last executing test programs: 1m14.728892309s ago: executing program 4 (id=334): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000080)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000040)='kfree\x00', r0, 0x0, 0x2}, 0xfffffcce) r1 = epoll_create(0xb213) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000240)={0xa0000000}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000000280)={0x2000000}) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xb, 0x0, &(0x7f0000001640)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="07000000040000000001000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) r5 = getpid() r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1801000001ffffeb00000000eb658e0d850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x18) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x4e8, 0x340, 0x11, 0x148, 0x0, 0x0, 0x450, 0x2a8, 0x2a8, 0x450, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x38, 0x0, [{0x4, 0x1, 0x7f}, {0x4, 0x1, 0x2, 0x5}, {0xdccf, 0x3, 0xfd, 0x2}, {0x6, 0x1a, 0x0, 0x7}, {0x8, 0x4f, 0x4, 0x8}, {0x0, 0x9b, 0x1, 0x4}, {0x80, 0x6, 0x5}, {0x0, 0x2, 0x8, 0x7}, {0xff, 0x6, 0xaa, 0x5}, {0x3, 0xc, 0x2, 0x1}, {0x0, 0xc5, 0x7}, {0x1, 0xfb, 0x3, 0x1}, {0x1, 0x0, 0x7f, 0x3}, {0x5, 0x7, 0x2, 0x8}, {0x0, 0xe, 0x9, 0x9}, {0x86c0, 0x4, 0xf, 0x1}, {0x7, 0x78, 0x81, 0x7fffffff}, {0x5, 0x1, 0x5}, {0xe, 0xf6, 0x4, 0x40f}, {0xdc, 0x8, 0x2, 0x2}, {0xef, 0x7, 0x1, 0x6}, {0x7, 0x4, 0x5, 0x8001}, {0x9, 0x80, 0x12, 0x2}, {0x10, 0x1, 0x16}, {0xd, 0x92, 0x8, 0x2}, {0x3, 0x10, 0x3, 0x10001}, {0x4, 0x1e, 0x7, 0xe}, {0x5, 0x0, 0x8d, 0x2}, {0xd2a3, 0x3, 0x3, 0x5}, {0x340, 0x9, 0x7, 0x5}, {0x3, 0x6, 0xff, 0x4}, {0xff, 0x0, 0x2}, {0x8000, 0x5, 0x43, 0xea}, {0x7fff, 0x15, 0xac, 0xffffffff}, {0x0, 0x5, 0x6, 0x2}, {0x5, 0xa2, 0x2, 0x2}, {0x2, 0x4, 0x7, 0x9}, {0x5ae, 0x81, 0xf6, 0x3ff}, {0x1, 0x80, 0xff, 0x29}, {0x2, 0x8, 0x3, 0xb}, {0xffff, 0x2c, 0xf}, {0x7, 0x8, 0x4, 0x143}, {0x4, 0x2, 0x0, 0xfc56}, {0x2, 0x5, 0x31, 0x7}, {0x5, 0x9, 0x9, 0x2}, {0x1, 0x40, 0x3, 0x3}, {0x100, 0x0, 0x80, 0x655}, {0x9, 0x6, 0x7, 0x71}, {0x5, 0x8a, 0x0, 0x8}, {0x4, 0x40, 0xb5, 0x2}, {0x0, 0x8e, 0x4, 0xfffffc00}, {0xfffd, 0x0, 0x1, 0x7fff}, {0x40, 0x2d, 0x4, 0x8bd}, {0x8, 0xbf, 0xf, 0x1a}, {0xb, 0x9, 0x7, 0x7}, {0xfff, 0x4, 0x4, 0x6}, {0x359, 0x9, 0xe, 0x779}, {0x0, 0x2, 0xf8, 0x3}, {0x220, 0x5, 0xb2, 0x3b7}, {0xe, 0x0, 0x80, 0x1}, {0x4b7c, 0xe0, 0xaa, 0x6}, {0x1, 0x2, 0xb}, {0x1ff, 0x7f, 0x4, 0xfff}, {0x5, 0x7, 0x8, 0x10001}], {0x4}}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @rand_addr=0x64010102, 0x0, 0x0, 'vlan0\x00', 'dvmrp1\x00'}, 0x0, 0xd0, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x81}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x4f, 0x7, "72f6daeff0a9c6294e211d2d88fe6dcff5d0e552201da3b7a1fd0000cb59"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x548) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000015c0)={'syztnl0\x00', &(0x7f0000001540)={'syztnl1\x00', 0x0, 0x7, 0x7, 0x0, 0xfffffffa, {{0x14, 0x4, 0x2, 0x3f, 0x50, 0x68, 0x0, 0x38, 0x2f, 0x0, @multicast2, @rand_addr=0x64010100, {[@cipso={0x86, 0x3b, 0x2, [{0x6, 0xc, "99da9cef5a7249b77d42"}, {0x1, 0x7, "661f66b01d"}, {0x0, 0x6, "b95ed6e6"}, {0x5, 0x5, "ea3901"}, {0x5, 0x6, "b2fe2573"}, {0x5, 0x11, "53a31fcae4fae0222c7b9d11faffd7"}]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f0000000d40)={0x13, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_io_uring_setup(0x4175, &(0x7f0000000180)={0x0, 0xbf56, 0x10000, 0x2, 0x2d0}, &(0x7f0000000440), &(0x7f0000000400)) io_uring_enter(r7, 0x7b1d, 0xe93c, 0xc, 0x0, 0x0) io_uring_register$IORING_REGISTER_NAPI(r7, 0x1b, &(0x7f00000000c0)={0x5, 0x6}, 0x1) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x303, 0x37}, "475566172f45f011", "bd14060000000000000092f94413582b", "00001000", "4e67cb72f328ac2f"}, 0x28) tkill(r5, 0x37) preadv2(r4, &(0x7f0000000000)=[{&(0x7f0000000780)=""/66, 0x42}], 0x1, 0x80, 0x8000, 0x0) 1m13.825654126s ago: executing program 4 (id=356): bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r0}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000d7c900000900000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r1, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r2, &(0x7f0000000600), &(0x7f0000000780)=""/70}, 0x20) 1m13.782994599s ago: executing program 4 (id=359): bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r0}, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000d7c900000900000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r1, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r2, &(0x7f0000000600), &(0x7f0000000780)=""/70}, 0x20) 1m13.748453721s ago: executing program 4 (id=360): socketpair$nbd(0x1, 0x1, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000001600)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) (async, rerun: 64) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) (rerun: 64) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000280)='kmem_cache_free\x00', r1, 0x0, 0x200000000000006}, 0x18) (async) llistxattr(0x0, 0x0, 0x0) (async, rerun: 32) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) (rerun: 32) syz_mount_image$iso9660(&(0x7f0000000040), &(0x7f0000000280)='./file0\x00', 0x3008011, &(0x7f0000000380)=ANY=[@ANYBLOB='cruft,map=normal,nojoliet,check=strict,hide,iocharset=iso8859-14,map=normal,nocompress,utf8,uid=', @ANYRESHEX=0x0, @ANYBLOB="3ac639f67f4bf82258126a865a8f74fda7a107c631273e5a0d6538f91887c8fc", @ANYRESHEX=0x0, @ANYBLOB=',session=0x000000000002000e,map=acorn,map=acorn,\x00'], 0x1, 0xa5b, &(0x7f0000001cc0)="$eJzs3c1vHOd9B/DvLEmJoV3bcVTXFRxxJVcK47AUSdVSBR9SiVxJTPlSkBRgoYcojahCEFu3cQs4RoEoQNFTjBZo0UN7M3rqyUAuTQ+FL0V7a049FCj8LwQ9qbkwmNkluSR3uRTDN8ufj7DcefnN8/xmZ555tK9P+HxZe3nL3Npaddvn/N1/PoKMOcFuTn/28ScflbcfPsmp9OXt4l+SwST1pD/J68nA1PTiwlyPgh4n95N8mhRJTqd5vyf3U/x1Xtyc/zTFP5b1dnVqryXTyxpfaMd9/gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwElUTE2Pj08UpzIzf/fdelNS32FqenGhyNrazjXr2zT9pBr1u/hJz3qTorxlcHB9qO/Xz2yufi1J/ULeaM69UQ1InsF8+MJrr7zzlf7a+vbdsvmlnN57se9//8PH31ldXflex7VFcYBZnTDNc+R2Y35maWFm7sbtRn1maaF+/erV8ct3bi3Vb83MNpbuLS035upTi40bywuL9ZGpr9cnrl+/Um+M3Vu4O397emy2sb7w2m9Ojo9frX9r7PcaNxaXFuYvf2tsaerOzOzszPztKqZcXcZcK0/E351Zri83bszV6w8fra5c2ZZZX7adv2XQRK/9KYMmewVNjk9OTkxMTk78sDV69saCq29ff/va+Hj/eNOLaU1kR8QhnbScLF/qfpgP/iIO+1Rr9v/JbGYyn7t5N/WO/6YyncUsZK7L+pb1/v/i5cau1aat/2/18v1t68+Wfy7kXGt2sEv/3yWXo/v3fr6fD/M438lqVrOS7x17Rkf773Yamc9MlrKQmczlRrWk3lpSz/VczdWM59u5k+EspT+3MpPZNLKUe1nKchrVGTWVxTRyI8tZyGLqGclUvp56JnI913Ml9TQylntZyN3M53amc6Mq5WEeVY/7lV1y3Aia2EvQ5C5BOzrzbv3/hu2bNLb/54TnUG3Xo3wIV3HYn7VW/3+qd+jI1JbZ/sNLCgAAADhQv/6feenMq//xv0mRr1bvy9+amW2MH3daAAAAwAGqPq73Rnk3UE59NYXn/wAAAPC8Karv2BVJhjLcnFr/JpQXAQAAAOA5Ub3/fy7F8OYCz/8BAADgOdP7N/Z7RhSj6z//W3/QvH/QimjOFUO3ZmYbY1MLs+9M5FL1KwPVNw12lNaXFAPV1w/eyvlm1Pmh5v3QZollnYNl1MTYOxN5KxdaOzLyZnn35kiHyMlm5NeakV9rj+zLlsgrZSQAPO8u7NIf77X/fyujzYjRs1WX3392Sx/cV/Ws43pWADgpNsbY+f/WkGYd+v9zzd8GONet//+tXZ7/lxGv5uFw8yMFY/lu3stqHmQ0rU8cDHcqdX00gubHEEZ7vBow1PrIwk+v1TK64/WAwY19bY9dyWRGO74i0FZusZ7DlWZc32EdBQA4Whd27YfX+//qRfKu/f/o7s//2/pcHykEgJNgYwT7Z50Y3nvwce8jALCVXhoAAAAAAAAAAAAAAAAAAAAAAAAAAAAO3p5+wP+/LiWrqyvJfgcL6DDx03//11/pGvOjF5LBZ8lw94laDiTn00kOZN8Pb6IvyXHV/s0881blMT4pD92uEz8/GWnsdaJ4UjXYX6qcY74wAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcCSKpK/T8lpyOsl4kstHn9XheXLcCRyU+v42K57maT7ISwedDgAAAAAAAAAAAAAAAAAAAAAAAAAAAADAF13r9/9rad6/0FyU/lpyMcn9JL9/3Dk+i8Ee658eUR4nzx9Vf9t+/7+WDGStSH/W1tbWkmJganpxYa48FYrT5frPPv7ko/LWtcgfrE/sHFWhLKCsYcvgEq0a2pYMbN3qy9VWQ9Mr7z/+s/f+pD59szoxby7fmp2eu734O5uBrxU/bg6B0D4Mwnq+f3Hx3/6mbfGpVuU/Tn+3Hdle762q3umd9f5ap6271LsHj1ZXJsualhvvLv/5H9faV72a88mbI8nI1pr+sLx1qen89sdzq+JnxV8VL+Xvc786/uWjUawV5SF6udr/Lz18tLoy9t33Vh9s5PSDRx+0FfBKhpM82NrKeuQ0XF1POnqhqnWgrHW8Cir/nOlR3q7aSpzYfFy37MOXq1Nm6Jn2od59Hyo9HvdWRle2Z7RWNpK//dOv5NKuR/p0hxIv9aixo+Jnxf8Ud/Lf+cu28T9q5fG/mI6ts0MRVWTbmdK+bkvzql3c3PPJ9hXf3l5m11bJIfhR/iC/vXH8a9X1v73dTHZpNxvXo2+2LezSbtabVpd2cXprS93RLlp6tYudLfWfXi57lJ933vGqGZ3Z1iO1rj6dt8h6nmeaUV3y/NV8I+k/+0xXlG/0uKL02n6/7f8fipH8X54Y/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADj5iqSv0/JacjHJK0leLufrydr2mCf7qK82VOwnzQOzn5w/f4quO1o8zdN8kJeOOiMAAAAAAAAADsfN6c8+/uSj8la9H9+X36i11tST/iSvFH83MDW9uDDXo6CB5P76W/qDnUO6LM798s+Lm/OflnOv96jveD8+AACfa78IAAD//2Tfb7o=") preadv(r2, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) (async, rerun: 64) syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) (async, rerun: 64) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$nfs(&(0x7f0000000000)='\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x200000, &(0x7f00000000c0)={[{')}'}, {'pagemap\x00'}, {'GPL\x00'}, {'GPL\x00'}, {')-'}], [{@dont_appraise}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@hash}, {@subj_type={'subj_type', 0x3d, '/dev/hwrng\x00'}}, {@func={'func', 0x3d, 'CREDS_CHECK'}}]}) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r4, 0x0, 0x10}, 0x18) syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) 1m13.655034927s ago: executing program 4 (id=361): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x10) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x3800) 1m13.654575827s ago: executing program 4 (id=362): r0 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000640)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000380)='rxrpc_s\x00', 0x0, 0x0, 0x0, r0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='attr/fscreate\x00') writev(r1, &(0x7f0000001240)=[{&(0x7f0000000a40)}, {&(0x7f0000001740)="9b5937bbf46a0a752f10243253d99fbb3227121bb4836b8073322d1ac20976026ad7649ec309fb239ebb9c2cd94e3c0a9d3ae6ba455d59f9121db45c1e3f9819cdbc953deaafd98b8131db4b498bc0addfc7e4ee821a6bcee9b07b6b4c5e8997f930a6f3fd18d2eb7de5346e9a72baa07d1096a2cf190170c4afda7fa59bd94e11bb77019f82de797869753f2b1bebfed1fdbd0f1edc487e9bf6bb46a696fd31f957a4b9069df7026a6d091626387f9b551cdb820d568a83df198b9c4ec31516929c32f9294778c656d42591359cf5057865524d34723463a5eeff4a8d73cf4855269f931281e4a72770858c1e321e454d4de06b2689ce63ab625583cec82ce42ccfd6ddc1e2c266d34016d508ef38bfc5f89cce170e9cb662c1884499a82524ac9cd366da3dbd9a03bef7381dae4008ec14a7181d8f6ba4497cedfe80907720ed4fe71ea378264b431e483bc1dd1b782d9dcd4bb3b26fe5341098692102ffff4f19699d25da82320bfa0debb44622328b452c505d20e8f46bc73f", 0x17b}, {&(0x7f0000000500)="2a6dfe6b588f0649b7c62468b77834dbabbd4b95", 0x14}, {&(0x7f0000001640)="acf5964b4d2aba2c68c363b6bc49a8c7becac3bbb7dfcc8b79d6d4f52be12eeb2b79d208ff301d18aa1e5b70729f3b4aa941103981c5f58d8d4971d20b6aa6c7bc3d371b296f014d7bec9aed7f966e46d306d93dabbef889580d6d6e78ba9c72b644dfe391899db31310e59eb3e734ccda545701b2fc7dbb748af3f4f2f22510c8965985c95e73ec6c46ac80a4a74288351133b2890706681f10d66dec0d89e27fdd35fe7ddfe33b4a8d99acecc1586f6d1d257e22e1bf7e390d6d4dbe967e616ccaba4ce0491838ad8469", 0xcb}, {&(0x7f0000000d00)="35b67d93a84d33eb70ff581e3a9d9d0da6dc5d9e513fd7f0d6a7e1a170a9fd02e1e8ab7be3d54f2942d30bb052ff1db99d44bbba505f4ec35bbda360e6b433a93f22eaa64d7024893d4a99395bd583c81e435a0b3c52004bf44246828d6b76a7bdae3a6cfbb9fb", 0x67}, {&(0x7f0000000d80)="3737510ba7998eb0a92eb479b9ac482e6adde06f82a7ed40961de2f2044db9ddc090c9ad2b99c28af1c0147e8302afcf6fdcf929bec6a1a7739a151623ff9e7b9f32748cb18596b18766bb9ec5d09bce07fd8016aeef37d95a4474f8c7a9299958fe", 0x62}, {0x0}, {&(0x7f0000000c00)="41c7c229ebe174b727f00ec3f1d02a27c4bab19ef5ff046bb5aaec1fa8b6d8b49c4ca80426f1d27aaa0a3a5f74b020a430b1cc1f485e8c9013fdfe42f6f11c3e2686e59c5a7738096c5826f4443b74e6640b8b42e5b049f8dd9b7ef8aca94c0a7f7553c48bca6b78498c8f52bea41749243422a96cabd158f601376639e11bd9acdcca6296ab8f4212d1c47c37329f2aa90197826b918c", 0x97}, {&(0x7f0000001040)="02e5570de9bd58f3ae924514eb95d3085d5b4ffc3ad1b8cdf7f7086f87dfad4ff604ecaacc625a44eea266710d093ac57e807436b57559bc78129208b4f028c7e81351dfef9e381d85c5d7f74e505af08f656fc416ece1fe515b610553eae1493e", 0x61}], 0x9) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x13}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="06000000040000"], 0x39) bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x18, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000180)={0xffffffffffffffff, 0x5, 0x8}, 0xc) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='attr/fscreate\x00') writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000040)="dc", 0x1}], 0x8) 58.421890139s ago: executing program 32 (id=362): r0 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000640)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000380)='rxrpc_s\x00', 0x0, 0x0, 0x0, r0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='attr/fscreate\x00') writev(r1, &(0x7f0000001240)=[{&(0x7f0000000a40)}, {&(0x7f0000001740)="9b5937bbf46a0a752f10243253d99fbb3227121bb4836b8073322d1ac20976026ad7649ec309fb239ebb9c2cd94e3c0a9d3ae6ba455d59f9121db45c1e3f9819cdbc953deaafd98b8131db4b498bc0addfc7e4ee821a6bcee9b07b6b4c5e8997f930a6f3fd18d2eb7de5346e9a72baa07d1096a2cf190170c4afda7fa59bd94e11bb77019f82de797869753f2b1bebfed1fdbd0f1edc487e9bf6bb46a696fd31f957a4b9069df7026a6d091626387f9b551cdb820d568a83df198b9c4ec31516929c32f9294778c656d42591359cf5057865524d34723463a5eeff4a8d73cf4855269f931281e4a72770858c1e321e454d4de06b2689ce63ab625583cec82ce42ccfd6ddc1e2c266d34016d508ef38bfc5f89cce170e9cb662c1884499a82524ac9cd366da3dbd9a03bef7381dae4008ec14a7181d8f6ba4497cedfe80907720ed4fe71ea378264b431e483bc1dd1b782d9dcd4bb3b26fe5341098692102ffff4f19699d25da82320bfa0debb44622328b452c505d20e8f46bc73f", 0x17b}, {&(0x7f0000000500)="2a6dfe6b588f0649b7c62468b77834dbabbd4b95", 0x14}, {&(0x7f0000001640)="acf5964b4d2aba2c68c363b6bc49a8c7becac3bbb7dfcc8b79d6d4f52be12eeb2b79d208ff301d18aa1e5b70729f3b4aa941103981c5f58d8d4971d20b6aa6c7bc3d371b296f014d7bec9aed7f966e46d306d93dabbef889580d6d6e78ba9c72b644dfe391899db31310e59eb3e734ccda545701b2fc7dbb748af3f4f2f22510c8965985c95e73ec6c46ac80a4a74288351133b2890706681f10d66dec0d89e27fdd35fe7ddfe33b4a8d99acecc1586f6d1d257e22e1bf7e390d6d4dbe967e616ccaba4ce0491838ad8469", 0xcb}, {&(0x7f0000000d00)="35b67d93a84d33eb70ff581e3a9d9d0da6dc5d9e513fd7f0d6a7e1a170a9fd02e1e8ab7be3d54f2942d30bb052ff1db99d44bbba505f4ec35bbda360e6b433a93f22eaa64d7024893d4a99395bd583c81e435a0b3c52004bf44246828d6b76a7bdae3a6cfbb9fb", 0x67}, {&(0x7f0000000d80)="3737510ba7998eb0a92eb479b9ac482e6adde06f82a7ed40961de2f2044db9ddc090c9ad2b99c28af1c0147e8302afcf6fdcf929bec6a1a7739a151623ff9e7b9f32748cb18596b18766bb9ec5d09bce07fd8016aeef37d95a4474f8c7a9299958fe", 0x62}, {0x0}, {&(0x7f0000000c00)="41c7c229ebe174b727f00ec3f1d02a27c4bab19ef5ff046bb5aaec1fa8b6d8b49c4ca80426f1d27aaa0a3a5f74b020a430b1cc1f485e8c9013fdfe42f6f11c3e2686e59c5a7738096c5826f4443b74e6640b8b42e5b049f8dd9b7ef8aca94c0a7f7553c48bca6b78498c8f52bea41749243422a96cabd158f601376639e11bd9acdcca6296ab8f4212d1c47c37329f2aa90197826b918c", 0x97}, {&(0x7f0000001040)="02e5570de9bd58f3ae924514eb95d3085d5b4ffc3ad1b8cdf7f7086f87dfad4ff604ecaacc625a44eea266710d093ac57e807436b57559bc78129208b4f028c7e81351dfef9e381d85c5d7f74e505af08f656fc416ece1fe515b610553eae1493e", 0x61}], 0x9) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x13}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="06000000040000"], 0x39) bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x18, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000180)={0xffffffffffffffff, 0x5, 0x8}, 0xc) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='attr/fscreate\x00') writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000040)="dc", 0x1}], 0x8) 6.184496219s ago: executing program 2 (id=1185): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000c40)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d649379071c33390e418ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fcb4e0b6eab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afcc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab2e4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea508000000a0c548552b571bed5647323c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151fcda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ecec37e83efceefd7ca2533659edc8bef9cb85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d350000000000000000e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e5a61561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a2946501559335781092cf8ce987c56cd31121624d7455f2a3666276c3c0e812b28e2f30d035cee5d0e77a3c72208ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f030b8d3ebce68663ef5a"], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{}], 0x8, 0x10, &(0x7f0000002e00), 0x0, 0x0, 0xfffffffd, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={r0, 0x66, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd48, 0x0, 0x0, 0x0, 0x1000000, 0x8, 0x0, 0x0}}, 0x10) 6.137642742s ago: executing program 2 (id=1187): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x20010, 0xffffffffffffffff, 0x84aa5000) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0xa828, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0x22, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) removexattr(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="757348727076b81e9b11a0e2982e45b42892d842006e00e7eddad145a3fda4e444fb2f917db356008e57e10000000000000002384069be4a71b5a8a5e103844a69c5b04a00a0d713c32f8552b5a26d9a9344f494331f9c966e744548474ea8f4628865779d101a49eae25b7d8aab858c052109668364a87384aa532dedadb6c3fcaba0244bd35c04ac68076aceab924d0e02676ca4fa1cd9621ebea494448f2d427d13e2c2ffe67bec5352b0031b94e1c28965594fca66f158b547471bc699aadaf1243b35aa7e8f302848a1343b33e692b76e58eb071dbbf1fbdb86def87103ca79b326a5698956f6e38accefe4fb5c3f5e12996abb72acfa37164d690336b129bd0e16c510aa9e"]) shutdown(r0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) syz_clone(0x20040000, 0x0, 0x0, 0x0, 0x0, 0x0) sendfile(r1, r1, 0x0, 0x40000f63c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @rand_addr=0x64010100}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={r2, 0x7f}, &(0x7f0000000080)=0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="075a1c28e008", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0100000004000000080000000800000000000000", @ANYRES32, @ANYBLOB="9b583d719c1a8e8a1b4bd056d6f81e000200d384921e3b000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) shutdown(r3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000c626b5dde22013d9f03f151ce9f789d45b7afe0ece1e50230494a95d7f0eba58"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_clone(0x60000400, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r7, {}, {}, {0xfff3}}}, 0x24}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000080000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000021440011800a0001006d617463680000003400028008000240000000001c0003000afe6cbf96caa5debdad61b67ddb2fb68fcf19f7807076430a00010071756f7461"], 0xc8}, 0x1, 0x0, 0x0, 0x4000005}, 0x20000004) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r8, 0x1, 0x7, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r9 = openat$selinux_context(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) write$selinux_context(r9, &(0x7f0000000200)='system_u:object_r:inetd_log_t:s0\x00', 0x21) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x24) 3.670559708s ago: executing program 3 (id=1212): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0xc, &(0x7f0000000300)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0xc, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8d}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffabfeda3d8693002de9c46017bee5ec80ff01"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r0}, &(0x7f0000000180), &(0x7f0000000200)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x5, 0x20000132, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = open(&(0x7f0000000240)='./file0\x00', 0x105142, 0xa4) ftruncate(r2, 0x2007ffc) sendfile(r2, r2, 0x0, 0x800000009) write$char_usb(r2, &(0x7f00000003c0)="65b8392e7c8d40d0d0fabea14838cbad3292b0a697fb442023024b01bc530c6d7924fb266dd5814efa666776f2fa5ece3ba7211216eee4a67c25fde5225002d23d", 0x41) bpf$MAP_CREATE(0x0, 0x0, 0x48) io_setup(0x400e, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000140), &(0x7f0000000040)='%pI4 \x00'}, 0x2a) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000540)='fib6_table_lookup\x00', r4}, 0x10) r5 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r5, 0x29, 0x2a, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast1, 0x10000008}}}, 0x88) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1) write$binfmt_misc(0xffffffffffffffff, &(0x7f00000007c0)="9d6cbee3ca75220c164bb1938044e53c8447418c3a590991af95c293dd85d5383d8051702458b9bc0a5bd03a4e62b4826a7c3a5bce363aa05856b1c0b6ffa79a005619c20d9d832329fe9f73b8dbb9cb42b59234f2e5bd473e0279495faa62838aad7d4133cdb3616c78cdfc0d2a32a5afc31fc5ca0745f2ee63469e913df9db8577b9992041446f3ece8e1b1a012cef73aca0952166abf4bf04e5959e850fee49985e6ef37cfd6b5cdc91430cc909b97b405cdeee201258e2d591cac938b6479e1ff2c5df2adb4d", 0xc8) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000000500000095"], &(0x7f0000000500)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r6, 0x0, 0x36, 0x0, &(0x7f0000000680)="c1188e19b95d02ff4284860186ddd712070016b67ef0f3762afeede9f909bee035cb7dde6cf4fb5a1241ee65c91e0ea151c97198e452", 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x5}, 0x50) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000002c0)='./file0\x00', 0x10, &(0x7f0000000600), 0x1, 0x59d, &(0x7f0000001100)="$eJzs3c9vFGUfAPDvs7stlAItb97kfZGDTUiERG1pwWiMiRDx5sEfJJ5IrG0hhAUaWhNBjJDgf6B/gIk3E2M8EmOIevHqzcSriSESA714WzO7s2WB3f7cMsh8PsnQ55mnk+8zu3z7zDw7MxtAaY1l/1Qi9kbEfIoY6WirRd441vq9u3euzCzduTKTotF4568UKV/X/v2U/xzON94eEb/8kOI/1YfjLly6fHa6Xp+7mNcnFs/NTyxcuvz8mXPTp+dOz52fmnxx8oUjh6eOHOrLfu6KiJ/Gj9eun3pt3zczX+755LuvbqQ4Gjvz9s796JexGFt+TTplr+tL/Q5WkGq+P51vcaoV2CHWpf3+DUTE/2IkqnHvzRuJT98qtHPAlmqkiAZQUkn+Q0m1jwOy89/2UuwRCfCo3D7WmgC4m1pze0vL+V9rzQ3G9ubcwI6lFJ3TOiki+jEzl8WYfyaNZEts0Twc0N3VaxHx/27jf2rm5mhzFj/L/8p9+V+JiDfzn9n6tzcYf+yBuvyHR2cz+f9eR/6/v8H48h8AAAAAAAD65+axiHiu2+d/leXrf6LL9T/DEXG0D/FX//yvcqsPYYAubh+LeCUi2tf+LXXkf260mtd2Na8HGEinztTnDkXE7og4GAPbsvrkCjHG9v080LOt4/q/bMnit68FzPtxq7bt/m1mpxenN7PPQMvtaxFP1brlf1oe/1OX8T8b++fXGKNx/NUfe7Wtnv/AVml8EXGg6/h/78kVaeXnc0w0jwcm2kcFD/vo5I1ve8WX/1CcbPzfsXL+j6bO5/UsrD/Gx3/+ton87378P5hONB85M5iv+3B6cfHiZMRgeuPh9VPr7zM8idr50M6XLP8P7u9+/r/S8f9QRFxdY8wT379+vVeb8R+KM3QtYnZd4//6C/vf/fzvXvHXNv4faY7pB/M15v9gZWtN0KL7CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/RpWI2BmpMr5crlTGxyOGI+K/saNSv7Cw+OypCx+cn83amt//X2l/0+9Iq57a3/8/2lGfeqB+OCL2RMRn1aFmfXzmQn226J0HAAAAAAAAAAAAAAAAAACAx8Rwj/v/M39Ui+4dsOVqRXcAKIz8h/KS/1Be8h/KS/5Decl/KC/5D+Ul/6G85D+UV7Xx9cmi+wAAAAAAAPTNnqdv/poi4urLQ80lM5i3DRTaM2CrHS26A0BhPOIHysulf1Beq53jmwOAJ19apX37hrcEAAAAAAAAAAAAAPrlwF73/0NZVYruAFCY3vf/ezIAPOnc/w/l5RwfcP8/AAAAAAAAAAAAADz+Fi5dPjtdr89d3Ghh2+Y2V1BYa+H33a3/s49Lf9ZfiNSHjHtEhaL/MgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG3/BAAA//9r5fVk") r7 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r7) 2.871454178s ago: executing program 0 (id=1223): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x7, 0x8604, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x8, 0x6}, 0x0, 0x10000, 0x0, 0x6, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000008}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000570000/0x4000)=nil, 0x4000, 0x3) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x82) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) mmap(&(0x7f00006cb000/0x1000)=nil, 0x1000, 0x1000009, 0x10010, r2, 0x2a96b000) ioctl$FITRIM(r1, 0xc0185879, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, 0x0) getpgrp(0xffffffffffffffff) unshare(0x28020480) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'macvlan1\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9c0000001000ffff29bdffffff7f000000002b00", @ANYRES32=0x0, @ANYBLOB="9d010000000000007400128009000100766c616e00000000640002800600010004000000580004800c00010007000000010400000c00010000000100010000000c00010007000000050000000c00010000000000090000000c00010004000000ff0700000c00010002000000010000000c000100030000000500000008000500", @ANYRES32=r4], 0x9c}, 0x1, 0x0, 0x0, 0x1b6c78eaf531015b}, 0x8000002) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="070000000400000008000000d9"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r6}, 0x18) r7 = syz_io_uring_setup(0x4553, &(0x7f0000000400)={0x0, 0x59fc, 0x80, 0x3, 0xbd7f7fff}, &(0x7f0000000040)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f00000002c0)=0x9, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000180)=@IORING_OP_MKDIRAT={0x25, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000037c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0, 0x1}) io_uring_enter(r7, 0x5535, 0x3acd, 0x22, 0x0, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r10) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r10, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)={0x14, r11, 0x719, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8044}, 0x880) r12 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r12}, &(0x7f0000bbdffc)) 2.722041248s ago: executing program 5 (id=1226): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000280)=r1}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x33}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x0) r4 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f00000001c0)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300", 0xfffffffb}, 0x48, 0xffffffffffffffff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xa6426000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) shutdown(0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(r2, 0xc02054a5, &(0x7f0000000340)={0x5, r1, 'id1\x00'}) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000400)='sys_enter\x00', r5}, 0x18) removexattr(0x0, 0x0) r6 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x4) r7 = add_key$fscrypt_v1(&(0x7f0000000240), &(0x7f0000000200)={'fscrypt:', @auto=[0x34, 0x37, 0x65, 0x34, 0x39, 0x31, 0x33, 0x0, 0x66, 0x36, 0x5c, 0x33, 0x30, 0x61, 0x66, 0x61]}, &(0x7f00000002c0)={0x0, "6035ae1e0fe721441705322225930e6c1e3e2a51a92fd780bc34d7cf6e0236805b4377f7ab1a9b01c103a4c6a7ef54e6763fd7264c39ea00c508ba6062696138", 0x18}, 0x48, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x4, r7, r6, r6, 0x0) keyctl$KEYCTL_MOVE(0x4, r4, r4, 0x0, 0x0) symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') 2.560342788s ago: executing program 0 (id=1227): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1802000000000000"], 0x0, 0x3f, 0x0, 0x0, 0x0, 0xb}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.540065549s ago: executing program 0 (id=1228): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x20010, 0xffffffffffffffff, 0x84aa5000) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0xa828, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0x22, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) removexattr(&(0x7f0000000200)='./cgroup\x00', 0x0) shutdown(r0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) syz_clone(0x20040000, 0x0, 0x0, 0x0, 0x0, 0x0) sendfile(r1, r1, 0x0, 0x40000f63c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @rand_addr=0x64010100}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={r2, 0x7f}, &(0x7f0000000080)=0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="075a1c28e008", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0100000004000000080000000800000000000000", @ANYRES32, @ANYBLOB="9b583d719c1a8e8a1b4bd056d6f81e000200d384921e3b000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) shutdown(r3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000c626b5dde22013d9f03f151ce9f789d45b7afe0ece1e50230494a95d7f0eba58"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_clone(0x60000400, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r7, {}, {}, {0xfff3}}}, 0x24}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000080000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000021440011800a0001006d617463680000003400028008000240000000001c0003000afe6cbf96caa5debdad61b67ddb2fb68fcf19f7807076430a00010071756f7461"], 0xc8}, 0x1, 0x0, 0x0, 0x4000005}, 0x20000004) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r8, 0x1, 0x7, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r9 = openat$selinux_context(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) write$selinux_context(r9, &(0x7f0000000200)='system_u:object_r:inetd_log_t:s0\x00', 0x21) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x24) 2.518412001s ago: executing program 5 (id=1229): unshare(0xc040400) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x3f, 0x0, 0x0, 0x0, 0xb}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) 2.484755463s ago: executing program 5 (id=1230): unshare(0xc040400) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x3f, 0x0, 0x0, 0x0, 0xb}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.484029333s ago: executing program 5 (id=1231): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x20010, 0xffffffffffffffff, 0x84aa5000) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0xa828, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0x22, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) removexattr(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="757348727076b81e9b11a0e2982e45b42892d842006e00e7eddad145a3fda4e444fb2f917db356008e57e10000000000000002384069be4a71b5a8a5e103844a69c5b04a00a0d713c32f8552b5a26d9a9344f494331f9c966e744548474ea8f4628865779d101a49eae25b7d8aab858c052109668364a87384aa532dedadb6c3fcaba0244bd35c04ac68076aceab924d0e02676ca4fa1cd9621ebea494448f2d427d13e2c2ffe67bec5352b0031b94e1c28965594fca66f158b547471bc699aadaf1243b35aa7e8f302848a1343b33e692b76e58eb071dbbf1fbdb86def87103ca79b326a5698956f6e38accefe4fb5c3f5e12996abb72acfa37164d690336b129bd0e16c510aa9e"]) shutdown(r0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) syz_clone(0x20040000, 0x0, 0x0, 0x0, 0x0, 0x0) sendfile(r1, r1, 0x0, 0x40000f63c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @rand_addr=0x64010100}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={r2, 0x7f}, &(0x7f0000000080)=0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="075a1c28e008", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0100000004000000080000000800000000000000", @ANYRES32, @ANYBLOB="9b583d719c1a8e8a1b4bd056d6f81e000200d384921e3b000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) shutdown(r3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000c626b5dde22013d9f03f151ce9f789d45b7afe0ece1e50230494a95d7f0eba58"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_clone(0x60000400, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r7, {}, {}, {0xfff3}}}, 0x24}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000080000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000021440011800a0001006d617463680000003400028008000240000000001c0003000afe6cbf96caa5debdad61b67ddb2fb68fcf19f7807076430a00010071756f7461"], 0xc8}, 0x1, 0x0, 0x0, 0x4000005}, 0x20000004) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r8, 0x1, 0x7, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r9 = openat$selinux_context(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) write$selinux_context(r9, &(0x7f0000000200)='system_u:object_r:inetd_log_t:s0\x00', 0x21) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x24) 2.171776213s ago: executing program 3 (id=1232): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd3a, 0x0, 0x0, 0x0, 0x100}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r2, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r3, &(0x7f0000000600), &(0x7f0000000780)=""/70}, 0x20) 2.131460875s ago: executing program 1 (id=1233): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x4, 0x0, 0x7ffc1ffb}]}) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB='\v\x00\x00\x00\a\x00\x00\x00\b\x00\x00\x00\b\x00\x00\x00'], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b708000000000e007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000020850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) sigaltstack(&(0x7f0000000140)={&(0x7f00000000c0)=""/83, 0x100000000, 0x53}, &(0x7f0000000200)={&(0x7f0000000380)=""/112, 0x0, 0x70}) 2.131027855s ago: executing program 1 (id=1234): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x100000000000600d, 0x1) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0xc9028ba210c11f8b) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000000)={'\x00', 0xc, 0x2, 0x803fd, 0x1, 0x800}) 2.102401497s ago: executing program 1 (id=1235): pipe2(&(0x7f0000001cc0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[], 0x48) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x18, 0xd, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000001000000000000000000000418110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2000000000000070a0000f8ffffffb703000008000000b7040000020000008500000003000000850000001100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@uname={'uname', 0x3d, '\xd0\xae\xde\xc1\xaa \xff\xd8\x1d\x1b\xf8\x93)!|\xb0X\xa3\x96\xed\xa2\xab@\xa2m\x93\xdd\b<\x00t\xdc\xabl\xab!\xae\x16\xc4\xcd\xf9{\xdc5_;A\xd2{eC\x014\\\xb3\xc4\xce\xc3yS2-\x01\xbe\xaarW\x96O\xd3\x0f\xe2\xd7/\x17\x1d\xa7.8\x9f8-\xea<\x8d\x91\x90j\xea\xd5\xd5\xae\xcc\xc0\x97\xef\x10\x92\xea\x98|+\x00\x00\x00\x00\x00\x00\x00\x00'}}]}}) 1.885787401s ago: executing program 3 (id=1236): sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = io_uring_setup(0x7bc7, &(0x7f0000000000)={0x0, 0xeebf, 0x410, 0x2, 0x290}) r1 = getpid() sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f0000000e40)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000e00)={&(0x7f0000000dc0)={0x3c, 0x3e9, 0x4, 0x70bd2b, 0x25dfdbff, {0x10, 0x0, 0x1, r1, 0xfffffff1, 0x44bd, 0x1, 0x800, 0x0, 0x0, 0x9}, ["", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x1) close_range(r0, r0, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCMIWAIT(r2, 0x545c, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0xd9, 0x2000, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0xffffffff}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f00000000c0)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x60, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='scsi_dispatch_cmd_start\x00', r4, 0x0, 0x2}, 0x18) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) syz_mount_image$ext4(&(0x7f0000000640)='ext4\x00', &(0x7f0000000680)='./file0\x00', 0x0, &(0x7f00000006c0), 0x1, 0x603, &(0x7f0000000700)="$eJzs3V1oXGkZAOD3TH5q29hUEcFepVgwaJ00P5YGFFuvhFqpraCoWGMy+SGTTEwm0ASkahEKCu2FqCAWcqGCKAQU7wT1yp8L/9iLdpdCFxZ2C6FLt7AXe5HlTGbS6WaaNJs0Z+k8D5z2+76Zk+898/Y9nfP1dCaAptWV/pKL+EhE3EgiOusea43qg11rz1vqXx5PtyRWVy/eTyJJ9+lfHq89P6n+frC6W3dE/O2HEWfbN847t7A4OVQsFmar/Z7y1EzP3MLiJyemhsYKY4XpvoETg4ODA/2DJ3btWH/2u1+//vGvfO5/V39w9vcr/7j6zSROR0f1sfrj2C1d0VV9TdridP0DScTJ3Z4sY7msA2DbTvYcO95SrfO2SM8BndFSrfrSL7/xoDP+eftJ+y6/efO1vYwV2H1XImIVaFKJ+ocmVXsfkF7/1ra9eu/xmx/v1Uw8ycqZtQvAG9W1naX1/LeurQ3F+yrXhgfeSKpXhmuS2trRDtzKpz/j/gf/k//zn9ItntE6DO9Nyy9nHQFZah/IOgKydORLWUdAlv59LesIyNL/V7KOgCxduJh1BGTpi8/bP4KzLb+4n3UE/OVMRBxvtP6XW1//iQbrPwcjYqd35vzxSERXvPDz+rGN6z+5ezuchk2snIn4dN29XUt1+a863FLtvT/tRFsyOlEspLk/FBHd0bYv7fduMseLx/7++UbjX72b5v/mhdr6X7ql89fWAqtx3Gvd9/h+I0PloZ0eN2tWvh9xpLVR/pP1+k8a1H/65+H8U85Rul663mj80K00/7+6unn+eZZWlyI+1rD+k/XnJJvfn9lTOR/01M4KG1347ytzjcZPHU3z/+BT8p+dtP4PbJ7/yvl//X7dhpnc3GfHOm80Gr/7ozT/b3373Zz/25MvVwKs3Vp8eahcnu2NaE++sHG8b/sxP69qr0ft9Urz3/3Rxn//b3b+3x8R33rKOf/63buvNhr/2mSa/399Xf1nJ83/yBb1nzxW/9tvnP/M0SuN5v7waJr/U/u3rv+BSjDd1RHv/7b2tAnKOk4AAAAAAAAAAAAAAAAAAAAAAIBmk4uIjkhy+fV2LpfPr32+74fiQK5Ymit/YrQ0Pz0Sle/KPhxtudonPXbWfR5sb6X9qN/3jn5/RHwgIq617K/088Ol4kjWBw9NqiPizh++M9zgm/kBAAAAAAAAAAAAAAAAAICsHHzC//9PvdSSdXTAs9ARcWf0Jy3fS9sP1Tk0lbT+f/tw6myof2g66h+al/qH5qX+oXmpf2he6h+al/qH5qX+oXmpf2he9fUPAAAAADyfzp87l26rS/3L42l/ujQ2MTk+M9h3Ij81P5wfLs3O5MdKpbHKN/ZPbf3ziqXSTG9fzF/uKRfmyj1zC4uXpkrz0+VLE1NDY4VLhbY9OCZga7d/OjCedQwAAAAAAAAAAAAAAAAAAMAjcwuLk0PFYmFWQ0NDY72R9ZkJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB55OwAA//8t2VDh") openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000e80), 0x0, 0x0) r5 = open(&(0x7f00000005c0)='./bus\x00', 0x24842, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000300)=""/236, 0xec}, {&(0x7f0000000400)=""/233, 0xe9}, {&(0x7f0000000040)=""/89, 0x59}, {&(0x7f0000000100)=""/173, 0xad}, {&(0x7f0000000500)=""/183, 0xb7}], 0x5) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@ipv6_newnexthop={0x38, 0x68, 0x1, 0xfffffffc, 0xfffffffe, {}, [@NHA_ENCAP_TYPE={0x6, 0x7, 0x3}, @NHA_ENCAP={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_ID={0xc, 0x1, 0x9}}, @NHA_OIF={0x8, 0x5, r7}]}, 0x38}}, 0x0) pwritev2(r5, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x8ec00}], 0x12, 0x300400, 0x0, 0x3) 1.459590078s ago: executing program 5 (id=1237): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0xab, @loopback, 0x10001}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x7, @loopback, 0x23}, 0x1c) r1 = dup(r0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[], 0x78}, 0x1, 0x0, 0x0, 0x4080}, 0x8080) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000180)=ANY=[@ANYBLOB="33015cd98c000000000000c204"], 0x18) r2 = socket(0xa, 0x3, 0xff) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty, 0x4000002}, 0x1c) syz_emit_ethernet(0x6e, &(0x7f00000001c0)={@random="cfb14e407d33", @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, 'z&-', 0x38, 0x3a, 0xfe, @local, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x8001, {0x2, 0x6, "081331", 0x9, 0xff, 0x0, @loopback, @loopback, [@fragment={0x3b, 0x0, 0xa, 0x0, 0x0, 0x3, 0x65}]}}}}}}}, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000300)={0x1, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r3, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000040)={0x30b, @tick=0x1000, 0x31, {0xfd}}) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f00000000c0)={0x7, 0xffffffffffffffa0, 0xfa00, {0xffffffffffffffff, 0x10c}}, 0xfffffd88) 1.079786492s ago: executing program 3 (id=1238): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x4, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = creat(&(0x7f0000000300)='./file0\x00', 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0, 0x0, 0x4}, 0x18) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x3000010, &(0x7f0000000340)={[{@errors_remount}, {@nodioread_nolock}]}, 0x1, 0x512, &(0x7f0000000380)="$eJzs3d9rY1kdAPDvvW1mOzNdk1WRdcF1cVc6i07Sbt3dIqLriz4tqOv7WNu0lCZNadJ1Whbt4H8ggoJPPvki+AcIwzz4B8jAgL6ID6KiiM7og6DOlSQ3TidN2rrTNp3m84HTnHPvzf2ec0NO7o/TewMYWy9FxFsRMRERr0ZEMZ+e5in2uqm93IP77y21UxJZ9s5fk0jyab11tdcxGRFX87dNRcTXvhzxzeRg3ObO7vpirVbdysuVVn2z0tzZvb5WX1ytrlY35ufn3lh4c+H1hdks90TtLPUyP/nS529/+lu/u/Hna99uV+tzH4lC9LXjJHWbXuhsi572Nto6jWAj0PvMC6OuCAAAx9Lex/9gRHyis/9fjInO3lyfiVHUDAAAADgp2Rem499JRAYAAABcWGlETEeSlvOxANORppfycwMfjitprdFsfWqlsb2x3J4XUYpCurJWq87mY4VLUUja5bl8jG2v/FpfeT4inouI7xcvd8rlpUZtecTnPgAAAGBcXO07/v9HMe3kjzbg/wQAAACA86s0tAAAAABcFA75AQAA4OLrP/6/PaJ6AAAAAKfiK2+/3U5Z7/nXy+/ubK833r2+XG2ul+vbS+WlxtZmebXRWO3cs69+1PpqjcbmZ2Jj+2alVW22Ks2d3Rv1xvZG68baY4/ABgAAAM7Qcx+/8+skIvY+e7mTIr8PIMBj/jDqCgAnaWLUFQBGxl28YXwVRl0BYOSSI+YbvAMAAE+/mY8evP7fe/6/cwNwsRnrAwDjx/V/GF8FIwBhrKUR8YFu9plhywy9/v/L40bJsoi7xf1TnF8EAICzNd1JSVrOjwOmI03L5YhnI9JSFJKVtVp1Nj8++FWx8Ey7PNd5Z3LkmGEAAAAAAAAAAAAAAAAAAAAAAAAAoCvLksgAAACACy0i/VPSuZt/xEzxlen+8wOXkn8W44954Ufv/ODmYqu1Ndee/rfOs7wuRUTrh/n014Y+PgwAAAA4acne0Fnd4/T8de5MawUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAGHhw/72lXjrLuH/5YkSUBsWfjKnO61QUIuLK35OY3Pe+JCImTiD+3q2IeH5Q/CQeZllWymvRHz+NiMunHL/U2TTD4189gfgwzu60+5+3Bn3/0nip8zr4+zeZpyc1vP9L88jPd/q5Qf3fswfWVh8Y44V7P6sMjX8r4oXJwf1Pr/9NhsR/+cDa/pVl2cEY3/j67u6w+NmPI2YG/v4kj8WqtOqblebO7vW1+uJqdbW6MT8/98bCmwuvL8xWVtZq1fzvwBjf+9jPHx7W/isD4v/2N93+97D2vzJspX3+c+/m/Q91s4VB8a+9PPD3dyqGxE/z375P5vn2/Jlefq+b3+/Fn9598bD2Lw/Z/kd9/teO2f5Xv/rd3x9zUQDgDDR3dtcXa7Xq1iGZqWMs8zRmfjF1Lqrxf2ay73Q/ufNSn/ebae+tPprSa9U5qNi+THZmsSbinDT5f5mRdksAAMApeLTTP+qaAAAAAAAAAAAAAAAAAAAAwPg6i9uJ9cfcG01TAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO9d8AAAD//yLg4A8=") 930.267731ms ago: executing program 3 (id=1239): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc}, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x26, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x8, 0x6}, 0x0, 0x6, 0x0, 0x1, 0xa, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x7fffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000380)=[{0x200000000006, 0x1, 0x7, 0x7ffc1ffb}]}) process_vm_readv(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000000c0)="ee", 0x1}, {&(0x7f0000000640)="dfcb69b47bc485ae32a07519b21e53d1a0c728e6022d523d4a1c28357862834ca9f743eab2e748cdd769a07e6a7bf39d17964f3a3bf2e0a7fe24ff05b529057a78c4b2f85c4a4e76d9e685ca317f6e8850c8ebb1af4c5ad4041e8492ef", 0x5d}], 0x2}}], 0x1, 0x9200000000000000) r2 = dup3(r1, r0, 0x0) recvmmsg(r2, &(0x7f0000002c80)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000880)=""/194, 0xc2}, {&(0x7f0000000c40)=""/207, 0xcf}], 0x2, &(0x7f0000000580)=""/164, 0xa4}, 0x6}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000b00)=""/111, 0x6f}], 0x1, &(0x7f0000000b80)=""/74, 0x4a}, 0xc}, {{0x0, 0x0, 0x0}, 0xe}, {{0x0, 0x0, &(0x7f0000002380)=[{0x0}, {0x0}, {&(0x7f0000004100)=""/4096, 0x1000}, {&(0x7f0000002f00)=""/245, 0xf5}, {0x0}, {&(0x7f0000001080)=""/65, 0x41}], 0x6, &(0x7f0000002c00)=""/107, 0x6b}, 0x4}], 0x4, 0x40000001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xa, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESOCT=r2], 0x50) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000003400000034000000020000000000000002000004000000000000000002000000000000000000000002000000000000000100000000000001"], 0x0, 0x4e}, 0x20) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b00000000000000000000000010000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="0100000001"], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001680)={r5, 0x0, 0x0}, 0x10) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000740)=ANY=[@ANYBLOB="1800"/14, @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000030000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r7, &(0x7f0000000000), &(0x7f0000000080)=@buf="1d"}, 0x20) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r7, &(0x7f0000000100)}, 0x20) setsockopt$packet_int(r1, 0x107, 0x13, &(0x7f00000004c0)=0x8, 0x4) lsm_list_modules(0x0, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x7, 0x8, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000c55640ab5d3bb281c3ed8b49770ae212930332e18a5c12c4f93915d65b407bcf4f116c8af7101aa1d755a79dcfc50a6959bb9f537752760fdcc071550ae85dc0ac422b6e37a4321c920f2f049514ab77ffb67f3cf5730fbfdbb3c8c9a9efea59b97f8b6204a018182f0cb7a7f8087f38e8ff57d440f31e681de88fd259657d7661", @ANYRES32, @ANYBLOB="0000000000000000b703000000040000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000500)=ANY=[@ANYBLOB="010007000000"], 0x6) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000440)='kfree\x00', r8, 0x0, 0x5}, 0x18) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x2000008, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}, {0x0, 0xffe0}}}, 0x24}}, 0x0) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020e0000150000000000000000000000030005000000000002004e24ac1e00010000000000000000030006003c000000020000fc34000000000000000000000001001800000000000800120000000200fcffffff0000000006003300000000000000000000000000fe8000000000000000000000000000aa0000000000000000000000000000000004"], 0xa8}}, 0x0) 603.154272ms ago: executing program 2 (id=1240): unshare(0xc040400) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x3f, 0x0, 0x0, 0x0, 0xb}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 581.951153ms ago: executing program 2 (id=1241): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={0x0, r1}, 0x18) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f0000000240)={'tunl0\x00', 0x0, 0x8, 0x10, 0x2, 0x100, {{0xb, 0x4, 0x3, 0x0, 0x2c, 0x66, 0x0, 0x3, 0x4, 0x0, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@lsrr={0x83, 0x17, 0x5f, [@loopback, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @private=0xa010102]}]}}}}}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_score\x00') preadv(r3, &(0x7f0000000000)=[{&(0x7f0000000480)=""/177, 0xb1}], 0x1, 0x5, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newtfilter={0x24, 0x11, 0x1, 0x691522eb, 0x0, {0x0, 0x0, 0x74, r5, {0x10, 0x4}, {}, {0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x4000010) statx(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x1000, 0x10, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000640)={{{@in=@rand_addr=0x64010101, @in=@multicast1, 0x4e22, 0x0, 0x4e24, 0x1ff, 0xa, 0x20, 0xa0, 0x3a, r5, r7}, {0xf, 0x7, 0x80000000, 0x100, 0x8, 0x8, 0x8001, 0x5}, {0xfffffffffffffff8, 0x7, 0x7fffffff, 0x5}, 0x8, 0x6e6bb3, 0x2, 0x0, 0x2, 0x3}, {{@in6=@private1, 0x4d2, 0xff}, 0x2, @in=@empty, 0x3506, 0x1, 0x1, 0x8, 0x7, 0xc97e}}, 0xe8) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000340)={{{@in=@local, @in=@loopback, 0x4e20, 0x0, 0x4e24, 0x0, 0xa, 0x20, 0x20, 0x2, r2, r7}, {0x7f, 0x4, 0x1, 0x9, 0x14, 0x1, 0x4, 0x6a2}, {0x1fb, 0xfff, 0x0, 0x5}, 0x7, 0x6e6bbc, 0x2, 0x0, 0x1, 0x3}, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4d4, 0xff}, 0xa, @in=@dev={0xac, 0x14, 0x14, 0x1d}, 0x3507, 0x3, 0x0, 0x8, 0xfffffffc, 0x10001, 0x8000}}, 0xe8) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x24000001}, 0x1004) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0xc}, 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000067b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = socket$inet(0xa, 0x801, 0x84) listen(r11, 0xfffffffd) r12 = socket$netlink(0x10, 0x3, 0x4) writev(r12, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r10}, 0x10) connect$inet(r8, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'dh\x00', 0x2d, 0x400eeb4, 0x13}, 0x2c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000"], 0x0, 0x3, 0x0, 0x0, 0x41000}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) 525.677607ms ago: executing program 5 (id=1242): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0xc, &(0x7f0000000300)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0xc, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8d}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffabfeda3d8693002de9c46017bee5ec80ff01"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r0}, &(0x7f0000000180), &(0x7f0000000200)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x5, 0x20000132, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = open(&(0x7f0000000240)='./file0\x00', 0x105142, 0xa4) ftruncate(r2, 0x2007ffc) sendfile(r2, r2, 0x0, 0x800000009) write$char_usb(r2, &(0x7f00000003c0)="65b8392e7c8d40d0d0fabea14838cbad3292b0a697fb442023024b01bc530c6d7924fb266dd5814efa666776f2fa5ece3ba7211216eee4a67c25fde5225002d23d", 0x41) bpf$MAP_CREATE(0x0, 0x0, 0x48) io_setup(0x400e, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000140), &(0x7f0000000040)='%pI4 \x00'}, 0x2a) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000540)='fib6_table_lookup\x00', r4}, 0x10) r5 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r5, 0x29, 0x2a, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast1, 0x10000008}}}, 0x88) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1) write$binfmt_misc(0xffffffffffffffff, &(0x7f00000007c0)="9d6cbee3ca75220c164bb1938044e53c8447418c3a590991af95c293dd85d5383d8051702458b9bc0a5bd03a4e62b4826a7c3a5bce363aa05856b1c0b6ffa79a005619c20d9d832329fe9f73b8dbb9cb42b59234f2e5bd473e0279495faa62838aad7d4133cdb3616c78cdfc0d2a32a5afc31fc5ca0745f2ee63469e913df9db8577b9992041446f3ece8e1b1a012cef73aca0952166abf4bf04e5959e850fee49985e6ef37cfd6b5cdc91430cc909b97b405cdeee201258e2d591cac938b6479e1ff2c5df2adb4d", 0xc8) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000000500000095"], &(0x7f0000000500)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r6, 0x0, 0x36, 0x0, &(0x7f0000000680)="c1188e19b95d02ff4284860186ddd712070016b67ef0f3762afeede9f909bee035cb7dde6cf4fb5a1241ee65c91e0ea151c97198e452", 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x5}, 0x50) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000002c0)='./file0\x00', 0x10, &(0x7f0000000600), 0x1, 0x59d, &(0x7f0000001100)="$eJzs3c9vFGUfAPDvs7stlAItb97kfZGDTUiERG1pwWiMiRDx5sEfJJ5IrG0hhAUaWhNBjJDgf6B/gIk3E2M8EmOIevHqzcSriSESA714WzO7s2WB3f7cMsh8PsnQ55mnk+8zu3z7zDw7MxtAaY1l/1Qi9kbEfIoY6WirRd441vq9u3euzCzduTKTotF4568UKV/X/v2U/xzON94eEb/8kOI/1YfjLly6fHa6Xp+7mNcnFs/NTyxcuvz8mXPTp+dOz52fmnxx8oUjh6eOHOrLfu6KiJ/Gj9eun3pt3zczX+755LuvbqQ4Gjvz9s796JexGFt+TTplr+tL/Q5WkGq+P51vcaoV2CHWpf3+DUTE/2IkqnHvzRuJT98qtHPAlmqkiAZQUkn+Q0m1jwOy89/2UuwRCfCo3D7WmgC4m1pze0vL+V9rzQ3G9ubcwI6lFJ3TOiki+jEzl8WYfyaNZEts0Twc0N3VaxHx/27jf2rm5mhzFj/L/8p9+V+JiDfzn9n6tzcYf+yBuvyHR2cz+f9eR/6/v8H48h8AAAAAAAD65+axiHiu2+d/leXrf6LL9T/DEXG0D/FX//yvcqsPYYAubh+LeCUi2tf+LXXkf260mtd2Na8HGEinztTnDkXE7og4GAPbsvrkCjHG9v080LOt4/q/bMnit68FzPtxq7bt/m1mpxenN7PPQMvtaxFP1brlf1oe/1OX8T8b++fXGKNx/NUfe7Wtnv/AVml8EXGg6/h/78kVaeXnc0w0jwcm2kcFD/vo5I1ve8WX/1CcbPzfsXL+j6bO5/UsrD/Gx3/+ton87378P5hONB85M5iv+3B6cfHiZMRgeuPh9VPr7zM8idr50M6XLP8P7u9+/r/S8f9QRFxdY8wT379+vVeb8R+KM3QtYnZd4//6C/vf/fzvXvHXNv4faY7pB/M15v9gZWtN0KL7CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/RpWI2BmpMr5crlTGxyOGI+K/saNSv7Cw+OypCx+cn83amt//X2l/0+9Iq57a3/8/2lGfeqB+OCL2RMRn1aFmfXzmQn226J0HAAAAAAAAAAAAAAAAAACAx8Rwj/v/M39Ui+4dsOVqRXcAKIz8h/KS/1Be8h/KS/5Decl/KC/5D+Ul/6G85D+UV7Xx9cmi+wAAAAAAAPTNnqdv/poi4urLQ80lM5i3DRTaM2CrHS26A0BhPOIHysulf1Beq53jmwOAJ19apX37hrcEAAAAAAAAAAAAAPrlwF73/0NZVYruAFCY3vf/ezIAPOnc/w/l5RwfcP8/AAAAAAAAAAAAADz+Fi5dPjtdr89d3Ghh2+Y2V1BYa+H33a3/s49Lf9ZfiNSHjHtEhaL/MgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG3/BAAA//9r5fVk") r7 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r7) 379.539186ms ago: executing program 0 (id=1243): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000c40)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d649379071c33390e418ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fcb4e0b6eab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afcc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab2e4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea508000000a0c548552b571bed5647323c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151fcda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ecec37e83efceefd7ca2533659edc8bef9cb85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d350000000000000000e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e5a61561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a2946501559335781092cf8ce987c56cd31121624d7455f2a3666276c3c0e812b28e2f30d035cee5d0e77a3c72208ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31a0445859a5ece8fb11a4ee8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463aaf28345bde0c195bc9f022ca8ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262d0af3246eb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a0600adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cd50feeb7bfad9b7be3283b6450d264e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5631820420b75b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff201000000000000002e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa66237e0dacc107f532348cc2116473381e961f3d9c8c21578fe3245097c280abe51427b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d174b0000000000000000000000fa08ad0731ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282b6caa2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae0533496b6d58da50ee80a6b9a7438978c5465113f668eb4484350048289d07dbef325d3221a7cb35f812f257941a9781e3214c2a3dcf89d99844b762a9cf17548c54fccad2c7ae8072b82e0880815daf966"], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{}], 0x8, 0x10, &(0x7f0000002e00), 0x0, 0x0, 0xfffffffd, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={r0, 0x66, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd48, 0x0, 0x0, 0x0, 0x1000000, 0x8, 0x0, 0x0}}, 0x10) 325.843599ms ago: executing program 2 (id=1244): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) prctl$PR_CAPBSET_READ(0x17, 0x80000000000000) (async, rerun: 64) r0 = perf_event_open(&(0x7f0000000680)={0x2, 0x80, 0xff, 0x8, 0xfd, 0x0, 0x0, 0x8, 0x44c5, 0x8, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7, 0x1, @perf_config_ext={0x400, 0x4}, 0x0, 0x100000000, 0xfffffffb, 0x7, 0x1, 0x1ff, 0x4, 0x0, 0x6, 0x0, 0xbba}, 0x0, 0x10, 0xffffffffffffffff, 0x4) (rerun: 64) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x7f, 0x0, 0x0, 0xb, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x100000000d07, 0x40}, 0x100b28, 0x6, 0x0, 0x1, 0x1000000008, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, r0, 0xa) (async, rerun: 32) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000700000045000000a000020095"], &(0x7f0000000800)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) (rerun: 32) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000003c0)='kfree\x00', r1}, 0x10) (async) socket$inet6(0xa, 0x2, 0x0) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0xfffffffffffffe8b, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000580)='kmem_cache_free\x00', r3}, 0x18) (async, rerun: 64) unshare(0x16030a00) (rerun: 64) r4 = socket(0x1d, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) (async) socketpair(0x1, 0x1, 0xfffffffd, 0x0) (async) r5 = socket(0x2, 0x80805, 0x0) r6 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x26, 0x1, 0x0, 0x0, 0x0, 0x7, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_config_ext={0x8, 0x6}, 0x0, 0x10000, 0x0, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) fcntl$lock(r5, 0x26, &(0x7f0000000000)={0x1, 0x4, 0x4, 0x5e}) (async, rerun: 32) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x20, 0x0, 0x0, 0x4, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, r6, 0x0) (async, rerun: 32) bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[], 0x50) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async, rerun: 64) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x2000) (async, rerun: 64) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)) r7 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={r7, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00'}, 0x18) (async) msgget$private(0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) 296.641171ms ago: executing program 0 (id=1245): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x4, 0x0, 0x7ffc1ffb}]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) sigaltstack(&(0x7f0000000140)={&(0x7f00000000c0)=""/83, 0x100000000, 0x53}, &(0x7f0000000200)={&(0x7f0000000380)=""/112, 0x0, 0x70}) 295.594191ms ago: executing program 1 (id=1246): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x3f, 0x0, 0x0, 0x0, 0xb}, 0x94) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 179.710488ms ago: executing program 1 (id=1247): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x400, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x1, 0x64}}}}, [@NL80211_ATTR_USE_RRM={0x4}, @NL80211_ATTR_FILS_KEK={0x7, 0xf2, "0ce2a8"}]}, 0x2c}}, 0x24040080) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) sendmsg$TIPC_NL_KEY_FLUSH(r0, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0xd0, r2, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1030200}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8001}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x800}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfffffffb}, @TIPC_NLA_PUBL_LOWER={0x8}]}, @TIPC_NLA_MON={0x4c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x87}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2b87f9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80000001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4008011}, 0x10) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x800000, 0x20010, 0xffffffffffffffff, 0x0) r4 = syz_io_uring_complete(r3) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f00000003c0)={'syztnl2\x00', 0x0, 0x40, 0xd0, 0x80000001, 0x7fffffff, {{0x12, 0x4, 0x0, 0x1e, 0x48, 0x67, 0x0, 0x0, 0x2d, 0x0, @loopback, @local, {[@lsrr={0x83, 0x7, 0x5, [@remote]}, @ssrr={0x89, 0x13, 0x55, [@local, @multicast2, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0xb, 0xce, [@remote, @remote]}, @rr={0x7, 0xb, 0xb0, [@dev={0xac, 0x14, 0x14, 0x2a}, @multicast1]}, @generic={0x7, 0x2}]}}}}}) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0xa8, r5, 0x200, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x19}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x16}, @MPTCP_PM_ADDR_ATTR_ID={0x5}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x100}, 0x24008041) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000600)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(r0, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x7c, r1, 0x20, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x7}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5}, @NL80211_ATTR_TSID={0x5}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x2}]}, 0x7c}}, 0x4040840) socket(0x21, 0x1, 0x9) r8 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) ioctl$BTRFS_IOC_RESIZE(r8, 0x50009403, &(0x7f0000000740)={{r4}, {@void, @max}}) symlink(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)='./file0\x00') preadv(0xffffffffffffffff, &(0x7f0000000b40)=[{&(0x7f0000000800)=""/61, 0x3d}, {&(0x7f0000000840)=""/183, 0xb7}, {&(0x7f0000000900)=""/244, 0xf4}, {&(0x7f0000000a00)=""/47, 0x2f}, {&(0x7f0000000a40)=""/211, 0xd3}], 0x5, 0x1, 0x6) r9 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000c00)=@generic={&(0x7f0000000bc0)='./file0\x00'}, 0x18) r10 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000c40)='/proc/tty/ldiscs\x00', 0x0, 0x0) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000c80)={0x2, 0x4, 0x8, 0x1, 0x80, r4, 0x0, '\x00', r6, r4, 0x5, 0x1, 0x5}, 0x50) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000d00)={0x0}, &(0x7f0000000d40)=0xc) r13 = syz_open_procfs(r12, &(0x7f0000000d80)='attr/current\x00') r14 = socket$rds(0x15, 0x5, 0x0) bind$rds(r14, &(0x7f0000000dc0)={0x2, 0x4e24, @multicast2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000e80)={{r13, 0xffffffffffffffff}, &(0x7f0000000e00), &(0x7f0000000e40)=r13}, 0x20) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000001180)={'tunl0\x00', &(0x7f0000001080)={'tunl0\x00', r6, 0x7, 0x8, 0xfffffffb, 0xc, {{0x36, 0x4, 0x1, 0x3c, 0xd8, 0x67, 0x0, 0x5, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x1b}, @rand_addr=0x64010102, {[@cipso={0x86, 0x30, 0x1, [{0x1, 0x9, "7b439ce172f58f"}, {0x6, 0xd, "0600a5f38f051ae06b03f9"}, {0x6, 0x8, "ce1346aafc66"}, {0x6, 0x6, "1456bbf6"}, {0x0, 0x6, "eab6e849"}]}, @cipso={0x86, 0x1a, 0x3, [{0x5, 0x2}, {0x7, 0x12, "87c63904d679d56acd513109c9be403a"}]}, @timestamp_prespec={0x44, 0x1c, 0xd4, 0x3, 0xb, [{@dev={0xac, 0x14, 0x14, 0x35}, 0x620e}, {@dev={0xac, 0x14, 0x14, 0x2d}, 0x93}, {@local, 0x1}]}, @noop, @timestamp={0x44, 0xc, 0x36, 0x0, 0x0, [0x2cc, 0x101]}, @lsrr={0x83, 0x17, 0x55, [@broadcast, @dev={0xac, 0x14, 0x14, 0x2a}, @dev={0xac, 0x14, 0x14, 0x42}, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0xe}]}, @timestamp_addr={0x44, 0x14, 0x54, 0x1, 0x6, [{@local, 0xffff}, {@multicast1, 0xe}]}, @lsrr={0x83, 0xb, 0xf8, [@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2]}, @timestamp_addr={0x44, 0xc, 0xad, 0x1, 0x4, [{@empty, 0x4}]}, @timestamp_addr={0x44, 0xc, 0xae, 0x1, 0xb, [{@local, 0x7}]}]}}}}}) r17 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000011c0)=0xffffffffffffffff, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001480)={r13, 0x20, &(0x7f0000001440)={&(0x7f0000001280)=""/209, 0xd1, 0x0, &(0x7f0000001380)=""/180, 0xb4}}, 0x10) r19 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000001500)=@o_path={&(0x7f00000014c0)='./file0\x00', 0x0, 0x0, r9}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000001680)={0x12, 0x14, &(0x7f0000000ec0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r15}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x7}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r9}}]}, &(0x7f0000000f80)='GPL\x00', 0x3, 0x96, &(0x7f0000000fc0)=""/150, 0x41100, 0x20, '\x00', r16, @fallback=0x7, r17, 0x8, &(0x7f0000001200)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000001240)={0x3, 0x10, 0x2, 0x2}, 0x10, r18, r19, 0x4, &(0x7f0000001600)=[0xffffffffffffffff, r9, r13, r11, r13, r10, r9], &(0x7f0000001640)=[{0x1, 0x4, 0xe, 0x8}, {0x0, 0x2, 0x1, 0xf}, {0x5, 0x4, 0x3, 0x9}, {0x2, 0x3, 0x0, 0xc}], 0x10, 0x36c}, 0x94) 156.02007ms ago: executing program 0 (id=1248): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000280)=r1}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x33}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x0) r4 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f00000001c0)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300", 0xfffffffb}, 0x48, 0xffffffffffffffff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xa6426000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) shutdown(0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(r2, 0xc02054a5, &(0x7f0000000340)={0x5, r1, 'id1\x00'}) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000400)='sys_enter\x00', r5}, 0x18) removexattr(0x0, 0x0) r6 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x4) r7 = add_key$fscrypt_v1(&(0x7f0000000240), &(0x7f0000000200)={'fscrypt:', @auto=[0x34, 0x37, 0x65, 0x34, 0x39, 0x31, 0x33, 0x0, 0x66, 0x36, 0x5c, 0x33, 0x30, 0x61, 0x66, 0x61]}, &(0x7f00000002c0)={0x0, "6035ae1e0fe721441705322225930e6c1e3e2a51a92fd780bc34d7cf6e0236805b4377f7ab1a9b01c103a4c6a7ef54e6763fd7264c39ea00c508ba6062696138", 0x18}, 0x48, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x4, r7, r6, r6, 0x0) keyctl$KEYCTL_MOVE(0x4, r4, r4, 0x0, 0x0) symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') 81.624785ms ago: executing program 2 (id=1249): r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x42, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x13f, 0x4}}, 0x20) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b000000070000c1a0a1f914fc8ccea952bc2ac70b00080000000800000005ce079b50d1b3679106921a6b8b2f2711f2b833b63f9ffae1232d9e86080a4e20896e58e6252c3bb8a7bb46095af286762d0a8bfcde1cf3d5e9a3784645fd2cfcd325ac080771adb8d4c8a150f27a721ec86a35e647c28ea1134c4bc840fdc7c1643fa07003e6b221011d7fb5012a987df5dd822cdb47fb8aab292c10bb30576c49c4a59b9cd972002dd571df1fb9eabfc9a46c10728e7ab3"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r1, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r2, 0x0, 0x10007ffffffff}, 0x18) lseek(r0, 0x5, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1801000000000800000000005e002200850000006d00000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='kmem_cache_free\x00', r3}, 0x10) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r7, 0x40042408, r8) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xfc}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="010000000b000000050010000200000000000000", @ANYRES32, @ANYBLOB="0000000000000002000000040000000000000000", @ANYRES32=r10, @ANYRES32, @ANYBLOB="0000000002400000000000000000"], 0x50) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1004403, &(0x7f0000000300)={[], [{@appraise}, {@hash}]}, 0x2, 0x5be, &(0x7f0000000f80)="$eJzs3c9vVNUeAPDvvTMtlL732kdenuLCNBoCidLSAgZ/LGBPCP7YubFCIcjwI7RGiyaWBDcmxo0LElcuxP9CiW5dmbhw4caVIUFj2GiMjrkzd4ahnWmH0uHW3s8nuZ1z7rnTcy70O+fMvefMBFBaE9mPNGJXRFxKIsY6yqqRF040j7vz67snsy2Jev3lX5JI8n2t45P8cTR/8p9jEd9+lcTOysp65xevnJut1eYu5/mphfOXpuYXr+w7e372zNyZuQszz8wcPnTw0OHp/Q90fmlH+ti1N94a++D4q5998kcy/fkPx5M4Ej+fbpZ1nsdGmYiJ+K1ef2/5/uzf9fBGV1aQSvvv5K5k+Q42rWoeI8MR8UiMRaXjf3Ms3n+x0MYBA1VPIupASSXiH0qqNQ5ovbfv731wOuBRCfAw3D6a/RzqEv/V5rXBGI+hiNi97HldLumtS1bHN18fv5ZtMaDrcEB3S1e35anl8Z80YnM8tjdyO+6k91znzUYAJ/LHbP9L66x/Ylle/MPDs3Q1Ih7tNv5fO/5f64j/19dZv/gHAAAAAACAjXPzaEQ83e3+X5rfm9seTzTu/yXN+3/f3V0heGQD6l/7/l96awOqAbq4fTTiha7zf9tzfMcree7fzdmAyemztbn9EfGfiNgbQ9uy/PQqdez7cOf1XmWd8/+yLau/NRcwb8et6rZ7n3NqdmH2Qc4ZaLp9NeKxau/5P1n/n3T2/7ns9eBSn3Xs3H3jRK+yteMfGJT6pxF7uvb/SfuYZPXP55hqjAemWqOClR5/56MvetUv/qE4Wf+/Y/X4H086P69n/v5+/3BEHFis1nuVr3f8P5y8Umn9/szbswsLl6cjhpNjK/fP3F+bYatqxUMrXrL43/vk6tf/2uP/jjgciYilPuv8/1+jP/Yq0/9DcbL4H8nT/fX/95+YuTH+Za/6++v/Dzb69L35Htf/YHX9BmjR7QQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAf6I0Iv4VSTrZTqfp5GTEaET8L3aktYvzC0+dvvjmhVNZWeP7/9PWN/2ONfNJ6/v/xzvyM8vyByLivxHxcWWkkZ88ebF2quiTBwAAAAAAAAAAAAAAAAAAgE1itMf6/8xPlaJbBwxcNX8U71A+1aIbABRG/EN5iX8or874XyiwHcDDp/+H8lpn/LtdAFuA/h/Kaqi/w7YPuh1AEfT/AAAAAACwpdx8/tnrSUQsPTfS2DLDeVn7xuBIUa0DBiktugFAYczhhfIy9QfKq8/Jv8AWlrRTv9e7lfee/Z8MpkEAAAAAAAAAAAAAwAp7dt38fs31/8CWZP0/lJf1/1Be1v9DeXmPD6y1ir+v9f9dPzmgg8EGAAAAAAAAAAAAADyQ+cUr52ZrtbnLEhKbLTEUEZugGQUkhosPz4JfmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgLa/AwAA//9FPyNW") sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000100001000000f5ffffffffffffff000a14000000060a0000000000000000000002"], 0x3c}}, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000000)='\x06\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xd9z\x81\x91\x8aP}I\xc6\x0e\xd9\v\xda\xbfS\x16 \x04\r\xcd\xdb:\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x00 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 103.527256][ T6216] RSP: 002b:00007fcadb117038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 103.527281][ T6216] RAX: ffffffffffffffda RBX: 00007fcadc905fa0 RCX: 00007fcadc6aefc9 [ 103.527297][ T6216] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 0000000000000000 [ 103.527314][ T6216] RBP: 00007fcadb117090 R08: 0000000000000000 R09: 0000000000000000 [ 103.527328][ T6216] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 103.527374][ T6216] R13: 00007fcadc906038 R14: 00007fcadc905fa0 R15: 00007fffcbd75d48 [ 103.527398][ T6216] [ 103.647425][ T6218] netlink: 8 bytes leftover after parsing attributes in process `syz.0.905'. [ 103.665802][ T37] EXT4-fs warning (device loop1): ext4_convert_unwritten_extents:4984: inode #15: block 1: len 15: ext4_ext_map_blocks returned -30 [ 103.679369][ T29] kauditd_printk_skb: 276 callbacks suppressed [ 103.679388][ T29] audit: type=1326 audit(103.658:3173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6217 comm="syz.0.905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcadc6aefc9 code=0x7ffc0000 [ 103.702350][ T6197] syz.2.898: attempt to access beyond end of device [ 103.702350][ T6197] loop2: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 103.782470][ T6197] Buffer I/O error on dev loop2, logical block 128, lost async page write [ 103.791469][ T29] audit: type=1326 audit(103.688:3174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6217 comm="syz.0.905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fcadc6aefc9 code=0x7ffc0000 [ 103.814265][ T29] audit: type=1326 audit(103.688:3175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6217 comm="syz.0.905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcadc6aefc9 code=0x7ffc0000 [ 103.837097][ T29] audit: type=1326 audit(103.688:3176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6217 comm="syz.0.905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fcadc6aefc9 code=0x7ffc0000 [ 103.859822][ T29] audit: type=1326 audit(103.688:3177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6217 comm="syz.0.905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcadc6aefc9 code=0x7ffc0000 [ 103.875503][ T6199] syz.2.898: attempt to access beyond end of device [ 103.875503][ T6199] loop2: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 103.882592][ T29] audit: type=1326 audit(103.688:3178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6217 comm="syz.0.905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fcadc6aefc9 code=0x7ffc0000 [ 103.882622][ T29] audit: type=1326 audit(103.698:3179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6217 comm="syz.0.905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcadc6aefc9 code=0x7ffc0000 [ 103.895964][ T6199] Buffer I/O error on dev loop2, logical block 128, lost async page write [ 103.918669][ T29] audit: type=1326 audit(103.698:3180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6217 comm="syz.0.905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcadc6aefc9 code=0x7ffc0000 [ 103.972507][ T29] audit: type=1326 audit(103.698:3181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6217 comm="syz.0.905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fcadc6aefc9 code=0x7ffc0000 [ 103.995337][ T29] audit: type=1326 audit(103.698:3182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6217 comm="syz.0.905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcadc6aefc9 code=0x7ffc0000 [ 104.034985][ T6214] syz.1.902 (6214) used greatest stack depth: 10224 bytes left [ 104.055176][ T3313] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 104.192302][ T6236] loop1: detected capacity change from 0 to 1024 [ 104.200609][ T6236] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.909: Failed to acquire dquot type 0 [ 104.220736][ T6236] EXT4-fs error (device loop1): mb_free_blocks:2017: group 0, inode 13: block 144:freeing already freed block (bit 9); block bitmap corrupt. [ 104.258775][ T6236] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #13: comm syz.1.909: corrupted inode contents [ 104.281020][ T6236] EXT4-fs error (device loop1): ext4_dirty_inode:6517: inode #13: comm syz.1.909: mark_inode_dirty error [ 104.355589][ T6236] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #13: comm syz.1.909: corrupted inode contents [ 104.387723][ T6249] loop2: detected capacity change from 0 to 512 [ 104.399613][ T6236] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #13: comm syz.1.909: mark_inode_dirty error [ 104.405308][ T6231] lo speed is unknown, defaulting to 1000 [ 104.414012][ T6236] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #13: comm syz.1.909: corrupted inode contents [ 104.430647][ T6236] EXT4-fs error (device loop1) in ext4_orphan_del:301: Corrupt filesystem [ 104.444006][ T6249] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 104.445246][ T6236] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #13: comm syz.1.909: corrupted inode contents [ 104.452162][ T6249] EXT4-fs (loop2): orphan cleanup on readonly fs [ 104.464699][ T6236] EXT4-fs error (device loop1): ext4_truncate:4637: inode #13: comm syz.1.909: mark_inode_dirty error [ 104.487086][ T6236] EXT4-fs error (device loop1) in ext4_process_orphan:343: Corrupt filesystem [ 104.495150][ T6249] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #16: comm syz.2.916: corrupted inode contents [ 104.496855][ T6236] EXT4-fs (loop1): 1 truncate cleaned up [ 104.515341][ T6236] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 104.516185][ T6249] EXT4-fs (loop2): Remounting filesystem read-only [ 104.528883][ T6236] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 104.542725][ T6249] EXT4-fs (loop2): 1 truncate cleaned up [ 104.549309][ T37] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 104.556157][ T6231] chnl_net:caif_netlink_parms(): no params data found [ 104.559874][ T37] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 104.577474][ T37] EXT4-fs (loop2): Quota write (off=8, len=24) cancelled because transaction is not started [ 104.588290][ T6249] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 104.606961][ T6249] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 104.650445][ T6231] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.657680][ T6231] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.665051][ T6231] bridge_slave_0: entered allmulticast mode [ 104.672488][ T6231] bridge_slave_0: entered promiscuous mode [ 104.680007][ T6231] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.687190][ T6231] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.710618][ T6231] bridge_slave_1: entered allmulticast mode [ 104.718350][ T6260] loop2: detected capacity change from 0 to 128 [ 104.725253][ T6231] bridge_slave_1: entered promiscuous mode [ 104.759061][ T6231] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.770028][ T6231] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.795497][ T6231] team0: Port device team_slave_0 added [ 104.802540][ T6231] team0: Port device team_slave_1 added [ 104.829479][ T6231] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.836591][ T6231] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.862578][ T6231] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.884411][ T6231] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.891422][ T6231] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.917480][ T6231] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.961670][ T6231] hsr_slave_0: entered promiscuous mode [ 104.968577][ T6231] hsr_slave_1: entered promiscuous mode [ 104.975528][ T6231] debugfs: 'hsr0' already exists in 'hsr' [ 104.981378][ T6231] Cannot create hsr debugfs directory [ 104.989372][ T6261] lo speed is unknown, defaulting to 1000 [ 105.093443][ T6277] netlink: 4 bytes leftover after parsing attributes in process `syz.3.919'. [ 105.129200][ T6260] syz.2.918: attempt to access beyond end of device [ 105.129200][ T6260] loop2: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 105.142675][ T6260] Buffer I/O error on dev loop2, logical block 128, lost async page write [ 105.154209][ T6231] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.175445][ T6261] chnl_net:caif_netlink_parms(): no params data found [ 105.187585][ T6260] syz.2.918: attempt to access beyond end of device [ 105.187585][ T6260] loop2: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 105.201095][ T6260] Buffer I/O error on dev loop2, logical block 128, lost async page write [ 105.224135][ T6283] netlink: 19 bytes leftover after parsing attributes in process `syz.3.921'. [ 105.240662][ T6231] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.292203][ T6231] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.332156][ T6261] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.339431][ T6261] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.343625][ T6290] loop2: detected capacity change from 0 to 4096 [ 105.347060][ T6261] bridge_slave_0: entered allmulticast mode [ 105.360150][ T6261] bridge_slave_0: entered promiscuous mode [ 105.366843][ T6290] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 105.382625][ T6231] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.394608][ T6261] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.401696][ T6261] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.409105][ T6261] bridge_slave_1: entered allmulticast mode [ 105.416092][ T6261] bridge_slave_1: entered promiscuous mode [ 105.441844][ T6261] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 105.458000][ T6261] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 105.495235][ T3321] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 105.521812][ T6231] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 105.535997][ T6261] team0: Port device team_slave_0 added [ 105.544634][ T6231] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 105.559017][ T6261] team0: Port device team_slave_1 added [ 105.569312][ T6231] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 105.584211][ T6300] loop2: detected capacity change from 0 to 512 [ 105.606966][ T6300] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 105.615186][ T6300] EXT4-fs (loop2): orphan cleanup on readonly fs [ 105.622223][ T6231] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.623049][ T6300] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #16: comm syz.2.925: corrupted inode contents [ 105.641981][ T6300] EXT4-fs (loop2): Remounting filesystem read-only [ 105.649654][ T6300] EXT4-fs (loop2): 1 truncate cleaned up [ 105.655942][ T6261] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.662911][ T6261] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.663780][ T6113] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 105.688914][ T6261] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.699418][ T6113] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 105.720743][ T6113] EXT4-fs (loop2): Quota write (off=8, len=24) cancelled because transaction is not started [ 105.731509][ T6300] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 105.745760][ T6300] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 105.747152][ T6261] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.761752][ T6261] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.787794][ T6261] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.814167][ T6113] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.879198][ T6261] hsr_slave_0: entered promiscuous mode [ 105.894527][ T6261] hsr_slave_1: entered promiscuous mode [ 105.900675][ T6261] debugfs: 'hsr0' already exists in 'hsr' [ 105.906551][ T6261] Cannot create hsr debugfs directory [ 106.001537][ T6113] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.031322][ T6320] netlink: 4 bytes leftover after parsing attributes in process `syz.1.931'. [ 106.048703][ T6113] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.090831][ T6231] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.111678][ T6113] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.132048][ T6231] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.155418][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.162551][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.205410][ T3450] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.212519][ T3450] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.224682][ T6332] netlink: 19 bytes leftover after parsing attributes in process `syz.2.936'. [ 106.224847][ T6334] loop1: detected capacity change from 0 to 128 [ 106.250727][ T6334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.263140][ T6334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.273141][ T6113] bridge_slave_1: left allmulticast mode [ 106.278862][ T6113] bridge_slave_1: left promiscuous mode [ 106.284726][ T6113] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.292685][ T6113] bridge_slave_0: left allmulticast mode [ 106.298467][ T6113] bridge_slave_0: left promiscuous mode [ 106.304224][ T6113] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.404209][ T6353] loop2: detected capacity change from 0 to 512 [ 106.417296][ T6353] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 106.425451][ T6353] EXT4-fs (loop2): orphan cleanup on readonly fs [ 106.432226][ T6113] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 106.433194][ T6353] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #16: comm syz.2.938: corrupted inode contents [ 106.453050][ T6353] EXT4-fs (loop2): Remounting filesystem read-only [ 106.459805][ T6353] EXT4-fs (loop2): 1 truncate cleaned up [ 106.460029][ T6113] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 106.474405][ T289] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 106.475598][ T6113] bond0 (unregistering): Released all slaves [ 106.485020][ T289] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 106.485785][ T289] EXT4-fs (loop2): Quota write (off=8, len=24) cancelled because transaction is not started [ 106.512442][ T6353] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 106.525960][ T6353] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 106.560357][ T6113] hsr_slave_0: left promiscuous mode [ 106.566868][ T6113] hsr_slave_1: left promiscuous mode [ 106.572593][ T6113] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 106.580145][ T6113] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 106.588855][ T6113] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 106.596300][ T6113] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 106.609490][ T6113] veth1_macvtap: left promiscuous mode [ 106.615260][ T6113] veth0_macvtap: left promiscuous mode [ 106.620858][ T6113] veth1_vlan: left promiscuous mode [ 106.624134][ T6359] loop2: detected capacity change from 0 to 512 [ 106.626843][ T6113] veth0_vlan: left promiscuous mode [ 106.646773][ T6359] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 106.659098][ T6359] EXT4-fs (loop2): orphan cleanup on readonly fs [ 106.667099][ T6359] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #16: comm syz.2.939: corrupted inode contents [ 106.679555][ T6359] EXT4-fs (loop2): Remounting filesystem read-only [ 106.687742][ T6359] EXT4-fs (loop2): 1 truncate cleaned up [ 106.693579][ T3450] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 106.704467][ T3450] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 106.715273][ T3450] EXT4-fs (loop2): Quota write (off=8, len=24) cancelled because transaction is not started [ 106.726334][ T6359] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 106.740551][ T6359] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 106.749894][ T6113] team0 (unregistering): Port device team_slave_1 removed [ 106.765640][ T6113] team0 (unregistering): Port device team_slave_0 removed [ 106.831503][ T6231] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.917448][ T6231] veth0_vlan: entered promiscuous mode [ 106.926530][ T6231] veth1_vlan: entered promiscuous mode [ 106.945121][ T6231] veth0_macvtap: entered promiscuous mode [ 106.952217][ T6231] veth1_macvtap: entered promiscuous mode [ 106.966328][ T6231] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.979087][ T6231] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.990616][ T289] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.999635][ T289] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.008629][ T289] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.018027][ T289] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.082706][ T6261] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 107.114032][ T6261] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 107.141599][ T6261] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 107.246323][ T6261] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 107.359841][ T6113] bridge_slave_1: left allmulticast mode [ 107.365648][ T6113] bridge_slave_1: left promiscuous mode [ 107.371390][ T6113] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.380931][ T6113] bridge_slave_0: left allmulticast mode [ 107.386963][ T6113] bridge_slave_0: left promiscuous mode [ 107.392800][ T6113] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.467559][ T6432] netlink: 4 bytes leftover after parsing attributes in process `syz.1.942'. [ 107.486243][ T6113] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 107.496816][ T6113] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 107.506649][ T6113] bond0 (unregistering): Released all slaves [ 107.531132][ T6261] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.583202][ T6113] hsr_slave_0: left promiscuous mode [ 107.589507][ T6113] hsr_slave_1: left promiscuous mode [ 107.595222][ T6113] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 107.602645][ T6113] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 107.610280][ T6113] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 107.617735][ T6113] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 107.628313][ T6113] veth1_macvtap: left promiscuous mode [ 107.633851][ T6113] veth0_macvtap: left promiscuous mode [ 107.639403][ T6113] veth1_vlan: left promiscuous mode [ 107.644899][ T6113] veth0_vlan: left promiscuous mode [ 107.695682][ T6438] netlink: 36 bytes leftover after parsing attributes in process `syz.2.944'. [ 107.735667][ T6113] team0 (unregistering): Port device team_slave_1 removed [ 107.746756][ T6113] team0 (unregistering): Port device team_slave_0 removed [ 107.796754][ T6261] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.811896][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.819024][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.834967][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.842074][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.919466][ T6261] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.109761][ T6261] veth0_vlan: entered promiscuous mode [ 108.116653][ T6464] loop1: detected capacity change from 0 to 2048 [ 108.132163][ T6261] veth1_vlan: entered promiscuous mode [ 108.155662][ T6464] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 108.181643][ T6261] veth0_macvtap: entered promiscuous mode [ 108.201475][ T6474] netlink: 19 bytes leftover after parsing attributes in process `syz.2.952'. [ 108.205899][ T6261] veth1_macvtap: entered promiscuous mode [ 108.246392][ T6261] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.260473][ T6261] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.270961][ T52] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.273802][ T6478] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.949: bg 0: block 345: padding at end of block bitmap is not set [ 108.286060][ T6480] netlink: 4 bytes leftover after parsing attributes in process `syz.0.953'. [ 108.303090][ T6478] EXT4-fs (loop1): Remounting filesystem read-only [ 108.313968][ T289] EXT4-fs warning (device loop1): ext4_convert_unwritten_extents:4984: inode #15: block 1: len 15: ext4_ext_map_blocks returned -30 [ 108.335446][ T52] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.348784][ T3390] IPVS: starting estimator thread 0... [ 108.386354][ T6480] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 108.393916][ T6480] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 108.407914][ T3313] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 108.418243][ T6480] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 108.425745][ T6480] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 108.448237][ T3450] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.464242][ T6483] IPVS: using max 2496 ests per chain, 124800 per kthread [ 108.469973][ T3450] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.552241][ T6494] netlink: 8 bytes leftover after parsing attributes in process `syz.5.917'. [ 108.800891][ T6486] lo speed is unknown, defaulting to 1000 [ 108.850417][ T29] kauditd_printk_skb: 285 callbacks suppressed [ 108.850433][ T29] audit: type=1400 audit(108.828:3442): avc: denied { read } for pid=6481 comm="syz.2.954" name="loop-control" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 108.880316][ T29] audit: type=1400 audit(108.828:3443): avc: denied { open } for pid=6481 comm="syz.2.954" path="/dev/loop-control" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 109.313172][ T6506] loop3: detected capacity change from 0 to 4096 [ 109.325741][ T6506] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 109.378229][ T29] audit: type=1326 audit(109.358:3444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6512 comm="syz.2.963" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 109.401060][ T29] audit: type=1326 audit(109.358:3445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6512 comm="syz.2.963" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 109.430387][ T29] audit: type=1326 audit(109.378:3446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6512 comm="syz.2.963" exe="/root/syz-executor" sig=0 arch=c000003e syscall=210 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 109.437570][ T6513] netlink: 19 bytes leftover after parsing attributes in process `syz.2.963'. [ 109.453309][ T29] audit: type=1326 audit(109.378:3447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6512 comm="syz.2.963" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 109.484937][ T29] audit: type=1326 audit(109.378:3448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6512 comm="syz.2.963" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 109.508043][ T29] audit: type=1326 audit(109.378:3449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6512 comm="syz.2.963" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 109.530811][ T29] audit: type=1326 audit(109.378:3450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6512 comm="syz.2.963" exe="/root/syz-executor" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 109.553761][ T29] audit: type=1326 audit(109.408:3451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6512 comm="syz.2.963" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 109.581548][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 109.600478][ T6517] SELinux: Context WXE][O:Ѹo߭ObZDfq :~ is not valid (left unmapped). [ 109.785379][ T52] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.930121][ T6535] lo speed is unknown, defaulting to 1000 [ 109.986772][ T6535] chnl_net:caif_netlink_parms(): no params data found [ 110.027605][ T6535] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.034871][ T6535] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.042149][ T6535] bridge_slave_0: entered allmulticast mode [ 110.048975][ T6535] bridge_slave_0: entered promiscuous mode [ 110.055932][ T6535] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.063017][ T6535] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.070605][ T6535] bridge_slave_1: entered allmulticast mode [ 110.077034][ T6535] bridge_slave_1: entered promiscuous mode [ 110.095773][ T6535] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 110.106471][ T6535] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 110.126346][ T6535] team0: Port device team_slave_0 added [ 110.133121][ T6535] team0: Port device team_slave_1 added [ 110.151482][ T6535] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 110.158516][ T6535] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.184479][ T6535] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 110.195884][ T6535] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 110.202926][ T6535] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.229152][ T6535] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 110.258164][ T6535] hsr_slave_0: entered promiscuous mode [ 110.264326][ T6535] hsr_slave_1: entered promiscuous mode [ 110.270246][ T6535] debugfs: 'hsr0' already exists in 'hsr' [ 110.276006][ T6535] Cannot create hsr debugfs directory [ 110.553554][ T6554] loop3: detected capacity change from 0 to 512 [ 110.566013][ T6554] ext4: Unknown parameter 'pcr' [ 110.633423][ T6556] loop2: detected capacity change from 0 to 1024 [ 110.651344][ T6556] EXT4-fs error (device loop2): ext4_acquire_dquot:6945: comm syz.2.974: Failed to acquire dquot type 0 [ 110.686885][ T6556] EXT4-fs error (device loop2): mb_free_blocks:2017: group 0, inode 13: block 144:freeing already freed block (bit 9); block bitmap corrupt. [ 110.704019][ T6556] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #13: comm syz.2.974: corrupted inode contents [ 110.704379][ T6562] __nla_validate_parse: 2 callbacks suppressed [ 110.704390][ T6562] netlink: 88 bytes leftover after parsing attributes in process `syz.0.977'. [ 110.717729][ T6556] EXT4-fs error (device loop2): ext4_dirty_inode:6517: inode #13: comm syz.2.974: mark_inode_dirty error [ 110.721995][ T6562] netlink: 88 bytes leftover after parsing attributes in process `syz.0.977'. [ 110.764109][ T6556] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #13: comm syz.2.974: corrupted inode contents [ 110.795314][ T6564] netlink: 19 bytes leftover after parsing attributes in process `syz.0.978'. [ 110.804681][ T6556] EXT4-fs error (device loop2): __ext4_ext_dirty:206: inode #13: comm syz.2.974: mark_inode_dirty error [ 110.817805][ T6556] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #13: comm syz.2.974: corrupted inode contents [ 110.829975][ T6556] EXT4-fs error (device loop2) in ext4_orphan_del:301: Corrupt filesystem [ 110.838800][ T6556] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #13: comm syz.2.974: corrupted inode contents [ 110.850780][ T6556] EXT4-fs error (device loop2): ext4_truncate:4637: inode #13: comm syz.2.974: mark_inode_dirty error [ 110.862332][ T6556] EXT4-fs error (device loop2) in ext4_process_orphan:343: Corrupt filesystem [ 110.881312][ T6556] EXT4-fs (loop2): 1 truncate cleaned up [ 110.887947][ T6556] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 110.908309][ T6556] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 111.211458][ T52] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.416529][ T52] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.456443][ T52] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.516496][ T52] bridge_slave_1: left allmulticast mode [ 111.522288][ T52] bridge_slave_1: left promiscuous mode [ 111.528032][ T52] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.535910][ T52] bridge_slave_0: left allmulticast mode [ 111.541554][ T52] bridge_slave_0: left promiscuous mode [ 111.547314][ T52] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.635917][ T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 111.646072][ T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 111.656274][ T52] bond0 (unregistering): Released all slaves [ 111.712747][ T52] hsr_slave_0: left promiscuous mode [ 111.724320][ T52] hsr_slave_1: left promiscuous mode [ 111.734087][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 111.741509][ T52] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 111.757485][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 111.765019][ T52] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 111.783171][ T52] veth1_macvtap: left promiscuous mode [ 111.791460][ T52] veth0_macvtap: left promiscuous mode [ 111.799793][ T52] veth1_vlan: left promiscuous mode [ 111.806297][ T52] veth0_vlan: left promiscuous mode [ 111.906251][ T52] team0 (unregistering): Port device team_slave_1 removed [ 111.917020][ T52] team0 (unregistering): Port device team_slave_0 removed [ 111.999885][ T6607] loop1: detected capacity change from 0 to 4096 [ 112.018070][ T6607] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 112.106642][ T6621] netlink: 19 bytes leftover after parsing attributes in process `syz.0.990'. [ 112.108151][ T3313] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 112.188714][ T6633] loop0: detected capacity change from 0 to 128 [ 112.198748][ T6631] loop1: detected capacity change from 0 to 512 [ 112.216294][ T6631] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 112.225675][ T6631] EXT4-fs (loop1): orphan cleanup on readonly fs [ 112.235643][ T6535] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 112.245332][ T6633] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 112.262216][ T6640] loop3: detected capacity change from 0 to 128 [ 112.269045][ T6633] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 112.273645][ T6535] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 112.298288][ T6631] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #16: comm syz.1.993: corrupted inode contents [ 112.306158][ T6535] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 112.333970][ T6631] EXT4-fs (loop1): Remounting filesystem read-only [ 112.336628][ T6535] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 112.344047][ T6631] EXT4-fs (loop1): 1 truncate cleaned up [ 112.354690][ T3326] EXT4-fs (loop1): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 112.365278][ T3326] EXT4-fs (loop1): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 112.376335][ T3326] EXT4-fs (loop1): Quota write (off=8, len=24) cancelled because transaction is not started [ 112.393369][ T6631] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 112.406965][ T6631] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 112.518410][ T6669] netlink: 28 bytes leftover after parsing attributes in process `syz.1.995'. [ 112.579037][ T6535] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.676604][ T6648] syz.3.994: attempt to access beyond end of device [ 112.676604][ T6648] loop3: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 112.690073][ T6648] Buffer I/O error on dev loop3, logical block 128, lost async page write [ 112.701846][ T6675] loop1: detected capacity change from 0 to 1024 [ 112.717111][ T6535] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.727406][ T6640] syz.3.994: attempt to access beyond end of device [ 112.727406][ T6640] loop3: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 112.740883][ T6640] Buffer I/O error on dev loop3, logical block 128, lost async page write [ 112.769488][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.776601][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.798186][ T6675] EXT4-fs error (device loop1): ext4_acquire_dquot:6945: comm syz.1.997: Failed to acquire dquot type 0 [ 112.825952][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.833066][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.904947][ T6675] EXT4-fs error (device loop1): mb_free_blocks:2017: group 0, inode 13: block 144:freeing already freed block (bit 9); block bitmap corrupt. [ 112.905223][ T6640] syz.3.994: attempt to access beyond end of device [ 112.905223][ T6640] loop3: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 112.932827][ T6640] Buffer I/O error on dev loop3, logical block 128, lost async page write [ 112.943278][ T6675] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #13: comm syz.1.997: corrupted inode contents [ 112.957516][ T6675] EXT4-fs error (device loop1): ext4_dirty_inode:6517: inode #13: comm syz.1.997: mark_inode_dirty error [ 112.984294][ T6675] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #13: comm syz.1.997: corrupted inode contents [ 113.005824][ T6675] EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #13: comm syz.1.997: mark_inode_dirty error [ 113.017459][ T6675] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #13: comm syz.1.997: corrupted inode contents [ 113.035766][ T6535] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 113.044567][ T6675] EXT4-fs error (device loop1) in ext4_orphan_del:301: Corrupt filesystem [ 113.053371][ T6675] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #13: comm syz.1.997: corrupted inode contents [ 113.088328][ T6675] EXT4-fs error (device loop1): ext4_truncate:4637: inode #13: comm syz.1.997: mark_inode_dirty error [ 113.114769][ T6675] EXT4-fs error (device loop1) in ext4_process_orphan:343: Corrupt filesystem [ 113.129144][ T6701] loop3: detected capacity change from 0 to 512 [ 113.149591][ T6675] EXT4-fs (loop1): 1 truncate cleaned up [ 113.157938][ T6701] EXT4-fs error (device loop3): ext4_orphan_get:1392: inode #13: comm syz.3.1001: iget: bad i_size value: 12154757448730 [ 113.176393][ T6701] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.1001: couldn't read orphan inode 13 (err -117) [ 113.192454][ T6675] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 113.220251][ T6675] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.230297][ T6701] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 113.246439][ T6708] loop0: detected capacity change from 0 to 4096 [ 113.280859][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.287127][ T6535] veth0_vlan: entered promiscuous mode [ 113.295211][ T6708] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 113.317075][ T6535] veth1_vlan: entered promiscuous mode [ 113.334869][ T6535] veth0_macvtap: entered promiscuous mode [ 113.342514][ T6535] veth1_macvtap: entered promiscuous mode [ 113.354534][ T6535] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 113.374464][ T6535] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.385748][ T3326] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.394814][ T3326] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.404085][ T3326] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.413105][ T3326] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.437050][ T6231] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.490010][ T6722] loop5: detected capacity change from 0 to 128 [ 113.516147][ T6724] loop0: detected capacity change from 0 to 2048 [ 113.536560][ T6724] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 113.621677][ T6728] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.1007: bg 0: block 345: padding at end of block bitmap is not set [ 113.636866][ T6728] EXT4-fs (loop0): Remounting filesystem read-only [ 113.643445][ T37] EXT4-fs warning (device loop0): ext4_convert_unwritten_extents:4984: inode #15: block 1: len 15: ext4_ext_map_blocks returned -30 [ 113.710930][ T6231] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.829730][ T6727] syz.5.1006: attempt to access beyond end of device [ 113.829730][ T6727] loop5: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 113.843251][ T6727] Buffer I/O error on dev loop5, logical block 128, lost async page write [ 113.858621][ T6722] syz.5.1006: attempt to access beyond end of device [ 113.858621][ T6722] loop5: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 113.872291][ T6722] Buffer I/O error on dev loop5, logical block 128, lost async page write [ 113.884828][ T6733] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1009'. [ 113.886955][ T6738] loop2: detected capacity change from 0 to 512 [ 113.900128][ T29] kauditd_printk_skb: 169 callbacks suppressed [ 113.900139][ T29] audit: type=1326 audit(113.876:3611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6732 comm="syz.0.1009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5bd9b3efc9 code=0x7ffc0000 [ 113.929469][ T29] audit: type=1326 audit(113.876:3612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6732 comm="syz.0.1009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5bd9b3efc9 code=0x7ffc0000 [ 113.952394][ T29] audit: type=1326 audit(113.876:3613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6732 comm="syz.0.1009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5bd9b3efc9 code=0x7ffc0000 [ 113.975281][ T29] audit: type=1326 audit(113.876:3614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6732 comm="syz.0.1009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5bd9b3efc9 code=0x7ffc0000 [ 113.998164][ T29] audit: type=1326 audit(113.876:3615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6732 comm="syz.0.1009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5bd9b3efc9 code=0x7ffc0000 [ 114.021061][ T29] audit: type=1326 audit(113.876:3616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6732 comm="syz.0.1009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5bd9b3efc9 code=0x7ffc0000 [ 114.045736][ T29] audit: type=1326 audit(113.876:3617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6732 comm="syz.0.1009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5bd9b3efc9 code=0x7ffc0000 [ 114.068661][ T29] audit: type=1326 audit(113.876:3618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6732 comm="syz.0.1009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f5bd9b3efc9 code=0x7ffc0000 [ 114.091444][ T29] audit: type=1326 audit(113.876:3619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6732 comm="syz.0.1009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5bd9b3efc9 code=0x7ffc0000 [ 114.114357][ T29] audit: type=1326 audit(113.876:3620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6732 comm="syz.0.1009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5bd9b3efc9 code=0x7ffc0000 [ 114.149329][ T6738] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 114.158046][ T6738] EXT4-fs (loop2): orphan cleanup on readonly fs [ 114.171375][ T6738] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #16: comm syz.2.1011: corrupted inode contents [ 114.244003][ T6738] EXT4-fs (loop2): Remounting filesystem read-only [ 114.250730][ T6738] EXT4-fs (loop2): 1 truncate cleaned up [ 114.262657][ T289] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 114.273339][ T289] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 114.325904][ T6750] loop3: detected capacity change from 0 to 512 [ 114.347990][ T6752] loop1: detected capacity change from 0 to 128 [ 114.349229][ T289] EXT4-fs (loop2): Quota write (off=8, len=24) cancelled because transaction is not started [ 114.356831][ T6752] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.375504][ T6752] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.389833][ T6750] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 114.402202][ T6750] EXT4-fs (loop3): orphan cleanup on readonly fs [ 114.412187][ T6113] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.427884][ T6738] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 114.444489][ T6750] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #16: comm syz.3.1016: corrupted inode contents [ 114.460341][ T6750] EXT4-fs (loop3): Remounting filesystem read-only [ 114.467799][ T6750] EXT4-fs (loop3): 1 truncate cleaned up [ 114.473580][ T52] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 114.484174][ T52] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 114.494485][ T6738] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 114.494914][ T52] EXT4-fs (loop3): Quota write (off=8, len=24) cancelled because transaction is not started [ 114.518099][ T6113] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.530669][ T6750] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 114.547443][ T6750] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 114.566735][ T6113] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.637999][ T6113] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.662248][ T6761] loop2: detected capacity change from 0 to 512 [ 114.710223][ T6761] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 114.723976][ T6761] EXT4-fs (loop2): orphan cleanup on readonly fs [ 114.755644][ T6761] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #16: comm syz.2.1020: corrupted inode contents [ 114.786421][ T6764] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1022'. [ 114.805849][ T6113] bridge_slave_1: left allmulticast mode [ 114.811624][ T6113] bridge_slave_1: left promiscuous mode [ 114.817408][ T6113] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.834627][ T6761] EXT4-fs (loop2): Remounting filesystem read-only [ 114.845356][ T6113] bridge_slave_0: left allmulticast mode [ 114.851225][ T6113] bridge_slave_0: left promiscuous mode [ 114.851436][ T6783] loop5: detected capacity change from 0 to 512 [ 114.857181][ T6113] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.874355][ T6761] EXT4-fs (loop2): 1 truncate cleaned up [ 114.880152][ T3450] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 114.890805][ T3450] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 114.901950][ T3450] EXT4-fs (loop2): Quota write (off=8, len=24) cancelled because transaction is not started [ 114.914990][ T6761] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 114.938137][ T6761] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 114.950068][ T6783] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 114.958585][ T6783] EXT4-fs (loop5): orphan cleanup on readonly fs [ 114.988005][ T6783] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #16: comm syz.5.1024: corrupted inode contents [ 115.000560][ T6783] EXT4-fs (loop5): Remounting filesystem read-only [ 115.007792][ T6783] EXT4-fs (loop5): 1 truncate cleaned up [ 115.013964][ T3450] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 115.024603][ T3450] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 115.035494][ T3450] EXT4-fs (loop5): Quota write (off=8, len=24) cancelled because transaction is not started [ 115.048738][ T6113] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 115.056952][ T6783] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 115.077349][ T6113] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 115.084320][ T6783] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.096105][ T6113] bond0 (unregistering): Released all slaves [ 115.149549][ T6766] lo speed is unknown, defaulting to 1000 [ 115.181736][ T6113] hsr_slave_0: left promiscuous mode [ 115.194298][ T6113] hsr_slave_1: left promiscuous mode [ 115.224759][ T6113] veth1_macvtap: left promiscuous mode [ 115.256722][ T6814] loop5: detected capacity change from 0 to 512 [ 115.263214][ T6113] veth0_macvtap: left promiscuous mode [ 115.286282][ T6113] veth1_vlan: left promiscuous mode [ 115.301503][ T6113] veth0_vlan: left promiscuous mode [ 115.302261][ T6814] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 115.324092][ T6814] EXT4-fs (loop5): orphan cleanup on readonly fs [ 115.334105][ T6815] loop2: detected capacity change from 0 to 2048 [ 115.347925][ T6814] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #16: comm syz.5.1033: corrupted inode contents [ 115.363281][ T6814] EXT4-fs (loop5): Remounting filesystem read-only [ 115.375244][ T6826] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1035'. [ 115.380422][ T6814] EXT4-fs (loop5): 1 truncate cleaned up [ 115.395265][ T6815] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 115.407449][ T3450] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 115.418059][ T3450] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 115.431473][ T6833] netlink: 19 bytes leftover after parsing attributes in process `syz.1.1035'. [ 115.440265][ T3450] EXT4-fs (loop5): Quota write (off=8, len=24) cancelled because transaction is not started [ 115.459723][ T6814] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 115.472539][ T3321] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.476278][ T6814] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.536155][ T6113] team0 (unregistering): Port device team_slave_1 removed [ 115.538147][ T6838] loop2: detected capacity change from 0 to 2048 [ 115.550007][ T6113] team0 (unregistering): Port device team_slave_0 removed [ 115.555349][ T6840] loop1: detected capacity change from 0 to 128 [ 115.606982][ T6838] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 115.651815][ T6847] loop5: detected capacity change from 0 to 512 [ 115.724789][ T6847] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 115.741544][ T6850] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.1036: bg 0: block 345: padding at end of block bitmap is not set [ 115.756734][ T6847] EXT4-fs (loop5): orphan cleanup on readonly fs [ 115.763615][ T6850] EXT4-fs (loop2): Remounting filesystem read-only [ 115.771234][ T3326] EXT4-fs warning (device loop2): ext4_convert_unwritten_extents:4984: inode #15: block 1: len 15: ext4_ext_map_blocks returned -30 [ 115.782277][ T6766] chnl_net:caif_netlink_parms(): no params data found [ 115.803253][ T6847] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #16: comm syz.5.1039: corrupted inode contents [ 115.816552][ T6847] EXT4-fs (loop5): Remounting filesystem read-only [ 115.824078][ T6847] EXT4-fs (loop5): 1 truncate cleaned up [ 115.840193][ T3450] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 115.850917][ T3450] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 115.863866][ T3450] EXT4-fs (loop5): Quota write (off=8, len=24) cancelled because transaction is not started [ 115.881553][ T6847] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 115.915084][ T3321] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.934311][ T6847] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.980022][ T6766] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.987272][ T6766] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.025558][ T6766] bridge_slave_0: entered allmulticast mode [ 116.032155][ T6766] bridge_slave_0: entered promiscuous mode [ 116.041107][ T6879] FAULT_INJECTION: forcing a failure. [ 116.041107][ T6879] name failslab, interval 1, probability 0, space 0, times 0 [ 116.053856][ T6879] CPU: 1 UID: 0 PID: 6879 Comm: syz.5.1041 Not tainted syzkaller #0 PREEMPT(voluntary) [ 116.053931][ T6879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 116.053947][ T6879] Call Trace: [ 116.053954][ T6879] [ 116.053962][ T6879] __dump_stack+0x1d/0x30 [ 116.053988][ T6879] dump_stack_lvl+0xe8/0x140 [ 116.054080][ T6879] dump_stack+0x15/0x1b [ 116.054101][ T6879] should_fail_ex+0x265/0x280 [ 116.054133][ T6879] should_failslab+0x8c/0xb0 [ 116.054245][ T6879] __kmalloc_noprof+0xa5/0x570 [ 116.054274][ T6879] ? io_uring_alloc_async_data+0x48/0xa0 [ 116.054296][ T6879] io_uring_alloc_async_data+0x48/0xa0 [ 116.054319][ T6879] __io_timeout_prep+0x21a/0x440 [ 116.054362][ T6879] io_link_timeout_prep+0x22/0x30 [ 116.054411][ T6879] io_submit_sqes+0x5ef/0x1060 [ 116.054487][ T6879] __se_sys_io_uring_enter+0x1c1/0x1b70 [ 116.054560][ T6879] ? 0xffffffff81000000 [ 116.054573][ T6879] ? __rcu_read_unlock+0x4f/0x70 [ 116.054597][ T6879] ? get_pid_task+0x96/0xd0 [ 116.054619][ T6879] ? proc_fail_nth_write+0x13b/0x160 [ 116.054672][ T6879] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 116.054742][ T6879] ? vfs_write+0x7e8/0x960 [ 116.054766][ T6879] ? __rcu_read_unlock+0x4f/0x70 [ 116.054792][ T6879] ? __fget_files+0x184/0x1c0 [ 116.054898][ T6879] ? fput+0x8f/0xc0 [ 116.054973][ T6879] __x64_sys_io_uring_enter+0x78/0x90 [ 116.055006][ T6879] x64_sys_call+0x2df0/0x3000 [ 116.055031][ T6879] do_syscall_64+0xd2/0x200 [ 116.055115][ T6879] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 116.055219][ T6879] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 116.055257][ T6879] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.055277][ T6879] RIP: 0033:0x7f587e50efc9 [ 116.055291][ T6879] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 116.055310][ T6879] RSP: 002b:00007f587cf77038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 116.055400][ T6879] RAX: ffffffffffffffda RBX: 00007f587e765fa0 RCX: 00007f587e50efc9 [ 116.055417][ T6879] RDX: 0000000000000000 RSI: 00000000000047bc RDI: 0000000000000003 [ 116.055493][ T6879] RBP: 00007f587cf77090 R08: 0000000000000000 R09: 0000000000000000 [ 116.055508][ T6879] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 116.055523][ T6879] R13: 00007f587e766038 R14: 00007f587e765fa0 R15: 00007ffc83c10468 [ 116.055546][ T6879] [ 116.055986][ T6821] lo speed is unknown, defaulting to 1000 [ 116.058268][ T6113] IPVS: stop unused estimator thread 0... [ 116.210696][ T6884] loop5: detected capacity change from 0 to 128 [ 116.307327][ T6846] syz.1.1037: attempt to access beyond end of device [ 116.307327][ T6846] loop1: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 116.314444][ T6766] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.323447][ T6846] Buffer I/O error on dev loop1, logical block 128, lost async page write [ 116.330443][ T6766] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.347157][ T6840] syz.1.1037: attempt to access beyond end of device [ 116.347157][ T6840] loop1: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 116.348357][ T6766] bridge_slave_1: entered allmulticast mode [ 116.360715][ T6840] Buffer I/O error on dev loop1, logical block 128, lost async page write [ 116.367309][ T6766] bridge_slave_1: entered promiscuous mode [ 116.385536][ T6884] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.401139][ T6884] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.441677][ T6766] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 116.455078][ T6821] chnl_net:caif_netlink_parms(): no params data found [ 116.474832][ T6766] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 116.491780][ T6895] loop1: detected capacity change from 0 to 512 [ 116.515580][ T6895] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 116.538178][ T6895] EXT4-fs (loop1): orphan cleanup on readonly fs [ 116.564844][ T6895] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #16: comm syz.1.1045: corrupted inode contents [ 116.580890][ T6821] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.588019][ T6821] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.595606][ T6895] EXT4-fs (loop1): Remounting filesystem read-only [ 116.601570][ T6821] bridge_slave_0: entered allmulticast mode [ 116.602357][ T6895] EXT4-fs (loop1): 1 truncate cleaned up [ 116.609217][ T6821] bridge_slave_0: entered promiscuous mode [ 116.614030][ T6113] EXT4-fs (loop1): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 116.621725][ T6766] team0: Port device team_slave_0 added [ 116.630329][ T6113] EXT4-fs (loop1): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 116.638778][ T6766] team0: Port device team_slave_1 added [ 116.652089][ T6113] EXT4-fs (loop1): Quota write (off=8, len=24) cancelled because transaction is not started [ 116.662814][ T6821] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.662904][ T6895] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 116.669965][ T6821] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.684126][ T6895] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 116.692627][ T6821] bridge_slave_1: entered allmulticast mode [ 116.705855][ T6821] bridge_slave_1: entered promiscuous mode [ 116.744234][ T6821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 116.761325][ T6766] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 116.768437][ T6766] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.794439][ T6766] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 116.807387][ T6821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 116.834733][ T6766] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 116.841738][ T6766] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.867748][ T6766] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 116.879562][ T6821] team0: Port device team_slave_0 added [ 116.886822][ T6821] team0: Port device team_slave_1 added [ 116.886911][ T6916] loop1: detected capacity change from 0 to 4096 [ 116.910343][ T6916] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 116.931003][ T6821] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 116.938037][ T6821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.964106][ T6821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 116.983992][ T6821] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 116.990967][ T6821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.016900][ T6821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 117.036681][ T6766] hsr_slave_0: entered promiscuous mode [ 117.042827][ T6766] hsr_slave_1: entered promiscuous mode [ 117.048888][ T6766] debugfs: 'hsr0' already exists in 'hsr' [ 117.054657][ T6766] Cannot create hsr debugfs directory [ 117.086458][ T3313] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 117.120780][ T6821] hsr_slave_0: entered promiscuous mode [ 117.129959][ T6821] hsr_slave_1: entered promiscuous mode [ 117.136108][ T6821] debugfs: 'hsr0' already exists in 'hsr' [ 117.141889][ T6821] Cannot create hsr debugfs directory [ 117.183372][ T6929] netlink: 88 bytes leftover after parsing attributes in process `syz.1.1050'. [ 117.192513][ T6929] netlink: 88 bytes leftover after parsing attributes in process `syz.1.1050'. [ 117.265318][ T6935] loop1: detected capacity change from 0 to 512 [ 117.398150][ T6935] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 117.407428][ T6954] loop2: detected capacity change from 0 to 128 [ 117.414486][ T6935] EXT4-fs (loop1): orphan cleanup on readonly fs [ 117.447000][ T6935] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #16: comm syz.1.1053: corrupted inode contents [ 117.466290][ T6935] EXT4-fs (loop1): Remounting filesystem read-only [ 117.475546][ T6935] EXT4-fs (loop1): 1 truncate cleaned up [ 117.481439][ T31] EXT4-fs (loop1): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 117.492131][ T31] EXT4-fs (loop1): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 117.525402][ T31] EXT4-fs (loop1): Quota write (off=8, len=24) cancelled because transaction is not started [ 117.641832][ T6821] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.664025][ T6766] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 117.685083][ T6766] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 117.702778][ T6821] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.716385][ T6977] loop1: detected capacity change from 0 to 128 [ 117.767867][ T6766] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 117.822099][ T6821] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.867500][ T6766] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 117.907534][ T6821] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 118.058792][ T6821] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 118.074579][ T6954] syz.2.1055: attempt to access beyond end of device [ 118.074579][ T6954] loop2: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 118.088058][ T6954] Buffer I/O error on dev loop2, logical block 128, lost async page write [ 118.105432][ T6821] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 118.113046][ T6959] syz.2.1055: attempt to access beyond end of device [ 118.113046][ T6959] loop2: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 118.126495][ T6959] Buffer I/O error on dev loop2, logical block 128, lost async page write [ 118.142316][ T6766] 8021q: adding VLAN 0 to HW filter on device bond0 [ 118.161764][ T6821] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 118.175107][ T6821] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 118.194257][ T6959] syz.2.1055: attempt to access beyond end of device [ 118.194257][ T6959] loop2: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 118.207717][ T6959] Buffer I/O error on dev loop2, logical block 128, lost async page write [ 118.230966][ T6766] 8021q: adding VLAN 0 to HW filter on device team0 [ 118.276604][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.283696][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.298544][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.305743][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.336272][ T7015] loop2: detected capacity change from 0 to 512 [ 118.386883][ T7015] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 118.405641][ T6766] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 118.417234][ T7015] EXT4-fs (loop2): orphan cleanup on readonly fs [ 118.451210][ T7015] EXT4-fs error (device loop2): ext4_do_update_inode:5632: inode #16: comm syz.2.1057: corrupted inode contents [ 118.470413][ T6821] 8021q: adding VLAN 0 to HW filter on device bond0 [ 118.485706][ T6821] 8021q: adding VLAN 0 to HW filter on device team0 [ 118.487678][ T7015] EXT4-fs (loop2): Remounting filesystem read-only [ 118.500782][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.507908][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.514295][ T7015] EXT4-fs (loop2): 1 truncate cleaned up [ 118.520902][ T3450] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 118.531579][ T3450] EXT4-fs (loop2): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 118.554303][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.561402][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.574518][ T3450] EXT4-fs (loop2): Quota write (off=8, len=24) cancelled because transaction is not started [ 118.627760][ T6821] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 118.638223][ T6821] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 118.678303][ T6766] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.781446][ T6821] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.885410][ T7044] loop2: detected capacity change from 0 to 4096 [ 118.910941][ T6766] veth0_vlan: entered promiscuous mode [ 118.943519][ T6766] veth1_vlan: entered promiscuous mode [ 118.973226][ T6766] veth0_macvtap: entered promiscuous mode [ 119.006631][ T6766] veth1_macvtap: entered promiscuous mode [ 119.059515][ T6766] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.076853][ T6821] veth0_vlan: entered promiscuous mode [ 119.100285][ T6766] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.121064][ T6821] veth1_vlan: entered promiscuous mode [ 119.131098][ T3326] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.153576][ T3326] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.206166][ T6821] veth0_macvtap: entered promiscuous mode [ 119.225297][ T3326] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.234863][ T7077] : renamed from veth0_to_bond (while UP) [ 119.250239][ T6821] veth1_macvtap: entered promiscuous mode [ 119.261575][ T7074] loop2: detected capacity change from 0 to 4096 [ 119.272007][ T31] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.291974][ T6821] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.311636][ T6821] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.349855][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.398425][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.444703][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.468040][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.543361][ T29] kauditd_printk_skb: 134 callbacks suppressed [ 119.543451][ T29] audit: type=1400 audit(119.516:3701): avc: denied { create } for pid=7086 comm="syz.2.1064" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 119.607068][ T7092] loop3: detected capacity change from 0 to 512 [ 119.637879][ T29] audit: type=1400 audit(119.566:3702): avc: denied { write } for pid=7086 comm="syz.2.1064" name="file0" dev="tmpfs" ino=1432 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 119.659839][ T29] audit: type=1400 audit(119.566:3703): avc: denied { open } for pid=7086 comm="syz.2.1064" path="/271/file0" dev="tmpfs" ino=1432 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 119.682379][ T29] audit: type=1400 audit(119.566:3704): avc: denied { ioctl } for pid=7086 comm="syz.2.1064" path="/271/file0" dev="tmpfs" ino=1432 ioctlcmd=0x1276 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 119.706097][ T29] audit: type=1400 audit(119.616:3705): avc: denied { unlink } for pid=3321 comm="syz-executor" name="file0" dev="tmpfs" ino=1432 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 119.746289][ T7099] loop0: detected capacity change from 0 to 512 [ 119.797914][ T7102] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1067'. [ 119.861253][ T7099] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 119.883929][ T29] audit: type=1326 audit(119.846:3706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7096 comm="syz.2.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 119.906850][ T29] audit: type=1326 audit(119.846:3707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7096 comm="syz.2.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 119.914339][ T7099] EXT4-fs (loop0): orphan cleanup on readonly fs [ 119.929698][ T29] audit: type=1326 audit(119.846:3708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7096 comm="syz.2.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 119.929735][ T29] audit: type=1326 audit(119.846:3709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7096 comm="syz.2.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 119.982160][ T29] audit: type=1326 audit(119.846:3710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7096 comm="syz.2.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49bd32efc9 code=0x7ffc0000 [ 119.995328][ T7099] EXT4-fs error (device loop0): ext4_do_update_inode:5632: inode #16: comm syz.0.1068: corrupted inode contents [ 120.031133][ T7112] loop3: detected capacity change from 0 to 512 [ 120.055475][ T7099] EXT4-fs (loop0): Remounting filesystem read-only [ 120.081858][ T7099] EXT4-fs (loop0): 1 truncate cleaned up [ 120.088096][ T7112] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 120.097246][ T3450] EXT4-fs (loop0): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 120.107872][ T3450] EXT4-fs (loop0): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 120.119172][ T7112] EXT4-fs (loop3): orphan cleanup on readonly fs [ 120.144361][ T3450] EXT4-fs (loop0): Quota write (off=8, len=24) cancelled because transaction is not started [ 120.159705][ T7112] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #16: comm syz.3.1073: corrupted inode contents [ 120.172354][ T7112] EXT4-fs (loop3): Remounting filesystem read-only [ 120.202198][ T7112] EXT4-fs (loop3): 1 truncate cleaned up [ 120.208867][ T12] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 120.219498][ T12] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 120.271615][ T12] EXT4-fs (loop3): Quota write (off=8, len=24) cancelled because transaction is not started [ 120.283939][ T7119] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1076'. [ 120.293257][ T44] Bluetooth: hci0: sending frame failed (-49) [ 120.299828][ T3558] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 120.514899][ T7146] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1082'. [ 120.570247][ T7128] lo speed is unknown, defaulting to 1000 [ 120.713618][ T7128] chnl_net:caif_netlink_parms(): no params data found [ 120.872653][ T7128] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.879819][ T7128] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.907286][ T7128] bridge_slave_0: entered allmulticast mode [ 120.914133][ T7128] bridge_slave_0: entered promiscuous mode [ 120.921764][ T7128] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.928914][ T7128] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.936563][ T7128] bridge_slave_1: entered allmulticast mode [ 120.943345][ T7128] bridge_slave_1: entered promiscuous mode [ 120.966368][ T7128] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 120.976159][ T7178] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1091'. [ 120.977626][ T7128] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 121.007387][ T7128] team0: Port device team_slave_0 added [ 121.020695][ T7128] team0: Port device team_slave_1 added [ 121.057529][ T7128] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 121.064573][ T7128] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.090600][ T7128] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 121.102614][ T7128] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 121.109658][ T7128] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.135596][ T7128] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 121.181688][ T7128] hsr_slave_0: entered promiscuous mode [ 121.188138][ T7128] hsr_slave_1: entered promiscuous mode [ 121.196441][ T7188] loop1: detected capacity change from 0 to 512 [ 121.203115][ T7128] debugfs: 'hsr0' already exists in 'hsr' [ 121.208945][ T7128] Cannot create hsr debugfs directory [ 121.217168][ T7188] EXT4-fs (loop1): orphan cleanup on readonly fs [ 121.233599][ T7188] EXT4-fs error (device loop1): ext4_orphan_get:1392: inode #15: comm syz.1.1094: iget: bad i_size value: 38620345925642 [ 121.246735][ T7188] EXT4-fs error (device loop1): ext4_orphan_get:1397: comm syz.1.1094: couldn't read orphan inode 15 (err -117) [ 121.375218][ T7128] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.484940][ T7128] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.537952][ T7128] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.559491][ T7215] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1100'. [ 121.569301][ T7212] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1102'. [ 121.578342][ T7212] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 121.585996][ T7212] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 121.595334][ T7212] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 121.602777][ T7212] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 121.632255][ T3384] IPVS: starting estimator thread 0... [ 121.640592][ T7128] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.657010][ T7219] loop1: detected capacity change from 0 to 1024 [ 121.664613][ T7219] EXT4-fs: inline encryption not supported [ 121.670540][ T7219] EXT4-fs: Ignoring removed i_version option [ 121.699227][ T7219] FAULT_INJECTION: forcing a failure. [ 121.699227][ T7219] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 121.709473][ T7128] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 121.712523][ T7219] CPU: 0 UID: 0 PID: 7219 Comm: syz.1.1103 Not tainted syzkaller #0 PREEMPT(voluntary) [ 121.712561][ T7219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 121.712579][ T7219] Call Trace: [ 121.712587][ T7219] [ 121.712597][ T7219] __dump_stack+0x1d/0x30 [ 121.712651][ T7219] dump_stack_lvl+0xe8/0x140 [ 121.712697][ T7219] dump_stack+0x15/0x1b [ 121.712803][ T7219] should_fail_ex+0x265/0x280 [ 121.712842][ T7219] should_fail+0xb/0x20 [ 121.712864][ T7219] should_fail_usercopy+0x1a/0x20 [ 121.712939][ T7219] _copy_to_user+0x20/0xa0 [ 121.712974][ T7219] simple_read_from_buffer+0xb5/0x130 [ 121.713020][ T7219] proc_fail_nth_read+0x10e/0x150 [ 121.713063][ T7219] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 121.713161][ T7219] vfs_read+0x1a8/0x770 [ 121.713192][ T7219] ? __rcu_read_unlock+0x4f/0x70 [ 121.713227][ T7219] ? __fget_files+0x184/0x1c0 [ 121.713307][ T7219] ksys_read+0xda/0x1a0 [ 121.713340][ T7219] __x64_sys_read+0x40/0x50 [ 121.713373][ T7219] x64_sys_call+0x27c0/0x3000 [ 121.713404][ T7219] do_syscall_64+0xd2/0x200 [ 121.713466][ T7219] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 121.713503][ T7219] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 121.713545][ T7219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.713592][ T7219] RIP: 0033:0x7f46452ed9dc [ 121.713624][ T7219] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 121.713654][ T7219] RSP: 002b:00007f4643d57030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 121.713685][ T7219] RAX: ffffffffffffffda RBX: 00007f4645545fa0 RCX: 00007f46452ed9dc [ 121.713753][ T7219] RDX: 000000000000000f RSI: 00007f4643d570a0 RDI: 0000000000000009 [ 121.713768][ T7219] RBP: 00007f4643d57090 R08: 0000000000000000 R09: 0000000000000000 [ 121.713785][ T7219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 121.713802][ T7219] R13: 00007f4645546038 R14: 00007f4645545fa0 R15: 00007ffff2f6d208 [ 121.713829][ T7219] [ 121.723845][ T7217] IPVS: using max 2496 ests per chain, 124800 per kthread [ 121.927951][ T7128] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 121.942392][ T7128] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 121.951903][ T7128] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 122.031297][ T7128] 8021q: adding VLAN 0 to HW filter on device bond0 [ 122.048568][ T7233] loop5: detected capacity change from 0 to 1024 [ 122.056815][ T7128] 8021q: adding VLAN 0 to HW filter on device team0 [ 122.070242][ T3450] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.077469][ T3450] bridge0: port 1(bridge_slave_0) entered forwarding state [ 122.088240][ T3450] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.095406][ T3450] bridge0: port 2(bridge_slave_1) entered forwarding state [ 122.153395][ T7233] EXT4-fs error (device loop5): ext4_acquire_dquot:6945: comm syz.5.1105: Failed to acquire dquot type 0 [ 122.174729][ T7233] EXT4-fs error (device loop5): mb_free_blocks:2017: group 0, inode 13: block 144:freeing already freed block (bit 9); block bitmap corrupt. [ 122.198927][ T7233] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #13: comm syz.5.1105: corrupted inode contents [ 122.205450][ T7128] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.225707][ T7233] EXT4-fs error (device loop5): ext4_dirty_inode:6517: inode #13: comm syz.5.1105: mark_inode_dirty error [ 122.249991][ T7233] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #13: comm syz.5.1105: corrupted inode contents [ 122.284023][ T7233] EXT4-fs error (device loop5): __ext4_ext_dirty:206: inode #13: comm syz.5.1105: mark_inode_dirty error [ 122.352797][ T7128] veth0_vlan: entered promiscuous mode [ 122.361289][ T7128] veth1_vlan: entered promiscuous mode [ 122.375305][ T7128] veth0_macvtap: entered promiscuous mode [ 122.383402][ T7128] veth1_macvtap: entered promiscuous mode [ 122.396694][ T7128] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 122.406413][ T7128] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 122.442457][ T3450] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.460916][ T7233] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #13: comm syz.5.1105: corrupted inode contents [ 122.461681][ T3450] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.483165][ T7233] EXT4-fs error (device loop5) in ext4_orphan_del:301: Corrupt filesystem [ 122.492048][ T3450] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.501084][ T3450] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.510466][ T7233] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #13: comm syz.5.1105: corrupted inode contents [ 122.530352][ T7233] EXT4-fs error (device loop5): ext4_truncate:4637: inode #13: comm syz.5.1105: mark_inode_dirty error [ 122.534177][ T7261] FAULT_INJECTION: forcing a failure. [ 122.534177][ T7261] name failslab, interval 1, probability 0, space 0, times 0 [ 122.542107][ T7233] EXT4-fs error (device loop5) in ext4_process_orphan:343: Corrupt filesystem [ 122.554215][ T7261] CPU: 1 UID: 0 PID: 7261 Comm: syz.2.1075 Not tainted syzkaller #0 PREEMPT(voluntary) [ 122.554241][ T7261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 122.554253][ T7261] Call Trace: [ 122.554259][ T7261] [ 122.554267][ T7261] __dump_stack+0x1d/0x30 [ 122.554361][ T7261] dump_stack_lvl+0xe8/0x140 [ 122.554389][ T7261] dump_stack+0x15/0x1b [ 122.554445][ T7261] should_fail_ex+0x265/0x280 [ 122.554472][ T7261] should_failslab+0x8c/0xb0 [ 122.554511][ T7261] kmem_cache_alloc_node_noprof+0x57/0x4a0 [ 122.554588][ T7261] ? __alloc_skb+0x101/0x320 [ 122.554705][ T7261] __alloc_skb+0x101/0x320 [ 122.554741][ T7261] ? audit_log_start+0x342/0x720 [ 122.554811][ T7261] audit_log_start+0x3a0/0x720 [ 122.554861][ T7261] ? kstrtouint+0x76/0xc0 [ 122.554906][ T7261] audit_seccomp+0x48/0x100 [ 122.554987][ T7261] ? __seccomp_filter+0x82d/0x1250 [ 122.555025][ T7261] __seccomp_filter+0x83e/0x1250 [ 122.555064][ T7261] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 122.555158][ T7261] ? vfs_write+0x7e8/0x960 [ 122.555208][ T7261] ? __rcu_read_unlock+0x4f/0x70 [ 122.555244][ T7261] ? __fget_files+0x184/0x1c0 [ 122.555284][ T7261] __secure_computing+0x82/0x150 [ 122.555401][ T7261] syscall_trace_enter+0xcf/0x1e0 [ 122.555498][ T7261] do_syscall_64+0xac/0x200 [ 122.555570][ T7261] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 122.555618][ T7261] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 122.555702][ T7261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.555731][ T7261] RIP: 0033:0x7f1aeda2efc9 [ 122.555753][ T7261] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 122.555777][ T7261] RSP: 002b:00007f1aec497038 EFLAGS: 00000246 ORIG_RAX: 0000000000000145 [ 122.555804][ T7261] RAX: ffffffffffffffda RBX: 00007f1aedc85fa0 RCX: 00007f1aeda2efc9 [ 122.555827][ T7261] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000200000495000 [ 122.555844][ T7261] RBP: 00007f1aec497090 R08: 0000000000000000 R09: 0000000000000000 [ 122.555928][ T7261] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 122.555945][ T7261] R13: 00007f1aedc86038 R14: 00007f1aedc85fa0 R15: 00007ffcc4104dd8 [ 122.555971][ T7261] [ 122.785810][ T7233] EXT4-fs (loop5): 1 truncate cleaned up [ 122.962825][ T7278] lo speed is unknown, defaulting to 1000 [ 122.987441][ T7280] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1116'. [ 123.118761][ T7282] lo speed is unknown, defaulting to 1000 [ 123.209493][ T7282] chnl_net:caif_netlink_parms(): no params data found [ 123.268040][ T7297] loop1: detected capacity change from 0 to 512 [ 123.282193][ T7282] bridge0: port 1(bridge_slave_0) entered blocking state [ 123.289356][ T7282] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.310500][ T7297] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 123.322148][ T7282] bridge_slave_0: entered allmulticast mode [ 123.329860][ T7297] EXT4-fs (loop1): orphan cleanup on readonly fs [ 123.336875][ T7282] bridge_slave_0: entered promiscuous mode [ 123.344653][ T7297] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #16: comm syz.1.1118: corrupted inode contents [ 123.358439][ T7282] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.363958][ T7297] EXT4-fs (loop1): Remounting filesystem read-only [ 123.365578][ T7282] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.374812][ T7297] EXT4-fs (loop1): 1 truncate cleaned up [ 123.379976][ T7282] bridge_slave_1: entered allmulticast mode [ 123.384932][ T3450] EXT4-fs (loop1): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 123.391693][ T7282] bridge_slave_1: entered promiscuous mode [ 123.401272][ T3450] EXT4-fs (loop1): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 123.418006][ T3450] EXT4-fs (loop1): Quota write (off=8, len=24) cancelled because transaction is not started [ 123.438431][ T7282] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 123.472482][ T7282] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 123.496367][ T7301] loop1: detected capacity change from 0 to 512 [ 123.510603][ T7282] team0: Port device team_slave_0 added [ 123.518413][ T7301] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 123.536950][ T7301] EXT4-fs (loop1): orphan cleanup on readonly fs [ 123.544918][ T7282] team0: Port device team_slave_1 added [ 123.557099][ T7301] EXT4-fs error (device loop1): ext4_do_update_inode:5632: inode #16: comm syz.1.1119: corrupted inode contents [ 123.580103][ T7282] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 123.587241][ T7282] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 123.613315][ T7282] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 123.643990][ T7301] EXT4-fs (loop1): Remounting filesystem read-only [ 123.656757][ T7301] EXT4-fs (loop1): 1 truncate cleaned up [ 123.663958][ T52] EXT4-fs (loop1): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 123.674657][ T52] EXT4-fs (loop1): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 123.685474][ T52] EXT4-fs (loop1): Quota write (off=8, len=24) cancelled because transaction is not started [ 123.705518][ T7282] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 123.712608][ T7282] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 123.738698][ T7282] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 123.792233][ T7282] hsr_slave_0: entered promiscuous mode [ 123.798431][ T7282] hsr_slave_1: entered promiscuous mode [ 123.804564][ T7282] debugfs: 'hsr0' already exists in 'hsr' [ 123.810317][ T7282] Cannot create hsr debugfs directory [ 123.926204][ T7312] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1123'. [ 123.933687][ T7314] IPv6: NLM_F_CREATE should be specified when creating new route [ 123.935149][ T7312] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1123'. [ 123.953575][ T7282] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 124.016509][ T7324] loop0: detected capacity change from 0 to 512 [ 124.025429][ T7282] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 124.039129][ T7324] EXT4-fs error (device loop0): ext4_orphan_get:1392: inode #13: comm syz.0.1129: iget: bad i_size value: 12154757448730 [ 124.074683][ T7324] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.1129: couldn't read orphan inode 13 (err -117) [ 124.107427][ T7282] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 124.166714][ T7282] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 124.181996][ T7336] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1132'. [ 124.249268][ T7282] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 124.268607][ T7353] lo speed is unknown, defaulting to 1000 [ 124.274738][ T7282] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 124.279125][ T7355] loop5: detected capacity change from 0 to 1024 [ 124.289669][ T7355] EXT4-fs: Ignoring removed orlov option [ 124.297865][ T7355] EXT4-fs (loop5): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 124.298548][ T7282] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 124.317990][ T7357] SELinux: Context system_u:object_r:udev_var_run_t:s0 is not valid (left unmapped). [ 124.320641][ T7355] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c840e018, mo2=0000] [ 124.336764][ T7355] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #3: block 2: comm syz.5.1139: lblock 2 mapped to illegal pblock 2 (length 1) [ 124.338827][ T7282] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 124.354533][ T7355] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #3: block 48: comm syz.5.1139: lblock 0 mapped to illegal pblock 48 (length 1) [ 124.371744][ T7355] EXT4-fs error (device loop5): ext4_acquire_dquot:6945: comm syz.5.1139: Failed to acquire dquot type 0 [ 124.383404][ T7355] EXT4-fs error (device loop5) in ext4_reserve_inode_write:6313: Corrupt filesystem [ 124.393688][ T7355] EXT4-fs error (device loop5): ext4_evict_inode:254: inode #11: comm syz.5.1139: mark_inode_dirty error [ 124.405190][ T7355] EXT4-fs warning (device loop5): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 124.417605][ T7355] EXT4-fs (loop5): 1 orphan inode deleted [ 124.429245][ T7364] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #2: block 16: comm syz.5.1139: lblock 0 mapped to illegal pblock 16 (length 1) [ 124.434273][ T31] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #3: block 1: comm kworker/u8:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 124.458059][ T7365] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #2: block 16: comm syz.5.1139: lblock 0 mapped to illegal pblock 16 (length 1) [ 124.466160][ T31] EXT4-fs error (device loop5): ext4_release_dquot:6981: comm kworker/u8:1: Failed to release dquot type 0 [ 124.531930][ T7282] 8021q: adding VLAN 0 to HW filter on device bond0 [ 124.558822][ T7282] 8021q: adding VLAN 0 to HW filter on device team0 [ 124.569889][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 124.577043][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 124.585853][ T7367] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1140'. [ 124.600149][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 124.606652][ T29] kauditd_printk_skb: 286 callbacks suppressed [ 124.606672][ T29] audit: type=1326 audit(124.576:3962): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7366 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c6187efc9 code=0x7ffc0000 [ 124.607277][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 124.614132][ T29] audit: type=1326 audit(124.586:3963): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7366 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0c6187efc9 code=0x7ffc0000 [ 124.639666][ T6535] EXT4-fs error (device loop5): __ext4_get_inode_loc:4832: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 124.679482][ T29] audit: type=1326 audit(124.616:3964): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7366 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c6187efc9 code=0x7ffc0000 [ 124.679847][ T6535] EXT4-fs error (device loop5) in ext4_reserve_inode_write:6313: Corrupt filesystem [ 124.702377][ T29] audit: type=1326 audit(124.616:3965): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7366 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0c6187efc9 code=0x7ffc0000 [ 124.735406][ T29] audit: type=1326 audit(124.616:3966): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7366 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c6187efc9 code=0x7ffc0000 [ 124.744437][ T6535] EXT4-fs error (device loop5): ext4_quota_off:7229: inode #3: comm syz-executor: mark_inode_dirty error [ 124.758365][ T29] audit: type=1326 audit(124.616:3967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7366 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f0c6187efc9 code=0x7ffc0000 [ 124.798198][ T29] audit: type=1326 audit(124.716:3968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7366 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c6187efc9 code=0x7ffc0000 [ 124.821135][ T29] audit: type=1326 audit(124.716:3969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7366 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c6187efc9 code=0x7ffc0000 [ 124.844208][ T29] audit: type=1326 audit(124.806:3970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7366 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f0c6187efc9 code=0x7ffc0000 [ 124.867095][ T29] audit: type=1326 audit(124.806:3971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7366 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c6187efc9 code=0x7ffc0000 [ 124.895761][ T3450] bridge_slave_1: left allmulticast mode [ 124.901481][ T3450] bridge_slave_1: left promiscuous mode [ 124.907407][ T3450] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.920189][ T3450] bridge_slave_0: left allmulticast mode [ 124.926103][ T3450] bridge_slave_0: left promiscuous mode [ 124.931857][ T3450] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.082991][ T3450] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 125.093164][ T3450] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 125.102752][ T3450] bond0 (unregistering): Released all slaves [ 125.136382][ T7282] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 125.214655][ T7381] lo speed is unknown, defaulting to 1000 [ 125.279302][ T7383] loop5: detected capacity change from 0 to 512 [ 125.592033][ T3450] hsr_slave_0: left promiscuous mode [ 125.598257][ T3450] hsr_slave_1: left promiscuous mode [ 125.604181][ T3450] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 125.611664][ T3450] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 125.619547][ T3450] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 125.626968][ T3450] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 125.638955][ T3450] veth1_macvtap: left promiscuous mode [ 125.644543][ T3450] veth0_macvtap: left promiscuous mode [ 125.650049][ T3450] veth1_vlan: left promiscuous mode [ 125.655301][ T3450] veth0_vlan: left promiscuous mode [ 125.721190][ T3450] team0 (unregistering): Port device team_slave_1 removed [ 125.730681][ T3450] team0 (unregistering): Port device team_slave_0 removed [ 125.833652][ T7282] veth0_vlan: entered promiscuous mode [ 125.841488][ T7282] veth1_vlan: entered promiscuous mode [ 125.855227][ T7282] veth0_macvtap: entered promiscuous mode [ 125.862553][ T7282] veth1_macvtap: entered promiscuous mode [ 125.874516][ T7282] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 125.883381][ T7282] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 125.932543][ T7384] lo speed is unknown, defaulting to 1000 [ 125.941620][ T289] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.957949][ T7404] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.977092][ T289] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.994460][ T289] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.016402][ T289] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.065352][ T7409] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1149'. [ 126.083698][ T7417] loop3: detected capacity change from 0 to 512 [ 126.110630][ T7384] chnl_net:caif_netlink_parms(): no params data found [ 126.125537][ T7417] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 126.142425][ T7417] EXT4-fs (loop3): orphan cleanup on readonly fs [ 126.153290][ T7417] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #16: comm syz.3.1150: corrupted inode contents [ 126.173255][ T7417] EXT4-fs (loop3): Remounting filesystem read-only [ 126.212248][ T7417] EXT4-fs (loop3): 1 truncate cleaned up [ 126.218090][ T52] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 126.228813][ T52] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 126.239952][ T52] EXT4-fs (loop3): Quota write (off=8, len=24) cancelled because transaction is not started [ 126.251541][ T7384] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.258843][ T7384] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.266768][ T7384] bridge_slave_0: entered allmulticast mode [ 126.273183][ T7384] bridge_slave_0: entered promiscuous mode [ 126.283372][ T7384] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.290578][ T7384] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.298208][ T7384] bridge_slave_1: entered allmulticast mode [ 126.305022][ T7384] bridge_slave_1: entered promiscuous mode [ 126.318852][ T7436] loop5: detected capacity change from 0 to 128 [ 126.357627][ T7384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 126.368604][ T7384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 126.398534][ T7384] team0: Port device team_slave_0 added [ 126.420976][ T7384] team0: Port device team_slave_1 added [ 126.440372][ T7384] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 126.447425][ T7384] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.473475][ T7384] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 126.486527][ T7384] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 126.493579][ T7384] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.519629][ T7384] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 126.557626][ T7384] hsr_slave_0: entered promiscuous mode [ 126.564695][ T7384] hsr_slave_1: entered promiscuous mode [ 126.570642][ T7384] debugfs: 'hsr0' already exists in 'hsr' [ 126.576482][ T7384] Cannot create hsr debugfs directory [ 126.647627][ T7404] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.659092][ T7436] syz.5.1156: attempt to access beyond end of device [ 126.659092][ T7436] loop5: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 126.672742][ T7436] Buffer I/O error on dev loop5, logical block 128, lost async page write [ 126.681623][ T7441] syz.5.1156: attempt to access beyond end of device [ 126.681623][ T7441] loop5: rw=2049, sector=128, nr_sectors = 1 limit=128 [ 126.695170][ T7441] Buffer I/O error on dev loop5, logical block 128, lost async page write [ 126.706653][ T7384] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.737141][ T7404] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.777631][ T7384] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.816985][ T7404] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.856959][ T7384] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.864854][ T7450] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1161'. [ 126.899454][ T7454] loop5: detected capacity change from 0 to 512 [ 126.915236][ T7454] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 126.915273][ T37] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.923385][ T7454] EXT4-fs (loop5): orphan cleanup on readonly fs [ 126.943643][ T31] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.944919][ T7454] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #16: comm syz.5.1162: corrupted inode contents [ 126.964062][ T3450] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.972407][ T3450] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.981328][ T7454] EXT4-fs (loop5): Remounting filesystem read-only [ 126.989275][ T7454] EXT4-fs (loop5): 1 truncate cleaned up [ 126.995508][ T289] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 127.006195][ T289] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 127.016873][ T289] EXT4-fs (loop5): Quota write (off=8, len=24) cancelled because transaction is not started [ 127.018383][ T7384] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.101474][ T7384] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 127.113528][ T7464] loop9: detected capacity change from 0 to 7 [ 127.119909][ T7384] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 127.120357][ T7464] Buffer I/O error on dev loop9, logical block 0, async page read [ 127.134716][ T7464] Buffer I/O error on dev loop9, logical block 0, async page read [ 127.137679][ T7384] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 127.142550][ T7464] loop9: unable to read partition table [ 127.155121][ T7464] loop_reread_partitions: partition scan of loop9 (被xڬdGݡ [ 127.155121][ T7464] ) failed (rc=-5) [ 127.158646][ T3548] Buffer I/O error on dev loop9, logical block 0, async page read [ 127.177068][ T3548] Buffer I/O error on dev loop9, logical block 0, async page read [ 127.185671][ T7384] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 127.192660][ T3548] Buffer I/O error on dev loop9, logical block 0, async page read [ 127.204147][ T7461] netlink: '+}[@': attribute type 3 has an invalid length. [ 127.209045][ T3548] Buffer I/O error on dev loop9, logical block 0, async page read [ 127.272082][ T3548] Buffer I/O error on dev loop9, logical block 0, async page read [ 127.343009][ T7478] loop3: detected capacity change from 0 to 2048 [ 127.353640][ T7384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.392121][ T7384] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.400321][ T3002] udevd[3002]: worker [3830] terminated by signal 33 (Unknown signal 33) [ 127.401353][ T7489] loop5: detected capacity change from 0 to 512 [ 127.416646][ T7490] tipc: Enabling of bearer rejected, failed to enable media [ 127.446604][ T3450] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.453754][ T3450] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.471726][ T7489] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 127.482559][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.489769][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.497528][ T7489] EXT4-fs (loop5): orphan cleanup on readonly fs [ 127.516689][ T7489] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #16: comm syz.5.1175: corrupted inode contents [ 127.529129][ T7489] EXT4-fs (loop5): Remounting filesystem read-only [ 127.535898][ T7489] EXT4-fs (loop5): 1 truncate cleaned up [ 127.543564][ T289] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 127.554187][ T289] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 127.555489][ T7498] EXT4-fs error (device loop3): ext4_validate_block_bitmap:441: comm syz.3.1169: bg 0: block 345: padding at end of block bitmap is not set [ 127.566399][ T289] EXT4-fs (loop5): Quota write (off=8, len=24) cancelled because transaction is not started [ 127.592540][ T7498] EXT4-fs (loop3): Remounting filesystem read-only [ 127.606600][ T37] EXT4-fs warning (device loop3): ext4_convert_unwritten_extents:4984: inode #15: block 1: len 15: ext4_ext_map_blocks returned -30 [ 127.692133][ T7384] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 127.728583][ T7513] loop1: detected capacity change from 0 to 128 [ 127.739645][ T7513] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 127.749870][ T7513] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.816154][ T7384] veth0_vlan: entered promiscuous mode [ 127.829547][ T7384] veth1_vlan: entered promiscuous mode [ 127.838901][ T3450] bridge_slave_1: left allmulticast mode [ 127.844718][ T3450] bridge_slave_1: left promiscuous mode [ 127.850530][ T3450] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.862896][ T3450] bridge_slave_0: left allmulticast mode [ 127.869068][ T3450] bridge_slave_0: left promiscuous mode [ 127.875051][ T3450] bridge0: port 1(bridge_slave_0) entered disabled state [ 127.986755][ T3450] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 127.997159][ T3450] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 128.008384][ T3450] bond0 (unregistering): Released all slaves [ 128.030744][ T7384] veth0_macvtap: entered promiscuous mode [ 128.044412][ T3450] hsr_slave_0: left promiscuous mode [ 128.054550][ T3450] hsr_slave_1: left promiscuous mode [ 128.060577][ T3450] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.068207][ T3450] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.081884][ T7540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1187'. [ 128.091330][ T3450] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.098868][ T3450] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.118936][ T3450] veth1_vlan: left promiscuous mode [ 128.124450][ T3450] veth0_vlan: left promiscuous mode [ 128.190675][ T3450] team0 (unregistering): Port device team_slave_1 removed [ 128.200546][ T3450] team0 (unregistering): Port device team_slave_0 removed [ 128.596006][ T7539] lo speed is unknown, defaulting to 1000 [ 128.604809][ T7384] veth1_macvtap: entered promiscuous mode [ 128.624452][ T7384] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 128.644935][ T7384] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 128.675665][ T37] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.749067][ T37] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.818146][ T37] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.266665][ T37] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.449927][ T7557] loop5: detected capacity change from 0 to 512 [ 129.475891][ T7557] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 129.488566][ T7557] EXT4-fs (loop5): orphan cleanup on readonly fs [ 129.508297][ T7557] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #16: comm syz.5.1193: corrupted inode contents [ 129.543876][ T7557] EXT4-fs (loop5): Remounting filesystem read-only [ 129.566774][ T7557] EXT4-fs (loop5): 1 truncate cleaned up [ 129.572837][ T37] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 129.583443][ T37] EXT4-fs (loop5): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 129.620128][ T37] EXT4-fs (loop5): Quota write (off=8, len=24) cancelled because transaction is not started [ 129.630389][ T37] __quota_error: 97 callbacks suppressed [ 129.630401][ T37] Quota error (device loop5): v2_write_file_info: Can't write info structure [ 129.645282][ T37] Quota error (device loop5): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 129.841734][ T29] audit: type=1326 audit(129.810:4045): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7566 comm="syz.5.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f587e50efc9 code=0x7ffc0000 [ 129.864748][ T29] audit: type=1326 audit(129.810:4046): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7566 comm="syz.5.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f587e50efc9 code=0x7ffc0000 [ 129.887646][ T29] audit: type=1326 audit(129.810:4047): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7566 comm="syz.5.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f587e50efc9 code=0x7ffc0000 [ 129.910491][ T29] audit: type=1326 audit(129.810:4048): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7566 comm="syz.5.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f587e50efc9 code=0x7ffc0000 [ 129.933468][ T29] audit: type=1326 audit(129.810:4049): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7566 comm="syz.5.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f587e50efc9 code=0x7ffc0000 [ 129.956457][ T29] audit: type=1326 audit(129.810:4050): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7566 comm="syz.5.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f587e50efc9 code=0x7ffc0000 [ 129.979288][ T29] audit: type=1326 audit(129.810:4051): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7566 comm="syz.5.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f587e50efc9 code=0x7ffc0000 [ 130.002235][ T29] audit: type=1326 audit(129.810:4052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7566 comm="syz.5.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f587e50efc9 code=0x7ffc0000 [ 130.053494][ T7575] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 130.061872][ T7575] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 130.068490][ T7573] loop5: detected capacity change from 0 to 4096 [ 130.074575][ T7575] netlink: 'syz.3.1200': attribute type 4 has an invalid length. [ 130.077767][ T7573] EXT4-fs: Ignoring removed nomblk_io_submit option [ 130.084539][ T7575] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1200'. [ 130.091205][ T7573] EXT4-fs: Ignoring removed i_version option [ 130.106447][ T7575] .`: renamed from bond0 (while UP) [ 130.113201][ T7573] EXT4-fs error (device loop5): ext4_ext_check_inode:523: inode #4: comm syz.5.1201: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 256(256) [ 130.131744][ T7573] EXT4-fs error (device loop5): ext4_quota_enable:7139: comm syz.5.1201: Bad quota inode: 4, type: 1 [ 130.143126][ T7573] EXT4-fs warning (device loop5): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 130.160946][ T7573] EXT4-fs (loop5): mount failed [ 130.236681][ T7588] loop3: detected capacity change from 0 to 512 [ 130.246392][ T7585] netlink: 'syz.1.1205': attribute type 2 has an invalid length. [ 130.255707][ T7588] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 130.256768][ T7585] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 130.277849][ T7588] EXT4-fs (loop3): orphan cleanup on readonly fs [ 130.289095][ T7588] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #16: comm syz.3.1206: corrupted inode contents [ 130.302002][ T7588] EXT4-fs (loop3): Remounting filesystem read-only [ 130.308880][ T7588] EXT4-fs (loop3): 1 truncate cleaned up [ 130.315498][ T3450] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 130.326127][ T3450] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 130.337220][ T3450] EXT4-fs (loop3): Quota write (off=8, len=24) cancelled because transaction is not started [ 130.426673][ T7605] FAULT_INJECTION: forcing a failure. [ 130.426673][ T7605] name failslab, interval 1, probability 0, space 0, times 0 [ 130.439500][ T7605] CPU: 0 UID: 0 PID: 7605 Comm: syz.0.1213 Not tainted syzkaller #0 PREEMPT(voluntary) [ 130.439527][ T7605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 130.439539][ T7605] Call Trace: [ 130.439546][ T7605] [ 130.439553][ T7605] __dump_stack+0x1d/0x30 [ 130.439578][ T7605] dump_stack_lvl+0xe8/0x140 [ 130.439618][ T7605] dump_stack+0x15/0x1b [ 130.439646][ T7605] should_fail_ex+0x265/0x280 [ 130.439666][ T7605] should_failslab+0x8c/0xb0 [ 130.439701][ T7605] kmem_cache_alloc_noprof+0x50/0x480 [ 130.439875][ T7605] ? getname_flags+0x80/0x3b0 [ 130.439913][ T7605] getname_flags+0x80/0x3b0 [ 130.439948][ T7605] do_sys_openat2+0x60/0x110 [ 130.440033][ T7605] __x64_sys_open+0xe6/0x110 [ 130.440057][ T7605] x64_sys_call+0x1457/0x3000 [ 130.440084][ T7605] do_syscall_64+0xd2/0x200 [ 130.440106][ T7605] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 130.440200][ T7605] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 130.440238][ T7605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.440264][ T7605] RIP: 0033:0x7fcd5390efc9 [ 130.440283][ T7605] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 130.440353][ T7605] RSP: 002b:00007fcd52377038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 130.440371][ T7605] RAX: ffffffffffffffda RBX: 00007fcd53b65fa0 RCX: 00007fcd5390efc9 [ 130.440384][ T7605] RDX: 0000000000000021 RSI: 0000000000066842 RDI: 0000000000000000 [ 130.440395][ T7605] RBP: 00007fcd52377090 R08: 0000000000000000 R09: 0000000000000000 [ 130.440407][ T7605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 130.440420][ T7605] R13: 00007fcd53b66038 R14: 00007fcd53b65fa0 R15: 00007ffc6e912878 [ 130.440450][ T7605] [ 130.657212][ T7606] loop3: detected capacity change from 0 to 1024 [ 130.684286][ T7606] EXT4-fs error (device loop3): ext4_acquire_dquot:6945: comm syz.3.1212: Failed to acquire dquot type 0 [ 130.700268][ T7606] EXT4-fs error (device loop3): mb_free_blocks:2017: group 0, inode 13: block 144:freeing already freed block (bit 9); block bitmap corrupt. [ 130.715182][ T7606] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #13: comm syz.3.1212: corrupted inode contents [ 130.737928][ T7606] EXT4-fs error (device loop3): ext4_dirty_inode:6517: inode #13: comm syz.3.1212: mark_inode_dirty error [ 130.788755][ T7606] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #13: comm syz.3.1212: corrupted inode contents [ 130.824822][ T7620] FAULT_INJECTION: forcing a failure. [ 130.824822][ T7620] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 130.838054][ T7620] CPU: 0 UID: 0 PID: 7620 Comm: syz.1.1216 Not tainted syzkaller #0 PREEMPT(voluntary) [ 130.838137][ T7620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 130.838149][ T7620] Call Trace: [ 130.838156][ T7620] [ 130.838164][ T7620] __dump_stack+0x1d/0x30 [ 130.838313][ T7620] dump_stack_lvl+0xe8/0x140 [ 130.838336][ T7620] dump_stack+0x15/0x1b [ 130.838353][ T7620] should_fail_ex+0x265/0x280 [ 130.838372][ T7620] should_fail+0xb/0x20 [ 130.838406][ T7620] should_fail_usercopy+0x1a/0x20 [ 130.838432][ T7620] _copy_to_user+0x20/0xa0 [ 130.838523][ T7620] simple_read_from_buffer+0xb5/0x130 [ 130.838548][ T7620] proc_fail_nth_read+0x10e/0x150 [ 130.838647][ T7620] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 130.838686][ T7620] vfs_read+0x1a8/0x770 [ 130.838742][ T7620] ? __rcu_read_unlock+0x4f/0x70 [ 130.838767][ T7620] ? __fget_files+0x184/0x1c0 [ 130.838829][ T7620] ksys_read+0xda/0x1a0 [ 130.838864][ T7620] __x64_sys_read+0x40/0x50 [ 130.838968][ T7620] x64_sys_call+0x27c0/0x3000 [ 130.838992][ T7620] do_syscall_64+0xd2/0x200 [ 130.839048][ T7620] ? arch_exit_to_user_mode_prepare+0x27/0x80 [ 130.839075][ T7620] ? irqentry_exit_to_user_mode+0x7b/0xa0 [ 130.839111][ T7620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.839134][ T7620] RIP: 0033:0x7f46452ed9dc [ 130.839149][ T7620] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 130.839187][ T7620] RSP: 002b:00007f4643d57030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 130.839211][ T7620] RAX: ffffffffffffffda RBX: 00007f4645545fa0 RCX: 00007f46452ed9dc [ 130.839225][ T7620] RDX: 000000000000000f RSI: 00007f4643d570a0 RDI: 0000000000000006 [ 130.839237][ T7620] RBP: 00007f4643d57090 R08: 0000000000000000 R09: 0000000000000000 [ 130.839249][ T7620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 130.839260][ T7620] R13: 00007f4645546038 R14: 00007f4645545fa0 R15: 00007ffff2f6d208 [ 130.839317][ T7620] [ 130.928619][ T7606] EXT4-fs error (device loop3): __ext4_ext_dirty:206: inode #13: comm syz.3.1212: mark_inode_dirty error [ 131.054227][ T7606] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #13: comm syz.3.1212: corrupted inode contents [ 131.066618][ T7606] EXT4-fs error (device loop3) in ext4_orphan_del:301: Corrupt filesystem [ 131.075542][ T7606] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #13: comm syz.3.1212: corrupted inode contents [ 131.087807][ T7606] EXT4-fs error (device loop3): ext4_truncate:4637: inode #13: comm syz.3.1212: mark_inode_dirty error [ 131.101146][ T7606] EXT4-fs error (device loop3) in ext4_process_orphan:343: Corrupt filesystem [ 131.112680][ T7606] EXT4-fs (loop3): 1 truncate cleaned up [ 131.120181][ T7606] EXT4-fs mount: 42 callbacks suppressed [ 131.120198][ T7606] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 131.139418][ T7606] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 131.190598][ T7634] lo speed is unknown, defaulting to 1000 [ 131.583496][ T7655] lo speed is unknown, defaulting to 1000 [ 131.636381][ T7655] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1228'. [ 131.696931][ T7660] lo speed is unknown, defaulting to 1000 [ 131.710046][ T7661] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1231'. [ 132.191970][ T7675] loop3: detected capacity change from 0 to 1024 [ 132.226449][ T7675] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 132.966457][ T7282] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 132.989555][ T7682] loop3: detected capacity change from 0 to 512 [ 133.004481][ T7682] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 133.012647][ T7682] EXT4-fs (loop3): orphan cleanup on readonly fs [ 133.020476][ T7682] EXT4-fs error (device loop3): ext4_do_update_inode:5632: inode #16: comm syz.3.1238: corrupted inode contents [ 133.033054][ T7682] EXT4-fs (loop3): Remounting filesystem read-only [ 133.039808][ T7682] EXT4-fs (loop3): 1 truncate cleaned up [ 133.045692][ T3450] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 133.056270][ T3450] EXT4-fs (loop3): Quota write (off=5120, len=1024) cancelled because transaction is not started [ 133.066905][ T3450] EXT4-fs (loop3): Quota write (off=8, len=24) cancelled because transaction is not started [ 133.078016][ T7682] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 133.091108][ T7682] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 133.504820][ T7691] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1241'. [ 133.523881][ T7691] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 133.531337][ T7691] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 133.554395][ T7691] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 133.559743][ T7696] loop5: detected capacity change from 0 to 1024 [ 133.561873][ T7691] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 133.582773][ T9] IPVS: starting estimator thread 0... [ 133.598402][ T7696] EXT4-fs error (device loop5): ext4_acquire_dquot:6945: comm syz.5.1242: Failed to acquire dquot type 0 [ 133.622843][ T7696] EXT4-fs error (device loop5): mb_free_blocks:2017: group 0, inode 13: block 144:freeing already freed block (bit 9); block bitmap corrupt. [ 133.671175][ T7696] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #13: comm syz.5.1242: corrupted inode contents [ 133.673841][ T7698] IPVS: using max 2400 ests per chain, 120000 per kthread [ 133.753076][ T7696] EXT4-fs error (device loop5): ext4_dirty_inode:6517: inode #13: comm syz.5.1242: mark_inode_dirty error [ 133.779867][ T7696] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #13: comm syz.5.1242: corrupted inode contents [ 133.793679][ T7696] EXT4-fs error (device loop5): __ext4_ext_dirty:206: inode #13: comm syz.5.1242: mark_inode_dirty error [ 133.824379][ T7706] can: request_module (can-proto-0) failed. [ 133.825132][ T7696] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #13: comm syz.5.1242: corrupted inode contents [ 133.842829][ T7696] EXT4-fs error (device loop5) in ext4_orphan_del:301: Corrupt filesystem [ 133.852906][ T7696] EXT4-fs error (device loop5): ext4_do_update_inode:5632: inode #13: comm syz.5.1242: corrupted inode contents [ 133.893973][ T7696] EXT4-fs error (device loop5): ext4_truncate:4637: inode #13: comm syz.5.1242: mark_inode_dirty error [ 133.953104][ T7696] EXT4-fs error (device loop5) in ext4_process_orphan:343: Corrupt filesystem [ 133.964596][ T7722] loop1: detected capacity change from 0 to 2048 [ 133.972990][ T7696] EXT4-fs (loop5): 1 truncate cleaned up [ 133.979872][ T7696] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 133.993443][ T7720] loop2: detected capacity change from 0 to 1024 [ 134.000544][ T7720] ext4: Unknown parameter 'appraise' [ 134.000900][ T7722] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 134.025456][ T7696] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.083066][ T7728] loop3: detected capacity change from 0 to 2048 [ 134.101055][ T7730] ================================================================== [ 134.109202][ T7730] BUG: KCSAN: data-race in __xa_set_mark / xas_find_marked [ 134.116441][ T7730] [ 134.118780][ T7730] read-write to 0xffff88811a13c900 of 8 bytes by task 7722 on cpu 1: [ 134.126856][ T7730] __xa_set_mark+0xd2/0x1a0 [ 134.131397][ T7730] __folio_mark_dirty+0x384/0x4a0 [ 134.136462][ T7730] mark_buffer_dirty+0x11e/0x210 [ 134.141444][ T7730] folio_zero_new_buffers+0x28c/0x2e0 [ 134.146865][ T7730] block_write_end+0x200/0x210 [ 134.146903][ T7728] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 134.151669][ T7730] ext4_da_write_end+0x1d3/0x800 [ 134.151705][ T7730] generic_perform_write+0x312/0x490 [ 134.173921][ T7730] ext4_buffered_write_iter+0x1ee/0x3c0 [ 134.179511][ T7730] ext4_file_write_iter+0x387/0xf60 [ 134.184742][ T7730] vfs_write+0x52a/0x960 [ 134.189020][ T7730] ksys_write+0xda/0x1a0 [ 134.193304][ T7730] __x64_sys_write+0x40/0x50 [ 134.197928][ T7730] x64_sys_call+0x2802/0x3000 [ 134.202624][ T7730] do_syscall_64+0xd2/0x200 [ 134.207151][ T7730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.213075][ T7730] [ 134.215418][ T7730] read to 0xffff88811a13c900 of 8 bytes by task 7730 on cpu 0: [ 134.222983][ T7730] xas_find_marked+0x218/0x620 [ 134.227780][ T7730] find_get_entry+0x5d/0x380 [ 134.232395][ T7730] filemap_get_folios_tag+0x13b/0x210 [ 134.237800][ T7730] mpage_prepare_extent_to_map+0x320/0xc00 [ 134.243636][ T7730] ext4_do_writepages+0xa05/0x2750 [ 134.248778][ T7730] ext4_writepages+0x176/0x300 [ 134.253565][ T7730] do_writepages+0x1c6/0x310 [ 134.258187][ T7730] __filemap_fdatawrite_range+0xfb/0x140 [ 134.263846][ T7730] generic_fadvise+0x312/0x430 [ 134.268649][ T7730] __x64_sys_fadvise64+0xcb/0x110 [ 134.273705][ T7730] x64_sys_call+0x29c5/0x3000 [ 134.278412][ T7730] do_syscall_64+0xd2/0x200 [ 134.282943][ T7730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.288864][ T7730] [ 134.291194][ T7730] value changed: 0x00000003ffffffff -> 0x0000000fffffffff [ 134.298328][ T7730] [ 134.300664][ T7730] Reported by Kernel Concurrency Sanitizer on: [ 134.306834][ T7730] CPU: 0 UID: 0 PID: 7730 Comm: syz.1.1250 Not tainted syzkaller #0 PREEMPT(voluntary) [ 134.316593][ T7730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 134.326682][ T7730] ================================================================== [ 134.405660][ T7730] EXT4-fs error (device loop1): ext4_validate_block_bitmap:441: comm syz.1.1250: bg 0: block 345: padding at end of block bitmap is not set [ 134.421252][ T7730] EXT4-fs (loop1): Remounting filesystem read-only [ 134.428032][ T3450] EXT4-fs warning (device loop1): ext4_convert_unwritten_extents:4984: inode #15: block 1: len 15: ext4_ext_map_blocks returned -30 [ 134.442106][ T7733] EXT4-fs error (device loop3): ext4_validate_block_bitmap:441: comm syz.3.1251: bg 0: block 345: padding at end of block bitmap is not set [ 134.456706][ T7733] EXT4-fs (loop3): Remounting filesystem read-only [ 134.463396][ T37] EXT4-fs warning (device loop3): ext4_convert_unwritten_extents:4984: inode #15: block 1: len 15: ext4_ext_map_blocks returned -30 [ 134.545105][ T3313] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.555102][ T7282] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.