last executing test programs: 30.276747054s ago: executing program 4 (id=2600): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) connect$unix(r0, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r0, &(0x7f0000002dc0), 0x307017fdb7a670f, 0x40) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff}, 0x0) r2 = dup(r0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) symlinkat(0x0, 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00') openat(0xffffffffffffffff, 0x0, 0x515a02, 0x52abe154ad664fa4) 30.259235045s ago: executing program 4 (id=2602): r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000080)=0x10, 0x80800) write(r0, &(0x7f0000000280)="b96ca73e6c52e77dcb67c27fc869f9eb2bf7542afb8a1a9bd4895bcfb0b8c187b0c64945da7a512651806b77a8b688a6ec7e2888c647c38ad1bbb9d8f9b2e39df957748c85cbdacc6f2de178932929e75a521196919987df3afaa88f44989cc8e05f0e74677cfaafa1862ca68ff485b70c2fb72a3412aa451b3ebe35bf5268281fbe20ecbe96ada77d0ec37c7c4ee1a161d94ba362498d39df734dea997d4b977ba0212f63fd14f25c63f8244147b8db96ec86356ae53bc592aa6aa22b25925be0bc72057037cbf3c51f3f22c5", 0xcd) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x0, 0x0) socket$inet6(0xa, 0x3, 0xff) setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x2, 0x0, 0x0) bind$can_raw(0xffffffffffffffff, &(0x7f0000000480), 0x10) setsockopt$CAN_RAW_FILTER(0xffffffffffffffff, 0x65, 0x1, &(0x7f0000000000)=[{{0x4, 0x0, 0x1, 0x1}, {0x2, 0x0, 0x1, 0x1}}, {{0x4, 0x1, 0x1}, {0x1, 0x1}}], 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) getxattr(0x0, &(0x7f0000000300)=@known='user.incfs.size\x00', 0x0, 0x0) 30.255215335s ago: executing program 4 (id=2603): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r2}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) get_mempolicy(0x0, 0x0, 0x203, &(0x7f0000394000/0x3000)=nil, 0x3) 30.19467797s ago: executing program 4 (id=2605): socket$netlink(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000001c0), 0x70802, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000180)='kmem_cache_free\x00', r1, 0x0, 0x200000000000006}, 0x18) r2 = socket$packet(0x11, 0x2, 0x300) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1801000001ffffeb00000000eb658e0d850000007b00"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x18) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200008, &(0x7f0000000380), 0x3, 0x56a, &(0x7f00000015c0)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwFy9SBBEL4h/g3WPxH/CvKGihSAl68BKZzWy7TbL5uXW3zucD0743M5s3b998335nZ5cNoLBGsn9KEa9GxDdJxOG2bYORbxxZ2W/p8Y3JbEliefmzP5NI8nWt/ZP8/4N55ZWI+PWriJOlte3WFxZnKtVqOpfXRxuzV0frC4unLs9WptPp9Mr4xMSZdybG33/v3a719c0Lf3//6f2Pznx9fOm7nx8euZvEuTiUb2vvxy7caq+MxEj+nAzFuVU7jnWhsX6S9PoA2JGBPM6HIpsDDsdAHvXA/9/NiFgGCioR/1BQrTygdW3fpevgF8ajD1cugNb2f3DlvZHY17w2OrCUPHNllF3vDneh/ayNX/64dzdbYpP3IW52oT2Allu3I+L04ODa+S/J57+dO91883hjq9so2usP9NL9LP95a738p/Qk/4l18p+D68TuTmwe/6WHXWimoyz/+2Dd/PfJ1DU8kNdeauZ8Q8mly9X0dES8HBEnYmhvVt/ofs6ZpQfLnba153/ZkrXfygXz43g4uPfZx0xVGpXd9Lndo9sRrz3Nf5NYM//va+a6q8c/ez4ubLGNY+m91ztt27z/7bqfAS//FPHGuuP/9I5WsvH9ydHm+TDaOivW+uvOsd86tb+9/ndfNv4HNu7/cNJ+v7a+/TZ+3PdP2mnbTs//PcnnzfKefN31SqMxNxaxJ/lk7frxp49t1Vv7Z/0/cXzj+W+9839/RHyxxf7fOXqn4679MP5T2xr/7RcefPzlD53a39r4v90sncjXbGX+2+oB7ua5AwAAAAAAgH5TiohDkZTKT8qlUrm88vmOo3GgVK3VGycv1eavTEXzu7LDMVRq3ek+3PZ5iLH887Ct+viq+kREHImIbwf2N+vlyVp1qtedBwAAAAAAAAAAAAAAAAAAgD5xsMP3/zO/D/T66IDnzk9+Q3FtGv/d+KUnoC95/YfiEv9QXOIfikv8Q3GJfygu8Q/FJf6huMQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAAdNWF8+ezZXnp8Y3JrD51bWF+pnbt1FRanynPzk+WJ2tzV8vTtdp0NS1P1mY3+3vVWu3q2HjMXx9tpPXGaH1h8eJsbf5K4+Ll2cp0ejEd+k96BQAAAAAAAAAAAAAAAAAAAC+W+sLiTKVaTecUOhbORl8cxo4LyWajfDY/GXbUxGDvO6jwHAo9npgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoM2/AQAA///fKTPH") r4 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000000)={0x0, 0x0}) open(&(0x7f0000000180)='./bus\x00', 0x14937e, 0x111) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r5 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r5, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x8005, 0x0, 0x0, 0x19, 0x1c, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x204]}) sendfile(r4, r4, 0x0, 0x5) r6 = syz_mount_image$ext4(&(0x7f0000000b80)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x200000, &(0x7f0000000040)={[{@grpquota}]}, 0x1, 0xbac, &(0x7f00000017c0)="$eJzs3M1rXOUaAPDnnEy+c5v0crn3tggGpCqK07QpFbpqXYsKunDZmExKyPTDJIIJXaR1ry5EXBSkf4Lg3m5cCS7qQutfUMQiRTdtFyNnPtKxk5nGdGaOSX8/eHPe97wn8zxPTmfOe2BOA3hqTWc/0ohDEXE2iZis708jYqjaG4nYrB13/+7l+awlUam8/VsSSUTcu3t5vvFaSX07Xh+MRMTN15L490etcVfXN5bnyuXSSn18dO38paOr6xuvLJ2fO1c6V7pwYvbVE7MnZ2e7WOvtS+998cwPbzx/9frHM29+fuC7JE7HRH2uuY5umY7prb9Js0JEzHU7WE4G6vU015kUckwIAICO0qY13H9jMgbi4eJtMr79MdfkAAAAgK6oDERUAAAAgH0ucf8PAAAA+1zjewD37l6eb7R8v5HQX3fORMRUrf7G8821mUJsVrcjMRgRY78n0fxYa1L7tSc2nUX6+vtS1qJHzyF3snklIv6/3flPqvVPVZ/ibq0/jYiZLsSffmS8l+o/3YX4edcPwNPpxpnahaz1+pdurX9im+tfYZtr127kff1rrP/ut6z/HtY/0Gb999YOYxx+8NLNdnPN6793P/l5IYufbZ+oqL/hzpWIw4Xt6k+26k/a1H92hzHG529fazeX1Z/V22j9rr9yPeJIdTXXWn9D0un/Jzq6uFQuzdR+bvP66yc7x28+/1nL4jfuBfohO/9jsbvzf2mHMab+9+uhdnOPrz/9ZSh5p9obqu/5cG5tbeVYxFDyeuv+451zaRzTeI2s/hef6/z+367+7DNhs/53yP71XKlvs/HVR2KOHzn+1e7r762s/oVdnv9Pdxjjy2+uvd9uLu/6AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANgb0oiYiCQtbvXTtFiMGI+I/8RYWr64uvby4sUPLixkcxFTMZguLpVLMxExWRsn2fhYtf9wfPyR8WxEHIyIzyZHq+Pi/MXyQt7FAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsGU8IiYiSYsRkUbEH5NpWizmnRUAAADQdVN5JwAAAAD0nPt/AAAA2P9a7v8LfxmN9DMXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9qWDz964lUTE5qnRassM1ecGc80M6LV0Z4eN9ToPoP8G8k4AyE2hqV+pVCo5pgL0mXt8IHnM/EjbmeGu5wIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAP9cLh27cSiJi89RotWWG6nODuWYG9FqadwJAbgY6TSaP3QHsYYW8EwBy4x4fqK3sH1RqWudH2v7m8BNHBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGDvmKi2JC1GRFrtp2mxGPGviJiKwWRxqVyaiYgDEfHT5OBwNj6Wd9IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB03er6xvJcuVxa0dHR6WJnNPoWa7T+Zm5zzHD7qQ6dnD+YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADIxer6xvJcuVxaWc07EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACBvq+sby3Plcmmlh528awQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID9/BgAA///GyAmy") r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x2082) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r7, 0xc0a85320, &(0x7f00000005c0)={{0x80, 0x7}, 'port0\x00', 0x44, 0xa04f2, 0x10000000, 0x8000008, 0x3, 0x4, 0x80000004}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) recvmsg$can_j1939(0xffffffffffffffff, 0x0, 0x20) r8 = creat(&(0x7f0000000040)='./file0\x00', 0x0) close(r8) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r8, 0x40bc5311, &(0x7f0000000180)={0x80, 0x1, 'client0\x00', 0x1, "896c81dd59ff28d2", "e5dbc741536b0e2fbb12e9338ec8dcb3e07c903fc30e8a11d477e3fb04eb2f74", 0x3, 0x4}) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r8, 0x111, 0x2, 0x1, 0x4) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x100ef, 0x7fa962bfffff, 0x13012, r2, 0x0) writev(r6, &(0x7f00000000c0)=[{&(0x7f00000003c0)="3700000f0000ff3f13000000170a001700000000288a1d824cfe040037000d00030001362564aa58b9a6c011f6bbf44cc4000000000000000000000000e29635da2a03c3674fb0b13b9c346ae0bb144f04c3ef", 0x53}], 0x1) 29.82357292s ago: executing program 4 (id=2616): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r2}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) get_mempolicy(0x0, 0x0, 0x203, &(0x7f0000394000/0x3000)=nil, 0x3) 29.443544441s ago: executing program 4 (id=2623): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b7040000000000008500000001"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r2}, 0x10) r3 = openat$cgroup_ro(r0, &(0x7f0000000380)='memory.stat\x00', 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x4) sendfile(r4, r3, 0x0, 0x10) 29.419369613s ago: executing program 32 (id=2623): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b7040000000000008500000001"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r2}, 0x10) r3 = openat$cgroup_ro(r0, &(0x7f0000000380)='memory.stat\x00', 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x4) sendfile(r4, r3, 0x0, 0x10) 4.036711765s ago: executing program 3 (id=3033): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r1, 0x0, 0x2}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r2, 0x0, 0x0, 0x20004041, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0900000000000000000002000000140001800500020001"], 0x28}, 0x1, 0x0, 0x0, 0x40000c5}, 0x0) 3.892294137s ago: executing program 3 (id=3034): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0xe}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_io_uring_setup(0x8d0, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) r2 = dup(r1) r3 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x6) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000400000000000"], 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r6}, 0x10) symlinkat(&(0x7f0000000400)='./file0/../file0\x00', r4, &(0x7f0000000080)='./file0\x00') readlinkat(r4, &(0x7f00000001c0)='./file0/../file0\x00', &(0x7f0000000780)=""/198, 0xc6) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, 0x0) 3.869045799s ago: executing program 3 (id=3035): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) io_setup(0x8, 0x0) sched_setscheduler(0x0, 0x2, 0x0) getpid() socket(0x18, 0x1, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) 3.678010774s ago: executing program 3 (id=3036): syz_emit_ethernet(0x56, &(0x7f0000000200)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}, @empty, @void, {@canfd={0xd, {{0x0, 0x0, 0x1}, 0x1e, 0x1, 0x0, 0x0, "8c65760ef54bb606cb183521975faf99e45f998f8fd6f5a58df7162875b29d36af51285a93134d5c4a00cb1b3aae5c5643855c6970b6ee749564dad1d78bd30d"}}}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r0}, 0x18) r1 = io_uring_setup(0x1e2b, &(0x7f0000004bc0)={0x0, 0xb07b, 0x42, 0x2, 0x3f8}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) accept4$unix(0xffffffffffffffff, &(0x7f0000000340), &(0x7f0000000140)=0x6e, 0x80000) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r4}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r5, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r2}, &(0x7f0000000000), &(0x7f00000005c0)=r6}, 0x20) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000004c40)=[@ioring_restriction_sqe_op={0x1, 0x54}], 0x1) 3.60045065s ago: executing program 3 (id=3040): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000180)='kmem_cache_free\x00', r1, 0x0, 0x200000000000006}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) setresgid(0x0, r4, 0xee01) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/locks\x00', 0x0, 0x0) pread64(r5, &(0x7f00000024c0)=""/209, 0xd1, 0x8) fchownat(r5, 0x0, r3, r4, 0x400) 3.547004085s ago: executing program 3 (id=3042): socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xf, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f00000000c0)) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000500)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r2 = socket$can_raw(0x1d, 0x3, 0x1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bind$can_raw(r2, &(0x7f0000000080), 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='kmem_cache_free\x00', r1, 0x0, 0x1}, 0x18) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d0000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = gettid() r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r6, &(0x7f0000000440)=""/247, 0x26) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r6, 0x4040534e, &(0x7f0000000080)={0x31, @time={0x3, 0xfffefffd}, 0x0, {0x0, 0x2}, 0x0, 0x0, 0x4}) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r6, 0xc0305302, &(0x7f0000000040)={0x36, 0x7, 0x4, 0x9, 0x1, 0x80}) tkill(r5, 0x7) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000040)='sys_enter\x00', r4}, 0x18) sched_getattr(0x0, &(0x7f00000001c0)={0x38}, 0x38, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000240)=@file={0x1, './file0\x00'}, 0x6e) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x24, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r8}, 0x18) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180200000020702500000000002020207b1af8ff00000000bfa100000000000007010000dbffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2b, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000340)='kfree\x00', r9, 0x0, 0xfffffffffffffffc}, 0x18) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="a0010000100001000000000000000000fe880000000000000000000000000101ac1414bb00000000000000000000000000000000000200000000000064000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000032000000fc010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000002000000000000000000000000000002000000000000000000000002000000cd000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c0017000000000000000000000000000000000028bd7000000000004c001400636d616328616573290000"], 0x1a0}}, 0x800) socket$inet6(0xa, 0x3, 0xff) 2.683583294s ago: executing program 5 (id=3055): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000000c0)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x8000000, 0x0, 0x3, 0x1, 0xfffc, 0x7f}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000000)={@loopback={0xfec0ffff00000000}, 0x8000000, 0x2, 0x3, 0x0, 0x0, 0x603}, 0x20) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000002c0)={'veth1_to_bond\x00', &(0x7f00000001c0)=@ethtool_link_settings={0x4d, 0x0, 0x9, 0xd, 0x4, 0x0, 0x8, 0x1, 0x7f, 0x8, [0xeb2f, 0x1, 0x9, 0x100, 0x4, 0x98b2, 0xa4, 0xff]}}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0xe, 0x7fff0000}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000011c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f00000002c0)='mm_page_free\x00', r5, 0x0, 0x6}, 0x18) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r6) close_range(r0, r6, 0x2) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r6, &(0x7f00000005c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="a4000000", @ANYRES16=r7, @ANYBLOB="000126bd7000fedbdf250b00000008000300", @ANYRES32=r8, @ANYBLOB="04000b0004000b00110007006a536d71735479c472c935f18100000009000700966e353f8c9d9ea97e6b370d6bdc000000040028004c0050800800030001ac0f0009000100466f4b38ab0000001c00088004000100040002000400020004000100040002000400020004000600130004006a8d6d1be41a6cb086849910465db50004000b0009000700dfaaf80718000000"], 0xa4}, 0x1, 0x0, 0x0, 0x80}, 0x240000c4) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000ff0f000007"], 0x50) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000004080)={{r10}, &(0x7f0000004000), &(0x7f0000004040)}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='kfree\x00', r11, 0x0, 0x8000000000004}, 0x18) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) write$binfmt_script(r9, &(0x7f0000000540), 0x84) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r9, 0x0) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x14}, 0x4010) r13 = openat$pidfd(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) pidfd_send_signal(r13, 0x0, &(0x7f00000000c0)={0x5, 0x0, 0x7}, 0x0) perf_event_open(&(0x7f00000004c0)={0x8, 0xcb, 0x0, 0xc, 0x0, 0x0, 0x82, 0x200000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0x9}, 0x18204, 0x0, 0x3, 0x0, 0x0, 0x5338c7af, 0x0, 0x0, 0x5, 0x0, 0x2}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) socket$tipc(0x1e, 0x2, 0x0) 2.564586794s ago: executing program 5 (id=3056): socket$inet6(0xa, 0x3, 0x3c) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x1, 0x6}, 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000000000000004b64ffed850000006d000000a50000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r2, 0x0, 0xb}, 0x18) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000880)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="9bfb27bd7000000002000100000020000180140002006e65747063693000000000000000000008000100", @ANYRES32=r6], 0x34}, 0x1, 0x0, 0x0, 0x2000c804}, 0x20048004) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000240), 0x4) ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f0000000300)={0x18, 0x0, {0x1, @broadcast, 'batadv_slave_1\x00'}}) r8 = socket$tipc(0x1e, 0x5, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) readv(r9, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0xe3}], 0x1) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r8, 0x8983, &(0x7f0000000040)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) r10 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(0x0) keyctl$chown(0x4, 0x0, r11, 0x0) quotactl$Q_GETNEXTQUOTA(0xffffffff80000901, &(0x7f0000000340)=@md0, 0x0, &(0x7f0000000480)) r12 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r13 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip6_mr_cache\x00') pread64(r13, &(0x7f0000000200)=""/196, 0xc4, 0x401) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e000083a2a4091dffaabc0e6ce73b00ffff000004d66b37919f50bb44c162217b3ca44f9f62c6a161824d29974abe9458d32120324f69950c5088c9e894b2998af2d8c80e83b6c5cd32bfe7a745128f9227f024aca04a2324a7c3f29a3414a804b5c23d4827b4a566cf7b04588580f63edc5d2f25e827756f59fbab11d01d412dfb8589e7ce73d4d76780cae9effc01a98dbb", @ANYRES32=r1, @ANYBLOB="930f00"/20, @ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="0100000002000000010000000d00"/28], 0x50) r14 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="000000000000008600"], &(0x7f0000000380)='syzkaller\x00', 0xfffffff9, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb2d0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='kfree\x00', r14}, 0x18) 2.092641022s ago: executing program 5 (id=3058): syz_emit_ethernet(0x56, &(0x7f0000000200)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}, @empty, @void, {@canfd={0xd, {{0x0, 0x0, 0x1}, 0x1e, 0x1, 0x0, 0x0, "8c65760ef54bb606cb183521975faf99e45f998f8fd6f5a58df7162875b29d36af51285a93134d5c4a00cb1b3aae5c5643855c6970b6ee749564dad1d78bd30d"}}}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r0}, 0x18) r1 = io_uring_setup(0x1e2b, &(0x7f0000004bc0)={0x0, 0xb07b, 0x42, 0x2, 0x3f8}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) accept4$unix(0xffffffffffffffff, &(0x7f0000000340), &(0x7f0000000140)=0x6e, 0x80000) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r4}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r2}, &(0x7f0000000000), &(0x7f00000005c0)=r5}, 0x20) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000004c40)=[@ioring_restriction_sqe_op={0x1, 0x54}], 0x1) 2.063154344s ago: executing program 5 (id=3059): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x3c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r0}, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYRES16=r1, @ANYBLOB="010328bd7000fedbdf251c"], 0x20}}, 0x10) 1.998426399s ago: executing program 5 (id=3061): bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = socket$kcm(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) syz_clone(0x630c1100, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000140)={&(0x7f0000000880)={0x2, 0x4e20, @multicast2}, 0x10, 0x0, 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32, @ANYBLOB="ac1414bb008000000000000038000000000000000000000007000000070e43aa5889c23ef593ae6bcd1844187c8073b5c9e00000000600000003000000080000000900001400000000000000000000000100000005000000000000001400000000000000000000000700000001000000000000001400000000000000000000000100000003000000000000001c000000000000000000000008"], 0xc0}, 0x0) 1.852576191s ago: executing program 1 (id=3064): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0700000004000000080200000100000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="1000"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x8, 0x8, &(0x7f0000000180)=ANY=[@ANYRESDEC=r0, @ANYRES32=r1], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x50) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000060000000000000000008500000007000000850000000e00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000012c0)={&(0x7f0000000040)='kfree\x00', r3}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff0000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r2}, 0x4) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80002, 0x0) close(r6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='timer_start\x00', r7}, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) 1.533604156s ago: executing program 1 (id=3068): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r2}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) get_mempolicy(0x0, 0x0, 0x203, &(0x7f0000394000/0x3000)=nil, 0x3) 1.433442084s ago: executing program 1 (id=3069): syz_emit_ethernet(0x56, &(0x7f0000000200)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}, @empty, @void, {@canfd={0xd, {{0x0, 0x0, 0x1}, 0x1e, 0x1, 0x0, 0x0, "8c65760ef54bb606cb183521975faf99e45f998f8fd6f5a58df7162875b29d36af51285a93134d5c4a00cb1b3aae5c5643855c6970b6ee749564dad1d78bd30d"}}}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r0}, 0x18) r1 = io_uring_setup(0x1e2b, &(0x7f0000004bc0)={0x0, 0xb07b, 0x42, 0x2, 0x3f8}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) accept4$unix(0xffffffffffffffff, &(0x7f0000000340), &(0x7f0000000140)=0x6e, 0x80000) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r4}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r2}, &(0x7f0000000000), &(0x7f00000005c0)=r4}, 0x20) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000004c40)=[@ioring_restriction_sqe_op={0x1, 0x54}], 0x1) 1.280554037s ago: executing program 1 (id=3072): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r0}, 0x18) r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r2 = fcntl$dupfd(r1, 0x0, r1) r3 = socket(0xa, 0x3, 0xff) getsockopt$inet6_buf(r3, 0x3a, 0x3d, 0x0, 0x0) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x0, 0x0, 0x0, 0x7995}, 0xfff7, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) 998.285809ms ago: executing program 1 (id=3073): r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000080)=0x10, 0x80800) write(r0, &(0x7f0000000280)="b96ca73e6c52e77dcb67c27fc869f9eb2bf7542afb8a1a9bd4895bcfb0b8c187b0c64945da7a512651806b77a8b688a6ec7e2888c647c38ad1bbb9d8f9b2e39df957748c85cbdacc6f2de178932929e75a521196919987df3afaa88f44989cc8e05f0e74677cfaafa1862ca68ff485b70c2fb72a3412aa451b3ebe35bf5268281fbe20ecbe96ada77d0ec37c7c4ee1a161d94ba362498d39df734dea997d4b977ba0212f63fd14f25c63f8244147b8db96ec86356ae53bc592aa6aa22b25925be0bc72057037cbf3c51f3f22c5", 0xcd) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x0, 0x0) socket$inet6(0xa, 0x3, 0xff) setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x2, &(0x7f0000000400)=0x2, 0x4) bind$can_raw(0xffffffffffffffff, &(0x7f0000000480), 0x10) setsockopt$CAN_RAW_FILTER(0xffffffffffffffff, 0x65, 0x1, &(0x7f0000000000)=[{{0x4, 0x0, 0x1, 0x1}, {0x2, 0x0, 0x1, 0x1}}, {{0x4, 0x1, 0x1}, {0x1, 0x1}}], 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) getxattr(0x0, 0x0, 0x0, 0x0) 783.984967ms ago: executing program 1 (id=3074): bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x24406, &(0x7f0000003f80), 0x1, 0x44f, &(0x7f0000000b40)="$eJzs289vFFUcAPDvzG6L/LIrwR/8UIloJP4otCBy8KLRxIMmJnrAY20LQRZqaE2EEC3G4NGQeDceTfgLPOnFqCcTr+rZkBDTC+hpzezO0O2yu/bXdiv7+SQD78287XvfefO2b+Z1AhhYB7J/kogdEfFbRIw0sksLHGj8d3vh8uTfC5cnk6jV3v4rqZe7tXB5sihafG57kSlHpJ8lsa9NvbMXL52dqFanL+T5w3PnPjg8e/HS82fOTZyePj19fvzEiWNHx148Pv7CusSZxXVr78cz+/e8/u61NydPXnvvp+tJEX9LHGtXjqYf3dZTtdr6VbcJ7GxKJ+U+NoQVKeVX61B9/I9EKRY7byRe+7SvjQN6qlar1R7qfHi+BtzDkuh3C4D+KH7RZ/e/xbZBU49N4ebLjRugLO7b+dY4Uo40LzPUcn+7ng5ExMn5f77Ktmh9DrG1R5UCAAPtu2z+81y7+V8azc+F7s/XUCoR8UBE7IqI4xGxOyIejKiXfTgiHllh/a2LJHfPP9MbqwpsmbL530v52tbS+V8x+4tKKc/trMc/lJw6U50+kp+TQzG0JcuPdanj+1d//aLTseb5X7Zl9RdzwbwdN8pbln5mamJuYi0xN7t5JWJvuV38yZ2VgCQi9kTE3lXWceaZb/Z3OtYh/uFl/eB1WGeqfR3xdKP/56Ml/kLSfX3y8H1RnT6yJfKr4m4//3L1rU71/3f/91bW/9vaXv9F/H9Ukub12tmV13H198873lOu9vofTt5Zsu+jibm5C2MRw8kb9Xylef94S7nxxfJZ/IcOth//u2LxTOyLiOwifjQiHouIx5u+u56IiINd4v/xlSffX338vZXFP9W1/6Ol/xcTw9G6p32idPaHb5dUWllJ/Fn/H6unDuV7lvP91645RUTNh9Zy7gAAAOD/Io2IHZGko3fSaTo62vgb/t2xLa3OzM49e2rmw/NTjXcEKjGUFs8/R5qeh47lt/VFfrwlfzR/bvxlaWs9Pzo5U53qd/Aw4LZ3GP+ZP0v9bh3Qc97XgsFl/MPgMv5hcBn/MLjajH+vnsGAaPf7/5M+tAPYeC3jv+uyn4kB3Fvc/8PgMv5hcBn/MJCuRHR/eb+niet5Kzak0jQiVv3xiH6cn82ciHRTNEOiR4k+fzEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACsk38DAAD//3893aY=") open(&(0x7f0000000240)='./file2\x00', 0x165142, 0x148) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0xfd, 0x0, 0x437d}]}) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYRES16=r1, @ANYRES16=r0], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000080000000c"], 0x48) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000003c0)=0x2) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002300000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r4}, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x8, 'macsec0\x00', {'netpci0\x00'}}) r5 = socket$inet(0x2, 0x3, 0x30) getsockopt$inet_mreqsrc(r5, 0x0, 0x53, &(0x7f0000000700)={@dev, @local, @broadcast}, &(0x7f0000000440)=0xc) socket$nl_route(0x10, 0x3, 0x0) symlink(0x0, &(0x7f00000017c0)='./file0\x00') bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x65, 0x7f, 0x5, 0x0, 0x0, 0x7, 0x89008, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc46, 0x0, @perf_bp={0x0, 0x4}, 0x0, 0x8, 0x7ffffefc, 0x3, 0xfffffffffffffffe, 0x0, 0x4000, 0x0, 0xfc, 0x0, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x9) r6 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r6, &(0x7f0000002a00)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f00000000c0)=""/43, 0x2b}}, 0x120) write$UHID_DESTROY(r6, &(0x7f0000000080), 0x4) 680.568515ms ago: executing program 0 (id=3075): accept4$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000080)=0x10, 0x80800) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r0, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r1}, 0x18) getxattr(0x0, &(0x7f0000000300)=@known='user.incfs.size\x00', 0x0, 0x0) 449.872824ms ago: executing program 0 (id=3076): bpf$MAP_CREATE(0x0, &(0x7f00000024c0)=ANY=[], 0x50) socket$kcm(0x10, 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x40, &(0x7f0000000040)={[{@errors_remount}, {@min_batch_time={'min_batch_time', 0x3d, 0x5}}, {@noacl}]}, 0x1, 0x581, &(0x7f0000000800)="$eJzs3U1oHGUfAPD/zGb7mfdNX3hfeJUeigoVSjdJP7R6aq9iIdCD4EXDZhtKNtmQ3WgTckjvRexBVHqpNwU9Vjx4EC8evXpRPAvFBoWmB13Zr6RNduOmbbI1+/vB7D7PPLP7f56d+U9mhgwTQN86VntJI56JiLEkYuiBtoFoNh5rLLe6spS/v7KUT6JavfRrEklE3FtZyreWT5rvhyNiOSL+HxHfZiNOpJvjlhcWp8aLxcJcsz5cmZ4dLi8snrwyPT5ZmCzMnH75lbPnzpwdPTX64MfuVx+sZbc31us/3Xjv+vev3brx2RdHl/MfjCdxPgabbfVx7Nve93UjaXb0/Ib5Z558qJ5Ket0BHkmmmee1VPpfDEWmmfXtVId2tWvADqvuj6g+5HYV6BdJ9LoHQG+0jgNq57+taTePP+5caJyA1OKuNqdGy0Dj2kQcqJ+bHPoteejMpHa++fludpQ9aflaRIwMDGze/pPm9vfoRp5EB9lR31xorKjN6z9d2/9Em/1PtK6dPqbW/m910/5vPX6mw/5vrMsYf7z588cd41+LeLZt/GQtftImfhoRb3cZ/+YbX53r1Fb9JOJ4tI/fkmx9fXj48pViYaTx2jbG18ePvrrV+A91iN+4ZnvgSHT4/We7HP+X391+bnmL+C8+v/X6b/f7H4yI97uM/597n77eqe3OteRu7Shgu+u/Nu9Wl/FfOn/sxy4XBQAAAAAAAAAAtiGNiMFI0txaOU1zucY9vP+NQ2mxVK6cuFyan5mI+r2yRyKbtv7TaqhRT2r10Xp5vX5qQ/10phkwc7Bez+VLxYkejx0AAAAAAAAAAAAAAAAAAACeFoc33P//e6Z+///Gx1UDe1XnR34De538h/71cP4nPesHsPv8/Ye+VZX/0L/kP/Qv+Q/9S/5D/5L/0L/kP/Qv+Q8AAAAAAAAAAAAAAAAAAAAAAAAAADtiLBMxdvFi9f7KUr5WnxhYmJ8qvXNyolCeyk3P53P50txsbrJUmiwWcvnS9N99X1IqzY7EzPzV4UqhXBkuLyy+NV2an2k9U7SQ3fERAQAAAAAAAAAAAAAAAAAAwD/PYH1K0lxEpPVymuZyEf+KiCORTS5fKRZGIuLfEfFDJru/Vh/tdacBAAAAAAAAAAAAAAAAAABgjykvLE6NF4uFuT4pDGxn4YhYfrLdqH3jtj+Vba6rp+U3fPzCZEQ8Bd1Q2HrjBwAAAAAAAAAAAAAAAAAAdtX6Tb/dfuLPne0QAAAAAAAAAAAAAAAAAAAA9KX0lyQiatPxoRcGN7buS1Yz9feIePfmpQ+vjlcqc6O1+XfX5lc+as4/1Yv+A91q5WkrjwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB15YXFqfFisTC3g4VejxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgUfwVAAD//6301cc=") r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) syz_io_uring_setup(0xe46, &(0x7f0000000380)={0x0, 0x5f36, 0x2, 0x4001, 0x2b7}, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.current\x00', 0x275a, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000000000000000000000000000000a0cc2b89ce1525748ce167cbabb881f060599a6a59f645edca1d5c24b2f6b8c997a8f3e1b7679984a566d98d4d31198ee4c5ea7be0d99cf89bba4a6fd0bec12e7792bec3c5038e13b1982f80cdecd07f8908a983a7c9fb81c2ba7f7e87c991f30e50d1b3bbe4cf2a2f5d4571b6568ada51bc121c9139d2a8e0638c84066b1759081802"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r3}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$gtp(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB='\a\x00', @ANYRES32, @ANYBLOB="08000400000000000c0003000000000000000100080005000000000008000100", @ANYRES32=0x0, @ANYBLOB="0800020000000000060006"], 0x50}}, 0x0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, 0x0, 0x20000000) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000000c0)=0x0) capset(&(0x7f00000001c0)={0x20071026, r6}, &(0x7f0000000200)={0x93b6, 0x7, 0x750b6284, 0xfffffff7, 0x10000, 0x4}) close(0xffffffffffffffff) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_io_uring_setup(0x4172, &(0x7f0000000780)={0x0, 0x4f5e, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x54, 0x2007, @fd_index=0x4, 0x0, &(0x7f00000004c0), 0x1}) io_uring_enter(r8, 0x567, 0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='kfree\x00', r7, 0x0, 0x7}, 0x18) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r11}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1}, &(0x7f0000000200), &(0x7f0000000240)}, 0x20) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x800, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 449.072894ms ago: executing program 5 (id=3077): socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @mcast2, 0xc}, 0x1c) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0700000004000000000100000100000028"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x18) pause() getsockopt$sock_buf(r0, 0x1, 0x19, &(0x7f0000002f80)=""/217, &(0x7f0000003080)=0xd9) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) socket$inet6(0xa, 0x2, 0x3a) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r4, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000900)={0x0, 0xffffffffffffff85, &(0x7f0000000100)={&(0x7f0000000200)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x0, {0xa, 0x80, 0x14, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1d}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e21, 0x4e22}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x400000, &(0x7f0000006680)) r6 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) shmctl$SHM_LOCK(r6, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x136, 0xfff}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r7, 0x84, 0x1a, &(0x7f00000000c0)={r8, 0x6b, "d069ca545cbe68330b96fc0f58ce1ea7e230c5f0bff0be6249c14b38ea67e396d4d3d40ed1c61493bfd4cf884d96c5a6d25b67297cef9fb3f098154b3f383299e1c99fb04a5dde79edac9eb4f00800bf7314cafd201a91f161833b584be46351b8725f0d19a2351ffb3598"}, &(0x7f0000000140)=0x73) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f0000000240)={0x0, 0x2, 0x3, 0xfffffffffffffffd, 0x0, 0x8}, 0x0, &(0x7f0000000280)={0x3ff, 0x0, 0x0, 0x18, 0x0, 0x9, 0x466, 0xffffffffffffffff}, 0x0, 0x0) 270.158628ms ago: executing program 0 (id=3079): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x18) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000480)={0x0, 0x4000, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, r1, 0x9c3fa077fa966179, 0x20, 0x0, {{0x7e}, {@val={0x33}, @void}}}, 0x1c}}, 0x4000054) 249.58335ms ago: executing program 2 (id=3080): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x3c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r0}, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYRES16=r1, @ANYBLOB="010328bd7000fedbdf251c"], 0x20}}, 0x10) 213.117223ms ago: executing program 2 (id=3081): getresgid(&(0x7f0000000c40), 0x0, &(0x7f0000000240)=0x0) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000200)='./bus\x00', 0x10814, &(0x7f0000000700)=ANY=[@ANYRES8, @ANYRESHEX=r0, @ANYRES32, @ANYRESDEC, @ANYBLOB="1500bba7d41fabba4332de3ca642acf6f8de847e3f21783608008708a887d30aaf0a14b0691d48445fe3b4d1ddde1b81337b2c3b5f88535d7f6fa931b84783704494cebe49ca9f6269b05edde0246c360d0566b4056f0f02ccab035d3d0a5cde0b31bd424949fe23c0a0a25691738006c5c6acdf101fecdb4f79abdfb95c6afaea03dd5903b5240565f31504c207a9a2aa6c8108fb973081e90412a3c6cfa3b2513693727fad9acd8108acb8b90fab033c9dac0dc3e5a61c513e7b5edc5d76320f0e54045ea2b7b8fb1f78d3d346e26ee5ed6926cea1ffe0a1"], 0x1, 0x1fa, &(0x7f0000000500)="$eJzs2zFrE2EYB/Dn2rRe7GAHJ1E4cHEK6icwSAUxIEQy6GSgurQipEsUxH4eZz+EX8alg2SLXO5om2sLjWdyEn8/ON6H/O/guSF53uHN27sfDvY/Hr3f+nISaZLFRsSTmETs5lUpKdd0Vm/HnCTq+FXraQDgj/T7w27TPbBco1F3eDsidi4kg2+NNAQAAAAAAAAAAEBti5z/34j4Wj3/f7zifgGA+pz/X1/tch2NusN7xf6twvl/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDmT6fTWNL/Sci2vGxGRRkQ7Im5GRCsi8s+b7hcAqG8ynZ/7V83/iEgiwvwHgDXw6vWbF91eb6+fZWnEz+PxYDwo1iJ/9ry39zCb2T176mQ8Hmye5o+KPJvPt2b7hjx/fGm+HQ/uF3mePX3Zq+Q7sb/81weA/1InO3Vuvm+WV0Snc1mez+eiOrc/qMzvVtxprew1AIAFHH36fDA8PHw3+utFsthT7bKhq+/53lpWq4prFT+Sf6INRd0ivc7NDf8wAUt39qWvJmkzDQEAAAAAAAAAAAAAABes4i9HTb8jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADr53cAAAD//8h6UUs=") mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x408, 0x103) 172.824906ms ago: executing program 0 (id=3082): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0xb8) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000002000000e00000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000064010102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x310) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000000)={0x4, {{0x2, 0x4e21, @loopback}}, 0x0, 0x1, [{{0x2, 0x4e20, @loopback}}]}, 0x110) r1 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000240)=""/68, 0x44}], 0x1, 0xde, 0x20004) 171.959236ms ago: executing program 2 (id=3083): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) eventfd2(0x0, 0x0) 100.491192ms ago: executing program 2 (id=3084): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa1", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x78, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xffffffff}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x3c, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x6}, @NFTA_LIMIT_BURST={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x400}, @NFTA_LIMIT_UNIT={0x0, 0x2, 0x1, 0x0, 0x9}]}}}, @NFTA_SET_EXPR={0xff2e, 0x11, 0x0, 0x1, @redir={{}, @val={0x0, 0x2, 0x0, 0x1, [@NFTA_REDIR_FLAGS={0x0, 0x3, 0x1, 0x0, 0x20}, @NFTA_REDIR_REG_PROTO_MAX={0x0, 0x2, 0x1, 0x0, 0xb}, @NFTA_REDIR_REG_PROTO_MAX={0x0, 0x2, 0x1, 0x0, 0xe}, @NFTA_REDIR_REG_PROTO_MIN, @NFTA_REDIR_REG_PROTO_MIN={0x0, 0x1, 0x1, 0x0, 0x2}]}}}, @NFTA_SET_FLAGS={0x0, 0x3, 0x1, 0x0, 0x20}, @NFTA_SET_TIMEOUT={0x0, 0xb, 0x1, 0x0, 0xa}]}], {0xfffffffffffffde2, 0x10}}, 0xc0}}, 0x0) 100.020922ms ago: executing program 0 (id=3085): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYBLOB="2d8154cdb2ee5523c7e541137bf6122169a9f97666a5295ae1a72be29421479b55781b719236f1e4", @ANYBLOB="0000000000000000b708000000000e007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000020850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r4}, 0x10) r5 = dup3(r3, r2, 0x0) connect$unix(r5, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e22}, 0x6e) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x30b529, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x0, 0x4}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0xffffffffffffffff, 0xa, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) 99.672292ms ago: executing program 2 (id=3086): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0x7, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) close_range(r1, 0xffffffffffffffff, 0x0) 74.631934ms ago: executing program 2 (id=3087): socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xf, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f00000000c0)) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000500)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r2 = socket$can_raw(0x1d, 0x3, 0x1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bind$can_raw(r2, &(0x7f0000000080), 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='kmem_cache_free\x00', r1, 0x0, 0x1}, 0x18) syslog(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d0000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) gettid() r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r4, &(0x7f0000000440)=""/247, 0x26) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000080)={0x31, @time={0x3, 0xfffefffd}, 0x0, {0x0, 0x2}, 0x0, 0x0, 0x4}) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r4, 0xc0305302, &(0x7f0000000040)={0x36, 0x7, 0x4, 0x9, 0x1, 0x80}) sched_getattr(0x0, &(0x7f00000001c0)={0x38}, 0x38, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000240)=@file={0x1, './file0\x00'}, 0x6e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00'}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000340)='kfree\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffffc}, 0x18) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="a0010000100001000000000000000000fe880000000000000000000000000101ac1414bb00000000000000000000000000000000000200000000000064000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000032000000fc010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000002000000000000000000000000000002000000000000000000000002000000cd000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c0017000000000000000000000000000000000028bd7000000000004c001400636d616328616573290000"], 0x1a0}}, 0x800) 0s ago: executing program 0 (id=3088): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r0, 0x0, 0x40}, 0x18) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r3, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r3}, &(0x7f00000006c0), &(0x7f0000000700)=r2}, 0x20) sendmsg$inet(r1, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) kernel console output (not intermixed with test programs): 0065] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 142.537743][T10065] RSP: 002b:00007f738ce27030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 142.537763][T10065] RAX: ffffffffffffffda RBX: 00007f738e9e5fa0 RCX: 00007f738e7bd57c [ 142.537833][T10065] RDX: 000000000000000f RSI: 00007f738ce270a0 RDI: 0000000000000006 [ 142.537847][T10065] RBP: 00007f738ce27090 R08: 0000000000000000 R09: 0000000000000000 [ 142.537914][T10065] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 142.537925][T10065] R13: 0000000000000000 R14: 00007f738e9e5fa0 R15: 00007fffb4870208 [ 142.537967][T10065] [ 142.811062][T10068] loop9: detected capacity change from 0 to 7 [ 142.817325][T10068] Buffer I/O error on dev loop9, logical block 0, async page read [ 142.833873][T10068] Buffer I/O error on dev loop9, logical block 0, async page read [ 142.841944][T10068] loop9: unable to read partition table [ 142.863546][T10068] loop_reread_partitions: partition scan of loop9 (ţ被xüźŃř éÚ¬§˝dG¤´ŕ–ݡŻ ťâ·ű [ 142.863546][T10068] ) failed (rc=-5) [ 143.002391][T10081] random: crng reseeded on system resumption [ 143.016425][T10083] loop4: detected capacity change from 0 to 512 [ 143.060818][T10083] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 143.080713][T10083] ext4 filesystem being mounted at /509/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 143.181878][ T3310] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 143.317063][T10120] netlink: 'syz.2.2516': attribute type 15 has an invalid length. [ 143.324990][T10120] netlink: 'syz.2.2516': attribute type 7 has an invalid length. [ 143.335664][T10120] SELinux: policydb magic number 0xffffffff does not match expected magic number 0xf97cff8c [ 143.345966][T10120] SELinux: failed to load policy [ 143.672889][T10138] lo speed is unknown, defaulting to 1000 [ 143.950139][T10138] loop4: detected capacity change from 0 to 512 [ 143.956604][T10138] EXT4-fs: Ignoring removed mblk_io_submit option [ 143.963038][T10138] EXT4-fs: Ignoring removed bh option [ 143.999481][T10137] syz!: rxe_newlink: already configured on team_slave_0 [ 144.013010][T10137] netlink: 'syz.2.2523': attribute type 1 has an invalid length. [ 144.021720][T10138] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 144.108135][T10138] EXT4-fs (loop4): 1 truncate cleaned up [ 144.116010][T10138] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 144.328254][ T3310] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 144.479410][T10167] loop4: detected capacity change from 0 to 1024 [ 144.510411][T10167] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 144.531084][T10175] FAULT_INJECTION: forcing a failure. [ 144.531084][T10175] name failslab, interval 1, probability 0, space 0, times 0 [ 144.543826][T10175] CPU: 1 UID: 0 PID: 10175 Comm: syz.0.2531 Not tainted 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 144.543904][T10175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 144.543915][T10175] Call Trace: [ 144.543921][T10175] [ 144.543928][T10175] __dump_stack+0x1d/0x30 [ 144.543950][T10175] dump_stack_lvl+0xe8/0x140 [ 144.543969][T10175] dump_stack+0x15/0x1b [ 144.543983][T10175] should_fail_ex+0x265/0x280 [ 144.544116][T10175] should_failslab+0x8c/0xb0 [ 144.544141][T10175] __kmalloc_node_track_caller_noprof+0xa4/0x410 [ 144.544170][T10175] ? sidtab_sid2str_get+0xa0/0x130 [ 144.544211][T10175] kmemdup_noprof+0x2b/0x70 [ 144.544240][T10175] sidtab_sid2str_get+0xa0/0x130 [ 144.544272][T10175] security_sid_to_context_core+0x1eb/0x2e0 [ 144.544394][T10175] security_sid_to_context+0x27/0x40 [ 144.544494][T10175] avc_audit_post_callback+0x10f/0x520 [ 144.544520][T10175] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 144.544544][T10175] common_lsm_audit+0x1bb/0x230 [ 144.544575][T10175] ? __pfx_avc_audit_post_callback+0x10/0x10 [ 144.544632][T10175] slow_avc_audit+0x104/0x140 [ 144.544692][T10175] avc_has_perm+0x13a/0x180 [ 144.544718][T10175] selinux_netlink_send+0x4b1/0x5f0 [ 144.544792][T10175] security_netlink_send+0x40/0x80 [ 144.544820][T10175] netlink_sendmsg+0x498/0x6b0 [ 144.544923][T10175] ? __pfx_netlink_sendmsg+0x10/0x10 [ 144.544959][T10175] __sock_sendmsg+0x145/0x180 [ 144.544985][T10175] ____sys_sendmsg+0x31e/0x4e0 [ 144.545023][T10175] ___sys_sendmsg+0x17b/0x1d0 [ 144.545112][T10175] __x64_sys_sendmsg+0xd4/0x160 [ 144.545167][T10175] x64_sys_call+0x191e/0x2ff0 [ 144.545191][T10175] do_syscall_64+0xd2/0x200 [ 144.545217][T10175] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 144.545280][T10175] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 144.545304][T10175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.545329][T10175] RIP: 0033:0x7f9e2820eb69 [ 144.545345][T10175] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 144.545365][T10175] RSP: 002b:00007f9e26856038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 144.545413][T10175] RAX: ffffffffffffffda RBX: 00007f9e28436080 RCX: 00007f9e2820eb69 [ 144.545427][T10175] RDX: 0000000000040000 RSI: 00002000000001c0 RDI: 000000000000000b [ 144.545441][T10175] RBP: 00007f9e26856090 R08: 0000000000000000 R09: 0000000000000000 [ 144.545455][T10175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 144.545502][T10175] R13: 0000000000000000 R14: 00007f9e28436080 R15: 00007ffff54a13d8 [ 144.545522][T10175] [ 144.803591][ T29] kauditd_printk_skb: 418 callbacks suppressed [ 144.803606][ T29] audit: type=1400 audit(1754233204.304:12290): avc: denied { nlmsg_read } for pid=10168 comm="syz.0.2531" scontext=root:sysadm_r:sysadm_t tsid=137 tclass=netlink_audit_socket permissive=1 [ 144.828649][ T29] audit: type=1400 audit(1754233204.314:12291): avc: denied { audit_write } for pid=10168 comm="syz.0.2531" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 144.850051][ T29] audit: type=1107 audit(1754233204.314:12292): pid=10168 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 144.869372][ T3310] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 145.012259][T10185] __nla_validate_parse: 11 callbacks suppressed [ 145.012290][T10185] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2533'. [ 145.027437][T10185] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2533'. [ 145.049210][ T29] audit: type=1400 audit(1754233204.824:12293): avc: denied { mounton } for pid=10187 comm="syz.3.2536" path="/483/file0" dev="tmpfs" ino=2542 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 145.130861][T10191] loop0: detected capacity change from 0 to 512 [ 145.137365][T10191] EXT4-fs: Ignoring removed mblk_io_submit option [ 145.141273][T10186] lo speed is unknown, defaulting to 1000 [ 145.143828][T10191] EXT4-fs: Ignoring removed bh option [ 145.155701][T10191] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 145.170050][T10191] EXT4-fs (loop0): 1 truncate cleaned up [ 145.176059][T10191] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 145.207777][ T29] audit: type=1400 audit(1754233204.974:12294): avc: denied { append } for pid=10183 comm="syz.0.2535" name="pfkey" dev="proc" ino=4026532766 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 145.242862][T10196] FAULT_INJECTION: forcing a failure. [ 145.242862][T10196] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 145.256045][T10196] CPU: 1 UID: 0 PID: 10196 Comm: syz.1.2539 Not tainted 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 145.256077][T10196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 145.256088][T10196] Call Trace: [ 145.256093][T10196] [ 145.256146][T10196] __dump_stack+0x1d/0x30 [ 145.256168][T10196] dump_stack_lvl+0xe8/0x140 [ 145.256189][T10196] dump_stack+0x15/0x1b [ 145.256205][T10196] should_fail_ex+0x265/0x280 [ 145.256235][T10196] should_fail+0xb/0x20 [ 145.256276][ T29] audit: type=1400 audit(1754233205.014:12295): avc: denied { create } for pid=10190 comm="syz.4.2538" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 145.256319][T10196] should_fail_usercopy+0x1a/0x20 [ 145.256338][T10196] _copy_to_user+0x20/0xa0 [ 145.256365][T10196] simple_read_from_buffer+0xb5/0x130 [ 145.256491][T10196] proc_fail_nth_read+0x10e/0x150 [ 145.256519][T10196] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 145.256545][T10196] vfs_read+0x1a0/0x6f0 [ 145.256565][T10196] ? __rcu_read_unlock+0x4f/0x70 [ 145.256587][T10196] ? __fget_files+0x184/0x1c0 [ 145.256635][T10196] ksys_read+0xda/0x1a0 [ 145.256657][T10196] __x64_sys_read+0x40/0x50 [ 145.256686][T10196] x64_sys_call+0x27bc/0x2ff0 [ 145.256716][T10196] do_syscall_64+0xd2/0x200 [ 145.256783][T10196] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 145.256807][T10196] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 145.256828][T10196] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.256850][T10196] RIP: 0033:0x7fc3c382d57c [ 145.256865][T10196] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 145.256948][T10196] RSP: 002b:00007fc3c1e97030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 145.256967][T10196] RAX: ffffffffffffffda RBX: 00007fc3c3a55fa0 RCX: 00007fc3c382d57c [ 145.256979][T10196] RDX: 000000000000000f RSI: 00007fc3c1e970a0 RDI: 0000000000000008 [ 145.256992][T10196] RBP: 00007fc3c1e97090 R08: 0000000000000000 R09: 0000000000000000 [ 145.257075][T10196] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 145.257087][T10196] R13: 0000000000000000 R14: 00007fc3c3a55fa0 R15: 00007ffe8a64c388 [ 145.257105][T10196] [ 145.351104][T10200] bridge0: entered allmulticast mode [ 145.501455][T10200] bridge_slave_1: left allmulticast mode [ 145.507186][T10200] bridge_slave_1: left promiscuous mode [ 145.513813][T10200] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.515606][T10207] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2544'. [ 145.531039][T10200] bridge_slave_0: left allmulticast mode [ 145.536690][T10200] bridge_slave_0: left promiscuous mode [ 145.542369][T10200] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.553783][T10209] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2540'. [ 145.701995][ T29] audit: type=1326 audit(1754233205.474:12296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10220 comm="syz.3.2548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa35650eb69 code=0x7ffc0000 [ 145.745047][ T29] audit: type=1326 audit(1754233205.504:12297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10220 comm="syz.3.2548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa35650eb69 code=0x7ffc0000 [ 145.769962][ T29] audit: type=1326 audit(1754233205.504:12298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10220 comm="syz.3.2548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=239 compat=0 ip=0x7fa35650eb69 code=0x7ffc0000 [ 145.794250][ T29] audit: type=1326 audit(1754233205.504:12299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10220 comm="syz.3.2548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa35650eb69 code=0x7ffc0000 [ 145.886960][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 145.987309][T10248] loop4: detected capacity change from 0 to 164 [ 146.012758][T10248] Unsupported NM flag settings (8) [ 146.065999][T10257] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2564'. [ 146.077676][T10260] SELinux: policydb magic number 0x6e756f6d does not match expected magic number 0xf97cff8c [ 146.089270][T10260] SELinux: failed to load policy [ 146.115953][T10260] : renamed from bond0 [ 146.142114][T10264] loop0: detected capacity change from 0 to 512 [ 146.152153][T10264] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 146.259893][T10264] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 146.285794][T10264] ext4 filesystem being mounted at /568/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 146.327862][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 146.453659][T10287] loop4: detected capacity change from 0 to 512 [ 146.460966][T10287] EXT4-fs: Ignoring removed i_version option [ 146.575998][T10287] EXT4-fs (loop4): orphan cleanup on readonly fs [ 146.586390][T10287] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.2575: bg 0: block 131: padding at end of block bitmap is not set [ 146.620276][T10287] EXT4-fs (loop4): Remounting filesystem read-only [ 146.648469][T10287] EXT4-fs (loop4): 1 truncate cleaned up [ 146.655166][T10287] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 146.791453][T10284] syzkaller0: entered promiscuous mode [ 146.797185][T10284] syzkaller0: entered allmulticast mode [ 146.870773][ T3310] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 146.914416][ T3411] hid_parser_main: 17 callbacks suppressed [ 146.914435][ T3411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 146.929097][ T3411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 146.936476][ T3411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 146.944508][ T3411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 146.951966][ T3411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 146.960712][ T3411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 146.968146][ T3411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 146.975617][ T3411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 146.983669][ T3411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 146.991702][ T3411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 147.000574][ T3411] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz0] on syz1 [ 147.068808][T10311] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2583'. [ 147.077675][T10311] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2583'. [ 147.226479][T10323] loop0: detected capacity change from 0 to 1024 [ 147.261667][T10323] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 147.286759][T10323] 9pnet_fd: Insufficient options for proto=fd [ 147.442596][T10344] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2594'. [ 147.534228][T10350] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2596'. [ 147.543237][T10350] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2596'. [ 147.680160][T10352] lo speed is unknown, defaulting to 1000 [ 147.764719][T10354] sd 0:0:1:0: device reset [ 147.866453][T10363] loop3: detected capacity change from 0 to 512 [ 147.873714][T10363] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 147.889699][T10363] EXT4-fs (loop3): 1 truncate cleaned up [ 147.895762][T10363] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 147.962567][T10372] loop4: detected capacity change from 0 to 1024 [ 147.981144][T10372] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 148.159685][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 148.184914][T10398] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 148.191536][T10398] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 148.200349][T10398] vhci_hcd vhci_hcd.0: Device attached [ 148.208478][T10372] loop4: detected capacity change from 1024 to 64 [ 148.225834][T10399] vhci_hcd: connection closed [ 148.226154][ T7914] vhci_hcd: stop threads [ 148.235091][ T7914] vhci_hcd: release socket [ 148.239525][ T7914] vhci_hcd: disconnect device [ 148.294831][ T3310] EXT4-fs error (device loop4): ext4_readdir:264: inode #2: block 16: comm syz-executor: path /530/file1: bad entry in directory: inode out of bounds - offset=0, inode=201326592, rec_len=256, size=1024 fake=0 [ 148.325160][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 148.370527][ T6100] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 148.382788][T10375] kmmpd-loop4: attempt to access beyond end of device [ 148.382788][T10375] loop4: rw=14337, sector=128, nr_sectors = 2 limit=64 [ 148.396973][T10375] Buffer I/O error on dev loop4, logical block 64, lost sync page write [ 148.420936][T10417] FAULT_INJECTION: forcing a failure. [ 148.420936][T10417] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 148.434656][T10417] CPU: 0 UID: 0 PID: 10417 Comm: syz.3.2619 Not tainted 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 148.434689][T10417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 148.434709][T10417] Call Trace: [ 148.434714][T10417] [ 148.434786][T10417] __dump_stack+0x1d/0x30 [ 148.434811][T10417] dump_stack_lvl+0xe8/0x140 [ 148.434828][T10417] dump_stack+0x15/0x1b [ 148.434842][T10417] should_fail_ex+0x265/0x280 [ 148.434948][T10417] should_fail+0xb/0x20 [ 148.434976][T10417] should_fail_usercopy+0x1a/0x20 [ 148.434993][T10417] strncpy_from_user+0x25/0x230 [ 148.435069][T10417] ? __kmalloc_cache_noprof+0x189/0x320 [ 148.435100][T10417] getname_flags+0x230/0x3b0 [ 148.435131][T10417] path_setxattrat+0x223/0x310 [ 148.435173][T10417] __x64_sys_setxattr+0x6e/0x90 [ 148.435203][T10417] x64_sys_call+0xad2/0x2ff0 [ 148.435223][T10417] do_syscall_64+0xd2/0x200 [ 148.435262][T10417] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 148.435356][T10417] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 148.435379][T10417] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.435403][T10417] RIP: 0033:0x7fa35650eb69 [ 148.435420][T10417] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 148.435439][T10417] RSP: 002b:00007fa354b77038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 148.435498][T10417] RAX: ffffffffffffffda RBX: 00007fa356735fa0 RCX: 00007fa35650eb69 [ 148.435509][T10417] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000200000003040 [ 148.435519][T10417] RBP: 00007fa354b77090 R08: 0000000000000000 R09: 0000000000000000 [ 148.435530][T10417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 148.435543][T10417] R13: 0000000000000000 R14: 00007fa356735fa0 R15: 00007ffc6b3b6f88 [ 148.435562][T10417] [ 148.670964][ T7899] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.780874][ T7899] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.830665][ T7899] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.883870][T10441] FAULT_INJECTION: forcing a failure. [ 148.883870][T10441] name failslab, interval 1, probability 0, space 0, times 0 [ 148.896563][T10441] CPU: 1 UID: 0 PID: 10441 Comm: syz.1.2627 Not tainted 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 148.896648][T10441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 148.896661][T10441] Call Trace: [ 148.896667][T10441] [ 148.896674][T10441] __dump_stack+0x1d/0x30 [ 148.896697][T10441] dump_stack_lvl+0xe8/0x140 [ 148.896791][T10441] dump_stack+0x15/0x1b [ 148.896808][T10441] should_fail_ex+0x265/0x280 [ 148.896843][T10441] should_failslab+0x8c/0xb0 [ 148.896871][T10441] kmem_cache_alloc_noprof+0x50/0x310 [ 148.896919][T10441] ? sk_prot_alloc+0x3f/0x190 [ 148.896951][T10441] ? __account_obj_stock+0x211/0x350 [ 148.897048][T10441] sk_prot_alloc+0x3f/0x190 [ 148.897078][T10441] sk_alloc+0x34/0x360 [ 148.897104][T10441] tipc_sk_create+0xec/0x11c0 [ 148.897195][T10441] ? kmem_cache_alloc_noprof+0x186/0x310 [ 148.897218][T10441] ? security_inode_alloc+0x37/0x100 [ 148.897240][T10441] ? selinux_inode_alloc_security+0x105/0x130 [ 148.897346][T10441] ? security_inode_alloc+0x69/0x100 [ 148.897410][T10441] ? inode_init_always_gfp+0x4cd/0x500 [ 148.897436][T10441] __sock_create+0x2ec/0x5b0 [ 148.897526][T10441] __sys_socketpair+0x1bc/0x430 [ 148.897590][T10441] __x64_sys_socketpair+0x52/0x60 [ 148.897613][T10441] x64_sys_call+0x2bf2/0x2ff0 [ 148.897638][T10441] do_syscall_64+0xd2/0x200 [ 148.897660][T10441] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 148.897698][T10441] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 148.897716][T10441] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.897735][T10441] RIP: 0033:0x7fc3c382eb69 [ 148.897749][T10441] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 148.897769][T10441] RSP: 002b:00007fc3c1e97038 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 148.897789][T10441] RAX: ffffffffffffffda RBX: 00007fc3c3a55fa0 RCX: 00007fc3c382eb69 [ 148.897802][T10441] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 000000000000001e [ 148.897846][T10441] RBP: 00007fc3c1e97090 R08: 0000000000000000 R09: 0000000000000000 [ 148.897857][T10441] R10: 0000200000000940 R11: 0000000000000246 R12: 0000000000000001 [ 148.897870][T10441] R13: 0000000000000000 R14: 00007fc3c3a55fa0 R15: 00007ffe8a64c388 [ 148.897890][T10441] [ 149.149354][ T7899] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 149.381675][T10455] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 149.388786][ T23] IPVS: starting estimator thread 0... [ 149.441835][ T7899] bond2 (unregistering): (slave gretap1): Releasing active interface [ 149.478628][T10463] IPVS: using max 2688 ests per chain, 134400 per kthread [ 149.522206][ T7899] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 149.533498][ T7899] bond0 (unregistering): Released all slaves [ 149.547049][ T7899] bond1 (unregistering): Released all slaves [ 149.557626][ T7899] bond2 (unregistering): Released all slaves [ 149.768719][T10431] lo speed is unknown, defaulting to 1000 [ 149.831085][T10479] loop2: detected capacity change from 0 to 512 [ 149.839847][ T7899] hsr_slave_0: left promiscuous mode [ 149.881586][ T7899] hsr_slave_1: left promiscuous mode [ 149.888008][T10479] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 149.897566][ T7899] veth1_macvtap: left promiscuous mode [ 149.903739][ T7899] veth0_macvtap: left promiscuous mode [ 149.910311][ T7899] veth1_vlan: left promiscuous mode [ 149.915594][ T7899] veth0_vlan: left promiscuous mode [ 149.922926][T10479] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 149.971246][T10479] ext4 filesystem being mounted at /483/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 150.034752][T10479] EXT4-fs (loop2): shut down requested (0) [ 150.066362][ T29] kauditd_printk_skb: 362 callbacks suppressed [ 150.066376][ T29] audit: type=1326 audit(1754233209.834:12660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10478 comm="syz.2.2637" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 150.124551][ T3300] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 150.137476][T10465] lo speed is unknown, defaulting to 1000 [ 150.174029][ T29] audit: type=1326 audit(1754233209.944:12661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10482 comm="syz.2.2638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 150.213791][T10483] __nla_validate_parse: 2 callbacks suppressed [ 150.213805][T10483] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2638'. [ 150.231256][ T29] audit: type=1326 audit(1754233209.984:12662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10482 comm="syz.2.2638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 150.254845][ T29] audit: type=1326 audit(1754233209.984:12663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10482 comm="syz.2.2638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 150.259712][T10431] chnl_net:caif_netlink_parms(): no params data found [ 150.278424][ T29] audit: type=1326 audit(1754233209.984:12664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10482 comm="syz.2.2638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 150.278453][ T29] audit: type=1326 audit(1754233209.984:12665): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10482 comm="syz.2.2638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 150.278526][ T29] audit: type=1326 audit(1754233209.984:12666): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10482 comm="syz.2.2638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 150.278618][ T29] audit: type=1326 audit(1754233209.984:12667): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10482 comm="syz.2.2638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 150.278698][ T29] audit: type=1326 audit(1754233209.984:12668): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10482 comm="syz.2.2638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 150.278727][ T29] audit: type=1326 audit(1754233209.984:12669): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10482 comm="syz.2.2638" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 150.389469][T10494] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2641'. [ 150.544448][T10431] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.551690][T10431] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.565078][T10431] bridge_slave_0: entered allmulticast mode [ 150.572214][T10431] bridge_slave_0: entered promiscuous mode [ 150.579015][T10431] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.586110][T10431] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.594574][T10431] bridge_slave_1: entered allmulticast mode [ 150.601121][T10431] bridge_slave_1: entered promiscuous mode [ 150.623028][T10519] loop0: detected capacity change from 0 to 1024 [ 150.665104][T10519] EXT4-fs: Ignoring removed oldalloc option [ 150.671091][T10519] EXT4-fs: Ignoring removed bh option [ 150.682759][T10431] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 150.695237][T10431] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 150.696143][ T7899] ------------[ cut here ]------------ [ 150.711104][ T7899] WARNING: CPU: 0 PID: 7899 at net/xfrm/xfrm_state.c:3303 xfrm_state_fini+0x17c/0x1f0 [ 150.720790][ T7899] Modules linked in: [ 150.724829][ T7899] CPU: 0 UID: 0 PID: 7899 Comm: kworker/u8:46 Not tainted 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 150.733049][T10519] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 150.737973][ T7899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 150.761044][ T7899] Workqueue: netns cleanup_net [ 150.765912][ T7899] RIP: 0010:xfrm_state_fini+0x17c/0x1f0 [ 150.772123][ T7899] Code: 48 8d bb 30 0e 00 00 e8 42 52 bd fc 48 8b bb 30 0e 00 00 e8 d6 d0 c9 fc 5b 41 5e 41 5f 5d c3 cc cc cc cc cc e8 75 9f a2 fc 90 <0f> 0b 90 e9 d9 fe ff ff e8 67 9f a2 fc 90 0f 0b 90 4c 89 f7 e8 0b [ 150.792578][ T7899] RSP: 0018:ffffc90001393c60 EFLAGS: 00010293 [ 150.798690][ T7899] RAX: ffffffff84b5572b RBX: ffff888109fa2f80 RCX: ffff8881023d9080 [ 150.806697][ T7899] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888109fa3d80 [ 150.815284][ T7899] RBP: ffffffff86c8a2e0 R08: 0001ffff86847f7f R09: 0000000000000000 [ 150.823926][ T7899] R10: ffffc90001393be8 R11: 0001c90001393be8 R12: ffffffff86c8a300 [ 150.832575][ T7899] R13: ffff888109fa2fa8 R14: ffff888109fa3d80 R15: ffff888109fa2f80 [ 150.840566][ T7899] FS: 0000000000000000(0000) GS:ffff8882aee49000(0000) knlGS:0000000000000000 [ 150.850800][ T7899] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 150.857428][ T7899] CR2: 00007f9e26711d58 CR3: 0000000127048000 CR4: 00000000003506f0 [ 150.865444][ T7899] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 150.874075][ T7899] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 150.882749][ T7899] Call Trace: [ 150.886024][ T7899] [ 150.889536][ T7899] xfrm_net_exit+0x2d/0x60 [ 150.893956][ T7899] ops_undo_list+0x278/0x410 [ 150.898587][ T7899] cleanup_net+0x2de/0x4d0 [ 150.903073][ T7899] process_scheduled_works+0x4ce/0x9d0 [ 150.909809][ T7899] worker_thread+0x582/0x770 [ 150.914582][ T7899] kthread+0x489/0x510 [ 150.918686][ T7899] ? __pfx_worker_thread+0x10/0x10 [ 150.923814][ T7899] ? __pfx_kthread+0x10/0x10 [ 150.929060][ T7899] ret_from_fork+0xdd/0x150 [ 150.933576][ T7899] ? __pfx_kthread+0x10/0x10 [ 150.938230][ T7899] ret_from_fork_asm+0x1a/0x30 [ 150.943680][ T7899] [ 150.946696][ T7899] ---[ end trace 0000000000000000 ]--- [ 150.974945][T10523] bridge0: entered promiscuous mode [ 150.982303][T10523] macsec1: entered promiscuous mode [ 150.990764][T10523] bridge0: port 4(macsec1) entered blocking state [ 150.997299][T10523] bridge0: port 4(macsec1) entered disabled state [ 151.004878][T10523] macsec1: entered allmulticast mode [ 151.010234][T10523] bridge0: entered allmulticast mode [ 151.016575][T10523] macsec1: left allmulticast mode [ 151.021733][T10523] bridge0: left allmulticast mode [ 151.028504][T10523] bridge0: left promiscuous mode [ 151.040795][T10525] bridge0: entered promiscuous mode [ 151.046191][T10525] macsec1: entered promiscuous mode [ 151.052808][T10525] bridge0: port 4(macsec1) entered blocking state [ 151.059293][T10525] bridge0: port 4(macsec1) entered disabled state [ 151.066860][T10525] macsec1: entered allmulticast mode [ 151.072232][T10525] bridge0: entered allmulticast mode [ 151.079142][T10525] macsec1: left allmulticast mode [ 151.084183][T10525] bridge0: left allmulticast mode [ 151.090427][T10525] bridge0: left promiscuous mode [ 151.099025][T10431] team0: Port device team_slave_0 added [ 151.117017][T10431] team0: Port device team_slave_1 added [ 151.138676][T10431] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 151.145650][T10431] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 151.171904][T10431] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 151.185245][T10431] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 151.192239][T10431] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 151.218161][T10431] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 151.321635][T10431] hsr_slave_0: entered promiscuous mode [ 151.336301][T10431] hsr_slave_1: entered promiscuous mode [ 151.342560][T10431] debugfs: 'hsr0' already exists in 'hsr' [ 151.348286][T10431] Cannot create hsr debugfs directory [ 151.380679][ T3303] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 151.464452][T10501] lo speed is unknown, defaulting to 1000 [ 151.555415][T10431] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 151.564425][T10431] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 151.572864][T10431] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 151.582482][T10431] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 151.614345][T10431] 8021q: adding VLAN 0 to HW filter on device bond0 [ 151.626162][T10431] 8021q: adding VLAN 0 to HW filter on device team0 [ 151.635375][ T7914] bridge0: port 1(bridge_slave_0) entered blocking state [ 151.642461][ T7914] bridge0: port 1(bridge_slave_0) entered forwarding state [ 151.654252][ T7914] bridge0: port 2(bridge_slave_1) entered blocking state [ 151.661435][ T7914] bridge0: port 2(bridge_slave_1) entered forwarding state [ 151.702647][T10568] loop3: detected capacity change from 0 to 2048 [ 151.721358][T10568] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 151.783940][T10431] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 151.843321][T10579] lo speed is unknown, defaulting to 1000 [ 151.874072][T10585] IPv6: Can't replace route, no match found [ 151.975457][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 152.079188][T10610] netlink: 'syz.2.2671': attribute type 25 has an invalid length. [ 152.118040][T10431] veth0_vlan: entered promiscuous mode [ 152.119564][T10616] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2673'. [ 152.126732][T10431] veth1_vlan: entered promiscuous mode [ 152.144886][T10579] loop0: detected capacity change from 0 to 8192 [ 152.150441][T10431] veth0_macvtap: entered promiscuous mode [ 152.161039][T10431] veth1_macvtap: entered promiscuous mode [ 152.177352][T10431] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 152.189734][T10431] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 152.206475][ T7914] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 152.226112][ T5999] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 152.249908][ T5999] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 152.264406][ T5999] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 152.388210][T10634] loop3: detected capacity change from 0 to 512 [ 152.402875][T10634] EXT4-fs error (device loop3): ext4_do_update_inode:5653: inode #16: comm syz.3.2676: corrupted inode contents [ 152.421305][T10634] EXT4-fs error (device loop3): ext4_dirty_inode:6538: inode #16: comm syz.3.2676: mark_inode_dirty error [ 152.437129][T10634] EXT4-fs error (device loop3): ext4_do_update_inode:5653: inode #16: comm syz.3.2676: corrupted inode contents [ 152.454288][T10634] EXT4-fs error (device loop3): __ext4_ext_dirty:206: inode #16: comm syz.3.2676: mark_inode_dirty error [ 152.478818][T10634] EXT4-fs error (device loop3): ext4_do_update_inode:5653: inode #16: comm syz.3.2676: corrupted inode contents [ 152.493538][T10634] EXT4-fs error (device loop3) in ext4_orphan_del:305: Corrupt filesystem [ 152.511987][T10634] EXT4-fs error (device loop3): ext4_do_update_inode:5653: inode #16: comm syz.3.2676: corrupted inode contents [ 152.525229][T10634] EXT4-fs error (device loop3): ext4_truncate:4666: inode #16: comm syz.3.2676: mark_inode_dirty error [ 152.542751][T10634] EXT4-fs error (device loop3) in ext4_process_orphan:347: Corrupt filesystem [ 152.554496][T10634] EXT4-fs (loop3): 1 truncate cleaned up [ 152.560565][T10634] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 152.574035][ T7914] EXT4-fs error (device loop3): ext4_release_dquot:6969: comm kworker/u8:61: Failed to release dquot type 1 [ 152.575737][T10634] ext4 filesystem being mounted at /518/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 152.631333][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 152.678226][T10654] FAULT_INJECTION: forcing a failure. [ 152.678226][T10654] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 152.691480][T10654] CPU: 1 UID: 0 PID: 10654 Comm: syz.5.2681 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 152.691514][T10654] Tainted: [W]=WARN [ 152.691519][T10654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 152.691553][T10654] Call Trace: [ 152.691559][T10654] [ 152.691566][T10654] __dump_stack+0x1d/0x30 [ 152.691622][T10654] dump_stack_lvl+0xe8/0x140 [ 152.691641][T10654] dump_stack+0x15/0x1b [ 152.691690][T10654] should_fail_ex+0x265/0x280 [ 152.691864][T10654] should_fail+0xb/0x20 [ 152.691937][T10654] should_fail_usercopy+0x1a/0x20 [ 152.691954][T10654] _copy_from_user+0x1c/0xb0 [ 152.691977][T10654] __se_sys_mount+0x10d/0x2e0 [ 152.691998][T10654] ? fput+0x8f/0xc0 [ 152.692029][T10654] ? ksys_write+0x192/0x1a0 [ 152.692063][T10654] __x64_sys_mount+0x67/0x80 [ 152.692083][T10654] x64_sys_call+0x2b4d/0x2ff0 [ 152.692142][T10654] do_syscall_64+0xd2/0x200 [ 152.692164][T10654] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 152.692187][T10654] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 152.692263][T10654] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.692287][T10654] RIP: 0033:0x7fa02246eb69 [ 152.692300][T10654] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 152.692321][T10654] RSP: 002b:00007fa020ad7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 152.692338][T10654] RAX: ffffffffffffffda RBX: 00007fa022695fa0 RCX: 00007fa02246eb69 [ 152.692349][T10654] RDX: 0000200000000080 RSI: 0000200000000000 RDI: 0000000000000000 [ 152.692363][T10654] RBP: 00007fa020ad7090 R08: 0000200000000300 R09: 0000000000000000 [ 152.692442][T10654] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 152.692454][T10654] R13: 0000000000000000 R14: 00007fa022695fa0 R15: 00007ffd02f51d88 [ 152.692472][T10654] [ 152.984744][T10662] siw: device registration error -23 [ 153.060074][T10673] netlink: 'syz.2.2687': attribute type 3 has an invalid length. [ 153.071834][T10673] vlan0: entered allmulticast mode [ 153.076975][T10673] bridge_slave_0: entered allmulticast mode [ 153.184012][T10685] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2693'. [ 153.220422][T10687] siw: device registration error -23 [ 153.314195][T10700] loop5: detected capacity change from 0 to 128 [ 153.374437][T10707] loop2: detected capacity change from 0 to 512 [ 153.381959][T10707] EXT4-fs (loop2): blocks per group (71) and clusters per group (20800) inconsistent [ 153.533296][T10722] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2706'. [ 153.556398][T10725] loop3: detected capacity change from 0 to 1024 [ 153.579641][T10725] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 153.591816][T10725] ext4 filesystem being mounted at /521/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 153.610090][T10725] EXT4-fs error (device loop3): ext4_map_blocks:814: inode #15: block 1: comm syz.3.2707: lblock 1 mapped to illegal pblock 1 (length 7) [ 153.624410][T10725] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 1 with max blocks 7 with error 117 [ 153.637546][T10725] EXT4-fs (loop3): This should not happen!! Data will be lost [ 153.637546][T10725] [ 153.647444][T10725] EXT4-fs error (device loop3): ext4_map_blocks:778: inode #15: block 4: comm syz.3.2707: lblock 4 mapped to illegal pblock 4 (length 1) [ 153.674683][ T3307] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 153.687626][T10731] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2709'. [ 153.697077][T10731] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2709'. [ 153.759206][T10737] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2711'. [ 153.869744][T10748] cgroup: name respecified [ 154.163378][T10745] syz.2.2715 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 154.175137][T10745] CPU: 0 UID: 0 PID: 10745 Comm: syz.2.2715 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 154.175207][T10745] Tainted: [W]=WARN [ 154.175215][T10745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 154.175228][T10745] Call Trace: [ 154.175235][T10745] [ 154.175244][T10745] __dump_stack+0x1d/0x30 [ 154.175267][T10745] dump_stack_lvl+0xe8/0x140 [ 154.175286][T10745] dump_stack+0x15/0x1b [ 154.175300][T10745] dump_header+0x81/0x220 [ 154.175376][T10745] oom_kill_process+0x342/0x400 [ 154.175411][T10745] out_of_memory+0x979/0xb80 [ 154.175508][T10745] try_charge_memcg+0x5e6/0x9e0 [ 154.175536][T10745] charge_memcg+0x51/0xc0 [ 154.175552][T10745] mem_cgroup_swapin_charge_folio+0xcc/0x150 [ 154.175572][T10745] __read_swap_cache_async+0x1df/0x350 [ 154.175659][T10745] swap_cluster_readahead+0x376/0x3e0 [ 154.175724][T10745] swapin_readahead+0xde/0x6f0 [ 154.175771][T10745] ? __filemap_get_folio+0x4f7/0x6b0 [ 154.175803][T10745] ? __rcu_read_unlock+0x34/0x70 [ 154.175827][T10745] ? swap_cache_get_folio+0x77/0x200 [ 154.175875][T10745] do_swap_page+0x301/0x2430 [ 154.175901][T10745] ? css_rstat_updated+0xb7/0x240 [ 154.175929][T10745] ? __pfx_default_wake_function+0x10/0x10 [ 154.175952][T10745] handle_mm_fault+0x9a5/0x2c20 [ 154.176044][T10745] do_user_addr_fault+0x636/0x1090 [ 154.176076][T10745] exc_page_fault+0x62/0xa0 [ 154.176094][T10745] asm_exc_page_fault+0x26/0x30 [ 154.176116][T10745] RIP: 0033:0x7f67409355fe [ 154.176198][T10745] Code: 0c 85 c0 74 e7 48 89 df 48 81 c3 e0 00 00 00 e8 08 c4 ff ff 48 39 eb 75 df 0f 1f 00 8b 05 b6 25 35 00 85 c0 0f 8e a3 fd ff ff 8d 9d fe ff 49 39 c4 73 a0 48 8d 1d 91 09 35 00 83 3d 96 25 35 [ 154.176215][T10745] RSP: 002b:00007fffa9938300 EFLAGS: 00010202 [ 154.176231][T10745] RAX: 0000000000000001 RBX: 00007f6740c87ba0 RCX: 0000000000000000 [ 154.176244][T10745] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000555583ba1808 [ 154.176257][T10745] RBP: 00007f6740c87ba0 R08: 0000000000000000 R09: 7fffffffffffffff [ 154.176271][T10745] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000025c84 [ 154.176284][T10745] R13: 00007f6740c86080 R14: ffffffffffffffff R15: 00007fffa9938410 [ 154.176344][T10745] [ 154.176350][T10745] memory: usage 296280kB, limit 307200kB, failcnt 2526 [ 154.410364][T10745] memory+swap: usage 1884kB, limit 9007199254740988kB, failcnt 0 [ 154.418294][T10745] kmem: usage 1392kB, limit 9007199254740988kB, failcnt 0 [ 154.425457][T10745] Memory cgroup stats for /syz2: [ 154.425861][T10745] cache 131072 [ 154.434815][T10745] rss 28672 [ 154.437919][T10745] shmem 0 [ 154.441521][T10745] mapped_file 65536 [ 154.445409][T10745] dirty 0 [ 154.448997][T10745] writeback 0 [ 154.452271][T10745] workingset_refault_anon 20 [ 154.456846][T10745] workingset_refault_file 65 [ 154.461468][T10745] swap 188416 [ 154.464744][T10745] swapcached 16384 [ 154.469667][T10745] pgpgin 260966 [ 154.473114][T10745] pgpgout 260925 [ 154.476638][T10745] pgfault 275092 [ 154.480189][T10745] pgmajfault 26 [ 154.483648][T10745] inactive_anon 0 [ 154.487321][T10745] active_anon 28672 [ 154.491837][T10745] inactive_file 8192 [ 154.495794][T10745] active_file 131072 [ 154.500295][T10745] unevictable 0 [ 154.503739][T10745] hierarchical_memory_limit 314572800 [ 154.509881][T10745] hierarchical_memsw_limit 9223372036854771712 [ 154.516015][T10745] total_cache 131072 [ 154.519968][T10745] total_rss 28672 [ 154.523587][T10745] total_shmem 0 [ 154.527039][T10745] total_mapped_file 65536 [ 154.532752][T10745] total_dirty 0 [ 154.536265][T10745] total_writeback 0 [ 154.540149][T10745] total_workingset_refault_anon 20 [ 154.545358][T10745] total_workingset_refault_file 65 [ 154.551129][T10745] total_swap 188416 [ 154.554926][T10745] total_swapcached 16384 [ 154.559821][T10745] total_pgpgin 260966 [ 154.563795][T10745] total_pgpgout 260925 [ 154.567847][T10745] total_pgfault 275092 [ 154.572531][T10745] total_pgmajfault 26 [ 154.576576][T10745] total_inactive_anon 0 [ 154.580839][T10745] total_active_anon 28672 [ 154.585389][T10745] total_inactive_file 8192 [ 154.591080][T10745] total_active_file 131072 [ 154.595484][T10745] total_unevictable 0 [ 154.599474][T10745] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.2715,pid=10745,uid=0 [ 154.614799][T10745] Memory cgroup out of memory: Killed process 10745 (syz.2.2715) total-vm:93764kB, anon-rss:944kB, file-rss:22312kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 154.636542][T10755] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2717'. [ 154.671436][T10757] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2718'. [ 154.822989][T10774] sctp: [Deprecated]: syz.3.2726 (pid 10774) Use of int in max_burst socket option. [ 154.822989][T10774] Use struct sctp_assoc_value instead [ 154.979062][T10784] netlink: 'syz.1.2730': attribute type 10 has an invalid length. [ 155.095676][T10781] syzkaller0: entered promiscuous mode [ 155.101452][T10781] syzkaller0: entered allmulticast mode [ 155.140561][T10784] dummy0: left allmulticast mode [ 155.146690][T10784] bridge0: port 3(dummy0) entered disabled state [ 155.177820][T10784] team0: Port device dummy0 added [ 155.254348][ T23] hid (null): invalid report_size -1413666444 [ 155.260591][ T23] hid (null): unknown global tag 0xd [ 155.265959][ T23] hid (null): report_id 2222385494 is invalid [ 155.272088][ T23] hid (null): global environment stack underflow [ 155.278434][ T23] hid (null): unknown global tag 0xf4 [ 155.283876][ T23] hid (null): unknown global tag 0x1c [ 155.289385][ T23] hid (null): unknown global tag 0xe [ 155.294697][ T23] hid (null): unknown global tag 0xc [ 155.300073][ T23] hid (null): unknown global tag 0xd [ 155.305403][ T23] hid (null): unknown global tag 0xe [ 155.310750][ T23] hid (null): unknown global tag 0x9f [ 155.316121][ T23] hid (null): unknown global tag 0xe [ 155.321469][ T23] hid (null): unknown global tag 0xe [ 155.326752][ T23] hid (null): unknown global tag 0xe [ 155.332059][ T23] hid (null): unknown global tag 0xc [ 155.337513][ T23] hid (null): unknown global tag 0xe [ 155.342853][ T23] hid (null): bogus close delimiter [ 155.348036][ T23] hid (null): unknown global tag 0xc [ 155.357333][ T23] hid (null): invalid report_count 32141 [ 155.363109][ T23] hid (null): unknown global tag 0xd [ 155.363136][ T23] hid (null): unknown global tag 0xe [ 155.363172][ T23] hid (null): unknown global tag 0xc [ 155.368119][ T23] hid (null): unknown global tag 0xc [ 155.370634][ T29] kauditd_printk_skb: 491 callbacks suppressed [ 155.370648][ T29] audit: type=1400 audit(1754233215.144:13160): avc: denied { setattr } for pid=10795 comm="syz.1.2733" name="vcsu" dev="devtmpfs" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 155.374114][ T23] hid (null): unknown global tag 0xe [ 155.374151][ T23] hid (null): unknown global tag 0xc [ 155.380125][ T29] audit: type=1326 audit(1754233215.144:13161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10795 comm="syz.1.2733" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc3c382eb69 code=0x0 [ 155.384794][ T23] hid (null): unknown global tag 0xc [ 155.453091][ T23] hid (null): unknown global tag 0xc [ 155.462382][ T23] hid (null): unknown global tag 0xd [ 155.467711][ T23] hid (null): unknown global tag 0x3d [ 155.473150][ T23] hid (null): unknown global tag 0xe [ 155.478475][ T23] hid (null): invalid report_count 52049 [ 155.484136][ T23] hid (null): unknown global tag 0xc [ 155.489603][ T23] hid (null): invalid report_size 1527839594 [ 155.495691][ T23] hid (null): unknown global tag 0xe [ 155.501014][ T23] hid (null): report_id 0 is invalid [ 155.506382][ T23] hid (null): invalid report_count -190267900 [ 155.512550][ T23] hid (null): unknown global tag 0xd [ 155.517932][ T23] hid (null): unknown global tag 0x76 [ 155.523334][ T23] hid (null): unknown global tag 0xd [ 155.528767][ T23] hid (null): report_id 32568 is invalid [ 155.541126][ T23] hid-generic 0006:0098:0009.0005: collection stack underflow [ 155.548676][ T23] hid-generic 0006:0098:0009.0005: item 0 0 0 12 parsing failed [ 155.556703][ T23] hid-generic 0006:0098:0009.0005: probe with driver hid-generic failed with error -22 [ 155.581861][ T29] audit: type=1326 audit(1754233215.354:13162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10800 comm="syz.0.2734" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e2820eb69 code=0x7ffc0000 [ 155.606852][ T29] audit: type=1326 audit(1754233215.354:13163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10800 comm="syz.0.2734" exe="/root/syz-executor" sig=0 arch=c000003e syscall=239 compat=0 ip=0x7f9e2820eb69 code=0x7ffc0000 [ 155.631779][ T29] audit: type=1326 audit(1754233215.354:13164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10800 comm="syz.0.2734" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e2820eb69 code=0x7ffc0000 [ 155.723387][ T29] audit: type=1326 audit(1754233215.474:13165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10802 comm="syz.0.2735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e2820eb69 code=0x7ffc0000 [ 155.747003][ T29] audit: type=1326 audit(1754233215.474:13166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10802 comm="syz.0.2735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e2820eb69 code=0x7ffc0000 [ 155.770574][ T29] audit: type=1326 audit(1754233215.474:13167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10802 comm="syz.0.2735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=22 compat=0 ip=0x7f9e2820eb69 code=0x7ffc0000 [ 155.794112][ T29] audit: type=1326 audit(1754233215.474:13168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10802 comm="syz.0.2735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e2820eb69 code=0x7ffc0000 [ 155.798077][T10805] __nla_validate_parse: 4 callbacks suppressed [ 155.798093][T10805] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2737'. [ 155.817678][ T29] audit: type=1326 audit(1754233215.474:13169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10802 comm="syz.0.2735" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9e2820eb69 code=0x7ffc0000 [ 155.864441][T10808] sctp: [Deprecated]: syz.0.2738 (pid 10808) Use of int in max_burst socket option. [ 155.864441][T10808] Use struct sctp_assoc_value instead [ 155.896028][T10809] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2736'. [ 155.905065][T10809] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2736'. [ 156.005300][T10821] loop3: detected capacity change from 0 to 1024 [ 156.036429][T10821] EXT4-fs: Ignoring removed bh option [ 156.050918][T10821] EXT4-fs (loop3): can't mount with both data=journal and delalloc [ 156.120684][T10825] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2746'. [ 156.205964][T10817] loop2: detected capacity change from 0 to 128 [ 156.210468][T10827] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2747'. [ 156.224609][T10817] syz.2.2742: attempt to access beyond end of device [ 156.224609][T10817] loop2: rw=2049, sector=145, nr_sectors = 89 limit=128 [ 156.253112][T10817] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2742'. [ 156.433566][T10798] lo speed is unknown, defaulting to 1000 [ 156.586725][T10832] lo speed is unknown, defaulting to 1000 [ 156.633213][T10842] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2751'. [ 156.643429][T10842] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2751'. [ 156.726192][T10847] FAULT_INJECTION: forcing a failure. [ 156.726192][T10847] name failslab, interval 1, probability 0, space 0, times 0 [ 156.740382][T10847] CPU: 0 UID: 0 PID: 10847 Comm: syz.5.2753 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 156.740479][T10847] Tainted: [W]=WARN [ 156.740486][T10847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 156.740498][T10847] Call Trace: [ 156.740504][T10847] [ 156.740511][T10847] __dump_stack+0x1d/0x30 [ 156.740533][T10847] dump_stack_lvl+0xe8/0x140 [ 156.740620][T10847] dump_stack+0x15/0x1b [ 156.740702][T10847] should_fail_ex+0x265/0x280 [ 156.740782][T10847] should_failslab+0x8c/0xb0 [ 156.740808][T10847] kmem_cache_alloc_noprof+0x50/0x310 [ 156.740836][T10847] ? skb_clone+0x151/0x1f0 [ 156.740900][T10847] skb_clone+0x151/0x1f0 [ 156.740928][T10847] __netlink_deliver_tap+0x2c9/0x500 [ 156.740967][T10847] netlink_unicast+0x66b/0x690 [ 156.741023][T10847] netlink_sendmsg+0x58b/0x6b0 [ 156.741059][T10847] ? __pfx_netlink_sendmsg+0x10/0x10 [ 156.741094][T10847] __sock_sendmsg+0x145/0x180 [ 156.741190][T10847] ____sys_sendmsg+0x31e/0x4e0 [ 156.741226][T10847] ___sys_sendmsg+0x17b/0x1d0 [ 156.741272][T10847] __x64_sys_sendmsg+0xd4/0x160 [ 156.741412][T10847] x64_sys_call+0x191e/0x2ff0 [ 156.741435][T10847] do_syscall_64+0xd2/0x200 [ 156.741460][T10847] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 156.741518][T10847] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 156.741541][T10847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.741564][T10847] RIP: 0033:0x7fa02246eb69 [ 156.741614][T10847] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 156.741680][T10847] RSP: 002b:00007fa020ad7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 156.741699][T10847] RAX: ffffffffffffffda RBX: 00007fa022695fa0 RCX: 00007fa02246eb69 [ 156.741773][T10847] RDX: 0000000000000010 RSI: 00002000000001c0 RDI: 0000000000000003 [ 156.741786][T10847] RBP: 00007fa020ad7090 R08: 0000000000000000 R09: 0000000000000000 [ 156.741798][T10847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 156.741811][T10847] R13: 0000000000000000 R14: 00007fa022695fa0 R15: 00007ffd02f51d88 [ 156.741857][T10847] [ 156.966601][T10834] lo speed is unknown, defaulting to 1000 [ 157.309865][T10875] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2763'. [ 157.318843][T10875] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2763'. [ 157.666483][T10888] lo speed is unknown, defaulting to 1000 [ 157.711418][T10896] loop3: detected capacity change from 0 to 512 [ 157.726561][T10896] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 157.778738][T10891] syzkaller0: entered promiscuous mode [ 157.784253][T10891] syzkaller0: entered allmulticast mode [ 157.995835][T10908] lo speed is unknown, defaulting to 1000 [ 158.168263][T10916] FAULT_INJECTION: forcing a failure. [ 158.168263][T10916] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 158.181443][T10916] CPU: 1 UID: 0 PID: 10916 Comm: syz.0.2777 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 158.181481][T10916] Tainted: [W]=WARN [ 158.181488][T10916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 158.181503][T10916] Call Trace: [ 158.181510][T10916] [ 158.181543][T10916] __dump_stack+0x1d/0x30 [ 158.181565][T10916] dump_stack_lvl+0xe8/0x140 [ 158.181658][T10916] dump_stack+0x15/0x1b [ 158.181678][T10916] should_fail_ex+0x265/0x280 [ 158.181751][T10916] should_fail+0xb/0x20 [ 158.181777][T10916] should_fail_usercopy+0x1a/0x20 [ 158.181794][T10916] _copy_to_user+0x20/0xa0 [ 158.181821][T10916] simple_read_from_buffer+0xb5/0x130 [ 158.181880][T10916] proc_fail_nth_read+0x10e/0x150 [ 158.181905][T10916] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 158.181929][T10916] vfs_read+0x1a0/0x6f0 [ 158.181953][T10916] ? trace_reschedule_exit+0xd/0xc0 [ 158.182039][T10916] ? ksys_read+0x95/0x1a0 [ 158.182059][T10916] ksys_read+0xda/0x1a0 [ 158.182083][T10916] __x64_sys_read+0x40/0x50 [ 158.182183][T10916] x64_sys_call+0x27bc/0x2ff0 [ 158.182202][T10916] do_syscall_64+0xd2/0x200 [ 158.182225][T10916] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 158.182321][T10916] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 158.182341][T10916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.182362][T10916] RIP: 0033:0x7f9e2820d57c [ 158.182376][T10916] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 158.182392][T10916] RSP: 002b:00007f9e26877030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 158.182408][T10916] RAX: ffffffffffffffda RBX: 00007f9e28435fa0 RCX: 00007f9e2820d57c [ 158.182428][T10916] RDX: 000000000000000f RSI: 00007f9e268770a0 RDI: 0000000000000004 [ 158.182442][T10916] RBP: 00007f9e26877090 R08: 0000000000000000 R09: 0000000000000000 [ 158.182456][T10916] R10: 0000200000000280 R11: 0000000000000246 R12: 0000000000000001 [ 158.182523][T10916] R13: 0000000000000000 R14: 00007f9e28435fa0 R15: 00007ffff54a13d8 [ 158.182543][T10916] [ 158.646095][T10920] sctp: [Deprecated]: syz.5.2779 (pid 10920) Use of int in max_burst socket option. [ 158.646095][T10920] Use struct sctp_assoc_value instead [ 158.858190][T10933] loop5: detected capacity change from 0 to 512 [ 158.958882][T10931] lo speed is unknown, defaulting to 1000 [ 158.973776][T10931] lo speed is unknown, defaulting to 1000 [ 158.988762][T10931] lo speed is unknown, defaulting to 1000 [ 159.104486][T10931] infiniband sz1: set down [ 159.109053][T10931] infiniband sz1: added lo [ 159.114463][ T3388] lo speed is unknown, defaulting to 1000 [ 159.244225][T10931] RDS/IB: sz1: added [ 159.257911][T10931] smc: adding ib device sz1 with port count 1 [ 159.278202][T10931] smc: ib device sz1 port 1 has pnetid [ 159.284965][ T3388] lo speed is unknown, defaulting to 1000 [ 159.306473][T10931] lo speed is unknown, defaulting to 1000 [ 159.349154][T10918] lo speed is unknown, defaulting to 1000 [ 159.402983][T10918] lo speed is unknown, defaulting to 1000 [ 159.476328][T10931] lo speed is unknown, defaulting to 1000 [ 159.585782][T10931] lo speed is unknown, defaulting to 1000 [ 159.720406][T10918] chnl_net:caif_netlink_parms(): no params data found [ 159.777118][T10953] loop5: detected capacity change from 0 to 512 [ 159.783745][T10931] lo speed is unknown, defaulting to 1000 [ 159.820685][T10953] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 159.857420][T10953] ext4 filesystem being mounted at /29/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 159.890588][T10918] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.897717][T10918] bridge0: port 1(bridge_slave_0) entered disabled state [ 159.911597][T10918] bridge_slave_0: entered allmulticast mode [ 159.918155][T10918] bridge_slave_0: entered promiscuous mode [ 159.937347][T10918] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.944454][T10918] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.971887][T10918] bridge_slave_1: entered allmulticast mode [ 159.978013][T10953] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 159.983227][T10918] bridge_slave_1: entered promiscuous mode [ 159.992795][T10953] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 1 with max blocks 1029 with error 28 [ 159.992823][T10953] EXT4-fs (loop5): This should not happen!! Data will be lost [ 159.992823][T10953] [ 159.992838][T10953] EXT4-fs (loop5): Total free blocks count 0 [ 159.992889][T10953] EXT4-fs (loop5): Free/Dirty block details [ 159.992901][T10953] EXT4-fs (loop5): free_blocks=65280 [ 159.992915][T10953] EXT4-fs (loop5): dirty_blocks=1029 [ 159.992926][T10953] EXT4-fs (loop5): Block reservation details [ 159.992938][T10953] EXT4-fs (loop5): i_reserved_data_blocks=1029 [ 160.063018][ T7899] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.074110][T10931] lo speed is unknown, defaulting to 1000 [ 160.108887][T10918] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 160.119917][T10431] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 160.125830][T10931] lo speed is unknown, defaulting to 1000 [ 160.137971][T10918] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 160.148435][ T7899] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.189497][T10918] team0: Port device team_slave_0 added [ 160.201468][T10918] team0: Port device team_slave_1 added [ 160.222413][ T7899] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.223778][T10918] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 160.223791][T10918] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 160.223816][T10918] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 160.224633][T10918] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 160.224645][T10918] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 160.224674][T10918] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 160.254231][T10918] hsr_slave_0: entered promiscuous mode [ 160.340260][T10918] hsr_slave_1: entered promiscuous mode [ 160.340579][T10918] debugfs: 'hsr0' already exists in 'hsr' [ 160.352107][T10918] Cannot create hsr debugfs directory [ 160.361663][ T7899] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.570355][ T7899] bond0 (unregistering): Released all slaves [ 160.614761][ T7899] tipc: Left network mode [ 160.764891][ T7899] hsr_slave_0: left promiscuous mode [ 160.773515][ T7899] hsr_slave_1: left promiscuous mode [ 160.779197][ T7899] veth1_macvtap: left promiscuous mode [ 160.779219][ T7899] veth0_macvtap: left promiscuous mode [ 160.779321][ T7899] veth1_vlan: left promiscuous mode [ 160.779423][ T7899] veth0_vlan: left promiscuous mode [ 160.888787][ T7904] smc: removing ib device syz1 [ 160.912341][ T23] syz1: Port: 1 Link DOWN [ 160.918026][ T36] lo speed is unknown, defaulting to 1000 [ 160.923776][ T36] infiniband syz0: ib_query_port failed (-19) [ 160.942329][T10918] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 160.951709][T10918] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 160.961675][T10918] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 160.973435][T10918] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 161.042015][T10989] vlan2: entered allmulticast mode [ 161.042031][T10989] dummy0: entered allmulticast mode [ 161.062949][T10991] __nla_validate_parse: 4 callbacks suppressed [ 161.062964][T10991] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2796'. [ 161.100608][T10995] sctp: [Deprecated]: syz.1.2799 (pid 10995) Use of int in max_burst socket option. [ 161.100608][T10995] Use struct sctp_assoc_value instead [ 161.132531][T10918] 8021q: adding VLAN 0 to HW filter on device bond0 [ 161.143732][T10918] 8021q: adding VLAN 0 to HW filter on device team0 [ 161.146010][ T7914] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.146039][ T7914] bridge0: port 1(bridge_slave_0) entered forwarding state [ 161.147719][T10995] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2799'. [ 161.172355][ T6007] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.172391][ T6007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 161.186074][T10998] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2800'. [ 161.214897][T10918] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 161.214919][T10918] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 161.249635][T11005] loop2: detected capacity change from 0 to 512 [ 161.254094][ T7899] ------------[ cut here ]------------ [ 161.254105][ T7899] WARNING: CPU: 1 PID: 7899 at net/xfrm/xfrm_state.c:3303 xfrm_state_fini+0x17c/0x1f0 [ 161.254156][ T7899] Modules linked in: [ 161.254174][ T7899] CPU: 1 UID: 0 PID: 7899 Comm: kworker/u8:46 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 161.254209][ T7899] Tainted: [W]=WARN [ 161.254217][ T7899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 161.254232][ T7899] Workqueue: netns cleanup_net [ 161.254273][ T7899] RIP: 0010:xfrm_state_fini+0x17c/0x1f0 [ 161.254296][ T7899] Code: 48 8d bb 30 0e 00 00 e8 42 52 bd fc 48 8b bb 30 0e 00 00 e8 d6 d0 c9 fc 5b 41 5e 41 5f 5d c3 cc cc cc cc cc e8 75 9f a2 fc 90 <0f> 0b 90 e9 d9 fe ff ff e8 67 9f a2 fc 90 0f 0b 90 4c 89 f7 e8 0b [ 161.254315][ T7899] RSP: 0018:ffffc90001393c60 EFLAGS: 00010293 [ 161.254375][ T7899] RAX: ffffffff84b5572b RBX: ffff888109fa17c0 RCX: ffff8881023d9080 [ 161.254388][ T7899] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888109fa25c0 [ 161.254412][ T7899] RBP: ffffffff86c8a2e0 R08: 0001ffff86847f7f R09: 0000000000000000 [ 161.254426][ T7899] R10: ffffc90001393be8 R11: 0001c90001393be8 R12: ffffffff86c8a300 [ 161.254439][ T7899] R13: ffff888109fa17e8 R14: ffff888109fa25c0 R15: ffff888109fa17c0 [ 161.254453][ T7899] FS: 0000000000000000(0000) GS:ffff8882aef49000(0000) knlGS:0000000000000000 [ 161.254471][ T7899] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 161.254511][ T7899] CR2: 00007f6740a41fa0 CR3: 000000014660a000 CR4: 00000000003506f0 [ 161.254525][ T7899] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 161.254536][ T7899] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 161.254605][ T7899] Call Trace: [ 161.254611][ T7899] [ 161.254619][ T7899] xfrm_net_exit+0x2d/0x60 [ 161.254645][ T7899] ops_undo_list+0x278/0x410 [ 161.254674][ T7899] cleanup_net+0x2de/0x4d0 [ 161.254702][ T7899] process_scheduled_works+0x4ce/0x9d0 [ 161.254748][ T7899] worker_thread+0x582/0x770 [ 161.254784][ T7899] kthread+0x489/0x510 [ 161.254806][ T7899] ? __pfx_worker_thread+0x10/0x10 [ 161.254859][ T7899] ? __pfx_kthread+0x10/0x10 [ 161.254881][ T7899] ret_from_fork+0xdd/0x150 [ 161.254903][ T7899] ? __pfx_kthread+0x10/0x10 [ 161.254959][ T7899] ret_from_fork_asm+0x1a/0x30 [ 161.254988][ T7899] [ 161.254995][ T7899] ---[ end trace 0000000000000000 ]--- [ 161.275939][ T29] kauditd_printk_skb: 8527 callbacks suppressed [ 161.275955][ T29] audit: type=1326 audit(1754233221.034:21697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11002 comm="syz.2.2803" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x0 [ 161.284957][T10918] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 161.431894][ T29] audit: type=1326 audit(1754233221.204:21698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11002 comm="syz.2.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 161.507144][T10918] veth0_vlan: entered promiscuous mode [ 161.508863][ T29] audit: type=1326 audit(1754233221.214:21699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11002 comm="syz.2.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 161.516930][T10918] veth1_vlan: entered promiscuous mode [ 161.518154][ T29] audit: type=1326 audit(1754233221.214:21700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11002 comm="syz.2.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=141 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 161.534197][T10918] veth0_macvtap: entered promiscuous mode [ 161.555880][ T29] audit: type=1326 audit(1754233221.214:21701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11002 comm="syz.2.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 161.555909][ T29] audit: type=1326 audit(1754233221.214:21702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11002 comm="syz.2.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 161.555933][ T29] audit: type=1326 audit(1754233221.214:21703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11002 comm="syz.2.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 161.567956][T10918] veth1_macvtap: entered promiscuous mode [ 161.586269][ T29] audit: type=1326 audit(1754233221.214:21704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11002 comm="syz.2.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 161.600394][T10918] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 161.615319][ T29] audit: type=1326 audit(1754233221.214:21705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11002 comm="syz.2.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 161.615348][ T29] audit: type=1326 audit(1754233221.214:21706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11002 comm="syz.2.2803" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f6740a5eb69 code=0x7ffc0000 [ 161.815774][T10918] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 161.828879][ T6007] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.828971][ T6007] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.829005][ T6007] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.829035][ T6007] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.915899][T11032] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2807'. [ 161.966824][T11041] sctp: [Deprecated]: syz.0.2811 (pid 11041) Use of int in max_burst socket option. [ 161.966824][T11041] Use struct sctp_assoc_value instead [ 161.998288][T11041] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2811'. [ 162.010147][T11044] netlink: 80 bytes leftover after parsing attributes in process `syz.1.2812'. [ 162.050747][T11046] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 162.090895][T11051] loop2: detected capacity change from 0 to 2048 [ 162.102804][T11051] EXT4-fs: dax option not supported [ 162.194353][T11058] lo speed is unknown, defaulting to 1000 [ 162.544567][T11063] lo speed is unknown, defaulting to 1000 [ 162.804171][T11069] loop2: detected capacity change from 0 to 512 [ 162.830518][T11074] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2820'. [ 162.871958][T11076] netlink: 300 bytes leftover after parsing attributes in process `syz.3.2821'. [ 162.888200][T11060] Set syz1 is full, maxelem 65536 reached [ 162.904512][T11069] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 162.931034][T11078] lo speed is unknown, defaulting to 1000 [ 162.938974][T11081] FAULT_INJECTION: forcing a failure. [ 162.938974][T11081] name failslab, interval 1, probability 0, space 0, times 0 [ 162.940098][T11078] lo speed is unknown, defaulting to 1000 [ 162.952345][T11081] CPU: 0 UID: 0 PID: 11081 Comm: syz.1.2823 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 162.952380][T11081] Tainted: [W]=WARN [ 162.952386][T11081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 162.952399][T11081] Call Trace: [ 162.952405][T11081] [ 162.952414][T11081] __dump_stack+0x1d/0x30 [ 162.952435][T11081] dump_stack_lvl+0xe8/0x140 [ 162.952504][T11081] dump_stack+0x15/0x1b [ 162.952520][T11081] should_fail_ex+0x265/0x280 [ 162.952600][T11081] should_failslab+0x8c/0xb0 [ 162.952625][T11081] __kmalloc_node_track_caller_noprof+0xa4/0x410 [ 162.952657][T11081] ? sidtab_sid2str_get+0xa0/0x130 [ 162.952721][T11081] kmemdup_noprof+0x2b/0x70 [ 162.952747][T11081] sidtab_sid2str_get+0xa0/0x130 [ 162.952781][T11081] security_sid_to_context_core+0x1eb/0x2e0 [ 162.952827][T11081] security_sid_to_context+0x27/0x40 [ 162.952917][T11081] selinux_lsmprop_to_secctx+0x67/0xf0 [ 162.952950][T11081] security_lsmprop_to_secctx+0x43/0x80 [ 162.953018][T11081] audit_log_task_context+0x77/0x190 [ 162.953089][T11081] audit_log_task+0xf4/0x250 [ 162.953117][T11081] audit_seccomp+0x61/0x100 [ 162.953142][T11081] ? __seccomp_filter+0x68c/0x10d0 [ 162.953200][T11081] __seccomp_filter+0x69d/0x10d0 [ 162.953222][T11081] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 162.953249][T11081] ? vfs_write+0x75e/0x8e0 [ 162.953293][T11081] __secure_computing+0x82/0x150 [ 162.953314][T11081] syscall_trace_enter+0xcf/0x1e0 [ 162.953370][T11081] do_syscall_64+0xac/0x200 [ 162.953394][T11081] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 162.953418][T11081] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 162.953486][T11081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.953508][T11081] RIP: 0033:0x7fc3c382eb69 [ 162.953524][T11081] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 162.953542][T11081] RSP: 002b:00007fc3c1e97038 EFLAGS: 00000246 ORIG_RAX: 000000000000009e [ 162.953561][T11081] RAX: ffffffffffffffda RBX: 00007fc3c3a55fa0 RCX: 00007fc3c382eb69 [ 162.953574][T11081] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000005003 [ 162.953586][T11081] RBP: 00007fc3c1e97090 R08: 0000000000000000 R09: 0000000000000000 [ 162.953627][T11081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 162.953639][T11081] R13: 0000000000000000 R14: 00007fc3c3a55fa0 R15: 00007ffe8a64c388 [ 162.953657][T11081] [ 163.050979][T11084] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2821'. [ 163.051399][T11078] lo speed is unknown, defaulting to 1000 [ 163.205637][T11088] ALSA: seq fatal error: cannot create timer (-19) [ 163.210463][T11078] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 163.241035][T11078] lo speed is unknown, defaulting to 1000 [ 163.247220][T11078] lo speed is unknown, defaulting to 1000 [ 163.253635][T11078] lo speed is unknown, defaulting to 1000 [ 163.260611][T11078] lo speed is unknown, defaulting to 1000 [ 163.267079][T11078] lo speed is unknown, defaulting to 1000 [ 163.280997][T11078] lo speed is unknown, defaulting to 1000 [ 163.375930][ T3300] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 163.482073][T11105] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2832'. [ 163.601436][T11116] loop2: detected capacity change from 0 to 128 [ 163.610371][T11116] FAT-fs (loop2): Directory bread(block 162) failed [ 163.617188][T11116] FAT-fs (loop2): Directory bread(block 163) failed [ 163.618767][T11114] lo speed is unknown, defaulting to 1000 [ 163.624702][T11116] FAT-fs (loop2): Directory bread(block 164) failed [ 163.639978][T11116] FAT-fs (loop2): Directory bread(block 165) failed [ 163.646691][T11116] FAT-fs (loop2): Directory bread(block 166) failed [ 163.655337][T11116] FAT-fs (loop2): Directory bread(block 167) failed [ 163.656462][T11114] lo speed is unknown, defaulting to 1000 [ 163.662898][T11116] FAT-fs (loop2): Directory bread(block 168) failed [ 163.675469][T11116] FAT-fs (loop2): Directory bread(block 169) failed [ 163.702784][T11116] FAT-fs (loop2): Directory bread(block 162) failed [ 163.716337][T11116] FAT-fs (loop2): Directory bread(block 163) failed [ 163.716523][T11120] siw: device registration error -23 [ 163.723368][T11116] syz.2.2836: attempt to access beyond end of device [ 163.723368][T11116] loop2: rw=3, sector=226, nr_sectors = 6 limit=128 [ 163.743058][T11116] syz.2.2836: attempt to access beyond end of device [ 163.743058][T11116] loop2: rw=2051, sector=232, nr_sectors = 2 limit=128 [ 163.801059][T11126] sctp: [Deprecated]: syz.2.2840 (pid 11126) Use of int in max_burst socket option. [ 163.801059][T11126] Use struct sctp_assoc_value instead [ 163.828021][T11128] FAULT_INJECTION: forcing a failure. [ 163.828021][T11128] name failslab, interval 1, probability 0, space 0, times 0 [ 163.841978][T11128] CPU: 0 UID: 0 PID: 11128 Comm: syz.0.2842 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 163.842008][T11128] Tainted: [W]=WARN [ 163.842013][T11128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 163.842023][T11128] Call Trace: [ 163.842028][T11128] [ 163.842035][T11128] __dump_stack+0x1d/0x30 [ 163.842057][T11128] dump_stack_lvl+0xe8/0x140 [ 163.842075][T11128] dump_stack+0x15/0x1b [ 163.842089][T11128] should_fail_ex+0x265/0x280 [ 163.842116][T11128] should_failslab+0x8c/0xb0 [ 163.842139][T11128] kmem_cache_alloc_noprof+0x50/0x310 [ 163.842167][T11128] ? vm_area_dup+0x33/0x2c0 [ 163.842199][T11128] vm_area_dup+0x33/0x2c0 [ 163.842227][T11128] __split_vma+0xe9/0x650 [ 163.842247][T11128] ? obj_cgroup_charge_account+0x122/0x1a0 [ 163.842279][T11128] ? should_fail_ex+0x30/0x280 [ 163.842309][T11128] vms_gather_munmap_vmas+0x172/0x7a0 [ 163.842330][T11128] ? mas_find+0x608/0x700 [ 163.842354][T11128] mmap_region+0x53f/0x1630 [ 163.842377][T11128] ? mntput_no_expire+0x6f/0x460 [ 163.842405][T11128] ? mntput+0x4b/0x80 [ 163.842440][T11128] do_mmap+0x9b3/0xbe0 [ 163.842476][T11128] vm_mmap_pgoff+0x17a/0x2e0 [ 163.842506][T11128] ksys_mmap_pgoff+0x268/0x310 [ 163.842534][T11128] x64_sys_call+0x14a3/0x2ff0 [ 163.842551][T11128] do_syscall_64+0xd2/0x200 [ 163.842570][T11128] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 163.842594][T11128] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 163.842616][T11128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.842638][T11128] RIP: 0033:0x7f7609f7eb69 [ 163.842653][T11128] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 163.842671][T11128] RSP: 002b:00007f76085df038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 163.842687][T11128] RAX: ffffffffffffffda RBX: 00007f760a1a5fa0 RCX: 00007f7609f7eb69 [ 163.842715][T11128] RDX: 0000000000000000 RSI: 0000000000004000 RDI: 0000200000ffc000 [ 163.842727][T11128] RBP: 00007f76085df090 R08: 0000000000000004 R09: 0000000000000000 [ 163.842740][T11128] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000001 [ 163.842751][T11128] R13: 0000000000000000 R14: 00007f760a1a5fa0 R15: 00007ffedeb4be78 [ 163.842766][T11128] [ 164.234409][T11148] lo speed is unknown, defaulting to 1000 [ 164.274420][T11148] lo speed is unknown, defaulting to 1000 [ 164.277514][T11159] sctp: [Deprecated]: syz.1.2853 (pid 11159) Use of int in max_burst socket option. [ 164.277514][T11159] Use struct sctp_assoc_value instead [ 164.296603][T11151] siw: device registration error -23 [ 164.409062][T11169] loop3: detected capacity change from 0 to 2048 [ 164.459634][T11169] EXT4-fs (loop3): failed to initialize system zone (-117) [ 164.469387][T11169] EXT4-fs (loop3): mount failed [ 164.568138][T11169] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11169 comm=syz.3.2855 [ 164.694638][T11198] loop5: detected capacity change from 0 to 512 [ 164.938377][T11207] sctp: [Deprecated]: syz.3.2866 (pid 11207) Use of int in max_burst socket option. [ 164.938377][T11207] Use struct sctp_assoc_value instead [ 165.253068][T11210] lo speed is unknown, defaulting to 1000 [ 165.444055][T11216] syzkaller0: entered promiscuous mode [ 165.468386][T11216] syzkaller0: entered allmulticast mode [ 165.529664][T11210] lo speed is unknown, defaulting to 1000 [ 165.644505][T11235] siw: device registration error -23 [ 165.785160][T11242] lo speed is unknown, defaulting to 1000 [ 165.830265][T11242] lo speed is unknown, defaulting to 1000 [ 165.854537][T11250] lo speed is unknown, defaulting to 1000 [ 165.908004][T11250] lo speed is unknown, defaulting to 1000 [ 165.911007][T11257] sctp: [Deprecated]: syz.5.2882 (pid 11257) Use of int in max_burst socket option. [ 165.911007][T11257] Use struct sctp_assoc_value instead [ 165.946703][T11259] netlink: 'syz.5.2883': attribute type 1 has an invalid length. [ 166.117702][T11271] __nla_validate_parse: 6 callbacks suppressed [ 166.117718][T11271] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2888'. [ 166.133086][T11271] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2888'. [ 166.142176][T11263] lo speed is unknown, defaulting to 1000 [ 166.164563][T11273] IPVS: set_ctl: invalid protocol: 255 10.1.1.0:20003 [ 166.177955][T11273] dummy0: entered promiscuous mode [ 166.224817][T11277] loop0: detected capacity change from 0 to 256 [ 166.233813][T11277] vfat: Unknown parameter 'shor†name' [ 166.240936][T11263] lo speed is unknown, defaulting to 1000 [ 166.366742][ T29] kauditd_printk_skb: 429 callbacks suppressed [ 166.366756][ T29] audit: type=1326 audit(1754233226.134:22135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11276 comm="syz.0.2891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 166.404438][ T29] audit: type=1326 audit(1754233226.154:22136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11276 comm="syz.0.2891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=442 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 166.404614][T11277] FAULT_INJECTION: forcing a failure. [ 166.404614][T11277] name failslab, interval 1, probability 0, space 0, times 0 [ 166.429295][ T29] audit: type=1326 audit(1754233226.154:22137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11276 comm="syz.0.2891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 166.440803][T11277] CPU: 1 UID: 0 PID: 11277 Comm: syz.0.2891 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 166.440837][T11277] Tainted: [W]=WARN [ 166.440843][T11277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 166.440854][T11277] Call Trace: [ 166.440860][T11277] [ 166.440867][T11277] __dump_stack+0x1d/0x30 [ 166.440905][T11277] dump_stack_lvl+0xe8/0x140 [ 166.440925][T11277] dump_stack+0x15/0x1b [ 166.440942][T11277] should_fail_ex+0x265/0x280 [ 166.440974][T11277] should_failslab+0x8c/0xb0 [ 166.440999][T11277] __kmalloc_noprof+0xa5/0x3e0 [ 166.441089][T11277] ? memcg_list_lru_alloc+0x195/0x490 [ 166.441156][T11277] memcg_list_lru_alloc+0x195/0x490 [ 166.441180][T11277] __memcg_slab_post_alloc_hook+0x1a7/0x580 [ 166.441226][T11277] kmem_cache_alloc_lru_noprof+0x229/0x310 [ 166.441253][T11277] ? __d_alloc+0x3d/0x340 [ 166.441305][T11277] __d_alloc+0x3d/0x340 [ 166.441333][T11277] d_alloc_pseudo+0x1e/0x80 [ 166.441361][T11277] alloc_file_pseudo+0x71/0x160 [ 166.441484][T11277] __se_sys_memfd_secret+0x14b/0x230 [ 166.441516][T11277] __x64_sys_memfd_secret+0x1f/0x30 [ 166.441548][T11277] x64_sys_call+0x2c81/0x2ff0 [ 166.441569][T11277] do_syscall_64+0xd2/0x200 [ 166.441690][T11277] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 166.441714][T11277] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 166.441782][T11277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.441804][T11277] RIP: 0033:0x7f7609f7eb69 [ 166.441819][T11277] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 166.441850][T11277] RSP: 002b:00007f76085df038 EFLAGS: 00000246 ORIG_RAX: 00000000000001bf [ 166.441869][T11277] RAX: ffffffffffffffda RBX: 00007f760a1a5fa0 RCX: 00007f7609f7eb69 [ 166.441881][T11277] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 166.441894][T11277] RBP: 00007f76085df090 R08: 0000000000000000 R09: 0000000000000000 [ 166.441981][T11277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 166.442032][T11277] R13: 0000000000000000 R14: 00007f760a1a5fa0 R15: 00007ffedeb4be78 [ 166.442050][T11277] [ 166.687539][ T29] audit: type=1326 audit(1754233226.154:22138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11276 comm="syz.0.2891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 166.712120][ T29] audit: type=1326 audit(1754233226.154:22139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11276 comm="syz.0.2891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 166.712147][ T29] audit: type=1326 audit(1754233226.154:22140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11276 comm="syz.0.2891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 166.760723][ T29] audit: type=1326 audit(1754233226.154:22141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11276 comm="syz.0.2891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 166.784811][ T29] audit: type=1326 audit(1754233226.154:22142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11276 comm="syz.0.2891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 166.809524][ T29] audit: type=1326 audit(1754233226.154:22143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11276 comm="syz.0.2891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 166.833498][ T29] audit: type=1326 audit(1754233226.154:22144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11276 comm="syz.0.2891" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 166.920508][T11300] sg_read: process 1432 (syz.1.2900) changed security contexts after opening file descriptor, this is not allowed. [ 166.924017][T11298] siw: device registration error -23 [ 167.026415][T11288] syzkaller0: entered promiscuous mode [ 167.041983][T11288] syzkaller0: entered allmulticast mode [ 167.105179][T11315] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2905'. [ 167.240457][T11318] IPv6: sit1: Disabled Multicast RS [ 167.304330][T11330] siw: device registration error -23 [ 167.355446][T11341] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2917'. [ 167.399792][T11350] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 167.399792][T11350] program syz.0.2918 not setting count and/or reply_len properly [ 167.420294][T11352] lo speed is unknown, defaulting to 1000 [ 167.426143][T11352] lo speed is unknown, defaulting to 1000 [ 167.433600][T11352] lo speed is unknown, defaulting to 1000 [ 167.440330][T11352] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 167.455136][T11352] lo speed is unknown, defaulting to 1000 [ 167.456621][T11358] loop5: detected capacity change from 0 to 256 [ 167.475479][T11352] lo speed is unknown, defaulting to 1000 [ 167.484516][T11358] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 167.496512][T11364] loop2: detected capacity change from 0 to 512 [ 167.498751][T11352] lo speed is unknown, defaulting to 1000 [ 167.510148][T11352] lo speed is unknown, defaulting to 1000 [ 167.516171][T11352] lo speed is unknown, defaulting to 1000 [ 167.523981][T11364] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 167.537313][T11364] ext4 filesystem being mounted at /543/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 167.555516][T11337] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.2916: bg 0: block 217: padding at end of block bitmap is not set [ 167.583243][ T3300] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 167.639604][T11371] syzkaller0: entered promiscuous mode [ 167.645393][T11371] syzkaller0: entered allmulticast mode [ 167.768425][T11388] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2929'. [ 167.806485][T11392] loop5: detected capacity change from 0 to 512 [ 167.814553][T11392] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 167.824612][T11394] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2932'. [ 167.835205][T11392] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 167.869315][T11392] EXT4-fs (loop5): 1 truncate cleaned up [ 167.882331][T11392] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 167.897181][T11397] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2932'. [ 167.972373][T10431] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 167.994017][T11405] netlink: 'syz.5.2936': attribute type 7 has an invalid length. [ 168.007308][T11408] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 168.024117][ T10] lo speed is unknown, defaulting to 1000 [ 168.274739][T11420] syzkaller0: entered promiscuous mode [ 168.284684][T11420] syzkaller0: entered allmulticast mode [ 168.351573][T11430] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2944'. [ 168.360537][T11430] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2944'. [ 168.411884][T11436] sctp: [Deprecated]: syz.0.2947 (pid 11436) Use of int in max_burst socket option. [ 168.411884][T11436] Use struct sctp_assoc_value instead [ 168.430608][T11436] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2947'. [ 168.779820][T11401] 9pnet_fd: p9_fd_create_tcp (11401): problem connecting socket to 127.0.0.1 [ 169.359359][T11478] 9pnet_fd: Insufficient options for proto=fd [ 169.380267][T11489] sch_fq: defrate 4294967295 ignored. [ 169.400686][T11492] FAULT_INJECTION: forcing a failure. [ 169.400686][T11492] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 169.413935][T11492] CPU: 1 UID: 0 PID: 11492 Comm: syz.5.2966 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 169.414016][T11492] Tainted: [W]=WARN [ 169.414022][T11492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 169.414034][T11492] Call Trace: [ 169.414040][T11492] [ 169.414047][T11492] __dump_stack+0x1d/0x30 [ 169.414066][T11492] dump_stack_lvl+0xe8/0x140 [ 169.414083][T11492] dump_stack+0x15/0x1b [ 169.414100][T11492] should_fail_ex+0x265/0x280 [ 169.414224][T11492] should_fail+0xb/0x20 [ 169.414252][T11492] should_fail_usercopy+0x1a/0x20 [ 169.414272][T11492] _copy_to_user+0x20/0xa0 [ 169.414343][T11492] simple_read_from_buffer+0xb5/0x130 [ 169.414357][T11492] proc_fail_nth_read+0x10e/0x150 [ 169.414372][T11492] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 169.414387][T11492] vfs_read+0x1a0/0x6f0 [ 169.414452][T11492] ? __rcu_read_unlock+0x4f/0x70 [ 169.414464][T11492] ? __fget_files+0x184/0x1c0 [ 169.414490][T11492] ksys_read+0xda/0x1a0 [ 169.414502][T11492] __x64_sys_read+0x40/0x50 [ 169.414514][T11492] x64_sys_call+0x27bc/0x2ff0 [ 169.414576][T11492] do_syscall_64+0xd2/0x200 [ 169.414596][T11492] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 169.414610][T11492] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 169.414622][T11492] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.414634][T11492] RIP: 0033:0x7fa02246d57c [ 169.414643][T11492] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 169.414715][T11492] RSP: 002b:00007fa020ad7030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 169.414726][T11492] RAX: ffffffffffffffda RBX: 00007fa022695fa0 RCX: 00007fa02246d57c [ 169.414734][T11492] RDX: 000000000000000f RSI: 00007fa020ad70a0 RDI: 0000000000000003 [ 169.414741][T11492] RBP: 00007fa020ad7090 R08: 0000000000000000 R09: 0000000000000000 [ 169.414748][T11492] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 169.414790][T11492] R13: 0000000000000001 R14: 00007fa022695fa0 R15: 00007ffd02f51d88 [ 169.414827][T11492] [ 169.744651][T11501] lo speed is unknown, defaulting to 1000 [ 169.762134][T11504] SELinux: Context system_u:object_r:systemd_passwd_var_run_t:s0 is not valid (left unmapped). [ 169.777588][T11501] lo speed is unknown, defaulting to 1000 [ 169.785183][T11501] lo speed is unknown, defaulting to 1000 [ 170.044916][T11512] lo speed is unknown, defaulting to 1000 [ 170.083103][T11512] lo speed is unknown, defaulting to 1000 [ 170.091202][T11512] lo speed is unknown, defaulting to 1000 [ 170.122268][ T6007] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.183193][ T6007] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.212233][T11512] chnl_net:caif_netlink_parms(): no params data found [ 170.233444][ T6007] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.284273][T11512] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.291380][T11512] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.312900][T11512] bridge_slave_0: entered allmulticast mode [ 170.320593][T11512] bridge_slave_0: entered promiscuous mode [ 170.327825][T11512] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.335508][T11512] bridge0: port 2(bridge_slave_1) entered disabled state [ 170.368468][T11512] bridge_slave_1: entered allmulticast mode [ 170.382767][T11512] bridge_slave_1: entered promiscuous mode [ 170.398731][ T6007] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.437993][T11512] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 170.449208][T11512] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 170.502933][T11512] team0: Port device team_slave_0 added [ 170.518845][T11512] team0: Port device team_slave_1 added [ 170.540898][T11539] loop2: detected capacity change from 0 to 2048 [ 170.560127][T11512] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 170.567130][T11512] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 170.593668][T11512] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 170.619551][T11539] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 170.630613][T11512] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 170.638524][T11512] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 170.665126][T11512] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 170.675909][T11539] ext4 filesystem being mounted at /555/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 170.712178][ T6007] bridge_slave_1: left allmulticast mode [ 170.717827][ T6007] bridge_slave_1: left promiscuous mode [ 170.723939][ T6007] bridge0: port 2(bridge_slave_1) entered disabled state [ 170.732423][ T6007] bridge_slave_0: left allmulticast mode [ 170.738056][ T6007] bridge_slave_0: left promiscuous mode [ 170.744131][ T6007] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.791273][ T6007] team0: Port device geneve1 removed [ 170.840582][ T6007] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 170.850716][ T6007] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 170.860344][ T6007] bond0 (unregistering): Released all slaves [ 170.867764][T11552] FAULT_INJECTION: forcing a failure. [ 170.867764][T11552] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 170.881563][T11552] CPU: 1 UID: 0 PID: 11552 Comm: syz.0.2982 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 170.881649][T11552] Tainted: [W]=WARN [ 170.881654][T11552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 170.881665][T11552] Call Trace: [ 170.881672][T11552] [ 170.881679][T11552] __dump_stack+0x1d/0x30 [ 170.881700][T11552] dump_stack_lvl+0xe8/0x140 [ 170.881721][T11552] dump_stack+0x15/0x1b [ 170.881740][T11552] should_fail_ex+0x265/0x280 [ 170.881856][T11552] should_fail_alloc_page+0xf2/0x100 [ 170.881882][T11552] __alloc_frozen_pages_noprof+0xff/0x360 [ 170.881971][T11552] alloc_pages_mpol+0xb3/0x250 [ 170.882018][T11552] alloc_pages_noprof+0x90/0x130 [ 170.882105][T11552] get_free_pages_noprof+0xc/0x40 [ 170.882203][T11552] selinux_genfs_get_sid+0x33/0x180 [ 170.882228][T11552] inode_doinit_with_dentry+0x5fe/0x7a0 [ 170.882278][T11552] selinux_d_instantiate+0x27/0x40 [ 170.882304][T11552] security_d_instantiate+0x7a/0xa0 [ 170.882404][T11552] d_instantiate+0x3f/0x80 [ 170.882436][T11552] __debugfs_create_file+0x1c1/0x330 [ 170.882464][T11552] debugfs_create_file_full+0x3f/0x60 [ 170.882488][T11552] ? __pfx_batadv_meshif_init_early+0x10/0x10 [ 170.882572][T11552] ref_tracker_dir_debugfs+0x100/0x1e0 [ 170.882617][T11552] alloc_netdev_mqs+0x1a2/0xa20 [ 170.882685][T11552] rtnl_create_link+0x239/0x710 [ 170.882756][T11552] rtnl_newlink_create+0x14c/0x620 [ 170.882781][T11552] ? __list_del_entry_valid_or_report+0x65/0x130 [ 170.882808][T11552] ? __mutex_lock+0x25d/0xcf0 [ 170.882836][T11552] rtnl_newlink+0xf29/0x12d0 [ 170.882942][T11552] ? xas_load+0x413/0x430 [ 170.882963][T11552] ? __memcg_slab_free_hook+0x135/0x230 [ 170.883051][T11552] ? __rcu_read_unlock+0x4f/0x70 [ 170.883085][T11552] ? avc_has_perm_noaudit+0x1b1/0x200 [ 170.883183][T11552] ? cred_has_capability+0x210/0x280 [ 170.883251][T11552] ? selinux_capable+0x31/0x40 [ 170.883328][T11552] ? security_capable+0x83/0x90 [ 170.883358][T11552] ? ns_capable+0x7d/0xb0 [ 170.883378][T11552] ? __pfx_rtnl_newlink+0x10/0x10 [ 170.883401][T11552] rtnetlink_rcv_msg+0x5fe/0x6d0 [ 170.883530][T11552] netlink_rcv_skb+0x120/0x220 [ 170.883560][T11552] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 170.883591][T11552] rtnetlink_rcv+0x1c/0x30 [ 170.883669][T11552] netlink_unicast+0x5c0/0x690 [ 170.883699][T11552] netlink_sendmsg+0x58b/0x6b0 [ 170.883734][T11552] ? __pfx_netlink_sendmsg+0x10/0x10 [ 170.883816][T11552] __sock_sendmsg+0x145/0x180 [ 170.883841][T11552] ____sys_sendmsg+0x31e/0x4e0 [ 170.883917][T11552] ___sys_sendmsg+0x17b/0x1d0 [ 170.883968][T11552] __x64_sys_sendmsg+0xd4/0x160 [ 170.884053][T11552] x64_sys_call+0x191e/0x2ff0 [ 170.884095][T11552] do_syscall_64+0xd2/0x200 [ 170.884174][T11552] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 170.884199][T11552] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 170.884221][T11552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.884312][T11552] RIP: 0033:0x7f7609f7eb69 [ 170.884328][T11552] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 170.884346][T11552] RSP: 002b:00007f76085df038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 170.884408][T11552] RAX: ffffffffffffffda RBX: 00007f760a1a5fa0 RCX: 00007f7609f7eb69 [ 170.884421][T11552] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000004 [ 170.884433][T11552] RBP: 00007f76085df090 R08: 0000000000000000 R09: 0000000000000000 [ 170.884445][T11552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 170.884457][T11552] R13: 0000000000000000 R14: 00007f760a1a5fa0 R15: 00007ffedeb4be78 [ 170.884511][T11552] [ 170.887501][T11552] bridge0: port 3(batadv1) entered blocking state [ 171.249059][T11552] bridge0: port 3(batadv1) entered disabled state [ 171.255751][T11552] batadv1: entered allmulticast mode [ 171.261425][T11552] batadv1: entered promiscuous mode [ 171.271141][T11512] hsr_slave_0: entered promiscuous mode [ 171.280115][T11512] hsr_slave_1: entered promiscuous mode [ 171.286229][T11512] debugfs: 'hsr0' already exists in 'hsr' [ 171.291989][T11512] Cannot create hsr debugfs directory [ 171.306785][ T6007] tipc: Left network mode [ 171.318026][T11565] __nla_validate_parse: 1 callbacks suppressed [ 171.318041][T11565] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2985'. [ 171.380567][ T29] kauditd_printk_skb: 709 callbacks suppressed [ 171.380581][ T29] audit: type=1400 audit(1754233231.154:22852): avc: denied { unmount } for pid=3300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 171.416982][ T7918] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 171.426229][ T7918] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 171.436048][ T3300] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 171.437422][ T29] audit: type=1400 audit(1754233231.154:22853): avc: denied { create } for pid=11570 comm="syz.0.2987" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 171.466063][ T29] audit: type=1326 audit(1754233231.224:22854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11570 comm="syz.0.2987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 171.490289][ T29] audit: type=1326 audit(1754233231.224:22855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11570 comm="syz.0.2987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 171.527845][ T29] audit: type=1326 audit(1754233231.264:22856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11574 comm="syz.3.2990" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa35650eb69 code=0x7ffc0000 [ 171.552050][ T29] audit: type=1326 audit(1754233231.264:22857): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11574 comm="syz.3.2990" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa35650eb69 code=0x7ffc0000 [ 171.575605][ T29] audit: type=1326 audit(1754233231.264:22858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11574 comm="syz.3.2990" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa35650eb69 code=0x7ffc0000 [ 171.599795][ T29] audit: type=1326 audit(1754233231.264:22859): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11574 comm="syz.3.2990" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa35650eb69 code=0x7ffc0000 [ 171.623415][ T29] audit: type=1326 audit(1754233231.264:22860): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11574 comm="syz.3.2990" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa35650eb69 code=0x7ffc0000 [ 171.647624][ T29] audit: type=1326 audit(1754233231.264:22861): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11574 comm="syz.3.2990" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa35650eb69 code=0x7ffc0000 [ 171.678568][ T6007] hsr_slave_0: left promiscuous mode [ 171.691815][ T6007] hsr_slave_1: left promiscuous mode [ 171.693911][T11584] sctp: [Deprecated]: syz.0.2992 (pid 11584) Use of int in max_burst socket option. [ 171.693911][T11584] Use struct sctp_assoc_value instead [ 171.697744][ T6007] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 171.720013][ T6007] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 171.741430][ T6007] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 171.748880][ T6007] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 171.777526][ T6007] veth1_macvtap: left promiscuous mode [ 171.784826][ T6007] veth0_macvtap: left promiscuous mode [ 171.791362][ T6007] veth1_vlan: left promiscuous mode [ 171.796617][ T6007] veth0_vlan: left promiscuous mode [ 171.851692][T11601] loop5: detected capacity change from 0 to 1024 [ 171.876472][T11601] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 171.974824][ T6007] team0 (unregistering): Port device team_slave_1 removed [ 171.989615][ T6007] team0 (unregistering): Port device team_slave_0 removed [ 172.019420][ T6007] team0 (unregistering): Port device dummy0 removed [ 172.073567][T10431] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 172.136225][T11618] sctp: [Deprecated]: syz.5.3003 (pid 11618) Use of int in max_burst socket option. [ 172.136225][T11618] Use struct sctp_assoc_value instead [ 172.165215][T11622] loop3: detected capacity change from 0 to 256 [ 172.176877][T11622] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 172.194614][T11625] syzkaller0: Caught tx_queue_len zero misconfig [ 172.217338][T11628] loop3: detected capacity change from 0 to 512 [ 172.233074][T11628] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 172.264607][T11628] EXT4-fs (loop3): failed to open journal device unknown-block(0,0) -6 [ 172.332966][ T7899] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x6 [ 172.384200][T11512] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 172.399796][T11512] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 172.414588][T11512] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 172.430612][T11512] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 172.459537][ T6007] ------------[ cut here ]------------ [ 172.465010][ T6007] WARNING: CPU: 0 PID: 6007 at net/xfrm/xfrm_state.c:3303 xfrm_state_fini+0x17c/0x1f0 [ 172.474785][ T6007] Modules linked in: [ 172.477855][T11512] 8021q: adding VLAN 0 to HW filter on device bond0 [ 172.478773][ T6007] CPU: 0 UID: 0 PID: 6007 Comm: kworker/u8:35 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 172.492985][T11512] 8021q: adding VLAN 0 to HW filter on device team0 [ 172.499866][ T6007] Tainted: [W]=WARN [ 172.510202][ T5999] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.510307][ T6007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 172.517324][ T5999] bridge0: port 1(bridge_slave_0) entered forwarding state [ 172.527345][ T6007] Workqueue: netns cleanup_net [ 172.527372][ T6007] RIP: 0010:xfrm_state_fini+0x17c/0x1f0 [ 172.545490][ T6007] Code: 48 8d bb 30 0e 00 00 e8 42 52 bd fc 48 8b bb 30 0e 00 00 e8 d6 d0 c9 fc 5b 41 5e 41 5f 5d c3 cc cc cc cc cc e8 75 9f a2 fc 90 <0f> 0b 90 e9 d9 fe ff ff e8 67 9f a2 fc 90 0f 0b 90 4c 89 f7 e8 0b [ 172.547803][T11512] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 172.565802][ T6007] RSP: 0018:ffffc90011dc3c60 EFLAGS: 00010293 [ 172.565893][ T6007] RAX: ffffffff84b5572b RBX: ffff888109fa0000 RCX: ffff888125c44200 [ 172.576250][T11512] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 172.582309][ T6007] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888109fa0e00 [ 172.609253][ T6007] RBP: ffffffff86c8a2e0 R08: 0001ffff86847f7f R09: 0000000000000000 [ 172.617313][ T6007] R10: ffffc90011dc3be8 R11: 0001c90011dc3be8 R12: ffffffff86c8a300 [ 172.621993][ T5999] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.625922][ T6007] R13: ffff888109fa0028 R14: ffff888109fa0e00 R15: ffff888109fa0000 [ 172.632349][ T5999] bridge0: port 2(bridge_slave_1) entered forwarding state [ 172.640294][ T6007] FS: 0000000000000000(0000) GS:ffff8882aee49000(0000) knlGS:0000000000000000 [ 172.640325][ T6007] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 172.640337][ T6007] CR2: 00007f090a36ee9c CR3: 0000000158e24000 CR4: 00000000003506f0 [ 172.671594][ T6007] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 172.680163][ T6007] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 172.688189][ T6007] Call Trace: [ 172.691516][ T6007] [ 172.694447][ T6007] xfrm_net_exit+0x2d/0x60 [ 172.698927][ T6007] ops_undo_list+0x278/0x410 [ 172.703550][ T6007] cleanup_net+0x2de/0x4d0 [ 172.708047][ T6007] process_scheduled_works+0x4ce/0x9d0 [ 172.714266][ T6007] worker_thread+0x582/0x770 [ 172.718915][ T6007] kthread+0x489/0x510 [ 172.722986][ T6007] ? __pfx_worker_thread+0x10/0x10 [ 172.728184][ T6007] ? __pfx_kthread+0x10/0x10 [ 172.732804][ T6007] ret_from_fork+0xdd/0x150 [ 172.737439][ T6007] ? __pfx_kthread+0x10/0x10 [ 172.742623][ T6007] ret_from_fork_asm+0x1a/0x30 [ 172.747540][ T6007] [ 172.750572][ T6007] ---[ end trace 0000000000000000 ]--- [ 172.758290][T11512] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 172.906448][T11512] veth0_vlan: entered promiscuous mode [ 172.934526][T11512] veth1_vlan: entered promiscuous mode [ 172.965165][T11679] sctp: [Deprecated]: syz.0.3017 (pid 11679) Use of int in max_burst socket option. [ 172.965165][T11679] Use struct sctp_assoc_value instead [ 172.995647][T11512] veth0_macvtap: entered promiscuous mode [ 173.024411][T11512] veth1_macvtap: entered promiscuous mode [ 173.102384][T11681] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3018'. [ 173.121465][T11512] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 173.161677][T11512] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 173.223435][ T7918] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.256891][ T7918] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.309838][ T7918] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.348749][ T7918] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.391733][T11662] lo speed is unknown, defaulting to 1000 [ 173.424130][T11662] lo speed is unknown, defaulting to 1000 [ 173.430891][T11662] lo speed is unknown, defaulting to 1000 [ 173.680268][T11700] tipc: Failed to obtain node identity [ 173.685759][T11700] tipc: Enabling of bearer rejected, failed to enable media [ 173.736443][T11702] loop3: detected capacity change from 0 to 256 [ 173.764557][T11702] msdos: Unknown parameter '˙0xffffffffffffffff˙˙˙˙18446744073709551615' [ 173.865059][T11704] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 173.910210][T11711] sctp: [Deprecated]: syz.3.3028 (pid 11711) Use of int in max_burst socket option. [ 173.910210][T11711] Use struct sctp_assoc_value instead [ 174.133224][T11723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3033'. [ 174.142233][T11723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3033'. [ 174.172965][T11713] lo speed is unknown, defaulting to 1000 [ 174.325197][T11713] lo speed is unknown, defaulting to 1000 [ 174.333118][T11721] lo speed is unknown, defaulting to 1000 [ 174.355244][T11713] lo speed is unknown, defaulting to 1000 [ 174.445461][T11721] lo speed is unknown, defaulting to 1000 [ 174.453968][T11721] lo speed is unknown, defaulting to 1000 [ 174.626835][T11748] loop5: detected capacity change from 0 to 164 [ 174.659246][T11748] iso9660: Unknown parameter '184467440737095516150x0000000000000008' [ 174.677234][T11753] loop2: detected capacity change from 0 to 2048 [ 174.699835][T11756] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3045'. [ 174.708766][T11756] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3045'. [ 174.781917][T11753] loop2: p3 p4 < > [ 174.785895][T11753] loop2: p3 size 57344 extends beyond EOD, truncated [ 175.005315][T11767] lo speed is unknown, defaulting to 1000 [ 175.021998][ T7899] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.033508][T11773] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3050'. [ 175.088895][ T7899] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.140441][ T7899] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.158746][T11767] lo speed is unknown, defaulting to 1000 [ 175.171304][T11767] lo speed is unknown, defaulting to 1000 [ 175.199910][ T7899] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.249592][T11770] lo speed is unknown, defaulting to 1000 [ 175.337966][ T7899] team0: Port device geneve1 removed [ 175.355075][ T7899]  (unregistering): left promiscuous mode [ 175.361026][ T7899] bond_slave_0: left promiscuous mode [ 175.366515][ T7899] bond_slave_1: left promiscuous mode [ 175.382612][T11790] loop5: detected capacity change from 0 to 136 [ 175.397466][T11790] rock: directory entry would overflow storage [ 175.403723][T11790] rock: sig=0x4f50, size=4, remaining=3 [ 175.409340][T11790] iso9660: Corrupted directory entry in block 2 of inode 1472 [ 175.419418][ T7899]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 175.427861][T11791] loop2: detected capacity change from 0 to 512 [ 175.434327][ T7899] bond_slave_0: left allmulticast mode [ 175.445675][T11793] loop0: detected capacity change from 0 to 512 [ 175.453047][ T7899]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 175.469965][T11791] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 175.484453][ T7899] bond_slave_1: left allmulticast mode [ 175.488557][T11791] ext4 filesystem being mounted at /565/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 175.490188][ T7899]  (unregistering): Released all slaves [ 175.508035][ T7899] bond1 (unregistering): Released all slaves [ 175.517317][T11770] lo speed is unknown, defaulting to 1000 [ 175.534768][T11791] EXT4-fs error (device loop2): ext4_lookup:1787: inode #12: comm syz.2.3052: iget: bad i_size value: 2533274857506816 [ 175.541316][T11770] lo speed is unknown, defaulting to 1000 [ 175.554556][T11791] EXT4-fs error (device loop2): ext4_lookup:1787: inode #12: comm syz.2.3052: iget: bad i_size value: 2533274857506816 [ 175.589056][ T7899] tipc: Left network mode [ 175.597071][ T7899] IPVS: stopping master sync thread 4908 ... [ 175.758785][ T7899] dummy0: left promiscuous mode [ 175.766192][ T7899] hsr_slave_0: left promiscuous mode [ 175.772934][ T7899] hsr_slave_1: left promiscuous mode [ 175.778568][ T7899] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 175.786018][ T7899] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 175.843851][ T7899] team0 (unregistering): Port device team_slave_1 removed [ 175.857434][ T7899] team0 (unregistering): Port device team_slave_0 removed [ 175.905443][ T5994] smc: removing ib device sz1 [ 175.925033][T11770] chnl_net:caif_netlink_parms(): no params data found [ 176.083466][T11770] bridge0: port 1(bridge_slave_0) entered blocking state [ 176.090686][T11770] bridge0: port 1(bridge_slave_0) entered disabled state [ 176.107943][T11770] bridge_slave_0: entered allmulticast mode [ 176.132136][T11770] bridge_slave_0: entered promiscuous mode [ 176.151293][T11770] bridge0: port 2(bridge_slave_1) entered blocking state [ 176.158523][T11770] bridge0: port 2(bridge_slave_1) entered disabled state [ 176.180673][T11770] bridge_slave_1: entered allmulticast mode [ 176.191756][T11770] bridge_slave_1: entered promiscuous mode [ 176.213199][ T3300] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 176.290405][T11770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 176.334797][T11770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 176.367816][T11770] team0: Port device team_slave_0 added [ 176.375142][T11770] team0: Port device team_slave_1 added [ 176.433394][T11820] lo speed is unknown, defaulting to 1000 [ 176.444266][T11820] lo speed is unknown, defaulting to 1000 [ 176.455100][T11770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 176.462573][T11770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 176.489177][T11770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 176.501666][T11770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 176.508789][T11770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 176.534811][T11770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 176.554396][T11836] netlink: 'syz.2.3066': attribute type 4 has an invalid length. [ 176.562159][T11836] netlink: 17 bytes leftover after parsing attributes in process `syz.2.3066'. [ 176.624701][ T29] kauditd_printk_skb: 473 callbacks suppressed [ 176.624715][ T29] audit: type=1326 audit(1754233236.394:23335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11838 comm="syz.1.3068" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47e15eeb69 code=0x7ffc0000 [ 176.836734][T11770] hsr_slave_0: entered promiscuous mode [ 176.848868][ T29] audit: type=1326 audit(1754233236.424:23336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11838 comm="syz.1.3068" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47e15eeb69 code=0x7ffc0000 [ 176.872487][ T29] audit: type=1326 audit(1754233236.434:23337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11838 comm="syz.1.3068" exe="/root/syz-executor" sig=0 arch=c000003e syscall=239 compat=0 ip=0x7f47e15eeb69 code=0x7ffc0000 [ 176.896090][ T29] audit: type=1326 audit(1754233236.434:23338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11838 comm="syz.1.3068" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47e15eeb69 code=0x7ffc0000 [ 176.919738][ T29] audit: type=1326 audit(1754233236.434:23339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11838 comm="syz.1.3068" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f47e15eeb69 code=0x7ffc0000 [ 176.943461][ T29] audit: type=1326 audit(1754233236.434:23340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11840 comm="syz.0.3067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 176.967086][ T29] audit: type=1326 audit(1754233236.434:23341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11840 comm="syz.0.3067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 176.990716][ T29] audit: type=1326 audit(1754233236.444:23342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11840 comm="syz.0.3067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=239 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 177.014335][ T29] audit: type=1326 audit(1754233236.444:23343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11840 comm="syz.0.3067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 177.037964][ T29] audit: type=1326 audit(1754233236.444:23344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11840 comm="syz.0.3067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7609f7eb69 code=0x7ffc0000 [ 177.088421][T11770] hsr_slave_1: entered promiscuous mode [ 177.384795][ T7899] IPVS: stop unused estimator thread 0... [ 177.425059][ T7899] ------------[ cut here ]------------ [ 177.430596][ T7899] WARNING: CPU: 1 PID: 7899 at net/xfrm/xfrm_state.c:3303 xfrm_state_fini+0x17c/0x1f0 [ 177.440201][ T7899] Modules linked in: [ 177.444100][ T7899] CPU: 1 UID: 0 PID: 7899 Comm: kworker/u8:46 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 177.458053][ T7899] Tainted: [W]=WARN [ 177.461878][ T7899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 177.472021][ T7899] Workqueue: netns cleanup_net [ 177.476793][ T7899] RIP: 0010:xfrm_state_fini+0x17c/0x1f0 [ 177.482385][ T7899] Code: 48 8d bb 30 0e 00 00 e8 42 52 bd fc 48 8b bb 30 0e 00 00 e8 d6 d0 c9 fc 5b 41 5e 41 5f 5d c3 cc cc cc cc cc e8 75 9f a2 fc 90 <0f> 0b 90 e9 d9 fe ff ff e8 67 9f a2 fc 90 0f 0b 90 4c 89 f7 e8 0b [ 177.502015][ T7899] RSP: 0018:ffffc90001393c60 EFLAGS: 00010293 [ 177.508078][ T7899] RAX: ffffffff84b5572b RBX: ffff888109fa4740 RCX: ffff8881023d9080 [ 177.516124][ T7899] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888109fa5540 [ 177.524116][ T7899] RBP: ffffffff86c8a2e0 R08: 0001ffff86847f7f R09: 0000000000000000 [ 177.532116][ T7899] R10: ffffc90001393be8 R11: 0001c90001393be8 R12: ffffffff86c8a300 [ 177.540110][ T7899] R13: ffff888109fa4768 R14: ffff888109fa5540 R15: ffff888109fa4740 [ 177.548117][ T7899] FS: 0000000000000000(0000) GS:ffff8882aef49000(0000) knlGS:0000000000000000 [ 177.557082][ T7899] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 177.563816][ T7899] CR2: 00007f76099e8000 CR3: 0000000104174000 CR4: 00000000003506f0 [ 177.571836][ T7899] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 177.579869][ T7899] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 177.587895][ T7899] Call Trace: [ 177.591242][ T7899] [ 177.594252][ T7899] xfrm_net_exit+0x2d/0x60 [ 177.598700][ T7899] ops_undo_list+0x278/0x410 [ 177.603294][ T7899] cleanup_net+0x2de/0x4d0 [ 177.607706][ T7899] process_scheduled_works+0x4ce/0x9d0 [ 177.613207][ T7899] worker_thread+0x582/0x770 [ 177.617883][ T7899] kthread+0x489/0x510 [ 177.621976][ T7899] ? __pfx_worker_thread+0x10/0x10 [ 177.627165][ T7899] ? __pfx_kthread+0x10/0x10 [ 177.631794][ T7899] ret_from_fork+0xdd/0x150 [ 177.636291][ T7899] ? __pfx_kthread+0x10/0x10 [ 177.640891][ T7899] ret_from_fork_asm+0x1a/0x30 [ 177.645655][ T7899] [ 177.648682][ T7899] ---[ end trace 0000000000000000 ]--- [ 177.698088][T11863] loop0: detected capacity change from 0 to 1024 [ 177.704805][T11863] ext4: Unknown parameter 'noacl' [ 177.716422][T11863] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3076'. [ 177.789076][ T23] hid_parser_main: 33 callbacks suppressed [ 177.789093][ T23] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 177.808212][ T23] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 177.889136][T11870] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3079'. [ 177.936628][T11875] loop2: detected capacity change from 0 to 256 [ 177.943552][T11875] msdos: Unknown parameter '˙0xffffffffffffffff˙˙˙˙18446744073709551615' [ 178.015586][T11881] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3084'. [ 178.048253][T11770] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 178.066024][T11770] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 178.075977][T11770] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 178.087498][T11770] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 178.130828][T11770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 178.145622][T11770] 8021q: adding VLAN 0 to HW filter on device team0 [ 178.154785][ T7899] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.161956][ T7899] bridge0: port 1(bridge_slave_0) entered forwarding state [ 178.174734][ T7899] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.181915][ T7899] bridge0: port 2(bridge_slave_1) entered forwarding state [ 178.216677][ T7899] ================================================================== [ 178.224783][ T7899] BUG: KCSAN: data-race in copy_process / free_pid [ 178.231288][ T7899] [ 178.233596][ T7899] read-write to 0xffffffff8685fc48 of 4 bytes by task 11512 on cpu 1: [ 178.241759][ T7899] free_pid+0x77/0x180 [ 178.245812][ T7899] free_pids+0x54/0xb0 [ 178.249864][ T7899] release_task+0x9a9/0xb60 [ 178.254357][ T7899] wait_consider_task+0x114a/0x1660 [ 178.259550][ T7899] __do_wait+0xfa/0x510 [ 178.263699][ T7899] do_wait+0xb7/0x260 [ 178.267674][ T7899] kernel_wait4+0x16b/0x1e0 [ 178.272172][ T7899] __x64_sys_wait4+0x91/0x120 [ 178.276841][ T7899] x64_sys_call+0x2a66/0x2ff0 [ 178.281503][ T7899] do_syscall_64+0xd2/0x200 [ 178.285992][ T7899] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.291869][ T7899] [ 178.294172][ T7899] read to 0xffffffff8685fc48 of 4 bytes by task 7899 on cpu 0: [ 178.301694][ T7899] copy_process+0x14a6/0x2000 [ 178.306360][ T7899] kernel_clone+0x16c/0x5c0 [ 178.310849][ T7899] user_mode_thread+0x7d/0xb0 [ 178.315516][ T7899] call_usermodehelper_exec_work+0x7a/0x160 [ 178.321402][ T7899] process_scheduled_works+0x4ce/0x9d0 [ 178.326858][ T7899] worker_thread+0x582/0x770 [ 178.331440][ T7899] kthread+0x489/0x510 [ 178.335491][ T7899] ret_from_fork+0xdd/0x150 [ 178.339975][ T7899] ret_from_fork_asm+0x1a/0x30 [ 178.344724][ T7899] [ 178.347025][ T7899] value changed: 0x8000010c -> 0x8000010b [ 178.352722][ T7899] [ 178.355024][ T7899] Reported by Kernel Concurrency Sanitizer on: [ 178.361156][ T7899] CPU: 0 UID: 0 PID: 7899 Comm: kworker/u8:46 Tainted: G W 6.16.0-syzkaller-11241-g186f3edfdd41 #0 PREEMPT(voluntary) [ 178.375030][ T7899] Tainted: [W]=WARN SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 178.378812][ T7899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 178.388851][ T7899] Workqueue: events_unbound call_usermodehelper_exec_work [ 178.395957][ T7899] ================================================================== [ 178.462988][T11770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 178.488301][T11902] netlink: 87 bytes leftover after parsing attributes in process `syz.1.3089'. [ 178.843218][ T7904] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.921287][ T7904] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.010457][ T7904] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.080991][ T7904] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.151401][ T7904] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.230660][ T7904] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.302182][ T7904] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.383816][ T7904] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.450331][ T7904] bridge_slave_1: left allmulticast mode [ 179.455969][ T7904] bridge_slave_1: left promiscuous mode [ 179.461665][ T7904] bridge0: port 2(bridge_slave_1) entered disabled state [ 179.469335][ T7904] bridge_slave_0: left allmulticast mode [ 179.475016][ T7904] bridge_slave_0: left promiscuous mode [ 179.480837][ T7904] bridge0: port 1(bridge_slave_0) entered disabled state [ 179.490452][ T7904] bridge_slave_1: left allmulticast mode [ 179.496111][ T7904] bridge_slave_1: left promiscuous mode [ 179.501779][ T7904] bridge0: port 2(bridge_slave_1) entered disabled state [ 179.510503][ T7904] bridge_slave_0: left allmulticast mode [ 179.516218][ T7904] bridge_slave_0: left promiscuous mode [ 179.521945][ T7904] bridge0: port 1(bridge_slave_0) entered disabled state [ 179.690744][ T7904] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 179.700354][ T7904] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 179.709959][ T7904] bond0 (unregistering): Released all slaves [ 179.760575][ T7904] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 179.770155][ T7904] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 179.779818][ T7904] bond0 (unregistering): Released all slaves [ 179.857232][ T7904] hsr_slave_0: left promiscuous mode [ 179.862896][ T7904] hsr_slave_1: left promiscuous mode [ 179.869655][ T7904] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 179.877116][ T7904] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 179.884688][ T7904] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 179.892103][ T7904] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 179.901425][ T7904] hsr_slave_0: left promiscuous mode [ 179.906939][ T7904] hsr_slave_1: left promiscuous mode [ 179.912465][ T7904] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 179.919858][ T7904] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 179.927332][ T7904] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 179.934732][ T7904] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 179.945913][ T7904] veth1_macvtap: left promiscuous mode [ 179.951481][ T7904] veth0_macvtap: left promiscuous mode [ 179.957016][ T7904] veth1_vlan: left promiscuous mode [ 179.962326][ T7904] veth0_vlan: left promiscuous mode [ 179.967864][ T7904] veth1_macvtap: left promiscuous mode [ 179.973325][ T7904] veth0_macvtap: left promiscuous mode [ 179.979021][ T7904] veth1_vlan: left promiscuous mode [ 179.984355][ T7904] veth0_vlan: left promiscuous mode [ 180.065033][ T7904] team0 (unregistering): Port device team_slave_1 removed [ 180.074520][ T7904] team0 (unregistering): Port device team_slave_0 removed [ 180.120825][ T7904] team0 (unregistering): Port device team_slave_1 removed [ 180.129884][ T7904] team0 (unregistering): Port device team_slave_0 removed [ 180.157718][ T3381] lo speed is unknown, defaulting to 1000 [ 180.163502][ T3381] infiniband syz0: ib_query_port failed (-19) [ 180.881732][ T7904] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 180.930662][ T7904] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 180.980904][ T7904] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.031238][ T7904] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.090768][ T7904] bridge_slave_1: left allmulticast mode [ 181.096409][ T7904] bridge_slave_1: left promiscuous mode [ 181.102586][ T7904] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.110382][ T7904] bridge_slave_0: left allmulticast mode [ 181.116007][ T7904] bridge_slave_0: left promiscuous mode [ 181.121792][ T7904] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.130178][ T7904] batadv1: left allmulticast mode [ 181.135197][ T7904] batadv1: left promiscuous mode [ 181.140230][ T7904] bridge0: port 3(batadv1) entered disabled state [ 181.147122][ T7904] bridge_slave_1: left allmulticast mode [ 181.152798][ T7904] bridge_slave_1: left promiscuous mode [ 181.158541][ T7904] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.166346][ T7904] bridge_slave_0: left allmulticast mode [ 181.171989][ T7904] bridge_slave_0: left promiscuous mode [ 181.177616][ T7904] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.250752][ T7904] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 181.260237][ T7904] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 181.269517][ T7904] bond0 (unregistering): Released all slaves [ 181.341156][ T7904] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 181.350640][ T7904] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 181.360732][ T7904] bond0 (unregistering): Released all slaves [ 181.425606][ T7904] hsr_slave_0: left promiscuous mode [ 181.431323][ T7904] hsr_slave_1: left promiscuous mode [ 181.436853][ T7904] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 181.444587][ T7904] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 181.454099][ T7904] hsr_slave_0: left promiscuous mode [ 181.459473][ T7918] batman_adv: batadv1: adding TT local entry 33:33:00:00:00:01 to non-existent VLAN -1 [ 181.469233][ T7904] hsr_slave_1: left promiscuous mode [ 181.474761][ T7904] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 181.482516][ T7904] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 181.489973][ T7904] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 181.497333][ T7904] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 181.507973][ T7904] veth1_macvtap: left promiscuous mode [ 181.513523][ T7904] veth0_macvtap: left promiscuous mode [ 181.519085][ T7904] veth1_vlan: left promiscuous mode [ 181.524352][ T7904] veth0_vlan: left promiscuous mode [ 181.588064][ T7904] team0 (unregistering): Port device team_slave_1 removed [ 181.596753][ T7904] team0 (unregistering): Port device team_slave_0 removed [ 181.645293][ T7904] team0 (unregistering): Port device team_slave_1 removed [ 181.654811][ T7904] team0 (unregistering): Port device team_slave_0 removed