] lo speed is unknown, defaulting to 1000 [ 531.160339][T13737] tipc: New replicast peer: 255.255.255.255 [ 531.166624][T13737] tipc: Enabled bearer , priority 10 [ 531.287444][T13717] lo speed is unknown, defaulting to 1000 [ 531.314820][T13743] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6407'. [ 531.323981][T13743] tipc: Disabling bearer [ 531.341226][T13717] lo speed is unknown, defaulting to 1000 [ 531.364888][T13737] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6407'. [ 531.510116][T13764] loop4: detected capacity change from 0 to 1024 [ 531.693643][T13744] lo speed is unknown, defaulting to 1000 [ 531.866565][T13744] lo speed is unknown, defaulting to 1000 [ 531.907483][T13798] FAULT_INJECTION: forcing a failure. [ 531.907483][T13798] name fail_futex, interval 1, probability 0, space 0, times 1 [ 531.920451][T13798] CPU: 1 UID: 0 PID: 13798 Comm: syz.1.6411 Not tainted syzkaller #0 PREEMPT(voluntary) [ 531.920567][T13798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 531.920585][T13798] Call Trace: [ 531.920593][T13798] [ 531.920603][T13798] __dump_stack+0x1d/0x30 [ 531.920634][T13798] dump_stack_lvl+0xe8/0x140 [ 531.920770][T13798] dump_stack+0x15/0x1b [ 531.920857][T13798] should_fail_ex+0x265/0x280 [ 531.920889][T13798] should_fail+0xb/0x20 [ 531.920910][T13798] get_futex_key+0x130/0xc00 [ 531.920947][T13798] ? should_fail_ex+0xdb/0x280 [ 531.920977][T13798] futex_wait_setup+0x4a/0x3e0 [ 531.921040][T13798] futex_wait_requeue_pi+0x1ac/0x6a0 [ 531.921087][T13798] ? __pfx_futex_wake_mark+0x10/0x10 [ 531.921123][T13798] ? proc_fail_nth_write+0x13b/0x160 [ 531.921156][T13798] do_futex+0x136/0x380 [ 531.921322][T13798] __se_sys_futex+0x2ed/0x360 [ 531.921406][T13798] ? mutex_unlock+0x4f/0x90 [ 531.921438][T13798] __x64_sys_futex+0x78/0x90 [ 531.921470][T13798] x64_sys_call+0x2bc2/0x3000 [ 531.921501][T13798] do_syscall_64+0xd8/0x2a0 [ 531.921593][T13798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.921620][T13798] RIP: 0033:0x7f363aa9f749 [ 531.921690][T13798] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 531.921707][T13798] RSP: 002b:00007f3639507038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 531.921725][T13798] RAX: ffffffffffffffda RBX: 00007f363acf5fa0 RCX: 00007f363aa9f749 [ 531.921738][T13798] RDX: 0000000000000000 RSI: 000080000000000b RDI: 000020000000cffc [ 531.921826][T13798] RBP: 00007f3639507090 R08: 0000200000048000 R09: 0000000000000300 [ 531.921839][T13798] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 531.921854][T13798] R13: 00007f363acf6038 R14: 00007f363acf5fa0 R15: 00007ffdf1f09fd8 [ 531.921878][T13798] [ 532.254681][T13833] netlink: 83992 bytes leftover after parsing attributes in process `syz.4.6413'. [ 532.268513][T13833] netlink: zone id is out of range [ 532.273824][T13833] netlink: zone id is out of range [ 532.279759][T13833] netlink: zone id is out of range [ 532.284960][ T29] kauditd_printk_skb: 179 callbacks suppressed [ 532.284976][ T29] audit: type=1326 audit(1765333126.099:17908): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13815 comm="syz.1.6412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 532.299238][T13833] netlink: zone id is out of range [ 532.314825][ T29] audit: type=1326 audit(1765333126.099:17909): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13815 comm="syz.1.6412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 532.332126][T13833] netlink: set zone limit has 8 unknown bytes [ 532.343557][ T29] audit: type=1326 audit(1765333126.099:17910): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13815 comm="syz.1.6412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 532.350924][T13843] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 532.373242][ T29] audit: type=1326 audit(1765333126.099:17911): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13815 comm="syz.1.6412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 532.373296][ T29] audit: type=1326 audit(1765333126.099:17912): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13815 comm="syz.1.6412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 532.428346][ T29] audit: type=1326 audit(1765333126.099:17913): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13815 comm="syz.1.6412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=264 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 532.451985][ T29] audit: type=1326 audit(1765333126.099:17914): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13815 comm="syz.1.6412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 532.475600][ T29] audit: type=1326 audit(1765333126.109:17915): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13815 comm="syz.1.6412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 532.499413][T13842] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 532.551290][T13833] lo speed is unknown, defaulting to 1000 [ 532.557930][T13833] lo speed is unknown, defaulting to 1000 [ 532.586490][T13863] tipc: Started in network mode [ 532.591434][T13863] tipc: Node identity ac14140f, cluster identity 4711 [ 532.599758][T13863] tipc: New replicast peer: 255.255.255.255 [ 532.605955][T13863] tipc: Enabled bearer , priority 10 [ 532.618985][T13863] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6416'. [ 532.628083][T13863] tipc: Disabling bearer [ 532.645998][T13863] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6416'. [ 532.702799][T13880] netlink: 52 bytes leftover after parsing attributes in process `syz.7.6417'. [ 532.725641][T13882] 9p: Bad value for 'rfdno' [ 532.754642][ T29] audit: type=1400 audit(1765333126.579:17916): avc: denied { read write } for pid=13886 comm="syz.4.6420" name="sg0" dev="devtmpfs" ino=137 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 532.781779][ T29] audit: type=1400 audit(1765333126.579:17917): avc: denied { ioctl open } for pid=13886 comm="syz.4.6420" path="/dev/sg0" dev="devtmpfs" ino=137 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 532.828027][T13890] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6421'. [ 532.839757][T13880] SET target dimension over the limit! [ 532.932030][T13899] netlink: 'syz.6.6424': attribute type 39 has an invalid length. [ 532.966949][T13905] tipc: New replicast peer: 255.255.255.255 [ 532.973232][T13905] tipc: Enabled bearer , priority 10 [ 532.979811][T13905] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6425'. [ 532.988973][T13905] tipc: Disabling bearer [ 533.000064][T13905] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6425'. [ 533.115500][T13913] loop7: detected capacity change from 0 to 1024 [ 533.406276][T13922] lo speed is unknown, defaulting to 1000 [ 533.413929][T13922] lo speed is unknown, defaulting to 1000 [ 533.671301][T13947] netlink: 83992 bytes leftover after parsing attributes in process `syz.6.6429'. [ 533.680787][T13947] netlink: zone id is out of range [ 533.685985][T13947] netlink: zone id is out of range [ 533.692444][T13947] netlink: zone id is out of range [ 533.701945][T13947] netlink: zone id is out of range [ 533.804167][T13957] netlink: 'syz.0.6433': attribute type 3 has an invalid length. [ 533.867827][T13962] netlink: 'syz.0.6435': attribute type 39 has an invalid length. [ 533.882545][ T4612] Bluetooth: hci0: Frame reassembly failed (-84) [ 533.914587][T13947] lo speed is unknown, defaulting to 1000 [ 533.922935][T13947] lo speed is unknown, defaulting to 1000 [ 534.337233][T14015] lo speed is unknown, defaulting to 1000 [ 534.343883][T14015] lo speed is unknown, defaulting to 1000 [ 535.248299][T14043] loop1: detected capacity change from 0 to 1024 [ 535.364726][T14054] netlink: 'syz.4.6446': attribute type 3 has an invalid length. [ 535.447462][T14056] bridge_slave_0: left allmulticast mode [ 535.453169][T14056] bridge_slave_0: left promiscuous mode [ 535.458969][T14056] bridge0: port 1(bridge_slave_0) entered disabled state [ 535.474766][T14056] bridge_slave_1: left allmulticast mode [ 535.480450][T14056] bridge_slave_1: left promiscuous mode [ 535.486287][T14056] bridge0: port 2(bridge_slave_1) entered disabled state [ 535.496535][T14056] bond0: (slave bond_slave_0): Releasing backup interface [ 535.506930][T14056] bond0: (slave bond_slave_1): Releasing backup interface [ 535.517856][T14056] team_slave_0: left promiscuous mode [ 535.525617][T14056] team0: Port device team_slave_0 removed [ 535.532795][T14056] team_slave_1: left promiscuous mode [ 535.540507][T14056] team0: Port device team_slave_1 removed [ 535.548122][T14056] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 535.555576][T14056] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 535.577698][T14056] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 535.585253][T14056] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 535.644483][T14061] lo speed is unknown, defaulting to 1000 [ 535.650490][T14061] lo speed is unknown, defaulting to 1000 [ 535.750035][T14107] xt_hashlimit: max too large, truncated to 1048576 [ 535.913863][T14109] lo speed is unknown, defaulting to 1000 [ 535.924710][T14109] lo speed is unknown, defaulting to 1000 [ 535.933434][T24605] Bluetooth: hci0: command 0x1003 tx timeout [ 535.934105][ T3542] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 535.941576][T14124] loop1: detected capacity change from 0 to 1024 [ 535.954067][T14124] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 535.962946][T14124] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 535.974098][T14124] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 535.982465][T14124] EXT4-fs (loop1): orphan cleanup on readonly fs [ 535.989427][T14124] EXT4-fs error (device loop1): ext4_free_blocks:6728: comm syz.1.6457: Freeing blocks not in datazone - block = 0, count = 4096 [ 536.003349][T14124] EXT4-fs (loop1): Remounting filesystem read-only [ 536.010122][T14124] EXT4-fs (loop1): 1 orphan inode deleted [ 536.016453][T14124] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 536.041953][ T6022] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 536.335177][T14162] FAULT_INJECTION: forcing a failure. [ 536.335177][T14162] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 536.348354][T14162] CPU: 1 UID: 0 PID: 14162 Comm: syz.0.6463 Not tainted syzkaller #0 PREEMPT(voluntary) [ 536.348389][T14162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 536.348405][T14162] Call Trace: [ 536.348414][T14162] [ 536.348442][T14162] __dump_stack+0x1d/0x30 [ 536.348547][T14162] dump_stack_lvl+0xe8/0x140 [ 536.348573][T14162] dump_stack+0x15/0x1b [ 536.348673][T14162] should_fail_ex+0x265/0x280 [ 536.348700][T14162] should_fail+0xb/0x20 [ 536.348725][T14162] should_fail_usercopy+0x1a/0x20 [ 536.348761][T14162] _copy_from_iter+0xcf/0xe70 [ 536.348810][T14162] ? __alloc_skb+0x3bb/0x4d0 [ 536.348873][T14162] ? __alloc_skb+0x24d/0x4d0 [ 536.348906][T14162] netlink_sendmsg+0x471/0x6b0 [ 536.348951][T14162] ? __pfx_netlink_sendmsg+0x10/0x10 [ 536.348998][T14162] __sock_sendmsg+0x145/0x180 [ 536.349099][T14162] ____sys_sendmsg+0x31e/0x4a0 [ 536.349140][T14162] ___sys_sendmsg+0x17b/0x1d0 [ 536.349189][T14162] __x64_sys_sendmsg+0xd4/0x160 [ 536.349248][T14162] x64_sys_call+0x17ba/0x3000 [ 536.349279][T14162] do_syscall_64+0xd8/0x2a0 [ 536.349339][T14162] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.349368][T14162] RIP: 0033:0x7f150716f749 [ 536.349388][T14162] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 536.349406][T14162] RSP: 002b:00007f1505bd7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 536.349425][T14162] RAX: ffffffffffffffda RBX: 00007f15073c5fa0 RCX: 00007f150716f749 [ 536.349438][T14162] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 536.349535][T14162] RBP: 00007f1505bd7090 R08: 0000000000000000 R09: 0000000000000000 [ 536.349563][T14162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 536.349576][T14162] R13: 00007f15073c6038 R14: 00007f15073c5fa0 R15: 00007ffe41ddc0d8 [ 536.349645][T14162] [ 536.669882][T14174] loop1: detected capacity change from 0 to 1024 [ 536.775185][T14169] lo speed is unknown, defaulting to 1000 [ 536.781422][T14169] lo speed is unknown, defaulting to 1000 [ 537.016518][T14208] loop7: detected capacity change from 0 to 512 [ 537.025989][T14183] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14183 comm=syz.6.6467 [ 537.069223][T14206] bridge0: port 1(batadv1) entered blocking state [ 537.075881][T14206] bridge0: port 1(batadv1) entered disabled state [ 537.085587][T14206] batadv1: entered allmulticast mode [ 537.091936][T14206] batadv1: entered promiscuous mode [ 537.099906][T14208] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 537.166729][T14183] loop6: detected capacity change from 0 to 512 [ 537.185756][T14208] ext4 filesystem being mounted at /524/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 537.205325][T14206] __nla_validate_parse: 3 callbacks suppressed [ 537.205343][T14206] netlink: 83992 bytes leftover after parsing attributes in process `syz.0.6469'. [ 537.279175][T14206] net_ratelimit: 19 callbacks suppressed [ 537.279202][T14206] netlink: set zone limit has 8 unknown bytes [ 537.298383][T26162] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 537.319527][T14226] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.355756][T14235] netlink: 'syz.0.6475': attribute type 3 has an invalid length. [ 537.365992][T14226] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.392207][ T4624] Bluetooth: hci0: Frame reassembly failed (-84) [ 537.415695][T14226] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.464957][T14226] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.532628][ T4643] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.550337][ T4643] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.563203][ T4643] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.571746][ T4643] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.573394][ T4613] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 537.589208][ T4613] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 537.703398][ T6483] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 537.719058][T14274] raw_sendmsg: syz.1.6478 forgot to set AF_INET. Fix it! [ 537.719071][ T29] kauditd_printk_skb: 220 callbacks suppressed [ 537.719115][ T29] audit: type=1400 audit(1765333131.539:18138): avc: denied { write } for pid=14273 comm="syz.1.6478" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 537.798748][ T29] audit: type=1326 audit(1765333131.619:18139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14275 comm="syz.1.6479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 537.822969][ T29] audit: type=1326 audit(1765333131.619:18140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14275 comm="syz.1.6479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=266 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 537.846696][ T29] audit: type=1326 audit(1765333131.619:18141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14275 comm="syz.1.6479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 537.870421][ T29] audit: type=1326 audit(1765333131.619:18142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14275 comm="syz.1.6479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f363aa9df90 code=0x7ffc0000 [ 537.894094][ T29] audit: type=1326 audit(1765333131.619:18143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14275 comm="syz.1.6479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7f363aaa0f77 code=0x7ffc0000 [ 537.917821][ T29] audit: type=1326 audit(1765333131.619:18144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14275 comm="syz.1.6479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 537.941426][ T29] audit: type=1326 audit(1765333131.619:18145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14275 comm="syz.1.6479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7f363aaa0f77 code=0x7ffc0000 [ 537.948911][T14278] xt_hashlimit: max too large, truncated to 1048576 [ 537.965028][ T29] audit: type=1326 audit(1765333131.619:18146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14275 comm="syz.1.6479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f363aa9e3aa code=0x7ffc0000 [ 537.995045][ T29] audit: type=1326 audit(1765333131.619:18147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14275 comm="syz.1.6479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 538.241138][T14297] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6482'. [ 538.319704][T14297] SET target dimension over the limit! [ 538.472138][T14343] FAULT_INJECTION: forcing a failure. [ 538.472138][T14343] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 538.485435][T14343] CPU: 1 UID: 0 PID: 14343 Comm: syz.4.6485 Not tainted syzkaller #0 PREEMPT(voluntary) [ 538.485465][T14343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 538.485486][T14343] Call Trace: [ 538.485492][T14343] [ 538.485499][T14343] __dump_stack+0x1d/0x30 [ 538.485522][T14343] dump_stack_lvl+0xe8/0x140 [ 538.485542][T14343] dump_stack+0x15/0x1b [ 538.485563][T14343] should_fail_ex+0x265/0x280 [ 538.485595][T14343] should_fail+0xb/0x20 [ 538.485615][T14343] should_fail_usercopy+0x1a/0x20 [ 538.485637][T14343] _copy_from_user+0x1c/0xb0 [ 538.485673][T14343] ___sys_sendmsg+0xc1/0x1d0 [ 538.485792][T14343] __x64_sys_sendmsg+0xd4/0x160 [ 538.485832][T14343] x64_sys_call+0x17ba/0x3000 [ 538.485862][T14343] do_syscall_64+0xd8/0x2a0 [ 538.485971][T14343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.486044][T14343] RIP: 0033:0x7f82bd12f749 [ 538.486059][T14343] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 538.486122][T14343] RSP: 002b:00007f82bbb8f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 538.486146][T14343] RAX: ffffffffffffffda RBX: 00007f82bd385fa0 RCX: 00007f82bd12f749 [ 538.486161][T14343] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 538.486176][T14343] RBP: 00007f82bbb8f090 R08: 0000000000000000 R09: 0000000000000000 [ 538.486187][T14343] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 538.486199][T14343] R13: 00007f82bd386038 R14: 00007f82bd385fa0 R15: 00007ffda7caf4c8 [ 538.486245][T14343] [ 538.711965][T14367] netlink: 'syz.4.6487': attribute type 3 has an invalid length. [ 538.877893][T14373] lo speed is unknown, defaulting to 1000 [ 538.891363][T14373] lo speed is unknown, defaulting to 1000 [ 539.102385][T14422] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.218569][T14422] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.277514][T14458] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6490'. [ 539.362714][T14422] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.436802][T14422] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.456518][T24605] Bluetooth: hci0: command 0x1003 tx timeout [ 539.462710][ T3542] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 539.522694][ T4612] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.535930][ T4636] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.549671][ T4612] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.561685][ T4612] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.987980][T14504] netlink: 52 bytes leftover after parsing attributes in process `syz.6.6495'. [ 540.030252][T14504] SET target dimension over the limit! [ 540.055554][ T4621] Bluetooth: hci1: Frame reassembly failed (-84) [ 540.358694][T14514] lo speed is unknown, defaulting to 1000 [ 540.365403][T14514] lo speed is unknown, defaulting to 1000 [ 540.707795][T14540] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6499'. [ 540.847373][T14546] netlink: 'syz.4.6500': attribute type 39 has an invalid length. [ 540.928418][T14553] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.025699][T14553] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.096137][T14553] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.221675][T14553] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 541.269347][ T4621] Bluetooth: hci2: Frame reassembly failed (-84) [ 541.309780][T14576] rdma_rxe: rxe_newlink: failed to add bond_slave_0 [ 541.646390][T14585] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6507'. [ 541.688562][T14585] SET target dimension over the limit! [ 541.694130][T12367] Bluetooth: hci0: command 0x1003 tx timeout [ 541.700329][ T3542] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 541.724085][T14589] netlink: 83992 bytes leftover after parsing attributes in process `syz.0.6508'. [ 541.733662][T14589] netlink: zone id is out of range [ 541.738914][T14589] netlink: zone id is out of range [ 541.744411][T14589] netlink: zone id is out of range [ 541.749525][T14589] netlink: zone id is out of range [ 541.762792][T14589] netlink: set zone limit has 8 unknown bytes [ 541.870917][T14589] lo speed is unknown, defaulting to 1000 [ 541.879215][T14589] lo speed is unknown, defaulting to 1000 [ 542.089180][ T4621] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.093499][T24605] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 542.103522][ T3542] Bluetooth: hci1: command 0x1003 tx timeout [ 542.103533][ T4621] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.121394][ T4621] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.133434][ T4621] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.251431][T14635] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6512'. [ 542.260589][T14635] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6512'. [ 542.271950][T14631] netlink: 24 bytes leftover after parsing attributes in process `syz.7.6511'. [ 542.273048][T14635] bridge0: port 1(vlan2) entered blocking state [ 542.287370][T14635] bridge0: port 1(vlan2) entered disabled state [ 542.293981][T14635] vlan2: entered allmulticast mode [ 542.299107][T14635] bridge0: entered allmulticast mode [ 542.305136][T14635] vlan2: left allmulticast mode [ 542.309993][T14635] bridge0: left allmulticast mode [ 542.611880][T14652] loop1: detected capacity change from 0 to 1024 [ 542.729131][T14657] loop6: detected capacity change from 0 to 128 [ 542.763377][ T29] kauditd_printk_skb: 57 callbacks suppressed [ 542.763398][ T29] audit: type=1400 audit(1765333136.559:18205): avc: denied { mount } for pid=14656 comm="syz.6.6516" name="/" dev="loop6" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 542.836232][ T29] audit: type=1400 audit(1765333136.659:18206): avc: denied { unmount } for pid=22011 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 542.952143][T14666] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6518'. [ 543.011507][T14666] SET target dimension over the limit! [ 543.037301][T14668] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 543.048918][T14668] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 543.076297][T14671] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.124852][T14671] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.152646][T14677] netlink: 'syz.6.6517': attribute type 1 has an invalid length. [ 543.175669][T14671] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.225187][T14671] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.293461][T24605] Bluetooth: hci2: command 0x1003 tx timeout [ 543.293461][ T6483] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 543.314572][ T4613] Bluetooth: hci1: Frame reassembly failed (-84) [ 543.314989][ T4615] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.334337][ T4615] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.350811][ T4615] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.363955][ T4615] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.546888][ T29] audit: type=1400 audit(1765333137.369:18207): avc: denied { append } for pid=14743 comm="syz.0.6525" name="loop9" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 543.573340][ T29] audit: type=1326 audit(1765333137.389:18208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14743 comm="syz.0.6525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 543.597551][ T29] audit: type=1326 audit(1765333137.399:18209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14743 comm="syz.0.6525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 543.621258][ T29] audit: type=1326 audit(1765333137.399:18210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14743 comm="syz.0.6525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=20 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 543.645118][ T29] audit: type=1326 audit(1765333137.399:18211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14743 comm="syz.0.6525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 543.668749][ T29] audit: type=1326 audit(1765333137.399:18212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14743 comm="syz.0.6525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 543.692511][ T29] audit: type=1326 audit(1765333137.399:18213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14743 comm="syz.0.6525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 543.716149][ T29] audit: type=1326 audit(1765333137.399:18214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14743 comm="syz.0.6525" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 543.793901][T14748] lo speed is unknown, defaulting to 1000 [ 543.797350][T14753] netlink: 'syz.6.6528': attribute type 39 has an invalid length. [ 543.800011][T14748] lo speed is unknown, defaulting to 1000 [ 543.832442][T14767] netlink: 52 bytes leftover after parsing attributes in process `syz.6.6529'. [ 543.919625][T14767] SET target dimension over the limit! [ 544.005751][T14778] lo speed is unknown, defaulting to 1000 [ 544.012103][T14778] lo speed is unknown, defaulting to 1000 [ 544.086199][T14786] lo speed is unknown, defaulting to 1000 [ 544.092560][T14786] lo speed is unknown, defaulting to 1000 [ 544.453452][T14832] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.493478][T24605] Bluetooth: hci0: command 0x1003 tx timeout [ 544.499718][ T3542] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 544.545337][T14832] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.642617][T14832] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.751406][T14832] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.922320][T14855] lo speed is unknown, defaulting to 1000 [ 544.953960][T14855] lo speed is unknown, defaulting to 1000 [ 545.259345][T14884] lo speed is unknown, defaulting to 1000 [ 545.269745][T14884] lo speed is unknown, defaulting to 1000 [ 545.373380][ T6483] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 545.379547][ T3542] Bluetooth: hci1: command 0x1003 tx timeout [ 545.385975][T14884] chnl_net:caif_netlink_parms(): no params data found [ 545.420264][T14999] netlink: 'syz.7.6538': attribute type 1 has an invalid length. [ 545.474187][T14884] bridge0: port 1(bridge_slave_0) entered blocking state [ 545.481371][T14884] bridge0: port 1(bridge_slave_0) entered disabled state [ 545.493736][T14884] bridge_slave_0: entered allmulticast mode [ 545.500359][T14884] bridge_slave_0: entered promiscuous mode [ 545.514336][T14884] bridge0: port 2(bridge_slave_1) entered blocking state [ 545.521519][T14884] bridge0: port 2(bridge_slave_1) entered disabled state [ 545.533606][T14884] bridge_slave_1: entered allmulticast mode [ 545.540345][T14884] bridge_slave_1: entered promiscuous mode [ 545.565733][T14884] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 545.576643][T14884] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 545.601024][T14884] team0: Port device team_slave_0 added [ 545.607935][T14884] team0: Port device team_slave_1 added [ 545.629545][T14884] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 545.636594][T14884] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 545.662572][T14884] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 545.674539][T14884] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 545.681508][T14884] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 545.707687][T14884] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 545.746831][T14884] hsr_slave_0: entered promiscuous mode [ 545.753260][T14884] hsr_slave_1: entered promiscuous mode [ 545.759464][T14884] debugfs: 'hsr0' already exists in 'hsr' [ 545.765252][T14884] Cannot create hsr debugfs directory [ 545.841536][T14884] netdevsim netdevsim6 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 545.851455][T14884] netdevsim netdevsim6 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 545.905774][T14884] netdevsim netdevsim6 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 545.915675][T14884] netdevsim netdevsim6 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 546.014148][T15255] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 546.031821][T14884] netdevsim netdevsim6 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 546.041824][T14884] netdevsim netdevsim6 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 546.095093][T14884] netdevsim netdevsim6 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 546.105064][T14884] netdevsim netdevsim6 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 546.116935][T15263] IPv6: NLM_F_CREATE should be specified when creating new route [ 546.295099][T15269] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6543'. [ 546.319179][T15284] 9pnet_fd: Insufficient options for proto=fd [ 546.349023][T15251] lo speed is unknown, defaulting to 1000 [ 546.355849][T14884] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 546.368017][T14884] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 546.381735][T15251] lo speed is unknown, defaulting to 1000 [ 546.391452][T14884] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 546.401314][T14884] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 546.646291][T15299] lo speed is unknown, defaulting to 1000 [ 546.691037][T15299] lo speed is unknown, defaulting to 1000 [ 546.863468][T14884] 8021q: adding VLAN 0 to HW filter on device bond0 [ 546.892792][T14884] 8021q: adding VLAN 0 to HW filter on device team0 [ 546.914549][ T4633] bridge0: port 1(bridge_slave_0) entered blocking state [ 546.921676][ T4633] bridge0: port 1(bridge_slave_0) entered forwarding state [ 546.940117][T15352] netlink: 83992 bytes leftover after parsing attributes in process `syz.4.6549'. [ 546.954512][T15352] netlink: zone id is out of range [ 546.955032][ T4643] bridge0: port 2(bridge_slave_1) entered blocking state [ 546.959649][T15352] netlink: zone id is out of range [ 546.959904][T15352] netlink: zone id is out of range [ 546.966731][ T4643] bridge0: port 2(bridge_slave_1) entered forwarding state [ 546.985065][T15352] netlink: zone id is out of range [ 547.009858][T15352] netlink: set zone limit has 8 unknown bytes [ 547.046203][T15352] lo speed is unknown, defaulting to 1000 [ 547.052253][T15352] lo speed is unknown, defaulting to 1000 [ 547.145995][T14884] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 547.328620][T14884] veth0_vlan: entered promiscuous mode [ 547.348000][T14884] veth1_vlan: entered promiscuous mode [ 547.383473][T14884] veth0_macvtap: entered promiscuous mode [ 547.406114][T14884] veth1_macvtap: entered promiscuous mode [ 547.485788][T15394] lo speed is unknown, defaulting to 1000 [ 547.495816][T15394] lo speed is unknown, defaulting to 1000 [ 547.631306][T14884] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 547.645249][T14884] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 547.663065][T15412] netlink: 'syz.1.6551': attribute type 1 has an invalid length. [ 547.718456][ T4613] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.731920][ T4613] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.780465][ T4613] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.791341][ T4613] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.805328][T15460] IPv6: NLM_F_CREATE should be specified when creating new route [ 547.848332][ T29] kauditd_printk_skb: 30 callbacks suppressed [ 547.848351][ T29] audit: type=1400 audit(1765333141.669:18243): avc: denied { module_load } for pid=15462 comm="syz.6.6552" path="/sys/kernel/notes" dev="sysfs" ino=210 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 547.914128][ T4643] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.931619][ T72] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.953704][T15471] netlink: 83992 bytes leftover after parsing attributes in process `syz.4.6554'. [ 547.963174][ T72] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.980524][ T72] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 548.002087][T15471] netlink: zone id is out of range [ 548.002329][T15478] loop4: detected capacity change from 0 to 512 [ 548.007288][T15471] netlink: zone id is out of range [ 548.036081][T15478] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 548.087219][T15478] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=200ec018, mo2=0002] [ 548.105293][T15478] System zones: 1-12 [ 548.111083][T15484] FAULT_INJECTION: forcing a failure. [ 548.111083][T15484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 548.122465][T15471] netlink: set zone limit has 8 unknown bytes [ 548.124289][T15484] CPU: 1 UID: 0 PID: 15484 Comm: syz.0.6556 Not tainted syzkaller #0 PREEMPT(voluntary) [ 548.124319][T15484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 548.124336][T15484] Call Trace: [ 548.124345][T15484] [ 548.124355][T15484] __dump_stack+0x1d/0x30 [ 548.124389][T15484] dump_stack_lvl+0xe8/0x140 [ 548.124448][T15484] dump_stack+0x15/0x1b [ 548.124475][T15484] should_fail_ex+0x265/0x280 [ 548.124572][T15484] should_fail+0xb/0x20 [ 548.124597][T15484] should_fail_usercopy+0x1a/0x20 [ 548.124695][T15484] _copy_from_user+0x1c/0xb0 [ 548.124730][T15484] ___sys_sendmsg+0xc1/0x1d0 [ 548.124786][T15484] __x64_sys_sendmsg+0xd4/0x160 [ 548.124906][T15484] x64_sys_call+0x17ba/0x3000 [ 548.124938][T15484] do_syscall_64+0xd8/0x2a0 [ 548.124987][T15484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.125027][T15484] RIP: 0033:0x7f150716f749 [ 548.125046][T15484] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 548.125070][T15484] RSP: 002b:00007f1505bd7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 548.125119][T15484] RAX: ffffffffffffffda RBX: 00007f15073c5fa0 RCX: 00007f150716f749 [ 548.125136][T15484] RDX: 0000000020040844 RSI: 0000200000000340 RDI: 0000000000000006 [ 548.125152][T15484] RBP: 00007f1505bd7090 R08: 0000000000000000 R09: 0000000000000000 [ 548.125169][T15484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 548.125243][T15484] R13: 00007f15073c6038 R14: 00007f15073c5fa0 R15: 00007ffe41ddc0d8 [ 548.125268][T15484] [ 548.137975][ T29] audit: type=1326 audit(1765333141.909:18244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15481 comm="syz.6.6555" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 548.153655][ T29] audit: type=1326 audit(1765333141.909:18245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15481 comm="syz.6.6555" exe="/root/syz-executor" sig=0 arch=c000003e syscall=239 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 548.153686][ T29] audit: type=1326 audit(1765333141.909:18246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15481 comm="syz.6.6555" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 548.194951][T15486] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6557'. [ 548.198405][T15478] EXT4-fs (loop4): 1 truncate cleaned up [ 548.378576][T15478] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 548.405740][ T29] audit: type=1326 audit(1765333142.219:18247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15490 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 548.428954][ T29] audit: type=1326 audit(1765333142.219:18248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15490 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 548.452133][ T29] audit: type=1326 audit(1765333142.219:18249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15490 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 548.475371][ T29] audit: type=1326 audit(1765333142.219:18250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15490 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 548.498511][ T29] audit: type=1326 audit(1765333142.219:18251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15490 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 548.521589][ T29] audit: type=1326 audit(1765333142.219:18252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15490 comm="gtp" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f150716f749 code=0x7ffc0000 [ 548.539755][ T6483] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 548.550853][ T3542] Bluetooth: hci0: command 0x1003 tx timeout [ 548.574830][T15494] lo speed is unknown, defaulting to 1000 [ 548.582632][T15471] can0: slcan on ttyS3. [ 548.582634][T15494] lo speed is unknown, defaulting to 1000 [ 548.628607][T15496] lo speed is unknown, defaulting to 1000 [ 548.640148][T15496] lo speed is unknown, defaulting to 1000 [ 548.693576][T15478] can0 (unregistered): slcan off ttyS3. [ 548.782095][ T9883] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 548.931109][T15574] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.995437][T15574] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.086783][T15574] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.155377][T15574] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.198022][T15583] lo speed is unknown, defaulting to 1000 [ 549.209259][T15583] lo speed is unknown, defaulting to 1000 [ 549.470661][T15610] vlan2: entered promiscuous mode [ 549.475984][T15610] vlan2: entered allmulticast mode [ 549.481180][T15610] hsr_slave_1: entered allmulticast mode [ 549.499647][T15614] netlink: 83992 bytes leftover after parsing attributes in process `syz.1.6570'. [ 549.510314][T15614] netlink: zone id is out of range [ 549.515542][T15614] netlink: zone id is out of range [ 549.521406][T15614] netlink: zone id is out of range [ 549.526971][T15614] netlink: zone id is out of range [ 549.532226][T15610] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6569'. [ 549.553234][T15614] netlink: set zone limit has 8 unknown bytes [ 549.663706][T15614] lo speed is unknown, defaulting to 1000 [ 549.686522][T15614] lo speed is unknown, defaulting to 1000 [ 549.936858][T15662] lo speed is unknown, defaulting to 1000 [ 549.945676][T15662] lo speed is unknown, defaulting to 1000 [ 550.166578][T15703] loop6: detected capacity change from 0 to 128 [ 550.203580][T15693] loop4: detected capacity change from 0 to 512 [ 550.210804][T15693] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 550.226323][T15693] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1306: group 0, block bitmap and bg descriptor inconsistent: 214 vs 220 free clusters [ 550.233886][T15709] bio_check_eod: 101 callbacks suppressed [ 550.233910][T15709] syz.6.6580: attempt to access beyond end of device [ 550.233910][T15709] loop6: rw=1, sector=145, nr_sectors = 8 limit=128 [ 550.241294][T15693] EXT4-fs (loop4): 1 truncate cleaned up [ 550.266397][T15709] syz.6.6580: attempt to access beyond end of device [ 550.266397][T15709] loop6: rw=1, sector=161, nr_sectors = 8 limit=128 [ 550.267403][T15693] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 550.288051][T15709] syz.6.6580: attempt to access beyond end of device [ 550.288051][T15709] loop6: rw=1, sector=177, nr_sectors = 8 limit=128 [ 550.306964][T15709] syz.6.6580: attempt to access beyond end of device [ 550.306964][T15709] loop6: rw=1, sector=193, nr_sectors = 8 limit=128 [ 550.320448][T15709] syz.6.6580: attempt to access beyond end of device [ 550.320448][T15709] loop6: rw=1, sector=209, nr_sectors = 8 limit=128 [ 550.333979][T15709] syz.6.6580: attempt to access beyond end of device [ 550.333979][T15709] loop6: rw=1, sector=225, nr_sectors = 8 limit=128 [ 550.347276][T15709] syz.6.6580: attempt to access beyond end of device [ 550.347276][T15709] loop6: rw=1, sector=241, nr_sectors = 8 limit=128 [ 550.360592][T15709] syz.6.6580: attempt to access beyond end of device [ 550.360592][T15709] loop6: rw=1, sector=257, nr_sectors = 8 limit=128 [ 550.374139][T15709] syz.6.6580: attempt to access beyond end of device [ 550.374139][T15709] loop6: rw=1, sector=273, nr_sectors = 8 limit=128 [ 550.387347][T15709] syz.6.6580: attempt to access beyond end of device [ 550.387347][T15709] loop6: rw=1, sector=289, nr_sectors = 8 limit=128 [ 550.456721][T15715] lo speed is unknown, defaulting to 1000 [ 550.463065][T15715] lo speed is unknown, defaulting to 1000 [ 550.665558][T15743] loop7: detected capacity change from 0 to 128 [ 550.717174][T15743] netlink: 20 bytes leftover after parsing attributes in process `syz.7.6583'. [ 550.820792][ T9883] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 550.928315][ T4616] Bluetooth: hci0: Frame reassembly failed (-84) [ 551.010361][T15766] FAULT_INJECTION: forcing a failure. [ 551.010361][T15766] name failslab, interval 1, probability 0, space 0, times 0 [ 551.011784][T15758] sctp: [Deprecated]: syz.7.6587 (pid 15758) Use of int in maxseg socket option. [ 551.011784][T15758] Use struct sctp_assoc_value instead [ 551.023186][T15766] CPU: 1 UID: 0 PID: 15766 Comm: syz.1.6589 Not tainted syzkaller #0 PREEMPT(voluntary) [ 551.023226][T15766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 551.023247][T15766] Call Trace: [ 551.023256][T15766] [ 551.023267][T15766] __dump_stack+0x1d/0x30 [ 551.023308][T15766] dump_stack_lvl+0xe8/0x140 [ 551.023400][T15766] dump_stack+0x15/0x1b [ 551.023503][T15766] should_fail_ex+0x265/0x280 [ 551.023536][T15766] should_failslab+0x8c/0xb0 [ 551.023568][T15766] __kmalloc_noprof+0xb9/0x5a0 [ 551.023629][T15766] ? kernfs_fop_write_iter+0xe2/0x300 [ 551.023679][T15766] kernfs_fop_write_iter+0xe2/0x300 [ 551.023760][T15766] ? rw_verify_area+0x8d/0x160 [ 551.023813][T15766] aio_write+0x2e5/0x410 [ 551.023865][T15766] io_submit_one+0xb74/0x1280 [ 551.023912][T15766] __se_sys_io_submit+0xfb/0x280 [ 551.023945][T15766] __x64_sys_io_submit+0x43/0x50 [ 551.024076][T15766] x64_sys_call+0x2e40/0x3000 [ 551.024119][T15766] do_syscall_64+0xd8/0x2a0 [ 551.024168][T15766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.024200][T15766] RIP: 0033:0x7f363aa9f749 [ 551.024221][T15766] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 551.024303][T15766] RSP: 002b:00007f3639507038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 551.024330][T15766] RAX: ffffffffffffffda RBX: 00007f363acf5fa0 RCX: 00007f363aa9f749 [ 551.024348][T15766] RDX: 0000200000002a00 RSI: 0000000000000001 RDI: 00007f363b834000 [ 551.024367][T15766] RBP: 00007f3639507090 R08: 0000000000000000 R09: 0000000000000000 [ 551.024384][T15766] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 551.024402][T15766] R13: 00007f363acf6038 R14: 00007f363acf5fa0 R15: 00007ffdf1f09fd8 [ 551.024430][T15766] [ 551.260390][T15770] netlink: 52 bytes leftover after parsing attributes in process `syz.7.6591'. [ 551.314780][T15770] SET target dimension over the limit! [ 551.334133][T15772] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15772 comm=syz.1.6592 [ 551.369862][T15774] netlink: 83992 bytes leftover after parsing attributes in process `syz.7.6594'. [ 551.382737][T15774] netlink: zone id is out of range [ 551.387977][T15774] netlink: zone id is out of range [ 551.393867][T15774] netlink: zone id is out of range [ 551.399175][T15774] netlink: zone id is out of range [ 551.407991][T15776] netlink: 'syz.1.6595': attribute type 39 has an invalid length. [ 551.471425][T15774] lo speed is unknown, defaulting to 1000 [ 551.477823][T15774] lo speed is unknown, defaulting to 1000 [ 551.547069][T15804] netlink: 83992 bytes leftover after parsing attributes in process `syz.7.6597'. [ 551.669462][T15804] lo speed is unknown, defaulting to 1000 [ 551.677760][T15804] lo speed is unknown, defaulting to 1000 [ 551.942653][T15844] loop6: detected capacity change from 0 to 1024 [ 552.428956][ T4633] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.453134][ T4633] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.472288][ T4633] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.492081][ T4633] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 552.524904][T15861] lo speed is unknown, defaulting to 1000 [ 552.564930][T15861] lo speed is unknown, defaulting to 1000 [ 552.616244][T15883] netlink: 52 bytes leftover after parsing attributes in process `syz.6.6605'. [ 552.671975][T15886] netlink: 'syz.1.6606': attribute type 39 has an invalid length. [ 552.679402][T15892] SET target dimension over the limit! [ 553.018058][ T6483] Bluetooth: hci0: command 0x1003 tx timeout [ 553.043385][ T3542] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 553.051601][ T4621] Bluetooth: hci1: Frame reassembly failed (-84) [ 553.093611][T15920] loop1: detected capacity change from 0 to 1024 [ 553.107169][T15898] lo speed is unknown, defaulting to 1000 [ 553.122216][T15898] lo speed is unknown, defaulting to 1000 [ 553.724664][ T29] kauditd_printk_skb: 286 callbacks suppressed [ 553.724678][ T29] audit: type=1400 audit(1765333147.549:18539): avc: denied { name_bind } for pid=15945 comm="syz.4.6613" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 553.788244][T15953] loop1: detected capacity change from 0 to 128 [ 553.800261][ T29] audit: type=1400 audit(1765333147.609:18540): avc: denied { watch watch_reads } for pid=15950 comm="syz.1.6614" path="/185/file0" dev="tmpfs" ino=1010 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 553.805002][T15953] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6614'. [ 553.824366][ T29] audit: type=1400 audit(1765333147.609:18541): avc: denied { create } for pid=15950 comm="syz.1.6614" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 553.852938][ T29] audit: type=1400 audit(1765333147.609:18542): avc: denied { connect } for pid=15950 comm="syz.1.6614" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 553.859524][T15955] random: crng reseeded on system resumption [ 553.872929][ T29] audit: type=1400 audit(1765333147.619:18543): avc: denied { mount } for pid=15950 comm="syz.1.6614" name="/" dev="loop1" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 553.922966][ T29] audit: type=1400 audit(1765333147.679:18544): avc: denied { append } for pid=15950 comm="syz.1.6614" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 553.946445][ T29] audit: type=1400 audit(1765333147.679:18545): avc: denied { open } for pid=15950 comm="syz.1.6614" path="/dev/snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 553.989469][ T29] audit: type=1326 audit(1765333147.809:18546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15958 comm="syz.6.6615" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 554.022884][ T29] audit: type=1326 audit(1765333147.809:18547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15958 comm="syz.6.6615" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 554.046567][ T29] audit: type=1326 audit(1765333147.809:18548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15958 comm="syz.6.6615" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 554.121631][T15959] loop6: detected capacity change from 0 to 512 [ 554.151975][T15959] ext4: Unknown parameter 'func' [ 554.287894][T15971] loop4: detected capacity change from 0 to 1024 [ 554.350211][T15972] netlink: 'syz.6.6618': attribute type 39 has an invalid length. [ 554.697909][T15988] loop1: detected capacity change from 0 to 512 [ 554.719712][T15993] bridge_slave_0: left allmulticast mode [ 554.725511][T15993] bridge_slave_0: left promiscuous mode [ 554.731252][T15993] bridge0: port 1(bridge_slave_0) entered disabled state [ 554.743892][T15993] bridge_slave_1: left allmulticast mode [ 554.749609][T15993] bridge_slave_1: left promiscuous mode [ 554.755351][T15993] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.779438][T15998] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6625'. [ 554.796122][T16002] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6626'. [ 554.796501][T15993] bond0: (slave bond_slave_0): Releasing backup interface [ 554.818375][T15993] bond0: (slave bond_slave_1): Releasing backup interface [ 554.832090][T15993] team0: Port device team_slave_0 removed [ 554.841547][T15993] team0: Port device team_slave_1 removed [ 554.849085][T15993] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 554.849150][T16002] SET target dimension over the limit! [ 554.856562][T15993] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 554.871204][T15993] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 554.878791][T15993] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 554.890891][T15993] net_ratelimit: 6 callbacks suppressed [ 554.890909][T15993] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 554.916174][T16006] netlink: 83992 bytes leftover after parsing attributes in process `syz.1.6627'. [ 554.927142][T16006] netlink: zone id is out of range [ 554.932283][T16006] netlink: zone id is out of range [ 554.950034][T16006] netlink: set zone limit has 8 unknown bytes [ 554.987489][T16008] netlink: 83992 bytes leftover after parsing attributes in process `syz.4.6628'. [ 555.001561][T16008] netlink: zone id is out of range [ 555.006865][T16008] netlink: zone id is out of range [ 555.018541][T16008] netlink: zone id is out of range [ 555.024213][T16008] netlink: zone id is out of range [ 555.040554][T16008] netlink: set zone limit has 8 unknown bytes [ 555.082391][T16008] lo speed is unknown, defaulting to 1000 [ 555.092119][T16008] lo speed is unknown, defaulting to 1000 [ 555.143449][ T6483] Bluetooth: hci1: command 0x1003 tx timeout [ 555.149547][ T3542] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 555.246131][T16066] FAULT_INJECTION: forcing a failure. [ 555.246131][T16066] name failslab, interval 1, probability 0, space 0, times 0 [ 555.258951][T16066] CPU: 1 UID: 0 PID: 16066 Comm: syz.4.6636 Not tainted syzkaller #0 PREEMPT(voluntary) [ 555.258984][T16066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 555.258999][T16066] Call Trace: [ 555.259007][T16066] [ 555.259015][T16066] __dump_stack+0x1d/0x30 [ 555.259076][T16066] dump_stack_lvl+0xe8/0x140 [ 555.259106][T16066] dump_stack+0x15/0x1b [ 555.259130][T16066] should_fail_ex+0x265/0x280 [ 555.259159][T16066] should_failslab+0x8c/0xb0 [ 555.259264][T16066] kmem_cache_alloc_node_noprof+0x6b/0x4c0 [ 555.259290][T16066] ? __alloc_skb+0x324/0x4d0 [ 555.259363][T16066] __alloc_skb+0x324/0x4d0 [ 555.259437][T16006] lo speed is unknown, defaulting to 1000 [ 555.259449][T16066] ? __alloc_skb+0x24d/0x4d0 [ 555.259481][T16066] netlink_alloc_large_skb+0xbf/0xf0 [ 555.259516][T16066] netlink_sendmsg+0x3cf/0x6b0 [ 555.259566][T16066] ? __pfx_netlink_sendmsg+0x10/0x10 [ 555.259690][T16066] __sock_sendmsg+0x145/0x180 [ 555.259815][T16066] ____sys_sendmsg+0x345/0x4a0 [ 555.259862][T16066] ___sys_sendmsg+0x17b/0x1d0 [ 555.260002][T16066] __sys_sendmmsg+0x178/0x300 [ 555.260058][T16066] __x64_sys_sendmmsg+0x57/0x70 [ 555.260099][T16066] x64_sys_call+0x1e28/0x3000 [ 555.260135][T16066] do_syscall_64+0xd8/0x2a0 [ 555.260256][T16066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.260286][T16066] RIP: 0033:0x7f82bd12f749 [ 555.260383][T16066] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 555.260409][T16066] RSP: 002b:00007f82bbb8f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 555.260436][T16066] RAX: ffffffffffffffda RBX: 00007f82bd385fa0 RCX: 00007f82bd12f749 [ 555.260454][T16066] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000008 [ 555.260478][T16066] RBP: 00007f82bbb8f090 R08: 0000000000000000 R09: 0000000000000000 [ 555.260496][T16066] R10: 000000000000fff0 R11: 0000000000000246 R12: 0000000000000001 [ 555.260514][T16066] R13: 00007f82bd386038 R14: 00007f82bd385fa0 R15: 00007ffda7caf4c8 [ 555.260678][T16066] [ 555.301826][T16069] netlink: 52 bytes leftover after parsing attributes in process `syz.7.6637'. [ 555.347909][T16069] SET target dimension over the limit! [ 555.369051][T16006] lo speed is unknown, defaulting to 1000 [ 555.630966][T16084] FAULT_INJECTION: forcing a failure. [ 555.630966][T16084] name failslab, interval 1, probability 0, space 0, times 0 [ 555.643787][T16084] CPU: 0 UID: 0 PID: 16084 Comm: syz.7.6639 Not tainted syzkaller #0 PREEMPT(voluntary) [ 555.643821][T16084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 555.643848][T16084] Call Trace: [ 555.643856][T16084] [ 555.643931][T16084] __dump_stack+0x1d/0x30 [ 555.643962][T16084] dump_stack_lvl+0xe8/0x140 [ 555.643991][T16084] dump_stack+0x15/0x1b [ 555.644025][T16084] should_fail_ex+0x265/0x280 [ 555.644055][T16084] should_failslab+0x8c/0xb0 [ 555.644112][T16084] __kmalloc_noprof+0xb9/0x5a0 [ 555.644192][T16084] ? genl_family_rcv_msg_attrs_parse+0x75/0x190 [ 555.644233][T16084] genl_family_rcv_msg_attrs_parse+0x75/0x190 [ 555.644267][T16084] genl_family_rcv_msg_doit+0x48/0x1b0 [ 555.644344][T16084] ? selinux_capable+0x31/0x40 [ 555.644372][T16084] ? security_capable+0x83/0x90 [ 555.644413][T16084] ? ns_capable+0x7d/0xb0 [ 555.644475][T16084] genl_rcv_msg+0x422/0x460 [ 555.644502][T16084] ? __pfx_ethnl_act_cable_test_tdr+0x10/0x10 [ 555.644549][T16084] netlink_rcv_skb+0x123/0x220 [ 555.644613][T16084] ? __pfx_genl_rcv_msg+0x10/0x10 [ 555.644641][T16084] genl_rcv+0x28/0x40 [ 555.644681][T16084] netlink_unicast+0x5c0/0x690 [ 555.644719][T16084] netlink_sendmsg+0x58b/0x6b0 [ 555.644768][T16084] ? __pfx_netlink_sendmsg+0x10/0x10 [ 555.644875][T16084] __sock_sendmsg+0x145/0x180 [ 555.644908][T16084] ____sys_sendmsg+0x31e/0x4a0 [ 555.644944][T16084] ___sys_sendmsg+0x17b/0x1d0 [ 555.644996][T16084] __x64_sys_sendmsg+0xd4/0x160 [ 555.645167][T16084] x64_sys_call+0x17ba/0x3000 [ 555.645197][T16084] do_syscall_64+0xd8/0x2a0 [ 555.645365][T16084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.645394][T16084] RIP: 0033:0x7f2e2f9af749 [ 555.645431][T16084] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 555.645455][T16084] RSP: 002b:00007f2e2e40f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 555.645479][T16084] RAX: ffffffffffffffda RBX: 00007f2e2fc05fa0 RCX: 00007f2e2f9af749 [ 555.645495][T16084] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 555.645529][T16084] RBP: 00007f2e2e40f090 R08: 0000000000000000 R09: 0000000000000000 [ 555.645546][T16084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 555.645602][T16084] R13: 00007f2e2fc06038 R14: 00007f2e2fc05fa0 R15: 00007fffee6bfb88 [ 555.645628][T16084] [ 555.961401][T16087] loop4: detected capacity change from 0 to 1024 [ 556.219413][T16093] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6641'. [ 556.261998][T16090] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 556.466165][T16132] SELinux: Context system_u:object_r:iptables_unit_file_t:s0 is not valid (left unmapped). [ 556.562708][T16139] lo speed is unknown, defaulting to 1000 [ 556.568882][T16139] lo speed is unknown, defaulting to 1000 [ 557.037316][T16177] netlink: 'syz.7.6654': attribute type 39 has an invalid length. [ 557.310207][T16183] loop7: detected capacity change from 0 to 1024 [ 557.839592][T16191] netlink: 83992 bytes leftover after parsing attributes in process `syz.1.6658'. [ 558.059902][T16199] lo speed is unknown, defaulting to 1000 [ 558.086795][T16199] lo speed is unknown, defaulting to 1000 [ 558.771693][ T29] kauditd_printk_skb: 181 callbacks suppressed [ 558.771712][ T29] audit: type=1400 audit(1765333152.589:18730): avc: denied { setopt } for pid=16231 comm="syz.4.6666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 558.827921][T16232] loop4: detected capacity change from 0 to 1024 [ 558.891659][T16232] EXT4-fs (loop4): unsupported inode size: 0 [ 558.897842][T16232] EXT4-fs (loop4): blocksize: 1024 [ 559.002341][ T29] audit: type=1326 audit(1765333152.819:18731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16238 comm="syz.1.6668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 559.073339][ T29] audit: type=1326 audit(1765333152.849:18732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16238 comm="syz.1.6668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=63 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 559.097061][ T29] audit: type=1326 audit(1765333152.849:18733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16238 comm="syz.1.6668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 559.120706][ T29] audit: type=1326 audit(1765333152.849:18734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16238 comm="syz.1.6668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 559.144321][ T29] audit: type=1326 audit(1765333152.849:18735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16238 comm="syz.1.6668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 559.168026][ T29] audit: type=1326 audit(1765333152.849:18736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16238 comm="syz.1.6668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 559.191781][ T29] audit: type=1326 audit(1765333152.849:18737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16238 comm="syz.1.6668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 559.215374][ T29] audit: type=1326 audit(1765333152.849:18738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16238 comm="syz.1.6668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 559.238895][ T29] audit: type=1326 audit(1765333152.849:18739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16238 comm="syz.1.6668" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f363aa9f749 code=0x7ffc0000 [ 559.373426][T16221] lo speed is unknown, defaulting to 1000 [ 559.379489][T16221] lo speed is unknown, defaulting to 1000 [ 559.437254][T16237] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.538258][T16282] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6670'. [ 559.568735][T16237] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.754167][T16237] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.886553][T16237] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.951859][T16303] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6673'. [ 559.980976][ T4621] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 560.000331][ T4621] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 560.029383][ T4621] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 560.038980][T16312] SET target dimension over the limit! [ 560.064556][ T4621] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 560.318413][T16318] loop7: detected capacity change from 0 to 128 [ 560.355183][T16318] EXT4-fs (loop7): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 560.381316][T16318] ext4 filesystem being mounted at /575/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 560.394411][T16336] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 560.402426][T16336] net_ratelimit: 5 callbacks suppressed [ 560.402444][T16336] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 560.427111][T16318] EXT4-fs warning (device loop7): verify_group_input:137: Cannot add at group 4294967294 (only 1 groups) [ 560.471687][T16345] netlink: 83992 bytes leftover after parsing attributes in process `syz.1.6684'. [ 560.481431][T16345] netlink: zone id is out of range [ 560.481980][T26162] EXT4-fs (loop7): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 560.486639][T16345] netlink: zone id is out of range [ 560.497986][T16345] netlink: set zone limit has 8 unknown bytes [ 560.521352][T16351] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 560.565918][T16351] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 560.630294][T16351] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 560.643748][T16345] lo speed is unknown, defaulting to 1000 [ 560.652776][T16345] lo speed is unknown, defaulting to 1000 [ 560.697907][T16351] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.005497][T16402] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 561.014503][T16402] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 561.157613][T16407] lo speed is unknown, defaulting to 1000 [ 561.163789][T16407] lo speed is unknown, defaulting to 1000 [ 561.295167][T16430] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6690'. [ 561.624330][T16446] lo speed is unknown, defaulting to 1000 [ 561.667424][T16446] lo speed is unknown, defaulting to 1000 [ 561.692872][T16453] netlink: 'syz.4.6696': attribute type 39 has an invalid length. [ 561.860876][T16468] netlink: 83992 bytes leftover after parsing attributes in process `syz.4.6697'. [ 561.929865][T16468] netlink: zone id is out of range [ 561.935091][T16468] netlink: zone id is out of range [ 561.977837][T16468] netlink: set zone limit has 8 unknown bytes [ 562.062523][T16468] lo speed is unknown, defaulting to 1000 [ 562.083808][T16468] lo speed is unknown, defaulting to 1000 [ 562.480102][T16511] netlink: 'syz.0.6698': attribute type 1 has an invalid length. [ 562.657363][T16554] FAULT_INJECTION: forcing a failure. [ 562.657363][T16554] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 562.670497][T16554] CPU: 0 UID: 0 PID: 16554 Comm: LX[X Not tainted syzkaller #0 PREEMPT(voluntary) [ 562.670531][T16554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 562.670620][T16554] Call Trace: [ 562.670628][T16554] [ 562.670636][T16554] __dump_stack+0x1d/0x30 [ 562.670660][T16554] dump_stack_lvl+0xe8/0x140 [ 562.670683][T16554] dump_stack+0x15/0x1b [ 562.670703][T16554] should_fail_ex+0x265/0x280 [ 562.670734][T16554] should_fail+0xb/0x20 [ 562.670761][T16554] should_fail_usercopy+0x1a/0x20 [ 562.670792][T16554] _copy_from_iter+0xcf/0xe70 [ 562.670822][T16554] ? __alloc_skb+0x3bb/0x4d0 [ 562.670845][T16554] ? __alloc_skb+0x24d/0x4d0 [ 562.670894][T16554] netlink_sendmsg+0x471/0x6b0 [ 562.670938][T16554] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.670970][T16554] __sock_sendmsg+0x145/0x180 [ 562.671013][T16554] ____sys_sendmsg+0x31e/0x4a0 [ 562.671130][T16554] ___sys_sendmsg+0x17b/0x1d0 [ 562.671168][T16554] __x64_sys_sendmsg+0xd4/0x160 [ 562.671202][T16554] x64_sys_call+0x17ba/0x3000 [ 562.671232][T16554] do_syscall_64+0xd8/0x2a0 [ 562.671277][T16554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.671297][T16554] RIP: 0033:0x7f82bd12f749 [ 562.671314][T16554] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 562.671336][T16554] RSP: 002b:00007f82bbb8f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 562.671438][T16554] RAX: ffffffffffffffda RBX: 00007f82bd385fa0 RCX: 00007f82bd12f749 [ 562.671548][T16554] RDX: 0000000000040010 RSI: 0000200000000240 RDI: 0000000000000006 [ 562.671560][T16554] RBP: 00007f82bbb8f090 R08: 0000000000000000 R09: 0000000000000000 [ 562.671574][T16554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 562.671590][T16554] R13: 00007f82bd386038 R14: 00007f82bd385fa0 R15: 00007ffda7caf4c8 [ 562.671614][T16554] [ 562.868375][T16556] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6704'. [ 562.916473][T16556] SET target dimension over the limit! [ 562.955921][T16559] lo speed is unknown, defaulting to 1000 [ 562.962150][T16559] lo speed is unknown, defaulting to 1000 [ 563.068651][T16595] FAULT_INJECTION: forcing a failure. [ 563.068651][T16595] name failslab, interval 1, probability 0, space 0, times 0 [ 563.081364][T16595] CPU: 0 UID: 0 PID: 16595 Comm: syz.1.6712 Not tainted syzkaller #0 PREEMPT(voluntary) [ 563.081395][T16595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 563.081407][T16595] Call Trace: [ 563.081414][T16595] [ 563.081423][T16595] __dump_stack+0x1d/0x30 [ 563.081455][T16595] dump_stack_lvl+0xe8/0x140 [ 563.081502][T16595] dump_stack+0x15/0x1b [ 563.081523][T16595] should_fail_ex+0x265/0x280 [ 563.081597][T16595] should_failslab+0x8c/0xb0 [ 563.081626][T16595] kmem_cache_alloc_noprof+0x69/0x4b0 [ 563.081654][T16595] ? skb_clone+0x151/0x1f0 [ 563.081690][T16595] skb_clone+0x151/0x1f0 [ 563.081754][T16595] __netlink_deliver_tap+0x2c9/0x500 [ 563.081798][T16595] netlink_unicast+0x66b/0x690 [ 563.081895][T16595] netlink_sendmsg+0x58b/0x6b0 [ 563.081937][T16595] ? __pfx_netlink_sendmsg+0x10/0x10 [ 563.081973][T16595] __sock_sendmsg+0x145/0x180 [ 563.082049][T16595] ____sys_sendmsg+0x31e/0x4a0 [ 563.082089][T16595] ___sys_sendmsg+0x17b/0x1d0 [ 563.082200][T16595] __x64_sys_sendmsg+0xd4/0x160 [ 563.082248][T16595] x64_sys_call+0x17ba/0x3000 [ 563.082280][T16595] do_syscall_64+0xd8/0x2a0 [ 563.082337][T16595] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.082358][T16595] RIP: 0033:0x7f363aa9f749 [ 563.082377][T16595] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 563.082400][T16595] RSP: 002b:00007f3639507038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 563.082424][T16595] RAX: ffffffffffffffda RBX: 00007f363acf5fa0 RCX: 00007f363aa9f749 [ 563.082491][T16595] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 563.082507][T16595] RBP: 00007f3639507090 R08: 0000000000000000 R09: 0000000000000000 [ 563.082521][T16595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 563.082533][T16595] R13: 00007f363acf6038 R14: 00007f363acf5fa0 R15: 00007ffdf1f09fd8 [ 563.082557][T16595] [ 563.426984][T28495] kernel read not supported for file /input/event2 (pid: 28495 comm: kworker/0:15) [ 563.653573][T16608] lo speed is unknown, defaulting to 1000 [ 563.660221][T16608] lo speed is unknown, defaulting to 1000 [ 563.825890][ T29] kauditd_printk_skb: 478 callbacks suppressed [ 563.825907][ T29] audit: type=1326 audit(1765333157.639:19218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16631 comm="syz.4.6716" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 563.856145][ T29] audit: type=1326 audit(1765333157.639:19219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16631 comm="syz.4.6716" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 563.879781][ T29] audit: type=1326 audit(1765333157.639:19220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16631 comm="syz.4.6716" exe="/root/syz-executor" sig=0 arch=c000003e syscall=126 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 563.903496][ T29] audit: type=1326 audit(1765333157.639:19221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16631 comm="syz.4.6716" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 563.927181][ T29] audit: type=1326 audit(1765333157.639:19222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16631 comm="syz.4.6716" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 564.027566][T16634] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6717'. [ 564.127935][T16635] SET target dimension over the limit! [ 564.232930][T16637] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 564.243634][T16637] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 564.406905][T16642] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 564.468927][T16648] geneve2: entered promiscuous mode [ 564.474350][T16648] geneve2: entered allmulticast mode [ 564.484454][ T29] audit: type=1326 audit(1765333158.239:19223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16639 comm="syz.4.6719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 564.508390][ T29] audit: type=1326 audit(1765333158.239:19224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16639 comm="syz.4.6719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 564.532142][ T29] audit: type=1326 audit(1765333158.239:19225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16639 comm="syz.4.6719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=63 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 564.555766][ T29] audit: type=1326 audit(1765333158.239:19226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16639 comm="syz.4.6719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 564.579581][ T29] audit: type=1326 audit(1765333158.239:19227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16639 comm="syz.4.6719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 564.707559][T16652] lo speed is unknown, defaulting to 1000 [ 564.724832][T16652] lo speed is unknown, defaulting to 1000 [ 564.970677][T16688] lo speed is unknown, defaulting to 1000 [ 564.988940][T16688] lo speed is unknown, defaulting to 1000 [ 565.528894][T16734] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6729'. [ 565.601892][T16734] SET target dimension over the limit! [ 565.617488][T28495] kernel read not supported for file /input/event2 (pid: 28495 comm: kworker/0:15) [ 565.912335][T16747] loop6: detected capacity change from 0 to 512 [ 565.922550][T16747] EXT4-fs (loop6): orphan cleanup on readonly fs [ 565.940805][T16750] netlink: 'syz.0.6732': attribute type 1 has an invalid length. [ 565.970864][T16747] EXT4-fs error (device loop6): ext4_acquire_dquot:6986: comm syz.6.6733: Failed to acquire dquot type 1 [ 566.000209][T16747] EXT4-fs (loop6): 1 truncate cleaned up [ 566.012752][T16747] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 566.520275][ T4633] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.529208][ T4633] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.573486][ T4633] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.581772][ T4633] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.711001][T16803] netlink: 204 bytes leftover after parsing attributes in process `syz.0.6736'. [ 566.720162][T16803] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6736'. [ 566.756556][T16803] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6736'. [ 566.770661][T16807] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6738'. [ 566.791927][T16803] netlink: 'syz.0.6736': attribute type 1 has an invalid length. [ 567.034969][T16821] loop4: detected capacity change from 0 to 1024 [ 567.041882][T16821] EXT4-fs: Ignoring removed oldalloc option [ 567.048197][T16821] EXT4-fs: Ignoring removed nomblk_io_submit option [ 567.069671][T16821] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 567.085851][T16821] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6742'. [ 567.119699][ T9883] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 567.175981][T16829] lo speed is unknown, defaulting to 1000 [ 567.189944][T16829] lo speed is unknown, defaulting to 1000 [ 567.613546][ T3542] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 567.987053][T16878] netlink: 204 bytes leftover after parsing attributes in process `syz.7.6751'. [ 567.996273][T16878] netlink: 72 bytes leftover after parsing attributes in process `syz.7.6751'. [ 568.017152][T14884] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 568.026327][T16878] netlink: 32 bytes leftover after parsing attributes in process `syz.7.6751'. [ 568.049185][T16878] netlink: 'syz.7.6751': attribute type 1 has an invalid length. [ 568.492019][T16896] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6757'. [ 568.585063][T16908] loop6: detected capacity change from 0 to 128 [ 568.606642][T16904] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 568.677224][T16908] bio_check_eod: 102 callbacks suppressed [ 568.677246][T16908] syz.6.6762: attempt to access beyond end of device [ 568.677246][T16908] loop6: rw=2049, sector=145, nr_sectors = 16 limit=128 [ 568.699798][T16911] lo speed is unknown, defaulting to 1000 [ 568.706361][T16911] lo speed is unknown, defaulting to 1000 [ 568.712194][T16908] syz.6.6762: attempt to access beyond end of device [ 568.712194][T16908] loop6: rw=2049, sector=169, nr_sectors = 8 limit=128 [ 568.734742][T16908] syz.6.6762: attempt to access beyond end of device [ 568.734742][T16908] loop6: rw=2049, sector=185, nr_sectors = 8 limit=128 [ 568.804393][T16908] syz.6.6762: attempt to access beyond end of device [ 568.804393][T16908] loop6: rw=2049, sector=201, nr_sectors = 8 limit=128 [ 568.908054][T16947] SET target dimension over the limit! [ 568.910585][ T29] kauditd_printk_skb: 134 callbacks suppressed [ 568.910605][ T29] audit: type=1400 audit(1765333162.729:19358): avc: denied { mounton } for pid=16907 comm="syz.6.6762" path="/41/file0/bus" dev="loop6" ino=34 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=file permissive=1 [ 568.947900][T16946] netlink: 'syz.4.6768': attribute type 1 has an invalid length. [ 569.000639][T16952] lo speed is unknown, defaulting to 1000 [ 569.007668][T16952] lo speed is unknown, defaulting to 1000 [ 569.050291][T16963] lo speed is unknown, defaulting to 1000 [ 569.063954][T16963] lo speed is unknown, defaulting to 1000 [ 569.078300][T16986] FAULT_INJECTION: forcing a failure. [ 569.078300][T16986] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 569.091468][T16986] CPU: 0 UID: 0 PID: 16986 Comm: syz.4.6771 Not tainted syzkaller #0 PREEMPT(voluntary) [ 569.091532][T16986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 569.091548][T16986] Call Trace: [ 569.091556][T16986] [ 569.091581][T16986] __dump_stack+0x1d/0x30 [ 569.091682][T16986] dump_stack_lvl+0xe8/0x140 [ 569.091713][T16986] dump_stack+0x15/0x1b [ 569.091734][T16986] should_fail_ex+0x265/0x280 [ 569.091756][T16986] should_fail+0xb/0x20 [ 569.091775][T16986] should_fail_usercopy+0x1a/0x20 [ 569.091832][T16986] _copy_from_user+0x1c/0xb0 [ 569.091867][T16986] ___sys_sendmsg+0xc1/0x1d0 [ 569.091917][T16986] __sys_sendmmsg+0x178/0x300 [ 569.092000][T16986] __x64_sys_sendmmsg+0x57/0x70 [ 569.092040][T16986] x64_sys_call+0x1e28/0x3000 [ 569.092065][T16986] do_syscall_64+0xd8/0x2a0 [ 569.092156][T16986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.092247][T16986] RIP: 0033:0x7f82bd12f749 [ 569.092267][T16986] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 569.092291][T16986] RSP: 002b:00007f82bbb6e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 569.092316][T16986] RAX: ffffffffffffffda RBX: 00007f82bd386090 RCX: 00007f82bd12f749 [ 569.092332][T16986] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 569.092349][T16986] RBP: 00007f82bbb6e090 R08: 0000000000000000 R09: 0000000000000000 [ 569.092447][T16986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 569.092463][T16986] R13: 00007f82bd386128 R14: 00007f82bd386090 R15: 00007ffda7caf4c8 [ 569.092488][T16986] [ 569.325776][T17006] netlink: zone id is out of range [ 569.330984][T17006] netlink: zone id is out of range [ 569.338938][T16996] lo speed is unknown, defaulting to 1000 [ 569.348913][T17006] netlink: zone id is out of range [ 569.354458][T17006] netlink: zone id is out of range [ 569.359293][T16996] lo speed is unknown, defaulting to 1000 [ 569.390799][T17006] netlink: set zone limit has 8 unknown bytes [ 569.457338][T17006] lo speed is unknown, defaulting to 1000 [ 569.460486][ T29] audit: type=1326 audit(1765333163.279:19359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17041 comm="syz.6.6777" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 569.463928][T17006] lo speed is unknown, defaulting to 1000 [ 569.541486][ T3406] IPVS: starting estimator thread 0... [ 569.548112][ T29] audit: type=1326 audit(1765333163.309:19360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17041 comm="syz.6.6777" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 569.571764][ T29] audit: type=1326 audit(1765333163.309:19361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17041 comm="syz.6.6777" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 569.595353][ T29] audit: type=1326 audit(1765333163.309:19362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17041 comm="syz.6.6777" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 569.619132][ T29] audit: type=1326 audit(1765333163.319:19363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17041 comm="syz.6.6777" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 569.642743][ T29] audit: type=1326 audit(1765333163.319:19364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17041 comm="syz.6.6777" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 569.666354][ T29] audit: type=1326 audit(1765333163.319:19365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17041 comm="syz.6.6777" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 569.690007][ T29] audit: type=1326 audit(1765333163.319:19366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17041 comm="syz.6.6777" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 569.713724][ T29] audit: type=1326 audit(1765333163.319:19367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17041 comm="syz.6.6777" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f03cafff749 code=0x7ffc0000 [ 569.737412][T17068] IPVS: using max 2208 ests per chain, 110400 per kthread [ 569.778655][T17063] loop4: detected capacity change from 0 to 2048 [ 569.824591][T17063] loop4: p1 < > p4 [ 569.829747][T17063] loop4: p4 size 8388608 extends beyond EOD, truncated [ 569.980572][T17101] netlink: 'syz.1.6785': attribute type 39 has an invalid length. [ 570.099121][T17103] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 570.133198][T17107] lo speed is unknown, defaulting to 1000 [ 570.140432][T17107] lo speed is unknown, defaulting to 1000 [ 570.227111][T17139] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=23 sclass=netlink_route_socket pid=17139 comm=syz.7.6791 [ 570.244167][T17141] netlink: zone id is out of range [ 570.249390][T17141] netlink: zone id is out of range [ 570.256700][T17139] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17139 comm=syz.7.6791 [ 570.304012][T17141] netlink: zone id is out of range [ 570.389296][T17141] lo speed is unknown, defaulting to 1000 [ 570.396357][T17141] lo speed is unknown, defaulting to 1000 [ 570.544542][T17182] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 570.565677][T17114] lo speed is unknown, defaulting to 1000 [ 570.576663][T17114] lo speed is unknown, defaulting to 1000 [ 570.607091][T17187] netlink: 'syz.0.6798': attribute type 39 has an invalid length. [ 570.624471][ T3482] Process accounting resumed [ 570.668328][T28495] Process accounting resumed [ 570.708829][T17199] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 570.797902][T17221] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=23 sclass=netlink_route_socket pid=17221 comm=syz.4.6803 [ 570.812155][T17221] __nla_validate_parse: 6 callbacks suppressed [ 570.812170][T17221] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6803'. [ 570.844020][T17221] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17221 comm=syz.4.6803 [ 570.897924][T17221] FAULT_INJECTION: forcing a failure. [ 570.897924][T17221] name failslab, interval 1, probability 0, space 0, times 0 [ 570.910674][T17221] CPU: 1 UID: 0 PID: 17221 Comm: syz.4.6803 Not tainted syzkaller #0 PREEMPT(voluntary) [ 570.910711][T17221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 570.910735][T17221] Call Trace: [ 570.910744][T17221] [ 570.910754][T17221] __dump_stack+0x1d/0x30 [ 570.910786][T17221] dump_stack_lvl+0xe8/0x140 [ 570.910826][T17221] dump_stack+0x15/0x1b [ 570.910846][T17221] should_fail_ex+0x265/0x280 [ 570.910876][T17221] should_failslab+0x8c/0xb0 [ 570.910986][T17221] kmem_cache_alloc_node_noprof+0x6b/0x4c0 [ 570.911016][T17221] ? __alloc_skb+0x324/0x4d0 [ 570.911041][T17221] __alloc_skb+0x324/0x4d0 [ 570.911076][T17221] ? __alloc_skb+0x24d/0x4d0 [ 570.911107][T17221] netlink_alloc_large_skb+0xbf/0xf0 [ 570.911221][T17221] netlink_sendmsg+0x3cf/0x6b0 [ 570.911264][T17221] ? __pfx_netlink_sendmsg+0x10/0x10 [ 570.911346][T17221] __sock_sendmsg+0x145/0x180 [ 570.911391][T17221] ____sys_sendmsg+0x31e/0x4a0 [ 570.911431][T17221] ___sys_sendmsg+0x17b/0x1d0 [ 570.911562][T17221] __x64_sys_sendmsg+0xd4/0x160 [ 570.911594][T17221] x64_sys_call+0x17ba/0x3000 [ 570.911619][T17221] do_syscall_64+0xd8/0x2a0 [ 570.911686][T17221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 570.911714][T17221] RIP: 0033:0x7f82bd12f749 [ 570.911741][T17221] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 570.911764][T17221] RSP: 002b:00007f82bbb8f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 570.911789][T17221] RAX: ffffffffffffffda RBX: 00007f82bd385fa0 RCX: 00007f82bd12f749 [ 570.911840][T17221] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000007 [ 570.911878][T17221] RBP: 00007f82bbb8f090 R08: 0000000000000000 R09: 0000000000000000 [ 570.911909][T17221] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 570.911922][T17221] R13: 00007f82bd386038 R14: 00007f82bd385fa0 R15: 00007ffda7caf4c8 [ 570.911955][T17221] [ 571.184455][T17234] bridge0: entered promiscuous mode [ 571.189757][T17234] macsec0: entered promiscuous mode [ 571.195966][T17234] bridge0: port 1(macsec0) entered blocking state [ 571.202452][T17234] bridge0: port 1(macsec0) entered disabled state [ 571.219652][T17234] macsec0: entered allmulticast mode [ 571.225134][T17234] bridge0: entered allmulticast mode [ 571.236110][T17234] macsec0: left allmulticast mode [ 571.241230][T17234] bridge0: left allmulticast mode [ 571.267254][T17246] netlink: 'syz.1.6809': attribute type 39 has an invalid length. [ 571.289098][T17234] bridge0: left promiscuous mode [ 571.302672][T17242] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.365855][T17242] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.402797][T17261] FAULT_INJECTION: forcing a failure. [ 571.402797][T17261] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 571.415990][T17261] CPU: 0 UID: 0 PID: 17261 Comm: syz.0.6813 Not tainted syzkaller #0 PREEMPT(voluntary) [ 571.416014][T17261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 571.416026][T17261] Call Trace: [ 571.416031][T17261] [ 571.416038][T17261] __dump_stack+0x1d/0x30 [ 571.416060][T17261] dump_stack_lvl+0xe8/0x140 [ 571.416102][T17261] dump_stack+0x15/0x1b [ 571.416118][T17261] should_fail_ex+0x265/0x280 [ 571.416138][T17261] should_fail+0xb/0x20 [ 571.416155][T17261] should_fail_usercopy+0x1a/0x20 [ 571.416212][T17261] fpu__restore_sig+0x12d/0xaa0 [ 571.416266][T17261] ? x86_task_fpu+0x36/0x60 [ 571.416280][T17261] ? should_fail_ex+0xdb/0x280 [ 571.416305][T17261] __ia32_sys_rt_sigreturn+0x29f/0x350 [ 571.416372][T17261] x64_sys_call+0x274a/0x3000 [ 571.416403][T17261] do_syscall_64+0xd8/0x2a0 [ 571.416485][T17261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.416506][T17261] RIP: 0033:0x7f150716f747 [ 571.416564][T17261] Code: ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 [ 571.416581][T17261] RSP: 002b:00007f1505bd7038 EFLAGS: 00000246 [ 571.416595][T17261] RAX: 0000000000000113 RBX: 00007f15073c5fa0 RCX: 00007f150716f749 [ 571.416606][T17261] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000005 [ 571.416617][T17261] RBP: 00007f1505bd7090 R08: 0000100000000001 R09: 0000000000000000 [ 571.416628][T17261] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 571.416681][T17261] R13: 00007f15073c6038 R14: 00007f15073c5fa0 R15: 00007ffe41ddc0d8 [ 571.416698][T17261] [ 571.419770][T17242] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.646422][T17242] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.677841][T17278] lo speed is unknown, defaulting to 1000 [ 571.715603][ T4601] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 571.762651][T17278] lo speed is unknown, defaulting to 1000 [ 571.768732][ T4601] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 571.794188][ T4601] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 571.839469][ T4601] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 571.986423][T17325] FAULT_INJECTION: forcing a failure. [ 571.986423][T17325] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 571.999587][T17325] CPU: 1 UID: 0 PID: 17325 Comm: syz.7.6820 Not tainted syzkaller #0 PREEMPT(voluntary) [ 571.999676][T17325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 571.999692][T17325] Call Trace: [ 571.999701][T17325] [ 571.999712][T17325] __dump_stack+0x1d/0x30 [ 571.999744][T17325] dump_stack_lvl+0xe8/0x140 [ 571.999771][T17325] dump_stack+0x15/0x1b [ 571.999791][T17325] should_fail_ex+0x265/0x280 [ 571.999909][T17325] should_fail+0xb/0x20 [ 571.999934][T17325] should_fail_usercopy+0x1a/0x20 [ 571.999966][T17325] _copy_to_user+0x20/0xa0 [ 572.000005][T17325] __se_sys_shmctl+0x3d1/0x420 [ 572.000045][T17325] __x64_sys_shmctl+0x43/0x50 [ 572.000073][T17325] x64_sys_call+0x1765/0x3000 [ 572.000106][T17325] do_syscall_64+0xd8/0x2a0 [ 572.000149][T17325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 572.000239][T17325] RIP: 0033:0x7f2e2f9af749 [ 572.000259][T17325] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 572.000345][T17325] RSP: 002b:00007f2e2e3ee038 EFLAGS: 00000246 ORIG_RAX: 000000000000001f [ 572.000398][T17325] RAX: ffffffffffffffda RBX: 00007f2e2fc06090 RCX: 00007f2e2f9af749 [ 572.000415][T17325] RDX: 0000200000000040 RSI: 0000000000000003 RDI: 0000000000000000 [ 572.000440][T17325] RBP: 00007f2e2e3ee090 R08: 0000000000000000 R09: 0000000000000000 [ 572.000457][T17325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 572.000472][T17325] R13: 00007f2e2fc06128 R14: 00007f2e2fc06090 R15: 00007fffee6bfb88 [ 572.000492][T17325] [ 572.484773][T17345] netlink: 204 bytes leftover after parsing attributes in process `syz.6.6824'. [ 572.494069][T17345] netlink: 72 bytes leftover after parsing attributes in process `syz.6.6824'. [ 572.503650][T17345] netlink: 32 bytes leftover after parsing attributes in process `syz.6.6824'. [ 572.514518][T17345] netlink: 'syz.6.6824': attribute type 1 has an invalid length. [ 572.553033][T17347] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6826'. [ 572.562082][T17347] netlink: 16 bytes leftover after parsing attributes in process `syz.6.6826'. [ 572.788298][T17360] FAULT_INJECTION: forcing a failure. [ 572.788298][T17360] name failslab, interval 1, probability 0, space 0, times 0 [ 572.801297][T17360] CPU: 1 UID: 0 PID: 17360 Comm: syz.7.6829 Not tainted syzkaller #0 PREEMPT(voluntary) [ 572.801348][T17360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 572.801365][T17360] Call Trace: [ 572.801373][T17360] [ 572.801382][T17360] __dump_stack+0x1d/0x30 [ 572.801471][T17360] dump_stack_lvl+0xe8/0x140 [ 572.801502][T17360] dump_stack+0x15/0x1b [ 572.801527][T17360] should_fail_ex+0x265/0x280 [ 572.801581][T17360] should_failslab+0x8c/0xb0 [ 572.801603][T17360] kmem_cache_alloc_node_noprof+0x6b/0x4c0 [ 572.801703][T17360] ? __alloc_skb+0x324/0x4d0 [ 572.801734][T17360] __alloc_skb+0x324/0x4d0 [ 572.801764][T17360] ? __alloc_skb+0x24d/0x4d0 [ 572.801794][T17360] netlink_ack+0xfd/0x500 [ 572.801858][T17360] netlink_rcv_skb+0x192/0x220 [ 572.801943][T17360] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 572.802074][T17360] rtnetlink_rcv+0x1c/0x30 [ 572.802123][T17360] netlink_unicast+0x5c0/0x690 [ 572.802215][T17360] netlink_sendmsg+0x58b/0x6b0 [ 572.802255][T17360] ? __pfx_netlink_sendmsg+0x10/0x10 [ 572.802287][T17360] __sock_sendmsg+0x145/0x180 [ 572.802367][T17360] ____sys_sendmsg+0x345/0x4a0 [ 572.802405][T17360] ___sys_sendmsg+0x17b/0x1d0 [ 572.802451][T17360] __sys_sendmmsg+0x178/0x300 [ 572.802518][T17360] __x64_sys_sendmmsg+0x57/0x70 [ 572.802548][T17360] x64_sys_call+0x1e28/0x3000 [ 572.802573][T17360] do_syscall_64+0xd8/0x2a0 [ 572.802657][T17360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 572.802745][T17360] RIP: 0033:0x7f2e2f9af749 [ 572.802762][T17360] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 572.802782][T17360] RSP: 002b:00007f2e2e40f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 572.802879][T17360] RAX: ffffffffffffffda RBX: 00007f2e2fc05fa0 RCX: 00007f2e2f9af749 [ 572.802892][T17360] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000006 [ 572.802906][T17360] RBP: 00007f2e2e40f090 R08: 0000000000000000 R09: 0000000000000000 [ 572.802919][T17360] R10: 0000000000000600 R11: 0000000000000246 R12: 0000000000000001 [ 572.802934][T17360] R13: 00007f2e2fc06038 R14: 00007f2e2fc05fa0 R15: 00007fffee6bfb88 [ 572.803016][T17360] [ 573.125200][T17375] netlink: 'syz.4.6836': attribute type 39 has an invalid length. [ 573.145964][T17376] program syz.7.6834 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 573.241494][T17379] lo speed is unknown, defaulting to 1000 [ 573.247757][T17379] lo speed is unknown, defaulting to 1000 [ 573.311320][T17371] netlink: 28 bytes leftover after parsing attributes in process `syz.7.6834'. [ 573.322140][T17371] Cannot find add_set index 0 as target [ 573.328325][T17371] IPv6: Can't replace route, no match found [ 573.340013][T17397] netlink: 'syz.1.6835': attribute type 1 has an invalid length. [ 573.447618][T17445] loop6: detected capacity change from 0 to 2048 [ 573.486558][T17445] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 573.522541][T14884] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 573.551998][T17464] netlink: 83992 bytes leftover after parsing attributes in process `syz.6.6841'. [ 573.568319][T17446] lo speed is unknown, defaulting to 1000 [ 573.574748][T17446] lo speed is unknown, defaulting to 1000 [ 573.578857][T17469] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6842'. [ 573.664351][T17530] wireguard0: entered promiscuous mode [ 573.670057][T17530] wireguard0: entered allmulticast mode [ 573.687322][T17469] hsr_slave_1 (unregistering): left promiscuous mode [ 573.700364][T17446] chnl_net:caif_netlink_parms(): no params data found [ 573.766801][T17464] lo speed is unknown, defaulting to 1000 [ 573.777395][T17446] bridge0: port 1(bridge_slave_0) entered blocking state [ 573.784632][T17446] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.791879][T17446] bridge_slave_0: entered allmulticast mode [ 573.798436][T17446] bridge_slave_0: entered promiscuous mode [ 573.805906][T17464] lo speed is unknown, defaulting to 1000 [ 573.812083][T17446] bridge0: port 2(bridge_slave_1) entered blocking state [ 573.819250][T17446] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.826680][T17446] bridge_slave_1: entered allmulticast mode [ 573.833385][T17446] bridge_slave_1: entered promiscuous mode [ 573.871012][T17640] loop7: detected capacity change from 0 to 7 [ 573.879975][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 573.889628][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 573.898027][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 573.907638][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 573.915654][T17640] loop7: unable to read partition table [ 573.921782][T17640] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 574.057403][T17446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 574.141048][T17672] net_ratelimit: 9 callbacks suppressed [ 574.141062][T17672] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 574.164416][T17446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 574.239552][ T29] kauditd_printk_skb: 613 callbacks suppressed [ 574.239570][ T29] audit: type=1326 audit(1765333168.059:19981): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17705 comm="syz.4.6849" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 574.282134][ T29] audit: type=1326 audit(1765333168.089:19982): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17705 comm="syz.4.6849" exe="/root/syz-executor" sig=0 arch=c000003e syscall=126 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 574.305878][ T29] audit: type=1326 audit(1765333168.089:19983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17705 comm="syz.4.6849" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82bd12f749 code=0x7ffc0000 [ 574.367532][T17712] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6851'. [ 574.408597][T17659] lo speed is unknown, defaulting to 1000 [ 574.410214][T17446] team0: Port device team_slave_0 added [ 574.422287][T17446] team0: Port device team_slave_1 added [ 574.457929][T17728] SET target dimension over the limit! [ 574.485287][T17659] lo speed is unknown, defaulting to 1000 [ 574.614004][T17446] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 574.621114][T17446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 574.647067][T17446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 574.728987][T17446] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 574.736063][T17446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 574.762103][T17446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 574.808921][T17779] 8021q: adding VLAN 0 to HW filter on device { [ 574.887165][ T8885] kernel read not supported for file /input/event2 (pid: 8885 comm: kworker/0:12) [ 574.964782][T17781] netlink: 'syz.1.6856': attribute type 1 has an invalid length. [ 574.993177][ T4621] ================================================================== [ 575.001307][ T4621] BUG: KCSAN: data-race in alloc_pid / copy_process [ 575.007910][ T4621] [ 575.010325][ T4621] read-write to 0xffffffff8685ffc8 of 4 bytes by task 4615 on cpu 1: [ 575.018391][ T4621] alloc_pid+0x54c/0x760 [ 575.022645][ T4621] copy_process+0xdd1/0x1ef0 [ 575.027233][ T4621] kernel_clone+0x16c/0x5c0 [ 575.031756][ T4621] user_mode_thread+0x7d/0xb0 [ 575.036433][ T4621] call_usermodehelper_exec_work+0x41/0x160 [ 575.042340][ T4621] process_scheduled_works+0x4ce/0x9d0 [ 575.047827][ T4621] worker_thread+0x582/0x770 [ 575.052427][ T4621] kthread+0x489/0x510 [ 575.056604][ T4621] ret_from_fork+0x149/0x290 [ 575.061209][ T4621] ret_from_fork_asm+0x1a/0x30 [ 575.065986][ T4621] [ 575.068308][ T4621] read to 0xffffffff8685ffc8 of 4 bytes by task 4621 on cpu 0: [ 575.075886][ T4621] copy_process+0x16d4/0x1ef0 [ 575.080658][ T4621] kernel_clone+0x16c/0x5c0 [ 575.085168][ T4621] user_mode_thread+0x7d/0xb0 [ 575.089872][ T4621] call_usermodehelper_exec_work+0x41/0x160 [ 575.095884][ T4621] process_scheduled_works+0x4ce/0x9d0 [ 575.101352][ T4621] worker_thread+0x582/0x770 [ 575.105953][ T4621] kthread+0x489/0x510 [ 575.110036][ T4621] ret_from_fork+0x149/0x290 [ 575.114642][ T4621] ret_from_fork_asm+0x1a/0x30 [ 575.119431][ T4621] [ 575.121760][ T4621] value changed: 0x8000017b -> 0x8000017c [ 575.127482][ T4621] [ 575.129803][ T4621] Reported by Kernel Concurrency Sanitizer on: [ 575.135951][ T4621] CPU: 0 UID: 0 PID: 4621 Comm: kworker/u8:38 Not tainted syzkaller #0 PREEMPT(voluntary) [ 575.145938][ T4621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 575.156006][ T4621] Workqueue: events_unbound call_usermodehelper_exec_work SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 575.163135][ T4621] ================================================================== [ 575.192006][ T29] audit: type=1400 audit(1765333168.999:19984): avc: denied { write } for pid=3283 comm="syz-executor" path="pipe:[2489]" dev="pipefs" ino=2489 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 575.206126][T17446] hsr_slave_0: entered promiscuous mode [ 575.267834][T17446] hsr_slave_1: entered promiscuous mode [ 575.274188][T17446] debugfs: 'hsr0' already exists in 'hsr' [ 575.279931][T17446] Cannot create hsr debugfs directory [ 575.534656][ T4633] bridge_slave_1: left allmulticast mode [ 575.540343][ T4633] bridge_slave_1: left promiscuous mode [ 575.546078][ T4633] bridge0: port 2(bridge_slave_1) entered disabled state [ 575.608750][ T4633] bridge_slave_0: left allmulticast mode [ 575.614575][ T4633] bridge_slave_0: left promiscuous mode [ 575.620230][ T4633] bridge0: port 1(bridge_slave_0) entered disabled state [ 575.705471][ T4633] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 575.715798][ T4633] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 575.725312][ T4633] bond0 (unregistering): Released all slaves [ 575.756276][ T4633] hsr_slave_0: left promiscuous mode [ 575.762235][ T4633] hsr_slave_1: left promiscuous mode [ 575.767907][ T4633] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 575.776530][ T4633] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 575.796084][ T4633] team0 (unregistering): Port device team_slave_1 removed [ 575.806203][ T4633] team0 (unregistering): Port device team_slave_0 removed [ 576.206467][ T4633] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.265676][ T4633] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.315030][ T4633] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.385278][ T4633] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.459984][ T4633] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.506435][ T4633] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.546497][ T4633] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.606284][ T4633] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.659471][ T4633] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.705096][ T4633] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.764990][ T4633] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.815145][ T4633] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.888895][ T4633] batadv1: left allmulticast mode [ 576.894020][ T4633] batadv1: left promiscuous mode [ 576.899106][ T4633] bridge0: port 1(batadv1) entered disabled state [ 577.075146][ T4633] bond0 (unregistering): Released all slaves [ 577.084143][ T4633] bond1 (unregistering): Released all slaves [ 577.092797][ T4633] bond2 (unregistering): Released all slaves [ 577.155584][ T4633] bond0 (unregistering): Released all slaves [ 577.215380][ T4633] bond0 (unregistering): Released all slaves [ 577.224018][ T4633] bond1 (unregistering): Released all slaves [ 577.267966][ T4633] tipc: Left network mode [ 577.272705][ T4633] tipc: Left network mode [ 577.283980][ T4633] hsr_slave_0: left promiscuous mode [ 577.292072][ T4633] hsr_slave_0: left promiscuous mode [ 577.300975][ T4633] hsr_slave_1: left promiscuous mode [ 577.309036][ T4633] hsr_slave_0: left promiscuous mode [ 577.315226][ T4633] hsr_slave_1: left promiscuous mode [ 577.331685][ T4633] veth1_macvtap: left promiscuous mode [ 577.337275][ T4633] veth0_macvtap: left promiscuous mode [ 577.342759][ T4633] veth1_vlan: left promiscuous mode [ 577.348101][ T4633] veth0_vlan: left promiscuous mode [ 577.353745][ T4633] veth1_macvtap: left promiscuous mode [ 577.359208][ T4633] veth0_macvtap: left promiscuous mode [ 577.364802][ T4633] veth1_vlan: left promiscuous mode [ 577.370043][ T4633] veth0_vlan: left promiscuous mode [ 577.376176][ T4633] veth1_macvtap: left promiscuous mode [ 577.381658][ T4633] veth0_macvtap: left promiscuous mode [ 577.387262][ T4633] veth1_vlan: left promiscuous mode [ 577.392503][ T4633] veth0_vlan: left promiscuous mode [ 578.290589][ T4633] IPVS: stop unused estimator thread 0...